@poe-platform/safe-bash 0.1.802 → 0.1.804

package/dist/safe-bash-command-op/index.js

@@ -4,9 +4,11 @@ import {
 
 // packages/safe-bash-command-op/src/index.ts
 init_buffer();
+import { builtInDirectContextExecutors, syncCommandEvaluators } from "../safe-bash-contracts/runtime-control.js";
 
 // packages/safe-bash-command-op/src/cli.ts
 init_buffer();
+import { isFsError, listenForAbort as listenForAbort4 } from "@poe-platform/safe-fs/core";
 import { InputByteBudget } from "../safe-bash-contracts/io.js";
 
 // packages/safe-bash-command-op/src/encoding.ts
@@ -1763,6 +1765,7 @@ function changeVaultPermissions(current, requested, action) {
 
 // packages/safe-bash-command-op/src/plugin-scopes.ts
 init_buffer();
+import { listenForAbort } from "@poe-platform/safe-fs/core";
 function object(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1844,10 +1847,10 @@ async function clearPluginDefaults(plugin, context, all, force) {
     const confirm = context.confirmPluginClear;
     if (!confirm) throw new Error("Plugin clear confirmation capability is unavailable");
     const confirmation = Object.freeze({ pluginId: plugin.id, defaults: Object.freeze(selected.map(({ entry }) => Object.freeze({ id: entry.id, scope: Object.freeze({ ...entry.scope }) }))) });
-    let onAbort;
+    let disposeAbort;
     const aborted = new Promise((_resolve, reject) => {
-      onAbort = () => reject(new DOMException("Plugin clear aborted", "AbortError"));
-      context.signal.addEventListener("abort", onAbort, { once: true });
+      const onAbort = () => reject(new DOMException("Plugin clear aborted", "AbortError"));
+      disposeAbort = listenForAbort(context.signal, onAbort);
       if (context.signal.aborted) onAbort();
     });
     let accepted;
@@ -1860,7 +1863,7 @@ async function clearPluginDefaults(plugin, context, all, force) {
       if (context.signal.aborted) throw new DOMException("Plugin clear aborted", "AbortError");
       throw new Error("Plugin clear confirmation failed");
     } finally {
-      context.signal.removeEventListener("abort", onAbort);
+      disposeAbort?.();
     }
     if (accepted !== true) throw new Error("Plugin clear was not confirmed");
   }
@@ -2387,9 +2390,11 @@ function listItemTemplates(templates = []) {
 
 // packages/safe-bash-command-op/src/bindings.ts
 init_buffer();
+import { listenForAbort as listenForAbort3 } from "@poe-platform/safe-fs/core";
 
