@poe-platform/safe-bash 0.1.802 → 0.1.804

package/dist/safe-bash/commands/node/index.browser.js

@@ -2,14 +2,13 @@ import {
   createSafeJsNodeCommand,
   createSafeJsNodeCommands,
   safeJsNodeCommands
-} from "../../chunks/chunk-RSTHLAF3.js";
-import "../../chunks/chunk-PH63PLPZ.js";
-import "../../chunks/chunk-D3ANYGMC.js";
-import "../../chunks/chunk-NZQXYWA3.js";
-import "../../chunks/chunk-74GHTNJA.js";
-import "../../chunks/chunk-E7OYNDGL.js";
-import "../../chunks/chunk-IWDICZVK.js";
-import "../../chunks/chunk-B7TAL7S5.js";
+} from "../../chunks/chunk-B2Z73HTZ.js";
+import "../../chunks/chunk-TC3F4UFF.js";
+import "../../chunks/chunk-UV4X32QU.js";
+import "../../chunks/chunk-62BOHHJT.js";
+import "../../chunks/chunk-4KTMKD5W.js";
+import "../../chunks/chunk-V7QT2RWC.js";
+import "../../chunks/chunk-PTAEWLSE.js";
 export {
   createSafeJsNodeCommand as createNodeCommand,
   createSafeJsNodeCommands as createNodeCommands,

package/dist/safe-bash/commands/node/index.js

@@ -6,14 +6,14 @@ import { NodeHost } from "./host.js";
 import { NodeOwner } from "./lifecycle.js";
 import { buildNodeProgram } from "./program.js";
 import { createSafeJsNodeCommand } from "./safejs.js";
-import { unconfiguredNodeCommand } from "./unconfigured.js";
+import { defaultNodeCommand } from "./default-runtime.js";
 import { NODE_PROFILE, NodeProfileError, NodeUsageError, nodeLimits, resolveNodeLimits } from "./types.js";
 import { environment, grants, record, text } from "./values.js";
 export { NODE_PROFILE, NodeProfileError, NodeUsageError, nodeLimits } from "./types.js";
 export { NODE_ENGINE_ABI } from "./worker-types.js";
 function commandConfiguration(options) {
     if (options === undefined)
-        return { definitions: Object.freeze([unconfiguredNodeCommand]), replace: false };
+        return { definitions: Object.freeze([defaultNodeCommand]), replace: false };
     const settings = record(options, [], ["provider", "grants", "runtime", "limits", "replace"]);
     if (Object.hasOwn(settings, "replace") && typeof settings.replace !== "boolean")
         throw new TypeError("node replace must be boolean");
@@ -45,7 +45,7 @@ function providerValue(value) {
 }
 export function createNodeCommand(options) {
     if (options === undefined)
-        return unconfiguredNodeCommand;
+        return defaultNodeCommand;
     const selected = record(options, [], ["provider", "grants", "runtime", "limits"]);
     if (Object.hasOwn(selected, "runtime")) {
         const settings = record(selected, ["runtime"], ["limits"]);

package/dist/safe-bash/commands/node/path.js

@@ -17,7 +17,7 @@ export function createNodePathModule(runtime, cwd) {
         return normalized.length > 1 && normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
     };
     const path = {
-        ...Object.fromEntries(Object.entries(posixPath).map(([name, operation]) => [name, runtime.declareHostOperation(operation, "read-side-effect")])),
+        ...Object.fromEntries(Object.entries(posixPath).map(([name, operation]) => [name, typeof operation === "function" ? runtime.declareHostOperation(operation, "read-side-effect") : operation])),
         normalize: runtime.declareHostOperation((value) => {
             if (typeof value !== "string")
                 throw new TypeError("path must be a string");

