concurrent-c-node 0.7.0__tar.gz → 0.11.0__tar.gz

{concurrent_c_node-0.7.0 → concurrent_c_node-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: concurrent-c-node
-Version: 0.7.0
+Version: 0.11.0
 Summary: JavaScript and npm packages from Python over the Concurrent-C bridge: one spawned Node child per domain, host-controlled lifetime.
 License: MIT
 Project-URL: Repository, https://github.com/sreekotay/concurrent-c
@@ -24,7 +24,7 @@ package bridge):
 ```python
 import cc_node
 
-js = cc_node.create()                # an Isolation Domain: one node child
+js = cc_node.create()                # always a SEPARATE node process
 _ = js.require('lodash')             # resolved from YOUR cwd's node_modules
 _.chunk([1, 2, 3, 4, 5], 2)          # [[1, 2], [3, 4], [5]]
 _.sortBy([{'n': 3}, {'n': 1}], 'n')  # dicts cross as objects, and back
@@ -35,12 +35,28 @@ semver.satisfies('1.2.3', '^1.0.0')  # True
 js.destroy()                         # or: with cc_node.create() as js: ...
 ```
 
-The bridge is **pure Python, stdlib only** — no compiled code, no
-dependencies, nothing to build.  The domain **is** a spawned `node`
-child (~28ms to first call), so you get real Node: full stdlib, native
-addons, whatever npm installs.  Promise-based APIs look synchronous
-from Python, and bulk data crosses through **shared memory** — an 8MB
-array in **9ms** where the same values as a JSON list take 583ms.
+## Separate process by design
+
+Unlike [`concurrent-c-python`](https://github.com/sreekotay/concurrent-c/tree/main/npm/cc-python)
+(whose **default** embeds libpython in the Node process, with
+`{ isolated: true }` as the child-process opt-in), **every**
+`cc_node.create()` is already the isolated tier: one spawned `node`
+child per domain.  There is no in-process Node embed from Python —
+you get real Node (full stdlib, native addons, whatever `npm install`
+put next to your program), crash isolation, and a wire you can measure.
+
+N domains are N OS processes: **full multi-core speedup** — fan work
+across `create()` handles and they run on separate cores, no shared
+event-loop or GIL between them.
+
+| | this package — separate `node` process | Concurrent-C hosted (not this wheel) |
+|---|---|---|
+| API | `cc_node.create()` from Python | `cc_js_new(false, &a)` in a `.ccs` program |
+| Where JS runs | own `node` child | libnode in the CC process |
+| Hot call | **~105µs** wire RTT | sub-µs (needs `libnode-dev`) |
+| Bulk buffers | shm spill — 8MB in **9.5ms** (52× a JSON list) | in-process |
+| Parallelism | **N children = N cores — full multi-core speedup** | one process (V8's rule) |
+| Crash | child dies → error; Python parent lives | shared fate with the host |
 
 ```
 pip install concurrent-c-node   # needs node on PATH (or point at one)
@@ -48,9 +64,39 @@ python -m cc_node.examples.use_node
 python -m cc_node.examples.bench_wire
 ```
 
-Import stays `import cc_node`. Examples ship in the wheel. The mirror of
-[`concurrent-c-python`](https://github.com/sreekotay/concurrent-c/tree/main/npm/cc-python)
-— same domain model, same materialization rules, pointed the other way:
+## Measured (separate-process wire)
+
+From `python -m cc_node.examples.bench_wire` (sources under
+[`cc_node/examples/`](https://github.com/sreekotay/concurrent-c/blob/main/pypi/cc-node/cc_node/examples/))
+on a 4-vCPU x86-64 box, node 22 / python 3.11
+([`perf/baselines/cc_node_bridge_py_20260810.txt`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/cc_node_bridge_py_20260810.txt);
+catalog: [`perf/baselines/README.md`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/README.md)):
+
+| what | result |
+|---|---|
+| spawn a domain (node child, first eval) | **28ms** |
+| wire round trip (smallest call) | **105µs** |
+| Python-callback round trip (JS → Python → JS) | **153µs** |
+| 8MB `array('d')` argument, shm spill | **9.5ms** |
+| the same 8MB as a JSON list | 499ms — the spill is **52x** |
+
+The wire is strict request/response JSON on dedicated fds — replies
+pair by request id, and stdio stays yours, so `console.log` in
+evaluated JS reaches the real stdout and can never collide with a
+protocol reply — with the shared-memory spill for bulk data (private
+0700 per-bridge directory, 0600 exclusive-create files, removed with
+the bridge).  The same discipline concurrent-c-python's
+`{ isolated: true }` domains speak, mirrored.
+
+One boundary, stated plainly: the domain is **crash isolation, not a
+security sandbox** — the node child inherits your environment and runs
+with your OS privileges, so do not run untrusted JavaScript through
+it.
+
+The bridge is **pure Python, stdlib only** — no compiled code, no
+dependencies, nothing to build.  Import stays `import cc_node`.
+Examples ship in the wheel. Same domain model and materialization
+rules as the npm sibling, pointed the other way:
 
