@poe-platform/safe-bash 0.1.802 → 0.1.803

package/dist/safe-bash/shell/runtime.js

@@ -163,6 +163,7 @@ export const defaultLimits = {
     maxPathnameComponents: Infinity,
     maxRedirects: Infinity,
     maxPipelineStages: Infinity,
+    maxPipelineBytes: Infinity,
     maxLoopIterations: Infinity,
     maxSubstitutionDepth: Infinity,
     maxFunctionDepth: Infinity,
@@ -453,6 +454,7 @@ function tickSharedWallClockBudgets() {
     }
 }
 export class Budget {
+    pipelineBytes = 0;
     get fileSystemOperations() {
         return this._fileSystemOperations;
     }
@@ -494,7 +496,7 @@ export class Budget {
             this.maxSourceBytesSmi = limits.maxSourceBytes | 0;
         if (limits.maxPipelineStages < 0x3fffffff)
             this.maxPipelineStagesSmi = limits.maxPipelineStages | 0;
-        if (limits.pipeHighWaterMark < 65536)
+        if (limits.pipeHighWaterMark < 65536 || limits.maxPipelineBytes !== Infinity)
             this.canSyncPurePipe = false;
         this.signal = signal ? combineManagedSignals(signal, this.controller.signal) : this.controller.signal;
         if (signal)
@@ -643,6 +645,16 @@ export class Budget {
     set fsOperations(value) {
         this._fileSystemOperations = value;
     }
+    pipelineInput = (bytes) => {
+        if (this.limits.maxPipelineBytes === Infinity)
+            return;
+        this.assertPipelineInput(bytes);
+        this.pipelineBytes += bytes;
+    };
+    assertPipelineInput(bytes) {
+        if (bytes > this.limits.maxPipelineBytes - this.pipelineBytes)
+            this.fail("maxPipelineBytes");
+    }
     reservePipelineStages(count) {
         this.signal.throwIfAborted();
         if (count > this.limits.maxPipelineStages - this._pipelineStages)
@@ -1493,6 +1505,7 @@ class BudgetedPipeStageSink {
         return Boolean(w.open && pipe && !pipe.failed && !pipe.signal?.aborted && pipe.readerReferences && (!pipe.writes || pipe.writes.size === 0) && (pipe.availableBytes ?? 0) < (pipe.highWaterMark ?? 0));
     }
     writeSync(chunk) {
+        this.budget.assertPipelineInput(chunk.byteLength);
         this.budget.bytes += chunk.byteLength;
         this.writable.write(chunk);
         if (chunk.byteLength && this.written)
@@ -8264,7 +8277,7 @@ export class Runtime {
         const n = pipeline.commands.length;
         this.budget.enterPipelineStages(n);
         this.budget.commands += n;
-        const pipeOptions = { highWaterMark: this.budget.limits.pipeHighWaterMark, signal: this.signal };
+        const pipeOptions = { highWaterMark: this.budget.limits.pipeHighWaterMark, signal: this.signal, admitWrite: this.budget.pipelineInput };
         const pipes = new Array(n - 1);
         for (let i = 0; i < n - 1; i++) {
             pipes[i] = createBytePipe(pipeOptions);
@@ -18326,7 +18339,7 @@ export class Runtime {
                 }
                 for (let index = 1; index < pipeline.commands.length; index++)
                     pipes.push(createBytePipe({
-                        highWaterMark: this.budget.limits.pipeHighWaterMark, signal: this.signal,
+                        highWaterMark: this.budget.limits.pipeHighWaterMark, signal: this.signal, admitWrite: this.budget.pipelineInput,
                     }));
                 for (let index = 0; index < pipeline.commands.length; index++) {
                     controllers.push(createManagedControlController());
@@ -35476,6 +35489,10 @@ export class Runtime {
         return true;
     }
     tryFastPureSubstitution(part, state, rawState, io) {
+        if (!cCollation(rawState.variables.LC_ALL || rawState.variables.LC_COLLATE || rawState.variables.LANG || "C"))
+            return undefined;
+        if (this.budget.limits.maxPipelineBytes !== Infinity)
+            return undefined;
         // Synchronous evaluators do not expose cumulative source-read accounting.
         // Use the command context whenever the caller has set an input ceiling.
         if (this.budget.limits.maxInputBytes !== Infinity)