package/dist/safe-bash/commands/node/preload.d.ts

@@ -1,2 +1,2 @@
-export declare const nodeRequireSource = "\nconst __safeBashModuleCache = new Map();\nconst __safeBashMakeRequire = base => name => {\n  const path = __safeBashModulePath(base, name);\n  if (path === null) return __safeBashRequire(name);\n  if (__safeBashModuleCache.has(path)) return __safeBashModuleCache.get(path).exports;\n  let source;\n  try { source = __safeBashModuleRead(path); }\n  catch (error) {\n    if (error.code !== \"ENOENT\") throw error;\n    const missing = new Error(\"Cannot find module '\" + name + \"'\");\n    missing.code = \"MODULE_NOT_FOUND\";\n    throw missing;\n  }\n  if (source.startsWith(\"\\uFEFF\")) source = source.slice(1);\n  const module = { exports: {} };\n  if (path.endsWith(\".json\")) {\n    module.exports = JSON.parse(source);\n    __safeBashModuleCache.set(path, module);\n    return module.exports;\n  }\n  if (source.startsWith(\"#!\")) {\n    const newline = source.indexOf(\"\\n\");\n    source = newline < 0 ? \"\" : source.slice(newline);\n  }\n  __safeBashModuleCache.set(path, module);\n  try {\n    const directory = path.slice(0, path.lastIndexOf(\"/\")) || \"/\";\n    (function(exports, require, module, __filename, __dirname) {\n      eval(source);\n    }).call(module.exports, module.exports, __safeBashMakeRequire(directory), module, path, directory);\n  } catch (error) {\n    __safeBashModuleCache.delete(path);\n    throw error;\n  }\n  return module.exports;\n};\nconst require = __safeBashMakeRequire(__safeBashEntryDirectory);\nfor (const name of __safeBashPreloads) __safeBashMakeRequire(__safeBashCwd)(name);\n";
+export declare const nodeRequireSource = "\nconst __safeBashModuleCache = new Map();\nconst __safeBashMakeRequire = base => name => {\n  const path = __safeBashModulePath(base, name);\n  if (path === null) {\n    if (!Object.hasOwn(__safeBashModules, name)) throw new TypeError(\"Unsupported node module; use fs, node:fs, fs/promises, node:fs/promises, path or node:path\");\n    return __safeBashModules[name];\n  }\n  if (__safeBashModuleCache.has(path)) return __safeBashModuleCache.get(path).exports;\n  let source;\n  try { source = __safeBashModuleRead(path); }\n  catch (error) {\n    if (error.code !== \"ENOENT\") throw error;\n    const missing = new Error(\"Cannot find module '\" + name + \"'\");\n    missing.code = \"MODULE_NOT_FOUND\";\n    throw missing;\n  }\n  if (source.startsWith(\"\\uFEFF\")) source = source.slice(1);\n  const module = { exports: {} };\n  if (path.endsWith(\".json\")) {\n    module.exports = JSON.parse(source);\n    __safeBashModuleCache.set(path, module);\n    return module.exports;\n  }\n  if (source.startsWith(\"#!\")) {\n    const newline = source.indexOf(\"\\n\");\n    source = newline < 0 ? \"\" : source.slice(newline);\n  }\n  __safeBashModuleCache.set(path, module);\n  try {\n    const directory = path.slice(0, path.lastIndexOf(\"/\")) || \"/\";\n    (function(exports, require, module, __filename, __dirname) {\n      eval(source);\n    }).call(module.exports, module.exports, __safeBashMakeRequire(directory), module, path, directory);\n  } catch (error) {\n    __safeBashModuleCache.delete(path);\n    throw error;\n  }\n  return module.exports;\n};\nconst require = __safeBashMakeRequire(__safeBashEntryDirectory);\nfor (const name of __safeBashPreloads) __safeBashMakeRequire(__safeBashCwd)(name);\n";
 //# sourceMappingURL=preload.d.ts.map

package/dist/safe-bash/commands/node/preload.js

@@ -3,7 +3,10 @@ export const nodeRequireSource = `
 const __safeBashModuleCache = new Map();
 const __safeBashMakeRequire = base => name => {
   const path = __safeBashModulePath(base, name);
-  if (path === null) return __safeBashRequire(name);
+  if (path === null) {
+    if (!Object.hasOwn(__safeBashModules, name)) throw new TypeError("Unsupported node module; use fs, node:fs, fs/promises, node:fs/promises, path or node:path");
+    return __safeBashModules[name];
+  }
   if (__safeBashModuleCache.has(path)) return __safeBashModuleCache.get(path).exports;
   let source;
   try { source = __safeBashModuleRead(path); }

package/dist/safe-bash/commands/node/quickjs.d.ts

@@ -0,0 +1,2 @@
+export * from "../../../safe-bash-command-node/index.js";
+//# sourceMappingURL=quickjs.d.ts.map

