@poe-platform/safe-bash 0.1.802 → 0.1.804

package/dist/safe-bash/chunks/{chunk-RSTHLAF3.js → chunk-B2Z73HTZ.js}

@@ -2,32 +2,32 @@ import {
   PublicDiagnostic,
   publicDiagnosticMessage,
   writeDiagnostic
-} from "./chunk-PH63PLPZ.js";
+} from "./chunk-TC3F4UFF.js";
 import {
   byteLength,
   concatBytes,
   decodeBytes,
   encodeBytes,
   isByteEncoding
-} from "./chunk-D3ANYGMC.js";
+} from "./chunk-UV4X32QU.js";
 import {
   dirname,
   posixPath,
   resolvePath,
   yieldTurn
-} from "./chunk-NZQXYWA3.js";
+} from "./chunk-62BOHHJT.js";
 import {
   readBytes,
   toByteSource,
   writeBytes
-} from "./chunk-74GHTNJA.js";
+} from "./chunk-4KTMKD5W.js";
 import {
   UsageError,
   pathOf
-} from "./chunk-E7OYNDGL.js";
+} from "./chunk-V7QT2RWC.js";
 import {
   init_platform
-} from "./chunk-B7TAL7S5.js";
+} from "./chunk-PTAEWLSE.js";
 
 // packages/safe-bash/src/commands/node/browser.ts
 init_platform();
@@ -114,11 +114,14 @@ var unlimitedLimits = Object.freeze({
   dataSize: Infinity
 });
 function commandLimits(options = {}) {
+  const limits = { ...unlimitedLimits };
   for (const [name, value] of Object.entries(options)) {
     if (!Object.hasOwn(unlimitedLimits, name)) throw new TypeError(`Unknown SafeJS limit: ${name}`);
+    if (value === void 0) continue;
     if (value !== Infinity && (!Number.isSafeInteger(value) || value < (name === "timeoutMs" ? 1 : 0))) throw new RangeError(`Invalid SafeJS limit: ${name}`);
+    limits[name] = value;
   }
-  return Object.freeze({ ...unlimitedLimits, ...options });
+  return Object.freeze(limits);
 }
 
 // packages/safe-bash/src/commands/node/buffer.ts
@@ -303,7 +306,10 @@ var nodeRequireSource = `
 const __safeBashModuleCache = new Map();
 const __safeBashMakeRequire = base => name => {
   const path = __safeBashModulePath(base, name);
-  if (path === null) return __safeBashRequire(name);
+  if (path === null) {
+    if (!Object.hasOwn(__safeBashModules, name)) throw new TypeError("Unsupported node module; use fs, node:fs, fs/promises, node:fs/promises, path or node:path");
+    return __safeBashModules[name];
+  }
   if (__safeBashModuleCache.has(path)) return __safeBashModuleCache.get(path).exports;
   let source;
   try { source = __safeBashModuleRead(path); }
@@ -562,7 +568,7 @@ function createNodePathModule(runtime, cwd) {
     return normalized.length > 1 && normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
   };
   const path = {
-    ...Object.fromEntries(Object.entries(posixPath).map(([name, operation]) => [name, runtime.declareHostOperation(operation, "read-side-effect")])),
+    ...Object.fromEntries(Object.entries(posixPath).map(([name, operation]) => [name, typeof operation === "function" ? runtime.declareHostOperation(operation, "read-side-effect") : operation])),
     normalize: runtime.declareHostOperation((value) => {
       if (typeof value !== "string") throw new TypeError("path must be a string");
       return posixPath.join(value);
@@ -976,6 +982,7 @@ function createSafeJsCommands(options, dialect) {
         const budget = runtime.createBudget(budgetOptions);
         const modules = { fs: makeSafeJsFsModule(runtime.makeFsModule, context.fs, { cwd: context.cwd, signal }), stdio, command };
         const prepared = await dialect.prepare?.(source, { ...parsed, file: filename }, modules, {
+          fs: context.fs,
           signal,
           fail,
           sourceBytes,
@@ -1109,21 +1116,29 @@ async function nodeEnvironment(files, inherited, cwd, read, signal, remainingByt
   return Object.assign(values, inherited);
 }
 
