sandboxedjs 0.1.92 → 0.1.94

package/dist/python/runtime.json

@@ -18,9 +18,9 @@
   "artifacts": {
     "moduleUrl": "./python.js",
     "hashes": {
-      "python.js": "sha256-ec01d17c48c14a6d442bb06e3351570fe3e0d8bfc857ba2c469e6fe58cbe0860",
-      "python.wasm": "sha256-f6d74973d23afb6401481343eee0190d3617a472c5bd36ed204785b13dcb8ce6",
-      "python.data": "sha256-69671e9d5e40b71da03fe8e8f9afc97f4563f6f9cadfcad06e8391963b247912",
+      "python.js": "sha256-ba225e5b4900449d493f213dc67263ed1afa7497f36582c43d778ccc282fe749",
+      "python.wasm": "sha256-a971913c97e671ec281c92c2922e0c64b3e2c9565c58a466a9dda78df5bb8e7a",
+      "python.data": "sha256-98d1fd943b6530e6ac7dd816420efe81082510da14c49bdc06fa60f5b08b924e",
       "python.worker.js": "sha256-63bb1df52c4e3a95eae7b2d77c98554188fcc5925e72628ea0c34d5c573977a5"
     }
   },

package/dist/python-abi.cjs

@@ -49,6 +49,7 @@ var Op = {
   setsockopt: 1802,
   getsockopt: 1803,
   socket_close: 1804,
+  resolve: 1805,
   spawn: 2048,
   waitpid: 2049,
   kill: 2050
@@ -1120,6 +1121,8 @@ var VirtualTcpSocket = class _VirtualTcpSocket {
   network;
   listenerValue = null;
   connectionValue = null;
+  /** Held so closing the guest's socket closes the host's, not just the queues. */
+  hostConnection = null;
   boundPort = 0;
   boundAddress = "0.0.0.0";
   bind(address, port) {
@@ -1137,13 +1140,35 @@ var VirtualTcpSocket = class _VirtualTcpSocket {
     }
     this.listenerValue = this.network.listen(this.boundPort, this.boundAddress, backlog);
   }
-  connect(port, address = "127.0.0.1") {
+  /**
+   * Connect, in the container or out of it.
+   *
+   * The destination used to be discarded, which quietly turned every connect
+   * into a loopback connect: a guest dialling example.com:443 would reach a
+   * container server listening on 443 and believe it had reached the internet.
+   * Loopback is still routed inside the container; anything else goes to the
+   * host's outbound stack, which owns the names and the real sockets, and
+   * which refuses with a reason when the host has no way out.
+   */
+  async connect(port, address = "127.0.0.1") {
     if (this.listenerValue || this.connectionValue) throw new PosixError(Errno.EISCONN);
     if (!isLoopback(address)) {
-      throw new PosixError(
-        Errno.ENETUNREACH,
-        `cannot reach ${address}:${port}: outbound network access is not available through raw sockets in this container; only loopback is routed`
-      );
+      const outbound = this.network.outbound;
+      if (!outbound) {
+        throw new PosixError(
+          Errno.ENETUNREACH,
+          `cannot reach ${address}:${port}: outbound network access is not available through raw sockets in this container; only loopback is routed`
+        );
+      }
+      const dialled = await outbound.connect(address, port, {
+        address: this.boundAddress,
+        port: this.boundPort
+      });
+      this.connectionValue = dialled.connection;
+      this.hostConnection = dialled.host;
+      this.boundPort = dialled.connection.local.port;
+      this.boundAddress = dialled.connection.local.address;
+      return;
     }
     this.connectionValue = this.network.connect(port, this.boundPort, this.boundAddress);
     this.boundPort = this.connectionValue.local.port;
@@ -1194,6 +1219,8 @@ var VirtualTcpSocket = class _VirtualTcpSocket {
   close() {
     if (this.listenerValue) this.network.close(this.listenerValue);
     this.connectionValue?.close();
+    this.hostConnection?.close();
+    this.hostConnection = null;
     this.listenerValue = null;
     this.connectionValue = null;