 // packages/safe-bash-command-op/src/plugin-selection.ts
 init_buffer();
+import { listenForAbort as listenForAbort2 } from "@poe-platform/safe-fs/core";
 async function selectPluginId(plugins, context, accountId) {
   const { signal, selectPlugin } = context;
   signal.throwIfAborted();
@@ -2398,13 +2403,12 @@ async function selectPluginId(plugins, context, accountId) {
     const id = plugin.executable ?? plugin.id;
     return id === void 0 ? [] : [Object.freeze({ id, name: plugin.plugin_name ?? plugin.name ?? id })];
   }));
-  let abort;
+  let disposeAbort;
   let selected;
   try {
     selected = await Promise.race([
       new Promise((_resolve, reject) => {
-        abort = () => reject(new Error("Plugin selection cancelled"));
-        signal.addEventListener("abort", abort, { once: true });
+        disposeAbort = listenForAbort2(signal, () => reject(new Error("Plugin selection cancelled")));
       }),
       Promise.resolve().then(() => {
         signal.throwIfAborted();
@@ -2416,7 +2420,7 @@ async function selectPluginId(plugins, context, accountId) {
     signal.throwIfAborted();
     throw new Error("Plugin selection failed");
   } finally {
-    signal.removeEventListener("abort", abort);
+    disposeAbort?.();
   }
   if (selected === void 0) throw new Error("Plugin selection cancelled");
   if (typeof selected !== "string" || !candidates.some((candidate) => candidate.id === selected)) throw new Error("Invalid plugin selection");
@@ -2521,7 +2525,8 @@ function createBindingManager(source, policy, clock, hasHook, defaultVault) {
     binding.cancelled = true;
     delete binding.staged;
     binding.steps = [];
-    binding.signal.removeEventListener("abort", binding.abort);
+    binding.disposeAbort?.();
+    delete binding.disposeAbort;
   }
   function validate(handle, context) {
     const binding = bindings.get(handle);
@@ -2541,7 +2546,7 @@ function createBindingManager(source, policy, clock, hasHook, defaultVault) {
   return {
     async prepareBinding(requests, context) {
       context.signal.throwIfAborted();
-      if (context.binding || requests.length > 1024) throw new Error("Invalid binding plan");
+      if (context.binding) throw new Error("Invalid binding plan");
       context = Object.freeze({
         ...context,
         ...context.authentication === void 0 ? {} : { authentication: structuredClone(context.authentication) },
@@ -2549,8 +2554,8 @@ function createBindingManager(source, policy, clock, hasHook, defaultVault) {
       });
       const preparedGeneration = generation;
       const now = clock.now();
-      const expiresAt = context.expiresAt ?? now + 6e4;
-      if (!Number.isFinite(now) || !Number.isFinite(expiresAt) || expiresAt <= now) throw new Error("Invalid binding deadline");
+      const expiresAt = context.expiresAt ?? Infinity;
+      if (!Number.isFinite(now) || expiresAt !== Infinity && !Number.isFinite(expiresAt) || expiresAt <= now) throw new Error("Invalid binding deadline");
       const targets = [];
       const requestMetadata = requests.map(() => Object.freeze({}));
       const accounts = /* @__PURE__ */ new Set();
@@ -2685,9 +2690,9 @@ function createBindingManager(source, policy, clock, hasHook, defaultVault) {
       if (generation !== preparedGeneration) throw invalid();
       if (accounts.size > 1) throw new Error("A binding requires one account scope");
       const handle = Object.freeze({});
-      const binding = { generation, expiresAt, signal: context.signal, authentication: structuredClone(context.authentication), pluginScope: structuredClone(context.pluginScope), steps, cancelled: false, queue: Promise.resolve(), abort: () => cancel(binding) };
+      const binding = { generation, expiresAt, signal: context.signal, authentication: structuredClone(context.authentication), pluginScope: structuredClone(context.pluginScope), steps, cancelled: false, queue: Promise.resolve() };
       bindings.set(handle, binding);
-      context.signal.addEventListener("abort", binding.abort, { once: true });
+      if (steps.length) binding.disposeAbort = listenForAbort3(context.signal, () => cancel(binding));
       validate(handle, context);
       return Object.freeze({ backendId, accountId: accounts.values().next().value ?? null, handle, targets: Object.freeze(targets), metadata: Object.freeze(requestMetadata) });
     },
@@ -2732,6 +2737,8 @@ function createBindingManager(source, policy, clock, hasHook, defaultVault) {
           published(before);
           binding.generation = generation;
           delete binding.staged;
+          binding.disposeAbort?.();
+          delete binding.disposeAbort;
         }
         return result;
       } catch (error) {
@@ -3460,10 +3467,9 @@ ${value.map((row) => keys.map((key) => typeof row[key] === "object" ? JSON.strin
 }
 async function policyResult(callback, signal) {
   signal.throwIfAborted();
-  let abort;
+  let disposeAbort;
   const cancelled = new Promise((_resolve, reject) => {
-    abort = () => reject(new Error("operation aborted"));
-    signal.addEventListener("abort", abort, { once: true });
+    disposeAbort = listenForAbort4(signal, () => reject(new Error("operation aborted")));
   });
   try {
     return await Promise.race([Promise.resolve().then(() => {
@@ -3473,7 +3479,7 @@ async function policyResult(callback, signal) {
   } catch {
     throw new Error("authorization failed");
   } finally {
-    signal.removeEventListener("abort", abort);
+    disposeAbort?.();
   }
 }
 function approvalManifest(request, requests, prepared, effects) {
@@ -3687,6 +3693,7 @@ function createOpCommand(options = {}) {
         }
         return { exitCode: 0 };
       } catch (error) {
+        if (error instanceof Error && error.name === "BudgetExceededError" || isFsError(error, "EPIPE")) throw error;
         let message = error instanceof Error ? error.message : "operation failed";
         try {
           budget.assertOpen();
@@ -3706,22 +3713,23 @@ function createOpCommand(options = {}) {
 
