@jerryan/just-bash 3.5.0

package/dist/types.d.ts

@@ -0,0 +1,319 @@
+import type { ByteString } from "./encoding.js";
+import type { CommandExecutionBudget } from "./execution-scope.js";
+import type { IFileSystem } from "./fs/interface.js";
+import type { ExecutionLimits } from "./limits.js";
+import type { SecureFetch } from "./network/index.js";
+/**
+ * Lightweight interface for feature coverage tracking during fuzzing.
+ * Lives here to avoid circular dependencies between fuzzing → core modules.
+ */
+export interface FeatureCoverageWriter {
+    hit(feature: string): void;
+}
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    /** The final environment variables after execution (only set by BashEnv.exec) */
+    env?: Record<string, string>;
+    /**
+     * Explicit metadata for what shape `stdout` is in. The pipeline + redirect
+     * layers consult this instead of guessing from string contents:
+     *
+     *   - `"text"`: `stdout` is JS Unicode text. The pipeline UTF-8 encodes it
+     *     before handing it to the next command's stdin; redirects write it
+     *     as UTF-8.
+     *   - `"bytes"`: `stdout` is a latin1-shaped byte buffer (each char = one
+     *     byte). The pipeline forwards the bytes verbatim; redirects write
+     *     them as binary.
+     *
+     * Producers should set this via `textOutput()` / `bytesOutput()` from
+     * `encoding.ts` rather than poking the raw flag. Absent values fall back
+     * to the legacy `stdoutEncoding` heuristic for back-compat with older
+     * commands that haven't been migrated yet.
+     */
+    stdoutKind?: "text" | "bytes";
+    /**
+     * Legacy alias for `stdoutKind: "bytes"`. Older commands set this to
+     * `"binary"` to mark binary output. New code should prefer `stdoutKind`.
+     */
+    stdoutEncoding?: "binary";
+    /** @internal PIPESTATUS override used by synthesized transform builtins. */
+    internalPipeStatusOverride?: number[];
+    /** @internal Leaf command that produced output through wrapper builtins. */
+    internalProducerCommand?: string;
+    /** @internal Whether `exec` gives the producer external diagnostic formatting. */
+    internalProducerOmitsShellPrefix?: boolean;
+    /** @internal Bytes consumed from a descriptor-backed stdin stream. */
+    internalStdinConsumed?: number;
+    /**
+     * Bytes in the current result that have already been charged to the shared
+     * execution output budget. Interpreter plumbing must preserve this when it
+     * combines child results so nested shells do not refresh or double-charge
+     * the budget.
+     * @internal
+     */
+    internalOutputAccounting?: {
+        stdout: number;
+        stderr: number;
+    };
+}
+/**
+ * Result of statically analyzing a script's command usage without
+ * executing it. Produced by Bash.analyzeCommands().
+ */
+export interface CommandAnalysis {
+    /**
+     * Every literal simple-command name in the script, deduplicated in
+     * first-encountered order (including names inside function bodies,
+     * subshells, command substitutions, and compound-command bodies).
+     */
+    commands: string[];
+    /**
+     * The subset of `commands` that would fail command resolution at
+     * dispatch time: not a builtin, not a registered command, not a
+     * function defined on this instance or within the script itself, and
+     * not an executable file found on the VFS PATH.
+     */
+    unresolved: string[];
+}
+/** Result from BashEnv.exec() - always includes env */
+export interface BashExecResult extends ExecResult {
+    env: Record<string, string>;
+    metadata?: Record<string, unknown>;
+    /**
+     * Command names that failed resolution ("command not found") during this
+     * exec() call, deduplicated in first-encountered order. Captured from
+     * anywhere in the script — subshells, pipelines, command substitutions,
+     * nested `bash -c`. Set by Bash.exec(); empty when every command
+     * resolved. See BashOptions.abortOnUnresolvedCommands for fail-fast
+     * behavior.