-// packages/safe-bash/src/commands/node/unconfigured.ts
+// packages/safe-bash/src/commands/node/default-runtime.ts
 init_platform();
-var unconfiguredNodeCommand = Object.freeze({
+var defaultNodeCommand = Object.freeze({
   name: "node",
-  description: "JavaScript execution requires an explicitly configured runtime",
+  description: "Execute JavaScript with SafeJS and virtual I/O",
   async execute(context) {
     context.signal.throwIfAborted();
-    await context.stderr.write(new TextEncoder().encode("node: requires an injected runtime or provider\n"));
-    return { exitCode: 2 };
+    const { Budget, run, makeFsModule, declareHostOperation, parseSourceModule } = await import("./core-IE3AFIDX.js");
+    context.signal.throwIfAborted();
+    return createSafeJsNodeCommand({ runtime: {
+      run,
+      makeFsModule,
+      declareHostOperation,
+      parseSourceModule,
+      createBudget: (options) => new Budget(options)
+    } }).execute(context);
   }
 });
 
 // packages/safe-bash/src/commands/node/safejs.ts
+import { FsError } from "@poe-platform/safe-fs/core";
 function createSafeJsNodeCommands(options) {
-  if (options === void 0) return Object.freeze([unconfiguredNodeCommand]);
+  if (options === void 0) return Object.freeze([defaultNodeCommand]);
   const settings = record(options, "node options");
   onlyKeys(settings, ["runtime", "limits", "replace"]);
   if (Object.hasOwn(settings, "replace") && typeof settings.replace !== "boolean") throw new TypeError("node replace must be boolean");
@@ -1226,7 +1241,7 @@ complete -F _node_complete node
   return { file: args[index] ?? "-", args: args.slice(index + 1), print: false, help: false, check, preloads, sourceMaps, nodeOptions, envFiles, ...inputType ? { inputType } : {} };
 }
 function createSafeJsNodeCommand(options) {
-  if (options === void 0) return unconfiguredNodeCommand;
+  if (options === void 0) return defaultNodeCommand;
   const settings = record(options, "node options");
   onlyKeys(settings, ["runtime", "limits"]);
   if (settings.runtime === void 0 || settings.runtime === null) throw new TypeError("node requires an injected SafeJS runtime");
@@ -1284,14 +1299,27 @@ ${selected.check ? body : `eval(${JSON.stringify(body)});`}
       const nodeFs = {
         ...fs,
         promises: fs,
+        ...Object.fromEntries(["readFile", "writeFile", "appendFile", "mkdir", "readdir", "stat", "lstat", "rm", "rename", "copyFile"].filter((name) => typeof fs[name] === "function").map((name) => [
+          name + "Sync",
+          options.runtime.declareHostOperation(fs[name].bind(void 0), "read-side-effect", { awaitResult: true })
+        ])),
+        existsSync: options.runtime.declareHostOperation(async (path2) => {
+          try {
+            await fs.stat(path2);
+            return true;
+          } catch {
+            lifecycle.signal.throwIfAborted();
+            return false;
+          }
+        }, "read-side-effect", { awaitResult: true }),
+        unlinkSync: options.runtime.declareHostOperation(async (path2) => {
+          if (typeof path2 !== "string") throw new TypeError("path must be a string");
+          lifecycle.signal.throwIfAborted();
+          if (!lifecycle.fs.unlink) throw new FsError("ENOTSUP", { path: path2, syscall: "unlink" });
+          await lifecycle.fs.unlink(resolvePath(command.cwd, path2), { signal: lifecycle.signal });
+        }, "read-side-effect", { awaitResult: true }),
         ...typeof fs.readFile === "function" ? {
-          readFile: nodeReadFile(options, fs, lifecycle.signal, lifecycle.fail, pending),
-          readFileSync: options.runtime.declareHostOperation(
-            // Give the synchronous facade its own declaration so readFile stays asynchronous.
-            fs.readFile.bind(void 0),
-            "read-side-effect",
-            { awaitResult: true }
-          )
+          readFile: nodeReadFile(options, fs, lifecycle.signal, lifecycle.fail, pending)
         } : {}
       };
       modules.fs = { ...nodeFs, default: nodeFs };
@@ -1343,11 +1371,7 @@ ${source}
             }
             return resolvePath(base, name);
           }, "read-side-effect"),
-          __safeBashRequire: options.runtime.declareHostOperation((name) => {
-            const module = typeof name === "string" ? requiredModules.get(name) : void 0;
-            if (!module) throw new TypeError("Unsupported node module; use fs, node:fs, fs/promises, node:fs/promises, path or node:path");
-            return module;
-          }, "read-side-effect")
+          __safeBashModules: Object.fromEntries(requiredModules)
         }
       };
     }