 // packages/safe-bash-command-op/src/secrets.ts
 init_buffer();
+import { listenForAbort as listenForAbort6 } from "@poe-platform/safe-fs/core";
 
 // packages/safe-bash-command-op/src/handler-preparation.ts
 init_buffer();
+import { listenForAbort as listenForAbort5 } from "@poe-platform/safe-fs/core";
 async function acquire(signal, operation) {
   signal.throwIfAborted();
-  let abort;
+  let disposeAbort;
   const cancelled = new Promise((_resolve, reject) => {
-    abort = () => reject(new Error("Operation aborted"));
-    signal.addEventListener("abort", abort, { once: true });
+    disposeAbort = listenForAbort5(signal, () => reject(new Error("Operation aborted")));
   });
   try {
     const value = await Promise.race([operation(), cancelled]);
     signal.throwIfAborted();
     return value;
   } finally {
-    signal.removeEventListener("abort", abort);
+    disposeAbort?.();
   }
 }
 function createSourceSnapshot(source, maxBytes = Infinity) {
@@ -3909,17 +3917,16 @@ function expand(value, env, escapes = true) {
 }
 async function cancellable(signal, operation) {
   signal.throwIfAborted();
-  let abort;
+  let disposeAbort;
   const cancelled = new Promise((_resolve, reject) => {
-    abort = () => reject(signal.reason);
-    signal.addEventListener("abort", abort, { once: true });
+    disposeAbort = listenForAbort6(signal, () => reject(signal.reason));
   });
   try {
     const value = await Promise.race([operation(), cancelled]);
     signal.throwIfAborted();
     return value;
   } finally {
-    signal.removeEventListener("abort", abort);
+    disposeAbort?.();
   }
 }
 async function template(value, env, resolve, variables = true) {
@@ -4542,22 +4549,22 @@ function createDocumentHandlers(backend, options = {}) {
 
 // packages/safe-bash-command-op/src/items.ts
 init_buffer();
+import { listenForAbort as listenForAbort7 } from "@poe-platform/safe-fs/core";
 function record6(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Uint8Array);
 }
 async function cancellable2(signal, operation) {
   signal.throwIfAborted();
-  let abort;
+  let disposeAbort;
   const cancelled = new Promise((_resolve, reject) => {
-    abort = () => reject(signal.reason);
-    signal.addEventListener("abort", abort, { once: true });
+    disposeAbort = listenForAbort7(signal, () => reject(signal.reason));
   });
   try {
     const value = await Promise.race([operation(), cancelled]);
     signal.throwIfAborted();
     return value;
   } finally {
-    signal.removeEventListener("abort", abort);
+    disposeAbort?.();
   }
 }
 async function stdinText(context, encoding) {
@@ -4666,7 +4673,7 @@ function createItemHandlers(backend) {
 
 // packages/safe-bash-command-op/src/index.ts
 import { readBytes } from "../safe-bash-contracts/index.js";
-import { resolvePath } from "@poe-platform/safe-fs/core";
+import { isFsError as isFsError2, resolvePath } from "@poe-platform/safe-fs/core";
 