package/dist/safe-bash/commands/node/quickjs.js

@@ -0,0 +1,2 @@
+export * from "../../../safe-bash-command-node/index.js";
+//# sourceMappingURL=quickjs.js.map

package/dist/safe-bash/commands/node/safejs.js

@@ -12,10 +12,11 @@ import { createNodePathModule } from "./path.js";
 import { createSafeJsCommands } from "../safejs/runtime.js";
 import { commandLimits } from "../safejs/options.js";
 import { nodeEnvironment } from "./environment.js";
-import { unconfiguredNodeCommand } from "./unconfigured.js";
+import { defaultNodeCommand } from "./default-runtime.js";
+import { FsError } from "@poe-platform/safe-fs/core";
 export function createSafeJsNodeCommands(options) {
     if (options === undefined)
-        return Object.freeze([unconfiguredNodeCommand]);
+        return Object.freeze([defaultNodeCommand]);
     const settings = record(options, "node options");
     onlyKeys(settings, ["runtime", "limits", "replace"]);
     if (Object.hasOwn(settings, "replace") && typeof settings.replace !== "boolean")
@@ -134,7 +135,7 @@ function invocation(args, metadata) {
 }
 export function createSafeJsNodeCommand(options) {
     if (options === undefined)
-        return unconfiguredNodeCommand;
+        return defaultNodeCommand;
     const settings = record(options, "node options");
     onlyKeys(settings, ["runtime", "limits"]);
     if (settings.runtime === undefined || settings.runtime === null)
@@ -195,11 +196,29 @@ ${selected.check ? body : `eval(${JSON.stringify(body)});`}
             const nodeFs = {
                 ...fs,
                 promises: fs,
+                ...Object.fromEntries(["readFile", "writeFile", "appendFile", "mkdir", "readdir", "stat", "lstat", "rm", "rename", "copyFile"].filter(name => typeof fs[name] === "function").map(name => [
+                    name + "Sync", options.runtime.declareHostOperation(fs[name].bind(undefined), "read-side-effect", { awaitResult: true }),
+                ])),
+                existsSync: options.runtime.declareHostOperation(async (path) => {
+                    try {
+                        await fs.stat(path);
+                        return true;
+                    }
+                    catch {
+                        lifecycle.signal.throwIfAborted();
+                        return false;
+                    }
+                }, "read-side-effect", { awaitResult: true }),
+                unlinkSync: options.runtime.declareHostOperation(async (path) => {
+                    if (typeof path !== "string")
+                        throw new TypeError("path must be a string");
+                    lifecycle.signal.throwIfAborted();
+                    if (!lifecycle.fs.unlink)
+                        throw new FsError("ENOTSUP", { path, syscall: "unlink" });
+                    await lifecycle.fs.unlink(resolvePath(command.cwd, path), { signal: lifecycle.signal });
+                }, "read-side-effect", { awaitResult: true }),
                 ...(typeof fs.readFile === "function" ? {
                     readFile: nodeReadFile(options, fs, lifecycle.signal, lifecycle.fail, pending),
-                    readFileSync: options.runtime.declareHostOperation(
-                    // Give the synchronous facade its own declaration so readFile stays asynchronous.
-                    fs.readFile.bind(undefined), "read-side-effect", { awaitResult: true }),
                 } : {}),
             };
             modules.fs = { ...nodeFs, default: nodeFs };
@@ -245,12 +264,7 @@ ${selected.check ? body : `eval(${JSON.stringify(body)});`}
                         }
                         return resolvePath(base, name);
                     }, "read-side-effect"),
-                    __safeBashRequire: options.runtime.declareHostOperation((name) => {
-                        const module = typeof name === "string" ? requiredModules.get(name) : undefined;
-                        if (!module)
-                            throw new TypeError("Unsupported node module; use fs, node:fs, fs/promises, node:fs/promises, path or node:path");
-                        return module;
-                    }, "read-side-effect"),
+                    __safeBashModules: Object.fromEntries(requiredModules),
                 },
             };
         },

