@poe-platform/safe-bash 0.1.683 → 0.1.684

package/README.md

@@ -85,9 +85,19 @@ These plugins are separate from `agentCommands()`; pass them to `shell.use(...)`
 | --- | --- |
 | `curl` | `networkCommands({ authorize, transport?, limits?, replace? })`: required authorization on every request, redirect, and retry. Node uses the native HTTP transport; Workers can inject `createFetchTransport()`. `createOriginAuthorizer([...])` provides exact origin/hostname policy; its omitted allowlist is deliberately `*` (allow all). [Options and limits](src/commands/network/types.ts). |
 | `node` | `nodeCommands({ runtime, limits?, replace? })`: runs JavaScript with an injected SafeJS runtime, virtual files, and shell streams. [Usage and supported subset](src/commands/node/README.md). |
+| `python`, `python3` | `pythonCommands({ createExecutor })` from `@poe-platform/safe-bash/commands/python`: supply an explicit executor for invocation-local Python, filesystem I/O and shell streams. [Executor and ownership contract](src/contracts/python-executor.md). |
 | `llm` | `llmCommands({ providers, defaultModel?, replace? })`: opt-in model routing, sandbox attachments and streamed text/binary output. Includes injected-transport OpenAI and ElevenLabs reference providers. [Configuration and provider contract](src/commands/llm/README.md). |
 | `playwright-cli` | Standard browser commands, storage state, native snapshots, recordings, and traces through a host-owned adapter. [Sessions and host capabilities](src/contracts/playwright-sessions.md). `installPlaywrightNetworkPolicy` from `/playwright` supports browser-native redirects with per-hop bounded host HTTP fetch and independent direct HTTP/WebSocket denial. Cloudflare guardrails do not establish WebRTC/UDP denial or all-protocol accounting; hosts requiring those guarantees must refuse this integration. [Network policy and lifecycle](src/contracts/playwright-network-policy.md). |
 
+For a custom same-isolate Python JSPI host, use `createPythonJspiExecutor` from
+the same Python entry with an explicit loader, precompiled Wasm modules and
+pinned, authenticated runtime assets; follow the [static host recipe](src/contracts/python-jspi.md).
+Native I/O uses the caller's asynchronous filesystem without workspace copying,
+Node worker threads or a SAB request/reply bridge. This path is qualified with
+installed public-package artifacts in local workerd, not a verified Cloudflare
+deployment or a managed Python native-filesystem integration. JSPI cancellation
+is cooperative; it neither preempts CPU-only loops nor establishes confinement.
+
 Storage can be in memory, a rooted host directory, S3-compatible storage, or WebDAV,
 with read-only wrappers, mounts, and overlays. Choose and configure it explicitly;
 see the [filesystem guide](../safe-fs/README.md).

package/dist/safe-bash/chunks/chunk-4MPK7VIM.js

@@ -0,0 +1,519 @@
+import {
+  init_platform
+} from "./chunk-O4SKIJ5J.js";
+
+// packages/safe-bash/src/commands/python/invocation.ts
+init_platform();
+var PythonInvocationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PythonInvocationError";
+  }
+};
+function parsePythonInvocation(args, env) {
+  const startupArgs = [];
+  let informational = false;
+  scan: for (let index = 0; index < args.length; index++) {
+    const option = args[index];
+    if (option === "--" || option === "-" || !option.startsWith("-")) break;
+    if (option === "--help") {
+      informational = true;
+      break;
+    }
+    if (option === "--version") {
+      informational = true;
+      continue;
+    }
+    if (option.startsWith("--")) throw new PythonInvocationError("unsupported option " + option);
+    for (let offset = 1; offset < option.length; offset++) {
+      const flag = option[offset];
+      if (flag === "h" || flag === "?") {
+        informational = true;
+        break scan;
+      }
+      if (flag === "V") {
+        informational = true;
+        continue;
+      }
+      if ("cmWX".includes(flag)) {
+        const operand = option.slice(offset + 1) || args[++index];
+        if (operand === void 0) throw new PythonInvocationError("argument expected for -" + flag);
+        if (flag === "c" || flag === "m") break scan;
+        if (flag === "X") {
+          const separator = operand.indexOf("=");
+          const name = separator < 0 ? operand : operand.slice(0, separator);
+          const value = separator < 0 ? void 0 : operand.slice(separator + 1);
+          let decimal = value ?? "";
+          while (decimal.length && " 	\n\r\v\f".includes(decimal[0])) decimal = decimal.slice(1);
+          if (decimal[0] === "+" || decimal[0] === "-") decimal = decimal.slice(1);
+          const digits = decimal.length > 0 && [...decimal].every((character) => character >= "0" && character <= "9");
+          const supported = name === "utf8" && (value === void 0 || value === "0" || value === "1") || (name === "dev" || name === "warn_default_encoding") && value === void 0 || name === "int_max_str_digits" && digits && Number.isSafeInteger(Number(value)) && Number(value) <= 2147483647 && (Number(value) === 0 || Number(value) >= 640);
+          if (!supported) throw new PythonInvocationError("unsupported -X option " + operand);
+          startupArgs.push("-X", operand);
+        }
+        break;
+      }
+      if (!"BEPOusISbdvqR".includes(flag)) throw new PythonInvocationError("unsupported option -" + flag);
+      startupArgs.push("-" + flag);
+    }
+  }
+  if (!informational && !startupArgs.includes("-E") && !startupArgs.includes("-I")) {
+    if (env.PYTHONINSPECT) throw new PythonInvocationError("PYTHONINSPECT requires an interactive terminal, which the shell does not expose");
+    if (env.PYTHONHOME) throw new PythonInvocationError("PYTHONHOME cannot replace the configured Pyodide runtime");
+  }
+  const runtimeEnv = { ...env };
+  delete runtimeEnv.PYTHONPATH;
+  delete runtimeEnv.PYTHONHOME;
+  delete runtimeEnv.PYTHONWARNINGS;
+  runtimeEnv.PYTHONINSPECT = "";
+  startupArgs.push("-c", "");
+  return { startupArgs, env: runtimeEnv };
+}
+
+// packages/safe-bash/src/commands/python/diagnostics.ts
+init_platform();
+var messages = {
+  "executor-unavailable": "Python executor is unavailable; configure exactly one supported executor or interpreter worker.",
+  "transport-unavailable": "Python worker transport or shared-memory operations are unavailable.",
+  "runtime-abi": "Python runtime version or native ABI is unsupported.",
+  "runtime-assets": "Python runtime or package assets could not be loaded.",
+  "isolation-unavailable": "Python host isolation or resource enforcement is unavailable.",
+  deadline: "Python execution exceeded its host deadline.",
+  "filesystem-open": "Python filesystem handle access is unavailable; the backend must support retained open.",
+  "filesystem-read": "Python filesystem reads are unavailable for this backend.",
+  "filesystem-write": "Python filesystem writes are unavailable for this backend.",
+  "filesystem-directory": "Python retained directory operations are unavailable for this backend.",
+  "filesystem-operation": "The requested Python filesystem operation is unavailable for this backend.",
+  capacity: "Python worker capacity exhausted.",
+  cleanup: "Python resource cleanup failed; retirement could not be confirmed.",
+  startup: "Python startup failed; consult the host diagnostic callback.",
+  runtime: "Python runtime failed; consult the host diagnostic callback."