 - **Values**: plain data (finite numbers, strings, booleans, `None`,
   lists/dicts of the same) crosses by value; everything else is a live
@@ -60,11 +106,12 @@ Import stays `import cc_node`. Examples ship in the wheel. The mirror of
 - **The domain rules hold**: handles never cross bridges; `stats()` is
   the handle ledger and `release()` drops one early; `destroy()` is
   idempotent, every door answers `bridge is closed` after, and the
-  child dies with the bridge (and on host exit, via stdin EOF).
+  child dies with the bridge (and on host exit, via wire-fd EOF).
   Teardown is **cooperative** (farewell `close` + drain, then wait /
   kill-fallback): in-flight calls may still return a correct value.
-  Hard child death (`SIGKILL`, `process.abort`) is a different contract —
-  in-flight ops must reject. See
+  There is no clean cancel of CPU-bound JS work — wait, or kill the
+  child (`SIGKILL` / `process.abort`) and create a new domain. Hard death
+  must reject in-flight ops. See
   [`bridge_stress.md`](https://github.com/sreekotay/concurrent-c/blob/main/stress/bridge/bridge_stress.md).
 
 ## Async is free
@@ -128,9 +175,11 @@ And *which packages* it sees is the working directory's
 Run Python in your project, get your project's packages: `npm install`
 next to your program is the whole setup.
 
-(Writing Concurrent-C itself rather than Python?  There is a zero-IPC
-tier: `cc_js_new(false, &a)` boots libnode *inside* your CC program — see
-[`examples/js/jsdemo.shcc`](https://github.com/sreekotay/concurrent-c/blob/main/examples/js/jsdemo.shcc).)
+Writing Concurrent-C itself rather than Python?  The zero-IPC hosted
+tier is `cc_js_new(false, &a)` (needs libnode) —
+[`examples/js/jsdemo.shcc`](https://github.com/sreekotay/concurrent-c/blob/main/examples/js/jsdemo.shcc);
+`cc_js_new(true, &a)` is the same separate-process wire this package
+speaks, from CC.
 
 ## Publishing
 
@@ -141,27 +190,6 @@ From the Concurrent-C repo root (packs this wheel and the npm sibling):
 ./scripts/publish_bridges.sh --publish    # bump patch, pack, twine + npm publish
 ```
 
-## Measured
-
-From `python -m cc_node.examples.bench_wire` (sources under
-[`cc_node/examples/`](https://github.com/sreekotay/concurrent-c/blob/main/pypi/cc-node/cc_node/examples/))
-on a 4-vCPU x86-64 box, node 22 / python 3.11
-([`perf/baselines/cc_node_bridge_py_20260809.txt`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/cc_node_bridge_py_20260809.txt);
-catalog: [`perf/baselines/README.md`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/README.md)):
-
-| what | result |
-|---|---|
-| spawn a domain (node child, first eval) | 28ms |
-| wire round trip (smallest call) | 116µs |
-| Python-callback round trip (JS → Python → JS) | 238µs |
-| 8MB `array('d')` argument, shm spill | **9.2ms** |
-| the same 8MB as a JSON list | 583ms — the spill is **63x** |
-
-The wire is strict request/response JSON over stdio with the
-shared-memory spill for bulk data — the same discipline concurrent-c-python's
-isolated domains speak, mirrored.  True pinned zero-copy leases remain
-future work.
-
 A worked tour (builtin Node modules, chains, callbacks, thenables,
 buffers — no npm install needed):
 `python -m cc_node.examples.use_node`.

{concurrent_c_node-0.7.0 → concurrent_c_node-0.11.0}/README.md

@@ -13,7 +13,7 @@ package bridge):
 ```python
 import cc_node
 