package/dist/safe-bash/commands/op/index.browser.js

@@ -19,9 +19,8 @@ import {
   restoreEnvironment,
   selectOpBackendContext,
   selectOpGlobalFlags
-} from "../../chunks/chunk-UE5KZDEK.js";
-import "../../chunks/chunk-E7OYNDGL.js";
-import "../../chunks/chunk-B7TAL7S5.js";
+} from "../../chunks/chunk-ZKYKJCZZ.js";
+import "../../chunks/chunk-PTAEWLSE.js";
 export {
   captureEnvironment,
   createDocumentHandlers,

package/dist/safe-bash/commands/op/index.d.ts

@@ -1,13 +1,2 @@
-import type { CommandDefinition, VirtualShellPlugin } from "../../contracts/index.js";
-import { evalSyncOp, type OpCommandContext, type OpCommandsOptions } from "../../internal/op/index.js";
 export * from "../../internal/op/index.js";
-export { captureEnvironment, createDocumentHandlers, createEnvironmentHandlers, createItemHandlers, createObjectBackend, createOp, createOpTextCodec, createSecretHandlers, parseCommand, parseOpFileMode, parseSecretReference, renderOpHelp, renderOpOutput, restoreEnvironment, selectOpBackendContext, selectOpGlobalFlags, } from "../../internal/op/index.js";
-export { evalSyncOp };
-export declare function createOpCommand(options?: OpCommandsOptions): CommandDefinition & {
-    execute(context: OpCommandContext): Promise<{
-        exitCode: number;
-    }>;
-};
-export declare function createOpCommands(options?: OpCommandsOptions): readonly [CommandDefinition];
-export declare function opCommands(options?: OpCommandsOptions): VirtualShellPlugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/safe-bash/commands/op/index.js

@@ -1,86 +1,2 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
-
-// packages/safe-bash/src/commands/internal.ts
-var internal_exports = {};
-__reExport(internal_exports, internal_star);
-import * as internal_star from "../../../safe-bash-io-engine/internal.js";
-
 // packages/safe-bash/src/commands/op/index.ts
-import {
-  createOpCommand as createRawOpCommand,
-  createOpCommands as createRawOpCommands,
-  evalSyncOp
-} from "../../../safe-bash-command-op/index.js";
 export * from "../../../safe-bash-command-op/index.js";
-import {
-  captureEnvironment,
-  createDocumentHandlers,
-  createEnvironmentHandlers,
-  createItemHandlers,
-  createObjectBackend,
-  createOp,
-  createOpTextCodec,
-  createSecretHandlers,
-  parseCommand,
-  parseOpFileMode,
-  parseSecretReference,
-  renderOpHelp,
-  renderOpOutput,
-  restoreEnvironment,
-  selectOpBackendContext,
-  selectOpGlobalFlags
-} from "../../../safe-bash-command-op/index.js";
-function createOpCommand(options = {}) {
-  const def = createRawOpCommand(options);
-  internal_exports.builtInDirectContextExecutors.add(def.execute);
-  return def;
-}
-function createOpCommands(options = {}) {
-  const defs = createRawOpCommands(options);
-  for (let i = 0; i < defs.length; i++) internal_exports.builtInDirectContextExecutors.add(defs[i].execute);
-  return defs;
-}
-function opCommands(options = {}) {
-  const commands = createOpCommands(options);
-  return {
-    name: "op-commands",
-    setup(host) {
-      for (const command of commands) host.commands.register(command, { replace: options.replace ?? false });
-    }
-  };
-}
-internal_exports.syncCommandEvaluators.evalSyncOp = evalSyncOp;
-export {
-  captureEnvironment,
-  createDocumentHandlers,
-  createEnvironmentHandlers,
-  createItemHandlers,
-  createObjectBackend,
-  createOp,
-  createOpCommand,
-  createOpCommands,
-  createOpTextCodec,
-  createSecretHandlers,
-  evalSyncOp,
-  opCommands,
-  parseCommand,
-  parseOpFileMode,
-  parseSecretReference,
-  renderOpHelp,
-  renderOpOutput,
-  restoreEnvironment,
-  selectOpBackendContext,
-  selectOpGlobalFlags
-};