+};
+var PythonFailure = class extends Error {
+  constructor(category, options) {
+    super(messages[category], options);
+    this.category = category;
+    this.name = "PythonFailure";
+  }
+  category;
+};
+function isPythonFailureCategory(value) {
+  return typeof value === "string" && Object.hasOwn(messages, value);
+}
+function reportPythonFailure(category, cause, observer) {
+  const failure = new PythonFailure(category);
+  try {
+    void Promise.resolve(observer?.({ failure, cause })).catch(() => {
+    });
+  } catch {
+  }
+  return failure;
+}
+function inspectPythonCapabilities(options = {}) {
+  const failures = /* @__PURE__ */ new Set();
+  if (typeof options.createWorker === "function" === (typeof options.createExecutor === "function") || options.createWorker !== void 0 && typeof options.createWorker !== "function" || options.createExecutor !== void 0 && typeof options.createExecutor !== "function") failures.add("executor-unavailable");
+  if (typeof options.createExecutor !== "function" && (typeof SharedArrayBuffer !== "function" || typeof Atomics !== "object" || typeof Atomics.store !== "function" || typeof Atomics.notify !== "function")) failures.add("transport-unavailable");
+  if (options.runtimeVersion !== void 0 && options.runtimeVersion !== "314.0.6") failures.add("runtime-abi");
+  for (const requirement of options.requiredFileSystem ?? []) {
+    if (!["open", "read", "write", "directory"].includes(requirement)) throw new TypeError("Unknown Python filesystem requirement");
+    const category = requirement === "open" ? "filesystem-open" : requirement === "read" ? "filesystem-read" : requirement === "write" ? "filesystem-write" : "filesystem-directory";
+    try {
+      const fs = options.fs;
+      if (requirement === "directory") {
+        failures.add(category);
+      } else if (!fs || typeof fs.open !== "function" || fs.capabilities.open === false) failures.add("filesystem-open");
+      else if (requirement === "write" && (fs.capabilities.readOnly === true || fs.capabilities.write === false)) failures.add(category);
+      else if (requirement === "read" && fs.capabilities.read === false) failures.add(category);
+    } catch {
+      failures.add(category);
+    }
+  }
+  return Object.freeze({
+    configurationValid: failures.size === 0,
+    failures: Object.freeze([...failures].map((category) => new PythonFailure(category)))
+  });
+}
+
+// packages/safe-bash/src/commands/python/execution.ts
+init_platform();
+var pythonExecution = `
+import sys, os, json, runpy, traceback, types, warnings, textwrap, io, struct, linecache
+_safe_invocation = json.loads(_safe_invocation_json)
+os.environ.clear()
+os.environ.update(_safe_invocation['env'])
+_safe_args = list(_safe_invocation['args'])
+sys.orig_argv = [_safe_invocation.get('command', 'python')] + _safe_args
+_safe_exit = 0
+
+class _SafeOptionError(ValueError):
+ pass
+
+def _safe_system_exit(_error):
+ if isinstance(_error.code, int):
+  _status = int.__index__(_error.code)
+  _long_bound = 1 << (8 * struct.calcsize('@l') - 1)
+  status = (_status & 255) if -_long_bound <= _status < _long_bound else 255
+ else:
+  status = 0 if _error.code is None else 1
+ if _error.code is not None and not isinstance(_error.code, int):
+  print(_error.code, file=sys.stderr)
+ return status
+
+def _safe_launch():
+ args = list(_safe_args)
+ unbuffered = False
+ ignore_env = bool(sys.flags.ignore_environment)
+ safe_path = bool(sys.flags.safe_path)
+ native_warning_options = list(sys.warnoptions)
+ # Pyodide adds a bootstrap cwd entry even when CPython safe-path mode is set.
+ # Each execution mode below supplies its own entry after explicit PYTHONPATH.
+ sys.path[:] = [entry for entry in sys.path if entry != '']
+ warning_options = []
+ version_count = 0
+ options_terminated = False
+ while args and args[0].startswith('-') and args[0] != '-':
+  option = args.pop(0)
+  if option == '--':
+   options_terminated = True
+   break
+  if option in ('--help', '-h', '-?'):
+   print('usage: python [-uBEPOsSIbdvqR] [-W filter] [-X option] [-c code | -m module | file | -] [args ...]')
+   print('Dedicated Pyodide interpreter; stdin is noninteractive.')
+   print('-u: unbuffered binary output; -B: disable bytecode writes; -E: ignore PYTHON* settings')
+   print('-P: omit automatic unsafe sys.path entry; -W: Python warning filter')
+   print('-O/-OO, -S/-s/-I, -b/-bb, -d/-v/-q/-R: CPython startup flags')
+   print('-X: utf8, dev, warn_default_encoding, int_max_str_digits; interactive flags are unsupported.')
+   return
+  if option == '--version':
+   version_count += 1
+   continue
+  if option.startswith('--'):
+   raise _SafeOptionError('unsupported option ' + option)
+  index = 1
+  while index < len(option):
+   flag = option[index]
+   if flag in ('h', '?'):
+    args = ['--help']
+    break
+   if flag == 'V':
+    version_count += 1
+    index += 1
+    continue
+   if flag in ('c', 'm', 'W', 'X'):
+    operand = option[index + 1:] if index + 1 < len(option) else args.pop(0) if args else None
+    if operand is None:
+     raise _SafeOptionError('argument expected for -' + flag)
+    if flag in ('W', 'X'):
+     if flag == 'W': warning_options.append(operand)
+     break
+    args = ['-' + flag, operand] + args
+    break
+   elif flag in ('O', 'S', 's', 'I', 'b', 'd', 'v', 'q', 'R'):
+    pass # Applied by CPython startup configuration before bootstrap.
+   elif flag == 'u':
+    unbuffered = True
+   elif flag == 'B':
+    sys.dont_write_bytecode = True
+   elif flag == 'E':
+    ignore_env = True
+   elif flag == 'P':
+    safe_path = True
+   else:
+    raise _SafeOptionError('unsupported option -' + flag)
+   index += 1
+  if args and args[0] in ('-c', '-m'):
+   break
+ if version_count:
+  print('Python ' + (sys.version if version_count > 1 else sys.version.split()[0]))
+  return
+ if not ignore_env:
+  unbuffered = unbuffered or bool(os.environ.get('PYTHONUNBUFFERED'))
+  sys.dont_write_bytecode = sys.dont_write_bytecode or bool(os.environ.get('PYTHONDONTWRITEBYTECODE'))
+  safe_path = safe_path or bool(os.environ.get('PYTHONSAFEPATH'))
+  path = os.environ.get('PYTHONPATH')
+  if path:
+   sys.path[0:0] = [os.path.abspath(entry) for entry in path.split(os.pathsep)]
+  if os.environ.get('PYTHONWARNINGS'):
+   warning_options[0:0] = os.environ['PYTHONWARNINGS'].split(',')
+  encoding = os.environ.get('PYTHONIOENCODING')
+  if encoding:
+   name, separator, errors = encoding.partition(':')
+   for stream in (sys.stdin, sys.stdout):
+    stream.reconfigure(encoding=name or None, errors=(errors or 'strict'))
+   sys.stderr.reconfigure(encoding=name or None, errors='backslashreplace')
+ # CPython's -b/-bb filter follows environment and command-line -W filters.
+ byte_warning = ('error' if sys.flags.bytes_warning > 1 else 'default') + '::BytesWarning'
+ native_before = [value for value in native_warning_options if not (sys.flags.bytes_warning and value == byte_warning)]
+ warning_options = native_before + warning_options + ([byte_warning] if sys.flags.bytes_warning else [])
+ warnings._processoptions(warning_options)
+ sys.warnoptions[:] = warning_options
+ if unbuffered:
+  for name in ('stdout', 'stderr'):
+   stream = getattr(sys, name)
+   stream.flush()
+   encoding, errors = stream.encoding, stream.errors
+   binary = stream.detach()
+   raw = binary.detach() if hasattr(binary, 'detach') else binary
+   replacement = io.TextIOWrapper(raw, encoding=encoding, errors=errors, write_through=True)
+   setattr(sys, name, replacement)
+   setattr(sys, '__' + name + '__', replacement)
+ main = types.ModuleType('__main__')
+ main.__dict__.update(__package__=None, __spec__=None, __loader__=__import__('importlib.machinery', fromlist=['BuiltinImporter']).BuiltinImporter, __builtins__=__builtins__)
+ sys.modules['__main__'] = main
+ if not options_terminated and args and args[0] == '-c':
+  sys.argv = ['-c'] + args[2:]
+  if not safe_path: sys.path.insert(0, '')
+  source = textwrap.dedent(args[1])
+  code = compile(source, '<string>', 'exec')
+  # CPython 3.14 retains -c source for both top-level and nested tracebacks.