 // packages/safe-bash-command-op/src/types.ts
 init_buffer();
@@ -4730,27 +4737,44 @@ function createOpCommand2(options = {}) {
       if (!("fs" in context)) return command.execute(context);
       const host = context;
       const { fs, signal, cwd } = context;
+      let inputBytes = 0;
+      const account = (bytes) => {
+        context.inputBudget?.check(inputBytes += bytes.byteLength);
+        return bytes;
+      };
       const invocation = {
         ...host,
         args: context.args,
         env: { ...context.env },
         signal,
-        stdin: readBytes(context.stdin, signal),
+        stdin: (async function* () {
+          for await (const bytes of readBytes(context.stdin, signal)) yield account(bytes);
+        })(),
         stdout: context.stdout,
         stderr: context.stderr,
         ...authentication === void 0 ? {} : { authentication },
         ...pluginScope === void 0 ? {} : { pluginScope },
         ...confirmPluginClear === void 0 ? {} : { confirmPluginClear },
         ...selectPlugin === void 0 ? {} : { selectPlugin },
-        readFile: host.readFile ?? (async (path) => {
+        readFile: async (path) => {
+          if (host.readFile) return account(await host.readFile(path));
           signal.throwIfAborted();
           const resolved = resolvePath(cwd, path);
           const capabilities = fs.capabilitiesFor ? await fs.capabilitiesFor(resolved, { signal }) : fs.capabilities;
           if (capabilities.read !== true) throw new Error("op requires VFS read capability");
-          const bytes = await fs.readFile(resolved, { signal });
+          let bytes;
+          try {
+            bytes = await fs.readFile(resolved, {
+              signal,
+              ...context.inputBudget && Number.isFinite(context.inputBudget.maxBytes) ? { maxBytes: Math.max(0, context.inputBudget.maxBytes - inputBytes) } : {}
+            });
+          } catch (error) {
+            if (isFsError2(error, "EFBIG") && context.inputBudget) context.inputBudget.check(context.inputBudget.maxBytes + 1);
+            throw error;
+          }
           signal.throwIfAborted();
-          return Uint8Array.from(bytes);
-        }),
+          return Uint8Array.from(account(bytes));
+        },
         writeFile: host.writeFile ?? (async (path, bytes, settings = {}) => {
           signal.throwIfAborted();
           const resolved = resolvePath(cwd, path);
@@ -4796,6 +4820,8 @@ function createOpCommand2(options = {}) {
       return command.execute(invocation);
     }
   };
+  builtInDirectContextExecutors.add(def.execute);
+  syncCommandEvaluators.evalSyncOp = evalSyncOp;
   opMetaByExecutor.set(def.execute, { version: options.version ?? "0.0.1", channel: options.channel ?? "stable" });
   return def;
 }

package/dist/safe-bash-command-op/types.d.ts

@@ -31,6 +31,7 @@ export interface OpBindingTarget {
     readonly revision: string;
 }
 export interface OpBindingPrepareContext extends OpBackendContext {
+    /** Deadline on the backend clock; omitted or Infinity means no timeout. */
     readonly expiresAt?: number;
 }
 export interface OpPreparedBinding {

package/dist/safe-bash-command-pandoc/command.js

@@ -2,12 +2,12 @@ import {
   createPandocCommand,
   createPandocCommands,
   pandocCommands
-} from "../safe-bash/command-chunks/chunk-TGSNCQSR.js";
+} from "../safe-bash/command-chunks/chunk-JT4RYCA6.js";
 import "../safe-bash/command-chunks/chunk-BAXU7B5Z.js";
-import "../safe-bash/command-chunks/chunk-QRRYN2KO.js";
+import "../safe-bash/command-chunks/chunk-BC7BK6R6.js";
 import "../safe-bash/command-chunks/chunk-5LU4UCBR.js";
 import "../safe-bash/command-chunks/chunk-RDV7UCYZ.js";
-import "../safe-bash/command-chunks/chunk-YG4EPFWC.js";
+import "../safe-bash/command-chunks/chunk-M3NINRDU.js";
 import "../safe-bash/command-chunks/chunk-3E2OIS2J.js";
 import "../safe-bash/command-chunks/chunk-Y6TUZWPS.js";
 import "../safe-bash/command-chunks/chunk-7OKDCM5U.js";