   }
@@ -1258,7 +1285,7 @@ var SocketDescription = class _SocketDescription {
     this.resource.listen(backlog);
   }
   connect(address, port) {
-    this.resource.connect(port, address);
+    return this.resource.connect(port, address);
   }
   accept() {
     return new _SocketDescription(this.resource.accept(), this.flags);
@@ -1270,7 +1297,11 @@ var SocketDescription = class _SocketDescription {
     this.options.set(`${level}:${option}`, value.slice());
   }
   getOption(level, option) {
-    return this.options.get(`${level}:${option}`)?.slice() ?? new Uint8Array(4);
+    const stored = this.options.get(`${level}:${option}`);
+    if (stored) return stored.slice();
+    if (level === SOL_SOCKET && option === SO_TYPE) return int32(SOCK_STREAM);
+    if (level === SOL_SOCKET && option === SO_ERROR) return int32(0);
+    return new Uint8Array(4);
   }
   localAddress() {
     return this.resource.local;
@@ -1281,6 +1312,15 @@ var SocketDescription = class _SocketDescription {
     return peer;
   }
 };
+var SOL_SOCKET = 1;
+var SO_ERROR = 4;
+var SO_TYPE = 3;
+var SOCK_STREAM = 1;
+function int32(value) {
+  const bytes = new Uint8Array(4);
+  new DataView(bytes.buffer).setInt32(0, value, true);
+  return bytes;
+}
 function isLoopback(address) {
   if (address === "" || address === "localhost" || address === "0.0.0.0") return true;
   if (address === "::1" || address === "::" || address === "[::1]") return true;
@@ -1293,7 +1333,7 @@ var POLLIN = 1;
 var POLLOUT = 4;
 var POLLHUP = 16;
 var AF_INET = 2;
-var SOCK_STREAM = 1;
+var SOCK_STREAM2 = 1;
 var IPPROTO_TCP = 6;
 function createHostAbiServer(proc) {
   const files = new FileService(proc.vfs, proc.cred);
@@ -1584,7 +1624,7 @@ function createHostAbiServer(proc) {
         const family = r.u32();
         const type = r.u32();
         const protocol = r.i32();
-        if (family !== AF_INET || (type & 15) !== SOCK_STREAM) throw new PosixError(Errno.EAFNOSUPPORT);
+        if (family !== AF_INET || (type & 15) !== SOCK_STREAM2) throw new PosixError(Errno.EAFNOSUPPORT);
         if (protocol !== 0 && protocol !== IPPROTO_TCP) throw new PosixError(Errno.EPROTONOSUPPORT);
         if (!proc.sockets) throw new PosixError(Errno.ENOSYS);
         return { status: proc.table.add(new SocketDescription(new VirtualTcpSocket(proc.sockets))) };
@@ -1608,9 +1648,15 @@ function createHostAbiServer(proc) {
       }
       case Op.connect: {
         const description = socketDescription(proc.table.get(r.i32()));
-        description.connect(r.string(), r.u32());
+        await description.connect(r.string(), r.u32());
         return { status: 0 };
       }
+      case Op.resolve: {
+        const sockets = proc.sockets;
+        if (!sockets?.outbound) throw new PosixError(Errno.ENOSYS);
+        const address = sockets.outbound.resolve(r.string());
+        return { status: 0, payload: new Writer().string(address).finish() };
+      }
       case Op.send: {
         const description = socketDescription(proc.table.get(r.i32()));
         return { status: await writeBlocking(description, r.bytes32()) };

package/dist/python-abi.d.cts

@@ -1,6 +1,6 @@
-import { V as Vfs, C as Cred, a as VirtualTcpNetwork } from './contracts-BkWBTH8E.cjs';
-export { m as ROOT_CRED, v as makeCred } from './contracts-BkWBTH8E.cjs';
-export { M as MemoryVolume } from './memory-volume-DCm-DiXH.cjs';
+import { V as Vfs, C as Cred, a as VirtualTcpNetwork } from './contracts-B6SHFjma.cjs';
+export { m as ROOT_CRED, v as makeCred } from './contracts-B6SHFjma.cjs';
+export { M as MemoryVolume } from './memory-volume-CRhXUyCN.cjs';
 