-js = cc_node.create()                # an Isolation Domain: one node child
+js = cc_node.create()                # always a SEPARATE node process
 _ = js.require('lodash')             # resolved from YOUR cwd's node_modules
 _.chunk([1, 2, 3, 4, 5], 2)          # [[1, 2], [3, 4], [5]]
 _.sortBy([{'n': 3}, {'n': 1}], 'n')  # dicts cross as objects, and back
@@ -24,12 +24,28 @@ semver.satisfies('1.2.3', '^1.0.0')  # True
 js.destroy()                         # or: with cc_node.create() as js: ...
 ```
 
-The bridge is **pure Python, stdlib only** — no compiled code, no
-dependencies, nothing to build.  The domain **is** a spawned `node`
-child (~28ms to first call), so you get real Node: full stdlib, native
-addons, whatever npm installs.  Promise-based APIs look synchronous
-from Python, and bulk data crosses through **shared memory** — an 8MB
-array in **9ms** where the same values as a JSON list take 583ms.
+## Separate process by design
+
+Unlike [`concurrent-c-python`](https://github.com/sreekotay/concurrent-c/tree/main/npm/cc-python)
+(whose **default** embeds libpython in the Node process, with
+`{ isolated: true }` as the child-process opt-in), **every**
+`cc_node.create()` is already the isolated tier: one spawned `node`
+child per domain.  There is no in-process Node embed from Python —
+you get real Node (full stdlib, native addons, whatever `npm install`
+put next to your program), crash isolation, and a wire you can measure.
+
+N domains are N OS processes: **full multi-core speedup** — fan work
+across `create()` handles and they run on separate cores, no shared
+event-loop or GIL between them.
+
+| | this package — separate `node` process | Concurrent-C hosted (not this wheel) |
+|---|---|---|
+| API | `cc_node.create()` from Python | `cc_js_new(false, &a)` in a `.ccs` program |
+| Where JS runs | own `node` child | libnode in the CC process |
+| Hot call | **~105µs** wire RTT | sub-µs (needs `libnode-dev`) |
+| Bulk buffers | shm spill — 8MB in **9.5ms** (52× a JSON list) | in-process |
+| Parallelism | **N children = N cores — full multi-core speedup** | one process (V8's rule) |
+| Crash | child dies → error; Python parent lives | shared fate with the host |
 
 ```
 pip install concurrent-c-node   # needs node on PATH (or point at one)
@@ -37,9 +53,39 @@ python -m cc_node.examples.use_node
 python -m cc_node.examples.bench_wire
 ```
 
-Import stays `import cc_node`. Examples ship in the wheel. The mirror of
-[`concurrent-c-python`](https://github.com/sreekotay/concurrent-c/tree/main/npm/cc-python)
-— same domain model, same materialization rules, pointed the other way:
+## Measured (separate-process wire)
+
+From `python -m cc_node.examples.bench_wire` (sources under
+[`cc_node/examples/`](https://github.com/sreekotay/concurrent-c/blob/main/pypi/cc-node/cc_node/examples/))
+on a 4-vCPU x86-64 box, node 22 / python 3.11
+([`perf/baselines/cc_node_bridge_py_20260810.txt`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/cc_node_bridge_py_20260810.txt);
+catalog: [`perf/baselines/README.md`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/README.md)):
+
+| what | result |
+|---|---|
+| spawn a domain (node child, first eval) | **28ms** |
+| wire round trip (smallest call) | **105µs** |
+| Python-callback round trip (JS → Python → JS) | **153µs** |
+| 8MB `array('d')` argument, shm spill | **9.5ms** |
+| the same 8MB as a JSON list | 499ms — the spill is **52x** |
+
+The wire is strict request/response JSON on dedicated fds — replies
+pair by request id, and stdio stays yours, so `console.log` in
+evaluated JS reaches the real stdout and can never collide with a
+protocol reply — with the shared-memory spill for bulk data (private
+0700 per-bridge directory, 0600 exclusive-create files, removed with
+the bridge).  The same discipline concurrent-c-python's
+`{ isolated: true }` domains speak, mirrored.
+
+One boundary, stated plainly: the domain is **crash isolation, not a
+security sandbox** — the node child inherits your environment and runs
+with your OS privileges, so do not run untrusted JavaScript through
+it.
+
+The bridge is **pure Python, stdlib only** — no compiled code, no
+dependencies, nothing to build.  Import stays `import cc_node`.
+Examples ship in the wheel. Same domain model and materialization
+rules as the npm sibling, pointed the other way:
 
 - **Values**: plain data (finite numbers, strings, booleans, `None`,
   lists/dicts of the same) crosses by value; everything else is a live
@@ -49,11 +95,12 @@ Import stays `import cc_node`. Examples ship in the wheel. The mirror of
 - **The domain rules hold**: handles never cross bridges; `stats()` is
   the handle ledger and `release()` drops one early; `destroy()` is
   idempotent, every door answers `bridge is closed` after, and the
-  child dies with the bridge (and on host exit, via stdin EOF).
+  child dies with the bridge (and on host exit, via wire-fd EOF).
   Teardown is **cooperative** (farewell `close` + drain, then wait /
   kill-fallback): in-flight calls may still return a correct value.
-  Hard child death (`SIGKILL`, `process.abort`) is a different contract —
-  in-flight ops must reject. See
+  There is no clean cancel of CPU-bound JS work — wait, or kill the
+  child (`SIGKILL` / `process.abort`) and create a new domain. Hard death
+  must reject in-flight ops. See
   [`bridge_stress.md`](https://github.com/sreekotay/concurrent-c/blob/main/stress/bridge/bridge_stress.md).
 
 ## Async is free
@@ -117,9 +164,11 @@ And *which packages* it sees is the working directory's
 Run Python in your project, get your project's packages: `npm install`
 next to your program is the whole setup.
 
-(Writing Concurrent-C itself rather than Python?  There is a zero-IPC
-tier: `cc_js_new(false, &a)` boots libnode *inside* your CC program — see
-[`examples/js/jsdemo.shcc`](https://github.com/sreekotay/concurrent-c/blob/main/examples/js/jsdemo.shcc).)
+Writing Concurrent-C itself rather than Python?  The zero-IPC hosted
+tier is `cc_js_new(false, &a)` (needs libnode) —
+[`examples/js/jsdemo.shcc`](https://github.com/sreekotay/concurrent-c/blob/main/examples/js/jsdemo.shcc);
+`cc_js_new(true, &a)` is the same separate-process wire this package
+speaks, from CC.
 
 ## Publishing
 
@@ -130,27 +179,6 @@ From the Concurrent-C repo root (packs this wheel and the npm sibling):
 ./scripts/publish_bridges.sh --publish    # bump patch, pack, twine + npm publish
 ```
 
