@poe-platform/safe-bash 0.1.802 → 0.1.804

package/README.md

@@ -44,10 +44,15 @@ Output: `Hello, reader!\nAda\nGrace\n`. The script, input, and generated
 Each `exec()` starts fresh shell variables, functions, and working-directory state;
 filesystem changes persist in the supplied `fs`. The invocation-local `umask`
 starts at `0022`, accepts octal or symbolic modes, and is inherited by child shells.
+Within a script, `exec` keeps file redirections open or replaces the current shell
+command; `read -u FD -t SECONDS` reads an open descriptor with a timeout.
 Creation modes use the filesystem's capabilities; advisory modes do not enforce
 physical permissions, and the host process mask remains unchanged.
-Core and shell imports install a portable `globalThis.Buffer` when it is absent;
-an existing host Buffer is preserved. Workers do not need `nodejs_compat` for this.
+Core, shell, and command imports use Web-standard bytes without installing
+`globalThis.Buffer`. Workers do not need `nodejs_compat` for this.
+Bash `[[ value =~ pattern ]]` and `BASH_REMATCH` also work in browsers and
+Workers, using the same ERE engine with cooperative cancellation and shared
+resource accounting.
 AES ZIP encryption and decryption also work in browsers and Workers. The
 `@poe-platform/safe-bash/trap` entry selects the portable signal catalog there.
 
@@ -76,7 +81,7 @@ The registry subpath supports ESM splitting without visiting the full aggregate.
 Its exports do not select the optional
 `op`, `node` or `safejs` plugins; add those only through their command entrypoints.
 Only registered commands are available; adding search commands does not enable unrelated tools.
-Use `agentCommands({ muscleMemory: true })` or individual command plugins to enable tools such as `bc`, `fd`, `sponge`, and `less`.
+`agentCommands()` includes convenience tools such as `bc`, `fd`, `sponge`, `less`, and `more` by default. Pass `muscleMemory: false` to omit that family; individual command plugins remain available.
 Removing a registered command changes availability, while shared family code may
 remain bundled. Splitting dynamic
 imports changes initialization timing: every uploaded static chunk and Wasm asset
@@ -84,10 +89,12 @@ still counts toward a Worker's uncompressed size.
 
