sandboxedjs 0.1.53 → 0.1.55

package/dist/index.cjs

@@ -17804,7 +17804,20 @@ var Op = {
   getcwd: 1281,
   chdir: 1282,
   environ: 1283,
-  getrandom: 1536
+  getrandom: 1536,
+  socket: 1792,
+  bind: 1793,
+  listen: 1794,
+  accept: 1795,
+  connect: 1796,
+  send: 1797,
+  recv: 1798,
+  shutdown: 1799,
+  getsockname: 1800,
+  getpeername: 1801,
+  setsockopt: 1802,
+  getsockopt: 1803,
+  socket_close: 1804
 };
 var Errno = {
   EPERM: 1,
@@ -17841,6 +17854,15 @@ var Errno = {
   ENOTEMPTY: 39,
   ELOOP: 40,
   ENODATA: 61,
+  ENOTSOCK: 88,
+  EAFNOSUPPORT: 97,
+  EADDRINUSE: 98,
+  EADDRNOTAVAIL: 99,
+  ENETUNREACH: 101,
+  ECONNRESET: 104,
+  EISCONN: 106,
+  ENOTCONN: 107,
+  ECONNREFUSED: 111,
   EPROTO: 71,
   EOVERFLOW: 75,
   ETIMEDOUT: 110,
@@ -18706,6 +18728,362 @@ function failure(errno) {
   return -Math.abs(errno);
 }
 
+// src/net/virtual-socket.ts
+var ByteQueue = class {
+  chunks = [];
+  length = 0;
+  waiters = /* @__PURE__ */ new Set();
+  push(bytes2) {
+    if (bytes2.length === 0) return;
+    const copy = bytes2.slice();
+    this.chunks.push(copy);
+    this.length += copy.length;
+    this.wake();
+  }
+  take(max) {
+    if (max <= 0 || this.length === 0) return new Uint8Array();
+    const out = new Uint8Array(Math.min(max, this.length));
+    let at = 0;
+    while (at < out.length) {
+      const chunk = this.chunks[0];
+      const count = Math.min(chunk.length, out.length - at);
+      out.set(chunk.subarray(0, count), at);
+      at += count;
+      this.length -= count;
+      if (count === chunk.length) this.chunks.shift();
+      else this.chunks[0] = chunk.subarray(count);
+    }
+    return out;
+  }
+  get size() {
+    return this.length;
+  }
+  whenChanged() {
+    return new Promise((resolve3) => this.waiters.add(resolve3));
+  }
+  wake() {
+    for (const resolve3 of this.waiters) resolve3();
+    this.waiters.clear();
+  }
+};
+var VirtualTcpConnection = class {
+  incoming = new ByteQueue();
+  peer = null;
+  readClosed = false;
+  writeClosed = false;
+  closed = false;
+  local;
+  remote;
+  constructor(local, remote) {
+    this.local = local;
+    this.remote = remote;
+  }
+  pairWith(peer) {
+    this.peer = peer;
+  }
+  get eof() {
+    return this.readClosed || this.incoming.size === 0 && this.peer?.writeClosed === true;
+  }
+  get readable() {
+    return this.incoming.size > 0 || this.eof;
+  }
+  get writable() {
+    return !this.writeClosed && !this.closed && this.peer !== null && !this.peer.readClosed;
+  }
+  read(maxLength) {
+    if (this.incoming.size > 0) return this.incoming.take(maxLength);
+    if (this.eof) return new Uint8Array();
+    throw new PosixError(Errno.EAGAIN, "socket read would block");
+  }
+  write(bytes2) {
+    if (!this.writable) throw new PosixError(this.closed || this.writeClosed ? Errno.EPIPE : Errno.ECONNRESET);
+    this.peer.incoming.push(bytes2);
+    return bytes2.length;
+  }
+  async waitForChange() {
+    if (this.readable || this.closed) return;
+    await this.incoming.whenChanged();
+  }
+  shutdown(read, write) {
+    if (read) this.readClosed = true;
+    if (write) {
+      this.writeClosed = true;
+      if (this.peer) this.peer.incoming.wake();
+    }
+    this.incoming.wake();
+    this.peer?.incoming.wake();
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.readClosed = true;
+    this.writeClosed = true;
+    if (this.peer) {
+      this.peer.readClosed = true;
+      this.peer.incoming.wake();
+    }
+    this.incoming.wake();
+  }
+};
+var VirtualTcpListener = class {
+  constructor(port, address = "0.0.0.0", backlog = 128) {
+    this.port = port;
+    this.address = address;
+    this.backlog = backlog;
+  }
+  port;
+  address;
+  backlog;
+  pending = [];
+  waiters = /* @__PURE__ */ new Set();
+  closed = false;