+  linecache._register_code(code, source, '<string>')
+  exec(code, main.__dict__)
+ elif not options_terminated and args and args[0] == '-m':
+  sys.argv = args[1:]
+  if not safe_path: sys.path.insert(0, os.getcwd())
+  runpy._run_module_as_main(args[1], alter_argv=True)
+ elif not args or args[0] == '-':
+  sys.argv = (['-'] + args[1:]) if args else ['']
+  if not safe_path: sys.path.insert(0, '')
+  main.__file__ = '<stdin>'
+  exec(compile(sys.stdin.buffer.read(), '<stdin>', 'exec'), main.__dict__)
+ else:
+  sys.argv = args
+  # CPython makes __file__ absolute without collapsing ./ or ../ components.
+  path = args[0] if os.path.isabs(args[0]) else os.path.join(os.getcwd(), args[0])
+  importer = __import__('pkgutil').get_importer(path)
+  if importer is not None:
+   sys.path.insert(0, path)
+   runpy._run_module_as_main('__main__', alter_argv=False)
+  else:
+   if not safe_path: sys.path.insert(0, os.path.dirname(os.path.realpath(path)))
+   try:
+    with open(path, 'rb') as source:
+     code = source.read()
+   except OSError as error:
+    print("python: can't open file " + repr(path) + ': [Errno ' + str(error.errno) + '] ' + error.strerror, file=sys.stderr)
+    return 2
+   main.__file__ = path
+   main.__loader__ = __import__('importlib.machinery', fromlist=['SourceFileLoader']).SourceFileLoader('__main__', path)
+   exec(compile(code, path, 'exec'), main.__dict__)
+ return 0
+
+try:
+ _safe_exit = _safe_launch() or 0
+except SystemExit as _error:
+ _safe_exit = _safe_system_exit(_error)
+except _SafeOptionError as _error:
+ print('python: ' + str(_error), file=sys.stderr)
+ _safe_exit = 2
+except BaseException as _error:
+ # Hide bridge frames while preserving actual Python frames and chained errors.
+ _trace = _error.__traceback__
+ while _trace is not None and _trace.tb_frame.f_code.co_filename == '<exec>':
+  _trace = _trace.tb_next
+ _error.__traceback__ = _trace
+ sys.last_exc = _error
+ _safe_exit = 130 if isinstance(_error, KeyboardInterrupt) else 1
+ try:
+  sys.excepthook(type(_error), _error, _trace)
+ except SystemExit as _hook_error:
+  _safe_exit = _safe_system_exit(_hook_error)
+ except BaseException as _hook_error:
+  print('Error in sys.excepthook:', file=sys.stderr)
+  traceback.print_exception(type(_hook_error), _hook_error, _hook_error.__traceback__.tb_next)
+  print('\\nOriginal exception was:', file=sys.stderr)
+  sys.__excepthook__(type(_error), _error, _trace)
+finally:
+ for _stream in (sys.stdout, sys.stderr):
+  if _stream is not None and not getattr(_stream, 'closed', False):
+   try:
+    _stream.flush()
+   except BaseException:
+    _safe_exit = 120
+_safe_exit
+`;
+
+// packages/safe-bash/src/commands/python/runtime-scripts.ts
+init_platform();
+var pythonRuntimeRelocation = `
+import sys, zipimport, importlib.machinery
+
+def _rebase_runtime_path(value):
+ return _safe_runtime_mount + value if isinstance(value, str) and (value == '/lib' or value.startswith('/lib/')) else value
+
+def _rebase_runtime_loader(loader):
+ if isinstance(loader, zipimport.zipimporter):
+  archive = _rebase_runtime_path(loader.archive)
+  if archive != loader.archive:
+   return zipimport.zipimporter(archive + '/' + loader.prefix)
+ elif isinstance(loader, (importlib.machinery.SourceFileLoader, importlib.machinery.SourcelessFileLoader, importlib.machinery.ExtensionFileLoader)):
+  path = _rebase_runtime_path(loader.path)
+  if path != loader.path:
+   return type(loader)(loader.name, path)
+ return loader
+sys.path[:] = [_rebase_runtime_path(value) for value in sys.path]
+for _module in list(sys.modules.values()):
+ if _module is None:
+  continue
+ for _attribute in ('__file__', '__cached__'):
+  if hasattr(_module, _attribute):
+   setattr(_module, _attribute, _rebase_runtime_path(getattr(_module, _attribute)))
+ if hasattr(_module, '__path__'):
+  _module.__path__ = [_rebase_runtime_path(value) for value in _module.__path__]
+ if hasattr(_module, '__loader__'):
+  _module.__loader__ = _rebase_runtime_loader(_module.__loader__)
+ _spec = getattr(_module, '__spec__', None)
+ if _spec is not None:
+  _spec.origin = _rebase_runtime_path(_spec.origin)
+  _spec.loader = _rebase_runtime_loader(_spec.loader)
+  if _spec.submodule_search_locations is not None:
+   _spec.submodule_search_locations = [_rebase_runtime_path(value) for value in _spec.submodule_search_locations]
+sys.path_importer_cache.clear()
+`;
+var pythonImportMetadata = `
+import importlib._bootstrap_external, types, json
+_safe_import_stat_callback = _safe_import_stat
+_safe_original_import_stat = importlib._bootstrap_external._path_stat
+def _safe_import_path_stat(path):
+ if path == _safe_runtime_mount or path.startswith(_safe_runtime_mount + '/'):
+  return _safe_original_import_stat(path)
+ value = json.loads(_safe_import_stat_callback(path))
+ if 'errno' in value:
+  raise OSError(value['errno'], 'filesystem import metadata unavailable', path)
+ return types.SimpleNamespace(st_mode=value['mode'], st_size=value['size'], st_mtime=value['mtimeMs'] / 1000)
+importlib._bootstrap_external._path_stat = _safe_import_path_stat
+`;
+var pythonDirectoryEntries = `
+import os, json, errno
+_safe_directory_callback = _safe_directory_entries
+def _safe_listdir(path='.'):
+ if isinstance(path, int):
+  raise OSError(errno.ENOTSUP, 'retained directory descriptors are unsupported')
+ original = os.fspath(path) if path is not None else '.'
+ value = json.loads(_safe_directory_callback(os.fsdecode(original)))
+ if 'errno' in value:
+  raise OSError(value['errno'], 'directory enumeration failed', path)
+ return [os.fsencode(name) for name in value['entries']] if isinstance(original, bytes) else value['entries']
+os.listdir = _safe_listdir
+# The frozen importer holds the posix module separately from os.