 ## Supported features and commands
 
-The root and `core` exports register optional spreadsheet, PDF, media, office,
-and Git commands from static metadata and load their implementations on first
-execution. `agentCommands()` keeps its existing default inventory. Select a
-single command or a family explicitly, or retain the full optional inventory:
+The root and `core` exports provide spreadsheet, PDF, media, office, and Git
+commands using static metadata, loading their implementations on first execution.
+`agentCommands()` includes the portable command suite, including YAML, CSV, HTML,
+PDF, media, office, Mermaid, and virtual `op` commands. Git remains an explicit
+plugin, as do network and external runtime capabilities. For a shell without
+`agentCommands()`, select individual commands or families:
 
 ```ts
 import { optionalCommands } from "@poe-platform/safe-bash";
@@ -164,12 +171,17 @@ All private command plugins are available from `@poe-platform/safe-bash/core` in
   Bash-profile `set -f` / `set -o noglob` disables pathname
   expansion, and `set +f` restores it. `set -C` (or `set -o noclobber`) protects existing output
   files from `>` redirection; `>|` overrides it and `>>` still appends.
-  `shopt -s dotglob` includes dotfiles in globs.
+  `shopt -s dotglob` includes dotfiles in globs. `failglob` rejects unmatched
+  patterns; `lastpipe` retains the final foreground pipeline stage's shell changes;
+  `inherit_errexit` carries `set -e` into command substitutions. Enable
+  `expand_aliases` to expand aliases on subsequently read command lines.
 
 Shell builtins beyond the tools below: `:`, `cd`, `pushd`, `popd`, `dirs`, `set`,
 `shift`, `export`, `local`, `declare`, `readonly`, `unset`, `read`, `getopts`, `let`, `shopt`, `umask`,
 `exit`, `return`, `break`, `continue`, `command`, `builtin`, `type`, `.`, `source`,
-`eval`. `pwd`, `true`, and `false` also work without a command bundle.
+`eval`, `alias`, `unalias`. `alias name='command args'` defines an alias;
+`alias -p` lists definitions, and `unalias name` or `unalias -a` removes them.
+`pwd`, `true`, and `false` also work without a command bundle.
 `command -p` bypasses functions and searches `/bin:/usr/bin` in the supplied
 filesystem while preserving `PATH`; registered commands remain available.
 Combine it with `-v` or `-V` for discovery, including `command -pV printf`.
@@ -245,7 +257,7 @@ and other unsupported options remain unavailable.
 
 Tar creation also accepts `--sort=name` (bytewise directory-child order; operand order stays unchanged), `--sort=none` (default), `--dereference` / `-h` (archive symbolic-link targets), and `--exclude-caches` (retain directories with a valid `CACHEDIR.TAG` and their tag files, omitting other contents). Dereferencing retains backend containment and output-archive checks and rejects directory cycles.
 
-Tar reads newline-delimited exclusion patterns with `-X FILE` / `--exclude-from=FILE`. When listing or extracting, `--wildcards` enables anchored glob member selection; `--no-wildcards` restores literal selection. `--occurrence[=NUM]` selects only the requested occurrence of each member operand (default 1), and requires member operands.
+Tar reads newline-delimited exclusion patterns with `-X FILE` / `--exclude-from=FILE`; exclusion spelling accepts leading `./` and trailing `/`. File lists resolve against the active `-C` directory and accept trailing `--null` or `--verbatim-files-from` when no earlier decoding mode was specified. Tar and ZIP can read S3, WebDAV and custom filesystem sources without retained handles using canonical-path and metadata checks; these checks do not provide concurrent-read snapshots. When listing or extracting, `--wildcards` enables anchored glob member selection; `--no-wildcards` restores literal selection. `--occurrence[=NUM]` selects only the requested occurrence of each member operand (default 1), and requires member operands.
 
 Use `cat --help`, `base64 --help`, `cp --help`, `sort --help`, `grep --help`, `rg --help` or `tar --help` to discover supported options. `base64 --version`, `cp --version` and `sort --version` identify the safe-bash implementation. These informational requests exit before processing input files.
 `cp -u` / `--update` copies missing files and replaces files only when the source
@@ -382,7 +394,7 @@ properties, XML, INI, TOML, base64 and URI; shell and Lua are output only.
 See the [format profile](src/commands/yq/FORMATS.md) for supported shapes and limits.
 
 Import `csvcutCommands` from `@poe-platform/safe-bash/commands/csvcut` and pass it
-to `shell.use(csvcutCommands())` to enable CSV projection. For example,
+to `shell.use(csvcutCommands())` to enable CSV projection without the aggregate plugin. For example,
 `printf 'a,b\nx,y\n' | csvcut -c2,1,2` emits `b,a,b\ny,x,y\n`.
 The same subpath exports the typed SDK and bounded record/selector APIs; see the
