@poe-platform/safe-bash 0.1.763 → 0.1.765

package/dist/safe-bash/core.browser.js

@@ -158,7 +158,7 @@ import {
   sha256,
   sha384,
   sha512
-} from "./chunks/chunk-CRQDMBQA.js";
+} from "./chunks/chunk-FSH7QRIC.js";
 import {
   PythonFailure,
   inspectPythonCapabilities
@@ -85450,6 +85450,7 @@ ${prefix2} line ${offset + line}: \`${source.split("\n")[line - 1] ?? ""}'
     let inc = 1;
     let noRenumber = false;
     let joinBlanks = 1;
+    let hasFileOperand = false;
     const parseSecSpec = (v) => {
       if (v === "a" || v === "t" || v === "n") return { style: v };
       if (v.startsWith("p") && v.length > 1) {
@@ -85542,9 +85543,11 @@ ${prefix2} line ${offset + line}: \`${source.split("\n")[line - 1] ?? ""}'
       } else if (/^-i-?[0-9]{1,9}$/.test(a)) {
         inc = Number(a.slice(2));
       } else if (!a.startsWith("-")) {
-        if (cwd === void 0) return [];
+        if (cwd === void 0) return void 0;
         const fl = this.readSyncMemoryLines(resolvePath(cwd, a));
         if (!fl) return void 0;
+        if (!hasFileOperand) rawLines = [];
+        hasFileOperand = true;
         rawLines = [...rawLines, ...fl];
       } else {
         return void 0;
@@ -87258,11 +87261,11 @@ unsigned int ${ident}_len = ${view.byteLength};
     if (cmdName === "whoami") {
       if (opArgs.length !== 0 || this.tryReadMemoryFileViewSync("/etc/passwd", false) !== void 0) return void 0;
       if (getEnv("ID_EUID") !== void 0 || getEnv("EUID") !== void 0 || getEnv("ID_UID") !== void 0 || getEnv("UID") !== void 0) return void 0;
-      return getEnv("WHOAMI_USER") ?? getEnv("USER") ?? getEnv("LOGNAME") ?? "sandbox";
+      return getEnv("WHOAMI") ?? getEnv("USER") ?? getEnv("LOGNAME") ?? "sandbox";
     }
     if (cmdName === "id") {
       if (this.tryReadMemoryFileViewSync("/etc/passwd", false) !== void 0 || this.tryReadMemoryFileViewSync("/etc/group", false) !== void 0) return void 0;
-      for (const k of ["ID_UID", "UID", "ID_EUID", "EUID", "ID_GID", "GID", "ID_EGID", "EGID", "ID_USER", "USER", "LOGNAME", "ID_GROUP", "ID_GROUPS", "ID_CONTEXT"]) {
+      for (const k of ["ID_UID", "UID", "ID_EUID", "EUID", "ID_GID", "GID", "ID_EGID", "EGID", "ID_USER", "USER", "LOGNAME", "GROUP", "ID_GROUPS", "SELINUX_CONTEXT"]) {
         if (getEnv(k) !== void 0) return void 0;
       }
       if (opArgs.length === 0) return "uid=1000(sandbox) gid=1000(sandbox) groups=1000(sandbox)";
@@ -87275,10 +87278,12 @@ unsigned int ${ident}_len = ${view.byteLength};
     }
     if (cmdName === "hostname") {
       if (this.tryReadMemoryFileViewSync("/etc/hostname", false) !== void 0 || getEnv("HOSTNAME_DOMAIN") !== void 0 || getEnv("HOSTNAME_IP") !== void 0) return void 0;
-      const host2 = getEnv("HOSTNAME") ?? "sandbox";
-      if (opArgs.length === 0 || opArgs.length === 1 && (opArgs[0] === "-f" || opArgs[0] === "--fqdn" || opArgs[0] === "--long")) return host2;
+      const host2 = getEnv("HOSTNAME") || "sandbox";
+      if (opArgs.length === 0) return host2;
+      if (opArgs.length === 1 && (opArgs[0] === "-f" || opArgs[0] === "--fqdn" || opArgs[0] === "--long")) return host2.includes(".") ? host2 : `${host2}.vfs.local`;
       if (opArgs.length === 1 && (opArgs[0] === "-s" || opArgs[0] === "--short")) return host2.split(".")[0];
-      if (opArgs.length === 1 && (opArgs[0] === "-i" || opArgs[0] === "--ip-address" || opArgs[0] === "-I" || opArgs[0] === "--all-ip-addresses")) return "127.0.0.1";
+      if (opArgs.length === 1 && (opArgs[0] === "-i" || opArgs[0] === "--ip-address")) return "127.0.0.1";
+      if (opArgs.length === 1 && (opArgs[0] === "-I" || opArgs[0] === "--all-ip-addresses")) return "127.0.0.1 ";
       return void 0;
     }
     if (cmdName === "nproc") {
@@ -87460,6 +87465,7 @@ unsigned int ${ident}_len = ${view.byteLength};
     if (operands.length > 0) {
       for (const op of operands) tokens.push(op);
     } else {
+      if (rawLines === void 0) return void 0;
       for (const line of rawLines) {
         for (const t of line.split(/[ \t\r\n\f\v]+/)) {
           if (t.length > 0) tokens.push(t);