+     */
+    unresolvedCommands?: string[];
+}
+/** Options for exec calls within commands (internal API) */
+export interface CommandExecOptions {
+    /** Environment variables to merge into the exec state */
+    env?: Record<string, string>;
+    /**
+     * Replace the execution environment instead of merging with parent env.
+     * Useful for implementing `env -i` semantics safely without shell prefixes.
+     */
+    replaceEnv?: boolean;
+    /**
+     * Working directory for the exec.
+     * Required to prevent bugs where subcommands run in the wrong directory.
+     * Always pass `ctx.cwd` from the calling command's context.
+     */
+    cwd: string;
+    /**
+     * Standard input to pass to the subcommand.
+     * Optional - if not provided, stdin will be empty.
+     */
+    stdin?: string;
+    /**
+     * Shape of {@link stdin}:
+     *   - `"text"` (default): JS Unicode text. UTF-8 encoded into bytes
+     *     before reaching the subcommand, so byte consumers (`wc -c`,
+     *     `base64`, `md5sum`) inside the script see real UTF-8 bytes.
+     *   - `"bytes"`: a latin1-shaped byte buffer (each char = one byte,
+     *     e.g. from `Buffer.from(...).toString("latin1")`). Forwarded
+     *     verbatim — useful for piping raw binary into commands like
+     *     `gzip -d`.
+     */
+    stdinKind?: "text" | "bytes";
+    /**
+     * Abort signal for cooperative cancellation.
+     * When aborted, the interpreter stops executing at the next statement boundary.
+     * Used by `timeout` to ensure timed-out commands don't continue running.
+     */
+    signal?: AbortSignal;
+    /**
+     * Additional argv entries appended to the first executed command.
+     * Values bypass shell parsing entirely — no escaping, splitting, or globbing.
+     * Like child_process.spawnSync(cmd, args).
+     */
+    args?: string[];
+}
+/**
+ * Context provided to commands during execution.
+ *
+ * ## Field Availability
+ *
+ * **Always available (core fields):**
+ * - `fs`, `cwd`, `env`, `stdin`
+ *
+ * **Available when running via BashEnv interpreter:**
+ * - `exec` - For commands like `xargs`, `bash -c` that need to run subcommands
+ * - `getRegisteredCommands` - For the `help` command to list available commands
+ *
+ * **Conditionally available based on configuration:**
+ * - `fetch` - Only when `network` option is configured in BashEnv
+ * - `sleep` - Only when a custom sleep function is provided (e.g., for testing)
+ */
+/**
+ * Performance trace event for profiling command execution
+ */
+export interface TraceEvent {
+    /** Event category (e.g., "find", "grep") */
+    category: string;
+    /** Event name (e.g., "readdir", "stat", "eval") */
+    name: string;
+    /** Duration in milliseconds */
+    durationMs: number;
+    /** Optional details (e.g., path, count) */
+    details?: Record<string, unknown>;
+}
+/**
+ * Trace callback function for receiving performance events
+ */
+export type TraceCallback = (event: TraceEvent) => void;
+export interface RuntimeCommandContext {
+    /** Virtual filesystem interface for file operations */
+    fs: IFileSystem;
+    /** Stable identity of the underlying filesystem across defense wrappers. */
+    fsIdentity?: object;
+    /** Current working directory */
+    cwd: string;
+    /** Environment variables - uses Map to prevent prototype pollution */
+    env: Map<string, string>;
+    /** Interpreter-owned assignment gateway for commands such as `printf -v`. */
+    assignShellVariable?: (name: string, value: string, subscript?: string) => void | Promise<void>;
+    /**
+     * Exported environment variables only.
+     * Used by commands like printenv and env that should only show exported vars.
+     * In bash, only exported variables are passed to child processes.
+     */
+    exportedEnv?: Record<string, string>;
+    /**
+     * Standard input as a byte buffer. Opaque on purpose — see `encoding.ts`.
+     *
+     * Pipelines carry bytes (a previous command's stdout becomes this stdin).
