sandboxedjs 0.2.3 → 0.2.5

package/dist/index.cjs

@@ -8374,6 +8374,60 @@ function createSysProvider(kernel) {
   };
 }
 
+// src/net/proxy-fetch.ts
+function toBase64(bytes2) {
+  let text2 = "";
+  for (let at = 0; at < bytes2.length; at += 32768) {
+    text2 += String.fromCharCode(...bytes2.subarray(at, at + 32768));
+  }
+  return btoa(text2);
+}
+function fromBase64(text2) {
+  const binary = atob(text2);
+  const bytes2 = new Uint8Array(binary.length);
+  for (let at = 0; at < binary.length; at += 1) bytes2[at] = binary.charCodeAt(at);
+  return bytes2;
+}
+async function proxyExchange(proxy, request, fetchImpl = fetch) {
+  let answer;
+  try {
+    answer = await fetchImpl(proxy, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        url: request.url,
+        method: request.method,
+        headers: request.headers,
+        ...request.body?.length ? { body: toBase64(request.body) } : {}
+      })
+    });
+  } catch (error) {
+    throw new Error(
+      `the egress proxy at ${proxy} could not be reached (${error instanceof Error ? error.message : String(error)}). It performs this container's outbound requests, so nothing leaves until it answers.`
+    );
+  }
+  if (!answer.ok) {
+    throw new Error(
+      `the egress proxy at ${proxy} refused ${request.method} ${request.url} with ${answer.status} ${answer.statusText}: ${(await answer.text()).trim().slice(0, 300)}`
+    );
+  }
+  const payload = await answer.json();
+  return {
+    status: payload.status ?? 200,
+    statusText: payload.statusText ?? "",
+    headers: payload.headers ?? {},
+    body: payload.body ? fromBase64(payload.body) : new Uint8Array(0)
+  };
+}
+function isBrowser() {
+  return typeof process === "undefined" || process.versions?.node == null;
+}
+function browserBlocked(hostname, message) {
+  return new Error(
+    `${message} \u2014 the request to ${hostname} was blocked by the browser. A page can only read a response from a host that sends CORS headers, and most APIs send none. Give the container a proxy that makes the request for it \u2014 network: { proxy }, and \`npx sandboxedjs-egress\` is one \u2014 or run the container on a server.`
+  );
+}
+
 // src/net/policy.ts
 function isLoopbackHostname(hostname) {
   const host2 = hostname.replace(/^\[|\]$/g, "").toLowerCase();
@@ -8416,7 +8470,40 @@ function policedFetch(policy, fetchImpl) {
     if (!outboundAllowed(policy, url)) {
       throw Object.assign(new TypeError("fetch failed"), { cause: outboundBlockedError(url) });
     }
-    return fetchImpl(input, init);
+    if (policy.proxy) return await fetchThroughProxy(policy.proxy, fetchImpl, input, init);
+    try {
+      return await fetchImpl(input, init);
+    } catch (error) {
+      if (!isBrowser()) throw error;
+      throw Object.assign(new TypeError("fetch failed"), {
+        cause: browserBlocked(new URL(url).hostname, error instanceof Error ? error.message : String(error))
+      });
+    }
+  });
+}
+async function fetchThroughProxy(proxy, fetchImpl, input, init) {
+  const request = new Request(input, init);
+  const headers = {};
+  request.headers.forEach((value, name) => {
+    headers[name] = value;
+  });
+  const bodyless = request.method === "GET" || request.method === "HEAD";
+  const result = await proxyExchange(
+    proxy,
+    {
+      url: request.url,
+      method: request.method,
+      headers,
+      ...bodyless ? {} : { body: new Uint8Array(await request.arrayBuffer()) }
+    },
+    fetchImpl
+  );
+  const nullBody = result.status === 204 || result.status === 205 || result.status === 304 || request.method === "HEAD";
+  const body = nullBody ? null : result.body.slice().buffer;
+  return new Response(body, {
+    status: result.status,
+    statusText: result.statusText,