-## Measured
-
-From `python -m cc_node.examples.bench_wire` (sources under
-[`cc_node/examples/`](https://github.com/sreekotay/concurrent-c/blob/main/pypi/cc-node/cc_node/examples/))
-on a 4-vCPU x86-64 box, node 22 / python 3.11
-([`perf/baselines/cc_node_bridge_py_20260809.txt`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/cc_node_bridge_py_20260809.txt);
-catalog: [`perf/baselines/README.md`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/README.md)):
-
-| what | result |
-|---|---|
-| spawn a domain (node child, first eval) | 28ms |
-| wire round trip (smallest call) | 116µs |
-| Python-callback round trip (JS → Python → JS) | 238µs |
-| 8MB `array('d')` argument, shm spill | **9.2ms** |
-| the same 8MB as a JSON list | 583ms — the spill is **63x** |
-
-The wire is strict request/response JSON over stdio with the
-shared-memory spill for bulk data — the same discipline concurrent-c-python's
-isolated domains speak, mirrored.  True pinned zero-copy leases remain
-future work.
-
 A worked tour (builtin Node modules, chains, callbacks, thenables,
 buffers — no npm install needed):
 `python -m cc_node.examples.use_node`.

{concurrent_c_node-0.7.0 → concurrent_c_node-0.11.0}/cc_node/__init__.py

@@ -24,7 +24,9 @@ import base64
 import json
 import math
 import os
+import shutil
 import subprocess
+import tempfile
 
 __all__ = ["create", "JsError", "JsHandle", "__version__"]
 __version__ = "0.4.0"
@@ -49,20 +51,11 @@ def _numpy():
         return None
 
 
-def _shm_dir():
+def _shm_base():
     d = os.environ.get("CC_NODE_SHM_DIR")
     if d:
         return d
-    return "/dev/shm" if os.path.isdir("/dev/shm") else None
-
-
-def _shm_write(raw):
-    _shm_seq[0] += 1
-    path = os.path.join(_shm_dir(), "ccnode-%d-%d" % (os.getpid(),
-                                                      _shm_seq[0]))
-    with open(path, "wb") as f:
-        f.write(raw)
-    return path
+    return "/dev/shm" if os.path.isdir("/dev/shm") else tempfile.gettempdir()
 
