@jerryan/just-bash 3.9.0 → 3.11.0

package/dist/commands/mktemp/mktemp.d.ts

@@ -0,0 +1,4 @@
+import type { RuntimeCommand } from "../../types.js";
+export declare const mktempCommand: RuntimeCommand;
+import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
+export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/commands/registry.d.ts

@@ -1,6 +1,6 @@
 import type { RuntimeCommand } from "../types.js";
 /** All available built-in command names (excludes network commands) */
-export type CommandName = "echo" | "cat" | "printf" | "ls" | "mkdir" | "rmdir" | "touch" | "rm" | "cp" | "mv" | "ln" | "chmod" | "pwd" | "readlink" | "head" | "tail" | "wc" | "stat" | "grep" | "fgrep" | "egrep" | "rg" | "sed" | "awk" | "sort" | "uniq" | "comm" | "cut" | "paste" | "tr" | "rev" | "nl" | "fold" | "expand" | "unexpand" | "strings" | "split" | "column" | "join" | "tee" | "find" | "basename" | "dirname" | "tree" | "du" | "env" | "printenv" | "alias" | "unalias" | "history" | "xargs" | "true" | "false" | "clear" | "bash" | "sh" | "jq" | "base64" | "diff" | "date" | "sleep" | "timeout" | "seq" | "expr" | "md5sum" | "sha1sum" | "sha256sum" | "file" | "html-to-markdown" | "help" | "which" | "tac" | "hostname" | "od" | "gzip" | "gunzip" | "zcat" | "tar" | "yq" | "xan" | "sqlite3" | "time" | "whoami";
+export type CommandName = "echo" | "cat" | "printf" | "ls" | "mkdir" | "mktemp" | "rmdir" | "touch" | "rm" | "cp" | "mv" | "ln" | "chmod" | "pwd" | "readlink" | "head" | "tail" | "wc" | "stat" | "grep" | "fgrep" | "egrep" | "rg" | "sed" | "awk" | "sort" | "uniq" | "comm" | "cut" | "paste" | "tr" | "rev" | "nl" | "fold" | "expand" | "unexpand" | "strings" | "split" | "column" | "join" | "tee" | "find" | "basename" | "dirname" | "tree" | "du" | "env" | "printenv" | "alias" | "unalias" | "history" | "xargs" | "true" | "false" | "yes" | "clear" | "bash" | "sh" | "jq" | "base64" | "diff" | "date" | "sleep" | "timeout" | "seq" | "expr" | "md5sum" | "sha1sum" | "sha256sum" | "file" | "html-to-markdown" | "help" | "which" | "tac" | "hostname" | "od" | "gzip" | "gunzip" | "zcat" | "tar" | "yq" | "xan" | "sqlite3" | "time" | "whoami";
 /** Network command names (only available when network is configured) */
 export type NetworkCommandName = "curl";
 /** Python command names (only available when python is explicitly enabled) */

package/dist/commands/which/which.d.ts

@@ -1,3 +1,13 @@
+/**
+ * which - Locate a command
+ *
+ * Resolution order:
+ * 1. VFS PATH search (sandboxed filesystem)
+ * 2. Shell builtins (echo, cd, etc.) — only when no file found
+ *
+ * On miss, prints a helpful message to stderr explaining that the
+ * command is not available in this sandboxed bash environment.
+ */
 import type { RuntimeCommand } from "../../types.js";
 export declare const whichCommand: RuntimeCommand;
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";

package/dist/commands/yes/yes.d.ts

@@ -0,0 +1,4 @@
+import type { RuntimeCommand } from "../../types.js";
+export declare const yesCommand: RuntimeCommand;
+import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
+export declare const flagsForFuzzing: CommandFuzzInfo;

package/dist/custom-commands.d.ts

@@ -21,6 +21,11 @@ export interface LazyCommand {
      * trusted by default for compatibility with existing host integrations.
      */
     trusted?: boolean;
+    /**
+     * Set to true when the command handles --version itself. When unset,
+     * the dispatch intercepts --version and returns "<cmd> (just-bash)".
+     */
+    handlesOwnVersion?: boolean;
     load: () => Promise<Command>;
 }
 /** Inputs for a complete standalone command context, primarily for tests. */
@@ -61,5 +66,12 @@ export declare function defineCommand(name: string, execute: (args: string[], ct
 /**
  * Create a lazy-loaded wrapper for a custom command.
  * The command is only loaded when first executed.
+ *
+ * The load is shared, and waiters can detach from it. Both properties matter
+ * once an invocation can be cancelled: a cancelled waiter must not start a
+ * competing load, and it must not stay attached to a load that may never
+ * settle. Keeping only the waiter's own promise lets a cancelled waiter be
+ * collected instead of being retained by the shared load, so repeated
+ * cancellations cannot accumulate.
  */
 export declare function createLazyCustomCommand(lazy: LazyCommand): Command;