+    headers: result.headers
   });
 }
 function policedWebSocket(Native, policy) {
@@ -17474,9 +17561,6 @@ function parseUrl(raw) {
     return null;
   }
 }
-function isBrowser() {
-  return typeof process === "undefined" || process.versions?.node == null;
-}
 async function performRequest(ctx, url, init) {
   const isLocal = ctx.kernel.net.isLocal(url.hostname);
   if (isLocal) {
@@ -17504,7 +17588,16 @@ async function performRequest(ctx, url, init) {
     );
   }
   const proxy = ctx.kernel.net.proxy;
-  if (proxy) return await proxyRequest(ctx, proxy, url, init);
+  if (proxy) {
+    const result = await proxyExchange(proxy, {
+      url: url.toString(),
+      method: init.method,
+      headers: init.headers,
+      ...init.body?.length ? { body: init.body } : {}
+    });
+    ctx.kernel.net.countRx(result.body.length);
+    return { ...result, url: url.toString() };
+  }
   let response;
   try {
     response = await fetch(url.toString(), {
@@ -17513,9 +17606,7 @@ async function performRequest(ctx, url, init) {
       ...init.body ? { body: init.body.slice().buffer } : {}
     });
   } catch (error) {
-    throw isBrowser() ? new Error(
-      `${error instanceof Error ? error.message : String(error)} \u2014 the request to ${url.hostname} was blocked by the browser. A page can only read a response from a host that sends CORS headers, and most APIs send none. Give the container a proxy that makes the request for it \u2014 network: { proxy }, and \`npx sandboxedjs-egress\` is one \u2014 or run the container on a server.`
-    ) : error;
+    throw isBrowser() ? browserBlocked(url.hostname, error instanceof Error ? error.message : String(error)) : error;
   }
   const body = new Uint8Array(await response.arrayBuffer());
   ctx.kernel.net.countRx(body.length);
@@ -17525,53 +17616,6 @@ async function performRequest(ctx, url, init) {
   });
   return { status: response.status, statusText: response.statusText, headers, body, url: response.url || url.toString() };
 }
-async function proxyRequest(ctx, proxy, url, init) {
-  let answer;
-  try {
-    answer = await fetch(proxy, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({
-        url: url.toString(),
-        method: init.method,
-        headers: init.headers,
-        ...init.body?.length ? { body: toBase64(init.body) } : {}
-      })
-    });
-  } catch (error) {
-    throw new Error(
-      `the egress proxy at ${proxy} could not be reached (${error instanceof Error ? error.message : String(error)}). It performs this container's outbound requests, so nothing leaves until it answers.`
-    );
-  }
-  if (!answer.ok) {
-    throw new Error(
-      `the egress proxy at ${proxy} refused ${init.method} ${url.toString()} with ${answer.status} ${answer.statusText}: ${(await answer.text()).trim().slice(0, 300)}`
-    );
-  }
-  const payload = await answer.json();
-  const body = payload.body ? fromBase64(payload.body) : new Uint8Array(0);
-  ctx.kernel.net.countRx(body.length);
-  return {
-    status: payload.status ?? 200,
-    statusText: payload.statusText ?? "",
-    headers: payload.headers ?? {},
-    body,
-    url: url.toString()
-  };
-}
-function toBase64(bytes2) {
-  let text2 = "";
-  for (let at = 0; at < bytes2.length; at += 32768) {
-    text2 += String.fromCharCode(...bytes2.subarray(at, at + 32768));
-  }
-  return btoa(text2);
-}
-function fromBase64(text2) {
-  const binary = atob(text2);
-  const bytes2 = new Uint8Array(binary.length);
-  for (let at = 0; at < binary.length; at += 1) bytes2[at] = binary.charCodeAt(at);
-  return bytes2;
-}
 var curl = defineCommand({
   name: "curl",
   path: "/usr/bin/curl",
@@ -21013,7 +21057,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.2.3"};
+  version: "0.2.5"};
 
