concurrent-c-node 0.7.0__tar.gz → 0.10.0__tar.gz

{concurrent_c_node-0.7.0 → concurrent_c_node-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: concurrent-c-node
-Version: 0.7.0
+Version: 0.10.0
 Summary: JavaScript and npm packages from Python over the Concurrent-C bridge: one spawned Node child per domain, host-controlled lifetime.
 License: MIT
 Project-URL: Repository, https://github.com/sreekotay/concurrent-c
@@ -40,7 +40,7 @@ dependencies, nothing to build.  The domain **is** a spawned `node`
 child (~28ms to first call), so you get real Node: full stdlib, native
 addons, whatever npm installs.  Promise-based APIs look synchronous
 from Python, and bulk data crosses through **shared memory** — an 8MB
-array in **9ms** where the same values as a JSON list take 583ms.
+array in **9.5ms** where the same values as a JSON list take 499ms.
 
 ```
 pip install concurrent-c-node   # needs node on PATH (or point at one)
@@ -60,11 +60,12 @@ Import stays `import cc_node`. Examples ship in the wheel. The mirror of
 - **The domain rules hold**: handles never cross bridges; `stats()` is
   the handle ledger and `release()` drops one early; `destroy()` is
   idempotent, every door answers `bridge is closed` after, and the
-  child dies with the bridge (and on host exit, via stdin EOF).
+  child dies with the bridge (and on host exit, via wire-fd EOF).
   Teardown is **cooperative** (farewell `close` + drain, then wait /
   kill-fallback): in-flight calls may still return a correct value.
-  Hard child death (`SIGKILL`, `process.abort`) is a different contract —
-  in-flight ops must reject. See
+  There is no clean cancel of CPU-bound JS work — wait, or kill the
+  child (`SIGKILL` / `process.abort`) and create a new domain. Hard death
+  must reject in-flight ops. See
   [`bridge_stress.md`](https://github.com/sreekotay/concurrent-c/blob/main/stress/bridge/bridge_stress.md).
 
 ## Async is free
@@ -146,21 +147,30 @@ From the Concurrent-C repo root (packs this wheel and the npm sibling):
 From `python -m cc_node.examples.bench_wire` (sources under
 [`cc_node/examples/`](https://github.com/sreekotay/concurrent-c/blob/main/pypi/cc-node/cc_node/examples/))
 on a 4-vCPU x86-64 box, node 22 / python 3.11
-([`perf/baselines/cc_node_bridge_py_20260809.txt`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/cc_node_bridge_py_20260809.txt);
+([`perf/baselines/cc_node_bridge_py_20260810.txt`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/cc_node_bridge_py_20260810.txt);
 catalog: [`perf/baselines/README.md`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/README.md)):
 
 | what | result |
 |---|---|
 | spawn a domain (node child, first eval) | 28ms |
-| wire round trip (smallest call) | 116µs |
-| Python-callback round trip (JS → Python → JS) | 238µs |
-| 8MB `array('d')` argument, shm spill | **9.2ms** |
-| the same 8MB as a JSON list | 583ms — the spill is **63x** |
-
-The wire is strict request/response JSON over stdio with the
-shared-memory spill for bulk data — the same discipline concurrent-c-python's
-isolated domains speak, mirrored.  True pinned zero-copy leases remain
-future work.
+| wire round trip (smallest call) | 105µs |
+| Python-callback round trip (JS → Python → JS) | 153µs |
+| 8MB `array('d')` argument, shm spill | **9.5ms** |
+| the same 8MB as a JSON list | 499ms — the spill is **52x** |
+
+The wire is strict request/response JSON on dedicated fds — replies
+pair by request id, and stdio stays yours, so `console.log` in
+evaluated JS reaches the real stdout and can never collide with a
+protocol reply — with the shared-memory spill for bulk data (private
+0700 per-bridge directory, 0600 exclusive-create files, removed with
+the bridge).  The same discipline concurrent-c-python's isolated
+domains speak, mirrored.  True pinned zero-copy leases remain future
+work.
+
+One boundary, stated plainly: the domain is **crash isolation, not a
+security sandbox** — the node child inherits your environment and runs
+with your OS privileges, so do not run untrusted JavaScript through
+it.
 
 A worked tour (builtin Node modules, chains, callbacks, thenables,
 buffers — no npm install needed):

{concurrent_c_node-0.7.0 → concurrent_c_node-0.10.0}/README.md

@@ -29,7 +29,7 @@ dependencies, nothing to build.  The domain **is** a spawned `node`
 child (~28ms to first call), so you get real Node: full stdlib, native
 addons, whatever npm installs.  Promise-based APIs look synchronous
 from Python, and bulk data crosses through **shared memory** — an 8MB
-array in **9ms** where the same values as a JSON list take 583ms.
+array in **9.5ms** where the same values as a JSON list take 499ms.
 