 
 class JsError(RuntimeError):
@@ -123,17 +116,39 @@ class Bridge:
         broker = os.path.join(os.path.dirname(os.path.abspath(__file__)),
                               "broker.cjs")
         node = node or os.environ.get("CC_NODE_BIN", "node")
+        # Spills live in a private 0700 per-bridge directory (predictable
+        # names in a shared /dev/shm invite pre-creation races and
+        # umask-dependent exposure); the child writes its spills there
+        # too, and the directory goes with the bridge.
+        self._shm_dir = tempfile.mkdtemp(
+            prefix="ccnode-%d-" % os.getpid(), dir=_shm_base())
+        # The wire lives on dedicated fds; stdio is inherited, so
+        # console.log in evaluated JS reaches the real stdout and can
+        # never collide with a protocol reply.  pass_fds keeps our fd
+        # numbers in the child, so the broker learns them from the env.
+        req_r, req_w = os.pipe()
+        resp_r, resp_w = os.pipe()
+        env = dict(os.environ,
+                   CC_WIRE_IN=str(req_r), CC_WIRE_OUT=str(resp_w),
+                   CC_NODE_SHM_DIR=self._shm_dir)
         try:
             self._p = subprocess.Popen(
                 [node, broker],
-                stdin=subprocess.PIPE,
-                stdout=subprocess.PIPE,
+                pass_fds=(req_r, resp_w),
+                env=env,
                 cwd=os.getcwd(),
             )
         except FileNotFoundError:
+            for fd in (req_r, req_w, resp_r, resp_w):
+                os.close(fd)
+            shutil.rmtree(self._shm_dir, ignore_errors=True)
             raise JsError(
                 "cc-node: no node executable (install Node, or set "
                 "CC_NODE_BIN)") from None
+        os.close(req_r)
+        os.close(resp_w)
+        self._wire_w = os.fdopen(req_w, "wb")
+        self._wire_r = os.fdopen(resp_r, "rb")
         self.closed = False
         self._nid = 1
         self._cbs = {}
@@ -150,8 +165,14 @@ class Bridge:
 
     def _send(self, obj):
         line = json.dumps(obj, allow_nan=False) + "\n"
-        self._p.stdin.write(line.encode("utf-8"))
-        self._p.stdin.flush()
+        try:
+            self._wire_w.write(line.encode("utf-8"))
+            self._wire_w.flush()
+        except (BrokenPipeError, ValueError, OSError):
+            # The child died under this write (e.g. killed from inside a
+            # callback).  Every door answers the same way after death.
+            self.closed = True
+            raise JsError("cc-node: the node child exited") from None
 
     def _queue_release(self, hid):
         self._pending_release.append(hid)
@@ -166,6 +187,14 @@ class Bridge:
             except Exception:
                 pass
 
+    def _shm_write(self, raw):
+        _shm_seq[0] += 1
+        path = os.path.join(self._shm_dir, "s%d" % _shm_seq[0])
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(fd, "wb") as f:
+            f.write(raw)
+        return path
+
     def _flush_shm(self):
         # The child unlinks spill files as it decodes; this sweep only
         # matters when it died first (ENOENT is the normal case).
@@ -186,7 +215,7 @@ class Bridge:
         if parked is not None:
             return self._take_reply(parked)
         while True:
-            line = self._p.stdout.readline()
+            line = self._wire_r.readline()
             if not line:
                 self.closed = True
                 raise JsError("cc-node: the node child exited")
@@ -235,7 +264,10 @@ class Bridge:
             args = [self._decode_result(a) for a in msg["args"]]
             self._send({"cbr": msg["cbid"], "v": self._encode(fn(*args))})
         except Exception as e:  # crosses back as a JS error, message intact
-            self._send({"cbr": msg["cbid"], "e": str(e)})
+            try:
+                self._send({"cbr": msg["cbid"], "e": str(e)})
+            except Exception:
+                pass  # child gone; the in-flight op surfaces EOF next read
 
     # ---- values ----
 
@@ -294,8 +326,8 @@ class Bridge:
                     raw = np.ascontiguousarray(a).tobytes()
         if raw is None or kind is None:
             return None
-        if len(raw) > _SHM_SPILL and _shm_dir():
-            path = _shm_write(raw)
+        if len(raw) > _SHM_SPILL:
+            path = self._shm_write(raw)
             self._shm_out.append(path)
             return {"$shm": path, "t": kind}
         return {"$ta": kind, "b64": base64.b64encode(raw).decode("ascii")}
@@ -372,15 +404,22 @@ class Bridge:
         self._close_pending = False
         self.closed = True
         try:
-            if self._p.poll() is None and self._p.stdin \
-                    and not self._p.stdin.closed:
+            if self._p.poll() is None and not self._wire_w.closed:
                 rid = self._nid
                 self._nid += 1
                 self._send({"id": rid, "op": "close"})
         except Exception:
             pass
         try:
-            self._p.stdin.close()
+            self._wire_w.close()
+        except Exception:
+            pass
+        # Drain to EOF so the broker's farewell reply has somewhere to
+        # land — closing the reply fd under its write is an EPIPE crash
+        # in the child.
+        try:
+            while self._wire_r.readline():
+                pass
         except Exception:
             pass
         try:
@@ -390,6 +429,11 @@ class Bridge:
                 self._p.kill()
             except Exception:
                 pass
+        try:
+            self._wire_r.close()
+        except Exception:
+            pass
+        shutil.rmtree(self._shm_dir, ignore_errors=True)
         if self in _live:
             _live.remove(self)
 