 // src/python/extension-abi.ts
 var EXTENSION_ABI = {
@@ -22328,8 +22372,24 @@ var VirtualTcpNetwork = class {
   hasListener(port) {
     return this.listeners.has(port);
   }
+  /** Ports the container itself listens on, which no guest asked for. */
+  internal = /* @__PURE__ */ new Set();
+  /**
+   * Ports a guest is serving on.
+   *
+   * The container's own plumbing listens too — the HTTP egress takes a port
+   * like any server — and those are not the guest's. Reported, they reach
+   * every consumer of "what is running here": a port picker offers one, a
+   * preview opens it, and the reader is looking at an internal endpoint
+   * answering that it wanted an absolute URL, with nothing to say what it is
+   * or why they are there.
+   */
   ports() {
-    return [...this.listeners.keys()].sort((a, b) => a - b);
+    return [...this.listeners.keys()].filter((port) => !this.internal.has(port)).sort((a, b) => a - b);
+  }
+  /** Keep `port` out of {@link ports}: it belongs to the container, not a guest. */
+  markInternal(port) {
+    this.internal.add(port);
   }
   closeAll() {
     for (const listener of [...this.listeners.values()]) this.close(listener);
@@ -23266,6 +23326,7 @@ function ensureHttpEgress(ctx) {
     }
   }
   if (!listener || port === 0) return 0;
+  sockets.markInternal?.(port);
   listeners.set(sockets, port);
   const accepting = listener;
   void (async () => {
@@ -37808,7 +37869,8 @@ var Container = class _Container {
     if (opts.python) configurePython(opts.python);
     const network = {
       allowOutbound: opts.network?.allowOutbound ?? false,
-      allowedHosts: opts.network?.allowedHosts ?? null
+      allowedHosts: opts.network?.allowedHosts ?? null,
+      ...opts.network?.proxy ? { proxy: opts.network.proxy } : {}
     };
     const podOptions = {
       workdir: opts.cwd ?? "/",