+  enqueue(connection) {
+    if (this.closed) {
+      connection.close();
+      throw new PosixError(Errno.ECONNREFUSED, "listener is closed");
+    }
+    if (this.pending.length >= this.backlog) {
+      connection.close();
+      throw new PosixError(Errno.EAGAIN, "listener backlog is full");
+    }
+    this.pending.push(connection);
+    this.wake();
+  }
+  accept() {
+    const connection = this.pending.shift();
+    if (!connection) {
+      if (this.closed) throw new PosixError(Errno.EBADF, "listener is closed");
+      throw new PosixError(Errno.EAGAIN, "listener accept would block");
+    }
+    return { connection, peer: connection.remote };
+  }
+  get readable() {
+    return this.pending.length > 0 || this.closed;
+  }
+  get isClosed() {
+    return this.closed;
+  }
+  async waitForChange() {
+    if (this.readable) return;
+    await new Promise((resolve3) => this.waiters.add(resolve3));
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    for (const connection of this.pending.splice(0)) connection.close();
+    this.wake();
+  }
+  wake() {
+    for (const resolve3 of this.waiters) resolve3();
+    this.waiters.clear();
+  }
+};
+var VirtualTcpSocket = class _VirtualTcpSocket {
+  constructor(network) {
+    this.network = network;
+  }
+  network;
+  listenerValue = null;
+  connectionValue = null;
+  boundPort = 0;
+  boundAddress = "0.0.0.0";
+  bind(address, port) {
+    if (this.listenerValue || this.connectionValue || this.boundPort !== 0) {
+      throw new PosixError(Errno.EINVAL, "socket is already bound");
+    }
+    this.boundAddress = address;
+    this.boundPort = port;
+  }
+  listen(backlog) {
+    if (this.listenerValue) return;
+    if (this.boundPort === 0) {
+      const port = this.findEphemeralPort();
+      this.boundPort = port;
+    }
+    this.listenerValue = this.network.listen(this.boundPort, this.boundAddress, backlog);
+  }
+  connect(port, address = "127.0.0.1") {
+    if (this.listenerValue || this.connectionValue) throw new PosixError(Errno.EISCONN);
+    this.connectionValue = this.network.connect(port, this.boundPort, this.boundAddress);
+    this.boundPort = this.connectionValue.local.port;
+    this.boundAddress = this.connectionValue.local.address;
+  }
+  accept() {
+    if (!this.listenerValue) throw new PosixError(Errno.EINVAL, "socket is not listening");
+    const accepted = this.listenerValue.accept().connection;
+    const socket = new _VirtualTcpSocket(this.network);
+    socket.connectionValue = accepted;
+    socket.boundPort = accepted.local.port;
+    socket.boundAddress = accepted.local.address;
+    return socket;
+  }
+  get listener() {
+    return this.listenerValue;
+  }
+  get connection() {
+    return this.connectionValue;
+  }
+  get local() {
+    return { address: this.boundAddress, port: this.boundPort };
+  }
+  get remote() {
+    return this.connectionValue?.remote ?? null;
+  }
+  get readable() {
+    return this.listenerValue?.readable ?? this.connectionValue?.readable ?? false;
+  }
+  get writable() {
+    return this.connectionValue?.writable ?? false;
+  }
+  waitForChange() {
+    return (this.listenerValue ?? this.connectionValue)?.waitForChange() ?? Promise.resolve();
+  }
+  read(length) {
+    if (!this.connectionValue) throw new PosixError(Errno.EINVAL);
+    return this.connectionValue.read(length);
+  }
+  write(data) {
+    if (!this.connectionValue) throw new PosixError(Errno.EINVAL);
+    return this.connectionValue.write(data);
+  }
+  shutdown(read, write) {
+    if (!this.connectionValue) throw new PosixError(Errno.ENOTCONN);
+    this.connectionValue.shutdown(read, write);
+  }
+  close() {
+    if (this.listenerValue) this.network.close(this.listenerValue);
+    this.connectionValue?.close();
+    this.listenerValue = null;
+    this.connectionValue = null;
