Skip to content

feat(stdlib): uuid, binascii, shlex and secrets subsets, and the yt-dlp wall measurement - #806

Draft
espetro wants to merge 5 commits into
work/cyclesfrom
work/stdlibtab
Draft

espetro wants to merge 5 commits into
work/cyclesfrom
work/stdlibtab

Conversation

@espetro

@espetro espetro commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

Adds uuid, binascii (hexlify, unhexlify), shlex (split, quote, join) and secrets (token_hex, token_bytes, randbelow) to the lowered stdlib subset, each with runtime C, dispatch, import-table wiring, differential tests against CPython (32 tests) and numbered divergence entries (#48 to #51 in docs/reference/divergences.md).

Measurement that matters more than the commits

The yt-dlp native share did not move materially from stdlib work: 19 of 10025 definitions (0.19%) at the baseline assess, 23 of 4836 (0.48%) on the per-definition harness under the island lane. The difference is the measurement plane, not these commits.

The closed import table is not the wall:

  • Adding all 36 remaining off-table stdlib modules to the queue changed the plane map not at all (4836 definitions, 23 native); reverted.
  • Removing every import-table fence frees zero definitions, since each also has another fence.
  • Under the island lane there are zero "not in the closed import table" fences.

The wall is the class-base cascade: 4268 of the 4806 fenced definitions (88.7%) are fenced by nothing but "this class base is not lowered" (2957) and "class X runs on the island floor" (1311). The root is yt_dlp.extractor.common.InfoExtractor, island-side because of hundreds of unannotated parameters, 17 class-body assigns, decorators and a nested ClassDef, so about 1200 extractor subclasses ride the island with it. lazy_extractors (2047 definitions) is the same through its metaclass.

One in-table lever: functools.partial refuses keyword arguments (lower/_closures.py:123), the sole fence isolating the yt_dlp.networking re-export for 30 extractor module top levels. Keyword support is a design change to the closure stub, not a runtime row.

Report: stdlibtab session, off-table inventory ranked by fence presence.

🤖 Generated with Claude Code

Agent added 5 commits November 2, 2026 14:44
The closed subset covers the four shapes yt-dlp uses: the two random
generators, the name-based generator and the canonical text of a parsed
UUID. The runtime draws the random bytes from the entropy source, sets
the version and variant bits and prints the canonical form; uuid5 hashes
the namespace bytes and the name bytes with SHA-1, exactly as CPython
does, so uuid5 and UUID match CPython byte for byte.

The UUID class is not lowered as a class: `UUID(text)` returns the
canonical text, so `str(UUID(text))` reads the way CPython's does. The
`.hex` attribute of a lowered uuid call is the canonical text without the
dashes, which is what CPython's UUID.hex holds; it lowers to a runtime
helper on the same text rather than claiming that `str` has a `.hex`.

The `.int`, `.urn` and `.bytes` forms stay refused.
The module is queued and lowered: the table names it, the import classifier
reads it as a lowered stdlib module and the member table answers for the
four shapes yt-dlp uses. The gates lock the queue order the table expects.
The closed subset covers the hexadecimal codec yt-dlp uses: the decoder
turns an even-length hex text into bytes and the encoder turns bytes back
into the lowercase hex text. Both match CPython byte for byte, including
the error cases: an odd-length string and a non-hex character raise
ValueError, which is what CPython binascii.Error reads as at an
except (ValueError, ...) handler.

The decoder rejects a str argument to hexlify at compile time, where
CPython raises TypeError at run time; the divergence names that.
The closed subset covers the shell lexer yt-dlp uses for command lines
and config words: split runs CPython's POSIX-mode state machine, so the
words match CPython's byte for byte across the quoting, escaping and
comment rules, and an unterminated quote or a trailing backslash raises
ValueError as CPython's does. quote and join spell a word and a list of
words the way CPython's safe-set quoting does.

The comments flag is a constant bool folded at lowering time, where
CPython reads it at run time; the divergence names that. A randomized
differential run of 120,000 split cases and 80,000 quote cases matched
CPython with zero mismatches.

The shlex class itself, the posix flag and punctuation_chars stay
refused (PS2001).
…andbelow

The closed subset covers the cryptographically strong helpers yt-dlp
draws a device id and a pseudo-random byte from: the bytes come from the
host entropy source, the source CPython's SystemRandom reads through
os.urandom, so the shapes match CPython's while the values differ by
construction. randbelow draws the way CPython's
SystemRandom._randbelow draws it, so the result is uniform in [0, n).

The byte count is a constant int and defaults to CPython's 32 bytes;
randbelow(0) raises ValueError, as CPython's does. Every other secrets
name stays refused (PS2001).
@espetro espetro added this to the v0.8.0 milestone Nov 2, 2026
@espetro espetro added this to pyscriptc Nov 2, 2026
@github-project-automation github-project-automation Bot moved this to Todo in pyscriptc Nov 2, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

1 participant