+importlib._bootstrap_external._os.listdir = _safe_listdir
+`;
+var pythonStatProjection = `
+import os, json, errno
+_safe_stat_callback = _safe_stat_projection
+_safe_stat_type = os.stat_result
+_safe_fspath = os.fspath
+_safe_fsdecode = os.fsdecode
+
+def _safe_stat(path, *, dir_fd=None, follow_symlinks=True):
+ if dir_fd is not None:
+  raise OSError(errno.ENOTSUP, 'dir_fd metadata is unsupported')
+ if isinstance(path, int):
+  if not follow_symlinks:
+   raise ValueError('stat: cannot use fd and follow_symlinks together')
+ else:
+  path = _safe_fsdecode(_safe_fspath(path))
+ value = json.loads(_safe_stat_callback(path, follow_symlinks))
+ if 'errno' in value:
+  raise OSError(value['errno'], 'filesystem metadata unavailable', path)
+ keys = ('mode','ino','dev','nlink','uid','gid','size')
+ if any(key not in value for key in keys):
+  raise OSError(errno.EOVERFLOW, 'canonical identity or required stat metadata unavailable', path)
+ times = [value[key] / 1000 for key in ('atimeMs','mtimeMs','ctimeMs')]
+ extras = dict(zip(('st_atime','st_mtime','st_ctime'), times))
+ for name, milliseconds in zip(('atime','mtime','ctime'), (value['atimeMs'],value['mtimeMs'],value['ctimeMs'])):
+  seconds = int(milliseconds // 1000)
+  extras['st_' + name + '_ns'] = seconds * 1000000000 + round((milliseconds - seconds * 1000) * 1000000)
+ for key in ('blocks','blksize','rdev'):
+  if key in value:
+   extras['st_' + key] = value[key]
+ return _safe_stat_type(tuple(value[key] for key in keys) + tuple(int(time // 1) for time in times), extras)
+
+def _safe_lstat(path, *, dir_fd=None):
+ return _safe_stat(path, dir_fd=dir_fd, follow_symlinks=False)
+
+def _safe_fstat(fd):
+ if not isinstance(fd, int):
+  raise TypeError('file descriptor must be an integer')
+ return _safe_stat(fd)
+os.stat = _safe_stat
+os.lstat = _safe_lstat
+os.fstat = _safe_fstat
+import stat as _safe_stat_module
+class _SafeDirEntry:
+ def __init__(self, root, name):
+  self.name = name
+  self.path = os.path.join(root, name)
+  self._cache = {}
+ def __fspath__(self):
+  return self.path
+ def stat(self, *, follow_symlinks=True):
+  if follow_symlinks not in self._cache:
+   self._cache[follow_symlinks] = os.stat(self.path, follow_symlinks=follow_symlinks)
+  return self._cache[follow_symlinks]
+ def inode(self):
+  return self.stat(follow_symlinks=False).st_ino
+ def is_dir(self, *, follow_symlinks=True):
+  try:
+   return _safe_stat_module.S_ISDIR(self.stat(follow_symlinks=follow_symlinks).st_mode)
+  except FileNotFoundError:
+   return False
+ def is_file(self, *, follow_symlinks=True):
+  try:
+   return _safe_stat_module.S_ISREG(self.stat(follow_symlinks=follow_symlinks).st_mode)
+  except FileNotFoundError:
+   return False
+ def is_symlink(self):
+  try:
+   return _safe_stat_module.S_ISLNK(self.stat(follow_symlinks=False).st_mode)
+  except FileNotFoundError:
+   return False
+class _SafeScandir:
+ def __init__(self, path):
+  self._entries = iter([_SafeDirEntry(path, name) for name in os.listdir(path)])
+ def __iter__(self):
+  return self
+ def __next__(self):
+  return next(self._entries)
+ def close(self):
+  self._entries = iter(())
+ def __enter__(self):
+  return self
+ def __exit__(self, *args):
+  self.close()
+def _safe_scandir(path='.'):
+ if isinstance(path, int):
+  raise OSError(errno.ENOTSUP, 'retained directory descriptors are unsupported')
+ return _SafeScandir(os.fspath(path) if path is not None else '.')
+os.scandir = _safe_scandir
+
+`;
+var pythonTreeCleanup = `
+import shutil, os, json
+_safe_tree_callback = _safe_tree_cleanup
+_safe_original_rmtree_impl = shutil._rmtree_impl
+def _safe_rmtree_impl(path, dir_fd, onexc):
+ if dir_fd is not None:
+  return _safe_original_rmtree_impl(path, dir_fd, onexc)
+ value = json.loads(_safe_tree_callback(os.fsdecode(path)))
+ if not value['supported']:
+  return _safe_original_rmtree_impl(path, dir_fd, onexc)
+ if 'errno' in value:
+  onexc(os.rmdir, path, OSError(value['errno'], 'directory cleanup failed', path))
+shutil._rmtree_impl = _safe_rmtree_impl
+`;
+
+export {
+  PythonInvocationError,
+  parsePythonInvocation,
+  PythonFailure,
+  isPythonFailureCategory,
+  reportPythonFailure,
+  inspectPythonCapabilities,
+  pythonExecution,
+  pythonRuntimeRelocation,
+  pythonImportMetadata,
+  pythonDirectoryEntries,
+  pythonStatProjection,
+  pythonTreeCleanup
+};
+//# sourceMappingURL=chunk-4MPK7VIM.js.map

package/dist/safe-bash/chunks/chunk-4MPK7VIM.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/commands/python/invocation.ts", "../../src/commands/python/diagnostics.ts", "../../src/commands/python/execution.ts", "../../src/commands/python/runtime-scripts.ts"],
+  "sourcesContent": ["/** An explicit compatibility failure, rendered as Python usage status 2. */\nexport class PythonInvocationError extends Error {\n  constructor(message: string) { super(message); this.name = 'PythonInvocationError'; }\n}\n\n/** Extract native initialization flags without consuming script/module arguments. */\nexport function parsePythonInvocation(args: readonly string[], env: Readonly<Record<string, string>>): {\n  readonly startupArgs: string[];\n  readonly env: Record<string, string>;\n} {\n  const startupArgs: string[] = [];\n  let informational = false;\n  scan: for (let index = 0; index < args.length; index++) {\n    const option = args[index]!;\n    if (option === '--' || option === '-' || !option.startsWith('-')) break;\n    if (option === '--help') { informational = true; break; }\n    if (option === '--version') { informational = true; continue; }\n    if (option.startsWith('--')) throw new PythonInvocationError('unsupported option ' + option);\n    for (let offset = 1; offset < option.length; offset++) {\n      const flag = option[offset]!;\n      if (flag === 'h' || flag === '?') { informational = true; break scan; }\n      if (flag === 'V') { informational = true; continue; }\n      if ('cmWX'.includes(flag)) {\n        const operand = option.slice(offset + 1) || args[++index];\n        if (operand === undefined) throw new PythonInvocationError('argument expected for -' + flag);\n        if (flag === 'c' || flag === 'm') break scan;\n        if (flag === 'X') {\n          const separator = operand.indexOf('=');\n          const name = separator < 0 ? operand : operand.slice(0, separator);\n          const value = separator < 0 ? undefined : operand.slice(separator + 1);\n          let decimal = value ?? '';\n          while (decimal.length && ' \\t\\n\\r\\v\\f'.includes(decimal[0]!)) decimal = decimal.slice(1);\n          if (decimal[0] === '+' || decimal[0] === '-') decimal = decimal.slice(1);\n          const digits = decimal.length > 0 && [...decimal].every(character => character >= '0' && character <= '9');\n          const supported = (name === 'utf8' && (value === undefined || value === '0' || value === '1'))\n            || ((name === 'dev' || name === 'warn_default_encoding') && value === undefined)\n            || (name === 'int_max_str_digits' && digits && Number.isSafeInteger(Number(value)) && Number(value) <= 2147483647 && (Number(value) === 0 || Number(value) >= 640));\n          if (!supported) throw new PythonInvocationError('unsupported -X option ' + operand);\n          startupArgs.push('-X', operand);\n        }\n        // Warning-as-error can prevent Pyodide bootstrap; apply -W after bootstrap.