+  }
+  findEphemeralPort() {
+    for (let port = 49152; port <= 65535; port += 1) if (!this.network.hasListener(port)) return port;
+    throw new PosixError(Errno.EADDRINUSE, "no ephemeral ports available");
+  }
+};
+var SocketDescription = class _SocketDescription {
+  kind = "socket";
+  flags;
+  resource;
+  closed = false;
+  options = /* @__PURE__ */ new Map();
+  constructor(resource, flags = 0) {
+    this.resource = resource;
+    this.flags = flags;
+  }
+  get listener() {
+    return this.resource.listener;
+  }
+  get connection() {
+    return this.resource.connection;
+  }
+  read(length) {
+    return this.resource.read(length);
+  }
+  write(data) {
+    return this.resource.write(data);
+  }
+  readable() {
+    return this.resource.readable;
+  }
+  writable() {
+    return this.resource.writable;
+  }
+  whenReady() {
+    return this.resource.waitForChange();
+  }
+  stat() {
+    return {
+      ino: 0,
+      mode: 49663,
+      size: 0,
+      uid: 0,
+      gid: 0,
+      nlink: 1,
+      atimeMs: Date.now(),
+      mtimeMs: Date.now(),
+      ctimeMs: Date.now()
+    };
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.resource.close();
+  }
+  bind(address, port) {
+    this.resource.bind(address, port);
+  }
+  listen(backlog) {
+    this.resource.listen(backlog);
+  }
+  connect(address, port) {
+    this.resource.connect(port, address);
+  }
+  accept() {
+    return new _SocketDescription(this.resource.accept(), this.flags);
+  }
+  shutdown(read, write) {
+    this.resource.shutdown(read, write);
+  }
+  setOption(level, option, value) {
+    this.options.set(`${level}:${option}`, value.slice());
+  }
+  getOption(level, option) {
+    return this.options.get(`${level}:${option}`)?.slice() ?? new Uint8Array(4);
+  }
+  localAddress() {
+    return this.resource.local;
+  }
+  peerAddress() {
+    const peer = this.resource.remote;
+    if (!peer) throw new PosixError(Errno.ENOTCONN);
+    return peer;
+  }
+};
+var VirtualTcpNetwork = class {
+  constructor(occupied) {
+    this.occupied = occupied;
+  }
+  occupied;
+  listeners = /* @__PURE__ */ new Map();
+  listen(port, address = "0.0.0.0", backlog = 128) {
+    if (this.listeners.has(port) || this.occupied?.(port)) throw new PosixError(Errno.EADDRINUSE, `port ${port} is already in use`);
+    const listener = new VirtualTcpListener(port, address, backlog);
+    this.listeners.set(port, listener);
+    return listener;
+  }
+  close(listener) {
+    if (this.listeners.get(listener.port) !== listener) return;
+    this.listeners.delete(listener.port);
+    listener.close();
+  }
+  connect(port, localPort = 0, localAddress = "127.0.0.1") {
+    const listener = this.listeners.get(port);
+    if (!listener || listener.isClosed) throw new PosixError(Errno.ECONNREFUSED, `port ${port} is not listening`);
+    const client = new VirtualTcpConnection(
+      { address: localAddress, port: localPort },
+      { address: listener.address, port }
+    );
+    const server = new VirtualTcpConnection(
+      { address: listener.address, port },
+      { address: localAddress, port: localPort }
+    );
+    client.pairWith(server);
+    server.pairWith(client);
+    listener.enqueue(server);
+    return client;
+  }
+  hasListener(port) {
+    return this.listeners.has(port);
+  }
+  ports() {
+    return [...this.listeners.keys()].sort((a, b) => a - b);
+  }
+  closeAll() {
+    for (const listener of [...this.listeners.values()]) this.close(listener);
+  }
+};
+
 // src/runtime/python/syscall-server.ts
 var MAX_TRANSFER = 8 * 1024 * 1024;
 function createHostAbiServer(proc) {
@@ -18952,12 +19330,76 @@ function createHostAbiServer(proc) {
         crypto.getRandomValues(bytes2);
         return { status: length, payload: bytes2 };
       }
