@poe-platform/safe-bash 0.1.442 → 0.1.443

package/dist/safe-bash/browser.js

@@ -2026,6 +2026,11 @@ function encodeValues(values, output2) {
 
 // packages/safe-bash/src/contracts/command.ts
 var argumentCarriers = /* @__PURE__ */ new WeakSet();
+var CommandArgumentIdentityError = class extends TypeError {
+  constructor() {
+    super("Command argument identity does not match its carrier");
+  }
+};
 function argumentAllocation(allocation) {
   const reservations = [];
   const tracked = allocation && {
@@ -2175,7 +2180,7 @@ function getCommandArguments(context) {
   const carrier = context.argumentValues;
   if (carrier === void 0) return createCommandArguments(context.args);
   if (!argumentCarriers.has(carrier)) throw new TypeError("Expected owned command arguments");
-  if (carrier.args !== context.args) throw new TypeError("Command argument identity does not match its carrier");
+  if (carrier.args !== context.args) throw new CommandArgumentIdentityError();
   return carrier;
 }
 var CommandRegistry = class {
@@ -2687,6 +2692,24 @@ async function writeDiagnostic(sink, value2, signal) {
 // packages/safe-bash/src/commands/internal.ts
 init_platform();
 
+// packages/safe-bash/src/diagnostics.ts
+init_platform();
+var PublicDiagnostic = class extends Error {
+};
+function publicDiagnosticMessage(error, onInternalError) {
+  if (error instanceof FsError || error instanceof CommandArgumentIdentityError) return error.message;
+  if (error instanceof PublicDiagnostic && !Object.hasOwn(error, "cause")) return error.message;
+  const original = error instanceof PublicDiagnostic ? error.cause : error;
+  const detail = error instanceof PublicDiagnostic ? error.message : "internal error";
+  try {
+    const pending = onInternalError?.(original);
+    if (pending !== void 0) void Promise.resolve(pending).catch(() => void 0);
+  } catch {
+    return detail;
+  }
+  return detail;
+}
+
 // packages/safe-bash/src/commands/portable-requirements.ts
 init_platform();
 var inputRequirements = [
@@ -2774,7 +2797,7 @@ var RecordBuffer = class {
 var encoder3 = new TextEncoder();
 var decoder2 = new TextDecoder();
 var bufferLimit = 32 * 1024 * 1024;
-var UsageError = class extends Error {
+var UsageError = class extends PublicDiagnostic {
 };
 function options(args, short, long = {}, stopAtOperand = false, onOperand) {
   const flags = /* @__PURE__ */ new Set();
@@ -2855,7 +2878,7 @@ async function output(context, text) {
 }
 async function diagnostic(context, error) {
   context.signal.throwIfAborted();
-  await writeDiagnostic(context.stderr, `${context.command}: ${error instanceof Error ? error.message : String(error)}
+  await writeDiagnostic(context.stderr, `${context.command}: ${publicDiagnosticMessage(error, context.onInternalError)}
 `, context.signal);
 }
 function define(name2, handler, failureCode = 1) {
@@ -3497,7 +3520,7 @@ async function moveAcrossDevices(context, source, target, noClobber, budget) {
         } catch (error) {
           context.signal.throwIfAborted();
           if (codeOf(error) !== "ENOTSUP" && codeOf(error) !== "EOPNOTSUPP") throw error;
-          await diagnostic(context, new Error(`cannot preserve timestamps for '${entry.target}': operation not supported; retaining copied data`));
+          await diagnostic(context, new PublicDiagnostic(`cannot preserve timestamps for '${entry.target}': operation not supported; retaining copied data`));
         }
       }
     }
@@ -4529,7 +4552,7 @@ var FollowSession = class {
         if ("reason" in outcome) reject(outcome.reason);
         else resolve(outcome.value);
       };
-      const cancel = () => finish({ reason: this.operation.signal.aborted ? this.operation.signal.reason : new Error("Tail follow is closed") });
+      const cancel = () => finish({ reason: this.operation.signal.aborted ? this.operation.signal.reason : new PublicDiagnostic("Tail follow is closed") });
       this.waiting.add(cancel);
       this.operation.signal.addEventListener("abort", cancel, { once: true });
       pending?.then((value2) => finish({ value: value2 }), (reason) => finish({ reason }));
@@ -4733,7 +4756,7 @@ async function followTail(caller, selection, cap, select, scheduler = tailFollow
     entry.offset = 0;
     if (!initial) {
       const message2 = replaced ? "has been replaced; following new file" : entry.error === "ENOENT" ? "has appeared; following new file" : "has become accessible";
-      await diagnostic(context, new Error(`'${entry.name}' ${message2}`));
+      await diagnostic(context, new PublicDiagnostic(`'${entry.name}' ${message2}`));
     }
     entry.error = void 0;
     return stat;
@@ -4796,7 +4819,7 @@ async function followTail(caller, selection, cap, select, scheduler = tailFollow