package/dist/fs/create-exclusive.d.ts

@@ -0,0 +1,30 @@
+import type { CreateExclusiveOptions, IFileSystem } from "./interface.js";
+/**
+ * Thrown when the filesystem cannot create an entry atomically, either
+ * because it does not implement `createExclusive` or because a delegating
+ * filesystem routes to a backend that does not.
+ *
+ * This is a type rather than an error message because backend errors embed
+ * the caller-supplied path: matching text would let a template containing the
+ * literal "ENOSYS" turn a genuine EEXIST into a spurious "unsupported".
+ */
+export declare class ExclusiveCreateUnsupportedError extends Error {
+    readonly code = "ENOSYS";
+    constructor(path: string, syscall: string);
+}
+/**
+ * Create a file or directory that must not already exist, with `mode` applied
+ * at creation time.
+ *
+ * There is deliberately no fallback for filesystems lacking
+ * `createExclusive`. Exclusivity and privacy cannot be synthesised from
+ * separate check, create and chmod calls: between them a concurrent actor can
+ * take the name and have its entry truncated, or install a symlink so the
+ * write lands on its target, and the entry is briefly readable at the
+ * backend's default mode either way. A caller asking for an exclusive private
+ * entry that silently received a racy one is worse off than a caller told the
+ * filesystem cannot provide it, so this fails loudly instead.
+ *
+ * @throws ExclusiveCreateUnsupportedError if the filesystem cannot do this
+ */
+export declare function createExclusiveOn(fs: Pick<IFileSystem, "createExclusive">, path: string, options: CreateExclusiveOptions): Promise<void>;

package/dist/fs/in-memory-fs/in-memory-fs.d.ts

@@ -1,5 +1,5 @@
 import { type ByteString } from "../../encoding.js";
-import type { BufferEncoding, CpOptions, DirectoryEntry, DirentEntry, FileContent, FileEntry, FsEntry, FsStat, IFileSystem, InitialFiles, LazyFileEntry, MkdirOptions, ReadFileOptions, RmOptions, SymlinkEntry, WriteFileOptions } from "../interface.js";
+import type { BufferEncoding, CpOptions, CreateExclusiveOptions, DirectoryEntry, DirentEntry, FileContent, FileEntry, FsEntry, FsStat, IFileSystem, InitialFiles, LazyFileEntry, MkdirOptions, ReadFileOptions, RmOptions, SymlinkEntry, WriteFileOptions } from "../interface.js";
 export type { BufferEncoding, FileContent, FileEntry, LazyFileEntry, DirectoryEntry, SymlinkEntry, FsEntry, FsStat, IFileSystem, };
 export interface FsData {
     [path: string]: FsEntry;
@@ -68,6 +68,13 @@ export declare class InMemoryFs implements IFileSystem {
      */
     private resolvePathWithSymlinks;
     mkdir(path: string, options?: MkdirOptions): Promise<void>;
+    /**
+     * Atomically create a private file or directory that must not already
+     * exist. Execution is single-threaded, so the existence check and the
+     * insert cannot be interleaved; `this.data` is keyed by normalized path, so
+     * a symlink occupying the name is seen as a collision rather than followed.
+     */
+    createExclusive(path: string, options: CreateExclusiveOptions): Promise<void>;
     /**
      * Synchronous version of mkdir
      */

package/dist/fs/interface.d.ts

@@ -77,6 +77,20 @@ export interface FsStat {
 export interface MkdirOptions {
     recursive?: boolean;
 }
+/**
+ * Options for createExclusive operation
+ */
+export interface CreateExclusiveOptions {
+    /**
+     * Permission bits applied at creation time, e.g. 0o600 for a private file
+     * or 0o700 for a private directory. Applied by the creating operation
+     * itself so the entry is never briefly visible with the
+     * backend's default mode.
+     */
+    mode: number;
+    /** Create a directory instead of an empty regular file. */
+    directory?: boolean;
+}
 /**
  * Options for rm operation
  */
@@ -164,6 +178,29 @@ export interface IFileSystem {
      * @throws Error if parent doesn't exist (unless recursive) or path exists
      */
     mkdir(path: string, options?: MkdirOptions): Promise<void>;
+    /**
+     * Atomically create a file or directory that must not already exist, with
+     * `options.mode` applied by the creating operation itself.
+     *
+     * This is the primitive `mktemp`-style callers need: a plain
+     * `exists()`-then-`writeFile()` sequence is a TOCTOU race (a concurrent
+     * creator can win between the two calls and have its entry truncated), and
+     * a `writeFile()`-then-`chmod()` sequence exposes the entry with the
+     * backend's default mode (typically 0644/0755) until the chmod lands.
+     *
+     * The final path component is never followed: a symlink already occupying
+     * the name is a collision, not a target to write through.
+     *
+     * Optional for backwards compatibility with external `IFileSystem`
+     * implementations written before this method existed; all built-in
+     * filesystems implement it. Callers should route through
+     * `createExclusiveOn`, which reports a filesystem that cannot do this
+     * rather than substituting a non-atomic sequence.
+     *
+     * @throws Error with an `EEXIST` code if the path already exists
+     * @throws Error with an `ENOENT` code if the parent does not exist
+     */
+    createExclusive?(path: string, options: CreateExclusiveOptions): Promise<void>;
     /**
      * Read directory contents
      * @returns Array of entry names (not full paths)