package/dist/safe-bash-command-pandoc/index.d.ts

@@ -1,3 +1,4 @@
+export { evalSyncPandoc } from "./sync.js";
 export { convert, convertSync, readDocument, writeDocument, PandocError } from "./engine.js";
 export { createFormatRegistry, coreFormats, formatCapabilities } from "./formats.js";
 export type { FormatCapability, FormatDescriptor, FormatSelection, Direction } from "./formats.js";

package/dist/safe-bash-command-pandoc/index.js

@@ -10,6 +10,7 @@ import {
   createPandocCommand,
   createPandocCommands,
   defaultLimits,
+  evalSyncPandoc,
   formatCapabilities,
   inspectCommand,
   inspectFormats,
@@ -21,12 +22,12 @@ import {
   readDocument,
   resolveConversionArgs,
   writeDocument
-} from "../safe-bash/command-chunks/chunk-TGSNCQSR.js";
+} from "../safe-bash/command-chunks/chunk-JT4RYCA6.js";
 import "../safe-bash/command-chunks/chunk-BAXU7B5Z.js";
-import "../safe-bash/command-chunks/chunk-QRRYN2KO.js";
+import "../safe-bash/command-chunks/chunk-BC7BK6R6.js";
 import "../safe-bash/command-chunks/chunk-5LU4UCBR.js";
 import "../safe-bash/command-chunks/chunk-RDV7UCYZ.js";
-import "../safe-bash/command-chunks/chunk-YG4EPFWC.js";
+import "../safe-bash/command-chunks/chunk-M3NINRDU.js";
 import {
   createLuaFilterCapability
 } from "../safe-bash/command-chunks/chunk-3E2OIS2J.js";
@@ -158,6 +159,7 @@ export {
   createPandocCommands,
   createStandalonePandocCommand,
   defaultLimits,
+  evalSyncPandoc,
   formatCapabilities,
   inspectCommand,
   inspectFormats,

package/dist/safe-bash-command-pandoc/sync.d.ts

@@ -0,0 +1 @@
+export declare function evalSyncPandoc(inBytes: Uint8Array | undefined, opArgs: readonly string[], readFileSync?: (filePath: string) => Uint8Array | undefined, writeFileSync?: (filePath: string, bytes: Uint8Array) => boolean): string | undefined;

package/dist/safe-bash-command-patch/index.js

@@ -1,16 +1,16 @@
 import {
   patchCommand
-} from "../safe-bash/command-chunks/chunk-XIIBTGC5.js";
-import "../safe-bash/command-chunks/chunk-4B7Y7S6E.js";
+} from "../safe-bash/command-chunks/chunk-XPXEQKRW.js";
 import "../safe-bash/command-chunks/chunk-DT7BCTWY.js";
-import "../safe-bash/command-chunks/chunk-67QKREJK.js";
 import "../safe-bash/command-chunks/chunk-BAGCY35S.js";
 import "../safe-bash/command-chunks/chunk-4ZHMW6F5.js";
-import "../safe-bash/command-chunks/chunk-DOKKNRRM.js";
 import "../safe-bash/command-chunks/chunk-V6BEDRMQ.js";
 import {
   evalSyncPatch
 } from "../safe-bash/command-chunks/chunk-FXELCPFX.js";
+import "../safe-bash/command-chunks/chunk-67QKREJK.js";
+import "../safe-bash/command-chunks/chunk-DOKKNRRM.js";
+import "../safe-bash/command-chunks/chunk-4B7Y7S6E.js";
 import {
   init_buffer
 } from "../safe-bash/command-chunks/chunk-HX3SHTCE.js";