           }
           if (!stat) continue;
           if (stat.size < entry.offset) {
-            await diagnostic(context, new Error(`${entry.name}: file truncated`));
+            await diagnostic(context, new PublicDiagnostic(`${entry.name}: file truncated`));
             entry.offset = 0;
           }
           if (stat.size > entry.offset) round.push({ entry, end: stat.size });
@@ -5735,7 +5758,7 @@ function textCommands() {
             }
             return (async () => {
               if (records.length && (await compare(records.at(-1), bytes2) > 0 || parsed.flags.has("u") && await keyCompare(records.at(-1), bytes2) === 0)) {
-                await diagnostic(context, new Error(`disorder at record ${records.length + 1}`));
+                await diagnostic(context, new PublicDiagnostic(`disorder at record ${records.length + 1}`));
                 return false;
               }
               records.push(bytes2);
@@ -6719,16 +6742,16 @@ var precedence = {
 function integer2(text) {
   if (/^0[xX][\da-fA-F]+$/u.test(text)) return BigInt(text);
   if (/^0[0-7]+$/u.test(text)) return BigInt(`0o${text.slice(1)}`);
-  if (/^0\d+$/u.test(text)) throw new Error("Invalid octal constant");
+  if (/^0\d+$/u.test(text)) throw new PublicDiagnostic("Invalid octal constant");
   if (/^\d+$/u.test(text)) return BigInt(text);
   const match = /^(\d+)#([\da-zA-Z@_]+)$/u.exec(text);
-  if (!match) throw new Error("Invalid arithmetic constant");
+  if (!match) throw new PublicDiagnostic("Invalid arithmetic constant");
   const base = Number(match[1]);
-  if (base < 2 || base > 64) throw new Error("Invalid arithmetic base");
+  if (base < 2 || base > 64) throw new PublicDiagnostic("Invalid arithmetic base");
   let value2 = 0n;
   for (const character of match[2]) {
     const digit2 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ@_".indexOf(base <= 36 ? character.toLowerCase() : character);
-    if (digit2 >= base || digit2 < 0) throw new Error("Digit exceeds arithmetic base");
+    if (digit2 >= base || digit2 < 0) throw new PublicDiagnostic("Digit exceeds arithmetic base");
     value2 = BigInt.asIntN(64, value2 * BigInt(base) + BigInt(digit2));
   }
   return value2;
@@ -6880,7 +6903,7 @@ function evaluateArithmetic(program, variables, budget = new ParseBudget()) {
       case ">=":
         return BigInt(left >= right);
       default:
-        throw new Error(`Unsupported arithmetic operator ${operator}`);
+        throw new PublicDiagnostic(`Unsupported arithmetic operator ${operator}`);
     }
   };
   try {
@@ -6890,11 +6913,11 @@ function evaluateArithmetic(program, variables, budget = new ParseBudget()) {
     while (pending.length) {
       const frame = pending.pop();
       if (frame.kind === "evaluate") {
-        if (++steps > 1e4) throw new Error("Arithmetic operation limit exceeded");
+        if (++steps > 1e4) throw new PublicDiagnostic("Arithmetic operation limit exceeded");
         const node = frame.node;
         if (node.kind === "literal") value2 = node.value;
         else if (node.kind === "name") {
-          if (visiting.has(node.name) || visiting.size >= 64) throw new Error("Arithmetic variable recursion");
+          if (visiting.has(node.name) || visiting.size >= 64) throw new PublicDiagnostic("Arithmetic variable recursion");
           visiting.add(node.name);
           pending.push({ kind: "variable", name: node.name }, { kind: "evaluate", node: parseArithmetic(variables[node.name] ?? "0", 0, budget) });
         } else if (node.kind === "conditional") {
@@ -6940,11 +6963,11 @@ function evaluateArithmetic(program, variables, budget = new ParseBudget()) {
     }
     return value2;
   } catch (error) {
-    if (error instanceof ArithmeticFailure) throw new Error(`${program.source.trimStart()}: ${error.message} (error token is "${program.source.slice(error.offset)}")`);
+    if (error instanceof ArithmeticFailure) throw new PublicDiagnostic(`${program.source.trimStart()}: ${error.message} (error token is "${program.source.slice(error.offset)}")`);
     if (error instanceof ShellSyntaxError) {
       const offset = error.offset >= program.source.trimEnd().length ? Math.max(0, program.source.trimEnd().length - 1) : error.offset;
       const reason = error.reason === "Invalid arithmetic operand" ? "arithmetic syntax error: operand expected" : "arithmetic syntax error in expression";
-      throw new Error(`${program.source.trimStart()}: ${reason} (error token is "${program.source.slice(offset)}")`);
+      throw new PublicDiagnostic(`${program.source.trimStart()}: ${reason} (error token is "${program.source.slice(offset)}")`);
     }
     throw error;
   }