package/dist/safe-bash/commands/pandoc/index.browser.js

@@ -0,0 +1,44 @@
+import {
+  createPandocCommand,
+  createPandocCommands,
+  pandocCommands
+} from "../../chunks/chunk-FAAIR6EJ.js";
+import "../../chunks/chunk-OHML2BEU.js";
+import {
+  init_platform
+} from "../../chunks/chunk-PTAEWLSE.js";
+
+// packages/safe-bash/src/commands/pandoc/index.ts
+init_platform();
+import { AstError, ExecutionContext, PandocError, assertNever, convert, convertSync, coreFormats, createCiteprocFilterCapability, createExecutionContext, createFormatInspectionCommand, createFormatRegistry, createJsonFilterCapability, createLuaFilterCapability, createStandalonePandocCommand, defaultLimits, evalSyncPandoc, formatCapabilities, inspectCommand, inspectFormats, normalizeDocument, normalizeDocumentCooperatively, parseConversionArgs, pdfReader, readDocument, resolveConversionArgs, writeDocument } from "../../../safe-bash-command-pandoc/index.js";
+export {
+  AstError,
+  ExecutionContext,
+  PandocError,
+  assertNever,
+  convert,
+  convertSync,
+  coreFormats,
+  createCiteprocFilterCapability,
+  createExecutionContext,
+  createFormatInspectionCommand,
+  createFormatRegistry,
+  createJsonFilterCapability,
+  createLuaFilterCapability,
+  createPandocCommand,
+  createPandocCommands,
+  createStandalonePandocCommand,
+  defaultLimits,
+  evalSyncPandoc,
+  formatCapabilities,
+  inspectCommand,
+  inspectFormats,
+  normalizeDocument,
+  normalizeDocumentCooperatively,
+  pandocCommands,
+  parseConversionArgs,
+  pdfReader,
+  readDocument,
+  resolveConversionArgs,
+  writeDocument
+};

package/dist/safe-bash/commands/pandoc/index.d.ts

@@ -1,4 +1,3 @@
 export * from "../../../safe-bash-command-pandoc/index.js";
-export * from "./implementation.js";
 export { createPandocCommand, createPandocCommands, pandocCommands } from "../../lazy-optional.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/safe-bash/commands/pandoc/index.js

@@ -1,4 +1,3 @@
 export * from "../../../safe-bash-command-pandoc/index.js";
-export * from "./implementation.js";
 export { createPandocCommand, createPandocCommands, pandocCommands } from "../../lazy-optional.js";
 //# sourceMappingURL=index.js.map

package/dist/safe-bash/commands/portable-random.d.ts

@@ -1,2 +1,2 @@
-export declare function randomInteger(maximum: number): number;
+export * from "../../safe-bash-metadata-engine/random.js";
 //# sourceMappingURL=portable-random.d.ts.map

package/dist/safe-bash/commands/portable-random.js

@@ -1,13 +1,2 @@
-export function randomInteger(maximum) {
-    const range = 0x1_0000_0000;
-    if (!Number.isSafeInteger(maximum) || maximum < 1 || maximum > range) {
-        throw new RangeError("Random integer maximum must be an integer from 1 to 2^32");
-    }
-    const limit = Math.floor(range / maximum) * maximum;
-    const sample = new Uint32Array(1);
-    do {
-        globalThis.crypto.getRandomValues(sample);
-    } while (sample[0] >= limit);
-    return sample[0] % maximum;
-}
+export * from "../../safe-bash-metadata-engine/random.js";
 //# sourceMappingURL=portable-random.js.map

package/dist/safe-bash/commands/pr/index.browser.js

@@ -3,8 +3,8 @@ import {
   createPrCommands,
   evalSyncPr,
   prCommands
-} from "../../chunks/chunk-CHYGPFVM.js";
-import "../../chunks/chunk-B7TAL7S5.js";
+} from "../../chunks/chunk-22SX3F2R.js";
+import "../../chunks/chunk-PTAEWLSE.js";
 export {
   createPrCommand,
   createPrCommands,