package/dist/safe-bash/chunks/chunk-B3ZMOJVM.js

@@ -0,0 +1,319 @@
+import {
+  FsError
+} from "./chunk-DUTAG6ZD.js";
+import {
+  concatShellValues,
+  shellValueBytes,
+  shellValueFromBytes,
+  shellValueText
+} from "./chunk-XQWCQSRN.js";
+import {
+  init_platform
+} from "./chunk-PTAEWLSE.js";
+
+// packages/safe-bash/src/shell/read-builtin.ts
+init_platform();
+var usage = "read: usage: read [-Eers] [-a array] [-d delim] [-i text] [-n nchars] [-N nchars] [-p prompt] [-t timeout] [-u fd] [name ...]\n";
+function identifier(name) {
+  if (!name.length) return false;
+  for (let index = 0; index < name.length; index++) {
+    const character = name[index];
+    if (character !== "_" && !(character >= "a" && character <= "z") && !(character >= "A" && character <= "Z") && !(index > 0 && character >= "0" && character <= "9")) return false;
+  }
+  return true;
+}
+function decimal(value) {
+  let left = 0;
+  let right = value.length;
+  while (left < right && " 	\n\r\v\f".includes(value[left])) left++;
+  while (right > left && " 	\n\r\v\f".includes(value[right - 1])) right--;
+  const digits = value.slice(left, right);
+  let start = 0;
+  if (digits[0] === "+" || digits[0] === "-") start++;
+  if (digits.length === start) return void 0;
+  for (let index = start; index < digits.length; index++) if (digits[index] < "0" || digits[index] > "9") return void 0;
+  const number = Number(digits);
+  return Number.isInteger(number) && number >= 0 && number <= 2147483647 ? number : void 0;
+}
+function timeout(value) {
+  let offset = value.startsWith("+") || value.startsWith("-") ? 1 : 0;
+  let seconds = 0n;
+  while (offset < value.length && value[offset] !== ".") {
+    const character = value[offset++];
+    if (character < "0" || character > "9") return void 0;
+    seconds = seconds * 10n + BigInt(character);
+    if (seconds > 9223372036854775807n) return void 0;
+  }
+  if (value[offset] === ".") offset++;
+  let fraction = 0;
+  let digits = 0;
+  while (offset < value.length && digits < 6) {
+    const character = value[offset++];
+    if (character < "0" || character > "9") return void 0;
+    fraction = fraction * 10 + Number(character);
+    digits++;
+  }
+  fraction *= 10 ** (6 - digits);
+  if (digits === 6 && value[offset] !== void 0 && value[offset] >= "5" && value[offset] <= "9") fraction++;
+  if (value.startsWith("-") && (seconds > 0n || fraction > 0)) return void 0;
+  return Number(seconds & 4294967295n) * 1e3 + fraction / 1e3;
+}
+async function parse(context, validate) {
+  const options = { raw: false, exact: false, descriptor: 0, names: [] };
+  const args = context.argumentValues;
+  let offset = 0;
+  while (offset < args.length) {
+    const argument = args[offset];
+    const bytes = shellValueBytes(argument);
+    const text = shellValueText(argument);
+    if (text === "--") {
+      offset++;
+      break;
+    }
+    if (bytes[0] !== 45 || bytes.length === 1) break;
+    offset++;
+    for (let index = 1; index < bytes.length; index++) {
+      const flag = String.fromCharCode(bytes[index]);
+      if (flag === "r") {
+        options.raw = true;
+        continue;
+      }
+      if (flag === "e" || flag === "E" || flag === "s") {
+        options.terminal = flag;
+        continue;
+      }
+      if (!"adnNptui".includes(flag)) {
+        await context.diagnostic(concatShellValues(["read: -", bytes[index] < 128 ? flag : shellValueFromBytes(bytes.subarray(index, index + 1)), ": invalid option"]));
+        await context.stderr.write(new TextEncoder().encode(usage));
+        return 2;
+      }
+      let value;
+      if (index + 1 < bytes.length) value = typeof argument === "string" ? argument.slice(index + 1) : shellValueFromBytes(bytes.subarray(index + 1));
+      else if (offset < args.length) value = args[offset++];
+      else {
+        await context.diagnostic(`read: -${flag}: option requires an argument`);
+        await context.stderr.write(new TextEncoder().encode(usage));
+        return 2;
+      }
+      const valueText = shellValueText(value);
+      if (flag === "a") options.array = value;
+      else if (flag === "d") options.delimiter = (index + 1 < bytes.length ? bytes[index + 1] : shellValueBytes(value)[0]) ?? 0;
+      else if (flag === "p" || flag === "i") options.terminal = flag;