package/dist/safe-bash/shell/types.d.ts

@@ -55,6 +55,8 @@ export interface ShellLimits {
      * Zero permits only redirect-free commands. Not a global byte or filesystem-call budget. */
     readonly maxRedirects?: number;
     readonly maxPipelineStages?: number;
+    /** Cumulative bytes written between pipeline stages per invocation, including nested pipelines. */
+    readonly maxPipelineBytes?: number;
     readonly maxLoopIterations?: number;
     readonly maxSubstitutionDepth?: number;
     /** Maximum simultaneously active shell functions; zero rejects function calls. Unlimited when omitted. */

package/dist/safe-bash/shell/worker-limits.js

@@ -45,6 +45,7 @@ export const cloudflareWorkerLimits = Object.freeze({
     maxPathnameComponents: 64,
     maxRedirects: 64,
     maxPipelineStages: 64,
+    maxPipelineBytes: 4 * 1024 * 1024,
     maxLoopIterations: 1_000,
     maxSubstitutionDepth: 16,
     maxFunctionDepth: 16,

package/dist/safe-bash/shell-entry.browser.js

@@ -1,28 +1,32 @@
 import {
   cloudflareWorkerLimits
-} from "./chunks/chunk-KDNSPLII.js";
+} from "./chunks/chunk-2LSAMQER.js";
 import {
   Shell,
   ShellLimitError,
   ShellSyntaxError,
   parseShell
-} from "./chunks/chunk-SHEMU2Z7.js";
+} from "./chunks/chunk-B7PIL77G.js";
+import "./chunks/chunk-A7XEHALN.js";
 import "./chunks/chunk-TFIBK2GI.js";
 import "./chunks/chunk-3NDIFSNM.js";
-import "./chunks/chunk-44ALJ4QG.js";
+import "./chunks/chunk-6O77NL2S.js";
+import "./chunks/chunk-PNBBUWSM.js";
 import "./chunks/chunk-MHMMRCYC.js";
+import "./chunks/chunk-OV6IHKO6.js";
+import "./chunks/chunk-CHYGPFVM.js";
 import "./chunks/chunk-AUSNDQTJ.js";
 import "./chunks/chunk-CTVWDACF.js";
 import "./chunks/chunk-3R3AANOR.js";
-import "./chunks/chunk-OV6IHKO6.js";
 import "./chunks/chunk-XVOSKJE2.js";
 import "./chunks/chunk-C5OWC2TL.js";
 import "./chunks/chunk-PH63PLPZ.js";
-import "./chunks/chunk-CHYGPFVM.js";
-import "./chunks/chunk-6O77NL2S.js";
-import "./chunks/chunk-BJA5XNP6.js";
+import "./chunks/chunk-D3ANYGMC.js";
 import "./chunks/chunk-J42RIHHJ.js";
 import "./chunks/chunk-I5HZ4FGE.js";
+import "./chunks/chunk-VTH3MLDU.js";
+import "./chunks/chunk-5OHX7C2V.js";
+import "./chunks/chunk-74GHTNJA.js";
 import {
   CommandRegistry,
   commandRuntimeIdentity,
@@ -33,11 +37,7 @@ import "./chunks/chunk-55YJASTN.js";
 import "./chunks/chunk-4BSJLKNM.js";
 import "./chunks/chunk-DQP3VHSB.js";
 import "./chunks/chunk-GEG3BWGE.js";
-import "./chunks/chunk-VSAJ4OTM.js";
-import "./chunks/chunk-D3ANYGMC.js";
-import "./chunks/chunk-VTH3MLDU.js";
-import "./chunks/chunk-NZQXYWA3.js";
-import "./chunks/chunk-74GHTNJA.js";
+import "./chunks/chunk-VBTDHOWC.js";
 import "./chunks/chunk-QGUV42T5.js";
 import "./chunks/chunk-ZVD5IS4V.js";
 import "./chunks/chunk-E7OYNDGL.js";