 [flags, limits and profiles](https://github.com/poe-platform/poe-code/blob/main/packages/safe-bash-command-csvcut/README.md).
@@ -393,23 +405,23 @@ unqualified.
 | --- | --- |
 | `dos2unix`, `unix2dos` | `lineEndingCommands({ limits?, replace? })` from `/commands/line-endings`: byte and UTF-16 line-ending conversion. Use `-e` / `--add-eol` to terminate the final line, `-O` / `--to-stdout` to convert without rewriting inputs, and `-i[FLAGS]` / `--info[=FLAGS]` to inspect line endings, BOM and text/binary status. `-v` prints conversion details. In-place conversion requires safe publication capabilities and preserves reported ownership; `--allow-chown` permits publication when ownership cannot be preserved, and `--no-allow-chown` restores the default. |
 | `curl`, `wget` | `networkCommands({ authorize, transport?, limits?, replace? })`: required authorization on every request, redirect, and retry. Curl's `-r/--range` requests byte ranges. Wget supports `--header 'NAME: VALUE'`, `--user-agent`, `--referer`, `--post-data`/`--post-file` and `--method` with `--body-data`/`--body-file`; body files come from the VFS and retain their bytes. Repeated wget headers replace earlier values by name; `--header=''` clears custom headers, and `NAME:` sends an empty value. Host, Connection, and Expect overrides are accepted; framing and proxy headers remain transport-controlled. Custom headers are dropped after crossing origins. Node uses the native HTTP transport and supports curl's `--connect-timeout` for DNS/TCP/TLS setup. Workers default to `createFetchTransport()`, which cannot enforce a separate connection timeout. Network registration without an authorizer denies requests. Quotas default to disabled in every runtime. `createOriginAuthorizer([...])` provides exact origin/hostname policy; its omitted allowlist is deliberately `*` (allow all). [Options and limits](src/commands/network/types.ts). |
-| `node` | `nodeCommands({ runtime, limits?, replace? })`: runs JavaScript with an injected SafeJS runtime, virtual files, and shell streams. [Usage and supported subset](src/commands/node/README.md). |
-| `python`, `python3` | `pythonCommands({ createExecutor })` from `@poe-platform/safe-bash/commands/python`: supply an explicit executor for invocation-local Python, filesystem I/O and shell streams. Open-file, directory, worker-capacity, input-fragment, package-download, cache and manifest-store quotas are unlimited by default; configure individual budgets when needed. [Executor and ownership contract](src/contracts/python-executor.md). Invocation capabilities include `createPythonLlmCapability(context, service)` for the same authorized model service and `createPythonShellCapability(context)` for enabled commands. The bundled [Python LLM client](docs/python-llm.md) supports canonical streamed attachments, shared named templates and a typed saved-configuration snapshot. |
+| `node` | Opt-in [QuickJS runtime](../safe-bash-command-node/README.md) via `commands/node/quickjs`, with safe-fs files and safe-bash child commands. The existing [injected runtime](src/commands/node/README.md) remains available. |
+| `python`, `python3` | `pythonCommands({ createExecutor })` from `@poe-platform/safe-bash/commands/python`: supply an explicit executor for invocation-local Python, filesystem I/O and shell streams. Open-file, directory, worker-capacity, input-fragment, package-download, cache, manifest-store and Docker frame-size quotas are unlimited by default; configure individual budgets when needed. [Executor and ownership contract](src/contracts/python-executor.md). Invocation capabilities include `createPythonLlmCapability(context, service)` for the same authorized model service and `createPythonShellCapability(context)` for enabled commands. The bundled [Python LLM APIs](docs/python-llm.md) support ordinary `import llm` prompts, sync/async responses, in-memory conversations, text embeddings and canonical streamed attachments; the workflow client also exposes shared templates and saved configuration. |
 | `llm` | `llmCommands({ providers, defaultModel?, replace? })` or `llmCommands({ service, replace? })`: opt-in model routing, sandbox attachments and streamed text/binary output. Includes injected-transport OpenAI and ElevenLabs reference providers. [Configuration and provider contract](src/commands/llm/README.md). |
-| `pdfinfo` | `/commands/pdfinfo`: opt-in `pdfinfoCommands({ replace? })` registering `pdfinfo`, `pdftoppm`, `pdfimages`, `pdfunite`, and `pdfseparate` powered by `@poe-code/pdf-ast`. Supports Poppler metadata, page geometry, `-box`, `-isodates`/`-rawdates`, `-custom`, `-meta`, `-url`, `-js`, `-struct`/`-struct-text`, `-dests`, page rasterization (`pdftoppm`), image listing/extraction (`pdfimages`), PDF merging (`pdfunite`), and page splitting (`pdfseparate`). |
