@poe-platform/safe-bash 0.1.424 → 0.1.426

package/README.md

@@ -270,7 +270,7 @@ For SafeJS host integration, `makeSafeJsShellModule` exposes shell execution and
 | --- | --- |
 | `fs` | Required filesystem; no implicit host access. |
 | `cwd` | Initial virtual directory; defaults to `/`. |
-| `env` | Initial exported variables; defaults to an empty map, with `PWD` set from `cwd`. No host environment inheritance. Never pass host `process.env` or any secret-bearing object: everything in `env` is readable by executed scripts (`env`, `printenv`, `$VAR`), and on Cloudflare Workers with `nodejs_compat` `process.env` contains the Worker's secret bindings. The shell logs a warning when it detects this. |
+| `env` | Initial exported variables; defaults to an empty map, with `PWD` set from `cwd`. No host environment inheritance. Never pass host `process.env` or any secret-bearing object: everything in `env` is readable by executed scripts (`env`, `printenv`, `$VAR`), and on Cloudflare Workers with `nodejs_compat` `process.env` contains the Worker's secret bindings. The shell warns only for the identical host `process.env` object, not copies, and does not filter values. |
 | `commands` | Existing `CommandRegistry`; defaults to an empty registry. |
 | `limits` | Resource limits listed below. |
 
@@ -289,7 +289,7 @@ provided. Pass an `AbortSignal` as `signal` to cancel. [Option types](src/shell/
 | `maxExpansionFields` | 10,000 |
 | `maxExpansionBytes` | 16 MiB |
 | `maxWallClockMs` | 30 seconds |
-| `maxCpuMs` | 30 seconds, checked at command and cooperative-yield checkpoints |
+| `maxCpuMs` | 30 seconds elapsed including waits; checkpoint-enforced, not CPU accounting or preemptive enforcement. |
 | `pipeHighWaterMark` | 64 KiB |
 