@@ -11944,8 +11967,9 @@ function resolveLimits(...limits) {
 }
 var budgetedSinks = /* @__PURE__ */ new WeakMap();
 var Budget = class {
-  constructor(limits, signal) {
+  constructor(limits, signal, onInternalError) {
     this.limits = limits;
+    this.onInternalError = onInternalError;
     this.signal = signal ? AbortSignal.any([signal, this.controller.signal]) : this.controller.signal;
     this.parsing = new ParseBudget(limits.maxParseUnits, this.signal, (error) => this.controller.abort(error));
     this.values = new ValueArena(limits.maxExpansionBytes, limits.maxExpansionFields, () => this.signal.throwIfAborted(), (limit) => this.fail(limit));
@@ -11953,6 +11977,7 @@ var Budget = class {
     this.#armWallClock();
   }
   limits;
+  onInternalError;
   executionScope = Object.freeze({});
   pathLookup = new PathLookup();
   parsing;
@@ -12381,13 +12406,16 @@ function saturatedSum(left, right) {
 function errorCode(error) {
   return typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
 }
-function message(error) {
-  return error instanceof Error ? error.message : String(error);
+function message(error, onInternalError) {
+  if (error instanceof ExpansionFailure || error instanceof CommandFailure || error instanceof ArrayFailure || error instanceof BraceExpansionFailure) return error.message;
+  return publicDiagnosticMessage(error, onInternalError);
 }
-function filesystemDiagnostic(error, target) {
+function filesystemDiagnostic(error, target, onInternalError) {
   const descriptions = { ENOENT: "No such file or directory", EACCES: "Permission denied", EPERM: "Operation not permitted", ENOTDIR: "Not a directory", EISDIR: "Is a directory", ELOOP: "Too many levels of symbolic links", ENOSPC: "No space left on device", EROFS: "Read-only file system" };
   const description = descriptions[errorCode(error) ?? ""];
-  return description ? `${target}: ${description}` : void 0;
+  if (!description) return void 0;
+  publicDiagnosticMessage(error, onInternalError);
+  return `${target}: ${description}`;
 }
 function cdUtf8Width(codePoint) {
   return codePoint <= 127 ? 1 : codePoint <= 2047 ? 2 : codePoint <= 65535 ? 3 : 4;
@@ -12425,7 +12453,7 @@ var CdLookup = class {
   probes = 0;
   async charge(amount) {
     this.signal.throwIfAborted();
-    if (amount > 8388608 - this.spent) throw new Error("cd: helper work limit exceeded");
+    if (amount > 8388608 - this.spent) throw new PublicDiagnostic("cd: helper work limit exceeded");
     while (amount > 0) {
       const step = Math.min(amount, 128 - this.spent % 128);
       this.spent += step;
@@ -12446,8 +12474,8 @@ var CdLookup = class {
     for (let index = 0; index < value2.length; ) {
       const codePoint = value2.codePointAt(index);
       const width = cdUtf8Width(codePoint);
-      if (bytes2 + width > 65536) throw new Error(search ? "cd: CDPATH exceeds 65536 UTF-8 bytes" : "cd: path exceeds 65536 UTF-8 bytes");
-      if (search && codePoint === 58 && ++slots > 4096) throw new Error("cd: CDPATH exceeds 4096 components");
+      if (bytes2 + width > 65536) throw new PublicDiagnostic(search ? "cd: CDPATH exceeds 65536 UTF-8 bytes" : "cd: path exceeds 65536 UTF-8 bytes");
+      if (search && codePoint === 58 && ++slots > 4096) throw new PublicDiagnostic("cd: CDPATH exceeds 4096 components");
       await this.charge(width);
       if (search && codePoint === 58) {
         components.push({ start, end: index, bytes: bytes2 - startBytes });
@@ -12468,13 +12496,13 @@ var CdLookup = class {
     const search = eligible && cdpath ? await this.scan(cdpath, true) : void 0;
     const probe = async (component, componentBytes) => {
       const rawBytes = absolute ? targetBytes : component.startsWith("/") ? componentBytes + 1 + targetBytes : cwdBytes + 1 + (component ? componentBytes + 1 : 0) + targetBytes;
-      if (rawBytes > 65536) throw new Error("cd: path exceeds 65536 UTF-8 bytes");
+      if (rawBytes > 65536) throw new PublicDiagnostic("cd: path exceeds 65536 UTF-8 bytes");
       await this.charge(2 * rawBytes);
       const raw = absolute ? target : component.startsWith("/") ? `${component}/${target}` : component ? `${cwd}/${component}/${target}` : `${cwd}/${target}`;
       const path = resolvePath(cwd, raw);
       await this.scan(path);
       this.signal.throwIfAborted();
-      if (++this.probes > 4097) throw new Error("cd: probe limit exceeded");
+      if (++this.probes > 4097) throw new PublicDiagnostic("cd: probe limit exceeded");
       await this.charge(1);
       this.signal.throwIfAborted();
       const stat = await fs.stat(path, { signal: this.signal });
@@ -12626,7 +12654,7 @@ var DirectoryStackWork = class {
   }
 };
 var closedSink = { async write() {