{concurrent_c_node-0.7.0 → concurrent_c_node-0.11.0}/cc_node/broker.cjs

@@ -1,7 +1,12 @@
 #!/usr/bin/env node
 /* cc-node broker: the Node end of Python's JS bridge.
  *
- * Line-delimited JSON over stdio, strict request/response.  Handles are
+ * Line-delimited JSON on DEDICATED wire fds, strict request/response —
+ * stdin/stdout/stderr stay the user's, so console.log in evaluated
+ * code reaches the real stdout and can never collide with a protocol
+ * reply.  Requests arrive on fd 3, replies leave on fd 4; a parent
+ * that cannot pin fd numbers (python's pass_fds keeps the parent's
+ * numbering) says which via CC_WIRE_IN / CC_WIRE_OUT.  Handles are
  * integers into one table; results follow the bridge materialization
  * rule — plain data (finite numbers, strings, booleans, null, arrays
  * and plain objects of the same) crosses as a value, everything else
@@ -10,7 +15,7 @@
  * Python callable crosses as {$f: id}; invoking it sends a nested `cb`
  * request and BLOCKS on a synchronous read for the answer — legal
  * because the protocol is strictly alternating, so nothing else can be
- * in flight.  stdin EOF is the host vanishing: exit.
+ * in flight.  EOF on the request fd is the host vanishing: exit.
  *
  * cc/include/ccc/script/js.cch embeds this file verbatim (the CC
  * isolated tier speaks the same wire); js_iso_smoke pins the two
@@ -20,11 +25,14 @@
 const fs = require('fs');
 const { createRequire } = require('module');
 
+const IN_FD = Number(process.env.CC_WIRE_IN || 3);
+const OUT_FD = Number(process.env.CC_WIRE_OUT || 4);
+
 /* Resolve packages from the HOST's cwd — `npm install lodash` next to
  * your Python program is the point. */
 const requireCwd = createRequire(process.cwd() + '/');
 
-/* ---- one buffered reader over fd 0, sync and async ---- */
+/* ---- one buffered reader over the request fd, sync and async ---- */
 const rbuf = { data: Buffer.alloc(0) };
 
 function takeLine() {
@@ -42,7 +50,7 @@ function readLineSync() {
     const chunk = Buffer.alloc(65536);
     let n = 0;
     try {
-      n = fs.readSync(0, chunk, 0, chunk.length, null);
+      n = fs.readSync(IN_FD, chunk, 0, chunk.length, null);
     } catch (e) {
       if (e.code === 'EAGAIN') continue;
       if (e.code === 'EOF') return null;
@@ -58,7 +66,7 @@ function readLineAsync() {
   if (l !== null) return Promise.resolve(l);
   return new Promise((resolve, reject) => {
     const chunk = Buffer.alloc(65536);
-    fs.read(0, chunk, 0, chunk.length, null, (err, n) => {
+    fs.read(IN_FD, chunk, 0, chunk.length, null, (err, n) => {
       if (err) return err.code === 'EOF' ? resolve(null) : reject(err);
       if (n === 0) return resolve(null);
       rbuf.data = Buffer.concat([rbuf.data, chunk.subarray(0, n)]);
@@ -68,7 +76,12 @@ function readLineAsync() {
 }
 
 function send(obj) {
-  fs.writeSync(1, JSON.stringify(obj) + '\n');
+  try {
+    fs.writeSync(OUT_FD, JSON.stringify(obj) + '\n');
+  } catch (e) {
+    if (e.code === 'EPIPE') process.exit(0); /* host went away */
+    throw e;
+  }
 }
 
 /* ---- handles + materialization ---- */
@@ -102,7 +115,8 @@ function isPlain(v, depth) {
 
 /* Typed buffers cross as tagged bytes: small inline as base64, big
  * through the shared-memory spill (one memcpy per side; the receiver
- * consumes-and-unlinks).  Same discipline as cc-python's wire. */
+ * consumes-and-unlinks; files are 0600, exclusive-create, inside the
+ * host's private bridge dir).  Same discipline as cc-python's wire. */
 const TA_KIND = new Map([
   [Float64Array, 'f64'], [Float32Array, 'f32'],
   [Int32Array, 'i32'], [BigInt64Array, 'i64'], [Uint8Array, 'u8'],
@@ -120,8 +134,8 @@ let shmSeq = 0;
 function encodeBuffer(kind, buf) {
   if (buf.byteLength > SHM_SPILL) {
     const p = require('path').join(
-        SHM_DIR, 'ccnode-' + process.pid + '-' + (++shmSeq));
-    fs.writeFileSync(p, buf);
+        SHM_DIR, 'ccnode-c' + process.pid + '-' + (++shmSeq));
+    fs.writeFileSync(p, buf, { flag: 'wx', mode: 0o600 });
     return { shm: p, t: kind };
   }
   return { ta: kind, b64: buf.toString('base64') };