package/dist/safe-bash/commands/python/docker-runner.js

@@ -11,7 +11,7 @@ export async function runDockerPythonExecutor(options) {
     const input = process.stdin;
     const output = process.stdout;
     let buffered = new Uint8Array(0);
-    let limit = 16777216;
+    let limit = Infinity;
     let endpoint;
     let unsubscribe;
     let retirement;
@@ -52,9 +52,10 @@ export async function runDockerPythonExecutor(options) {
             return;
         }
         if (frame?.type !== 'start' || !Number.isSafeInteger(frame.maxTransferBytes) || frame.maxTransferBytes < 1 || frame.maxTransferBytes > 1048576
-            || !Number.isSafeInteger(frame.maxFrameBytes) || frame.maxFrameBytes < 65536 || frame.maxFrameBytes > 16777216)
+            || (frame.maxFrameBytes !== null && (!Number.isSafeInteger(frame.maxFrameBytes) || frame.maxFrameBytes < 65536)))
             throw new PythonFailure('transport-unavailable');
-        limit = frame.maxFrameBytes;
+        // JSON null explicitly represents an unlimited frame ceiling.
+        limit = frame.maxFrameBytes === null ? Infinity : frame.maxFrameBytes;
         const shared = new SharedArrayBuffer(8 + frame.maxTransferBytes * 6 + 65536);
         control = new Int32Array(shared, 0, 2);
         payload = new Uint8Array(shared, 8);

package/dist/safe-bash/commands/python/docker.d.ts

@@ -10,6 +10,7 @@ export interface DockerPythonExecutorOptions {
     readonly maxConcurrentExecutors: number;
     readonly temporaryBytes?: number;
     readonly controlTimeoutMs?: number;
+    /** Omitted or Infinity disables the frame-size ceiling. */
     readonly maxFrameBytes?: number;
 }
 export declare function createDockerPythonExecutorPool(options: DockerPythonExecutorOptions): Promise<PythonExecutorPool>;

package/dist/safe-bash/commands/python/docker.js

@@ -24,6 +24,9 @@ export async function createDockerPythonExecutorPool(options) {
     if (typeof options.image !== 'string' || !options.image.startsWith('sha256:') || options.image.length !== 71
         || [...options.image.slice(7)].some(character => !'0123456789abcdef'.includes(character)))
         throw new TypeError('An immutable Docker image ID is required');
+    const maxFrameBytes = options.maxFrameBytes ?? Infinity;
+    if (maxFrameBytes !== Infinity)
+        boundedInteger(maxFrameBytes, 65536, Number.MAX_SAFE_INTEGER);
     const configuration = Object.freeze({
         socketPath: options.socketPath, image: options.image,
         memoryBytes: boundedInteger(options.memoryBytes, 67108864, Number.MAX_SAFE_INTEGER),
@@ -32,7 +35,7 @@ export async function createDockerPythonExecutorPool(options) {
         maxConcurrentExecutors: boundedInteger(options.maxConcurrentExecutors, 1, Number.MAX_SAFE_INTEGER),
         temporaryBytes: boundedInteger(options.temporaryBytes ?? 16777216, 1, Number.MAX_SAFE_INTEGER),
         controlTimeoutMs: boundedInteger(options.controlTimeoutMs ?? 10000, 1, 300000),
-        maxFrameBytes: boundedInteger(options.maxFrameBytes ?? 8388608, 65536, 16777216),
+        maxFrameBytes,
     });
     if (!Number.isFinite(configuration.cpus) || configuration.cpus < 0.01 || configuration.cpus > 64)
         throw new RangeError('Invalid Python container CPU quota');
@@ -313,7 +316,7 @@ export async function createDockerPythonExecutorPool(options) {
                         if (retired || settled)
                             return;
                         await send({ type: 'start', invocation: start.invocation, runtimeMount: start.runtimeMount,
-                            maxTransferBytes: start.maxTransferBytes, maxFrameBytes: configuration.maxFrameBytes,
+                            maxTransferBytes: Math.min(start.maxTransferBytes, 65536), maxFrameBytes: configuration.maxFrameBytes === Infinity ? null : configuration.maxFrameBytes,
                             ...(start.packages ? { packages: start.packages } : {}), installOnly: !!start.installOnly,
                         }, true);
                     })().catch(error => fail(error instanceof PythonFailure || start.signal.aborted ? error : new PythonFailure('startup')));