 /**
  * Open-file descriptions: the thing a descriptor points *at*.
@@ -275,6 +275,7 @@ declare const Op: {
     readonly setsockopt: 1802;
     readonly getsockopt: 1803;
     readonly socket_close: 1804;
+    readonly resolve: 1805;
     readonly spawn: 2048;
     readonly waitpid: 2049;
     readonly kill: 2050;

package/dist/python-abi.d.ts

@@ -1,6 +1,6 @@
-import { V as Vfs, C as Cred, a as VirtualTcpNetwork } from './contracts-BkWBTH8E.js';
-export { m as ROOT_CRED, v as makeCred } from './contracts-BkWBTH8E.js';
-export { M as MemoryVolume } from './memory-volume-DJA-vFYW.js';
+import { V as Vfs, C as Cred, a as VirtualTcpNetwork } from './contracts-B6SHFjma.js';
+export { m as ROOT_CRED, v as makeCred } from './contracts-B6SHFjma.js';
+export { M as MemoryVolume } from './memory-volume-CwiXvRfs.js';
 
 /**
  * Open-file descriptions: the thing a descriptor points *at*.
@@ -275,6 +275,7 @@ declare const Op: {
     readonly setsockopt: 1802;
     readonly getsockopt: 1803;
     readonly socket_close: 1804;
+    readonly resolve: 1805;
     readonly spawn: 2048;
     readonly waitpid: 2049;
     readonly kill: 2050;