@@ -87524,6 +87530,7 @@ unsigned int ${ident}_len = ${view.byteLength};
       if (memLines === void 0) return void 0;
       linesToRead = memLines;
     }
+    if (linesToRead === void 0) return void 0;
     const tokens = [];
     for (const line of linesToRead) {
       for (const t of line.split(/[ \t\r\n\f\v]+/)) {
@@ -87604,6 +87611,7 @@ unsigned int ${ident}_len = ${view.byteLength};
       const vars = extractVars(operands[0]);
       return vars.length > 0 ? vars.join("\n") + "\n" : "";
     }
+    if (inStr === void 0) return void 0;
     const allowedVars = operands.length === 1 ? new Set(extractVars(operands[0])) : void 0;
     const raw = stateMonitor(rawState)?.raw ?? rawState;
     const isRestrictedEnv = raw._exported === void 0 && "_exported" in raw;
@@ -88805,7 +88813,18 @@ unsigned int ${ident}_len = ${view.byteLength};
     const list = part.script.lists[0];
     if (list.terminator || list.pipelines.length !== 1) return void 0;
     const pipeline = list.pipelines[0];
-    if (pipeline.negate) return void 0;
+    if (pipeline.negate || customRegisteredRegistries.has(this.commands)) return void 0;
+    for (const command4 of pipeline.commands) {
+      if (command4.kind !== "simple") continue;
+      const name2 = command4.words[0]?.plain;
+      if (!name2) continue;
+      if (name2 === "fmt" && command4 === pipeline.commands[0] && command4.redirects.length === 0 && !io.stdinIsDefault) return void 0;
+      const definition2 = this.getExternalCommand(name2);
+      if (definition2 && customRegisteredCommands.has(definition2.execute)) return void 0;
+      if (name2 === "uname" || name2 === "nproc" || name2 === "hostname" || name2 === "id" || name2 === "whoami") {
+        if (!definition2 || !internal_exports.builtInDirectContextExecutors.has(definition2.execute)) return void 0;
+      }
+    }
     if (pipeline.commands.length >= 2 && pipeline.commands.length <= 5) {
       if (syncPurePipelineSlotInUse || !this.budget.canSyncPurePipe || (0, yield_exports.hasYieldCheckpoint)(this.signal) || rawState.errexit || rawState.nounset || this.budget.commands + pipeline.commands.length > this.budget.limits.maxCommands) {
         return void 0;
@@ -89790,7 +89809,8 @@ unsigned int ${ident}_len = ${view.byteLength};
     if (cmd.kind !== "simple" || cmd.redirects.length > 0 && !hasSingleStdinRedir && !hasSingleHereStringRedir || cmd.words.length === 0) return void 0;
     let w0Plain = cmd.words[0].plain;
     if (!w0Plain || rawState.extensions?.builtins.has(w0Plain)) return void 0;
-    if (w0Plain === "xxd" || w0Plain === "od" || w0Plain === "mktemp" || w0Plain === "chmod") {
+    if (w0Plain === "fmt" && !hasSingleStdinRedir && !hasSingleHereStringRedir && !io.stdinIsDefault) return void 0;
+    if (w0Plain === "xxd" || w0Plain === "od" || w0Plain === "mktemp" || w0Plain === "chmod" || w0Plain === "uname" || w0Plain === "nproc" || w0Plain === "hostname" || w0Plain === "id" || w0Plain === "whoami") {
       const definition2 = this.getExternalCommand(w0Plain);
       if (!definition2 || !internal_exports.builtInDirectContextExecutors.has(definition2.execute)) return void 0;
     }
@@ -90432,11 +90452,11 @@ unsigned int ${ident}_len = ${view.byteLength};
         if (w0Plain === "comm") cjLines = this.evalSyncComm(stdinLines, allArgs, rawState.cwd);
         else if (w0Plain === "join") cjLines = this.evalSyncJoin(stdinLines, allArgs, rawState.cwd);
         else if (w0Plain === "paste") cjLines = this.evalSyncPaste(stdinLines ?? [], allArgs, rawState.cwd);
-        else if (w0Plain === "factor") cjLines = this.evalSyncFactor(stdinLines ?? [], allArgs);
-        else if (w0Plain === "tsort") cjLines = this.evalSyncTsort(stdinLines ?? [], allArgs, rawState.cwd);
+        else if (w0Plain === "factor") cjLines = this.evalSyncFactor(stdinLines, allArgs);
+        else if (w0Plain === "tsort") cjLines = this.evalSyncTsort(stdinLines, allArgs, rawState.cwd);
         else if (w0Plain === "jq") cjLines = this.evalSyncJq(void 0, allArgs, rawState.cwd);
         else if (w0Plain === "envsubst") {
-          const esOut = this.evalSyncEnvsubst("", allArgs, rawState);