package/dist/safe-bash/commands/python/index.browser.js

@@ -13,23 +13,25 @@ import {
   createPythonPackageEnvironment,
   createPythonPackageManifestStore,
   createPythonShellCapability,
+  installPythonLlmDependencies,
   pythonCommands,
   pythonDocumentPackages,
-  pythonHostFailureCode
-} from "../../chunks/chunk-WDLGKIHD.js";
-import "../../chunks/chunk-HZAMGT5I.js";
+  pythonHostFailureCode,
+  pythonLlmDependencies
+} from "../../chunks/chunk-S4RFUUXO.js";
+import "../../chunks/chunk-RUR6J33T.js";
+import "../../chunks/chunk-67WIFM3N.js";
 import {
   PythonFailure,
   inspectPythonCapabilities
-} from "../../chunks/chunk-LVOBFF4D.js";
-import "../../chunks/chunk-I5HZ4FGE.js";
-import "../../chunks/chunk-7R5BDCG7.js";
-import "../../chunks/chunk-VTH3MLDU.js";
-import "../../chunks/chunk-NZQXYWA3.js";
-import "../../chunks/chunk-74GHTNJA.js";
-import "../../chunks/chunk-E7OYNDGL.js";
-import "../../chunks/chunk-IWDICZVK.js";
-import "../../chunks/chunk-B7TAL7S5.js";
+} from "../../chunks/chunk-Q4FNLOTI.js";
+import "../../chunks/chunk-CL2FCTTO.js";
+import "../../chunks/chunk-62BOHHJT.js";
+import "../../chunks/chunk-DUTAG6ZD.js";
+import "../../chunks/chunk-4KTMKD5W.js";
+import "../../chunks/chunk-OHML2BEU.js";
+import "../../chunks/chunk-V7QT2RWC.js";
+import "../../chunks/chunk-PTAEWLSE.js";
 export {
   PythonFailure,
   PythonPackageConflictError,
@@ -47,7 +49,9 @@ export {
   createPythonPackageManifestStore,
   createPythonShellCapability,
   inspectPythonCapabilities,
+  installPythonLlmDependencies,
   pythonCommands,
   pythonDocumentPackages,
-  pythonHostFailureCode
+  pythonHostFailureCode,
+  pythonLlmDependencies
 };

package/dist/safe-bash/commands/python/index.d.ts

@@ -1,4 +1,3 @@
-import "../../portable-buffer.js";
 import type { CommandContext, CommandDefinition, VirtualShellPlugin } from '../../contracts/index.js';
 import { type PythonPackageOptions, type PythonPackageStart, type PythonPackageEnvironment } from './provisioning.js';
 import { type PythonDiagnosticObserver } from './diagnostics.js';
@@ -33,6 +32,7 @@ export interface PythonCommandsOptions {
     readonly onProgress?: (event: PythonInitializationProgress) => void;
     readonly onDiagnostic?: PythonDiagnosticObserver;
     readonly runtimeMount?: string;
+    /** Per-request I/O ceiling; omitted or Infinity disables it. Worker transports chunk independently. */
     readonly maxTransferBytes?: number;
     readonly maxOpenFiles?: number;
     readonly maxDirectoryEntries?: number;
@@ -81,6 +81,7 @@ export type { PythonExecutorPool, PythonExecutorPoolOptions } from './executor-p
 export { createPythonJspiExecutor } from './jspi.js';
 export type { PythonJspiExecutorOptions, PythonJspiRuntimeConfiguration } from './jspi.js';
 export { createPythonJspiAssets } from './jspi-assets.js';
+export { installPythonLlmDependencies, pythonLlmDependencies, type PythonLlmDependencyArchive } from './llm-dependencies.js';
 export type { PythonJspiAssetsOptions } from './jspi-assets.js';
 export { createPythonJspiTrampoline, createPythonJspiNativeCall, createPythonJspiStatResult } from './jspi-trampoline.js';
 export { PythonFailure, inspectPythonCapabilities } from './diagnostics.js';