package/dist/index.d.cts

@@ -1,8 +1,8 @@
-import { S as Shell, a as ShellIO, b as Session, N as Node, c as Command, K as Kernel, E as ExecContext, O as OutputStream, C as Container, B as BinaryBackend, d as createContainer } from './container-C9Y8dqos.cjs';
-export { e as BinaryExecutionRegistry, f as BinaryInfo, g as BinaryRequest, h as BufferSink, i as CallbackSink, j as CommandRegistry, k as ContainerFs, l as ContainerOptions, m as ContextInit, n as Env, o as ExecOptions, p as ExecResult, q as ExecutionDecision, r as ExecutionTier, F as FileData, s as FileInput, t as FileOutput, G as GroupEntry, H as HttpResponse, I as InputStream, J as Job, u as KernelOptions, L as ListeningPort, M as MANIFEST_FORMAT, v as MANIFEST_SCHEMA_VERSION, w as MountEntry, x as NetInterface, y as NetworkOptions, z as NetworkStack, A as NullInput, D as NullOutput, P as PYTHON_VERSION, Q as PasswdEntry, R as Pipe, T as Preparation, U as PreparedBinary, V as Process, W as ProcessKind, X as ProcessOptions, Y as ProcessState, Z as ProcessTable, _ as PythonCapabilities, $ as PythonOptions, a0 as PythonProfile, a1 as PythonRuntimeManifest, a2 as ResolvedExecutable, a3 as RunOptions, a4 as RunResult, a5 as SessionInit, a6 as SessionResult, a7 as SessionRunOptions, a8 as ShellExit, a9 as ShellInit, aa as ShellOptions, ab as SpawnHandle, ac as Stdio, ad as TeeOutput, ae as UserDatabase, af as Variables, ag as WasmCommandArtifact, ah as WasmTranslator, ai as binaryDigest, aj as braceExpand, ak as captureStdio, al as configurePython, am as createContext, an as createTranslationBackend, ao as createWasmCompatibilityBackend, ap as defineCommand, aq as expandWord, ar as expandWords, as as inspectElf, at as installWasmCommands, au as isElfBinary, av as isPythonAvailable, aw as resetPidCounter, ax as shellQuote, ay as validateManifest } from './container-C9Y8dqos.cjs';
-import { V as Vfs, C as Cred, R as RuntimeVolume, a as VirtualTcpNetwork, b as RuntimeHttpResponse, O as OutboundPolicy, S as SpawnChild, c as SyncSpawn, I as IpcTransport, d as VolumeStat, e as VolumeStats, f as RuntimePod, g as RuntimePackageInstaller, h as ChildSpawnConfig, i as ChildHandle, j as RuntimeProcess, k as RuntimeSocketPeer, l as RuntimeConnection } from './contracts-B6SHFjma.cjs';
-export { D as DirEntry, m as ROOT_CRED, n as RuntimeProcessManager, o as RuntimeProcessResult, p as Stats, q as VirtualNode, r as VirtualProvider, W as WriteOptions, s as applyChmod, t as createChildProcessModule, u as formatMode, v as makeCred, w as octalMode, x as parseUmask } from './contracts-B6SHFjma.cjs';
-import { M as MemoryVolume, a as MemoryVolumeSnapshotEntry } from './memory-volume-CRhXUyCN.cjs';
+import { S as Shell, a as ShellIO, b as Session, N as Node, c as Command, K as Kernel, E as ExecContext, O as OutputStream, C as Container, B as BinaryBackend, d as createContainer } from './container-BQx27_d-.cjs';
+export { e as BinaryExecutionRegistry, f as BinaryInfo, g as BinaryRequest, h as BufferSink, i as CallbackSink, j as CommandRegistry, k as ContainerFs, l as ContainerOptions, m as ContextInit, n as Env, o as ExecOptions, p as ExecResult, q as ExecutionDecision, r as ExecutionTier, F as FileData, s as FileInput, t as FileOutput, G as GroupEntry, H as HttpResponse, I as InputStream, J as Job, u as KernelOptions, L as ListeningPort, M as MANIFEST_FORMAT, v as MANIFEST_SCHEMA_VERSION, w as MountEntry, x as NetInterface, y as NetworkOptions, z as NetworkStack, A as NullInput, D as NullOutput, P as PYTHON_VERSION, Q as PasswdEntry, R as Pipe, T as Preparation, U as PreparedBinary, V as Process, W as ProcessKind, X as ProcessOptions, Y as ProcessState, Z as ProcessTable, _ as PythonCapabilities, $ as PythonOptions, a0 as PythonProfile, a1 as PythonRuntimeManifest, a2 as ResolvedExecutable, a3 as RunOptions, a4 as RunResult, a5 as SessionInit, a6 as SessionResult, a7 as SessionRunOptions, a8 as ShellExit, a9 as ShellInit, aa as ShellOptions, ab as SpawnHandle, ac as Stdio, ad as TeeOutput, ae as UserDatabase, af as Variables, ag as WasmCommandArtifact, ah as WasmTranslator, ai as binaryDigest, aj as braceExpand, ak as captureStdio, al as configurePython, am as createContext, an as createTranslationBackend, ao as createWasmCompatibilityBackend, ap as defineCommand, aq as expandWord, ar as expandWords, as as inspectElf, at as installWasmCommands, au as isElfBinary, av as isPythonAvailable, aw as resetPidCounter, ax as shellQuote, ay as validateManifest } from './container-BQx27_d-.cjs';
+import { V as Vfs, C as Cred, R as RuntimeVolume, a as VirtualTcpNetwork, b as RuntimeHttpResponse, O as OutboundPolicy, S as SpawnChild, c as SyncSpawn, I as IpcTransport, d as VolumeStat, e as VolumeStats, f as RuntimePod, g as RuntimePackageInstaller, h as ChildSpawnConfig, i as ChildHandle, j as RuntimeProcess, k as RuntimeSocketPeer, l as RuntimeConnection } from './contracts-BHo4LdY2.cjs';
+export { D as DirEntry, m as ROOT_CRED, n as RuntimeProcessManager, o as RuntimeProcessResult, p as Stats, q as VirtualNode, r as VirtualProvider, W as WriteOptions, s as applyChmod, t as createChildProcessModule, u as formatMode, v as makeCred, w as octalMode, x as parseUmask } from './contracts-BHo4LdY2.cjs';
+import { M as MemoryVolume, a as MemoryVolumeSnapshotEntry } from './memory-volume-e-uJFRnG.cjs';
 import EventEmitter from 'events/events.js';
 import streamModule from 'stream-browserify';
 