+     * Choose a conversion at the use site:
+     *   - `latin1FromBytes(ctx.stdin)` to forward bytes unchanged (cat, head,
+     *     tee, base64 -d, gzip, ...).
+     *   - `decodeBytesToUtf8(ctx.stdin)` to interpret as UTF-8 text (jq, sed,
+     *     grep, awk, parsers, code execution, char-position math, ...).
+     * Mixing the two — calling string methods on a latin1 byte buffer that
+     * actually holds UTF-8 — is the bug class this type prevents.
+     */
+    stdin: ByteString;
+    /**
+     * Execution limits configuration.
+     * Fully resolved by Bash before a command is invoked.
+     */
+    limits: Required<ExecutionLimits>;
+    /** Shared top-level accounting, present for interpreter-dispatched commands. */
+    executionScope?: CommandExecutionBudget;
+    /**
+     * Performance trace callback for profiling.
+     * If provided, commands emit timing events for analysis.
+     */
+    trace?: TraceCallback;
+    /**
+     * Execute a subcommand (e.g., for `xargs`, `bash -c`).
+     * Available when running commands via BashEnv interpreter.
+     *
+     * @param command - The command string to execute
+     * @param options - Required options including `cwd` to prevent directory bugs
+     */
+    exec?: (command: string, options: CommandExecOptions) => Promise<ExecResult>;
+    /**
+     * Invoke the bundled command shadowed by the current custom command.
+     * Available only when a custom command overrides a bundled command.
+     */
+    origCommand?: (args: string[]) => Promise<ExecResult>;
+    /** @internal Closed path for forwarding this command's already-accounted stdin. */
+    execWithInheritedStdin?: (command: string, options: Omit<CommandExecOptions, "stdin" | "stdinKind">) => Promise<ExecResult>;
+    /**
+     * Secure fetch function for network requests (e.g., for `curl`).
+     * Only available when `network` option is configured in BashEnv.
+     */
+    fetch?: SecureFetch;
+    /**
+     * Returns names of all registered commands.
+     * Available when running commands via BashEnv interpreter.
+     * Used by the `help` command.
+     */
+    getRegisteredCommands?: () => string[];
+    /**
+     * Custom sleep implementation.
+     * If provided, used instead of real setTimeout.
+     * Useful for testing with mock clocks.
+     */
+    sleep?: (ms: number) => Promise<void>;
+    /**
+     * File descriptors map for here-docs and process substitution.
+     * Maps FD numbers to their content (e.g., 3 -> "content from 3<<EOF").
+     * Note: FD 0 content is in `stdin`, but may also appear here for consistency.
+     */
+    fileDescriptors?: Map<number, string>;
+    /**
+     * Whether xpg_echo shopt is enabled.
+     * When true, echo interprets backslash escapes by default (like echo -e).
+     */
+    xpgEcho?: boolean;
+    /**
+     * Current command substitution nesting depth.
+     * Used to prevent stack exhaustion from deeply nested $(...).
+     */
+    substitutionDepth?: number;
+    /**
+     * Feature coverage writer for fuzzing instrumentation.
+     * When provided, commands emit coverage hits for analysis.
+     */
+    coverage?: FeatureCoverageWriter;
+    /**
+     * Abort signal from the current execution context.
+     * Commands that spawn sub-executions (bash -c, xargs, etc.)
+     * should forward this signal so cooperative cancellation propagates.
+     */
+    signal?: AbortSignal;
+    /**
+     * When true, command execution must remain inside DefenseInDepthBox
+     * async context. Commands with async boundaries should assert this
+     * before and after awaited operations.
+     */
+    requireDefenseContext?: boolean;
+    /**
+     * Bootstrap JavaScript code for js-exec.
+     * Threaded through the context chain instead of shell env to prevent
+     * user access/injection via environment variables.
+     */
+    jsBootstrapCode?: string;
+    /**
+     * Tool invoker hook. When present, js-exec sets up a `tools` proxy that
+     * routes calls through this callback. Receives `(path, argsJson)` and
+     * returns a JSON result string.