-  throw Object.assign(new Error("Bad file descriptor"), { code: "EBADF" });
+  throw Object.assign(new PublicDiagnostic("Bad file descriptor"), { code: "EBADF" });
 } };
 var closedSource = { [Symbol.asyncIterator]() {
   let closed = false;
@@ -12643,7 +12671,7 @@ var closedSource = { [Symbol.asyncIterator]() {
       return enqueue(() => {
         if (closed) return { done: true, value: void 0 };
         closed = true;
-        throw Object.assign(new Error("Bad file descriptor"), { code: "EBADF" });
+        throw Object.assign(new PublicDiagnostic("Bad file descriptor"), { code: "EBADF" });
       });
     },
     return(value2) {
@@ -13110,14 +13138,14 @@ var Runtime = class _Runtime {
   }
   writeVariable(state, name2, value2, origin = "assignment") {
     if (arrayStore(state)?.get(name2)) throw new ArrayFailure(origin === "arithmetic" ? "indexed arithmetic is unsupported" : "indexed write requires prepared publication");
-    if (state.readonlyVariables?.has(name2)) throw new Error(`${name2}: readonly variable`);
+    if (state.readonlyVariables?.has(name2)) throw new PublicDiagnostic(`${name2}: readonly variable`);
     if (shellValueByteLength(value2) > this.budget.limits.maxExpansionBytes) this.budget.fail("maxExpansionBytes");
     if (name2 === "OPTIND" && state.getopts?.integer && origin !== "arithmetic") {
       try {
         value2 = String(evaluateArithmetic(prepareArithmetic(shellValueText(value2) || "0", this.budget.parsing), this.arithmeticVariables(state), this.budget.parsing));
       } catch (error) {
         this.rethrowArithmeticControl(error);
-        throw new ExpansionFailure(message(error));
+        throw new ExpansionFailure(message(error, this.budget.onInternalError));
       }
     }
     publishVariable(state, name2, value2);
@@ -13135,7 +13163,7 @@ var Runtime = class _Runtime {
     if (state.variables.OPTIND !== previous) this.syncGetopts(state);
   }
   unsetVariable(state, name2, internal = false) {
-    if (state.readonlyVariables?.has(name2)) throw new Error(`${name2}: readonly variable`);
+    if (state.readonlyVariables?.has(name2)) throw new PublicDiagnostic(`${name2}: readonly variable`);
     delete state.variables[name2];
     state.exported.delete(name2);
     if (name2 === "OPTIND" && !internal) this.syncGetopts(state);
@@ -13853,7 +13881,7 @@ var Runtime = class _Runtime {
             }, (prepared) => evaluateArithmetic(prepared, this.arithmeticVariables(state, io.diagnosticLine), this.budget.parsing)) === 0n);
           } catch (error) {
             this.rethrowArithmeticControl(error);
-            throw new Error(`((: ${message(error)}`);
+            throw new PublicDiagnostic(`((: ${message(error, this.budget.onInternalError)}`);
           }
         }
         if (command2.kind === "subshell") {
@@ -13948,9 +13976,10 @@ var Runtime = class _Runtime {
         if (command2.kind !== "simple" && command2.kind !== "subshell" && command2.kind !== "arithmetic" && command2.kind !== "conditional") this.errexit(141, state, io);
         return 141;
       }
+      const publicMessage = message(error, this.budget.onInternalError);
       const line = error instanceof ExpansionFailure ? error.line ?? io.diagnosticLine ?? 1 : io.diagnosticLine ?? 1;
       if (error instanceof NounsetFailure || error instanceof ParameterExpansionFailure) {
-        const detail = error instanceof ParameterExpansionFailure ? diagnostic3 ?? message(error) : message(error);
+        const detail = error instanceof ParameterExpansionFailure ? diagnostic3 ?? publicMessage : publicMessage;
         try {
           await writeDiagnostic(io.stderr, `${io.scriptName ?? "shell"}: line ${line}: ${detail}
 `);
@@ -13962,14 +13991,15 @@ var Runtime = class _Runtime {
         }
         throw completedExit(error instanceof ParameterExpansionFailure && !state.isolated ? 127 : 1);
       }
-      if (error instanceof ArrayFailure) await writeDiagnostic(io.stderr, `${io.scriptName ?? "shell"}: line ${line}: ${diagnostic3 ?? message(error)}
+      if (error instanceof ArrayFailure) await writeDiagnostic(io.stderr, `${io.scriptName ?? "shell"}: line ${line}: ${diagnostic3 ?? publicMessage}
 `);
       else {
         try {
-          await writeDiagnostic(io.stderr, `${io.scriptName ?? "shell"}: line ${line}: ${diagnostic3 ?? message(error)}
+          await writeDiagnostic(io.stderr, `${io.scriptName ?? "shell"}: line ${line}: ${diagnostic3 ?? publicMessage}
 `);
-        } catch {
+        } catch (failure) {
           this.signal.throwIfAborted();
+          publicDiagnosticMessage(failure, this.budget.onInternalError);
         }
       }