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { S as Shell, a as ShellIO, b as Session, N as Node, c as Command, K as Kernel, E as ExecContext, O as OutputStream, C as Container, B as BinaryBackend, d as createContainer } from './container-CIE93_Gh.js';
-export { e as BinaryExecutionRegistry, f as BinaryInfo, g as BinaryRequest, h as BufferSink, i as CallbackSink, j as CommandRegistry, k as ContainerFs, l as ContainerOptions, m as ContextInit, n as Env, o as ExecOptions, p as ExecResult, q as ExecutionDecision, r as ExecutionTier, F as FileData, s as FileInput, t as FileOutput, G as GroupEntry, H as HttpResponse, I as InputStream, J as Job, u as KernelOptions, L as ListeningPort, M as MANIFEST_FORMAT, v as MANIFEST_SCHEMA_VERSION, w as MountEntry, x as NetInterface, y as NetworkOptions, z as NetworkStack, A as NullInput, D as NullOutput, P as PYTHON_VERSION, Q as PasswdEntry, R as Pipe, T as Preparation, U as PreparedBinary, V as Process, W as ProcessKind, X as ProcessOptions, Y as ProcessState, Z as ProcessTable, _ as PythonCapabilities, $ as PythonOptions, a0 as PythonProfile, a1 as PythonRuntimeManifest, a2 as ResolvedExecutable, a3 as RunOptions, a4 as RunResult, a5 as SessionInit, a6 as SessionResult, a7 as SessionRunOptions, a8 as ShellExit, a9 as ShellInit, aa as ShellOptions, ab as SpawnHandle, ac as Stdio, ad as TeeOutput, ae as UserDatabase, af as Variables, ag as WasmCommandArtifact, ah as WasmTranslator, ai as binaryDigest, aj as braceExpand, ak as captureStdio, al as configurePython, am as createContext, an as createTranslationBackend, ao as createWasmCompatibilityBackend, ap as defineCommand, aq as expandWord, ar as expandWords, as as inspectElf, at as installWasmCommands, au as isElfBinary, av as isPythonAvailable, aw as resetPidCounter, ax as shellQuote, ay as validateManifest } from './container-CIE93_Gh.js';
-import { V as Vfs, C as Cred, R as RuntimeVolume, a as VirtualTcpNetwork, b as RuntimeHttpResponse, O as OutboundPolicy, S as SpawnChild, c as SyncSpawn, I as IpcTransport, d as VolumeStat, e as VolumeStats, f as RuntimePod, g as RuntimePackageInstaller, h as ChildSpawnConfig, i as ChildHandle, j as RuntimeProcess, k as RuntimeSocketPeer, l as RuntimeConnection } from './contracts-B6SHFjma.js';
-export { D as DirEntry, m as ROOT_CRED, n as RuntimeProcessManager, o as RuntimeProcessResult, p as Stats, q as VirtualNode, r as VirtualProvider, W as WriteOptions, s as applyChmod, t as createChildProcessModule, u as formatMode, v as makeCred, w as octalMode, x as parseUmask } from './contracts-B6SHFjma.js';
-import { M as MemoryVolume, a as MemoryVolumeSnapshotEntry } from './memory-volume-CwiXvRfs.js';
+import { S as Shell, a as ShellIO, b as Session, N as Node, c as Command, K as Kernel, E as ExecContext, O as OutputStream, C as Container, B as BinaryBackend, d as createContainer } from './container-D-e5SMXQ.js';
+export { e as BinaryExecutionRegistry, f as BinaryInfo, g as BinaryRequest, h as BufferSink, i as CallbackSink, j as CommandRegistry, k as ContainerFs, l as ContainerOptions, m as ContextInit, n as Env, o as ExecOptions, p as ExecResult, q as ExecutionDecision, r as ExecutionTier, F as FileData, s as FileInput, t as FileOutput, G as GroupEntry, H as HttpResponse, I as InputStream, J as Job, u as KernelOptions, L as ListeningPort, M as MANIFEST_FORMAT, v as MANIFEST_SCHEMA_VERSION, w as MountEntry, x as NetInterface, y as NetworkOptions, z as NetworkStack, A as NullInput, D as NullOutput, P as PYTHON_VERSION, Q as PasswdEntry, R as Pipe, T as Preparation, U as PreparedBinary, V as Process, W as ProcessKind, X as ProcessOptions, Y as ProcessState, Z as ProcessTable, _ as PythonCapabilities, $ as PythonOptions, a0 as PythonProfile, a1 as PythonRuntimeManifest, a2 as ResolvedExecutable, a3 as RunOptions, a4 as RunResult, a5 as SessionInit, a6 as SessionResult, a7 as SessionRunOptions, a8 as ShellExit, a9 as ShellInit, aa as ShellOptions, ab as SpawnHandle, ac as Stdio, ad as TeeOutput, ae as UserDatabase, af as Variables, ag as WasmCommandArtifact, ah as WasmTranslator, ai as binaryDigest, aj as braceExpand, ak as captureStdio, al as configurePython, am as createContext, an as createTranslationBackend, ao as createWasmCompatibilityBackend, ap as defineCommand, aq as expandWord, ar as expandWords, as as inspectElf, at as installWasmCommands, au as isElfBinary, av as isPythonAvailable, aw as resetPidCounter, ax as shellQuote, ay as validateManifest } from './container-D-e5SMXQ.js';
+import { V as Vfs, C as Cred, R as RuntimeVolume, a as VirtualTcpNetwork, b as RuntimeHttpResponse, O as OutboundPolicy, S as SpawnChild, c as SyncSpawn, I as IpcTransport, d as VolumeStat, e as VolumeStats, f as RuntimePod, g as RuntimePackageInstaller, h as ChildSpawnConfig, i as ChildHandle, j as RuntimeProcess, k as RuntimeSocketPeer, l as RuntimeConnection } from './contracts-BHo4LdY2.js';
+export { D as DirEntry, m as ROOT_CRED, n as RuntimeProcessManager, o as RuntimeProcessResult, p as Stats, q as VirtualNode, r as VirtualProvider, W as WriteOptions, s as applyChmod, t as createChildProcessModule, u as formatMode, v as makeCred, w as octalMode, x as parseUmask } from './contracts-BHo4LdY2.js';
+import { M as MemoryVolume, a as MemoryVolumeSnapshotEntry } from './memory-volume-meoRW8ST.js';
 import EventEmitter from 'events/events.js';
 import streamModule from 'stream-browserify';
 