+      else if (flag === "t") {
+        const milliseconds = timeout(valueText);
+        if (milliseconds === void 0) {
+          await context.diagnostic(concatShellValues(["read: ", value, ": invalid timeout specification"]));
+          return 1;
+        }
+        options.timeout = milliseconds;
+      } else {
+        const number = decimal(valueText);
+        if (number === void 0) {
+          const detail = flag === "u" ? "file descriptor specification" : `${valueText.startsWith("0x") || valueText.startsWith("0X") ? "hex " : ""}number`;
+          await context.diagnostic(concatShellValues(["read: ", value, `: invalid ${detail}`]));
+          return 1;
+        }
+        if (flag === "u") {
+          options.descriptor = number;
+          await validate(number);
+        } else {
+          options.count = number;
+          options.exact ||= flag === "N";
+        }
+      }
+      break;
+    }
+  }
+  options.names = args.slice(offset);
+  return options;
+}
+async function executeRead(nonTerminalInput, context) {
+  const diagnosedDescriptorFailure = /* @__PURE__ */ Symbol("diagnosed read descriptor failure");
+  const inputs = [];
+  let input;
+  let observer;
+  let record;
+  let writer;
+  const operation = {};
+  let completion;
+  let closed = false;
+  const check = () => {
+    context.signal.throwIfAborted();
+    if (closed) throw new Error("Read invocation is closed");
+  };
+  const close = () => {
+    closed = true;
+    return completion ??= (async () => {
+      await Promise.allSettled([operation.work]);
+      let failure2;
+      for (const release of [() => writer?.close(), () => record?.release(), ...inputs.map((lease) => () => lease.release()), () => observer?.release()]) {
+        try {
+          await release();
+        } catch (reason) {
+          failure2 ??= { reason };
+        }
+      }
+      if (failure2) throw failure2.reason;
+    })();
+  };
+  context.registerCleanup(close);
+  const validate = async (descriptor) => {
+    check();
+    try {
+      context.input.validateOpen(descriptor);
+    } catch (error) {
+      context.signal.throwIfAborted();
+      if (error instanceof FsError && error.code === "EBADF") {
+        await context.diagnostic(`read: ${descriptor}: invalid file descriptor: Bad file descriptor`);
+        throw diagnosedDescriptorFailure;
+      }
+      throw error;
+    }
+  };
+  const select = (descriptor) => {
+    check();
+    try {
+      input = context.input.borrow(descriptor);
+      inputs.push(input);
+    } catch (error) {
+      context.signal.throwIfAborted();
+      if (!(error instanceof FsError && error.code === "EBADF")) throw error;
+    }
+  };
+  const observe = (descriptor) => {
+    check();
+    try {
+      observer = context.input.observe(descriptor);
+    } catch (error) {
+      context.signal.throwIfAborted();
+      if (!(error instanceof FsError && error.code === "EBADF")) throw error;
+    }
+  };
+  const work = Promise.resolve().then(async () => {
+    check();
+    const options = await parse(context, validate);
+    check();
+    if (typeof options === "number") return options;
+    if (options.timeout === 0) {
+      observe(options.descriptor);
+      check();
+      if (!observer) return 1;
+      const { readiness } = await observer.probeRead();
+      check();
+      if (readiness === "ready") return 0;
+      if (readiness === "blocked") return 1;
+      if (readiness !== "unknown") throw new TypeError("Invalid input readiness");
+      await context.diagnostic(observer.readable ? "read: input readiness is unknown for this cursor" : "read: descriptor readiness unavailable through this extension API");
+      return 1;
+    }
+    if (options.terminal !== void 0 && !nonTerminalInput) {
+      await context.diagnostic(`read: -${options.terminal}: terminal input capabilities unavailable through this extension API`);
+      return 1;
+    }
+    const invalidName = async (name) => {
+      await context.diagnostic(concatShellValues(["read: `", name, "': not a valid identifier"]));
+      return 1;
+    };
+    if (options.names[0] !== void 0 && !identifier(shellValueText(options.names[0]))) return invalidName(options.names[0]);
+    if (options.array !== void 0 && typeof context.bindings.openIndexed !== "function") {