+     */
+    invokeTool?: (path: string, argsJson: string) => Promise<string>;
+}
+/** Legacy standalone context shape used by direct command invocations. */
+export type CommandContext = Omit<RuntimeCommandContext, "limits" | "executionScope"> & {
+    /** Fully resolved when Bash dispatches the command; optional for legacy direct calls. */
+    limits?: Required<ExecutionLimits>;
+    /** Shared accounting is only available for interpreter-dispatched commands. */
+    executionScope?: CommandExecutionBudget;
+};
+/** Context supplied by Bash when dispatching a registered command. */
+export type ResolvedCommandContext = RuntimeCommandContext;
+export interface Command {
+    name: string;
+    /**
+     * Host-provided commands are trusted by default for compatibility. Set this
+     * to false to select the restricted extension boundary.
+     * Built-in commands should generally remain untrusted and use explicit
+     * trusted wrappers only at narrow infrastructure boundaries.
+     */
+    trusted?: boolean;
+    /** @internal Marks host extensions that receive a least-authority budget. */
+    internalIsExtension?: boolean;
+    execute(args: string[], ctx: ResolvedCommandContext): Promise<ExecResult>;
+}
+export interface RuntimeCommand extends Omit<Command, "execute"> {
+    /** @internal Bundled command shadowed by this host extension. */
+    internalOriginalCommand?: RuntimeCommand;
+    execute(args: string[], ctx: RuntimeCommandContext): Promise<ExecResult>;
+}
+export type CommandRegistry = Map<string, RuntimeCommand>;
+export type { IFileSystem };

package/dist/utils/args.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Lightweight argument parser for command implementations.
+ *
+ * Handles common patterns:
+ * - Boolean flags: -n, --number
+ * - Combined short flags: -rn (same as -r -n)
+ * - Value options: -k VALUE, -kVALUE, --key=VALUE, --key VALUE
+ * - Positional arguments
+ * - Unknown option detection
+ */
+import type { ExecResult } from "../types.js";
+export type ArgType = "boolean" | "string" | "number";
+export interface ArgDef {
+    /** Short form without dash, e.g., "n" for -n */
+    short?: string;
+    /** Long form without dashes, e.g., "number" for --number */
+    long?: string;
+    /** Type of the argument */
+    type: ArgType;
+    /** Default value */
+    default?: boolean | string | number;
+}
+export interface ParsedArgs<T extends Record<string, ArgDef>> {
+    /** Parsed flag/option values */
+    flags: {
+        [K in keyof T]: T[K]["type"] extends "boolean" ? boolean : T[K]["default"] extends number | string ? T[K]["type"] extends "number" ? number : string : T[K]["type"] extends "number" ? number | undefined : string | undefined;
+    };
+    /** Positional arguments (non-flag arguments) */
+    positional: string[];
+}
+export type ParseResult<T extends Record<string, ArgDef>> = {
+    ok: true;
+    result: ParsedArgs<T>;
+} | {
+    ok: false;
+    error: ExecResult;
+};
+/**
+ * Parse command arguments according to the provided definitions.
+ *
+ * @param cmdName - Command name for error messages
+ * @param args - Arguments to parse
+ * @param defs - Argument definitions
+ * @returns Parsed arguments or error result
+ *
+ * @example
+ * const defs = {
+ *   reverse: { short: "r", long: "reverse", type: "boolean" as const },
+ *   count: { short: "n", long: "lines", type: "number" as const, default: 10 },
+ * };
+ * const result = parseArgs("head", args, defs);
+ * if (!result.ok) return result.error;
+ * const { flags, positional } = result.result;
+ */
+export declare function parseArgs<T extends Record<string, ArgDef>>(cmdName: string, args: string[], defs: T): ParseResult<T>;

package/dist/utils/constants.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Shared constants for the bash environment.
+ */
+/**
+ * Default batch size for parallel I/O operations.