package/dist/index.js

@@ -8357,6 +8357,60 @@ function createSysProvider(kernel) {
   };
 }
 
+// src/net/proxy-fetch.ts
+function toBase64(bytes2) {
+  let text2 = "";
+  for (let at = 0; at < bytes2.length; at += 32768) {
+    text2 += String.fromCharCode(...bytes2.subarray(at, at + 32768));
+  }
+  return btoa(text2);
+}
+function fromBase64(text2) {
+  const binary = atob(text2);
+  const bytes2 = new Uint8Array(binary.length);
+  for (let at = 0; at < binary.length; at += 1) bytes2[at] = binary.charCodeAt(at);
+  return bytes2;
+}
+async function proxyExchange(proxy, request, fetchImpl = fetch) {
+  let answer;
+  try {
+    answer = await fetchImpl(proxy, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        url: request.url,
+        method: request.method,
+        headers: request.headers,
+        ...request.body?.length ? { body: toBase64(request.body) } : {}
+      })
+    });
+  } catch (error) {
+    throw new Error(
+      `the egress proxy at ${proxy} could not be reached (${error instanceof Error ? error.message : String(error)}). It performs this container's outbound requests, so nothing leaves until it answers.`
+    );
+  }
+  if (!answer.ok) {
+    throw new Error(
+      `the egress proxy at ${proxy} refused ${request.method} ${request.url} with ${answer.status} ${answer.statusText}: ${(await answer.text()).trim().slice(0, 300)}`
+    );
+  }
+  const payload = await answer.json();
+  return {
+    status: payload.status ?? 200,
+    statusText: payload.statusText ?? "",
+    headers: payload.headers ?? {},
+    body: payload.body ? fromBase64(payload.body) : new Uint8Array(0)
+  };
+}
+function isBrowser() {
+  return typeof process === "undefined" || process.versions?.node == null;
+}
+function browserBlocked(hostname, message) {
+  return new Error(
+    `${message} \u2014 the request to ${hostname} was blocked by the browser. A page can only read a response from a host that sends CORS headers, and most APIs send none. Give the container a proxy that makes the request for it \u2014 network: { proxy }, and \`npx sandboxedjs-egress\` is one \u2014 or run the container on a server.`
+  );
+}
+
 // src/net/policy.ts
 function isLoopbackHostname(hostname) {
   const host2 = hostname.replace(/^\[|\]$/g, "").toLowerCase();
@@ -8399,7 +8453,40 @@ function policedFetch(policy, fetchImpl) {
     if (!outboundAllowed(policy, url)) {
       throw Object.assign(new TypeError("fetch failed"), { cause: outboundBlockedError(url) });
     }
-    return fetchImpl(input, init);
+    if (policy.proxy) return await fetchThroughProxy(policy.proxy, fetchImpl, input, init);
+    try {
+      return await fetchImpl(input, init);
+    } catch (error) {
+      if (!isBrowser()) throw error;
+      throw Object.assign(new TypeError("fetch failed"), {
+        cause: browserBlocked(new URL(url).hostname, error instanceof Error ? error.message : String(error))
+      });
+    }
+  });
+}
+async function fetchThroughProxy(proxy, fetchImpl, input, init) {
+  const request = new Request(input, init);
+  const headers = {};
+  request.headers.forEach((value, name) => {
+    headers[name] = value;
+  });
+  const bodyless = request.method === "GET" || request.method === "HEAD";
+  const result = await proxyExchange(
+    proxy,
+    {
+      url: request.url,
+      method: request.method,
+      headers,
+      ...bodyless ? {} : { body: new Uint8Array(await request.arrayBuffer()) }
+    },
+    fetchImpl
+  );
+  const nullBody = result.status === 204 || result.status === 205 || result.status === 304 || request.method === "HEAD";
+  const body = nullBody ? null : result.body.slice().buffer;
+  return new Response(body, {
+    status: result.status,
+    statusText: result.statusText,
+    headers: result.headers
   });
 }
 function policedWebSocket(Native, policy) {
@@ -17457,9 +17544,6 @@ function parseUrl(raw) {
     return null;
   }
 }
-function isBrowser() {
-  return typeof process === "undefined" || process.versions?.node == null;
-}
 async function performRequest(ctx, url, init) {
   const isLocal = ctx.kernel.net.isLocal(url.hostname);
   if (isLocal) {
@@ -17487,7 +17571,16 @@ async function performRequest(ctx, url, init) {
     );
   }
   const proxy = ctx.kernel.net.proxy;
-  if (proxy) return await proxyRequest(ctx, proxy, url, init);
+  if (proxy) {
+    const result = await proxyExchange(proxy, {
+      url: url.toString(),
+      method: init.method,
+      headers: init.headers,
+      ...init.body?.length ? { body: init.body } : {}
+    });
+    ctx.kernel.net.countRx(result.body.length);
+    return { ...result, url: url.toString() };
+  }
   let response;
   try {
     response = await fetch(url.toString(), {
@@ -17496,9 +17589,7 @@ async function performRequest(ctx, url, init) {
       ...init.body ? { body: init.body.slice().buffer } : {}
     });
   } catch (error) {
-    throw isBrowser() ? new Error(
-      `${error instanceof Error ? error.message : String(error)} \u2014 the request to ${url.hostname} was blocked by the browser. A page can only read a response from a host that sends CORS headers, and most APIs send none. Give the container a proxy that makes the request for it \u2014 network: { proxy }, and \`npx sandboxedjs-egress\` is one \u2014 or run the container on a server.`
-    ) : error;
+    throw isBrowser() ? browserBlocked(url.hostname, error instanceof Error ? error.message : String(error)) : error;
   }
   const body = new Uint8Array(await response.arrayBuffer());
   ctx.kernel.net.countRx(body.length);
@@ -17508,53 +17599,6 @@ async function performRequest(ctx, url, init) {
   });
   return { status: response.status, statusText: response.statusText, headers, body, url: response.url || url.toString() };
 }
-async function proxyRequest(ctx, proxy, url, init) {
-  let answer;
-  try {
-    answer = await fetch(proxy, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({
-        url: url.toString(),
-        method: init.method,
-        headers: init.headers,
-        ...init.body?.length ? { body: toBase64(init.body) } : {}
-      })
-    });
-  } catch (error) {
-    throw new Error(
-      `the egress proxy at ${proxy} could not be reached (${error instanceof Error ? error.message : String(error)}). It performs this container's outbound requests, so nothing leaves until it answers.`
-    );
-  }
-  if (!answer.ok) {
-    throw new Error(
-      `the egress proxy at ${proxy} refused ${init.method} ${url.toString()} with ${answer.status} ${answer.statusText}: ${(await answer.text()).trim().slice(0, 300)}`
-    );
-  }
-  const payload = await answer.json();
-  const body = payload.body ? fromBase64(payload.body) : new Uint8Array(0);
-  ctx.kernel.net.countRx(body.length);
-  return {
-    status: payload.status ?? 200,
-    statusText: payload.statusText ?? "",
-    headers: payload.headers ?? {},
-    body,
-    url: url.toString()
-  };
-}
-function toBase64(bytes2) {
-  let text2 = "";
-  for (let at = 0; at < bytes2.length; at += 32768) {
-    text2 += String.fromCharCode(...bytes2.subarray(at, at + 32768));
-  }
-  return btoa(text2);
-}
-function fromBase64(text2) {
-  const binary = atob(text2);
-  const bytes2 = new Uint8Array(binary.length);
-  for (let at = 0; at < binary.length; at += 1) bytes2[at] = binary.charCodeAt(at);
-  return bytes2;
-}
 var curl = defineCommand({
   name: "curl",
   path: "/usr/bin/curl",
@@ -20996,7 +21040,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.2.3"};
+  version: "0.2.5"};
 