package/dist/safe-bash/worker/host.js

@@ -14,7 +14,7 @@ export function createWorkerKillAfterPolicy(registry, configuration, requiresMod
         // These counters/leases belong to the interpreter, not to a separate Shell.
         // Until a shared ledger is available, refuse rather than reset their quota.
         const limits = runtimeContext?.budget.limits ?? configuration.limits;
-        const shared = ["maxCommands", "maxLoopIterations", "maxSourceBytes", "maxParseUnits", "maxExpansionBytes", "maxExpansionFields", "maxPipelineStages", "maxSubstitutionDepth", "maxFunctionDepth", "maxCpuMs"];
+        const shared = ["maxCommands", "maxLoopIterations", "maxSourceBytes", "maxParseUnits", "maxExpansionBytes", "maxExpansionFields", "maxPipelineStages", "maxPipelineBytes", "maxSubstitutionDepth", "maxFunctionDepth", "maxCpuMs"];
         if (shared.some(key => limits?.[key] !== undefined && limits[key] !== Infinity)) {
             await writeBytes(context.stderr, new TextEncoder().encode("timeout: worker escalation cannot preserve finite shared interpreter quotas\n"), context.signal);
             return { exitCode: 125 };

package/dist/safe-bash-command-bc/index.js

@@ -35,11 +35,12 @@ var UsageError = class extends Error {
     super(message);
   }
 };
-async function collectSourceBytes(source, signal, maxBytes) {
+async function collectSourceBytes(source, signal, maxBytes, admit) {
   const chunks = [];
   let total = 0;
   for await (const chunk of readBytes(source, signal)) {
     total += chunk.byteLength;
+    admit(chunk.byteLength);
     if (total > maxBytes) throw new Error(`input exceeds maximum size (${maxBytes} bytes)`);
     chunks.push(chunk);
   }
@@ -673,6 +674,11 @@ function createBcCommand(options = {}) {
     description: "Arbitrary-precision calculator language",
     runtimeIdentity: commandRuntimeIdentity,
     async execute(context) {
+      let inputBytes = 0;
+      const admit = (bytes) => {
+        context.signal.throwIfAborted();
+        context.inputBudget?.check(inputBytes += bytes);
+      };
       context.signal.throwIfAborted();
       try {
         let mathlib = false;
@@ -721,14 +727,15 @@ function createBcCommand(options = {}) {
         }
         const sources = [...expressions];
         if (files.length === 0 && expressions.length === 0) {
-          sources.push(decoder.decode(await collectSourceBytes(context.stdin, context.signal, maxInputBytes)));
+          sources.push(decoder.decode(await collectSourceBytes(context.stdin, context.signal, maxInputBytes, admit)));
         } else if (files.length > 0) {
           for (const file of files) {
             if (file === "-") {
-              sources.push(decoder.decode(await collectSourceBytes(context.stdin, context.signal, maxInputBytes)));
+              sources.push(decoder.decode(await collectSourceBytes(context.stdin, context.signal, maxInputBytes, admit)));
             } else {
-              const raw = await context.fs.readFile(pathPosix.resolve(context.cwd, file));
+              const raw = await context.fs.readFile(pathPosix.resolve(context.cwd, file), { signal: context.signal });
               context.signal.throwIfAborted();
+              admit(raw.byteLength);
               if (raw.byteLength > maxInputBytes) throw new Error(`bc program exceeds maximum input size (${maxInputBytes} bytes)`);
               sources.push(decoder.decode(raw));
             }
@@ -1064,7 +1071,7 @@ function createBcCommand(options = {}) {
         return { exitCode: 0 };
       } catch (err) {
         context.signal.throwIfAborted();
-        if (err instanceof Error && err.name === "AbortError") throw err;
+        if (err instanceof Error && (err.name === "AbortError" || err.name === "BudgetExceededError")) throw err;
         const msg = err instanceof Error ? err.message : String(err);
         const code = err instanceof UsageError ? 2 : 1;
         await writeText(context.stderr, `bc: ${msg}

package/dist/safe-bash-command-bzip2/index.js

@@ -6,7 +6,8 @@ import {
 init_buffer();
 import { PublicDiagnostic, UsageError } from "../safe-bash-contracts/diagnostics.js";
 import {
-  commandRuntimeIdentity
+  commandRuntimeIdentity,
+  withInputByteBudget
 } from "../safe-bash-contracts/index.js";
 import { codeOf, diagnostic, output } from "../safe-bash-compression-engine/internal.js";
 import { runOperand } from "../safe-bash-compression-engine/operand.js";
@@ -35,7 +36,7 @@ function createNamedBzip2Command(name, options = {}) {
     name,
     description: `${name} block-sorting file compressor`,
     runtimeIdentity: commandRuntimeIdentity,
-    async execute(context) {
+    execute: withInputByteBudget(async (context) => {
       context.signal.throwIfAborted();
       try {
         const parsed = parseOptions(name, context.args);
@@ -105,7 +106,7 @@ No FILE or FILE '-' uses stdin; file output uses private VFS staging.
         await diagnostic(context, error);
         return { exitCode: error instanceof UsageError ? 2 : 1 };
       }
-    }
+    })
   };
 }
 function createBzip2Command(options = {}) {

package/dist/safe-bash-command-chmod/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Poe Platform
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/safe-bash-command-chmod/command.d.ts