+ *
+ * This value is used across multiple commands (find, ls, tree, du, etc.) to
+ * control how many filesystem operations are performed concurrently. A larger
+ * value provides more parallelism but uses more memory; a smaller value is
+ * more conservative.
+ *
+ * 100 is a good default that provides significant parallelism without
+ * overwhelming the system or using excessive memory.
+ */
+export declare const DEFAULT_BATCH_SIZE = 100;

package/dist/utils/file-reader.d.ts

@@ -0,0 +1,76 @@
+/**
+ * File reading utilities for command implementations.
+ *
+ * Provides common patterns for reading from files or stdin,
+ * including parallel batch reading for performance.
+ */
+import { type ByteString } from "../encoding.js";
+import type { ExecResult, RuntimeCommandContext } from "../types.js";
+export interface ReadFilesOptions {
+    /** Command name for error messages */
+    cmdName: string;
+    /** If true, "-" in file list means stdin */
+    allowStdinMarker?: boolean;
+    /** If true, stop on first error. If false, collect errors and continue */
+    stopOnError?: boolean;
+    /** Number of files to read in parallel (default: 100). Set to 1 for sequential. */
+    batchSize?: number;
+}
+export interface FileContent {
+    /** File name (or "-" for stdin, or "" if stdin with no files) */
+    filename: string;
+    /**
+     * File content as a byte buffer (latin1-shaped). Decode with
+     * `decodeBytesToUtf8` before regex/parsing/char-position math; pass through
+     * `latin1FromBytes` if forwarding bytes unchanged.
+     */
+    content: ByteString;
+}
+export interface ReadFilesResult {
+    /** Successfully read files */
+    files: FileContent[];
+    /** Error messages (e.g., "cmd: file: No such file or directory\n") */
+    stderr: string;
+    /** 0 if all files read successfully, 1 if any errors */
+    exitCode: number;
+}
+/** Charge bytes read from a file to the execution-wide input budget. */
+export declare function accountFileInput(ctx: RuntimeCommandContext, bytes: number, site: string): void;
+/**
+ * Read content from files or stdin.
+ *
+ * If files array is empty, reads from stdin.
+ * If files contains "-", reads stdin at that position.
+ *
+ * @example
+ * const result = await readFiles(ctx, files, { cmdName: "cat" });
+ * if (result.exitCode !== 0 && options.stopOnError) {
+ *   return { stdout: "", stderr: result.stderr, exitCode: result.exitCode };
+ * }
+ * for (const { filename, content } of result.files) {
+ *   // process content
+ * }
+ */
+export declare function readFiles(ctx: RuntimeCommandContext, files: string[], options: ReadFilesOptions): Promise<ReadFilesResult>;
+/**
+ * Read and concatenate all files into a single byte buffer.
+ *
+ * Useful for commands like sort and uniq that process all input together.
+ * Callers must `decodeBytesToUtf8` (text processing) or `latin1FromBytes`
+ * (byte passthrough) before using the content.
+ *
+ * @example
+ * const result = await readAndConcat(ctx, files, { cmdName: "sort" });
+ * if (!result.ok) return result.error;
+ * const lines = decodeBytesToUtf8(result.content).split("\n");
+ */
+export declare function readAndConcat(ctx: RuntimeCommandContext, files: string[], options: {
+    cmdName: string;
+    allowStdinMarker?: boolean;
+}): Promise<{
+    ok: true;
+    content: ByteString;
+} | {
+    ok: false;
+    error: ExecResult;
+}>;

package/dist/utils/glob.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Shared glob pattern matching utilities.
+ *
+ * Used by grep, find, and other commands that need glob matching.
+ */
+export interface MatchGlobOptions {
+    /** Case-insensitive matching */
+    ignoreCase?: boolean;
+    /** Strip surrounding quotes from pattern before matching */
+    stripQuotes?: boolean;
+}
+/**
+ * Match a filename against a glob pattern.