-| `pdftoppm` | `/commands/pdftoppm`: opt-in `pdftoppmPlugin({ replace? })` and `createPdftoppmCommand` powered by `@poe-code/pdf-ast`. Renders PDF pages to `.png`, `.ppm`, `.pgm`, `.pbm`, or `.svg` with configurable `-r`/`-rx`/`-ry` DPI, `-f`/`-l` page ranges, `-singlefile`, `-sep`, and `-x`/`-y`/`-W`/`-H`/`-cropbox` sub-region cropping. |
-| `pdfimages` | `/commands/pdfimages`: opt-in `pdfimagesPlugin({ replace? })` and `createPdfimagesCommand` powered by `@poe-code/pdf-ast`. Lists (`-list`) and extracts embedded XObject, nested Form XObject, and inline images to `.png`, `.jpg` (`-j`/`-all`), `.ppm`, or `.pbm` with CTM PPI metadata and `-p` page numbering. |
-| `pdftotext` | `/commands/pdftotext`: opt-in `pdftotextCommands({ replace? })` registering `pdftotext` and `pdftohtml` powered by `@poe-code/pdf-ast`. Supports logical reading order with dehyphenation, `-layout`, `-raw`, `-bbox`/`-bbox-layout` XHTML, Poppler `-tsv`, `-htmlmeta`, and `pdftohtml` (`-xml`, `-stdout`, `-s`, `-c`). |
-| `pdftk` | `/commands/pdftk`: opt-in `pdftkPlugin({ replace? })` and `createPdftkCommand` powered by `@poe-code/pdf-ast`. Supports `cat`/`shuffle` multi-handle page assembly and rotations, `dump_data_fields_utf8`, `fill_form` (FDF/XFDF/stanzas) with `flatten`, `burst`, `rotate`, `background`, and `stamp`. |
-| `qpdf` | `/commands/qpdf`: opt-in `qpdfCommands({ replace? })` and `runQpdfCli` powered by `@poe-code/pdf-ast`. Supports `--check`, `--show-npages`, `--show-xref`, `--show-object`, `--json`, `--is-encrypted`, `--requires-password`, `--show-encryption`, `--encrypt`/`--decrypt`, `--empty --pages ... --`, `--split-pages`, `--rotate`, `--qdf`, and `--replace-input`. |
+| `pdfinfo` | `/commands/pdfinfo`: `pdfinfoCommands({ replace? })` registering `pdfinfo`, `pdftoppm`, `pdfimages`, `pdfunite`, and `pdfseparate` powered by `@poe-code/pdf-ast`. Supports Poppler metadata, page geometry, `-box`, `-isodates`/`-rawdates`, `-custom`, `-meta`, `-url`, `-js`, `-struct`/`-struct-text`, `-dests`, page rasterization (`pdftoppm`), image listing/extraction (`pdfimages`), PDF merging (`pdfunite`), and page splitting (`pdfseparate`). |
+| `pdftoppm` | `/commands/pdftoppm`: `pdftoppmPlugin({ replace? })` and `createPdftoppmCommand` powered by `@poe-code/pdf-ast`. Renders PDF pages to `.png`, `.ppm`, `.pgm`, `.pbm`, or `.svg` with configurable `-r`/`-rx`/`-ry` DPI, `-f`/`-l` page ranges, `-singlefile`, `-sep`, and `-x`/`-y`/`-W`/`-H`/`-cropbox` sub-region cropping. |
+| `pdfimages` | `/commands/pdfimages`: `pdfimagesPlugin({ replace? })` and `createPdfimagesCommand` powered by `@poe-code/pdf-ast`. Lists (`-list`) and extracts embedded XObject, nested Form XObject, and inline images to `.png`, `.jpg` (`-j`/`-all`), `.ppm`, or `.pbm` with CTM PPI metadata and `-p` page numbering. |
+| `pdftotext` | `/commands/pdftotext`: `pdftotextCommands({ replace? })` registering `pdftotext` and `pdftohtml` powered by `@poe-code/pdf-ast`. Supports logical reading order with dehyphenation, `-layout`, `-raw`, `-bbox`/`-bbox-layout` XHTML, Poppler `-tsv`, `-htmlmeta`, and `pdftohtml` (`-xml`, `-stdout`, `-s`, `-c`). |
+| `pdftk` | `/commands/pdftk`: `pdftkPlugin({ replace? })` and `createPdftkCommand` powered by `@poe-code/pdf-ast`. Supports `cat`/`shuffle` multi-handle page assembly and rotations, `dump_data_fields_utf8`, `fill_form` (FDF/XFDF/stanzas) with `flatten`, `burst`, `rotate`, `background`, and `stamp`. |
+| `qpdf` | `/commands/qpdf`: `qpdfCommands({ replace? })` and `runQpdfCli` powered by `@poe-code/pdf-ast`. Supports `--check`, `--show-npages`, `--show-xref`, `--show-object`, `--json`, `--is-encrypted`, `--requires-password`, `--show-encryption`, `--encrypt`/`--decrypt`, `--empty --pages ... --`, `--split-pages`, `--rotate`, `--qdf`, and `--replace-input`. |
 | `magick`, `convert`, `mogrify`, `composite`, `montage`, `compare` | `/commands/imagemagick`: opt-in `imagemagickPlugin({ replace? })` (`imagemagickCommands`) registering ImageMagick `magick`, `convert`, `mogrify`, `composite`, `montage`, `compare`, and `identify` powered by `@poe-code/image-ast`. Supports `xc:`/`canvas:`/`gradient:`/`radial-gradient:`/`pattern:checkerboard`/`label:` generators, geometry modifiers (`!`, `>`, `<`, `^`, `%`, `@`), left-to-right image stack operators (`-resize`, `-crop`, `-extent`, `-border`, `-shave`, `-splice`, `-chop`, `-roll`, `-trim`, `-rotate`, `-flip`, `-flop`, `-shear`, `-distort` (`SRT`, `Perspective`, `Affine`, `Barrel`), `-swirl`, `-implode`, `-wave`, `-shadow`, `-vignette`, `-negate`, `-colorspace`, `-sepia-tone`, `-solarize`, `-posterize`, `-colors`, `-modulate`, `-gamma`, `-level`, `-threshold`, `-opaque`/`-transparent`, `-evaluate`, `-function`, `-clut`, `-fx`, `-blur`, `-sharpen`, `-edge`, `-emboss`, `-charcoal`, `-draw` (`rectangle`, `circle`, `polygon`, `polyline`, `bezier`, `path`, `text`), `-annotate`, `( ... )`, `+clone`, `-morph`, `+append`, `-append`, `-composite`, `-flatten`), `compare -metric AE\|MAE\|MSE\|RMSE\|PSNR\|SSIM`, in-place `mogrify`, `montage` grids, `out-%d.png` scene output, and stdin/stdout byte streams (`-`, `png:-`). |
