sandboxedjs 0.1.67 → 0.1.69

package/dist/index.js

@@ -489,6 +489,9 @@ function normalizeSignal(spec) {
   const withPrefix = upper.startsWith("SIG") ? upper : "SIG" + upper;
   return withPrefix in SIGNALS ? withPrefix : null;
 }
+function signalNumber(name) {
+  return SIGNALS[name] ?? 0;
+}
 function exitCodeForSignal(sig) {
   return 128 + (SIGNALS[sig] ?? 0);
 }
@@ -17800,7 +17803,10 @@ var Op = {
   getpeername: 1801,
   setsockopt: 1802,
   getsockopt: 1803,
-  socket_close: 1804
+  socket_close: 1804,
+  spawn: 2048,
+  waitpid: 2049,
+  kill: 2050
 };
 var Errno = {
   EPERM: 1,
@@ -17811,6 +17817,7 @@ var Errno = {
   ENXIO: 6,
   E2BIG: 7,
   EBADF: 9,
+  ECHILD: 10,
   EAGAIN: 11,
   ENOMEM: 12,
   EACCES: 13,
@@ -17946,7 +17953,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.1.67"};
+  version: "0.1.69"};
 
 // src/runtime/python/config.ts
 var bundledManifest = {
@@ -18491,6 +18498,9 @@ function toPosixError(error) {
   };
   return new PosixError(code && mapped[code] ? mapped[code] : Errno.EIO, message);
 }
+
+// src/runtime/python/backend.ts
+init_signals();
 var DescriptorTable = class _DescriptorTable {
   slots = /* @__PURE__ */ new Map();
   /** Descriptions this table shares with others, so close counts correctly. */
@@ -19384,6 +19394,46 @@ function createHostAbiServer(proc) {
         const joined = Object.entries(proc.env).map(([key, value]) => `${key}=${value}`).join("\0");
         return { status: 0, payload: new Writer().string(joined).finish() };
       }
+      /* --------------------------------------------------------- processes */
+      case Op.spawn: {
+        const argv = [];
+        for (let i = 0, n = r.u32(); i < n; i++) argv.push(r.string());
+        const env2 = {};
+        for (let i = 0, n = r.u32(); i < n; i++) {
+          const entry = r.string();
+          const split2 = entry.indexOf("=");
+          if (split2 > 0) env2[entry.slice(0, split2)] = entry.slice(split2 + 1);
+        }
+        const cwd = r.string() || proc.cwd;
+        const files2 = /* @__PURE__ */ new Map();
+        for (let i = 0, n = r.u32(); i < n; i++) {
+          const childFd = r.u32() | 0;
+          const parentFd = r.u32() | 0;
+          files2.set(childFd, proc.table.get(parentFd));
+        }
+        if (!proc.processes) throw new PosixError(Errno.ENOSYS);
+        if (argv.length === 0) throw new PosixError(Errno.EINVAL);
+        return { status: await proc.processes.spawn({ argv, env: env2, cwd: resolve3(cwd), files: files2 }) };
+      }
+      case Op.waitpid: {
+        const pid = r.u32() | 0;
+        const options = r.u32() | 0;
+        if (!proc.processes) throw new PosixError(Errno.ENOSYS);
+        const result = await Promise.race([
+          proc.processes.wait(pid, options),
+          aborted().then(() => {
+            throw new PosixError(Errno.EINTR);
+          })
+        ]);
+        return { status: 0, payload: new Writer().i32(result.pid).i32(result.status).finish() };
+      }
+      case Op.kill: {
+        const pid = r.u32() | 0;
+        const signal = r.u32() | 0;
+        if (!proc.processes) throw new PosixError(Errno.ENOSYS);
+        proc.processes.kill(pid, signal);
+        return { status: 0 };
+      }
       /* ---------------------------------------------------------- entropy */
       case Op.getrandom: {
         const length = Math.min(r.u32(), 65536);
@@ -19737,6 +19787,7 @@ async function startPythonProcess(options) {
   table.set(0, stdin);
   table.set(1, stdout);
   table.set(2, stderr);
+  for (const [fd, description] of options.inherit ?? []) table.set(fd, description);
   const controller = new AbortController();
   const abort = () => controller.abort();
   options.signal.addEventListener("abort", abort, { once: true });
@@ -19750,7 +19801,8 @@ async function startPythonProcess(options) {
     env: options.env,
     cwd: options.cwd,
     signal: controller.signal,
-    sockets: options.sockets
+    sockets: options.sockets,
+    processes: options.processes
   });
   const buffers = createHostTransportBuffers();
   let fault = null;
@@ -19815,7 +19867,11 @@ async function startPythonProcess(options) {
     pid: options.pid,
     ppid: options.ppid,
     mounts: options.mounts,
-    isTty: options.isTty
+    isTty: options.isTty,
+    /* Only beyond the standard three: 0, 1 and 2 are bound as the process's
+     * terminal-or-pipe streams by the worker itself, and installing a second
+     * stream over one of them would leave two objects claiming the number. */
+    inheritFds: [...options.inherit?.keys() ?? []].filter((fd) => fd > 2)
   });
   return {
     write: (data) => stdin.push(data),
@@ -20303,6 +20359,129 @@ raise SystemExit(entry())
 }
 