 ```
 pip install concurrent-c-node   # needs node on PATH (or point at one)
@@ -49,11 +49,12 @@ Import stays `import cc_node`. Examples ship in the wheel. The mirror of
 - **The domain rules hold**: handles never cross bridges; `stats()` is
   the handle ledger and `release()` drops one early; `destroy()` is
   idempotent, every door answers `bridge is closed` after, and the
-  child dies with the bridge (and on host exit, via stdin EOF).
+  child dies with the bridge (and on host exit, via wire-fd EOF).
   Teardown is **cooperative** (farewell `close` + drain, then wait /
   kill-fallback): in-flight calls may still return a correct value.
-  Hard child death (`SIGKILL`, `process.abort`) is a different contract —
-  in-flight ops must reject. See
+  There is no clean cancel of CPU-bound JS work — wait, or kill the
+  child (`SIGKILL` / `process.abort`) and create a new domain. Hard death
+  must reject in-flight ops. See
   [`bridge_stress.md`](https://github.com/sreekotay/concurrent-c/blob/main/stress/bridge/bridge_stress.md).
 
 ## Async is free
@@ -135,21 +136,30 @@ From the Concurrent-C repo root (packs this wheel and the npm sibling):
 From `python -m cc_node.examples.bench_wire` (sources under
 [`cc_node/examples/`](https://github.com/sreekotay/concurrent-c/blob/main/pypi/cc-node/cc_node/examples/))
 on a 4-vCPU x86-64 box, node 22 / python 3.11
-([`perf/baselines/cc_node_bridge_py_20260809.txt`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/cc_node_bridge_py_20260809.txt);
+([`perf/baselines/cc_node_bridge_py_20260810.txt`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/cc_node_bridge_py_20260810.txt);
 catalog: [`perf/baselines/README.md`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/README.md)):
 
 | what | result |
 |---|---|
 | spawn a domain (node child, first eval) | 28ms |
-| wire round trip (smallest call) | 116µs |
-| Python-callback round trip (JS → Python → JS) | 238µs |
-| 8MB `array('d')` argument, shm spill | **9.2ms** |
-| the same 8MB as a JSON list | 583ms — the spill is **63x** |
-
-The wire is strict request/response JSON over stdio with the
-shared-memory spill for bulk data — the same discipline concurrent-c-python's
-isolated domains speak, mirrored.  True pinned zero-copy leases remain
-future work.
+| wire round trip (smallest call) | 105µs |
+| Python-callback round trip (JS → Python → JS) | 153µs |
+| 8MB `array('d')` argument, shm spill | **9.5ms** |
+| the same 8MB as a JSON list | 499ms — the spill is **52x** |
+
+The wire is strict request/response JSON on dedicated fds — replies
+pair by request id, and stdio stays yours, so `console.log` in
+evaluated JS reaches the real stdout and can never collide with a
+protocol reply — with the shared-memory spill for bulk data (private
+0700 per-bridge directory, 0600 exclusive-create files, removed with
+the bridge).  The same discipline concurrent-c-python's isolated
+domains speak, mirrored.  True pinned zero-copy leases remain future
+work.
+
+One boundary, stated plainly: the domain is **crash isolation, not a
+security sandbox** — the node child inherits your environment and runs
+with your OS privileges, so do not run untrusted JavaScript through
+it.
 