package/dist/safe-bash-command-patch/patch.js

@@ -1,13 +1,13 @@
 import {
   patchCommand
-} from "../safe-bash/command-chunks/chunk-XIIBTGC5.js";
-import "../safe-bash/command-chunks/chunk-4B7Y7S6E.js";
+} from "../safe-bash/command-chunks/chunk-XPXEQKRW.js";
 import "../safe-bash/command-chunks/chunk-DT7BCTWY.js";
-import "../safe-bash/command-chunks/chunk-67QKREJK.js";
 import "../safe-bash/command-chunks/chunk-BAGCY35S.js";
 import "../safe-bash/command-chunks/chunk-4ZHMW6F5.js";
-import "../safe-bash/command-chunks/chunk-DOKKNRRM.js";
 import "../safe-bash/command-chunks/chunk-V6BEDRMQ.js";
+import "../safe-bash/command-chunks/chunk-67QKREJK.js";
+import "../safe-bash/command-chunks/chunk-DOKKNRRM.js";
+import "../safe-bash/command-chunks/chunk-4B7Y7S6E.js";
 import "../safe-bash/command-chunks/chunk-HX3SHTCE.js";
 export {
   patchCommand

package/dist/safe-bash-command-pdfimages/index.js

@@ -330,7 +330,7 @@ async function executePdfimages(context) {
     }
     context.inputBudget?.check(0);
     const existingSnap = new Map(vfsFiles);
-    const res = await runPdfimagesCli(argv, vfsFiles, { onAllocateBytes: chargeBytes, signal: invocation.signal });
+    const res = await runPdfimagesCli(argv, vfsFiles, { signal: invocation.signal });
     if (res.stderr) {
       await writeBytes(context.stderr, new TextEncoder().encode(res.stderr), invocation.signal);
     }

package/dist/safe-bash-command-pdfinfo/index.js

@@ -1918,8 +1918,36 @@ async function executePopplerFileTool(context, runner) {
         context.inputBudget?.check(accountedBytes);
       }
     };
-    const positionals = extractPopplerFileToolPositionals(argv);
-    if (positionals.length === 0 || positionals[0] === "-") {
+    let informational = false;
+    for (let i = 0; i < argv.length; i++) {
+      const arg = argv[i];
+      if (arg === "--") break;
+      if (POPPLER_FILE_TOOL_VALUE_FLAGS.has(arg)) {
+        i++;
+        continue;
+      }
+      if (["-h", "-help", "--help", "-?", "-v", "--version"].includes(arg)) {
+        informational = true;
+        break;
+      }
+    }
+    const positionals = informational ? [] : extractPopplerFileToolPositionals(argv);
+    if (!informational && runner === runPdfdetachCli) {
+      for (let i = 0; i < argv.length; i++) {
+        const flag = argv[i];
+        if (flag === "--") break;
+        if (!POPPLER_FILE_TOOL_VALUE_FLAGS.has(flag)) continue;
+        const value = argv[++i];
+        if (flag !== "-o" || !value || value.endsWith("/")) continue;
+        try {
+          const stat = await context.fs.stat(resolvePath(context.cwd, value), { signal: invocation.signal });
+          if (stat.type === "directory") argv[i] = `${value}/`;
+        } catch (error) {
+          if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT" && error.code !== "ENOTDIR") throw error;
+        }
+      }
+    }
+    if (!informational && (positionals.length === 0 || positionals[0] === "-")) {
       const chunks = [];
       let total = 0;
       for await (const chunk of readBytes(context.stdin, invocation.signal)) {
@@ -1956,19 +1984,16 @@ async function executePopplerFileTool(context, runner) {
       await writeBytes(context.stderr, new TextEncoder().encode(res.stderr), invocation.signal);
     }
     if (res.stdoutBytes) {
-      chargeBytes(res.stdoutBytes.byteLength);
       const stdout = invocation.child(context.stdout);
       await writeBytes(stdout.output, res.stdoutBytes, invocation.signal);
     } else if (res.stdout) {
       const outBytes = new TextEncoder().encode(res.stdout);
-      chargeBytes(outBytes.byteLength);
       const stdout = invocation.child(context.stdout);
       await writeBytes(stdout.output, outBytes, invocation.signal);
     }
     for (const [key, val] of vfsFiles.entries()) {
       if (++cooperativeWork % 64 === 0) await yieldTurn(context.signal);
       if (key !== "-" && existingSnap.get(key) !== val) {
-        chargeBytes(val.byteLength);
         const abs = resolvePath(context.cwd, key);
         try {
           await writeFileOutput(context, val, (data) => context.fs.writeFile(abs, data, { signal: invocation.signal }));