@@ -0,0 +1,7 @@
+export { modeChange } from "../safe-bash-io-engine/commands/mode-change.js";
+import { type MetadataCommandsOptions } from "../safe-bash-metadata-engine/index.js";
+export declare function createChmodCommand(configuration?: MetadataCommandsOptions): import("../safe-bash-contracts/index.js").CommandDefinition;
+export declare function evalSyncChmod(opArgs: readonly string[], umask: number, chmodNodeSync?: (filePath: string, change: (stat: {
+    type: "file" | "directory" | "symlink";
+    mode: number;
+}) => number) => boolean): string | undefined;

package/dist/safe-bash-command-chmod/command.js

@@ -0,0 +1,11 @@
+import {
+  createChmodCommand,
+  evalSyncChmod,
+  modeChange
+} from "../safe-bash/command-chunks/chunk-A7MU7762.js";
+import "../safe-bash/command-chunks/chunk-HX3SHTCE.js";
+export {
+  createChmodCommand,
+  evalSyncChmod,
+  modeChange
+};

package/dist/safe-bash-command-chmod/index.d.ts

@@ -0,0 +1,6 @@
+import type { VirtualShellPlugin } from "../safe-bash-contracts/index.js";
+import type { MetadataCommandsOptions } from "../safe-bash-metadata-engine/index.js";
+export * from "./command.js";
+export type { MetadataCommandsOptions as ChmodCommandsOptions, MetadataLimits as ChmodLimits } from "../safe-bash-metadata-engine/index.js";
+export declare function createChmodCommands(options?: MetadataCommandsOptions): import("../safe-bash-contracts/index.js").CommandDefinition[];
+export declare function chmodCommands(options?: MetadataCommandsOptions): VirtualShellPlugin;

package/dist/safe-bash-command-chmod/index.js

@@ -0,0 +1,27 @@
+import {
+  createChmodCommand,
+  evalSyncChmod,
+  modeChange
+} from "../safe-bash/command-chunks/chunk-A7MU7762.js";
+import {
+  init_buffer
+} from "../safe-bash/command-chunks/chunk-HX3SHTCE.js";
+
+// packages/safe-bash-command-chmod/src/index.ts
+init_buffer();
+function createChmodCommands(options = {}) {
+  return [createChmodCommand(options)];
+}
+function chmodCommands(options = {}) {
+  const commands = createChmodCommands(options);
+  return { name: "chmod-commands", setup(host) {
+    for (const command of commands) host.commands.register(command, { replace: options.replace ?? false });
+  } };
+}
+export {
+  chmodCommands,
+  createChmodCommand,
+  createChmodCommands,
+  evalSyncChmod,
+  modeChange
+};

package/dist/safe-bash-command-exiftool/index.js

@@ -10,7 +10,7 @@ init_buffer();
 import { yieldTurn } from "../safe-bash-contracts/yield.js";
 import { commandRuntimeIdentity, getCommandArguments } from "../safe-bash-contracts/command.js";
 import { FsError as FsError2 } from "../safe-bash-contracts/errors.js";
-import { readBytes as readBytes2, writeBytes } from "../safe-bash-contracts/io.js";
+import { readBytes as readBytes2, writeBytes, withInputByteBudget } from "../safe-bash-contracts/io.js";
 import { createOutputOperation } from "../safe-bash-contracts/output.js";
 import { shellValueByteLength } from "../safe-bash-contracts/value.js";
 