+      /* ----------------------------------------------------------- sockets */
+      case Op.socket: {
+        const family = r.u32();
+        const type = r.u32();
+        const protocol = r.i32();
+        if (family !== 2 || (type & 15) !== 1 || protocol !== 0) throw new PosixError(Errno.EAFNOSUPPORT);
+        if (!proc.sockets) throw new PosixError(Errno.ENOSYS);
+        return { status: proc.table.add(new SocketDescription(new VirtualTcpSocket(proc.sockets))) };
+      }
+      case Op.bind: {
+        const description = socketDescription(proc.table.get(r.i32()));
+        description.bind(r.string(), r.u32());
+        return { status: 0 };
+      }
+      case Op.listen: {
+        const description = socketDescription(proc.table.get(r.i32()));
+        description.listen(Math.max(1, Math.min(1024, r.u32())));
+        return { status: 0 };
+      }
+      case Op.accept: {
+        const description = socketDescription(proc.table.get(r.i32()));
+        const accepted = await acceptBlocking(description);
+        const fd = proc.table.add(accepted);
+        const peer = accepted.peerAddress();
+        return { status: fd, payload: new Writer().string(peer.address).u32(peer.port).finish() };
+      }
+      case Op.connect: {
+        const description = socketDescription(proc.table.get(r.i32()));
+        description.connect(r.string(), r.u32());
+        return { status: 0 };
+      }
+      case Op.send: {
+        const description = socketDescription(proc.table.get(r.i32()));
+        return { status: await writeBlocking(description, r.bytes32()) };
+      }
+      case Op.recv: {
+        const description = socketDescription(proc.table.get(r.i32()));
+        const data = await readBlocking(description, clamp(r.u32()));
+        return { status: data.length, payload: data };
+      }
+      case Op.shutdown: {
+        const description = socketDescription(proc.table.get(r.i32()));
+        const how = r.u32();
+        if (how > 2) throw new PosixError(Errno.EINVAL);
+        description.shutdown(how === 0 || how === 2, how === 1 || how === 2);
+        return { status: 0 };
+      }
+      case Op.getsockname: {
+        const address = socketDescription(proc.table.get(r.i32())).localAddress();
+        return { status: 0, payload: new Writer().string(address.address).u32(address.port).finish() };
+      }
+      case Op.getpeername: {
+        const address = socketDescription(proc.table.get(r.i32())).peerAddress();
+        return { status: 0, payload: new Writer().string(address.address).u32(address.port).finish() };
+      }
+      case Op.setsockopt: {
+        const description = socketDescription(proc.table.get(r.i32()));
+        description.setOption(r.u32(), r.u32(), r.bytes32());
+        return { status: 0 };
+      }
+      case Op.getsockopt: {
+        const description = socketDescription(proc.table.get(r.i32()));
+        return { status: 0, payload: new Writer().bytes32(description.getOption(r.u32(), r.u32())).finish() };
+      }
       default:
         return { status: failure(Errno.ENOSYS) };
     }
   }
   function implemented(capability) {
-    return ["files", "descriptors", "pipes", "readiness", "time", "identity", "entropy"].includes(capability);
+    return ["files", "descriptors", "pipes", "readiness", "time", "identity", "entropy"].includes(capability) || capability === "sockets" && proc.sockets !== void 0;
   }
   function resolve3(path) {
     if (path.startsWith("/")) return proc.vfs.resolvePath(path);
@@ -18966,6 +19408,22 @@ function createHostAbiServer(proc) {
   function clamp(length) {
     return Math.min(length, MAX_TRANSFER);
   }
+  function socketDescription(description) {
+    if (!(description instanceof SocketDescription)) throw new PosixError(Errno.ENOTSOCK, "descriptor is not a socket");