package/dist/fs/mountable-fs/mountable-fs.d.ts

@@ -1,5 +1,5 @@
 import { type ByteString } from "../../encoding.js";
-import type { BufferEncoding, CpOptions, FileContent, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
+import type { BufferEncoding, CpOptions, CreateExclusiveOptions, FileContent, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
 import type { OverlayDiff } from "../overlay-fs/overlay-fs.js";
 /**
  * Configuration for a mount point
@@ -109,6 +109,13 @@ export declare class MountableFs implements IFileSystem {
     stat(path: string): Promise<FsStat>;
     lstat(path: string): Promise<FsStat>;
     mkdir(path: string, options?: MkdirOptions): Promise<void>;
+    /**
+     * Atomically create a private file or directory that must not already
+     * exist, routed to the owning filesystem. A backend without
+     * `createExclusive` reports ENOSYS so callers can pick a fallback rather
+     * than silently getting non-exclusive creation.
+     */
+    createExclusive(path: string, options: CreateExclusiveOptions): Promise<void>;
     readdir(path: string): Promise<string[]>;
     rm(path: string, options?: RmOptions): Promise<void>;
     cp(src: string, dest: string, options?: CpOptions): Promise<void>;
@@ -134,5 +141,15 @@ export declare class MountableFs implements IFileSystem {
      * @param atime - Access time
      * @param mtime - Modification time
      */
+    /**
+     * Synchronous mkdir, routed to the filesystem that owns the path.
+     * @throws Error if that filesystem has no synchronous writes
+     */
+    mkdirSync(path: string, options?: MkdirOptions): void;
+    /**
+     * Synchronous writeFile, routed to the filesystem that owns the path.
+     * @throws Error if that filesystem has no synchronous writes
+     */
+    writeFileSync(path: string, content: string | Uint8Array): void;
     utimes(path: string, atime: Date, mtime: Date): Promise<void>;
 }

package/dist/fs/overlay-fs/overlay-fs.d.ts

@@ -21,7 +21,7 @@
  */
 import { type ByteString } from "../../encoding.js";
 import { type FileContent } from "../encoding.js";
-import type { CpOptions, DirentEntry, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
+import type { CpOptions, CreateExclusiveOptions, DirentEntry, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
 /** Kind of entry recorded in an {@link OverlayWrite}. */
 export type OverlayNodeType = "file" | "directory" | "symlink";
 /**
@@ -332,6 +332,24 @@ export declare class OverlayFs implements IFileSystem {
      */
     private realTargetToVirtual;
     mkdir(path: string, options?: MkdirOptions): Promise<void>;
+    /**
+     * Atomically create a private file or directory that must not already
+     * exist. A name is taken when a live entry shadows it in the upper layer
+     * or when the lower layer holds it without a covering whiteout; a
+     * whiteout means the name is free and is cleared by the create (attach
+     * for a file, resurrection via ensureDirs for a directory), so the new
+     * entry is visible to stat/exists/readdir.
+     *
+     * The final component is never followed: an upper symlink at the name is
+     * a live entry (EEXIST), and the lower-layer probe uses lstat. Symlinks
+     * in the parent ARE resolved, so the entry lands where later lookups —
+     * which resolve — will find it.
+     *
+     * Every await happens before the claim; from the final descend() to the
+     * attach() there is no yield, so two interleaved calls cannot both claim
+     * the name.
+     */
+    createExclusive(path: string, options: CreateExclusiveOptions): Promise<void>;
     /**
      * Core readdir implementation that returns entries with file types.
      * Both readdir and readdirWithFileTypes use this shared implementation.

package/dist/fs/path-utils.d.ts

@@ -30,10 +30,6 @@ export declare function validatePath(path: string, operation: string): void;
  * Get the directory name of a normalized virtual path.
  */
 export declare function dirname(path: string): string;
-/**
- * Resolve a relative path against a base directory.
- * If `path` is absolute, it is normalized and returned directly.
- */
 export declare function resolvePath(base: string, path: string): string;
 /**
  * Join a parent path with a child name.