 // src/python/extension-abi.ts
 var EXTENSION_ABI = {
@@ -22311,8 +22355,24 @@ var VirtualTcpNetwork = class {
   hasListener(port) {
     return this.listeners.has(port);
   }
+  /** Ports the container itself listens on, which no guest asked for. */
+  internal = /* @__PURE__ */ new Set();
+  /**
+   * Ports a guest is serving on.
+   *
+   * The container's own plumbing listens too — the HTTP egress takes a port
+   * like any server — and those are not the guest's. Reported, they reach
+   * every consumer of "what is running here": a port picker offers one, a
+   * preview opens it, and the reader is looking at an internal endpoint
+   * answering that it wanted an absolute URL, with nothing to say what it is
+   * or why they are there.
+   */
   ports() {
-    return [...this.listeners.keys()].sort((a, b) => a - b);
+    return [...this.listeners.keys()].filter((port) => !this.internal.has(port)).sort((a, b) => a - b);
+  }
+  /** Keep `port` out of {@link ports}: it belongs to the container, not a guest. */
+  markInternal(port) {
+    this.internal.add(port);
   }
   closeAll() {
     for (const listener of [...this.listeners.values()]) this.close(listener);
@@ -23249,6 +23309,7 @@ function ensureHttpEgress(ctx) {
     }
   }
   if (!listener || port === 0) return 0;
+  sockets.markInternal?.(port);
   listeners.set(sockets, port);
   const accepting = listener;
   void (async () => {
@@ -37791,7 +37852,8 @@ var Container = class _Container {
     if (opts.python) configurePython(opts.python);
     const network = {
       allowOutbound: opts.network?.allowOutbound ?? false,
-      allowedHosts: opts.network?.allowedHosts ?? null
+      allowedHosts: opts.network?.allowedHosts ?? null,
+      ...opts.network?.proxy ? { proxy: opts.network.proxy } : {}
     };
     const podOptions = {
       workdir: opts.cwd ?? "/",

package/dist/{memory-volume-CRhXUyCN.d.cts → memory-volume-e-uJFRnG.d.cts}

@@ -1,4 +1,4 @@
-import { R as RuntimeVolume, d as VolumeStat, e as VolumeStats } from './contracts-B6SHFjma.cjs';
+import { R as RuntimeVolume, d as VolumeStat, e as VolumeStats } from './contracts-BHo4LdY2.cjs';
 
 type NodeKind = "file" | "directory" | "symlink";
 interface MemoryVolumeSnapshotEntry {

package/dist/{memory-volume-CwiXvRfs.d.ts → memory-volume-meoRW8ST.d.ts}

@@ -1,4 +1,4 @@
-import { R as RuntimeVolume, d as VolumeStat, e as VolumeStats } from './contracts-B6SHFjma.js';
+import { R as RuntimeVolume, d as VolumeStat, e as VolumeStats } from './contracts-BHo4LdY2.js';
 
 type NodeKind = "file" | "directory" | "symlink";
 interface MemoryVolumeSnapshotEntry {

package/dist/python-abi.d.cts

@@ -1,6 +1,6 @@
-import { V as Vfs, C as Cred, a as VirtualTcpNetwork } from './contracts-B6SHFjma.cjs';
-export { m as ROOT_CRED, v as makeCred } from './contracts-B6SHFjma.cjs';
-export { M as MemoryVolume } from './memory-volume-CRhXUyCN.cjs';
+import { V as Vfs, C as Cred, a as VirtualTcpNetwork } from './contracts-BHo4LdY2.cjs';
+export { m as ROOT_CRED, v as makeCred } from './contracts-BHo4LdY2.cjs';
+export { M as MemoryVolume } from './memory-volume-e-uJFRnG.cjs';
 
 /**
  * Open-file descriptions: the thing a descriptor points *at*.

