azure-pipelines-task-lib 5.281.1 → 5.282.0

package/Strings/resources.resjson/de-DE/resources.resjson

@@ -1,4 +1,5 @@
 {
+  "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: Das Verzeichnis „%s“ kann ohne die Option „Rekursiv“ nicht kopiert werden.",
   "loc.messages.LIB_CopyFileFailed": "Fehler beim Kopieren der Datei. Verbleibende Versuche: %s",
   "loc.messages.LIB_DirectoryStackEmpty": "Der Verzeichnisstapel ist leer.",
   "loc.messages.LIB_EndpointAuthNotExist": "Die Endpunkt-Authentifizierungsdatensind nicht vorhanden: %s",

package/Strings/resources.resjson/es-ES/resources.resjson

@@ -1,4 +1,5 @@
 {
+  "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: no se puede copiar un directorio''%s'' sin la opción recursiva",
   "loc.messages.LIB_CopyFileFailed": "Error al copiar el archivo. Intentos restantes: %s",
   "loc.messages.LIB_DirectoryStackEmpty": "La pila de directorios está vacía",
   "loc.messages.LIB_EndpointAuthNotExist": "Los datos de autenticación del punto de conexión no existen: %s.",

package/Strings/resources.resjson/fr-FR/resources.resjson

@@ -1,4 +1,5 @@
 {
+  "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp : nous ne pouvons pas copier un répertoire « %s » sans l’option récursive",
   "loc.messages.LIB_CopyFileFailed": "Erreur durant la copie du fichier. Tentatives restantes : %s",
   "loc.messages.LIB_DirectoryStackEmpty": "La pile de répertoires est vide",
   "loc.messages.LIB_EndpointAuthNotExist": "Données d'authentification du point de terminaison absentes : %s",

package/Strings/resources.resjson/it-IT/resources.resjson

@@ -1,4 +1,5 @@
 {
+  "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: impossibile copiare una directory '%s' senza l'opzione ripetuta",
   "loc.messages.LIB_CopyFileFailed": "Si è verificato un errore durante la copia del file. Tentativi rimasti: %s",
   "loc.messages.LIB_DirectoryStackEmpty": "Lo stack della directory è vuoto",
   "loc.messages.LIB_EndpointAuthNotExist": "I dati di autenticazione endpoint non sono presenti: %s",

package/Strings/resources.resjson/ja-JP/resources.resjson

@@ -1,4 +1,5 @@
 {
+  "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: 再帰オプションなしでディレクトリ '%s' をコピーすることはできません",
   "loc.messages.LIB_CopyFileFailed": "ファイルのコピー中にエラーが発生しました。残りの試行回数: %s",
   "loc.messages.LIB_DirectoryStackEmpty": "ディレクトリ スタックが空です",
   "loc.messages.LIB_EndpointAuthNotExist": "エンドポイントの認証データがありません: %s",

package/Strings/resources.resjson/ko-KR/resources.resjson

@@ -1,4 +1,5 @@
 {
+  "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: 재귀 옵션 없이 디렉터리 '%s'를 복사할 수 없습니다.",
   "loc.messages.LIB_CopyFileFailed": "파일을 복사하는 동안 오류가 발생했습니다. 남은 시도 횟수: %s",
   "loc.messages.LIB_DirectoryStackEmpty": "디렉터리 스택이 비어 있습니다.",
   "loc.messages.LIB_EndpointAuthNotExist": "엔드포인트 인증 데이터가 없음: %s",

package/Strings/resources.resjson/ru-RU/resources.resjson

@@ -1,4 +1,5 @@
 {
+  "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: невозможно скопировать каталог '%s' без параметра рекурсии",
   "loc.messages.LIB_CopyFileFailed": "Ошибка при копировании файла. Оставшееся число попыток: %s.",
   "loc.messages.LIB_DirectoryStackEmpty": "Стек каталога пуст",
   "loc.messages.LIB_EndpointAuthNotExist": "Отсутствуют данные для проверки подлинности конечной точки: %s",