package/dist/fs/read-write-fs/read-write-fs.d.ts

@@ -12,7 +12,7 @@
  */
 import { type ByteString } from "../../encoding.js";
 import { type FileContent } from "../encoding.js";
-import type { CpOptions, DirentEntry, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
+import type { CpOptions, CreateExclusiveOptions, DirentEntry, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
 export interface ReadWriteFsOptions {
     /**
      * The root directory on the real filesystem.
@@ -65,6 +65,8 @@ export declare class ReadWriteFs implements IFileSystem {
      * Validate the parent directory of a path (for operations like lstat/readlink
      * that should not follow the final component's symlink).
      * Returns the canonical parent joined with the original basename.
+     * The root's parent is outside the sandbox and always fails this check,
+     * so callers that accept the root validate it with resolveAndValidate().
      */
     private validateParent;
     /**
@@ -95,6 +97,25 @@ export declare class ReadWriteFs implements IFileSystem {
     stat(path: string): Promise<FsStat>;
     lstat(path: string): Promise<FsStat>;
     mkdir(path: string, options?: MkdirOptions): Promise<void>;
+    /**
+     * Atomically create a private file or directory that must not already
+     * exist. `O_CREAT|O_EXCL` (and `mkdir`) are exclusive in the kernel, so a
+     * concurrent host process cannot win a race between a check and the create,
+     * and the mode is applied by the creating syscall rather than a later
+     * chmod — the entry is never on disk with the default 0644/0755. POSIX
+     * requires `O_EXCL` to fail on a symlink at the final component, so a
+     * pre-planted link is a collision instead of a write-through target.
+     */
+    createExclusive(path: string, options: CreateExclusiveOptions): Promise<void>;
+    private createExclusiveUnlocked;
+    /**
+     * Verify that an entry just created at `canonical` is still the entry at
+     * that pathname. O_EXCL and O_NOFOLLOW bind only the final component, so a
+     * concurrent host process swapping an intermediate directory for a symlink
+     * could place the entry outside the root; compare device and inode of the
+     * created descriptor against a re-validated lstat to detect the swap.
+     */
+    private assertCreatedInsideRoot;
     private mkdirUnlocked;
     readdir(path: string): Promise<string[]>;
     readdirWithFileTypes(path: string): Promise<DirentEntry[]>;

package/dist/index.d.cts

@@ -10,7 +10,7 @@ export type { ByteString, OutputKind } from "./encoding.js";
 export { bytesOutput, decodeBytesToUtf8, EMPTY_BYTES, encodeUtf8ToBytes, latin1FromBytes, stdoutAsBytes, stdoutKind, textOutput, unsafeBytesFromLatin1, } from "./encoding.js";
 export { FsError, fsErrorCode, isFsErrorCode, toFsError, } from "./fs/fs-error.js";
 export { InMemoryFs } from "./fs/in-memory-fs/index.js";
-export type { BufferEncoding, CpOptions, DirectoryEntry, FileContent, FileEntry, FileInit, FileSystemFactory, FsEntry, FsStat, InitialFiles, LazyFileEntry, LazyFileProvider, MkdirOptions, RmOptions, SymlinkEntry, } from "./fs/interface.js";
+export type { BufferEncoding, CpOptions, CreateExclusiveOptions, DirectoryEntry, FileContent, FileEntry, FileInit, FileSystemFactory, FsEntry, FsStat, InitialFiles, LazyFileEntry, LazyFileProvider, MkdirOptions, RmOptions, SymlinkEntry, } from "./fs/interface.js";
 export { MountableFs, type MountableFsOptions, type MountConfig, } from "./fs/mountable-fs/index.js";
 export { applyDiffToRealFs, type OverlayDiff, OverlayFs, type OverlayFsOptions, type OverlayNodeType, type OverlayWrite, } from "./fs/overlay-fs/index.js";
 export { ReadWriteFs, type ReadWriteFsOptions, } from "./fs/read-write-fs/index.js";