+      await context.diagnostic("read: indexed writer unavailable through this extension API");
+      return 1;
+    }
+    const ifs = options.exact ? "" : context.bindings.get("IFS") ?? " 	\n";
+    select(options.descriptor);
+    check();
+    const inherited = options.timeout === void 0 && options.count !== 0 ? context.bindings.get("TMOUT") : void 0;
+    const milliseconds = options.timeout ?? (inherited === void 0 ? void 0 : timeout(shellValueText(inherited)));
+    let timedOut = false;
+    if (!input && options.count !== 0) {
+      if (milliseconds !== void 0 && milliseconds > 0) {
+        observe(options.descriptor);
+        check();
+        if (observer) {
+          const probe = await observer.probeRead();
+          check();
+          const readyUnreadable = observer.readable === false && probe.readiness === "ready";
+          if (probe.timeout !== "ignore" && !(readyUnreadable && probe.timeout === "unknown")) {
+            if (probe.readiness === "unknown" || probe.timeout !== "honor") {
+              await context.diagnostic("read: descriptor timeout observation unavailable through this extension API");
+              return 1;
+            }
+            if (probe.readiness === "blocked") {
+              const outcome = await observer.waitRead({ timeoutMs: milliseconds, signal: context.signal });
+              check();
+              if (outcome === "unknown") {
+                await context.diagnostic("read: descriptor timeout observation unavailable through this extension API");
+                return 1;
+              }
+              if (outcome !== "ready" && outcome !== "timeout") throw new TypeError("Invalid descriptor wait result");
+              timedOut = outcome === "timeout";
+            } else if (probe.readiness !== "ready") throw new TypeError("Invalid descriptor readiness");
+          }
+        }
+      }
+      if (!timedOut) {
+        await context.diagnostic(`read: ${options.descriptor}: read error: Bad file descriptor`);
+        return 1;
+      }
+    }
+    record = await input?.read(options.raw, {
+      ...options.count === void 0 ? {} : { count: options.count },
+      ...options.delimiter === void 0 ? {} : { delimiter: options.delimiter },
+      exact: options.exact,
+      ...options.count !== 0 && milliseconds !== void 0 && milliseconds > 0 ? { timeoutMs: milliseconds } : {}
+    });
+    check();
+    const status = timedOut || record?.reason === "timeout" ? 142 : record?.terminated ? 0 : 1;
+    if (options.array !== void 0) {
+      const name = shellValueText(options.array);
+      if (!identifier(name)) return invalidName(options.array);
+      if (context.bindings.describe(name).readonly) {
+        await context.diagnostic(`${name}: readonly variable`);
+        return 1;
+      }
+      writer = await context.bindings.openIndexed(name, { clear: true });
+      check();
+      const fields = await record?.fields(ifs) ?? [];
+      for (let index = 0; index < fields.length; index++) {
+        check();
+        await writer.set(index, fields[index].value);
+      }
+    } else {
+      const names = options.names.length ? options.names : ["REPLY"];
+      const fields = options.names.length ? await record?.fields(ifs, names.length) ?? [] : void 0;
+      for (let index = 0; index < names.length; index++) {
+        check();
+        const original = names[index];
+        const name = shellValueText(original);
+        if (!identifier(name)) return invalidName(original);
+        if (context.bindings.describe(name).readonly) {
+          await context.diagnostic(`${name}: readonly variable`);
+          return options.names.length === 0 || index < names.length - 1 ? 2 : 1;
+        }
+        await context.bindings.assign(name, fields ? fields[index]?.value ?? "" : record?.shellValue ?? "");
+      }
+    }
+    return status;
+  });
+  operation.work = work;
+  let result = 1;
+  let failure;
+  try {
+    result = await work;
+  } catch (reason) {
+    if (reason === diagnosedDescriptorFailure) result = 1;
+    else failure = { reason };
+  }
+  try {
+    await close();
+  } catch (reason) {
+    failure ??= { reason };
+  }
+  context.signal.throwIfAborted();
+  if (failure) throw failure.reason;
+  return result;
+}
+
+export {
+  executeRead
+};