       if (error instanceof ExpansionFailure || error instanceof BraceExpansionFailure) throw completedExit(error instanceof ParameterExpansionFailure && !state.isolated ? 127 : 1);
@@ -14077,7 +14107,7 @@ var Runtime = class _Runtime {
             if (error instanceof NounsetFailure) throw error;
             if (error instanceof ParameterExpansionFailure && !isolatedInlineInput) throw error;
             if (error instanceof ParameterExpansionFailure) throw new CommandFailure(error.message, state.isolated ? 1 : 127);
-            if (error instanceof ExpansionFailure) throw new Error(error.message);
+            if (error instanceof ExpansionFailure) throw new PublicDiagnostic(error.message);
             throw error;
           }
           if (hereString) {
@@ -14090,18 +14120,18 @@ var Runtime = class _Runtime {
           continue;
         }
         const targets = await this.word(redirect.target, state, currentIO());
-        if (targets.length !== 1) throw new Error("Ambiguous redirect");
+        if (targets.length !== 1) throw new PublicDiagnostic("Ambiguous redirect");
         const target = targets[0];
         errorTarget = target;
         if (redirect.operator.endsWith("&")) {
           if (target === "-") descriptors.delete(redirect.descriptor);
           else {
-            if (!/^\d+-?$/u.test(target)) throw new Error(`${target}: Bad file descriptor`);
+            if (!/^\d+-?$/u.test(target)) throw new PublicDiagnostic(`${target}: Bad file descriptor`);
             const move = target.endsWith("-");
-            if (move && !redirect.move) throw new Error(`${target}: ambiguous redirect`);
+            if (move && !redirect.move) throw new PublicDiagnostic(`${target}: ambiguous redirect`);
             const sourceDescriptor = Number(move ? target.slice(0, -1) : target);
             const descriptor2 = descriptors.get(sourceDescriptor);
-            if (!descriptor2 || descriptor2.closed || !move && (redirect.operator === "<&" ? !descriptor2.input : !descriptor2.output)) throw new Error(`${move ? sourceDescriptor : target}: Bad file descriptor`);
+            if (!descriptor2 || descriptor2.closed || !move && (redirect.operator === "<&" ? !descriptor2.input : !descriptor2.output)) throw new PublicDiagnostic(`${move ? sourceDescriptor : target}: Bad file descriptor`);
             descriptors.set(redirect.descriptor, { ...descriptor2 });
             if (move && sourceDescriptor !== redirect.descriptor) {
               descriptors.delete(sourceDescriptor);
@@ -14114,7 +14144,7 @@ var Runtime = class _Runtime {
           if (redirect.operator === "<") {
             await interruptible(this.fs.access(path, 4, options3), this.signal);
             const stat = await interruptible(this.fs.stat(path, options3), this.signal);
-            if (stat.type === "directory" && !fileShortcut) throw new Error(`${target}: Is a directory`);
+            if (stat.type === "directory" && !fileShortcut) throw new PublicDiagnostic(`${target}: Is a directory`);
             const source = stat.type === "directory" ? toByteSource("") : await fileInput(this.fs, path, this.budget.limits.maxInputBytes, this.signal);
             const input3 = new ShellInput(source, this.budget, this.signal);
             inputs.add(input3);
@@ -14376,7 +14406,7 @@ var Runtime = class _Runtime {
       if (!inlineInput) await assign();
       if (fileShortcut) {
         const input3 = io.descriptors?.get(command2.redirects[0].descriptor)?.input;
-        if (!input3) throw new Error("Bad file descriptor");
+        if (!input3) throw new PublicDiagnostic("Bad file descriptor");
         await pipeBytes(input3, io.stdout, this.signal);
         return 0;
       }
@@ -14386,7 +14416,7 @@ var Runtime = class _Runtime {
       this.signal.throwIfAborted();
       const original = error instanceof ExecutionFailure ? error.original : error;
       if (special2 && !(original instanceof ShellLimitError) && !(original instanceof ExpansionFailure) && !(original instanceof Flow) && !(original instanceof ShellSyntaxError)) {
-        throw new ExecutionFailure(new FatalCommandFailure(message(original), 1), error instanceof ExecutionFailure ? error.io : io, error instanceof ExecutionFailure ? error.diagnostic : void 0);
+        throw new ExecutionFailure(new FatalCommandFailure(message(original, this.budget.onInternalError), 1), error instanceof ExecutionFailure ? error.io : io, error instanceof ExecutionFailure ? error.diagnostic : void 0);
       }
       if (error instanceof ExecutionFailure) throw error;
       throw new ExecutionFailure(error, io);
@@ -14447,6 +14477,7 @@ var Runtime = class _Runtime {
       fs: this.fs,
       signal: this.commandSignal,
       executionScope: this.budget.executionScope,