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export type { ByteString, OutputKind } from "./encoding.js";
 export { bytesOutput, decodeBytesToUtf8, EMPTY_BYTES, encodeUtf8ToBytes, latin1FromBytes, stdoutAsBytes, stdoutKind, textOutput, unsafeBytesFromLatin1, } from "./encoding.js";
 export { FsError, fsErrorCode, isFsErrorCode, toFsError, } from "./fs/fs-error.js";
 export { InMemoryFs } from "./fs/in-memory-fs/index.js";
-export type { BufferEncoding, CpOptions, DirectoryEntry, FileContent, FileEntry, FileInit, FileSystemFactory, FsEntry, FsStat, InitialFiles, LazyFileEntry, LazyFileProvider, MkdirOptions, RmOptions, SymlinkEntry, } from "./fs/interface.js";
+export type { BufferEncoding, CpOptions, CreateExclusiveOptions, DirectoryEntry, FileContent, FileEntry, FileInit, FileSystemFactory, FsEntry, FsStat, InitialFiles, LazyFileEntry, LazyFileProvider, MkdirOptions, RmOptions, SymlinkEntry, } from "./fs/interface.js";
 export { MountableFs, type MountableFsOptions, type MountConfig, } from "./fs/mountable-fs/index.js";
 export { applyDiffToRealFs, type OverlayDiff, OverlayFs, type OverlayFsOptions, type OverlayNodeType, type OverlayWrite, } from "./fs/overlay-fs/index.js";
 export { ReadWriteFs, type ReadWriteFsOptions, } from "./fs/read-write-fs/index.js";

package/dist/interpreter/expansion/array-prefix-suffix.d.ts

@@ -26,8 +26,9 @@ export type ExpandPartFn = (ctx: InterpreterContext, part: WordPart) => Promise<
  */
 export type ExpandWordPartsAsyncFn = (ctx: InterpreterContext, parts: WordPart[]) => Promise<string>;
 /**
- * Handle "${arr[@]:-${default[@]}}", "${arr[@]:+${alt[@]}}", and "${arr[@]:=default}"
+ * Handle "${arr[@]:-${default[@]}}" and "${arr[@]:+${alt[@]}}".
  * Also handles "${var:-${default[@]}}" where var is a scalar variable.
+ * Assignment defaults preserve existing array elements when no assignment is needed.
  * When the default value contains an array expansion, each element should become a separate word.
  */
 export declare function handleArrayDefaultValue(ctx: InterpreterContext, wordParts: WordPart[]): Promise<ArrayExpansionResult>;

package/dist/interpreter/expansion/parameter-ops.d.ts

@@ -39,6 +39,7 @@ export declare function handleDefaultValue(ctx: InterpreterContext, operation: {
     word?: WordNode;
     checkEmpty?: boolean;
 }, opCtx: ParameterOpContext, expandWordPartsAsync: ExpandWordPartsAsyncFn): Promise<string>;
+export declare function assertDefaultAssignmentTarget(parameter: string): void;
 /**
  * Handle AssignDefault operation: ${param:=word}
  */

package/dist/interpreter/expansion/pattern-removal.d.ts

@@ -3,7 +3,10 @@
  *
  * Functions for ${var#pattern}, ${var%pattern}, ${!prefix*} etc.
  */
+import type { WordNode } from "../../ast/types.js";
 import type { InterpreterContext } from "../types.js";
+import type { ExpandPartFn, ExpandWordPartsAsyncFn } from "./array-word-expansion.js";
+export declare function buildPatternRemovalRegex(ctx: InterpreterContext, pattern: WordNode, greedy: boolean, expandWordPartsAsync: ExpandWordPartsAsyncFn, expandPart: ExpandPartFn): Promise<string>;
 /**
  * Apply pattern removal (prefix or suffix strip) to a single value.
  * Used by both scalar and vectorized array operations.

package/dist/interpreter/expansion/variable.d.ts

@@ -26,7 +26,7 @@ export declare function isArray(ctx: InterpreterContext, name: string): boolean;
  * @param name - The variable name
  * @param checkNounset - Whether to check for nounset (default true)
  */
-export declare function getVariable(ctx: InterpreterContext, name: string, checkNounset?: boolean, _insideDoubleQuotes?: boolean): Promise<string>;
+export declare function getVariable(ctx: InterpreterContext, name: string, checkNounset?: boolean): Promise<string>;
 /**
  * Check if a variable is set (exists in the environment).
  * Properly handles array subscripts (e.g., arr[0] -> arr_0).

package/dist/interpreter/helpers/loop.d.ts

@@ -4,14 +4,46 @@
  * Consolidates the repeated error handling logic used in all loop constructs
  * (for, c-style for, while, until).
  */
+import type { InterpreterContext } from "../types.js";
 export type LoopAction = "break" | "continue" | "rethrow" | "error";
 export interface LoopErrorResult {
     action: LoopAction;
     stdout: string;
     stderr: string;
+    /**
+     * Status the loop should adopt as "last command executed".
+     *
+     * For "break"/"continue" this is 0: bash's `break` and `continue` are
+     * builtins that return 0, and they are the last command the body ran, so
+     * the loop must not report the status of whatever failed before them.
+     * For "error" it is the failure status.
+     */
     exitCode?: number;
     error?: unknown;
 }
+/**
+ * Exit status of the `break`/`continue` builtins themselves.
+ *
+ * A loop left via `break`/`continue` reports this, not the status of the
+ * last command that ran before it:
+ *
+ *   while :; do false; break; done; echo $?   # 0, not 1
+ */
+export declare const BREAK_CONTINUE_STATUS = 0;
+/**
+ * Adopt `status` as the loop's "last command executed" and publish it to `$?`.
+ *
+ * The loop tracks its own exit code for the value it finally returns, but `$?`
+ * has to move with it. A `for` loop runs nothing between the `continue` and
+ * the next iteration's first command, so leaving `$?` behind lets the failed
+ * command before the `continue` show up there:
+ *
+ *   for i in 1 2; do echo "$?"; false; continue; done   # 0 0, not 0 1
+ *
+ * `while`/`until` happen to hide this because their condition runs in between
+ * and resets `$?` - they are synchronised here all the same.
+ */
+export declare function adoptLoopStatus(ctx: InterpreterContext, status: number): number;
 /**
  * Handle errors thrown during loop body execution.
  *