@@ -1779,7 +1779,7 @@ function createExiftoolCommand(options = {}) {
     name: "exiftool",
     runtimeIdentity: commandRuntimeIdentity,
     description: "Inspect and edit admitted PNG, JPEG and PDF metadata through virtual files",
-    async execute(context) {
+    execute: withInputByteBudget(async (context) => {
       const publication = new Publication(context, limits.maxStagingAttempts);
       let stdout, stderr;
       let failed = false, failure;
@@ -1824,7 +1824,7 @@ function createExiftoolCommand(options = {}) {
           invocation = parseArguments(await expandArgfiles(context.args, context, publication, resources), resources.limits);
         } catch (error) {
           context.signal.throwIfAborted();
-          if (error instanceof ResourceLimitError) throw error;
+          if (error instanceof ResourceLimitError || error instanceof Error && error.name === "BudgetExceededError" || error instanceof FsError2 && error.code === "EFBIG") throw error;
           await output("Error: " + (error instanceof Error ? error.message : String(error)) + "\n", true);
           return { exitCode: 1 };
         }
@@ -1948,7 +1948,7 @@ function createExiftoolCommand(options = {}) {
             tags = jpeg ? inspectJpeg(bytes, resources).tags : png ? inspectPng(bytes, resources).tags : isPdf ? inspectPdf(bytes, resources).tags : [];
           } catch (error) {
             context.signal.throwIfAborted();
-            if (error instanceof ResourceLimitError) throw error;
+            if (error instanceof ResourceLimitError || error instanceof Error && error.name === "BudgetExceededError" || error instanceof FsError2 && error.code === "EFBIG") throw error;
             errors++;
             const message = error instanceof FsError2 && error.code === "ENOENT" ? "File not found" : error instanceof Error ? error.message : String(error);
             await output("Error: " + message + " - " + file + "\n", true);
@@ -2053,7 +2053,7 @@ function createExiftoolCommand(options = {}) {
       } finally {
         await cleanup();
       }
-    }
+    })
   });
 }
 var exiftoolCommand = createExiftoolCommand();

package/dist/safe-bash-command-find/find.js

@@ -1,7 +1,7 @@
 import {
   createFindDefinitions,
   evalSyncFind
-} from "../safe-bash/command-chunks/chunk-QKFSRZGQ.js";
+} from "../safe-bash/command-chunks/chunk-GFC2NTDG.js";
 import "../safe-bash/command-chunks/chunk-5ZMZ573Q.js";
 import "../safe-bash/command-chunks/chunk-HX3SHTCE.js";
 export {

package/dist/safe-bash-command-find/index.js

@@ -1,7 +1,7 @@
 import {
   createFindDefinitions,
   evalSyncFind
-} from "../safe-bash/command-chunks/chunk-QKFSRZGQ.js";
+} from "../safe-bash/command-chunks/chunk-GFC2NTDG.js";
 import "../safe-bash/command-chunks/chunk-5ZMZ573Q.js";
 import {
   init_buffer