 | `sips` | `/commands/sips`: opt-in `sipsPlugin({ replace? })` (`sipsCommands`) registering macOS `sips` and ImageMagick `identify` powered by `@poe-code/image-ast` (`sharp`). Supports `-g`, `-1`, `-Z`, `-z`, `--resampleWidth`, `--resampleHeight`, `-c`, `--cropOffset`, `-p`, `--padColor`, `-r`, `-f`, `-s format`, `-s formatOptions`, `-o/--out`, and `identify` (`-ping`, `-format`, `-verbose`). |
 | `soffice` | `/commands/soffice`: opt-in `sofficeCommands({ replace? })` registering `soffice` and `libreoffice` powered by `@poe-code/pdf-ast`. Supports headless `--convert-to pdf[:writer_pdf_Export\|calc_pdf_Export\|impress_pdf_Export]` (including JSON `FilterData`), StarCalc `--convert-to csv:...`, `--cat`, and conversion across `.docx`, `.odt`, `.rtf`, `.xlsx`, `.pptx`, `.csv`, `.html`, `.png`, `.txt`, and `.pdf`. |
 | `wkhtmltopdf` | `/commands/wkhtmltopdf`: opt-in CLI/SDK adapter with VFS byte I/O and explicit limits. Requires a supplied first-party static renderer; none is included. `wkhtmltopdfCommands({ limits, renderer? })` and `runWkhtmltopdf(context, options)` share behavior. Exported `switches` lists all 122 flags and rejections; `wkhtmltopdfLimits` defaults to 16 MiB PDF output, 64 objects and 128 batch jobs. `--help`, `--extended-help` and `--version` work without a renderer; TOC and dynamic execution are unavailable. |
 | `unrtf` | `/commands/unrtf`: opt-in `unrtfCommands({ limits?, replace? })`, equivalent `unrtf(context, { format?, file?, limits? })` SDK, and bounded `tokenizeRtf`, `extractRtf`, `renderRtf` streams. Strict UTF-8 text/HTML supports scoped font/color/emphasis and flat tables; objects, pictures and field instructions stay inert. Use `unrtf --text /document.rtf` or `unrtf --html /document.rtf` (HTML default); output is UTF-8 with no invented text separator/final LF. Accepted flags are `--text`, `--html`, `--quiet`, `--nopict`, `-n`, `--`; unsupported profiles fail with status 1. Opt into scoped GNU 0.21.10 text/HTML/LaTeX wrappers and character aliases with `--profile=gnu-0.21.10` or SDK `profile`; this admits `--latex`, `--noremap` (SDK `noremap`) and banner suppression via `--quiet` (SDK `quiet`). Strict extraction remains in effect; full native parser/rendering parity and picture exports remain unimplemented. Private implementation/types ship inside safe-bash; see the [flags, limits and runtime profile](https://github.com/poe-platform/poe-code/blob/main/packages/safe-bash-command-unrtf/README.md). |
 | `exiftool` | `/commands/exiftool`: opt-in `exiftoolCommands({ limits? })` for uncompressed PNG text and `tIME` inspection/selected writes. Use `exiftool -j -Title /image.png`, `-csv` for union headers, or `-Title=Example` to edit with an `_original` backup. Typed SDK argv uses `createExiftoolArguments`. Defaults: 64 files, 16 MiB cumulative input/output, 8 MiB decoded and 32 MiB retained bytes. Private implementation/types ship inside safe-bash. PDF, Office, EXIF/XMP, broader timestamps, import and execute protocols remain unsupported; see the [supported profile](https://github.com/poe-platform/poe-code/blob/main/packages/safe-bash-command-exiftool/README.md). |
-| `csvcut` | `/commands/csvcut`: opt-in `csvcutCommands({ limits?, replace? })` and equivalent `csvcut(context, { include?, exclude?, zero?, names?, headerless?, deleteEmptyRows?, lineNumbers?, addBom?, dialect?, filePath?, encoding?, help?, version? }, { limits? })`. Bounded UTF-8-sig byte input, comma/LF output and literal VFS paths; csvkit 2.2.0 selector candidate, permissive-v1 reader, quoting 0/3 only, no Sniffer or full Python compatibility. Defaults: 16 MiB input, 32 MiB output, 64 MiB retained, 1 MiB fields and 100,000 cells. Private implementation/types ship inside safe-bash; see the [flags, limits and runtime profile](https://github.com/poe-platform/poe-code/blob/main/packages/safe-bash-command-csvcut/README.md). |
-| `csvgrep` | `/commands/csvgrep`: opt-in `csvgrepCommands({ limits?, replace? })` and equivalent `csvgrep(context, { columns, match?, regex?, file?, any?, invert?, dialect?, filePath? }, { limits? })`. Preserves CSV rows/headers with UTF-8-sig input, comma/LF output and the bounded `bounded-sequence-v1` Python regex subset; full csvkit compatibility is unqualified. Private implementation/types ship inside safe-bash; see the [supported profile](https://github.com/poe-platform/poe-code/blob/main/packages/safe-bash-command-csvgrep/README.md). |
+| `csvcut` | `/commands/csvcut`: `csvcutCommands({ limits?, replace? })` and equivalent `csvcut(context, { include?, exclude?, zero?, names?, headerless?, deleteEmptyRows?, lineNumbers?, addBom?, dialect?, filePath?, encoding?, help?, version? }, { limits? })`. Bounded UTF-8-sig byte input, comma/LF output and literal VFS paths; csvkit 2.2.0 selector candidate, permissive-v1 reader, quoting 0/3 only, no Sniffer or full Python compatibility. Defaults: 16 MiB input, 32 MiB output, 64 MiB retained, 1 MiB fields and 100,000 cells. Private implementation/types ship inside safe-bash; see the [flags, limits and runtime profile](https://github.com/poe-platform/poe-code/blob/main/packages/safe-bash-command-csvcut/README.md). |
