sandboxedjs 0.1.6 → 0.1.7

package/README.md

@@ -607,6 +607,30 @@ Those three use dynamic imports, so they only fail if you call them.
 removed and the seam is there, but treat browser support as "should work, unproven" rather than
 a tested claim.
 
+## Uploading files
+
+A file picker in a browser never hands over a path — it hands over the file's bytes. So getting a
+picked file into the container is an ordinary write, and there is nothing to mirror from the host
+disk.
+
+Two ways in, both byte-exact:
+
+```js
+// 1. Directly, when your own server received the upload.
+await box.fs.writeFile("/workspace/uploads/clip.mp4", bytes);   // creates missing directories
+```
+
+```js
+// 2. Through a server running inside the container — a picker in the previewed
+//    app posting to its own backend. Publish the port and upload normally.
+const bridge = await box.expose(3000);
+await fetch(`${bridge.url}/api/upload`, { method: "POST", body: file });
+```
+
+Either way the file lands on the container's filesystem, and `ffmpeg`, Node and Python all see the
+same bytes. Uploads are held in memory like the rest of the filesystem, so a very large video is
+bounded by RAM.
+
 ## Video and audio
 
 `ffmpeg` and `ffprobe` are FFmpeg 5.1 compiled to WebAssembly, mounted on the container's own
@@ -652,25 +676,6 @@ Honest list of what does not work:
   This affects older toolchains — Vite 4 and its contemporaries. Current Vite ships its Rust
   pipeline as WebAssembly and runs fine, dev server included, as do Express, Koa, Fastify-style
   apps and plain `http` servers.
-- **HTTP request bodies into the container are text, not bytes.** Nodepod decodes a request body
-  as UTF-8 on its way to an in-container server, so any byte above `0x7f` is replaced: five bytes
-  containing `0x89` and `0xff` arrive as nine. Uploading a JPEG or an MP4 by POSTing it to a
-  server running inside the sandbox produces a file of roughly the right size that will not open,
-  and reports no error. This affects `box.request()`, `box.expose()` and the request proxy alike.
-
-  Write the file instead — `box.fs.writeFile(path, bytes)` takes a `Uint8Array` and is exact,
-  which the binary round-trip tests assert byte for byte. To accept an upload from a browser,
-  receive it in *your* server and write the bytes into the container:
-
-  ```js
-  // Express on the host, sandboxedjs holding the workspace.
-  app.post("/upload", async (req, res) => {
-    await box.fs.writeFile(`/workspace/uploads/${req.file.originalname}`, req.file.buffer);
-    res.json({ ok: true });
-  });
-  ```
-
-  Text bodies — JSON APIs, form fields, GraphQL — are unaffected.
 - **Python is MicroPython**, so C extensions (`numpy`, `pandas`, `cryptography`) are unavailable.
 - **No real sockets.** HTTP servers work through the request proxy; raw TCP/UDP does not.
 - **No real processes.** Processes are cooperative async tasks: `kill -9` cannot interrupt a

package/dist/index.cjs

@@ -23981,14 +23981,17 @@ var Container = class _Container {
   /** Send an HTTP request to a server running inside the container. */
   async request(port, init = {}) {
     this.assertActive();
-    const res = await this.pod.request(port, {
+    const res = await this.dispatchBinary(port, init) ?? await this.pod.request(port, {
       method: init.method ?? "GET",
       path: init.path ?? "/",
       headers: init.headers ?? {},
       body: init.body ?? null
     });
     const bodyRaw = res.body;
-    const bytes = bodyRaw instanceof Uint8Array ? bodyRaw : typeof bodyRaw === "string" ? new TextEncoder().encode(bodyRaw) : new Uint8Array(0);
+    const bytes = bodyRaw instanceof Uint8Array ? bodyRaw : (
+      // The binary dispatcher answers with an ArrayBuffer.
+      bodyRaw instanceof ArrayBuffer ? new Uint8Array(bodyRaw) : typeof bodyRaw === "string" ? new TextEncoder().encode(bodyRaw) : new Uint8Array(0)
+    );
     const body = typeof bodyRaw === "string" ? bodyRaw : new TextDecoder().decode(bytes);
     return {
       status: res.statusCode ?? 200,
@@ -24001,6 +24004,40 @@ var Container = class _Container {
       }
     };
   }
+  /**
+   * Deliver a request whose body is bytes, without letting them become text.
+   *
+   * Nodepod's public `request()` runs the body through `toString("utf8")` on
+   * its way in, so anything above `0x7f` is replaced: a five-byte payload
+   * containing `0x89` and `0xff` arrives as nine. That silently destroys every
+   * upload — an image or a video reaches the server the wrong size and no
+   * longer decodes, with no error raised anywhere.
+   *
+   * Its own dispatcher one layer down does preserve bytes, so a binary body
+   * goes straight there. This reaches past the published surface deliberately,
+   * so it is written to fail soft: any shape it does not recognise returns
+   * `null` and the caller falls back to the ordinary path, which is exactly
+   * the behaviour that existed before. Text bodies never come through here.
+   */
+  async dispatchBinary(port, init) {
+    if (!(init.body instanceof Uint8Array)) return null;
+    const manager = this.pod._processManager;
+    const dispatch = manager?.dispatchHttpRequest;
+    if (typeof dispatch !== "function") return null;
+    try {
+      const response = await dispatch.call(
+        manager,
+        port,
+        init.method ?? "GET",
+        init.path ?? "/",
+        init.headers ?? {},
+        init.body
+      );
+      return response ?? null;
+    } catch {
+      return null;
+    }
+  }
   /** Wait until something inside the container answers on `port`. */
   waitForPort(port, opts = {}) {
     return this.net.waitForPort(port, opts);