package/dist/safe-bash-command-fmt/index.js

@@ -2217,12 +2217,14 @@ function pathOf(context, path) {
   return isAbsolutePath(path) ? path : `${context.cwd.endsWith("/") ? context.cwd.slice(0, -1) : context.cwd}/${path}`;
 }
 var InputBudget = class {
-  constructor(maximum, sourceBufferBytes) {
+  constructor(maximum, sourceBufferBytes, inputBudget) {
     this.maximum = maximum;
     this.sourceBufferBytes = sourceBufferBytes;
+    this.inputBudget = inputBudget;
   }
   maximum;
   sourceBufferBytes;
+  inputBudget;
   used = 0;
   get maxReadBytes() {
     return Math.max(0, Math.min(this.sourceBufferBytes, this.maximum - this.used));
@@ -2234,6 +2236,7 @@ var InputBudget = class {
       if (size > this.maximum - this.used) throw new FsError("EFBIG", { message: "byte command input limit exceeded" });
       if (size > this.maxReadBytes) throw new FmtError("LIMIT", "source chunk retention limit exceeded");
       this.used += size;
+      this.inputBudget?.check(this.used);
       if (!size) yield byteSpan(chunk, 0, 0);
       for (let offset = 0; offset < size; offset += 4096) yield byteSpan(chunk, offset, Math.min(4096, size - offset));
     }
@@ -2390,7 +2393,7 @@ async function fmt(context, configuration = {}) {
       const engineBytes = 10120 + settings.prefix.length;
       const batchBytes = limits.retainedBytes >= Math.max(32768, engineBytes + 16384 + 4096) ? 16384 : 0;
       const engineLimit = limits.retainedBytes - batchBytes;
-      const budget = new InputBudget(limits.inputBytes, engineLimit - engineBytes);
+      const budget = new InputBudget(limits.inputBytes, engineLimit - engineBytes, context.inputBudget);
       let work = 0, outputBytes = 0;
       stdout = createOutputOperation({ signal: local.signal }, context.stdout);
       const outputContext = { ...context, stdout: stdout.output };
@@ -2406,6 +2409,7 @@ async function fmt(context, configuration = {}) {
         try {
           await current.open(name, nameBytes);
         } catch (error) {
+          if (error instanceof Error && (error.name === "BudgetExceededError" || error.name === "AbortError")) throw error;
           local.signal.throwIfAborted();
           await diagnostic(context, fileError(error, name, nameBytes, true, context));
           await current.close();
@@ -2439,6 +2443,7 @@ async function fmt(context, configuration = {}) {
                   bytes2 = await current.next();
                   if (bytes2?.length) received = true;
                 } catch (error) {
+                  if (error instanceof Error && (error.name === "BudgetExceededError" || error.name === "AbortError")) throw error;
                   local.signal.throwIfAborted();
                   if (isFsError(error, "EFBIG")) throw new FmtError("LIMIT", "byte command input limit exceeded");
                   readFailed = true;
@@ -2467,6 +2472,7 @@ async function fmt(context, configuration = {}) {
           }
           if (outBatchUsed) await flushOutBatch();
         } catch (error) {
+          if (error instanceof Error && (error.name === "BudgetExceededError" || error.name === "AbortError")) throw error;
           local.signal.throwIfAborted();
           try {
             await flushOutBatch();
@@ -2496,6 +2502,7 @@ async function fmt(context, configuration = {}) {
     } catch (error) {
       failed = true;
       context.signal.throwIfAborted();
+      if (error instanceof Error && (error.name === "BudgetExceededError" || error.name === "AbortError")) throw error;
       if (error instanceof FmtError && error.usage) await writeBytes(context.stderr, Uint8Array.from(`fmt: ${error.message}
 Try 'fmt --help' for more information.
 `, (character) => character.charCodeAt(0)), context.signal);