+      onInternalError: this.budget.onInternalError,
       registerCleanup: (cleanup) => {
         scope.register(cleanup);
       },
@@ -14828,8 +14859,8 @@ ${functionDisplay(name2, state.functions.get(name2))}`;
         }
         const code = errorCode(error);
         if (code === "ENOENT" || code === "ENOTDIR") continue;
-        if (code !== "EACCES" && code !== "EPERM") throw new CommandFailure(filesystemDiagnostic(error, target) ?? `${target}: ${message(error)}`, 126);
-        denied ??= new CommandFailure(filesystemDiagnostic(error, target) ?? `${target}: ${message(error)}`, 126);
+        if (code !== "EACCES" && code !== "EPERM") throw new CommandFailure(filesystemDiagnostic(error, target, this.budget.onInternalError) ?? `${target}: ${message(error, this.budget.onInternalError)}`, 126);
+        denied ??= new CommandFailure(filesystemDiagnostic(error, target, this.budget.onInternalError) ?? `${target}: ${message(error, this.budget.onInternalError)}`, 126);
       }
     }
     if (denied && !matches.length && !discovery) throw denied;
@@ -15051,6 +15082,7 @@ ${prefix2} line ${offset + line}: \`${source.split("\n")[line - 1] ?? ""}'
         args: argumentValues.args,
         argumentValues,
         executionScope: this.budget.executionScope,
+        onInternalError: this.budget.onInternalError,
         env: Object.assign(/* @__PURE__ */ Object.create(null), incoming.env),
         stdin: input3 ?? incoming.stdin,
         stdout: this.budget.sink(incoming.stdout, runtime.signal),
@@ -15238,7 +15270,7 @@ ${prefix2} line ${offset + line}: \`${source.split("\n")[line - 1] ?? ""}'
       this.signal.throwIfAborted();
       if (error instanceof ShellLimitError || error instanceof CommandFailure) throw error;
       if (errorCode(error) === "EFBIG") this.budget.fail("maxSourceBytes");
-      throw new CommandFailure(filesystemDiagnostic(error, target) ?? `${target}: ${message(error)}`, errorCode(error) === "ENOENT" ? 127 : 126);
+      throw new CommandFailure(filesystemDiagnostic(error, target, this.budget.onInternalError) ?? `${target}: ${message(error, this.budget.onInternalError)}`, errorCode(error) === "ENOENT" ? 127 : 126);
     }
     if (direct && environmentInterpreter) return this.envShebang(context, state, io, environmentInterpreter[1], target, args, { path, source });
     const units = [];
@@ -15383,7 +15415,7 @@ ${prefix2} line ${offset + line}: \`${source.split("\n")[line - 1] ?? ""}'
       this.signal.throwIfAborted();
       if (error instanceof ShellLimitError) throw error;
       if (errorCode(error) === "EFBIG") this.budget.fail("maxSourceBytes");
-      const diagnostic3 = error instanceof CommandFailure ? error.message : filesystemDiagnostic(error, target) ?? `${target}: ${message(error)}`;
+      const diagnostic3 = error instanceof CommandFailure ? error.message : filesystemDiagnostic(error, target, this.budget.onInternalError) ?? `${target}: ${message(error, this.budget.onInternalError)}`;
       if (special2) throw new FatalCommandFailure(diagnostic3, 1);
       throw new CommandFailure(diagnostic3, error instanceof CommandFailure ? error.status : 1);
     }
@@ -15596,7 +15628,7 @@ ${prefix2} line ${offset + line}: \`${source.split("\n")[line - 1] ?? ""}'
         value2 = evaluateArithmetic(prepareArithmetic(args[index], this.budget.parsing), variables, this.budget.parsing);
       } catch (error) {
         this.rethrowArithmeticControl(error);
-        throw new Error(`let: ${message(error)}`);
+        throw new PublicDiagnostic(`let: ${message(error, this.budget.onInternalError)}`);
       }
       if ((index - offset + 1) % 128 === 0) await checkpoint();
     }
@@ -15691,7 +15723,7 @@ ${prefix2} line ${offset + line}: \`${source.split("\n")[line - 1] ?? ""}'
     this.writeVariable(state, "OPTIND", String(result.optind), "getopts");
     if (result.argument.kind === "set") this.writeVariable(state, "OPTARG", result.argument.value, "getopts");
     else this.unsetVariable(state, "OPTARG", true);
-    if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(name2)) throw new Error(`getopts: \`${name2}': not a valid identifier`);
+    if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(name2)) throw new PublicDiagnostic(`getopts: \`${name2}': not a valid identifier`);
     await this.assignVariable(state, name2, result.option, "getopts");
     return result.status;
   }
@@ -15714,8 +15746,8 @@ ${prefix2} line ${offset + line}: \`${source.split("\n")[line - 1] ?? ""}'
       selected = await new CdLookup(this.signal).find(this.fs, state.cwd, target || ".", state.variables.CDPATH);
     } catch (error) {
       this.signal.throwIfAborted();
-      const description = filesystemDiagnostic(error, "");