{concurrent_c_node-0.7.0 → concurrent_c_node-0.11.0}/concurrent_c_node.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: concurrent-c-node
-Version: 0.7.0
+Version: 0.11.0
 Summary: JavaScript and npm packages from Python over the Concurrent-C bridge: one spawned Node child per domain, host-controlled lifetime.
 License: MIT
 Project-URL: Repository, https://github.com/sreekotay/concurrent-c
@@ -24,7 +24,7 @@ package bridge):
 ```python
 import cc_node
 
-js = cc_node.create()                # an Isolation Domain: one node child
+js = cc_node.create()                # always a SEPARATE node process
 _ = js.require('lodash')             # resolved from YOUR cwd's node_modules
 _.chunk([1, 2, 3, 4, 5], 2)          # [[1, 2], [3, 4], [5]]
 _.sortBy([{'n': 3}, {'n': 1}], 'n')  # dicts cross as objects, and back
@@ -35,12 +35,28 @@ semver.satisfies('1.2.3', '^1.0.0')  # True
 js.destroy()                         # or: with cc_node.create() as js: ...
 ```
 
-The bridge is **pure Python, stdlib only** — no compiled code, no
-dependencies, nothing to build.  The domain **is** a spawned `node`
-child (~28ms to first call), so you get real Node: full stdlib, native
-addons, whatever npm installs.  Promise-based APIs look synchronous
-from Python, and bulk data crosses through **shared memory** — an 8MB
-array in **9ms** where the same values as a JSON list take 583ms.
+## Separate process by design
+
+Unlike [`concurrent-c-python`](https://github.com/sreekotay/concurrent-c/tree/main/npm/cc-python)
+(whose **default** embeds libpython in the Node process, with
+`{ isolated: true }` as the child-process opt-in), **every**
+`cc_node.create()` is already the isolated tier: one spawned `node`
+child per domain.  There is no in-process Node embed from Python —
+you get real Node (full stdlib, native addons, whatever `npm install`
+put next to your program), crash isolation, and a wire you can measure.
+
+N domains are N OS processes: **full multi-core speedup** — fan work
+across `create()` handles and they run on separate cores, no shared
+event-loop or GIL between them.
+
+| | this package — separate `node` process | Concurrent-C hosted (not this wheel) |
+|---|---|---|
+| API | `cc_node.create()` from Python | `cc_js_new(false, &a)` in a `.ccs` program |
+| Where JS runs | own `node` child | libnode in the CC process |
+| Hot call | **~105µs** wire RTT | sub-µs (needs `libnode-dev`) |
+| Bulk buffers | shm spill — 8MB in **9.5ms** (52× a JSON list) | in-process |
+| Parallelism | **N children = N cores — full multi-core speedup** | one process (V8's rule) |
+| Crash | child dies → error; Python parent lives | shared fate with the host |
 
 ```
 pip install concurrent-c-node   # needs node on PATH (or point at one)
@@ -48,9 +64,39 @@ python -m cc_node.examples.use_node
 python -m cc_node.examples.bench_wire
 ```
 
-Import stays `import cc_node`. Examples ship in the wheel. The mirror of
-[`concurrent-c-python`](https://github.com/sreekotay/concurrent-c/tree/main/npm/cc-python)
-— same domain model, same materialization rules, pointed the other way:
+## Measured (separate-process wire)
+
+From `python -m cc_node.examples.bench_wire` (sources under
+[`cc_node/examples/`](https://github.com/sreekotay/concurrent-c/blob/main/pypi/cc-node/cc_node/examples/))
+on a 4-vCPU x86-64 box, node 22 / python 3.11
+([`perf/baselines/cc_node_bridge_py_20260810.txt`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/cc_node_bridge_py_20260810.txt);
+catalog: [`perf/baselines/README.md`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/README.md)):
+
+| what | result |
+|---|---|
+| spawn a domain (node child, first eval) | **28ms** |
+| wire round trip (smallest call) | **105µs** |
+| Python-callback round trip (JS → Python → JS) | **153µs** |
+| 8MB `array('d')` argument, shm spill | **9.5ms** |
+| the same 8MB as a JSON list | 499ms — the spill is **52x** |
+
+The wire is strict request/response JSON on dedicated fds — replies
+pair by request id, and stdio stays yours, so `console.log` in
+evaluated JS reaches the real stdout and can never collide with a
+protocol reply — with the shared-memory spill for bulk data (private
+0700 per-bridge directory, 0600 exclusive-create files, removed with
+the bridge).  The same discipline concurrent-c-python's
+`{ isolated: true }` domains speak, mirrored.
+
+One boundary, stated plainly: the domain is **crash isolation, not a
+security sandbox** — the node child inherits your environment and runs
+with your OS privileges, so do not run untrusted JavaScript through
+it.
+
+The bridge is **pure Python, stdlib only** — no compiled code, no
+dependencies, nothing to build.  Import stays `import cc_node`.
+Examples ship in the wheel. Same domain model and materialization
+rules as the npm sibling, pointed the other way:
 