+          const esOut = this.evalSyncEnvsubst(void 0, allArgs, rawState);
           if (esOut !== void 0) cjLines = esOut.endsWith("\n") ? esOut.slice(0, -1).split("\n") : esOut ? [esOut] : [];
         } else if (w0Plain === "numfmt") {
           const optArgs = [];

package/dist/safe-bash/shell/runtime.js

@@ -31701,6 +31701,7 @@ export class Runtime {
         let inc = 1;
         let noRenumber = false;
         let joinBlanks = 1;
+        let hasFileOperand = false;
         const parseSecSpec = (v) => {
             if (v === "a" || v === "t" || v === "n")
                 return { style: v };
@@ -31835,10 +31836,13 @@ export class Runtime {
             }
             else if (!a.startsWith("-")) {
                 if (cwd === undefined)
-                    return [];
+                    return undefined;
                 const fl = this.readSyncMemoryLines(resolvePath(cwd, a));
                 if (!fl)
                     return undefined;
+                if (!hasFileOperand)
+                    rawLines = [];
+                hasFileOperand = true;
                 rawLines = [...rawLines, ...fl];
             }
             else {
@@ -33937,12 +33941,12 @@ export class Runtime {
                 return undefined;
             if (getEnv("ID_EUID") !== undefined || getEnv("EUID") !== undefined || getEnv("ID_UID") !== undefined || getEnv("UID") !== undefined)
                 return undefined;
-            return getEnv("WHOAMI_USER") ?? getEnv("USER") ?? getEnv("LOGNAME") ?? "sandbox";
+            return getEnv("WHOAMI") ?? getEnv("USER") ?? getEnv("LOGNAME") ?? "sandbox";
         }
         if (cmdName === "id") {
             if (this.tryReadMemoryFileViewSync("/etc/passwd", false) !== undefined || this.tryReadMemoryFileViewSync("/etc/group", false) !== undefined)
                 return undefined;
-            for (const k of ["ID_UID", "UID", "ID_EUID", "EUID", "ID_GID", "GID", "ID_EGID", "EGID", "ID_USER", "USER", "LOGNAME", "ID_GROUP", "ID_GROUPS", "ID_CONTEXT"]) {
+            for (const k of ["ID_UID", "UID", "ID_EUID", "EUID", "ID_GID", "GID", "ID_EGID", "EGID", "ID_USER", "USER", "LOGNAME", "GROUP", "ID_GROUPS", "SELINUX_CONTEXT"]) {
                 if (getEnv(k) !== undefined)
                     return undefined;
             }
@@ -33960,13 +33964,17 @@ export class Runtime {
         if (cmdName === "hostname") {
             if (this.tryReadMemoryFileViewSync("/etc/hostname", false) !== undefined || getEnv("HOSTNAME_DOMAIN") !== undefined || getEnv("HOSTNAME_IP") !== undefined)
                 return undefined;
-            const host = getEnv("HOSTNAME") ?? "sandbox";
-            if (opArgs.length === 0 || (opArgs.length === 1 && (opArgs[0] === "-f" || opArgs[0] === "--fqdn" || opArgs[0] === "--long")))
+            const host = getEnv("HOSTNAME") || "sandbox";
+            if (opArgs.length === 0)
                 return host;
+            if (opArgs.length === 1 && (opArgs[0] === "-f" || opArgs[0] === "--fqdn" || opArgs[0] === "--long"))
+                return host.includes(".") ? host : `${host}.vfs.local`;
             if (opArgs.length === 1 && (opArgs[0] === "-s" || opArgs[0] === "--short"))
                 return host.split(".")[0];
-            if (opArgs.length === 1 && (opArgs[0] === "-i" || opArgs[0] === "--ip-address" || opArgs[0] === "-I" || opArgs[0] === "--all-ip-addresses"))
+            if (opArgs.length === 1 && (opArgs[0] === "-i" || opArgs[0] === "--ip-address"))
                 return "127.0.0.1";
+            if (opArgs.length === 1 && (opArgs[0] === "-I" || opArgs[0] === "--all-ip-addresses"))
+                return "127.0.0.1 ";
             return undefined;
         }
         if (cmdName === "nproc") {
@@ -34153,6 +34161,8 @@ export class Runtime {
                 tokens.push(op);
         }
         else {
+            if (rawLines === undefined)
+                return undefined;
             for (const line of rawLines) {
                 for (const t of line.split(/[ \t\r\n\f\v]+/)) {
                     if (t.length > 0)
@@ -34226,6 +34236,8 @@ export class Runtime {