\n        break;\n      }\n      if (!'BEPOusISbdvqR'.includes(flag)) throw new PythonInvocationError('unsupported option -' + flag);\n      startupArgs.push('-' + flag);\n    }\n  }\n  if (!informational && !startupArgs.includes('-E') && !startupArgs.includes('-I')) {\n    if (env.PYTHONINSPECT) throw new PythonInvocationError('PYTHONINSPECT requires an interactive terminal, which the shell does not expose');\n    if (env.PYTHONHOME) throw new PythonInvocationError('PYTHONHOME cannot replace the configured Pyodide runtime');\n  }\n  const runtimeEnv = { ...env };\n  // These paths belong to the canonical filesystem, mounted after bootstrap.\n  delete runtimeEnv.PYTHONPATH;\n  delete runtimeEnv.PYTHONHOME;\n  delete runtimeEnv.PYTHONWARNINGS;\n  // Pyodide otherwise supplies PYTHONINSPECT=1, including with a -c operand.\n  runtimeEnv.PYTHONINSPECT = '';\n  // Without a command Pyodide initializes CPython in inspect mode.\n  startupArgs.push('-c', '');\n  return { startupArgs, env: runtimeEnv };\n}\n", "import type { FileSystem } from '../../contracts/filesystem.js';\n\nconst messages = {\n  'executor-unavailable': 'Python executor is unavailable; configure exactly one supported executor or interpreter worker.',\n  'transport-unavailable': 'Python worker transport or shared-memory operations are unavailable.',\n  'runtime-abi': 'Python runtime version or native ABI is unsupported.',\n  'runtime-assets': 'Python runtime or package assets could not be loaded.',\n  'isolation-unavailable': 'Python host isolation or resource enforcement is unavailable.',\n  deadline: 'Python execution exceeded its host deadline.',\n  'filesystem-open': 'Python filesystem handle access is unavailable; the backend must support retained open.',\n  'filesystem-read': 'Python filesystem reads are unavailable for this backend.',\n  'filesystem-write': 'Python filesystem writes are unavailable for this backend.',\n  'filesystem-directory': 'Python retained directory operations are unavailable for this backend.',\n  'filesystem-operation': 'The requested Python filesystem operation is unavailable for this backend.',\n  capacity: 'Python worker capacity exhausted.',\n  cleanup: 'Python resource cleanup failed; retirement could not be confirmed.',\n  startup: 'Python startup failed; consult the host diagnostic callback.',\n  runtime: 'Python runtime failed; consult the host diagnostic callback.',\n} as const;\n\nexport type PythonFailureCategory = keyof typeof messages;\n\nexport class PythonFailure extends Error {\n  constructor(readonly category: PythonFailureCategory, options?: ErrorOptions) {\n    super(messages[category], options);\n    this.name = 'PythonFailure';\n  }\n}\n\nexport interface PythonDiagnostic {\n  readonly failure: PythonFailure;\n  readonly cause: unknown;\n}\n\nexport type PythonDiagnosticObserver = (diagnostic: PythonDiagnostic) => void | Promise<void>;\nexport type PythonFileSystemRequirement = 'open' | 'read' | 'write' | 'directory';\n\nexport function isPythonFailureCategory(value: unknown): value is PythonFailureCategory {\n  return typeof value === 'string' && Object.hasOwn(messages, value);\n}\n\nexport function reportPythonFailure(category: PythonFailureCategory, cause: unknown, observer?: PythonDiagnosticObserver): PythonFailure {\n  const failure = new PythonFailure(category);\n  try { void Promise.resolve(observer?.({ failure, cause })).catch(() => {}); } catch {}\n  return failure;\n}\n\nexport interface PythonCapabilityOptions {\n  readonly createWorker?: () => unknown;\n  readonly createExecutor?: () => unknown;\n  readonly fs?: FileSystem;\n  readonly requiredFileSystem?: readonly PythonFileSystemRequirement[];\n  readonly runtimeVersion?: string;\n}\n\nexport interface PythonCapabilityReport {\n  readonly configurationValid: boolean;\n  readonly failures: readonly PythonFailure[];\n}\n\nexport function inspectPythonCapabilities(options: PythonCapabilityOptions = {}): PythonCapabilityReport {\n  const failures = new Set<PythonFailureCategory>();\n  if ((typeof options.createWorker === 'function') === (typeof options.createExecutor === 'function')\n    || options.createWorker !== undefined && typeof options.createWorker !== 'function'\n    || options.createExecutor !== undefined && typeof options.createExecutor !== 'function') failures.add('executor-unavailable');\n  if (typeof options.createExecutor !== 'function' && (typeof SharedArrayBuffer !== 'function' || typeof Atomics !== 'object'\n    || typeof Atomics.store !== 'function' || typeof Atomics.notify !== 'function')) failures.add('transport-unavailable');\n  if (options.runtimeVersion !== undefined && options.runtimeVersion !== '314.0.6') failures.add('runtime-abi');\n  for (const requirement of options.requiredFileSystem ?? []) {\n    if (!['open', 'read', 'write', 'directory'].includes(requirement)) throw new TypeError('Unknown Python filesystem requirement');\n    const category: PythonFailureCategory = requirement === 'open' ? 'filesystem-open'\n      : requirement === 'read' ? 'filesystem-read' : requirement === 'write' ? 'filesystem-write' : 'filesystem-directory';\n    try {\n      const fs = options.fs;\n      if (requirement === 'directory') {\n        failures.add(category);\n      } else if (!fs || typeof fs.open !== 'function' || fs.capabilities.open === false) failures.add('filesystem-open');\n      else if (requirement === 'write' && (fs.capabilities.readOnly === true || fs.capabilities.write === false)) failures.add(category);\n      else if (requirement === 'read' && fs.capabilities.read === false) failures.add(category);\n    } catch { failures.add(category); }\n  }\n  return Object.freeze({ configurationValid: failures.size === 0,\n    failures: Object.freeze([...failures].map(category => new PythonFailure(category))) });\n}\n", "/** Executed by CPython after canonical storage and byte streams are installed. */\nexport const pythonExecution = `\nimport sys, os, json, runpy, traceback, types, warnings, textwrap, io, struct, linecache\n_safe_invocation = json.loads(_safe_invocation_json)\nos.environ.clear()\nos.environ.update(_safe_invocation['env'])\n_safe_args = list(_safe_invocation['args'])\nsys.orig_argv = [_safe_invocation.get('command', 'python')] + _safe_args\n_safe_exit = 0\n\nclass _SafeOptionError(ValueError):\n pass\n\ndef _safe_system_exit(_error):\n if isinstance(_error.code, int):\n  _status = int.