+    return description;
+  }
+  async function acceptBlocking(description) {
+    for (; ; ) {
+      try {
+        return description.accept();
+      } catch (error) {
+        const posix = toPosixError(error);
+        if (posix.errno !== Errno.EAGAIN || description.flags & O_NONBLOCK) throw posix;
+      }
+      await Promise.race([description.whenReady(), aborted()]);
+      if (proc.signal.aborted) throw new PosixError(Errno.EINTR);
+    }
+  }
   async function readBlocking(description, length) {
     for (; ; ) {
       try {
@@ -19232,7 +19690,8 @@ async function startPythonProcess(options) {
     table,
     env: options.env,
     cwd: options.cwd,
-    signal: controller.signal
+    signal: controller.signal,
+    sockets: options.sockets
   });
   const buffers = createHostTransportBuffers();
   let fault = null;
@@ -19839,7 +20298,8 @@ async function runOwnedPython(ctx, argv) {
     mounts,
     onStdout: (data) => ctx.stdout.write(data),
     onStderr: (data) => ctx.stderr.write(data),
-    signal: ctx.signal
+    signal: ctx.signal,
+    sockets: ctx.kernel.pod.sockets
   });
   void pumpStdin(ctx, process2);
   return process2.wait();
@@ -26145,12 +26605,16 @@ var VirtualHttpServer = class extends EventEmitter4__default.default {
   }
 };
 var VirtualHttpRouter = class {
+  constructor(sockets) {
+    this.sockets = sockets;
+  }
+  sockets;
   servers = /* @__PURE__ */ new Map();
   /** Notified when a server begins listening, for `onServerReady`. */
   onListen;
   onClose;
   register(port, server, owner) {
-    if (this.servers.has(port)) throw Object.assign(new Error(`listen EADDRINUSE: address already in use 0.0.0.0:${port}`), { code: "EADDRINUSE", port });
+    if (this.servers.has(port) || this.sockets?.hasListener(port)) throw Object.assign(new Error(`listen EADDRINUSE: address already in use 0.0.0.0:${port}`), { code: "EADDRINUSE", port });
     this.servers.set(port, { server, owner });
     this.onListen?.(port);
   }
@@ -29734,8 +30198,9 @@ var LocalRuntimePod = class _LocalRuntimePod {
   volume = new MirroringVolume(new MemoryVolume());
   packages;
   instanceId = `sbx-${Math.random().toString(36).slice(2)}`;
-  router = new VirtualHttpRouter();
-  proxy = { activePorts: (_instanceId) => this.router.activePorts() };
+  router;
+  sockets;
+  proxy = { activePorts: (_instanceId) => [.../* @__PURE__ */ new Set([...this.router.activePorts(), ...this.sockets.ports()])].sort((a, b) => a - b) };
   /**
    * Bind a port to a server that is not a JavaScript one.
    *
@@ -29802,6 +30267,8 @@ var LocalRuntimePod = class _LocalRuntimePod {
   fetch;
   constructor(options) {
     ensureProcessGlobal();
+    this.sockets = new VirtualTcpNetwork((port) => this.router.activePortsIncludes(port));
+    this.router = new VirtualHttpRouter(this.sockets);
     this.workdir = options.workdir ?? "/";
     this.env = { ...options.env };
     this.aliases = { ...WASM_ALIASES, ...options.aliases };
@@ -29935,8 +30402,10 @@ var LocalRuntimePod = class _LocalRuntimePod {
       await new Promise((resolve3) => setTimeout(resolve3, busy ? 5 : 0));
     }
   }
-  async request(_port, _init = {}) {
-    return this.router.request(_port, _init);
+  async request(port, init = {}) {
+    if (this.router.activePortsIncludes(port)) return this.router.request(port, init);
+    if (!this.sockets.hasListener(port)) return this.router.request(port, init);
+    return this.requestTcp(port, init);
   }
   connect(port, init, peer) {
     return this.router.connect(port, init, peer);
@@ -29955,8 +30424,46 @@ var LocalRuntimePod = class _LocalRuntimePod {
     for (const process2 of this.running) process2.kill();
     this.running.clear();
     this.router.closeAll();
+    this.sockets.closeAll();
     this.esbuild?.stop();
   }