package/dist/limits.d.ts

@@ -107,7 +107,4 @@ export interface ExecutionLimits {
 export type ExecutionLimitProfile = "normal" | "hardened";
 /** Liberal default shared by shell and standalone transform entry points. */
 export declare const DEFAULT_MAX_SOURCE_BYTES: number;
-/**
- * Resolve execution limits by merging user-provided limits with defaults.
- */
 export declare function resolveLimits(userLimits?: ExecutionLimits, profile?: ExecutionLimitProfile): Required<ExecutionLimits>;

package/dist/network/dns-pin.d.ts

@@ -1,15 +1,4 @@
-/**
- * Request-owned connection binding for DNS-reviewed HTTP requests.
- *
- * Each owner has a private Undici Agent whose connector resolves exactly one
- * hostname to exactly one preflight-reviewed address. The Agent is never
- * shared between requests or redirect hops, so an existing origin pool cannot
- * substitute a socket opened under a different DNS decision.
- *
- * The browser build removes the Node-only `undici` branch and edge runtimes
- * that cannot construct this owner fail closed when private-range denial is
- * enabled.
- */
+/** Types for the deprecated request-owned connection override. */
 export interface PinnedAddress {
     hostname: string;
     address: string;
@@ -20,23 +9,3 @@ export interface PinnedConnectionOwner {
     close(): Promise<void>;
 }
 export type PinnedConnectionOwnerFactory = (pinned: PinnedAddress) => Promise<PinnedConnectionOwner>;
-/**
- * Both shapes a dynamic `import("undici")` can resolve to.
- *
- * Node resolves the package and exposes its CommonJS exports as named ones. A
- * bundler that inlines the same module into its own graph cannot always do
- * that, and hands back a namespace carrying the module under `default` alone.
- */
-type UndiciNamespace = typeof import("undici") | Pick<typeof import("undici"), "default">;
-type UndiciExports = typeof import("undici") | typeof import("undici").default;
-/** @internal Pure namespace normalization used by focused interop tests. */
-export declare function _undiciExports(namespace: UndiciNamespace): UndiciExports;
-type PinnedLookup = import("node:net").LookupFunction;
-/** @internal Pure connector lookup used by focused binding tests. */
-export declare function _createPinnedLookup(pinned: PinnedAddress): PinnedLookup;
-/**
- * Create a disposable transport whose pool identity is the reviewed address.
- * The returned owner must be closed after the response body is consumed.
- */
-export declare const createPinnedConnectionOwner: PinnedConnectionOwnerFactory;
-export {};

package/dist/network/fetch.d.ts

@@ -8,7 +8,7 @@ import { type FetchResult, type NetworkConfig } from "./types.js";
 export interface SecureFetchOptions {
     method?: string;
     headers?: Headers | Record<string, string>;
-    body?: string;
+    body?: string | Uint8Array<ArrayBuffer>;
     followRedirects?: boolean;
     /** Override timeout for this request (capped at global timeout) */
     timeoutMs?: number;

package/dist/security/trusted-globals.d.ts

@@ -15,3 +15,11 @@ export declare const _performanceNow: () => number;
 export declare const _Headers: typeof globalThis.Headers;
 /** Internal capability revocation; never expose this constructor to commands. */
 export declare const _Proxy: ProxyConstructor;
+/**
+ * Intrinsic promise settlement for infrastructure that must keep observing a
+ * promise after the execution that created it has ended. The patched
+ * `Promise.prototype.then` blocks registered callbacks once an execution is
+ * deactivated, and calling a caller-supplied `then` would run that caller's code
+ * with the privileges of whatever registered it.
+ */
+export declare const _promiseThen: typeof Promise.prototype.then;