package/Strings/resources.resjson/zh-CN/resources.resjson

@@ -1,4 +1,5 @@
 {
+  "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: 没有递归选项，无法复制目录 \"%s\"",
   "loc.messages.LIB_CopyFileFailed": "复制文件时出错。剩余尝试次数: %s",
   "loc.messages.LIB_DirectoryStackEmpty": "目录堆栈为空",
   "loc.messages.LIB_EndpointAuthNotExist": "终结点授权数据不存在: %s",

package/Strings/resources.resjson/zh-TW/resources.resjson

@@ -1,4 +1,5 @@
 {
+  "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp：未指定遞迴選項，無法複製目錄 '%s'",
   "loc.messages.LIB_CopyFileFailed": "複製檔案時發生錯誤。剩餘嘗試次數: %s",
   "loc.messages.LIB_DirectoryStackEmpty": "目錄堆疊是空的",
   "loc.messages.LIB_EndpointAuthNotExist": "端點驗證資料不存在: %s",

package/externaloutput.d.ts

@@ -5,23 +5,36 @@ import stream = require('stream');
 import im = require('./internal');
 /** Commands allowed by default once VSO commands are enabled for a path. */
 export declare const defaultAllowedVsoCommands: readonly string[];
+/** Controls whether VSO commands are blocked, reported through telemetry, both, or neither. */
+export type VsoCommandMode = 'disabled' | 'telemetryOnly' | 'blockOnly' | 'blockAndTelemetry';
 /**
  * Where the external output originates. Used for documentation and telemetry only; it does
  * NOT select an automatic allowlist. A task must explicitly enable VSO commands when needed.
  */
 export type ExternalOutputSource = 'remote' | 'childProcess' | 'repository';
+export interface VsoCommandTelemetryEvent {
+    source: ExternalOutputSource;
+    commandName: string;
+    blocked: boolean;
+}
+export type VsoCommandTelemetrySink = (event: VsoCommandTelemetryEvent) => void;
 export interface ExternalOutputOptions {
     /** Origin of the output. Documentation/telemetry only. */
     source: ExternalOutputSource;
     /**
-     * When false or omitted, every "##vso[" marker is blocked. When true, markers whose
-     * command name is in the effective allowlist pass through unchanged.
+        * Controls VSO command blocking and telemetry.
+        * @defaultValue 'blockOnly'
+     */
+    vsoCommandMode?: VsoCommandMode;
+    /**
+        * When blocking is active, false or omitted blocks every "##vso[" marker. When true,
+        * markers whose command name is in the effective allowlist pass through unchanged.
      */
     enableVsoCommands?: boolean;
     /**
      * The allowlist of "area.event" command names to permit when enableVsoCommands is true.
      * Replaces (does not extend) the default list. An explicit empty array allows nothing.
-     * Has no effect when enableVsoCommands is false.
+    * Has no effect when enableVsoCommands is false or blocking is inactive.
      */
     allowedVsoCommands?: readonly string[];
     /** Destination for filtered output. Defaults to process.stdout. */
@@ -35,8 +48,11 @@ export interface ExternalOutputOptions {
 export declare class MarkerFilter {
     private readonly enabled;
     private readonly allowed;
+    private readonly block;
+    private readonly source?;
+    private readonly telemetry?;
     private pending;
-    constructor(enabled: boolean, allowed: Set<string>);
+    constructor(enabled: boolean, allowed: Set<string>, block?: boolean, source?: ExternalOutputSource | undefined, telemetry?: VsoCommandTelemetrySink | undefined);
     push(chunk: Buffer): Buffer;
     flush(): Buffer;
 }