+ *
+ * Supports:
+ * - `*` matches any sequence of characters
+ * - `?` matches any single character
+ * - `[...]` character classes
+ *
+ * @param name - The filename to test
+ * @param pattern - The glob pattern
+ * @param options - Matching options
+ * @returns true if the name matches the pattern
+ */
+export declare function matchGlob(name: string, pattern: string, options?: MatchGlobOptions | boolean): boolean;

package/dist/vitest-setup.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,136 @@
+{
+  "name": "@jerryan/just-bash",
+  "version": "3.5.0",
+  "description": "A simulated bash environment with virtual filesystem",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/JerryAZR/just-bash.git"
+  },
+  "homepage": "https://github.com/JerryAZR/just-bash#readme",
+  "bugs": {
+    "url": "https://github.com/JerryAZR/just-bash/issues"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=20.19"
+  },
+  "main": "dist/bundle/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "browser": "./dist/bundle/browser.js",
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/bundle/index.cjs"
+      },
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/bundle/index.js"
+      }
+    },
+    "./browser": {
+      "types": "./dist/browser.d.ts",
+      "import": "./dist/bundle/browser.js"
+    }
+  },
+  "files": [
+    "dist/bundle/",
+    "dist/bin/",
+    "dist/*.d.ts",
+    "dist/*.d.cts",
+    "dist/ast/*.d.ts",
+    "dist/commands/**/*.d.ts",
+    "dist/commands/sqlite3/worker.js",
+    "dist/fs/**/*.d.ts",
+    "dist/interpreter/**/*.d.ts",
+    "dist/network/**/*.d.ts",
+    "dist/parser/*.d.ts",
+    "dist/sandbox/*.d.ts",
+    "dist/security/*.d.ts",
+    "dist/transform/**/*.d.ts",
+    "dist/utils/*.d.ts",
+    "vendor/cpython-emscripten/",
+    "README.md",
+    "CHANGELOG.md",
+    "dist/AGENTS.md"
+  ],
+  "bin": {
+    "just-bash": "./dist/bin/just-bash.js",
+    "just-bash-shell": "./dist/bin/shell/shell.js"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc && pnpm build:lib && pnpm build:lib:cjs && pnpm build:browser && pnpm build:cli && pnpm build:shell && pnpm build:worker && pnpm build:clean && cp dist/index.d.ts dist/index.d.cts && sed '1,/^-->/d' AGENTS.npm.md > dist/AGENTS.md",
+    "build:clean": "find dist -name '*.test.js' -delete && find dist -name '*.test.d.ts' -delete",
+    "build:worker": "esbuild src/commands/python3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/python3/worker.js --external:../../../vendor/cpython-emscripten/* && cp src/commands/python3/worker.js dist/commands/python3/worker.js && mkdir -p dist/bin/chunks && cp src/commands/python3/worker.js dist/bin/chunks/worker.js && mkdir -p dist/bundle/chunks && cp src/commands/python3/worker.js dist/bundle/chunks/worker.js && esbuild src/commands/js-exec/js-exec-worker.ts --bundle --platform=node --format=esm --outfile=src/commands/js-exec/js-exec-worker.js --external:quickjs-emscripten && cp src/commands/js-exec/js-exec-worker.js dist/commands/js-exec/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bin/chunks/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bundle/chunks/js-exec-worker.js && esbuild src/commands/sqlite3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/sqlite3/worker.js --external:sql.js && mkdir -p dist/commands/sqlite3 && cp src/commands/sqlite3/worker.js dist/commands/sqlite3/worker.js && cp src/commands/sqlite3/worker.js dist/bin/chunks/sqlite3-worker.js && cp src/commands/sqlite3/worker.js dist/bundle/chunks/sqlite3-worker.js",