__index__(_error.code)\n  _long_bound = 1 << (8 * struct.calcsize('@l') - 1)\n  status = (_status & 255) if -_long_bound <= _status < _long_bound else 255\n else:\n  status = 0 if _error.code is None else 1\n if _error.code is not None and not isinstance(_error.code, int):\n  print(_error.code, file=sys.stderr)\n return status\n\ndef _safe_launch():\n args = list(_safe_args)\n unbuffered = False\n ignore_env = bool(sys.flags.ignore_environment)\n safe_path = bool(sys.flags.safe_path)\n native_warning_options = list(sys.warnoptions)\n # Pyodide adds a bootstrap cwd entry even when CPython safe-path mode is set.\n # Each execution mode below supplies its own entry after explicit PYTHONPATH.\n sys.path[:] = [entry for entry in sys.path if entry != '']\n warning_options = []\n version_count = 0\n options_terminated = False\n while args and args[0].startswith('-') and args[0] != '-':\n  option = args.pop(0)\n  if option == '--':\n   options_terminated = True\n   break\n  if option in ('--help', '-h', '-?'):\n   print('usage: python [-uBEPOsSIbdvqR] [-W filter] [-X option] [-c code | -m module | file | -] [args ...]')\n   print('Dedicated Pyodide interpreter; stdin is noninteractive.')\n   print('-u: unbuffered binary output; -B: disable bytecode writes; -E: ignore PYTHON* settings')\n   print('-P: omit automatic unsafe sys.path entry; -W: Python warning filter')\n   print('-O/-OO, -S/-s/-I, -b/-bb, -d/-v/-q/-R: CPython startup flags')\n   print('-X: utf8, dev, warn_default_encoding, int_max_str_digits; interactive flags are unsupported.')\n   return\n  if option == '--version':\n   version_count += 1\n   continue\n  if option.startswith('--'):\n   raise _SafeOptionError('unsupported option ' + option)\n  index = 1\n  while index < len(option):\n   flag = option[index]\n   if flag in ('h', '?'):\n    args = ['--help']\n    break\n   if flag == 'V':\n    version_count += 1\n    index += 1\n    continue\n   if flag in ('c', 'm', 'W', 'X'):\n    operand = option[index + 1:] if index + 1 < len(option) else args.pop(0) if args else None\n    if operand is None:\n     raise _SafeOptionError('argument expected for -' + flag)\n    if flag in ('W', 'X'):\n     if flag == 'W': warning_options.append(operand)\n     break\n    args = ['-' + flag, operand] + args\n    break\n   elif flag in ('O', 'S', 's', 'I', 'b', 'd', 'v', 'q', 'R'):\n    pass # Applied by CPython startup configuration before bootstrap.\n   elif flag == 'u':\n    unbuffered = True\n   elif flag == 'B':\n    sys.dont_write_bytecode = True\n   elif flag == 'E':\n    ignore_env = True\n   elif flag == 'P':\n    safe_path = True\n   else:\n    raise _SafeOptionError('unsupported option -' + flag)\n   index += 1\n  if args and args[0] in ('-c', '-m'):\n   break\n if version_count:\n  print('Python ' + (sys.version if version_count > 1 else sys.version.split()[0]))\n  return\n if not ignore_env:\n  unbuffered = unbuffered or bool(os.environ.get('PYTHONUNBUFFERED'))\n  sys.dont_write_bytecode = sys.dont_write_bytecode or bool(os.environ.get('PYTHONDONTWRITEBYTECODE'))\n  safe_path = safe_path or bool(os.environ.get('PYTHONSAFEPATH'))\n  path = os.environ.get('PYTHONPATH')\n  if path:\n   sys.path[0:0] = [os.path.abspath(entry) for entry in path.split(os.pathsep)]\n  if os.environ.get('PYTHONWARNINGS'):\n   warning_options[0:0] = os.environ['PYTHONWARNINGS'].split(',')\n  encoding = os.environ.get('PYTHONIOENCODING')\n  if encoding:\n   name, separator, errors = encoding.partition(':')\n   for stream in (sys.stdin, sys.stdout):\n    stream.reconfigure(encoding=name or None, errors=(errors or 'strict'))\n   sys.stderr.reconfigure(encoding=name or None, errors='backslashreplace')\n # CPython's -b/-bb filter follows environment and command-line -W filters.\n byte_warning = ('error' if sys.flags.bytes_warning > 1 else 'default') + '::BytesWarning'\n native_before = [value for value in native_warning_options if not (sys.flags.bytes_warning and value == byte_warning)]\n warning_options = native_before + warning_options + ([byte_warning] if sys.flags.bytes_warning else [])\n warnings._processoptions(warning_options)\n sys.warnoptions[:] = warning_options\n if unbuffered:\n  for name in ('stdout', 'stderr'):\n   stream = getattr(sys, name)\n   stream.flush()\n   encoding, errors = stream.encoding, stream.errors\n   binary = stream.detach()\n   raw = binary.detach() if hasattr(binary, 'detach') else binary\n   replacement = io.TextIOWrapper(raw, encoding=encoding, errors=errors, write_through=True)\n   setattr(sys, name, replacement)\n   setattr(sys, '__' + name + '__', replacement)\n main = types.ModuleType('__main__')\n main.__dict__.update(__package__=None, __spec__=None, __loader__=__import__('importlib.machinery', fromlist=['BuiltinImporter']).BuiltinImporter, __builtins__=__builtins__)\n sys.modules['__main__'] = main\n if not options_terminated and args and args[0] == '-c':\n  sys.argv = ['-c'] + args[2:]\n  if not safe_path: sys.path.insert(0, '')\n  source = textwrap.dedent(args[1])\n  code = compile(source, '<string>', 'exec')\n  # CPython 3.14 retains -c source for both top-level and nested tracebacks.\n  linecache._register_code(code, source, '<string>')\n  exec(code, main.__dict__)\n elif not options_terminated and args and args[0] == '-m':\n  sys.argv = args[1:]\n  if not safe_path: sys.path.insert(0, os.getcwd())\n  runpy._run_module_as_main(args[1], alter_argv=True)\n elif not args or args[0] == '-':\n  sys.argv = (['-'] + args[1:]) if args else ['']\n  if not safe_path: sys.path.insert(0, '')\n  main.__file__ = '<stdin>'\n  exec(compile(sys.stdin.buffer.read(), '<stdin>', 'exec'), main.__dict__)\n else:\n  sys.argv = args\n  # CPython makes __file__ absolute without collapsing ./ or ../ components.