package/externaloutput.js

@@ -63,6 +63,38 @@ var LF = 0x0A;
 var MAX_HEADER = 256;
 /** Commands allowed by default once VSO commands are enabled for a path. */
 exports.defaultAllowedVsoCommands = Object.freeze(['task.debug', 'task.setprogress']);
+function resolveVsoCommandMode(mode) {
+    switch (mode || 'blockOnly') {
+        case 'disabled':
+            return { block: false, telemetry: false };
+        case 'telemetryOnly':
+            return { block: false, telemetry: true };
+        case 'blockAndTelemetry':
+            return { block: true, telemetry: true };
+        case 'blockOnly':
+            return { block: true, telemetry: false };
+        default:
+            // JavaScript callers can bypass the TypeScript union. Preserve the secure default.
+            return { block: true, telemetry: false };
+    }
+}
+function publishVsoCommandTelemetry(event) {
+    try {
+        var telemetryEvent = __assign(__assign({}, event), { SYSTEM_TASKINSTANCEID: im._getVariable('SYSTEM_TASKINSTANCEID') || '', SYSTEM_TASKINSTANCENAME: im._getVariable('SYSTEM_TASKINSTANCENAME') || '', SYSTEM_JOBID: im._getVariable('SYSTEM_JOBID') || '', SYSTEM_PLANID: im._getVariable('SYSTEM_PLANID') || '' });
+        im._command('telemetry.publish', { area: 'TaskLib', feature: 'ExternalOutputVsoCommand' }, JSON.stringify(telemetryEvent));
+    }
+    catch (_err) {
+        console.error(_err);
+        // Telemetry is best effort and must not interrupt external-output handling.
+    }
+}
+function createMarkerFilter(options) {
+    var mode = resolveVsoCommandMode(options.vsoCommandMode);
+    var telemetry = mode.telemetry
+        ? function (event) { return publishVsoCommandTelemetry(event); }
+        : undefined;
+    return new MarkerFilter(!!options.enableVsoCommands, resolveAllowed(options), mode.block, options.source, telemetry);
+}
 function resolveAllowed(options) {
     if (!options.enableVsoCommands) {
         return new Set();
@@ -120,9 +152,13 @@ function scanHeader(buf, start) {
  * boundary, so memory stays bounded regardless of input size.
  */
 var MarkerFilter = /** @class */ (function () {
-    function MarkerFilter(enabled, allowed) {
+    function MarkerFilter(enabled, allowed, block, source, telemetry) {
+        if (block === void 0) { block = true; }
         this.enabled = enabled;
         this.allowed = allowed;
+        this.block = block;
+        this.source = source;
+        this.telemetry = telemetry;
         this.pending = EMPTY;
     }
     MarkerFilter.prototype.push = function (chunk) {
@@ -147,18 +183,23 @@ var MarkerFilter = /** @class */ (function () {
                 out.push(buf.subarray(pos, idx));
             }
             var afterMarker = idx + MARKER.length;
-            if (!this.enabled) {
+            if (this.block && !this.enabled && !this.telemetry) {
                 out.push(NEUTRALIZED);
                 pos = afterMarker;
                 continue;
             }
-            // Enabled: read the command name (up to the first space or ']') and allow the marker
-            // only when that name is allowlisted.
+            if (!this.block && !this.telemetry) {
+                out.push(MARKER);
+                pos = afterMarker;
+                continue;
+            }
+            // Read the command name (up to the first space or ']') for telemetry and, when
+            // blocking, to determine whether the marker is allowlisted.
             var _a = scanHeader(buf, afterMarker), term = _a.term, newline = _a.newline;
             if (term === -1) {
                 if (buf.length - afterMarker >= MAX_HEADER) {
                     // No terminator within the bound: fail closed.
-                    out.push(NEUTRALIZED);
+                    out.push(this.block ? NEUTRALIZED : MARKER);
                     pos = afterMarker;
                     continue;
                 }
@@ -169,14 +210,18 @@ var MarkerFilter = /** @class */ (function () {
             // A CR/LF before the terminator means the agent (which parses per line) would never
             // treat this as a command, so we fail closed and neutralize.
             if (newline) {
-                out.push(NEUTRALIZED);
+                out.push(this.block ? NEUTRALIZED : MARKER);
                 pos = afterMarker;
                 continue;
             }
             var name_1 = canonicalCommandName(buf.toString('utf8', afterMarker, term));
+            var blocked = this.block && !(this.enabled && name_1 && this.allowed.has(name_1));
+            if (this.telemetry && name_1 && this.source) {
+                this.telemetry({ source: this.source, commandName: name_1, blocked: blocked });
+            }
             // Allowlisted markers pass unchanged; the header/data after them flow through as
             // ordinary bytes and any later markers are evaluated independently.
-            out.push(name_1 && this.allowed.has(name_1) ? MARKER : NEUTRALIZED);
+            out.push(blocked ? NEUTRALIZED : MARKER);
             pos = afterMarker;
         }
         if (out.length === 0) {
@@ -196,7 +241,7 @@ var MarkerFilter = /** @class */ (function () {
             return EMPTY;
         }
         // An incomplete command candidate that begins with the full marker is neutralized.
-        if (this.enabled && p.length >= MARKER.length && p.subarray(0, MARKER.length).equals(MARKER)) {
+        if (this.block && p.length >= MARKER.length && p.subarray(0, MARKER.length).equals(MARKER)) {
             return Buffer.concat([NEUTRALIZED, p.subarray(MARKER.length)]);
         }
         // A partial marker (fewer than the full bytes) cannot be executed by the agent, so it
@@ -215,7 +260,7 @@ var ExternalOutputStream = /** @class */ (function (_super) {
     __extends(ExternalOutputStream, _super);
     function ExternalOutputStream(options) {
         var _this = _super.call(this) || this;
-        _this.markerFilter = new MarkerFilter(!!options.enableVsoCommands, resolveAllowed(options));
+        _this.markerFilter = createMarkerFilter(options);
         return _this;
     }
     ExternalOutputStream.prototype._transform = function (chunk, _encoding, callback) {
@@ -262,7 +307,7 @@ function createExternalOutputStream(options) {
 exports.createExternalOutputStream = createExternalOutputStream;
 /** Filters one complete value for internal task-lib consumers. */
 function filterExternalOutput(data, options) {
-    var filter = new MarkerFilter(!!options.enableVsoCommands, resolveAllowed(options));
+    var filter = createMarkerFilter(options);
     var buf = Buffer.isBuffer(data) ? data : Buffer.from(String(data), 'utf8');
     var filtered = filter.push(buf);
     var pending = filter.flush();
@@ -271,7 +316,7 @@ function filterExternalOutput(data, options) {
 exports.filterExternalOutput = filterExternalOutput;
 /** Creates a stateful writer for internal consumers that receive output in chunks. */
 function createFilteredWriter(options, destination) {
-    var filter = new MarkerFilter(!!options.enableVsoCommands, resolveAllowed(options));
+    var filter = createMarkerFilter(options);
     var ended = false;
     return {
         write: function (data) {