package/dist/python-abi.js

@@ -47,6 +47,7 @@ var Op = {
   setsockopt: 1802,
   getsockopt: 1803,
   socket_close: 1804,
+  resolve: 1805,
   spawn: 2048,
   waitpid: 2049,
   kill: 2050
@@ -1118,6 +1119,8 @@ var VirtualTcpSocket = class _VirtualTcpSocket {
   network;
   listenerValue = null;
   connectionValue = null;
+  /** Held so closing the guest's socket closes the host's, not just the queues. */
+  hostConnection = null;
   boundPort = 0;
   boundAddress = "0.0.0.0";
   bind(address, port) {
@@ -1135,13 +1138,35 @@ var VirtualTcpSocket = class _VirtualTcpSocket {
     }
     this.listenerValue = this.network.listen(this.boundPort, this.boundAddress, backlog);
   }
-  connect(port, address = "127.0.0.1") {
+  /**
+   * Connect, in the container or out of it.
+   *
+   * The destination used to be discarded, which quietly turned every connect
+   * into a loopback connect: a guest dialling example.com:443 would reach a
+   * container server listening on 443 and believe it had reached the internet.
+   * Loopback is still routed inside the container; anything else goes to the
+   * host's outbound stack, which owns the names and the real sockets, and
+   * which refuses with a reason when the host has no way out.
+   */
+  async connect(port, address = "127.0.0.1") {
     if (this.listenerValue || this.connectionValue) throw new PosixError(Errno.EISCONN);
     if (!isLoopback(address)) {
-      throw new PosixError(
-        Errno.ENETUNREACH,
-        `cannot reach ${address}:${port}: outbound network access is not available through raw sockets in this container; only loopback is routed`
-      );
+      const outbound = this.network.outbound;
+      if (!outbound) {
+        throw new PosixError(
+          Errno.ENETUNREACH,
+          `cannot reach ${address}:${port}: outbound network access is not available through raw sockets in this container; only loopback is routed`
+        );
+      }
+      const dialled = await outbound.connect(address, port, {
+        address: this.boundAddress,
+        port: this.boundPort
+      });
+      this.connectionValue = dialled.connection;
+      this.hostConnection = dialled.host;
+      this.boundPort = dialled.connection.local.port;
+      this.boundAddress = dialled.connection.local.address;
+      return;
     }
     this.connectionValue = this.network.connect(port, this.boundPort, this.boundAddress);
     this.boundPort = this.connectionValue.local.port;
@@ -1192,6 +1217,8 @@ var VirtualTcpSocket = class _VirtualTcpSocket {
   close() {
     if (this.listenerValue) this.network.close(this.listenerValue);
     this.connectionValue?.close();
+    this.hostConnection?.close();
+    this.hostConnection = null;
     this.listenerValue = null;
     this.connectionValue = null;
   }
@@ -1256,7 +1283,7 @@ var SocketDescription = class _SocketDescription {
     this.resource.listen(backlog);
   }
   connect(address, port) {
-    this.resource.connect(port, address);
+    return this.resource.connect(port, address);
   }
   accept() {
     return new _SocketDescription(this.resource.accept(), this.flags);
@@ -1268,7 +1295,11 @@ var SocketDescription = class _SocketDescription {
     this.options.set(`${level}:${option}`, value.slice());
   }
   getOption(level, option) {
-    return this.options.get(`${level}:${option}`)?.slice() ?? new Uint8Array(4);
+    const stored = this.options.get(`${level}:${option}`);
+    if (stored) return stored.slice();
+    if (level === SOL_SOCKET && option === SO_TYPE) return int32(SOCK_STREAM);
+    if (level === SOL_SOCKET && option === SO_ERROR) return int32(0);
+    return new Uint8Array(4);
   }
   localAddress() {
     return this.resource.local;
@@ -1279,6 +1310,15 @@ var SocketDescription = class _SocketDescription {
     return peer;
   }
 };
+var SOL_SOCKET = 1;
+var SO_ERROR = 4;
+var SO_TYPE = 3;
+var SOCK_STREAM = 1;
+function int32(value) {
+  const bytes = new Uint8Array(4);
+  new DataView(bytes.buffer).setInt32(0, value, true);
+  return bytes;
+}
 function isLoopback(address) {
   if (address === "" || address === "localhost" || address === "0.0.0.0") return true;
   if (address === "::1" || address === "::" || address === "[::1]") return true;
@@ -1291,7 +1331,7 @@ var POLLIN = 1;
 var POLLOUT = 4;
 var POLLHUP = 16;
 var AF_INET = 2;
-var SOCK_STREAM = 1;
+var SOCK_STREAM2 = 1;
 var IPPROTO_TCP = 6;
 function createHostAbiServer(proc) {
   const files = new FileService(proc.vfs, proc.cred);
@@ -1582,7 +1622,7 @@ function createHostAbiServer(proc) {
         const family = r.u32();
         const type = r.u32();
         const protocol = r.i32();
-        if (family !== AF_INET || (type & 15) !== SOCK_STREAM) throw new PosixError(Errno.EAFNOSUPPORT);
+        if (family !== AF_INET || (type & 15) !== SOCK_STREAM2) throw new PosixError(Errno.EAFNOSUPPORT);
         if (protocol !== 0 && protocol !== IPPROTO_TCP) throw new PosixError(Errno.EPROTONOSUPPORT);
         if (!proc.sockets) throw new PosixError(Errno.ENOSYS);
         return { status: proc.table.add(new SocketDescription(new VirtualTcpSocket(proc.sockets))) };
@@ -1606,9 +1646,15 @@ function createHostAbiServer(proc) {
       }
       case Op.connect: {
         const description = socketDescription(proc.table.get(r.i32()));
-        description.connect(r.string(), r.u32());
+        await description.connect(r.string(), r.u32());
         return { status: 0 };
       }
+      case Op.resolve: {
+        const sockets = proc.sockets;
+        if (!sockets?.outbound) throw new PosixError(Errno.ENOSYS);
+        const address = sockets.outbound.resolve(r.string());
+        return { status: 0, payload: new Writer().string(address).finish() };
+      }
       case Op.send: {
         const description = socketDescription(proc.table.get(r.i32()));
         return { status: await writeBlocking(description, r.bytes32()) };

package/dist/python-worker.js

@@ -47,6 +47,7 @@ var Op = {
   setsockopt: 1802,
   getsockopt: 1803,
   socket_close: 1804,
+  resolve: 1805,
   spawn: 2048,
   waitpid: 2049,
   kill: 2050

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sandboxedjs",
-  "version": "0.1.92",
+  "version": "0.1.94",
   "description": "A Linux-like container that runs entirely inside Node.js — POSIX shell, ~140 coreutils, Node.js and Python runtimes, virtual filesystem and networking. No Docker, no VM, no native modules.",
   "type": "module",
   "license": "MIT",