package/dist/types.d.ts

@@ -308,6 +308,12 @@ export interface Command {
     trusted?: boolean;
     /** @internal Marks host extensions that receive a least-authority budget. */
     internalIsExtension?: boolean;
+    /**
+     * Set to true when the command handles --version itself (e.g. python3
+     * shows Python's version, not just-bash's). When unset, the dispatch
+     * intercepts --version and returns "<cmd> (just-bash)".
+     */
+    handlesOwnVersion?: boolean;
     execute(args: string[], ctx: ResolvedCommandContext): Promise<ExecResult>;
 }
 export interface RuntimeCommand extends Omit<Command, "execute"> {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jerryan/just-bash",
-  "version": "3.9.0",
+  "version": "3.11.0",
   "description": "A simulated bash environment with virtual filesystem",
   "repository": {
     "type": "git",
@@ -91,11 +91,10 @@
     "quickjs-emscripten": "^0.32.0",
     "re2js": "^1.3.3",
     "seek-bzip": "^2.0.0",
-    "smol-toml": "^1.8.0",
+    "smol-toml": "^1.9.0",
     "sprintf-js": "^1.1.3",
     "sql.js": "^1.14.1",
     "turndown": "^7.2.4",
-    "undici": "^7.29.0",
     "yaml": "^2.9.0"
   },
   "optionalDependencies": {
@@ -108,7 +107,7 @@
     "build:worker": "esbuild src/commands/python3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/python3/worker.js --external:../../../vendor/cpython-emscripten/* && cp src/commands/python3/worker.js dist/commands/python3/worker.js && mkdir -p dist/bin/chunks && cp src/commands/python3/worker.js dist/bin/chunks/worker.js && mkdir -p dist/bundle/chunks && cp src/commands/python3/worker.js dist/bundle/chunks/worker.js && esbuild src/commands/js-exec/js-exec-worker.ts --bundle --platform=node --format=esm --outfile=src/commands/js-exec/js-exec-worker.js --external:quickjs-emscripten && cp src/commands/js-exec/js-exec-worker.js dist/commands/js-exec/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bin/chunks/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bundle/chunks/js-exec-worker.js && esbuild src/commands/sqlite3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/sqlite3/worker.js --external:sql.js && mkdir -p dist/commands/sqlite3 && cp src/commands/sqlite3/worker.js dist/commands/sqlite3/worker.js && cp src/commands/sqlite3/worker.js dist/bin/chunks/sqlite3-worker.js && cp src/commands/sqlite3/worker.js dist/bundle/chunks/sqlite3-worker.js",
     "build:lib": "esbuild dist/index.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bundle --chunk-names=chunks/[name]-[hash] --banner:js='import{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:diff --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --external:guarded-fetch",
     "build:lib:cjs": "esbuild dist/index.js --bundle --platform=node --format=cjs --minify --outfile=dist/bundle/index.cjs --external:diff --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --external:guarded-fetch",
-    "build:browser": "esbuild dist/browser.js --bundle --platform=browser --format=esm --minify --outfile=dist/bundle/browser.js --external:diff --external:sprintf-js --external:turndown --external:undici --external:guarded-fetch --external:node:zlib --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --define:__BROWSER__=true --alias:node:async_hooks=./src/shims/browser-unsupported.js --alias:node:dns=./src/shims/browser-unsupported.js --alias:node:module=./src/shims/browser-unsupported.js",
+    "build:browser": "esbuild dist/browser.js --bundle --platform=browser --format=esm --minify --outfile=dist/bundle/browser.js --external:diff --external:sprintf-js --external:turndown --external:guarded-fetch --external:node:zlib --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --define:__BROWSER__=true --alias:node:async_hooks=./src/shims/browser-unsupported.js --alias:node:dns=./src/shims/browser-unsupported.js --alias:node:module=./src/shims/browser-unsupported.js",
     "build:cli": "esbuild dist/cli/just-bash.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
     "build:shell": "esbuild dist/cli/shell.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin/shell --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
     "validate": "pnpm lint && pnpm knip && pnpm typecheck && pnpm build && pnpm check:worker-sync && pnpm test:run && pnpm test:wasm && pnpm test:dist",

package/dist/bin/chunks/awk2-NTRVFXRA.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import{createRequire} from"node:module";const require=createRequire(import.meta.url);
-import{a,b}from"./chunk-ZVG47PYA.js";import"./chunk-MROECM42.js";import"./chunk-42AMF6EE.js";import"./chunk-YXPSX3SI.js";import"./chunk-GR4ZHKXI.js";import"./chunk-HWI42GQO.js";import"./chunk-YERKK5B3.js";import"./chunk-I57EACSL.js";import"./chunk-FUT3X2GJ.js";import"./chunk-CPKBPQ2C.js";import"./chunk-MUFNRCMY.js";import"./chunk-DN2YCFOR.js";export{a as awkCommand2,b as flagsForFuzzing};