                 return undefined;
             linesToRead = memLines;
         }
+        if (linesToRead === undefined)
+            return undefined;
         const tokens = [];
         for (const line of linesToRead) {
             for (const t of line.split(/[ \t\r\n\f\v]+/)) {
@@ -34314,6 +34326,8 @@ export class Runtime {
             const vars = extractVars(operands[0]);
             return vars.length > 0 ? vars.join("\n") + "\n" : "";
         }
+        if (inStr === undefined)
+            return undefined;
         const allowedVars = operands.length === 1 ? new Set(extractVars(operands[0])) : undefined;
         const raw = (stateMonitor(rawState)?.raw ?? rawState);
         const isRestrictedEnv = raw._exported === undefined && "_exported" in raw;
@@ -35866,8 +35880,24 @@ export class Runtime {
         if (list.terminator || list.pipelines.length !== 1)
             return undefined;
         const pipeline = list.pipelines[0];
-        if (pipeline.negate)
+        if (pipeline.negate || customRegisteredRegistries.has(this.commands))
             return undefined;
+        for (const command of pipeline.commands) {
+            if (command.kind !== "simple")
+                continue;
+            const name = command.words[0]?.plain;
+            if (!name)
+                continue;
+            if (name === "fmt" && command === pipeline.commands[0] && command.redirects.length === 0 && !io.stdinIsDefault)
+                return undefined;
+            const definition = this.getExternalCommand(name);
+            if (definition && customRegisteredCommands.has(definition.execute))
+                return undefined;
+            if (name === "uname" || name === "nproc" || name === "hostname" || name === "id" || name === "whoami") {
+                if (!definition || !builtInDirectContextExecutors.has(definition.execute))
+                    return undefined;
+            }
+        }
         // Range-aware tr and Buffer-free 76-col base64 are supported below.
         if (pipeline.commands.length >= 2 && pipeline.commands.length <= 5) {
             if (syncPurePipelineSlotInUse ||
@@ -37493,7 +37523,9 @@ export class Runtime {
         let w0Plain = cmd.words[0].plain;
         if (!w0Plain || rawState.extensions?.builtins.has(w0Plain))
             return undefined;
-        if (w0Plain === "xxd" || w0Plain === "od" || w0Plain === "mktemp" || w0Plain === "chmod") {
+        if (w0Plain === "fmt" && !hasSingleStdinRedir && !hasSingleHereStringRedir && !io.stdinIsDefault)
+            return undefined;
+        if (w0Plain === "xxd" || w0Plain === "od" || w0Plain === "mktemp" || w0Plain === "chmod" || w0Plain === "uname" || w0Plain === "nproc" || w0Plain === "hostname" || w0Plain === "id" || w0Plain === "whoami") {
             const definition = this.getExternalCommand(w0Plain);
             if (!definition || !builtInDirectContextExecutors.has(definition.execute))
                 return undefined;
@@ -38376,13 +38408,13 @@ export class Runtime {
                 else if (w0Plain === "paste")
                     cjLines = this.evalSyncPaste(stdinLines ?? [], allArgs, rawState.cwd);
                 else if (w0Plain === "factor")
-                    cjLines = this.evalSyncFactor(stdinLines ?? [], allArgs);
+                    cjLines = this.evalSyncFactor(stdinLines, allArgs);
                 else if (w0Plain === "tsort")
-                    cjLines = this.evalSyncTsort(stdinLines ?? [], allArgs, rawState.cwd);
+                    cjLines = this.evalSyncTsort(stdinLines, allArgs, rawState.cwd);
                 else if (w0Plain === "jq")
                     cjLines = this.evalSyncJq(undefined, allArgs, rawState.cwd);
                 else if (w0Plain === "envsubst") {
-                    const esOut = this.evalSyncEnvsubst("", allArgs, rawState);
+                    const esOut = this.evalSyncEnvsubst(undefined, allArgs, rawState);
                     if (esOut !== undefined)
                         cjLines = esOut.endsWith("\n") ? esOut.slice(0, -1).split("\n") : (esOut ? [esOut] : []);
                 }