 A worked tour (builtin Node modules, chains, callbacks, thenables,
 buffers — no npm install needed):

{concurrent_c_node-0.7.0 → concurrent_c_node-0.10.0}/cc_node/__init__.py

@@ -24,7 +24,9 @@ import base64
 import json
 import math
 import os
+import shutil
 import subprocess
+import tempfile
 
 __all__ = ["create", "JsError", "JsHandle", "__version__"]
 __version__ = "0.4.0"
@@ -49,20 +51,11 @@ def _numpy():
         return None
 
 
-def _shm_dir():
+def _shm_base():
     d = os.environ.get("CC_NODE_SHM_DIR")
     if d:
         return d
-    return "/dev/shm" if os.path.isdir("/dev/shm") else None
-
-
-def _shm_write(raw):
-    _shm_seq[0] += 1
-    path = os.path.join(_shm_dir(), "ccnode-%d-%d" % (os.getpid(),
-                                                      _shm_seq[0]))
-    with open(path, "wb") as f:
-        f.write(raw)
-    return path
+    return "/dev/shm" if os.path.isdir("/dev/shm") else tempfile.gettempdir()
 
 
 class JsError(RuntimeError):
@@ -123,17 +116,39 @@ class Bridge:
         broker = os.path.join(os.path.dirname(os.path.abspath(__file__)),
                               "broker.cjs")
         node = node or os.environ.get("CC_NODE_BIN", "node")
+        # Spills live in a private 0700 per-bridge directory (predictable
+        # names in a shared /dev/shm invite pre-creation races and
+        # umask-dependent exposure); the child writes its spills there
+        # too, and the directory goes with the bridge.
+        self._shm_dir = tempfile.mkdtemp(
+            prefix="ccnode-%d-" % os.getpid(), dir=_shm_base())
+        # The wire lives on dedicated fds; stdio is inherited, so
+        # console.log in evaluated JS reaches the real stdout and can
+        # never collide with a protocol reply.  pass_fds keeps our fd
+        # numbers in the child, so the broker learns them from the env.
+        req_r, req_w = os.pipe()
+        resp_r, resp_w = os.pipe()
+        env = dict(os.environ,
+                   CC_WIRE_IN=str(req_r), CC_WIRE_OUT=str(resp_w),
+                   CC_NODE_SHM_DIR=self._shm_dir)
         try:
             self._p = subprocess.Popen(
                 [node, broker],
-                stdin=subprocess.PIPE,
-                stdout=subprocess.PIPE,
+                pass_fds=(req_r, resp_w),
+                env=env,
                 cwd=os.getcwd(),
             )
         except FileNotFoundError:
+            for fd in (req_r, req_w, resp_r, resp_w):
+                os.close(fd)
+            shutil.rmtree(self._shm_dir, ignore_errors=True)
             raise JsError(
                 "cc-node: no node executable (install Node, or set "
                 "CC_NODE_BIN)") from None
+        os.close(req_r)
+        os.close(resp_w)
+        self._wire_w = os.fdopen(req_w, "wb")
+        self._wire_r = os.fdopen(resp_r, "rb")
         self.closed = False
         self._nid = 1
         self._cbs = {}
@@ -150,8 +165,14 @@ class Bridge:
 
     def _send(self, obj):
         line = json.dumps(obj, allow_nan=False) + "\n"
-        self._p.stdin.write(line.encode("utf-8"))
-        self._p.stdin.flush()
+        try:
+            self._wire_w.write(line.encode("utf-8"))
+            self._wire_w.flush()
+        except (BrokenPipeError, ValueError, OSError):
+            # The child died under this write (e.g. killed from inside a
+            # callback).  Every door answers the same way after death.
+            self.closed = True
+            raise JsError("cc-node: the node child exited") from None
 
     def _queue_release(self, hid):
         self._pending_release.append(hid)
@@ -166,6 +187,14 @@ class Bridge:
             except Exception:
                 pass
 