package/dist/safe-bash/commands/python/index.js

@@ -1,4 +1,3 @@
-import "../../portable-buffer.js";
 import { PythonFileSystem, PythonStatTranslator } from "@poe-platform/safe-fs/core";
 import { validateExitCode } from '../../contracts/command.js';
 import { openCommandFile } from '../../contracts/filesystem-descriptor.js';
@@ -28,17 +27,19 @@ export function createPythonCommands(options) {
         throw new TypeError('Python onDiagnostic must be a function');
     if (options.environment && options.provisioning)
         throw new TypeError('A borrowed Python environment cannot be combined with provisioning options');
-    const maxTransferBytes = options.maxTransferBytes ?? 65536;
+    const maxTransferBytes = options.maxTransferBytes ?? Infinity;
+    // Transport chunks keep shared buffers finite without imposing an I/O quota.
+    const transferChunkBytes = Math.min(maxTransferBytes, 65536);
     const maxOpenFiles = options.maxOpenFiles;
     const maxConcurrentWorkers = options.maxConcurrentWorkers ?? Infinity;
     const maxInputChunkBytes = options.maxInputChunkBytes ?? Infinity;
-    if (options.maxConcurrentWorkers !== undefined && (!Number.isSafeInteger(maxConcurrentWorkers) || maxConcurrentWorkers < 1))
+    if (maxConcurrentWorkers !== Infinity && (!Number.isSafeInteger(maxConcurrentWorkers) || maxConcurrentWorkers < 1))
         throw new RangeError('Invalid Python worker concurrency limit');
-    if (options.maxInputChunkBytes !== undefined && (!Number.isSafeInteger(maxInputChunkBytes) || maxInputChunkBytes < 1))
+    if (maxInputChunkBytes !== Infinity && (!Number.isSafeInteger(maxInputChunkBytes) || maxInputChunkBytes < 1))
         throw new RangeError('Invalid Python input chunk limit');
     let activeWorkers = 0;
     for (const size of [maxTransferBytes, maxOpenFiles, options.maxDirectoryEntries])
-        if (size !== undefined && (!Number.isSafeInteger(size) || size < 1))
+        if (size !== undefined && size !== Infinity && (!Number.isSafeInteger(size) || size < 1))
             throw new RangeError('Invalid Python resource limit');
     const runtimeMount = options.runtimeMount ?? '/.pyodide-runtime';
     if (!runtimeMount.startsWith('/') || runtimeMount === '/' || runtimeMount.slice(1).includes('/') || runtimeMount.includes('\0') || runtimeMount.split('/').some(part => part === '..' || part === '.'))
@@ -205,7 +206,7 @@ export function createPythonCommands(options) {
             if (options.createCapabilities) {
                 const capabilityInput = { async *[Symbol.asyncIterator]() {
                         while (true) {
-                            const bytes = await dispatch({ op: 'stdin', args: [maxTransferBytes] });
+                            const bytes = await dispatch({ op: 'stdin', args: [transferChunkBytes] });
                             if (!bytes.length)
                                 break;
                             yield Uint8Array.from(bytes);
@@ -318,7 +319,7 @@ export function createPythonCommands(options) {
             else {
                 let shared;
                 try {
-                    shared = new SharedArrayBuffer(8 + maxTransferBytes * 6 + 65536);
+                    shared = new SharedArrayBuffer(8 + transferChunkBytes * 6 + 65536);
                 }
                 catch (reason) {
                     throw reportPythonFailure('transport-unavailable', reason, options.onDiagnostic);
@@ -433,7 +434,7 @@ export function createPythonCommands(options) {
                     }
                     if (settled)
                         return;
-                    const start = { type: 'start', shared, invocation: { command: context.command, args: [...context.args], cwd: context.cwd, env: { ...context.env } }, runtimeMount, maxTransferBytes, ...(packages ? { packages } : {}), installOnly: !!installation };
+                    const start = { type: 'start', shared, invocation: { command: context.command, args: [...context.args], cwd: context.cwd, env: { ...context.env } }, runtimeMount, maxTransferBytes: transferChunkBytes, ...(packages ? { packages } : {}), installOnly: !!installation };
                     signal.throwIfAborted();
                     try {
                         endpoint.postMessage(start);
@@ -506,6 +507,7 @@ export { createPythonPackageCache } from './cache.js';
 export { createPythonExecutorPool } from './executor-pool.js';
 export { createPythonJspiExecutor } from './jspi.js';
 export { createPythonJspiAssets } from './jspi-assets.js';
+export { installPythonLlmDependencies, pythonLlmDependencies } from './llm-dependencies.js';
 export { createPythonJspiTrampoline, createPythonJspiNativeCall, createPythonJspiStatResult } from './jspi-trampoline.js';
 export { PythonFailure, inspectPythonCapabilities } from './diagnostics.js';
 //# sourceMappingURL=index.js.map