 Always call `dispose()` when finished. Shell failures normally produce an exit

package/dist/safe-bash/browser.js

@@ -4109,6 +4109,7 @@ function filesystemCommands(maxDirectoryEntries) {
 
 // packages/safe-bash/src/commands/predicates.ts
 init_platform();
+var maxExpressionDepth = 256;
 async function metadata(context, path, link = false) {
   assertCommandRequirements(context, predicateRequirements, ["metadata"]);
   try {
@@ -4141,15 +4142,16 @@ function predicateCommands() {
       if (!/^[ \t]*[+-]?[0-9]+[ \t]*$/u.test(text)) throw new UsageError(`integer expression expected: '${text}'`);
       return BigInt(text.trim());
     };
-    const primary = () => {
+    const primary = (depth) => {
       const token = args[offset++];
       if (token === void 0) throw new UsageError("argument expected");
-      if (token === "!" && !binary.has(args[offset] ?? "")) {
-        const inner = primary();
-        return async () => !await inner();
-      }
-      if (token === "(" && !binary.has(args[offset] ?? "")) {
-        const inner = disjunction();
+      if ((token === "!" || token === "(") && !binary.has(args[offset] ?? "")) {
+        if (depth >= maxExpressionDepth) throw new UsageError(`expression nesting exceeds ${maxExpressionDepth}`);
+        if (token === "!") {
+          const inner2 = primary(depth + 1);
+          return async () => !await inner2();
+        }
+        const inner = disjunction(depth + 1);
         if (args[offset++] !== ")") throw new UsageError("missing ')'");
         return inner;
       }
@@ -4214,27 +4216,27 @@ function predicateCommands() {
       }
       return async () => token !== "";
     };
-    const conjunction = () => {
-      let predicate = primary();
+    const conjunction = (depth) => {
+      let predicate = primary(depth);
       while (args[offset] === "-a") {
         offset++;
         const left = predicate;
-        const right = primary();
+        const right = primary(depth);
         predicate = async () => await left() && await right();
       }
       return predicate;
     };
-    const disjunction = () => {
-      let predicate = conjunction();
+    const disjunction = (depth) => {
+      let predicate = conjunction(depth);
       while (args[offset] === "-o") {
         offset++;
         const left = predicate;
-        const right = conjunction();
+        const right = conjunction(depth);
         predicate = async () => await left() || await right();
       }
       return predicate;
     };
-    const evaluate = disjunction();
+    const evaluate = disjunction(0);
     if (offset !== args.length) throw new UsageError(`unexpected argument '${args[offset]}'`);
     return { exitCode: await evaluate() ? 0 : 1 };
   })).map((command2) => ({ ...command2, filesystemRequirements: predicateRequirements }));
@@ -17941,7 +17943,7 @@ init_platform();
 // packages/safe-bash/src/commands/network/private-address.ts
 init_platform();
 function privateIPv4(first, second) {
-  return first === 10 || first === 127 || first === 0 || first === 169 && second === 254 || first === 192 && second === 168 || first === 172 && second >= 16 && second <= 31;
+  return first === 10 || first === 127 || first === 0 || first === 169 && second === 254 || first === 192 && second === 168 || first === 172 && second >= 16 && second <= 31 || first === 100 && second >= 64 && second <= 127 || first === 198 && second >= 18 && second <= 19 || first >= 224;
 }
 function privateHostname(input3) {
   const hostname = input3.toLowerCase().replace(/\.$/u, "").replace(/^\[|\]$/gu, "");
@@ -17957,10 +17959,12 @@ function privateHostname(input3) {
     const mappedIPv4 = hextets.slice(0, 5).every((value2) => value2 === 0) && hextets[5] === 65535;
     const translatedIPv4 = hextets.slice(0, 4).every((value2) => value2 === 0) && hextets[4] === 65535 && hextets[5] === 0;
     const nat64IPv4 = hextets[0] === 100 && hextets[1] === 65435 && hextets.slice(2, 6).every((value2) => value2 === 0);
-    if (mappedIPv4 || translatedIPv4 || nat64IPv4) {
+    const compatibleIPv4 = hextets.slice(0, 6).every((value2) => value2 === 0);
+    if (mappedIPv4 || translatedIPv4 || nat64IPv4 || compatibleIPv4) {
       return privateIPv4(hextets[6] >>> 8, hextets[6] & 255);
     }
-    return (hextets[0] & 65024) === 64512 || (hextets[0] & 65472) === 65152;
+    if (hextets[0] === 8194) return privateIPv4(hextets[1] >>> 8, hextets[1] & 255);
+    return (hextets[0] & 65024) === 64512 || (hextets[0] & 65472) === 65152 || (hextets[0] & 65472) === 65216 || (hextets[0] & 65280) === 65280 || hextets[0] === 100 && hextets[1] === 65435 && hextets[2] === 1;
   }
   const parts2 = hostname.split(".");
   if (parts2.length !== 4 || parts2.some((part) => !part || Array.from(part).some((character) => character < "0" || character > "9"))) return false;
@@ -19144,7 +19148,7 @@ async function substitute(text, pattern, replacement, budget, global, occurrence
 }
 
 // packages/safe-bash/src/commands/text-programs/sed.ts
-function parse(source, extended, separator) {
+function parse(source, extended, separator, maxProgramInstructions) {
   if (source.length > 1024 * 1024) throw new ProgramError("sed program exceeds 1 MiB");
   const result = [];
   const groups = [];
@@ -19240,6 +19244,7 @@ function parse(source, extended, separator) {
       continue;
     }
     if (offset === source.length) break;
+    if (result.length >= maxProgramInstructions) throw new ProgramError("program instruction limit exceeded");
     const first = address();
     horizontal();
     let second;
@@ -19629,6 +19634,8 @@ async function execute(program, context, files, quiet, budget, separator, output
 }
 function sedCommand(options3 = {}) {
   const definition = command("sed", async (context) => {
+    const maxProgramInstructions = options3.maxProgramInstructions === void 0 ? 1024 : options3.maxProgramInstructions;
+    if (!Number.isSafeInteger(maxProgramInstructions) || maxProgramInstructions < 1) throw new ProgramError("maxProgramInstructions must be a positive safe integer");
     const budget = new Budget3(context, options3);
     const sources = [];
     const files = [];
@@ -19677,7 +19684,7 @@ function sedCommand(options3 = {}) {
       sources.push(byteString(files.shift()));
     }
     if (sources[0]?.startsWith("#n")) quiet = true;
-    const program = parse(sources.join("\n"), extended, separator);
+    const program = parse(sources.join("\n"), extended, separator, maxProgramInstructions);
     const outputFiles = program.flatMap((instruction) => instruction.kind !== "r" && instruction.file !== void 0 ? [instruction.file] : []);
     await assertPathRequirements(context, sedRequirements, ["script-output"], outputFiles);
     if (inPlace !== void 0 || outputFiles.length) {