package/dist/safe-bash-command-pdftk/index.js

@@ -1677,7 +1677,7 @@ function* runPdftkCliSteps(argv, files, signal) {
       }
     }
   } else if (operation === "background" || operation === "multibackground" || operation === "stamp" || operation === "multistamp") {
-    const overlayPath = opArgs[0];
+    const overlayPath = opArgs[0] ?? "-";
     const overlayBytes = overlayPath ? files.get(overlayPath) : void 0;
     if (!overlayBytes) {
       return { exitCode: 1, stdout: "", stderr: `Error: Unable to open '${overlayPath ?? ""}'
@@ -1818,24 +1818,6 @@ async function executePdftk(context) {
         context.inputBudget?.check(accountedBytes);
       }
     };
-    if (argv.some((t, i) => (t === "-" || t.endsWith("=-")) && argv[i - 1]?.toLowerCase() !== "output")) {
-      const chunks = [];
-      let total = 0;
-      for await (const chunk of readBytes(context.stdin, invocation.signal)) {
-        if (++cooperativeWork % 64 === 0) await yieldTurn(context.signal);
-        chunks.push(chunk);
-        total += chunk.byteLength;
-        chargeBytes(chunk.byteLength);
-      }
-      const buf = new Uint8Array(total);
-      let off = 0;
-      for (const c of chunks) {
-        if (++cooperativeWork % 64 === 0) await yieldTurn(context.signal);
-        buf.set(c, off);
-        off += c.byteLength;
-      }
-      vfsFiles.set("-", buf);
-    }
     const inputPaths = [];
     let operandIndex = 0;
     while (operandIndex < argv.length && !PDFTK_OPERATIONS.has(argv[operandIndex].toLowerCase())) {
@@ -1849,7 +1831,8 @@ async function executePdftk(context) {
     }
     const operation = argv[operandIndex++]?.toLowerCase();
     if (["update_info", "update_info_utf8", "fill_form", "background", "multibackground", "stamp", "multistamp"].includes(operation ?? "")) {
-      if (argv[operandIndex]) inputPaths.push(argv[operandIndex]);
+      const operand = argv[operandIndex];
+      inputPaths.push(operand && !PDFTK_OPERATIONS.has(operand.toLowerCase()) ? operand : "-");
     } else if (operation === "attach_files") {
       while (operandIndex < argv.length && !PDFTK_OPERATIONS.has(argv[operandIndex].toLowerCase())) {
         const token = argv[operandIndex++];
@@ -1857,6 +1840,24 @@ async function executePdftk(context) {
         else inputPaths.push(token);
       }
     }
+    if (inputPaths.includes("-")) {
+      const chunks = [];
+      let total = 0;
+      for await (const chunk of readBytes(context.stdin, invocation.signal)) {
+        if (++cooperativeWork % 64 === 0) await yieldTurn(context.signal);
+        chunks.push(chunk);
+        total += chunk.byteLength;
+        chargeBytes(chunk.byteLength);
+      }
+      const buf = new Uint8Array(total);
+      let off = 0;
+      for (const c of chunks) {
+        if (++cooperativeWork % 64 === 0) await yieldTurn(context.signal);
+        buf.set(c, off);
+        off += c.byteLength;
+      }
+      vfsFiles.set("-", buf);
+    }
     for (const filePath of new Set(inputPaths)) {
       if (++cooperativeWork % 64 === 0) await yieldTurn(context.signal);
       if (filePath === "-") continue;
@@ -1874,19 +1875,16 @@ async function executePdftk(context) {
       await writeBytes(context.stderr, new TextEncoder().encode(res.stderr), invocation.signal);
     }
     if (res.stdoutBytes) {
-      chargeBytes(res.stdoutBytes.byteLength);
       const stdout = invocation.child(context.stdout);
       await writeBytes(stdout.output, res.stdoutBytes, invocation.signal);
     } else if (res.stdout) {
       const outBytes = new TextEncoder().encode(res.stdout);
-      chargeBytes(outBytes.byteLength);
       const stdout = invocation.child(context.stdout);
       await writeBytes(stdout.output, outBytes, invocation.signal);
     }
     for (const [key, val] of vfsFiles.entries()) {
       if (++cooperativeWork % 64 === 0) await yieldTurn(context.signal);
       if (key !== "-" && existingSnap.get(key) !== val) {
-        chargeBytes(val.byteLength);
         const abs = resolvePath(context.cwd, key);
         try {
           await writeFileOutput(context, val, (data) => context.fs.writeFile(abs, data, { signal: invocation.signal }));