package/lib-resource.js

@@ -45,6 +45,7 @@ module.exports = {
   },
   "localizedMessages": {
     "de-DE": {
+      "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: Das Verzeichnis „%s“ kann ohne die Option „Rekursiv“ nicht kopiert werden.",
       "loc.messages.LIB_CopyFileFailed": "Fehler beim Kopieren der Datei. Verbleibende Versuche: %s",
       "loc.messages.LIB_DirectoryStackEmpty": "Der Verzeichnisstapel ist leer.",
       "loc.messages.LIB_EndpointAuthNotExist": "Die Endpunkt-Authentifizierungsdatensind nicht vorhanden: %s",
@@ -124,6 +125,7 @@ module.exports = {
       "loc.messages.LIB_WhichNotFound_Win": "Unable to locate executable file: '%s'. Please verify either the file path exists or the file can be found within a directory specified by the PATH environment variable. Also verify the file has a valid extension for an executable file."
     },
     "es-ES": {
+      "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: no se puede copiar un directorio''%s'' sin la opción recursiva",
       "loc.messages.LIB_CopyFileFailed": "Error al copiar el archivo. Intentos restantes: %s",
       "loc.messages.LIB_DirectoryStackEmpty": "La pila de directorios está vacía",
       "loc.messages.LIB_EndpointAuthNotExist": "Los datos de autenticación del punto de conexión no existen: %s.",
@@ -163,6 +165,7 @@ module.exports = {
       "loc.messages.LIB_WhichNotFound_Win": "No se puede encontrar el archivo ejecutable: \"%s\". Compruebe que la ruta de acceso del archivo existe o que el archivo se puede encontrar en un directorio especificado en la variable de entorno PATH. Revise también que el archivo tenga una extensión válida para un archivo ejecutable."
     },
     "fr-FR": {
+      "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp : nous ne pouvons pas copier un répertoire « %s » sans l’option récursive",
       "loc.messages.LIB_CopyFileFailed": "Erreur durant la copie du fichier. Tentatives restantes : %s",
       "loc.messages.LIB_DirectoryStackEmpty": "La pile de répertoires est vide",
       "loc.messages.LIB_EndpointAuthNotExist": "Données d'authentification du point de terminaison absentes : %s",
@@ -202,6 +205,7 @@ module.exports = {
       "loc.messages.LIB_WhichNotFound_Win": "Impossible de localiser le fichier exécutable : '%s'. Vérifiez si le chemin du fichier existe ou si le fichier peut se trouver dans un répertoire spécifié par la variable d'environnement PATH. Vérifiez également si le fichier a une extension de fichier exécutable valide."
     },
     "it-IT": {
+      "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: impossibile copiare una directory '%s' senza l'opzione ripetuta",
       "loc.messages.LIB_CopyFileFailed": "Si è verificato un errore durante la copia del file. Tentativi rimasti: %s",
       "loc.messages.LIB_DirectoryStackEmpty": "Lo stack della directory è vuoto",
       "loc.messages.LIB_EndpointAuthNotExist": "I dati di autenticazione endpoint non sono presenti: %s",
@@ -241,6 +245,7 @@ module.exports = {
       "loc.messages.LIB_WhichNotFound_Win": "Il file eseguibile '%s' non è stato trovato. Verificare se il percorso di file esiste o il file è presente in una directory specificata dalla variabile di ambiente PATH. Controllare anche che l'estensione sia valida per un file eseguibile."
     },
     "ja-JP": {
+      "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: 再帰オプションなしでディレクトリ '%s' をコピーすることはできません",