\n  path = args[0] if os.path.isabs(args[0]) else os.path.join(os.getcwd(), args[0])\n  importer = __import__('pkgutil').get_importer(path)\n  if importer is not None:\n   sys.path.insert(0, path)\n   runpy._run_module_as_main('__main__', alter_argv=False)\n  else:\n   if not safe_path: sys.path.insert(0, os.path.dirname(os.path.realpath(path)))\n   try:\n    with open(path, 'rb') as source:\n     code = source.read()\n   except OSError as error:\n    print(\"python: can't open file \" + repr(path) + ': [Errno ' + str(error.errno) + '] ' + error.strerror, file=sys.stderr)\n    return 2\n   main.__file__ = path\n   main.__loader__ = __import__('importlib.machinery', fromlist=['SourceFileLoader']).SourceFileLoader('__main__', path)\n   exec(compile(code, path, 'exec'), main.__dict__)\n return 0\n\ntry:\n _safe_exit = _safe_launch() or 0\nexcept SystemExit as _error:\n _safe_exit = _safe_system_exit(_error)\nexcept _SafeOptionError as _error:\n print('python: ' + str(_error), file=sys.stderr)\n _safe_exit = 2\nexcept BaseException as _error:\n # Hide bridge frames while preserving actual Python frames and chained errors.\n _trace = _error.__traceback__\n while _trace is not None and _trace.tb_frame.f_code.co_filename == '<exec>':\n  _trace = _trace.tb_next\n _error.__traceback__ = _trace\n sys.last_exc = _error\n _safe_exit = 130 if isinstance(_error, KeyboardInterrupt) else 1\n try:\n  sys.excepthook(type(_error), _error, _trace)\n except SystemExit as _hook_error:\n  _safe_exit = _safe_system_exit(_hook_error)\n except BaseException as _hook_error:\n  print('Error in sys.excepthook:', file=sys.stderr)\n  traceback.print_exception(type(_hook_error), _hook_error, _hook_error.__traceback__.tb_next)\n  print('\\\\nOriginal exception was:', file=sys.stderr)\n  sys.__excepthook__(type(_error), _error, _trace)\nfinally:\n for _stream in (sys.stdout, sys.stderr):\n  if _stream is not None and not getattr(_stream, 'closed', False):\n   try:\n    _stream.flush()\n   except BaseException:\n    _safe_exit = 120\n_safe_exit\n`;\n", "export const pythonRuntimeRelocation = `\nimport sys, zipimport, importlib.machinery\n\ndef _rebase_runtime_path(value):\n return _safe_runtime_mount + value if isinstance(value, str) and (value == '/lib' or value.startswith('/lib/')) else value\n\ndef _rebase_runtime_loader(loader):\n if isinstance(loader, zipimport.zipimporter):\n  archive = _rebase_runtime_path(loader.archive)\n  if archive != loader.archive:\n   return zipimport.zipimporter(archive + '/' + loader.prefix)\n elif isinstance(loader, (importlib.machinery.SourceFileLoader, importlib.machinery.SourcelessFileLoader, importlib.machinery.ExtensionFileLoader)):\n  path = _rebase_runtime_path(loader.path)\n  if path != loader.path:\n   return type(loader)(loader.name, path)\n return loader\nsys.path[:] = [_rebase_runtime_path(value) for value in sys.path]\nfor _module in list(sys.modules.values()):\n if _module is None:\n  continue\n for _attribute in ('__file__', '__cached__'):\n  if hasattr(_module, _attribute):\n   setattr(_module, _attribute, _rebase_runtime_path(getattr(_module, _attribute)))\n if hasattr(_module, '__path__'):\n  _module.__path__ = [_rebase_runtime_path(value) for value in _module.__path__]\n if hasattr(_module, '__loader__'):\n  _module.__loader__ = _rebase_runtime_loader(_module.__loader__)\n _spec = getattr(_module, '__spec__', None)\n if _spec is not None:\n  _spec.origin = _rebase_runtime_path(_spec.origin)\n  _spec.loader = _rebase_runtime_loader(_spec.loader)\n  if _spec.submodule_search_locations is not None:\n   _spec.submodule_search_locations = [_rebase_runtime_path(value) for value in _spec.submodule_search_locations]\nsys.path_importer_cache.clear()\n`;\n\nexport const pythonImportMetadata = `\nimport importlib._bootstrap_external, types, json\n_safe_import_stat_callback = _safe_import_stat\n_safe_original_import_stat = importlib._bootstrap_external._path_stat\ndef _safe_import_path_stat(path):\n if path == _safe_runtime_mount or path.startswith(_safe_runtime_mount + '/'):\n  return _safe_original_import_stat(path)\n value = json.loads(_safe_import_stat_callback(path))\n if 'errno' in value:\n  raise OSError(value['errno'], 'filesystem import metadata unavailable', path)\n return types.SimpleNamespace(st_mode=value['mode'], st_size=value['size'], st_mtime=value['mtimeMs'] / 1000)\nimportlib._bootstrap_external._path_stat = _safe_import_path_stat\n`;\n\nexport const pythonDirectoryEntries = `\nimport os, json, errno\n_safe_directory_callback = _safe_directory_entries\ndef _safe_listdir(path='.'):\n if isinstance(path, int):\n  raise OSError(errno.ENOTSUP, 'retained directory descriptors are unsupported')\n original = os.fspath(path) if path is not None else '.'\n value = json.loads(_safe_directory_callback(os.fsdecode(original)))\n if 'errno' in value:\n  raise OSError(value['errno'], 'directory enumeration failed', path)\n return [os.fsencode(name) for name in value['entries']] if isinstance(original, bytes) else value['entries']\nos.listdir = _safe_listdir\n# The frozen importer holds the posix module separately from os.\nimportlib._bootstrap_external._os.listdir = _safe_listdir\n`;\n\nexport const pythonStatProjection = `\nimport os, json, errno\n_safe_stat_callback = _safe_stat_projection\n_safe_stat_type = os.stat_result\n_safe_fspath = os.fspath\n_safe_fsdecode = os.fsdecode\n\ndef _safe_stat(path, *, dir_fd=None, follow_symlinks=True):\n if dir_fd is not None:\n  raise OSError(errno.ENOTSUP, 'dir_fd metadata is unsupported')\n if isinstance(path, int):\n  if not follow_symlinks:\n   raise ValueError('stat: cannot use fd and follow_symlinks together')\n else:\n  path = _safe_fsdecode(_safe_fspath(path))\n value = json.loads(_safe_stat_callback(path, follow_symlinks))\n if 'errno' in value:\n  raise OSError(value['errno'], 'filesystem metadata unavailable', path)\n keys = ('mode','ino','dev','nlink','uid','gid','size')\n if any(key not in value for key in keys):\n  raise OSError(errno.EOVERFLOW, 'canonical identity or required stat metadata unavailable', path)\n times = [value[key] / 1000 for key in ('atimeMs','mtimeMs','ctimeMs')]\n extras = dict(zip(('st_atime','st_mtime','st_ctime'), times))\n for name, milliseconds in zip(('atime','mtime','ctime'), (value['atimeMs'],value['mtimeMs'],value['ctimeMs'])):\n  seconds = int(milliseconds // 1000)\n  extras['st_' + name + '_ns'] = seconds * 1000000000 + round((milliseconds - seconds * 1000) * 1000000)\n for key in ('blocks','blksize','rdev'):\n  if key in value:\n   extras['st_' + key] = value[key]\n return _safe_stat_type(tuple(value[key] for key in keys) + tuple(int(time // 1) for time in times), extras)\n\ndef _safe_lstat(path, *, dir_fd=None):\n return _safe_stat(path, dir_fd=dir_fd, follow_symlinks=False)\n\ndef _safe_fstat(fd):\n if not isinstance(fd, int):\n  raise TypeError('file descriptor must be an integer')\n