-      const text = description ? "" : message(error);
+      const description = filesystemDiagnostic(error, "", this.budget.onInternalError);
+      const text = description ? "" : message(error, this.budget.onInternalError);
       diagnose?.(error, cdDiagnostic(description ? [name2, ": ", target, description] : stackHooks && text.startsWith("cd: ") ? [name2, text.slice(2)] : [text]));
       throw error;
     }
@@ -16621,7 +16653,7 @@ ${prefix2} line ${offset + line}: \`${source.split("\n")[line - 1] ?? ""}'
         }, (prepared) => evaluateArithmetic(prepared, this.arithmeticVariables(state, io.diagnosticLine ?? part.line), this.budget.parsing)));
       } catch (error) {
         this.rethrowArithmeticControl(error);
-        throw new ExpansionFailure(message(error), io.diagnosticLine ?? part.line);
+        throw new ExpansionFailure(message(error, this.budget.onInternalError), io.diagnosticLine ?? part.line);
       }
     }
     if (part.kind === "substitution") {
@@ -16722,7 +16754,7 @@ ${prefix2} line ${offset + line}: \`${source.split("\n")[line - 1] ?? ""}'
         alternate = shellValueText(retained);
         if (operator === "?") throw new ParameterExpansionFailure(`${part.name}: ${alternate || (part.operator.startsWith(":") ? "parameter null or not set" : "parameter not set")}`, io.diagnosticLine ?? part.line);
         if (operator === "=") {
-          if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(part.name)) throw new Error("Cannot assign special parameter");
+          if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(part.name)) throw new PublicDiagnostic("Cannot assign special parameter");
           this.writeVariable(state, part.name, retained);
         }
         value2 = alternate;
@@ -16780,7 +16812,7 @@ ${prefix2} line ${offset + line}: \`${source.split("\n")[line - 1] ?? ""}'
           return { value: evaluateArithmetic(prepareArithmetic(source, this.budget.parsing), variables, this.budget.parsing), source };
         } catch (error) {
           this.rethrowArithmeticControl(error);
-          throw new ExpansionFailure(`${part.name}: ${message(error)}`, line);
+          throw new ExpansionFailure(`${part.name}: ${message(error, this.budget.onInternalError)}`, line);
         } finally {
           retained?.release();
         }
@@ -17553,7 +17585,7 @@ var ShellInput = class _ShellInput {
       decoder3.decode();
       return { value: text.finish(), escaped, terminated };
     } catch (error) {
-      if (error instanceof TypeError && error.message.includes("encoded data")) throw new Error("read: unsupported non-UTF-8 text boundary");
+      if (error instanceof TypeError && error.message.includes("encoded data")) throw new PublicDiagnostic("read: unsupported non-UTF-8 text boundary");
       throw error;
     } finally {
       if (offset < chunk.length) this.#cursor.remainder = chunk.subarray(offset);
@@ -17723,6 +17755,7 @@ var Shell = class {
   #active = /* @__PURE__ */ new Set();
   constructor(options3) {
     if (!options3?.fs) throw new TypeError("Shell requires an explicit filesystem");
+    if (options3.onInternalError !== void 0 && typeof options3.onInternalError !== "function") throw new TypeError("onInternalError must be callable");
     warnIfHostProcessEnv(options3.env);
     resolveLimits(options3.limits);
     this.#options = { ...options3, cwd: resolvePath("/", options3.cwd ?? "/"), env: { ...options3.env }, limits: { ...options3.limits } };
@@ -17786,8 +17819,9 @@ var Shell = class {
   }
   async exec(source, options3 = {}) {
     if (this.#disposed) throw new Error("Shell is disposed");
+    if (options3.onInternalError !== void 0 && typeof options3.onInternalError !== "function") throw new TypeError("onInternalError must be callable");
     warnIfHostProcessEnv(options3.env);
-    const budget = new Budget(resolveLimits(this.#options.limits, options3.limits), options3.signal);
+    const budget = new Budget(resolveLimits(this.#options.limits, options3.limits), options3.signal, options3.onInternalError ?? this.#options.onInternalError);
     const scope = new InvocationScope(options3.signal);
     const cancellationState = new RuntimeCancellationState();
     const owner = new RootInvocationCancellationOwner(scope);
@@ -18219,9 +18253,9 @@ var defaults = Object.freeze({
   workerOldGenerationMb: 128,
   workerStackMb: 4
 });
-var RegexExecutionError = class extends Error {
-  constructor(code, message2) {
-    super(code === "MATCH" ? message2 : `regex ${code}: ${message2}`);
+var RegexExecutionError = class extends PublicDiagnostic {
+  constructor(code, message2, options3) {
+    super(code === "MATCH" ? message2 : `regex ${code}: ${message2}`, options3);