+    def _shm_write(self, raw):
+        _shm_seq[0] += 1
+        path = os.path.join(self._shm_dir, "s%d" % _shm_seq[0])
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(fd, "wb") as f:
+            f.write(raw)
+        return path
+
     def _flush_shm(self):
         # The child unlinks spill files as it decodes; this sweep only
         # matters when it died first (ENOENT is the normal case).
@@ -186,7 +215,7 @@ class Bridge:
         if parked is not None:
             return self._take_reply(parked)
         while True:
-            line = self._p.stdout.readline()
+            line = self._wire_r.readline()
             if not line:
                 self.closed = True
                 raise JsError("cc-node: the node child exited")
@@ -235,7 +264,10 @@ class Bridge:
             args = [self._decode_result(a) for a in msg["args"]]
             self._send({"cbr": msg["cbid"], "v": self._encode(fn(*args))})
         except Exception as e:  # crosses back as a JS error, message intact
-            self._send({"cbr": msg["cbid"], "e": str(e)})
+            try:
+                self._send({"cbr": msg["cbid"], "e": str(e)})
+            except Exception:
+                pass  # child gone; the in-flight op surfaces EOF next read
 
     # ---- values ----
 
@@ -294,8 +326,8 @@ class Bridge:
                     raw = np.ascontiguousarray(a).tobytes()
         if raw is None or kind is None:
             return None
-        if len(raw) > _SHM_SPILL and _shm_dir():
-            path = _shm_write(raw)
+        if len(raw) > _SHM_SPILL:
+            path = self._shm_write(raw)
             self._shm_out.append(path)
             return {"$shm": path, "t": kind}
         return {"$ta": kind, "b64": base64.b64encode(raw).decode("ascii")}
@@ -372,15 +404,22 @@ class Bridge:
         self._close_pending = False
         self.closed = True
         try:
-            if self._p.poll() is None and self._p.stdin \
-                    and not self._p.stdin.closed:
+            if self._p.poll() is None and not self._wire_w.closed:
                 rid = self._nid
                 self._nid += 1
                 self._send({"id": rid, "op": "close"})
         except Exception:
             pass
         try:
-            self._p.stdin.close()
+            self._wire_w.close()
+        except Exception:
+            pass
+        # Drain to EOF so the broker's farewell reply has somewhere to
+        # land — closing the reply fd under its write is an EPIPE crash
+        # in the child.
+        try:
+            while self._wire_r.readline():
+                pass
         except Exception:
             pass
         try:
@@ -390,6 +429,11 @@ class Bridge:
                 self._p.kill()
             except Exception:
                 pass
+        try:
+            self._wire_r.close()
+        except Exception:
+            pass
+        shutil.rmtree(self._shm_dir, ignore_errors=True)
         if self in _live:
             _live.remove(self)
 

{concurrent_c_node-0.7.0 → concurrent_c_node-0.10.0}/cc_node/broker.cjs

@@ -1,7 +1,12 @@
 #!/usr/bin/env node
 /* cc-node broker: the Node end of Python's JS bridge.
  *
- * Line-delimited JSON over stdio, strict request/response.  Handles are
+ * Line-delimited JSON on DEDICATED wire fds, strict request/response —
+ * stdin/stdout/stderr stay the user's, so console.log in evaluated
+ * code reaches the real stdout and can never collide with a protocol
+ * reply.  Requests arrive on fd 3, replies leave on fd 4; a parent
+ * that cannot pin fd numbers (python's pass_fds keeps the parent's
+ * numbering) says which via CC_WIRE_IN / CC_WIRE_OUT.  Handles are
  * integers into one table; results follow the bridge materialization
  * rule — plain data (finite numbers, strings, booleans, null, arrays
  * and plain objects of the same) crosses as a value, everything else
@@ -10,7 +15,7 @@
  * Python callable crosses as {$f: id}; invoking it sends a nested `cb`
  * request and BLOCKS on a synchronous read for the answer — legal
  * because the protocol is strictly alternating, so nothing else can be
- * in flight.  stdin EOF is the host vanishing: exit.
+ * in flight.  EOF on the request fd is the host vanishing: exit.
  *
  * cc/include/ccc/script/js.cch embeds this file verbatim (the CC
  * isolated tier speaks the same wire); js_iso_smoke pins the two
@@ -20,11 +25,14 @@
 const fs = require('fs');
 const { createRequire } = require('module');
 