+| `csvgrep` | `/commands/csvgrep`: `csvgrepCommands({ limits?, replace? })` and equivalent `csvgrep(context, { columns, match?, regex?, file?, any?, invert?, dialect?, filePath? }, { limits? })`. Preserves CSV rows/headers with UTF-8-sig input, comma/LF output and the bounded `bounded-sequence-v1` Python regex subset; full csvkit compatibility is unqualified. Private implementation/types ship inside safe-bash; see the [supported profile](https://github.com/poe-platform/poe-code/blob/main/packages/safe-bash-command-csvgrep/README.md). |
 | `fold` | `/commands/fold`: opt-in `foldCommands({ locale?, limits?, replace? })` and `fold(context, { width?, mode?, spaces?, files?, locale?, limits? })` for byte streams and literal VFS paths. Supports column, character and byte counting with a pinned Unicode 17 profile or explicit C decoding. Use `replace: true` with `agentCommands()` to replace its existing fold implementation; defaults are unchanged. Private implementation/types ship inside safe-bash; see the [supported profile](https://github.com/poe-platform/poe-code/blob/main/packages/safe-bash-command-fold/README.md). |
 | `playwright-cli` | Standard browser commands, storage state, native snapshots, recordings, and traces through a host-owned adapter. Completed actions retain their live session when a failed checkpoint confirms safe cleanup. [Sessions and host capabilities](src/contracts/playwright-sessions.md). [Optional Cloudflare adapter and portable profiles](https://github.com/poe-platform/poe-code/blob/main/packages/safe-playwright-cloudflare/README.md). `installPlaywrightNetworkPolicy` from `/playwright` supports browser-native redirects with per-hop bounded host HTTP fetch and independent direct HTTP/WebSocket denial. `bindPlaywrightRoutePolicy(context, { ownsRequest, admit, fetch }, limits)` lets standard route mocks and header rewrites use that host policy, with admission before matching and bounded response leases. Cloudflare guardrails do not establish WebRTC/UDP denial or all-protocol accounting; hosts requiring those guarantees must refuse this integration. [Network policy and lifecycle](src/contracts/playwright-network-policy.md). |
 
@@ -425,7 +437,7 @@ The command is qualified for Node ESM; actual browser/workerd engines remain
 unverified. See the [flags, limits and supported profile](https://github.com/poe-platform/poe-code/blob/main/packages/safe-bash-command-diff3/README.md).
 
 
-`/commands/htmlq` exports opt-in `htmlqCommands({ limits?, replace? })`,
+`/commands/htmlq` exports `htmlqCommands({ limits?, replace? })`,
 equivalent `htmlq(context, { selector: "p", text: true })` SDK execution (or
 literal `argv`) and the inert HTML
 byte-stream engine. Use `htmlq 'div > p' -t -f /input.html`; attribute, text and
@@ -462,7 +474,9 @@ For a custom same-isolate Python JSPI host, use `createPythonJspiExecutor` from
 the same Python entry with an explicit loader, precompiled Wasm modules and
 pinned, authenticated runtime assets; follow the [static host recipe](src/contracts/python-jspi.md).
 Invocation-owned [host services and Python shell calls](docs/python-host-services.md)
-can be enabled explicitly through `createCapabilities`.
+can be enabled explicitly through `createCapabilities`. Python's `maxTransferBytes`
+is unlimited when omitted or set to `Infinity`; finite values enforce a per-request
+I/O ceiling. Worker transports use finite chunks independently of that ceiling.
 Native I/O uses the caller's asynchronous filesystem without workspace copying,
 Node worker threads or a SAB request/reply bridge. This path is qualified with
 installed public-package artifacts in local workerd, not a verified Cloudflare
@@ -471,12 +485,14 @@ is cooperative; it neither preempts CPU-only loops nor establishes confinement.
 
 Storage can be in memory, a rooted host directory, S3-compatible storage, or WebDAV,
 with read-only wrappers, mounts, and overlays. Choose and configure it explicitly;
-see the [filesystem guide](../safe-fs/README.md).
+see the [filesystem guide](../safe-fs/README.md). The root export includes
+`createS3HttpTransport` in Node, browsers, and Workers; portable runtimes use fetch.
 
 ### Run JavaScript with SafeJS
 
-Plug SafeJS into `node`; nothing starts a native Node.js subprocess or loads a
-runtime automatically. SafeJS is the execution engine, not a separate shell command.
+Register `nodeCommands()` to load SafeJS on first execution, or inject a runtime
+as below. No native Node.js subprocess is started. SafeJS is the execution engine,
+not a separate shell command.
 