     this.code = code;
     this.name = "RegexExecutionError";
   }
@@ -18428,7 +18462,7 @@ var Slot = class {
     if (this.receiver) this.receiver(value2);
     else this.fail(new RegexExecutionError("PROTOCOL", "unexpected idle message"));
   };
-  error = (error) => this.fail(new RegexExecutionError("WORKER_ERROR", error.message));
+  error = (error) => this.fail(new RegexExecutionError("WORKER_ERROR", "internal error", { cause: error }));
   messageerror = () => this.fail(new RegexExecutionError("PROTOCOL", "worker message could not be deserialized"));
   exit = (code) => {
     this.exited = true;
@@ -18793,7 +18827,7 @@ async function* requiredFileInput(context, requirements, mode, file, maxBytes) {
 }
 
 // packages/safe-bash/src/commands/text-programs/shared.ts
-var ProgramError = class extends Error {
+var ProgramError = class extends PublicDiagnostic {
 };
 var Budget3 = class {
   constructor(context, options3) {
@@ -18882,7 +18916,7 @@ function command(name2, run) {
         return { exitCode: await run(context) };
       } catch (error) {
         context.signal.throwIfAborted();
-        await writeDiagnostic(context.stderr, `${name2}: ${error instanceof Error ? error.message : String(error)}
+        await writeDiagnostic(context.stderr, `${name2}: ${publicDiagnosticMessage(error, context.onInternalError)}
 `, context.signal);
         return { exitCode: error instanceof ProgramError ? 2 : 1 };
       }
@@ -20423,7 +20457,7 @@ var defaultFileTypes = Object.freeze({
 for (const patterns2 of Object.values(defaultFileTypes)) Object.freeze(patterns2);
 
 // packages/safe-bash/src/commands/search/options.ts
-var SearchError = class extends Error {
+var SearchError = class extends PublicDiagnostic {
 };
 function count(value2, flag) {
   if (!/^[0-9]+$/u.test(value2) || !Number.isSafeInteger(Number(value2))) throw new SearchError(`${flag} requires a nonnegative integer`);
@@ -20840,7 +20874,7 @@ var Limits = class {
   }
 };
 async function diagnostic2(context, error) {
-  await writeDiagnostic(context.stderr, `rg: ${error instanceof Error ? error.message : String(error)}
+  await writeDiagnostic(context.stderr, `rg: ${publicDiagnosticMessage(error, context.onInternalError)}
 `, context.signal);
 }
 async function* lines2(source, limits, state, binary, nullData) {
@@ -21453,7 +21487,7 @@ var byteLength = Object.getOwnPropertyDescriptor(typedArrayPrototype2, "byteLeng
 var byteOffset = Object.getOwnPropertyDescriptor(typedArrayPrototype2, "byteOffset").get;
 var byteBuffer = Object.getOwnPropertyDescriptor(typedArrayPrototype2, "buffer").get;
 function fail(kind, message2) {
-  throw new Error(`bounded regex ${kind}: ${message2}`);
+  throw new PublicDiagnostic(`bounded regex ${kind}: ${message2}`);
 }
 function record3(value2, keys, optional = []) {
   if (value2 === null || typeof value2 !== "object" || Array.isArray(value2)) fail("protocol", "expected a data record");
@@ -21762,7 +21796,8 @@ var CooperativeWorker = class {
     try {
       owned = admit(input3, this.limits, this.#controller.signal);
     } catch (error) {
-      failure = error instanceof Error ? error.message.slice(0, 512) : "bounded regex protocol: request admission failed";
+      if (!(error instanceof PublicDiagnostic || error instanceof EreSyntaxError || error instanceof EreUnsupportedError || error instanceof EreProfileLimitError || error instanceof EreUsageUnknownError)) throw error;
+      failure = error.message.slice(0, 512);
     }
     this.#busy = true;
     const task = Promise.resolve().then(async () => {
@@ -21771,7 +21806,13 @@ var CooperativeWorker = class {
         this.#controller.signal.throwIfAborted();
         reply = owned ? await execute2(owned, this.#controller.signal) : { id, error: failure };
       } catch (error) {
-        reply = { id, error: error instanceof Error ? error.message.slice(0, 512) : "bounded regex request failed" };
+        if (!(error instanceof PublicDiagnostic || error instanceof EreSyntaxError || error instanceof EreUnsupportedError || error instanceof EreProfileLimitError || error instanceof EreUsageUnknownError)) {
+          owned = void 0;
+          this.#busy = false;
+          for (const listener of this.#listeners.get("error") ?? []) listener(error);
+          return;
+        }
+        reply = { id, error: error.message.slice(0, 512) };
       }
       if (expression && "error" in reply) reply = { id, operation: "expr-match", category: "unsupported", error: reply.error };
       owned = void 0;
@@ -21840,6 +21881,7 @@ function browserCommands(options3 = {}) {
 }
 export {
   ACCESS_MODES,
+  CommandArgumentIdentityError,
   CommandRegistry,
   EreLedger,
   EreProfileLimitError,