 - **Values**: plain data (finite numbers, strings, booleans, `None`,
   lists/dicts of the same) crosses by value; everything else is a live
@@ -60,11 +106,12 @@ Import stays `import cc_node`. Examples ship in the wheel. The mirror of
 - **The domain rules hold**: handles never cross bridges; `stats()` is
   the handle ledger and `release()` drops one early; `destroy()` is
   idempotent, every door answers `bridge is closed` after, and the
-  child dies with the bridge (and on host exit, via stdin EOF).
+  child dies with the bridge (and on host exit, via wire-fd EOF).
   Teardown is **cooperative** (farewell `close` + drain, then wait /
   kill-fallback): in-flight calls may still return a correct value.
-  Hard child death (`SIGKILL`, `process.abort`) is a different contract —
-  in-flight ops must reject. See
+  There is no clean cancel of CPU-bound JS work — wait, or kill the
+  child (`SIGKILL` / `process.abort`) and create a new domain. Hard death
+  must reject in-flight ops. See
   [`bridge_stress.md`](https://github.com/sreekotay/concurrent-c/blob/main/stress/bridge/bridge_stress.md).
 
 ## Async is free
@@ -128,9 +175,11 @@ And *which packages* it sees is the working directory's
 Run Python in your project, get your project's packages: `npm install`
 next to your program is the whole setup.
 
-(Writing Concurrent-C itself rather than Python?  There is a zero-IPC
-tier: `cc_js_new(false, &a)` boots libnode *inside* your CC program — see
-[`examples/js/jsdemo.shcc`](https://github.com/sreekotay/concurrent-c/blob/main/examples/js/jsdemo.shcc).)
+Writing Concurrent-C itself rather than Python?  The zero-IPC hosted
+tier is `cc_js_new(false, &a)` (needs libnode) —
+[`examples/js/jsdemo.shcc`](https://github.com/sreekotay/concurrent-c/blob/main/examples/js/jsdemo.shcc);
+`cc_js_new(true, &a)` is the same separate-process wire this package
+speaks, from CC.
 
 ## Publishing
 
@@ -141,27 +190,6 @@ From the Concurrent-C repo root (packs this wheel and the npm sibling):
 ./scripts/publish_bridges.sh --publish    # bump patch, pack, twine + npm publish
 ```
 
-## Measured
-
-From `python -m cc_node.examples.bench_wire` (sources under
-[`cc_node/examples/`](https://github.com/sreekotay/concurrent-c/blob/main/pypi/cc-node/cc_node/examples/))
-on a 4-vCPU x86-64 box, node 22 / python 3.11
-([`perf/baselines/cc_node_bridge_py_20260809.txt`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/cc_node_bridge_py_20260809.txt);
-catalog: [`perf/baselines/README.md`](https://github.com/sreekotay/concurrent-c/blob/main/perf/baselines/README.md)):
-
-| what | result |
-|---|---|
-| spawn a domain (node child, first eval) | 28ms |
-| wire round trip (smallest call) | 116µs |
-| Python-callback round trip (JS → Python → JS) | 238µs |
-| 8MB `array('d')` argument, shm spill | **9.2ms** |
-| the same 8MB as a JSON list | 583ms — the spill is **63x** |
-
-The wire is strict request/response JSON over stdio with the
-shared-memory spill for bulk data — the same discipline concurrent-c-python's
-isolated domains speak, mirrored.  True pinned zero-copy leases remain
-future work.
-
 A worked tour (builtin Node modules, chains, callbacks, thenables,
 buffers — no npm install needed):
 `python -m cc_node.examples.use_node`.

{concurrent_c_node-0.7.0 → concurrent_c_node-0.11.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "concurrent-c-node"
-version = "0.7.0"
+version = "0.11.0"
 description = "JavaScript and npm packages from Python over the Concurrent-C bridge: one spawned Node child per domain, host-controlled lifetime."
 readme = "README.md"
 requires-python = ">=3.8"