 ```ts
 import { Shell, agentCommands, createMemoryFileSystem, nodeCommands } from "@poe-platform/safe-bash";
@@ -532,7 +548,8 @@ source. `node --require ./setup.cjs` / `node -r ./setup.cjs` preloads virtual
 CommonJS modules before the program; repeated flags run in order from virtual cwd.
 Explicit `.cjs`, `.js`, and `.json` module paths share an invocation-local cache,
 including nested relative dependencies, and retain source limits, interpreter
-budgets, and cancellation. Other synchronous fs operations, package search,
+budgets, and cancellation. Synchronous writes, append, mkdir, readdir, stat/lstat,
+exists, unlink, rm, rename, and copyFile also use the VFS. Package search,
 ESM loading, `process.exit()`, and native module fallback are unavailable.
 Pass `limits` for source/input/output bytes, timeout, and interpreter budgets;
 see [defaults and configuration](src/commands/node/README.md#configuration).
@@ -646,13 +663,18 @@ sequences. `SECONDS` tracks elapsed whole seconds and accepts a new starting
 value. Assignments through arithmetic, `read`, and `printf -v` retain these
 behaviors; unsetting either variable removes its special behavior.
 
+HTML, YAML, CSV and XML query limits, plus `xan`, `bc`, `less`, `sponge`, SafeJS
+and LLM provider quotas accept `Infinity`; explicit `undefined` retains the default.
+
 Execution quotas are unlimited by default. Set individual `limits` to opt in;
 supplying one does not enable other quotas. Available quotas are `maxParseUnits`,
-`maxInputBytes`, `maxOutputBytes`, `maxCommands`, `maxFileSystemOperations`,
+`maxInputBytes`, `maxOutputBytes`, `maxPipelineBytes`, `maxCommands`, `maxFileSystemOperations`,
 `maxPathComponents`, `maxPathnameComponents`, `maxRedirects`, `maxPipelineStages`, `maxLoopIterations`,
 `maxSubstitutionDepth`, `maxFunctionDepth`, `maxSourceBytes`, `maxExpansionFields`, `maxExpansionBytes`,
 `maxWallClockMs`, and `maxCpuMs`. The CPU deadline measures elapsed time including
-waits at cooperative checkpoints. `pipeHighWaterMark` defaults to 64 KiB for
+waits at cooperative checkpoints. `maxPipelineBytes` counts bytes written across
+all pipeline edges in one invocation, including nested pipelines; terminal output
+does not consume this quota. `pipeHighWaterMark` defaults to 64 KiB for
 streaming backpressure and does not cap total work. `cloudflareWorkerLimits` is
 an explicit restrictive preset. Background job quotas (`maxJobs`, `maxWaiters`,
 `maxCleanupsPerJob`) are also unlimited unless supplied. `maxFunctionDepth` limits
@@ -732,7 +754,8 @@ time/environment commands, metadata, diff/patch, LLM providers, `yes`, `less`,
 `sponge`, `bc`, `htmlq`, `which`, `getopt`, `factor`, and `tsort`
 have unlimited resource budgets by default. Set individual family limits to opt
 in; setting one limit leaves the others unlimited. Explicit `Infinity` also
-disables a limit. Standard and agent command factories accept `maxRecursiveDirectoryDepth`
+disables a limit. Shell limit overrides set to `undefined` preserve the inherited
+value (or the default when none was set). Standard and agent command factories accept `maxRecursiveDirectoryDepth`
 for recursive filesystem traversal; it defaults to unlimited. Shell helpers expose `maxCdWork`, `maxCdProbes`,
 `maxCdPathBytes`, `maxCdPathComponents`, `maxDirectoryStackEntries`,
 `maxDirectoryStackBytes`, `maxDirectoryDiagnosticBytes`, `maxDirectoryStackOutputBytes`, `maxSyntaxDepth`, `maxAdmittedHandles`, `maxDescriptorOperations`, `maxDescriptorReadBytes`, `maxGlobstarStates`, `maxGlobstarDepth` and
@@ -785,7 +808,7 @@ There are no package-specific runtime environment switches. Supply these through
 | `PATH` | Virtual script lookup and `which`; never a host executable search. |
 | `IFS` | Field splitting and `read`; defaults to space, tab, and newline. |
 | `LC_ALL`, `LC_CTYPE`, `LC_COLLATE`, `LANG` | Character and collation behavior where supported; locale support varies by command. |
-| `TMPDIR` | `mktemp` directory; defaults to `/tmp`, which must exist in the VFS. |
+| `TMPDIR` | `mktemp` directory; defaults to `/tmp`, created in a writable VFS when needed. Explicit directories must exist. |
 | `TZ` | `date` and `touch` timezone. `date` otherwise uses `timeEnv.defaultTimeZone`; `touch` defaults to `UTC`. |
 | `QUOTING_STYLE` | `stat` filename quoting: `literal`, `shell-always`, or `shell-escape-always`. |
 