package/dist/safe-bash-command-pdftoppm/index.js

@@ -488,7 +488,7 @@ async function executePdftoppm(context) {
     }
     context.inputBudget?.check(0);
     const existingSnap = new Map(vfsFiles);
-    const res = await runPdftoppmCli(argv, vfsFiles, { onAllocateBytes: chargeBytes, signal: invocation.signal });
+    const res = await runPdftoppmCli(argv, vfsFiles, { signal: invocation.signal });
     if (res.stderr) {
       await writeBytes(context.stderr, new TextEncoder().encode(res.stderr), invocation.signal);
     }
@@ -884,8 +884,21 @@ function createPdftocairoCommand(options = {}) {
               context2.inputBudget?.check(accountedBytes);
             }
           };
-          const positionals = extractPdftocairoPositionals(argv);
-          if (positionals.length === 0 || positionals[0] === "-") {
+          let informational = false;
+          for (let i = 0; i < argv.length; i++) {
+            const arg = argv[i];
+            if (arg === "--") break;
+            if (CAIRO_VALUE_FLAGS.has(arg)) {
+              i++;
+              continue;
+            }
+            if (["-h", "-help", "--help", "-?", "-v", "--version"].includes(arg)) {
+              informational = true;
+              break;
+            }
+          }
+          const positionals = informational ? [] : extractPdftocairoPositionals(argv);
+          if (!informational && (positionals.length === 0 || positionals[0] === "-")) {
             const chunks = [];
             let total = 0;
             for await (const chunk of readBytes(context2.stdin, invocation.signal)) {
@@ -917,7 +930,7 @@ function createPdftocairoCommand(options = {}) {
           }
           context2.inputBudget?.check(0);
           const existingSnap = new Map(vfsFiles);
-          const res = await runPdftocairoCli(argv, vfsFiles, { onAllocateBytes: chargeBytes, signal: invocation.signal });
+          const res = await runPdftocairoCli(argv, vfsFiles, { signal: invocation.signal });
           if (res.stderr) {
             await writeBytes(context2.stderr, new TextEncoder().encode(res.stderr), invocation.signal);
           }