+const IN_FD = Number(process.env.CC_WIRE_IN || 3);
+const OUT_FD = Number(process.env.CC_WIRE_OUT || 4);
+
 /* Resolve packages from the HOST's cwd — `npm install lodash` next to
  * your Python program is the point. */
 const requireCwd = createRequire(process.cwd() + '/');
 
-/* ---- one buffered reader over fd 0, sync and async ---- */
+/* ---- one buffered reader over the request fd, sync and async ---- */
 const rbuf = { data: Buffer.alloc(0) };
 
 function takeLine() {
@@ -42,7 +50,7 @@ function readLineSync() {
     const chunk = Buffer.alloc(65536);
     let n = 0;
     try {
-      n = fs.readSync(0, chunk, 0, chunk.length, null);
+      n = fs.readSync(IN_FD, chunk, 0, chunk.length, null);
     } catch (e) {
       if (e.code === 'EAGAIN') continue;
       if (e.code === 'EOF') return null;
@@ -58,7 +66,7 @@ function readLineAsync() {
   if (l !== null) return Promise.resolve(l);
   return new Promise((resolve, reject) => {
     const chunk = Buffer.alloc(65536);
-    fs.read(0, chunk, 0, chunk.length, null, (err, n) => {
+    fs.read(IN_FD, chunk, 0, chunk.length, null, (err, n) => {
       if (err) return err.code === 'EOF' ? resolve(null) : reject(err);
       if (n === 0) return resolve(null);
       rbuf.data = Buffer.concat([rbuf.data, chunk.subarray(0, n)]);
@@ -68,7 +76,12 @@ function readLineAsync() {
 }
 
 function send(obj) {
-  fs.writeSync(1, JSON.stringify(obj) + '\n');
+  try {
+    fs.writeSync(OUT_FD, JSON.stringify(obj) + '\n');
+  } catch (e) {
+    if (e.code === 'EPIPE') process.exit(0); /* host went away */
+    throw e;
+  }
 }
 
 /* ---- handles + materialization ---- */
@@ -102,7 +115,8 @@ function isPlain(v, depth) {
 
 /* Typed buffers cross as tagged bytes: small inline as base64, big
  * through the shared-memory spill (one memcpy per side; the receiver
- * consumes-and-unlinks).  Same discipline as cc-python's wire. */
+ * consumes-and-unlinks; files are 0600, exclusive-create, inside the
+ * host's private bridge dir).  Same discipline as cc-python's wire. */
 const TA_KIND = new Map([
   [Float64Array, 'f64'], [Float32Array, 'f32'],
   [Int32Array, 'i32'], [BigInt64Array, 'i64'], [Uint8Array, 'u8'],
@@ -120,8 +134,8 @@ let shmSeq = 0;
 function encodeBuffer(kind, buf) {
   if (buf.byteLength > SHM_SPILL) {
     const p = require('path').join(
-        SHM_DIR, 'ccnode-' + process.pid + '-' + (++shmSeq));
-    fs.writeFileSync(p, buf);
+        SHM_DIR, 'ccnode-c' + process.pid + '-' + (++shmSeq));
+    fs.writeFileSync(p, buf, { flag: 'wx', mode: 0o600 });
     return { shm: p, t: kind };
   }
   return { ta: kind, b64: buf.toString('base64') };