@@ -811,10 +834,14 @@ and credential protections remain in effect.
 ## Limitations
 
 - This is a Bash-like interpreter, not full Bash or POSIX certification. No
-  background jobs/job control, `exec`, process substitution,
+  background jobs/job control, `exec`,
   associative arrays, or C-style `for ((…))` loops. `shopt` supports `dotglob`,
-  `globstar`, `nullglob`, `nocaseglob`, and `nocasematch`, plus `-o` for supported
+  `globstar`, `nullglob`, `nocaseglob`, `nocasematch`, `lastpipe`, `failglob`,
+  `inherit_errexit`, and `expand_aliases`, plus `-o` for supported
   `set` options. `shopt -s extglob` enables extended patterns, including parameter trimming.
+  Process substitutions use temporary files in virtual `TMPDIR` (default `/tmp`),
+  requiring a writable temporary directory. They buffer data rather than running
+  as concurrent OS processes, and remove their temporary files after use.
 - Utilities implement subsets of their native counterparts' flags and behavior.
   There is no `git`, `npm`, `npx`, or fallback to installed host programs.
   The opt-in `node` command is not a general Node.js runtime.

package/dist/image-ast/ast.d.ts

@@ -179,6 +179,7 @@ export interface SharpInputOptions {
     readonly ignoreIcc?: boolean;
     readonly failOnError?: boolean;
     readonly failOn?: "none" | "truncated" | "error" | "warning";
+    readonly maxDecodeDimension?: number;
     readonly raw?: {
         readonly width: number;
         readonly height: number;

package/dist/image-ast/browser/ast.d.ts

@@ -179,6 +179,7 @@ export interface SharpInputOptions {
     readonly ignoreIcc?: boolean;
     readonly failOnError?: boolean;
     readonly failOn?: "none" | "truncated" | "error" | "warning";
+    readonly maxDecodeDimension?: number;
     readonly raw?: {
         readonly width: number;
         readonly height: number;

package/dist/image-ast/browser/codecs/jpeg.d.ts

@@ -1,7 +1,7 @@
-import type { ImageMetadata, RgbaImage } from "../ast.js";
+import type { ImageMetadata, RgbaImage, SharpInputOptions } from "../ast.js";
 export declare function isJpegBytes(bytes: Uint8Array): boolean;
 export declare function readJpegMetadata(bytes: Uint8Array): ImageMetadata;
-export declare function decodeJpegImage(bytes: Uint8Array): RgbaImage;
+export declare function decodeJpegImage(bytes: Uint8Array, options?: SharpInputOptions): RgbaImage;
 export declare function encodeJpegImage(img: RgbaImage, options?: {
     readonly quality?: number;
     readonly density?: number;

package/dist/image-ast/codecs/jpeg.d.ts

@@ -1,7 +1,7 @@
-import type { ImageMetadata, RgbaImage } from "../ast.js";
+import type { ImageMetadata, RgbaImage, SharpInputOptions } from "../ast.js";
 export declare function isJpegBytes(bytes: Uint8Array): boolean;
 export declare function readJpegMetadata(bytes: Uint8Array): ImageMetadata;
-export declare function decodeJpegImage(bytes: Uint8Array): RgbaImage;
+export declare function decodeJpegImage(bytes: Uint8Array, options?: SharpInputOptions): RgbaImage;
 export declare function encodeJpegImage(img: RgbaImage, options?: {
     readonly quality?: number;
     readonly density?: number;