package/dist/python-abi.d.ts

@@ -1,6 +1,6 @@
-import { V as Vfs, C as Cred, a as VirtualTcpNetwork } from './contracts-B6SHFjma.js';
-export { m as ROOT_CRED, v as makeCred } from './contracts-B6SHFjma.js';
-export { M as MemoryVolume } from './memory-volume-CwiXvRfs.js';
+import { V as Vfs, C as Cred, a as VirtualTcpNetwork } from './contracts-BHo4LdY2.js';
+export { m as ROOT_CRED, v as makeCred } from './contracts-BHo4LdY2.js';
+export { M as MemoryVolume } from './memory-volume-meoRW8ST.js';
 
 /**
  * Open-file descriptions: the thing a descriptor points *at*.

package/dist/service-worker.js

@@ -1,3 +1,58 @@
+// src/preview/fetch-client.ts
+function installPreviewFetch(scope) {
+  const MARKER = "__sbx__/";
+  const at = scope.location.pathname.indexOf(MARKER);
+  if (at < 0) return;
+  const base = scope.location.origin + scope.location.pathname.slice(0, at + MARKER.length);
+  const LOOPBACK = /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[?::1\]?|[^.]+\.localhost)$/i;
+  const rewrite = (value) => {
+    let url;
+    try {
+      url = new URL(value, scope.location.href);
+    } catch {
+      return value;
+    }
+    const secure = url.protocol === "https:" || url.protocol === "wss:";
+    if (!secure && url.protocol !== "http:" && url.protocol !== "ws:") return value;
+    if (!LOOPBACK.test(url.hostname)) return value;
+    const port = url.port || (secure ? "443" : "80");
+    return `${base}${port}${url.pathname}${url.search}${url.hash}`;
+  };
+  const originalFetch = scope.fetch;
+  if (typeof originalFetch === "function") {
+    scope.fetch = function patched(input, init) {
+      if (typeof input === "string" || input instanceof URL) {
+        return originalFetch.call(this, rewrite(String(input)), init);
+      }
+      const moved = input && typeof input === "object" && "url" in input ? rewrite(input.url) : null;
+      if (moved === null || moved === input.url) {
+        return originalFetch.call(this, input, init);
+      }
+      return originalFetch.call(this, new Request(moved, input), init);
+    };
+  }
+  const open = scope.XMLHttpRequest?.prototype?.open;
+  if (typeof open === "function") {
+    scope.XMLHttpRequest.prototype.open = function patched(method, url, ...rest) {
+      return open.call(this, method, rewrite(String(url)), ...rest);
+    };
+  }
+  const OriginalEventSource = scope.EventSource;
+  if (typeof OriginalEventSource === "function") {
+    const Patched = function(url, init) {
+      return new OriginalEventSource(rewrite(String(url)), init);
+    };
+    Patched.prototype = OriginalEventSource.prototype;
+    for (const name of ["CONNECTING", "OPEN", "CLOSED"]) {
+      Object.defineProperty(Patched, name, { value: OriginalEventSource[name], enumerable: true });
+    }
+    scope.EventSource = Patched;
+  }
+}
+function previewFetchSource() {
+  return `(function(){try{(${installPreviewFetch.toString()})(window);}catch(error){console.warn("sandboxedjs: loopback rewriting unavailable",error);}})();`;
+}
+
 // src/preview/ws-client.ts
 function installPreviewSockets(scope) {
   const Native = scope.WebSocket;
@@ -419,6 +474,19 @@ var PreviewRouter = class {
   portFor(clientId) {
     return this.clientPorts.get(clientId);
   }
+  /**
+   * The container port one request is for, by path first and client second.
+   *
+   * A port named in the path wins, because that is how a previewed page
+   * reaches its *other* servers: the frontend's document is bound to 3000, and
+   * its call to the backend arrives as `__sbx__/8000/…`. Reading the port from
+   * the path also means such a request needs nothing remembered about who is
+   * asking — which matters, because this worker is stopped whenever it looks
+   * idle and every binding it held is gone when it starts again.
+   */
+  portForRequest(pathname, clientId) {
+    return this.claimedPort(pathname) ?? this.portFor(clientId);
+  }
   /** A response has come back from the page. */
   settle(id, response) {
     const resolve = this.pending.get(id);
@@ -498,7 +566,7 @@ function withSockets(body, headers) {
   const encoding = headers.get("content-encoding");
   if (encoding && encoding.toLowerCase() !== "identity") return body;
   const html = new TextDecoder().decode(body);
-  const tag = `<script>${previewSocketSource()}<\/script>`;
+  const tag = `<script>${previewSocketSource()}${previewFetchSource()}<\/script>`;
   const head = /<head[^>]*>/i.exec(html);
   const at = head ? head.index + head[0].length : 0;
   const bytes = new TextEncoder().encode(html.slice(0, at) + tag + html.slice(at));
@@ -591,7 +659,7 @@ worker.addEventListener("fetch", (event) => {
     event.respondWith(router.fetch(claimed, "/", event.request, event.resultingClientId || event.clientId));
     return;
   }
-  const port = router.portFor(event.clientId);
+  const port = router.portForRequest(url.pathname, event.clientId);
   if (port === void 0) return;
   event.respondWith(
     router.fetch(port, router.containerPath(url.pathname, url.search), event.request, event.clientId)