package/dist/safe-bash/chunks/{chunk-7ZBU7KYV.js → chunk-CFAWS3O4.js}

@@ -1,6 +1,6 @@
 import {
   init_platform
-} from "./chunk-B7TAL7S5.js";
+} from "./chunk-PTAEWLSE.js";
 
 // packages/safe-bash/src/commands/split/index.ts
 init_platform();

package/dist/safe-bash/chunks/{chunk-I5HZ4FGE.js → chunk-CL2FCTTO.js}

@@ -1,6 +1,6 @@
 import {
   init_platform
-} from "./chunk-B7TAL7S5.js";
+} from "./chunk-PTAEWLSE.js";
 
 // packages/safe-bash/src/contracts/filesystem-descriptor.ts
 init_platform();

package/dist/safe-bash/chunks/{chunk-KDNSPLII.js → chunk-CTXNARJH.js}

@@ -1,6 +1,6 @@
 import {
   init_platform
-} from "./chunk-B7TAL7S5.js";
+} from "./chunk-PTAEWLSE.js";
 
 // packages/safe-bash/src/shell/worker-limits.ts
 init_platform();
@@ -64,6 +64,7 @@ var cloudflareWorkerLimits = Object.freeze({
   maxPathnameComponents: 64,
   maxRedirects: 64,
   maxPipelineStages: 64,
+  maxPipelineBytes: 4 * 1024 * 1024,
   maxLoopIterations: 1e3,
   maxSubstitutionDepth: 16,
   maxFunctionDepth: 16,

package/dist/safe-bash/chunks/{chunk-TFIBK2GI.js → chunk-D5Q7NFWI.js}

@@ -1,6 +1,6 @@
 import {
   init_platform
-} from "./chunk-B7TAL7S5.js";
+} from "./chunk-PTAEWLSE.js";
 
 // packages/safe-bash/src/commands/yq/index.ts
 init_platform();

package/dist/safe-bash/chunks/{chunk-OQRVVGR6.js → chunk-DSOOVZ6Q.js}

@@ -1,6 +1,6 @@
 import {
   init_platform
-} from "./chunk-B7TAL7S5.js";
+} from "./chunk-PTAEWLSE.js";
 
 // packages/safe-bash/src/commands/llm/index.ts
 init_platform();

package/dist/safe-bash/chunks/{chunk-VTH3MLDU.js → chunk-DUTAG6ZD.js}

@@ -1,6 +1,6 @@
 import {
   init_platform
-} from "./chunk-B7TAL7S5.js";
+} from "./chunk-PTAEWLSE.js";
 
 // packages/safe-bash/src/contracts/errors.ts
 init_platform();

package/dist/safe-bash/chunks/{chunk-XAQMU6OY.js → chunk-EE5YGFIZ.js}

@@ -1,6 +1,6 @@
 import {
   init_platform
-} from "./chunk-B7TAL7S5.js";
+} from "./chunk-PTAEWLSE.js";
 
 // packages/safe-bash/src/commands/apply-patch/index.ts
 init_platform();

package/dist/safe-bash/chunks/{chunk-FZE4HW6G.js → chunk-EJOYT2ME.js}

@@ -1,6 +1,6 @@
 import {
   init_platform
-} from "./chunk-B7TAL7S5.js";
+} from "./chunk-PTAEWLSE.js";
 
 // packages/safe-bash/src/commands/regex-execution/bounded-provider.ts
 init_platform();