+    "build:lib": "esbuild dist/index.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bundle --chunk-names=chunks/[name]-[hash] --banner:js='import{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:diff --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --external:guarded-fetch",
+    "build:lib:cjs": "esbuild dist/index.js --bundle --platform=node --format=cjs --minify --outfile=dist/bundle/index.cjs --external:diff --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --external:guarded-fetch",
+    "build:browser": "esbuild dist/browser.js --bundle --platform=browser --format=esm --minify --outfile=dist/bundle/browser.js --external:diff --external:sprintf-js --external:turndown --external:undici --external:guarded-fetch --external:node:zlib --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --define:__BROWSER__=true --alias:node:async_hooks=./src/shims/browser-unsupported.js --alias:node:dns=./src/shims/browser-unsupported.js --alias:node:module=./src/shims/browser-unsupported.js",
+    "build:cli": "esbuild dist/cli/just-bash.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
+    "build:shell": "esbuild dist/cli/shell.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin/shell --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
+    "prepublishOnly": "pnpm test:dist",
+    "validate": "pnpm lint && pnpm knip && pnpm typecheck && pnpm build && pnpm check:worker-sync && pnpm test:run && pnpm test:wasm && pnpm test:dist",
+    "typecheck": "tsc --noEmit",
+    "lint": "pnpm lint:banned",
+    "check:worker-sync": "node scripts/check-worker-sync.js",
+    "lint:banned": "node scripts/check-banned-patterns.js",
+    "lint:fix": "pnpm --workspace-root lint:fix",
+    "knip": "knip",
+    "test": "vitest",
+    "test:run": "vitest run --exclude src/security/fuzzing/ --exclude src/commands/python3/ --exclude src/commands/sqlite3/ --exclude src/commands/js-exec/ --exclude src/agent-examples/python-scripting.test.ts",
+    "test:dist": "vitest run src/cli/just-bash.bundle.test.ts src/package-contents.test.ts",
+    "test:unit": "vitest run --config vitest.unit.config.ts",
+    "test:wasm": "vitest run --config vitest.wasm.config.ts",
+    "test:comparison": "vitest run --config vitest.comparison.config.ts",
+    "test:comparison:record": "RECORD_FIXTURES=1 vitest run --config vitest.comparison.config.ts",
+    "test:coverage": "vitest run --coverage",
+    "test:coverage:unit": "vitest run --config vitest.unit.config.ts --coverage",
+    "test:fuzz": "vitest run src/security/fuzzing/",
+    "test:fuzz:long": "FUZZ_RUNS=10000 vitest run src/security/fuzzing/",
+    "shell": "tsx src/cli/shell.ts",
+    "dev:exec": "tsx src/cli/exec.ts"
+  },
+  "keywords": [],
+  "author": "Malte and Claude",
+  "license": "Apache-2.0",
+  "devDependencies": {
+    "@types/ini": "^4.1.1",
+    "@types/node": "^25.9.5",
+    "@types/papaparse": "^5.5.2",
+    "@types/sprintf-js": "^1.1.4",
+    "@types/sql.js": "^1.4.11",
+    "@types/turndown": "^5.0.6",
+    "@vitest/coverage-v8": "^4.1.10",
+    "esbuild": "^0.27.7",
+    "fast-check": "^3.23.2",
+    "knip": "^5.88.1",
+    "tsx": "^4.23.12",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.10"
+  },
+  "dependencies": {
+    "diff": "^8.0.4",
+    "fast-xml-parser": "^5.10.1",
+    "file-type": "^21.3.4",
+    "guarded-fetch": "0.1.3",
+    "ini": "^6.0.0",
+    "modern-tar": "^0.7.7",
+    "papaparse": "^5.6.0",
+    "quickjs-emscripten": "^0.32.0",
+    "re2js": "^1.3.3",
+    "seek-bzip": "^2.0.0",
+    "smol-toml": "^1.8.0",
+    "sprintf-js": "^1.1.3",
+    "sql.js": "^1.14.1",
+    "turndown": "^7.2.4",
+    "undici": "^7.29.0",
+    "yaml": "^2.9.0"
+  },
+  "optionalDependencies": {
+    "@mongodb-js/zstd": "^7.0.0",
+    "node-liblzma": "^2.2.0"
+  }
+}