       "loc.messages.LIB_CopyFileFailed": "ファイルのコピー中にエラーが発生しました。残りの試行回数: %s",
       "loc.messages.LIB_DirectoryStackEmpty": "ディレクトリ スタックが空です",
       "loc.messages.LIB_EndpointAuthNotExist": "エンドポイントの認証データがありません: %s",
@@ -280,6 +285,7 @@ module.exports = {
       "loc.messages.LIB_WhichNotFound_Win": "実行可能ファイルが見つかりません: '%s'。ファイル パスが存在すること、またはそのファイルが PATH 環境変数で指定されたディレクトリ内にあることをご確認ください。そのファイルに実行可能ファイルの有効な拡張子がついていることもご確認ください。"
     },
     "ko-KR": {
+      "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: 재귀 옵션 없이 디렉터리 '%s'를 복사할 수 없습니다.",
       "loc.messages.LIB_CopyFileFailed": "파일을 복사하는 동안 오류가 발생했습니다. 남은 시도 횟수: %s",
       "loc.messages.LIB_DirectoryStackEmpty": "디렉터리 스택이 비어 있습니다.",
       "loc.messages.LIB_EndpointAuthNotExist": "엔드포인트 인증 데이터가 없음: %s",
@@ -319,6 +325,7 @@ module.exports = {
       "loc.messages.LIB_WhichNotFound_Win": "실행 파일 '%s'을(를) 찾을 수 없습니다. 파일 경로가 있는지 또는 PATH 환경 변수에서 지정한 디렉터리 내에서 파일을 찾을 수 있는지 확인하세요. 또한 파일이 실행 파일에 대해 올바른 확장명을 가지고 있는지 확인하세요."
     },
     "ru-RU": {
+      "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: невозможно скопировать каталог '%s' без параметра рекурсии",
       "loc.messages.LIB_CopyFileFailed": "Ошибка при копировании файла. Оставшееся число попыток: %s.",
       "loc.messages.LIB_DirectoryStackEmpty": "Стек каталога пуст",
       "loc.messages.LIB_EndpointAuthNotExist": "Отсутствуют данные для проверки подлинности конечной точки: %s",
@@ -358,6 +365,7 @@ module.exports = {
       "loc.messages.LIB_WhichNotFound_Win": "Не удалось найти исполняемый файл: \"%s\". Убедитесь, что путь к файлу существует и что файл можно найти в каталоге, указанном переменной окружения PATH. Также убедитесь, что у файла есть допустимое расширение для исполняемого файла."
     },
     "zh-CN": {
+      "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp: 没有递归选项，无法复制目录 \"%s\"",
       "loc.messages.LIB_CopyFileFailed": "复制文件时出错。剩余尝试次数: %s",
       "loc.messages.LIB_DirectoryStackEmpty": "目录堆栈为空",
       "loc.messages.LIB_EndpointAuthNotExist": "终结点授权数据不存在: %s",
@@ -397,6 +405,7 @@ module.exports = {
       "loc.messages.LIB_WhichNotFound_Win": "无法定位可执行文件: \"%s\"。请验证文件路径是否存在或文件是否可在 PATH 环境变量指定的目录内找到。另请验证该文件是否具有可执行文件的有效扩展名。"
     },
     "zh-TW": {
+      "loc.messages.LIB_CopyDirectoryWithoutRecursiveOption": "cp：未指定遞迴選項，無法複製目錄 '%s'",
       "loc.messages.LIB_CopyFileFailed": "複製檔案時發生錯誤。剩餘嘗試次數: %s",
       "loc.messages.LIB_DirectoryStackEmpty": "目錄堆疊是空的",
       "loc.messages.LIB_EndpointAuthNotExist": "端點驗證資料不存在: %s",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azure-pipelines-task-lib",
-  "version": "5.281.1",
+  "version": "5.282.0",
   "description": "Azure Pipelines Task SDK",
   "main": "./task.js",
   "typings": "./task.d.ts",
@@ -28,7 +28,7 @@
   "homepage": "https://github.com/Microsoft/azure-pipelines-task-lib",
   "dependencies": {
     "minimatch": "^3.1.5",
-    "nodejs-file-downloader": "^4.11.1",
+    "nodejs-file-downloader": "^4.13.0",
     "q": "^1.5.1",
     "semver": "^5.7.2",
     "shelljs": "^0.10.0"
@@ -45,9 +45,10 @@
     "typescript": "^4.9.5"
   },
   "overrides": {
-    "brace-expansion@1.x": { ".": "1.1.18" },
-    "brace-expansion@2.x": { ".": "2.1.4" },
+    "brace-expansion@1.x": { ".": "^1.1.21" },
+    "brace-expansion@2.x": { ".": "^2.1.7" },
     "js-yaml": "^4.3.2",
-    "serialize-javascript": "7.0.5"
+    "serialize-javascript": "7.0.5",
+    "follow-redirects": "^1.16.1"
   }
 }