package/dist/bin/chunks/chunk-3PCPQIUD.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import{createRequire} from"node:module";const require=createRequire(import.meta.url);
-function i(...s){let e=[...new Set(s.filter(n=>n!==void 0))];if(e.length===0)return{signal:void 0,cleanup(){}};if(e.length===1)return{signal:e[0],cleanup(){}};let r=new AbortController,o=[];for(let n of e){if(n.aborted){r.abort(n.reason);break}let t=()=>r.abort(n.reason);n.addEventListener("abort",t,{once:!0}),o.push([n,t])}return{signal:r.signal,cleanup(){for(let[n,t]of o)n.removeEventListener("abort",t)}}}export{i as a};

package/dist/bin/chunks/chunk-6JUPBMCR.js

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-import{createRequire} from"node:module";const require=createRequire(import.meta.url);
-import{b as P,c as O,d as T,e as k}from"./chunk-MBREBDZQ.js";import{f as F}from"./chunk-HWK7KFGB.js";import{l as v,m as w}from"./chunk-FUT3X2GJ.js";import{c as S}from"./chunk-OHFB3M3X.js";import{a as E}from"./chunk-NE4R2FVV.js";import{a as D}from"./chunk-I4IRHQDW.js";import{a as $,b as C}from"./chunk-MUFNRCMY.js";var H={name:"cp",summary:"copy files and directories",usage:"cp [OPTION]... SOURCE... DEST",options:["-r, -R, --recursive  copy directories recursively","-n, --no-clobber     do not overwrite an existing file","-p, --preserve       preserve file attributes","-v, --verbose        explain what is being done","    --help           display this help and exit"]},I={recursive:{short:"r",long:"recursive",type:"boolean"},recursiveUpper:{short:"R",type:"boolean"},noClobber:{short:"n",long:"no-clobber",type:"boolean"},preserve:{short:"p",long:"preserve",type:"boolean"},verbose:{short:"v",long:"verbose",type:"boolean"}},q={name:"cp",async execute(u,e){if(C(u))return $(H);let s=E("cp",u,I);if(!s.ok)return s.error;let d=s.result.flags.recursive||s.result.flags.recursiveUpper,A=s.result.flags.noClobber,N=s.result.flags.preserve,R=s.result.flags.verbose,p=s.result.positional;if(p.length<2)return{stdout:"",stderr:`cp: missing destination file operand
-`,exitCode:1};let m=p.pop()??"",g=p,l=e.fs.resolvePath(e.cwd,m),y="",n="",i=0,h=new T({limits:e.limits,signal:e.signal,executionScope:e.executionScope,site:"cp"}),f=!1;try{f=(await e.fs.stat(l)).isDirectory}catch{}if(g.length>1&&!f)return{stdout:"",stderr:`cp: target '${m}' is not a directory
-`,exitCode:1};for(let t of g)try{let o=e.fs.resolvePath(e.cwd,t),a=await e.fs.stat(o),r=l;if(f){let c=t.split("/").pop()||t;r=l==="/"?`/${c}`:`${l}/${c}`}if(a.isDirectory&&!d){n+=`cp: -r not specified; omitting directory '${t}'
-`,i=1;continue}if(a.isDirectory){let c=await O(e.fs,o,r,h);if(F(o,r)||c==="inside"){n+=`cp: cannot copy '${t}' into itself, '${r}'
-`,i=1;continue}if(c==="unknown"){n+=`cp: cannot safely determine whether '${r}' is inside '${t}'
-`,i=1;continue}}if(A)try{await e.fs.stat(r);continue}catch{}let b=await P(e.fs,o,r);if(b==="same"){n+=`cp: '${t}' and '${r}' are the same file
-`,i=1;continue}if(b==="unknown"){n+=`cp: cannot safely determine whether '${t}' and '${r}' are the same file
-`,i=1;continue}a.isDirectory&&await k({fs:e.fs,root:o,limits:e.limits,signal:e.signal,executionScope:e.executionScope,site:"cp",symlinks:"never",budget:h},()=>{}),await e.fs.cp(o,r,{recursive:d}),R&&(y+=`'${t}' -> '${r}'
-`)}catch(o){if(o instanceof v||o instanceof w)throw o;let a=D(o);S(o,"ENOENT")?n+=`cp: cannot stat '${t}': No such file or directory
-`:n+=`cp: cannot copy '${t}': ${a}
-`,i=1}return{stdout:y,stderr:n,exitCode:i}}},J={name:"cp",flags:[{flag:"-r",type:"boolean"},{flag:"-R",type:"boolean"},{flag:"-n",type:"boolean"},{flag:"-p",type:"boolean"},{flag:"-v",type:"boolean"}],needsArgs:!0,minArgs:2};export{q as a,J as b};