package/dist/safe-bash-command-gzip/index.js

@@ -16,10 +16,11 @@ function createGzipCommands(config = {}) {
   if (maxDecodedBytes !== void 0 && maxDecodedBytes !== Infinity && (!Number.isSafeInteger(maxDecodedBytes) || maxDecodedBytes < 0)) {
     throw new RangeError("maxDecodedBytes must be a nonnegative safe integer or Infinity");
   }
-  const commands = profiles.filter((profile) => profile.format === "gzip").flatMap((profile) => profile.names.map((name) => define(name, withInputByteBudget(async (context) => {
-    const options = parseOptions(name, context.args);
-    if (options.help) {
-      await output(context, `Usage: ${name} [OPTION]... [FILE]...
+  const commands = profiles.filter((profile) => profile.format === "gzip").flatMap((profile) => profile.names.map((name) => {
+    const command = define(name, async (context) => {
+      const options = parseOptions(name, context.args);
+      if (options.help) {
+        await output(context, `Usage: ${name} [OPTION]... [FILE]...
 -c, --stdout, --to-stdout
 -d, --decompress, --uncompress
 -k, --keep
@@ -29,48 +30,50 @@ ${options.format === "zstd" ? "-1..-9, --best\nHigher levels and --fast[=NUM] ar
 `}-h, --help
 No FILE or FILE '-' uses stdin; file output uses private VFS staging.
 `);
-      return { exitCode: 0 };
-    }
-    let plans;
-    let planningFailed = false;
-    try {
-      if (options.operands.length > 1) {
-        plans = [];
-        for (const name2 of options.operands) {
-          try {
-            plans.push(...await planOperands(context, { ...options, operands: [name2] }));
-          } catch (error) {
-            context.signal.throwIfAborted();
-            if (codeOf(error) === "EROFS") throw error;
-            planningFailed = true;
-            if (options.quiet < 2) await diagnostic(context, error);
-          }
-        }
-        if (plans.length > 1) await verifyOperandDestinations(context, plans);
-      } else plans = await planOperands(context, options);
-    } catch (error) {
-      context.signal.throwIfAborted();
-      if (options.quiet < 2) throw error;
-      return { exitCode: 1 };
-    }
-    const decodedBudget = new DecodedBudget(maxDecodedBytes);
-    let exitCode = planningFailed ? 1 : 0;
-    for (const plan of plans) {
+        return { exitCode: 0 };
+      }
+      let plans;
+      let planningFailed = false;
       try {
-        const warned = await runOperand(context, plan, options, decodedBudget);
-        if (warned) {
-          if (!options.quiet) await diagnostic(context, new PublicDiagnostic(`${plan.source}: decompression OK, trailing garbage ignored`));
-          if (exitCode === 0) exitCode = 2;
-        }
+        if (options.operands.length > 1) {
+          plans = [];
+          for (const name2 of options.operands) {
+            try {
+              plans.push(...await planOperands(context, { ...options, operands: [name2] }));
+            } catch (error) {
+              context.signal.throwIfAborted();
+              if (codeOf(error) === "EROFS") throw error;
+              planningFailed = true;
+              if (options.quiet < 2) await diagnostic(context, error);
+            }
+          }
+          if (plans.length > 1) await verifyOperandDestinations(context, plans);
+        } else plans = await planOperands(context, options);
       } catch (error) {
         context.signal.throwIfAborted();
-        if (options.quiet < 2) await diagnostic(context, error);
-        exitCode = 1;
-        if (decodedBudget.exceeded) break;
+        if (options.quiet < 2) throw error;
+        return { exitCode: 1 };
       }
-    }
-    return { exitCode };
-  }))));
+      const decodedBudget = new DecodedBudget(maxDecodedBytes);
+      let exitCode = planningFailed ? 1 : 0;
+      for (const plan of plans) {
+        try {
+          const warned = await runOperand(context, plan, options, decodedBudget);
+          if (warned) {
+            if (!options.quiet) await diagnostic(context, new PublicDiagnostic(`${plan.source}: decompression OK, trailing garbage ignored`));
+            if (exitCode === 0) exitCode = 2;
+          }
+        } catch (error) {
+          context.signal.throwIfAborted();
+          if (options.quiet < 2) await diagnostic(context, error);
+          exitCode = 1;
+          if (decodedBudget.exceeded) break;
+        }
+      }
+      return { exitCode };
+    });
+    return { ...command, execute: withInputByteBudget(async (context) => command.execute(context)) };
+  }));
   if (maxDecodedBytes === void 0 || maxDecodedBytes === Infinity) {
     for (const c of commands) builtInDirectContextExecutors.add(c.execute);
   }

package/dist/safe-bash-command-imagemagick/index.js

@@ -35,6 +35,7 @@ import {
 
 // packages/safe-bash-command-imagemagick/src/index.ts
 init_buffer();
+import { FsError } from "../safe-bash-contracts/errors.js";
 import { resolvePath } from "../safe-bash-contracts/path.js";
 import { yieldTurn, drainCooperativeSteps as drainSteps } from "../safe-bash-contracts/yield.js";
 import { InputByteBudget } from "../safe-bash-contracts/io.js";
@@ -5089,7 +5090,8 @@ async function executeVfsMagickTool(context, runner, maxInputBytes) {
         bytes = await context.fs.readFile(resolvePath(context.cwd, candidate), {
           signal: invocation.signal
         });
-      } catch {
+      } catch (error) {
+        if (!(error instanceof FsError) || !["ENOENT", "ENOTDIR", "EISDIR", "EACCES", "EPERM"].includes(error.code)) throw error;
         continue;
       }
       chargeInput(bytes.byteLength);

package/dist/safe-bash-command-jq/index.js

@@ -1,6 +1,6 @@
 import {
   createJqCommand
-} from "../safe-bash/command-chunks/chunk-MQFIPHIQ.js";
+} from "../safe-bash/command-chunks/chunk-ILX2NOLF.js";
 import {
   init_buffer
 } from "../safe-bash/command-chunks/chunk-HX3SHTCE.js";

package/dist/safe-bash-command-jq/jq.js

@@ -1,7 +1,7 @@
 import {
   createJqCommand,
   executeJq
-} from "../safe-bash/command-chunks/chunk-MQFIPHIQ.js";
+} from "../safe-bash/command-chunks/chunk-ILX2NOLF.js";
 import "../safe-bash/command-chunks/chunk-HX3SHTCE.js";
 export {
   createJqCommand,