{concurrent_c_node-0.7.0 → concurrent_c_node-0.10.0}/concurrent_c_node.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: concurrent-c-node
-Version: 0.7.0
+Version: 0.10.0
 Summary: JavaScript and npm packages from Python over the Concurrent-C bridge: one spawned Node child per domain, host-controlled lifetime.
 License: MIT
 Project-URL: Repository, https://github.com/sreekotay/concurrent-c
@@ -40,7 +40,7 @@ dependencies, nothing to build.  The domain **is** a spawned `node`
 child (~28ms to first call), so you get real Node: full stdlib, native
 addons, whatever npm installs.  Promise-based APIs look synchronous
 from Python, and bulk data crosses through **shared memory** — an 8MB
-array in **9ms** where the same values as a JSON list take 583ms.
+array in **9.5ms** where the same values as a JSON list take 499ms.
 
 ```
 pip install concurrent-c-node   # needs node on PATH (or point at one)
@@ -60,11 +60,12 @@ Import stays `import cc_node`. Examples ship in the wheel. The mirror of
 - **The domain rules hold**: handles never cross bridges; `stats()` is
   the handle ledger and `release()` drops one early; `destroy()` is
   idempotent, every door answers `bridge is closed` after, and the
-  child dies with the bridge (and on host exit, via stdin EOF).
+  child dies with the bridge (and on host exit, via wire-fd EOF).
   Teardown is **cooperative** (farewell `close` + drain, then wait /
   kill-fallback): in-flight calls may still return a correct value.
-  Hard child death (`SIGKILL`, `process.abort`) is a different contract —
-  in-flight ops must reject. See
+  There is no clean cancel of CPU-bound JS work — wait, or kill the
+  child (`SIGKILL` / `process.abort`) and create a new domain. Hard death
+  must reject in-flight ops. See
   [`bridge_stress.md`](https://github.com/sreekotay/concurrent-c/blob/main/stress/bridge/bridge_stress.md).
 
 ## Async is free
@@ -146,21 +147,30 @@ From the Concurrent-C repo root (packs this wheel and the npm sibling):
 From `python -m cc_node.examples.bench_wire` (sources under
 [`cc_node/examples/`](https://github.com/sreekotay/concurrent-c/blob/main/pypi/cc-node/cc_node/examples/))
 on a 4-vCPU x86-64 box, node 22 / python 3.11
-([`perf/baselines/cc_node_bridge_py_20260809.txt`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/cc_node_bridge_py_20260809.txt);
+([`perf/baselines/cc_node_bridge_py_20260810.txt`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/cc_node_bridge_py_20260810.txt);
 catalog: [`perf/baselines/README.md`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/README.md)):
 
 | what | result |
 |---|---|
 | spawn a domain (node child, first eval) | 28ms |
-| wire round trip (smallest call) | 116µs |
-| Python-callback round trip (JS → Python → JS) | 238µs |
-| 8MB `array('d')` argument, shm spill | **9.2ms** |
-| the same 8MB as a JSON list | 583ms — the spill is **63x** |
-
-The wire is strict request/response JSON over stdio with the
-shared-memory spill for bulk data — the same discipline concurrent-c-python's
-isolated domains speak, mirrored.  True pinned zero-copy leases remain
-future work.
+| wire round trip (smallest call) | 105µs |
+| Python-callback round trip (JS → Python → JS) | 153µs |
+| 8MB `array('d')` argument, shm spill | **9.5ms** |
+| the same 8MB as a JSON list | 499ms — the spill is **52x** |
+
+The wire is strict request/response JSON on dedicated fds — replies
+pair by request id, and stdio stays yours, so `console.log` in
+evaluated JS reaches the real stdout and can never collide with a
+protocol reply — with the shared-memory spill for bulk data (private
+0700 per-bridge directory, 0600 exclusive-create files, removed with
+the bridge).  The same discipline concurrent-c-python's isolated
+domains speak, mirrored.  True pinned zero-copy leases remain future
+work.
+
+One boundary, stated plainly: the domain is **crash isolation, not a
+security sandbox** — the node child inherits your environment and runs
+with your OS privileges, so do not run untrusted JavaScript through
+it.
 
 A worked tour (builtin Node modules, chains, callbacks, thenables,
 buffers — no npm install needed):

{concurrent_c_node-0.7.0 → concurrent_c_node-0.10.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "concurrent-c-node"
-version = "0.7.0"
+version = "0.10.0"
 description = "JavaScript and npm packages from Python over the Concurrent-C bridge: one spawned Node child per domain, host-controlled lifetime."
 readme = "README.md"
 requires-python = ">=3.8"