+  /** HTTP/1.1 client path for a server implemented outside the JS runtime. */
+  async requestTcp(port, init) {
+    const connection = this.sockets.connect(port);
+    const method = String(init.method ?? "GET").toUpperCase();
+    const path = String(init.path ?? "/");
+    const body = init.body == null ? new Uint8Array() : typeof init.body === "string" ? new TextEncoder().encode(init.body) : init.body instanceof ArrayBuffer ? new Uint8Array(init.body) : init.body;
+    const headers = Object.entries(init.headers ?? {}).map(([name, value]) => `${name}: ${String(value)}`);
+    if (!headers.some((line) => line.toLowerCase().startsWith("host:"))) headers.push("Host: localhost");
+    if (!headers.some((line) => line.toLowerCase().startsWith("connection:"))) headers.push("Connection: close");
+    if (body.length && !headers.some((line) => line.toLowerCase().startsWith("content-length:"))) headers.push(`Content-Length: ${body.length}`);
+    const request = new TextEncoder().encode(`${method} ${path} HTTP/1.1\r
+${headers.join("\r\n")}\r
+\r
+`);
+    connection.write(request);
+    if (body.length) connection.write(body);
+    const bytes2 = [];
+    let combined = new Uint8Array();
+    for (; ; ) {
+      try {
+        const chunk = connection.read(64 * 1024);
+        if (chunk.length === 0) break;
+        bytes2.push(chunk);
+        combined = joinBytes(bytes2);
+        const headerEnd = findBytes(combined, new Uint8Array([13, 10, 13, 10]));
+        if (headerEnd < 0) continue;
+        const headerText = new TextDecoder().decode(combined.subarray(0, headerEnd));
+        const contentLength = /^content-length:\s*(\d+)\s*$/im.exec(headerText)?.[1];
+        if (contentLength !== void 0 && combined.length >= headerEnd + 4 + Number(contentLength)) break;
+      } catch (error) {
+        if (!(error instanceof PosixError) || error.errno !== Errno.EAGAIN) throw error;
+        await connection.waitForChange();
+      }
+    }
+    connection.close();
+    return parseHttpResponse(combined);
+  }
   seed(files) {
     for (const [path, data] of Object.entries(files)) {
       const parts = path.split("/").filter(Boolean);
@@ -29988,6 +30495,43 @@ function formatError(error) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function joinBytes(parts) {
+  const total = parts.reduce((sum, part) => sum + part.length, 0);
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const part of parts) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+}
+function findBytes(haystack, needle) {
+  outer: for (let at = 0; at <= haystack.length - needle.length; at += 1) {
+    for (let i = 0; i < needle.length; i += 1) if (haystack[at + i] !== needle[i]) continue outer;
+    return at;
+  }
+  return -1;
+}
+function parseHttpResponse(bytes2) {
+  const marker = new Uint8Array([13, 10, 13, 10]);
+  const headerEnd = findBytes(bytes2, marker);
+  if (headerEnd < 0) throw new Error("Python server returned an incomplete HTTP response");
+  const text2 = new TextDecoder().decode(bytes2.subarray(0, headerEnd));
+  const lines = text2.split("\r\n");
+  const status = /HTTP\/\d\.\d\s+(\d+)(?:\s+(.*))?/.exec(lines.shift() ?? "");
+  if (!status) throw new Error("Python server returned an invalid HTTP status line");
+  const headers = {};
+  for (const line of lines) {
+    const separator = line.indexOf(":");
+    if (separator > 0) headers[line.slice(0, separator).toLowerCase()] = line.slice(separator + 1).trim();
+  }
+  return {
+    statusCode: Number(status[1]),
+    statusMessage: status[2] ?? "",
+    headers,
+    body: bytes2.slice(headerEnd + marker.length)
+  };
+}
 function packageIsInstalled(volume, cwd, wanted) {
   for (let dir3 = clean(cwd); ; dir3 = dirname(dir3)) {
     if (packageTreeContains(volume, join(dir3, "node_modules"), wanted, /* @__PURE__ */ new Set())) return true;