 // src/runtime/python/backend.ts
+var PENDING_INHERITANCE = /* @__PURE__ */ new Map();
+var INHERIT_TOKEN = "SBX_PYTHON_INHERIT";
+var WNOHANG = 1;
+function claimInheritance(env2) {
+  const token = env2[INHERIT_TOKEN];
+  if (!token) return void 0;
+  const files = PENDING_INHERITANCE.get(token);
+  PENDING_INHERITANCE.delete(token);
+  delete env2[INHERIT_TOKEN];
+  return files;
+}
+function waitStatus(proc) {
+  if (proc.termSignal) return signalNumber(proc.termSignal) & 127;
+  return ((proc.exitCode ?? 0) & 255) << 8;
+}
+function outputFor(description, fallback) {
+  if (!description) return fallback;
+  return {
+    write(data) {
+      description.write(typeof data === "string" ? new TextEncoder().encode(data) : data);
+    },
+    end() {
+    },
+    get closed() {
+      return false;
+    },
+    isTTY: fallback.isTTY
+  };
+}
+function createProcessService(ctx) {
+  const children = /* @__PURE__ */ new Map();
+  const exited = (proc) => proc.exitCode !== null || proc.termSignal !== null;
+  return {
+    async spawn(request) {
+      const token = `${ctx.proc.pid}:${Math.random().toString(36).slice(2)}`;
+      const env2 = { ...request.env };
+      if (request.files.size > 0) {
+        PENDING_INHERITANCE.set(token, new Map(request.files));
+        env2[INHERIT_TOKEN] = token;
+      }
+      const stdin = request.files.get(0);
+      const argv = [containerProgram(ctx, request.argv[0] ?? ""), ...request.argv.slice(1)];
+      const proc = ctx.kernel.spawn(argv, {
+        cwd: request.cwd,
+        env: env2,
+        cred: ctx.cred,
+        ppid: ctx.proc.pid,
+        stdin: stdin ? descriptionInput(stdin) : void 0,
+        stdout: outputFor(request.files.get(1), ctx.stdout),
+        stderr: outputFor(request.files.get(2), ctx.stderr)
+      });
+      children.set(proc.pid, proc);
+      void proc.wait().finally(() => PENDING_INHERITANCE.delete(token));
+      return proc.pid;
+    },
+    async wait(pid, options) {
+      const candidates = pid > 0 ? [children.get(pid)].filter((p) => p !== void 0) : [...children.values()];
+      if (candidates.length === 0) throw new PosixError(Errno.ECHILD);
+      const reap = (proc) => {
+        children.delete(proc.pid);
+        return { pid: proc.pid, status: waitStatus(proc) };
+      };
+      const done = candidates.find(exited);
+      if (done) return reap(done);
+      if (options & WNOHANG) return { pid: 0, status: 0 };
+      await Promise.race(candidates.map((proc) => proc.wait()));
+      const finished = candidates.find(exited);
+      if (!finished) throw new PosixError(Errno.ECHILD);
+      return reap(finished);
+    },
+    kill(pid, signal) {
+      const proc = children.get(pid) ?? ctx.kernel.procs.get(pid);
+      if (!proc) throw new PosixError(Errno.ESRCH);
+      if (signal === 0) return;
+      const name = SIGNAL_NAMES[signal];
+      if (!name) throw new PosixError(Errno.EINVAL);
+      proc.deliver(name);
+    }
+  };
+}
+function containerProgram(ctx, program) {
+  const resolvable = (name) => name !== "" && ctx.kernel.resolveExecutable(name, ctx.cwd, ctx.env, ctx.cred) !== null;
+  if (resolvable(program)) return program;
+  const base2 = program.slice(program.lastIndexOf("/") + 1);
+  if (resolvable(base2)) return base2;
+  if (base2.startsWith("python")) return "python3";
+  return program;
+}
+function descriptionInput(description) {
+  const read = async (size) => {
+    for (; ; ) {
+      try {
+        const chunk = description.read(size);
+        if (chunk.length === 0) return null;
+        return chunk;
+      } catch {
+        await description.whenReady();
+      }
+    }
+  };
+  return {
+    isTTY: false,
+    interactive: false,
+    read,
+    async readAll() {
+      const parts = [];
+      for (; ; ) {
+        const chunk = await read(65536);
+        if (chunk === null) break;
+        parts.push(chunk);
+      }
+      let total = 0;
+      for (const part of parts) total += part.length;
+      const out = new Uint8Array(total);
+      let at = 0;
+      for (const part of parts) {
+        out.set(part, at);
+        at += part.length;
+      }
+      return out;
+    }
+  };
+}
 function withSitePackages(env2) {
   const existing = env2.PYTHONPATH;
   return {
@@ -20343,6 +20522,8 @@ async function runOwnedPython(ctx, argv) {
   const { manifest, workerUrl } = pythonBackend();
   if (!manifest) throw new Error("no Python runtime manifest is configured");
   const mounts = containerMounts(ctx);
+  const env2 = withSitePackages(ctx.env);
+  const inherit = claimInheritance(env2);
   const process2 = await startPythonProcess({
     manifest,
     workerUrl: await resolveWorkerUrl(workerUrl),
@@ -20351,14 +20532,16 @@ async function runOwnedPython(ctx, argv) {
     pid: ctx.proc.pid,
     ppid: ctx.proc.ppid ?? 1,
     argv,
-    env: withSitePackages(ctx.env),
+    env: env2,
     cwd: ctx.cwd,
     isTty: isTerminal(ctx),
     mounts,
     onStdout: (data) => ctx.stdout.write(data),
     onStderr: (data) => ctx.stderr.write(data),
     signal: ctx.signal,
-    sockets: ctx.kernel.pod.sockets
+    sockets: ctx.kernel.pod.sockets,
+    processes: createProcessService(ctx),
+    inherit
   });
   void pumpStdin(ctx, process2);
   return process2.wait();