package/task.d.ts

@@ -848,7 +848,9 @@ export type ExternalOutputIssueOptions = eom.ExternalOutputIssueOptions;
  *
  * By default every marker is blocked. Set enableVsoCommands to true (optionally with an
  * explicit allowedVsoCommands list) to permit a small set of command names on a
- * compatibility-sensitive path.
+ * compatibility-sensitive path. Set vsoCommandMode to control blocking and Kusto telemetry
+ * independently. Telemetry includes only the output source, canonical command name, and
+ * whether the command was blocked; command properties and data are never included.
  *
  * @param options   External output options. See ExternalOutputOptions.
  * @returns         A writable/readable stream to pipe untrusted output into.

package/task.js

@@ -2466,7 +2466,9 @@ exports.ToolRunner = trm.ToolRunner;
  *
  * By default every marker is blocked. Set enableVsoCommands to true (optionally with an
  * explicit allowedVsoCommands list) to permit a small set of command names on a
- * compatibility-sensitive path.
+ * compatibility-sensitive path. Set vsoCommandMode to control blocking and Kusto telemetry
+ * independently. Telemetry includes only the output source, canonical command name, and
+ * whether the command was blocked; command properties and data are never included.
  *
  * @param options   External output options. See ExternalOutputOptions.
  * @returns         A writable/readable stream to pipe untrusted output into.