return _safe_stat(fd)\nos.stat = _safe_stat\nos.lstat = _safe_lstat\nos.fstat = _safe_fstat\nimport stat as _safe_stat_module\nclass _SafeDirEntry:\n def __init__(self, root, name):\n  self.name = name\n  self.path = os.path.join(root, name)\n  self._cache = {}\n def __fspath__(self):\n  return self.path\n def stat(self, *, follow_symlinks=True):\n  if follow_symlinks not in self._cache:\n   self._cache[follow_symlinks] = os.stat(self.path, follow_symlinks=follow_symlinks)\n  return self._cache[follow_symlinks]\n def inode(self):\n  return self.stat(follow_symlinks=False).st_ino\n def is_dir(self, *, follow_symlinks=True):\n  try:\n   return _safe_stat_module.S_ISDIR(self.stat(follow_symlinks=follow_symlinks).st_mode)\n  except FileNotFoundError:\n   return False\n def is_file(self, *, follow_symlinks=True):\n  try:\n   return _safe_stat_module.S_ISREG(self.stat(follow_symlinks=follow_symlinks).st_mode)\n  except FileNotFoundError:\n   return False\n def is_symlink(self):\n  try:\n   return _safe_stat_module.S_ISLNK(self.stat(follow_symlinks=False).st_mode)\n  except FileNotFoundError:\n   return False\nclass _SafeScandir:\n def __init__(self, path):\n  self._entries = iter([_SafeDirEntry(path, name) for name in os.listdir(path)])\n def __iter__(self):\n  return self\n def __next__(self):\n  return next(self._entries)\n def close(self):\n  self._entries = iter(())\n def __enter__(self):\n  return self\n def __exit__(self, *args):\n  self.close()\ndef _safe_scandir(path='.'):\n if isinstance(path, int):\n  raise OSError(errno.ENOTSUP, 'retained directory descriptors are unsupported')\n return _SafeScandir(os.fspath(path) if path is not None else '.')\nos.scandir = _safe_scandir\n\n`;\n\nexport const pythonTreeCleanup = `\nimport shutil, os, json\n_safe_tree_callback = _safe_tree_cleanup\n_safe_original_rmtree_impl = shutil._rmtree_impl\ndef _safe_rmtree_impl(path, dir_fd, onexc):\n if dir_fd is not None:\n  return _safe_original_rmtree_impl(path, dir_fd, onexc)\n value = json.loads(_safe_tree_callback(os.fsdecode(path)))\n if not value['supported']:\n  return _safe_original_rmtree_impl(path, dir_fd, onexc)\n if 'errno' in value:\n  onexc(os.rmdir, path, OSError(value['errno'], 'directory cleanup failed', path))\nshutil._rmtree_impl = _safe_rmtree_impl\n`;\n"],
+  "mappings": ";;;;;AAAA;AACO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC/C,YAAY,SAAiB;AAAE,UAAM,OAAO;AAAG,SAAK,OAAO;AAAA,EAAyB;AACtF;AAGO,SAAS,sBAAsB,MAAyB,KAG7D;AACA,QAAM,cAAwB,CAAC;AAC/B,MAAI,gBAAgB;AACpB,OAAM,UAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;AACtD,UAAM,SAAS,KAAK,KAAK;AACzB,QAAI,WAAW,QAAQ,WAAW,OAAO,CAAC,OAAO,WAAW,GAAG,EAAG;AAClE,QAAI,WAAW,UAAU;AAAE,sBAAgB;AAAM;AAAA,IAAO;AACxD,QAAI,WAAW,aAAa;AAAE,sBAAgB;AAAM;AAAA,IAAU;AAC9D,QAAI,OAAO,WAAW,IAAI,EAAG,OAAM,IAAI,sBAAsB,wBAAwB,MAAM;AAC3F,aAAS,SAAS,GAAG,SAAS,OAAO,QAAQ,UAAU;AACrD,YAAM,OAAO,OAAO,MAAM;AAC1B,UAAI,SAAS,OAAO,SAAS,KAAK;AAAE,wBAAgB;AAAM,cAAM;AAAA,MAAM;AACtE,UAAI,SAAS,KAAK;AAAE,wBAAgB;AAAM;AAAA,MAAU;AACpD,UAAI,OAAO,SAAS,IAAI,GAAG;AACzB,cAAM,UAAU,OAAO,MAAM,SAAS,CAAC,KAAK,KAAK,EAAE,KAAK;AACxD,YAAI,YAAY,OAAW,OAAM,IAAI,sBAAsB,4BAA4B,IAAI;AAC3F,YAAI,SAAS,OAAO,SAAS,IAAK,OAAM;AACxC,YAAI,SAAS,KAAK;AAChB,gBAAM,YAAY,QAAQ,QAAQ,GAAG;AACrC,gBAAM,OAAO,YAAY,IAAI,UAAU,QAAQ,MAAM,GAAG,SAAS;AACjE,gBAAM,QAAQ,YAAY,IAAI,SAAY,QAAQ,MAAM,YAAY,CAAC;AACrE,cAAI,UAAU,SAAS;AACvB,iBAAO,QAAQ,UAAU,aAAc,SAAS,QAAQ,CAAC,CAAE,EAAG,WAAU,QAAQ,MAAM,CAAC;AACvF,cAAI,QAAQ,CAAC,MAAM,OAAO,QAAQ,CAAC,MAAM,IAAK,WAAU,QAAQ,MAAM,CAAC;AACvE,gBAAM,SAAS,QAAQ,SAAS,KAAK,CAAC,GAAG,OAAO,EAAE,MAAM,eAAa,aAAa,OAAO,aAAa,GAAG;AACzG,gBAAM,YAAa,SAAS,WAAW,UAAU,UAAa,UAAU,OAAO,UAAU,SAClF,SAAS,SAAS,SAAS,4BAA4B,UAAU,UAClE,SAAS,wBAAwB,UAAU,OAAO,cAAc,OAAO,KAAK,CAAC,KAAK,OAAO,KAAK,KAAK,eAAe,OAAO,KAAK,MAAM,KAAK,OAAO,KAAK,KAAK;AAChK,cAAI,CAAC,UAAW,OAAM,IAAI,sBAAsB,2BAA2B,OAAO;AAClF,sBAAY,KAAK,MAAM,OAAO;AAAA,QAChC;AAEA;AAAA,MACF;AACA,UAAI,CAAC,gBAAgB,SAAS,IAAI,EAAG,OAAM,IAAI,sBAAsB,yBAAyB,IAAI;AAClG,kBAAY,KAAK,MAAM,IAAI;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,CAAC,iBAAiB,CAAC,YAAY,SAAS,IAAI,KAAK,CAAC,YAAY,SAAS,IAAI,GAAG;AAChF,QAAI,IAAI,cAAe,OAAM,IAAI,sBAAsB,iFAAiF;AACxI,QAAI,IAAI,WAAY,OAAM,IAAI,sBAAsB,0DAA0D;AAAA,EAChH;AACA,QAAM,aAAa,EAAE,GAAG,IAAI;AAE5B,SAAO,WAAW;AAClB,SAAO,WAAW;AAClB,SAAO,WAAW;AAElB,aAAW,gBAAgB;AAE3B,cAAY,KAAK,MAAM,EAAE;AACzB,SAAO,EAAE,aAAa,KAAK,WAAW;AACxC;;;AC7DA;AAEA,IAAM,WAAW;AAAA,EACf,wBAAwB;AAAA,EACxB,yBAAyB;AAAA,EACzB,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,yBAAyB;AAAA,EACzB,UAAU;AAAA,EACV,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,oBAAoB;AAAA,EACpB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,UAAU;AAAA,EACV,SAAS;AAAA,EACT,SAAS;AAAA,EACT,SAAS;AACX;AAIO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YAAqB,UAAiC,SAAwB;AAC5E,UAAM,SAAS,QAAQ,GAAG,OAAO;AADd;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;AAUO,SAAS,wBAAwB,OAAgD;AACtF,SAAO,OAAO,UAAU,YAAY,OAAO,OAAO,UAAU,KAAK;AACnE;AAEO,SAAS,oBAAoB,UAAiC,OAAgB,UAAoD;AACvI,QAAM,UAAU,IAAI,cAAc,QAAQ;AAC1C,MAAI;AAAE,SAAK,QAAQ,QAAQ,WAAW,EAAE,SAAS,MAAM,CAAC,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAAG,QAAQ;AAAA,EAAC;AACrF,SAAO;AACT;AAeO,SAAS,0BAA0B,UAAmC,CAAC,GAA2B;AACvG,QAAM,WAAW,oBAAI,IAA2B;AAChD,MAAK,OAAO,QAAQ,iBAAiB,gBAAiB,OAAO,QAAQ,mBAAmB,eACnF,QAAQ,iBAAiB,UAAa,OAAO,QAAQ,iBAAiB,cACtE,QAAQ,mBAAmB,UAAa,OAAO,QAAQ,mBAAmB,WAAY,UAAS,IAAI,sBAAsB;AAC9H,MAAI,OAAO,QAAQ,mBAAmB,eAAe,OAAO,sBAAsB,cAAc,OAAO,YAAY,YAC9G,OAAO,QAAQ,UAAU,cAAc,OAAO,QAAQ,WAAW,YAAa,UAAS,IAAI,uBAAuB;AACvH,MAAI,QAAQ,mBAAmB,UAAa,QAAQ,mBAAmB,UAAW,UAAS,IAAI,aAAa;AAC5G,aAAW,eAAe,QAAQ,sBAAsB,CAAC,GAAG;AAC1D,QAAI,CAAC,CAAC,QAAQ,QAAQ,SAAS,WAAW,EAAE,SAAS,WAAW,EAAG,OAAM,IAAI,UAAU,uCAAuC;AAC9H,UAAM,WAAkC,gBAAgB,SAAS,oBAC7D,gBAAgB,SAAS,oBAAoB,gBAAgB,UAAU,qBAAqB;AAChG,QAAI;AACF,YAAM,KAAK,QAAQ;AACnB,UAAI,gBAAgB,aAAa;AAC/B,iBAAS,IAAI,QAAQ;AAAA,MACvB,WAAW,CAAC,MAAM,OAAO,GAAG,SAAS,cAAc,GAAG,aAAa,SAAS,MAAO,UAAS,IAAI,iBAAiB;AAAA,eACxG,gBAAgB,YAAY,GAAG,aAAa,aAAa,QAAQ,GAAG,aAAa,UAAU,OAAQ,UAAS,IAAI,QAAQ;AAAA,eACxH,gBAAgB,UAAU,GAAG,aAAa,SAAS,MAAO,UAAS,IAAI,QAAQ;AAAA,IAC1F,QAAQ;AAAE,eAAS,IAAI,QAAQ;AAAA,IAAG;AAAA,EACpC;AACA,SAAO,OAAO,OAAO;AAAA,IAAE,oBAAoB,SAAS,SAAS;AAAA,IAC3D,UAAU,OAAO,OAAO,CAAC,GAAG,QAAQ,EAAE,IAAI,cAAY,IAAI,cAAc,QAAQ,CAAC,CAAC;AAAA,EAAE,CAAC;AACzF;;;ACnFA;AACO,IAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACD/B;AAAO,IAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoChC,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAc7B,IAAM,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgB/B,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA2F7B,IAAM,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;",
+  "names": []
+}