buninu-linux 0.7.5 → 0.8.55

package/initramfs/buninu/apps/bunmsh/test/shell1.test.js

@@ -420,6 +420,69 @@ describe("execution", () => {
     });
   });
 
+  test("parses POSIX case clauses independently of physical lines", async () => {
+    expect(await run('case "a b" in a\\ b|no) echo escaped;; *) echo bad;; esac')).toMatchObject({
+      status: 0,
+      stdout: "escaped\n",
+      stderr: "",
+    });
+    expect(await run("case x in (no) echo bad ;; (x) echo parenthesized\nesac")).toMatchObject({
+      status: 0,
+      stdout: "parenthesized\n",
+      stderr: "",
+    });
+    expect(await run("case x in x) case y in y) echo nested;; esac ;; *) echo bad;; esac")).toMatchObject({
+      status: 0,
+      stdout: "nested\n",
+      stderr: "",
+    });
+    expect(await run("case outer in outer) case inner in inner) echo autoconf;; esac;; *) echo bad;; esac")).toMatchObject({
+      status: 0,
+      stdout: "autoconf\n",
+      stderr: "",
+    });
+    expect(await run("case x in x) echo case;; esac; echo after")).toMatchObject({
+      status: 0,
+      stdout: "case\nafter\n",
+      stderr: "",
+    });
+    expect(await run("case b in [!ac]) echo bracket;; *) echo bad;; esac; case '*' in '*') echo quoted;; esac")).toMatchObject({
+      stdout: "bracket\nquoted\n",
+    });
+  });
+
+  test("implements mksh case fall-through terminators", async () => {
+    expect(await run("case b in a) echo a ;& b) echo b ;& c) echo c ;; esac")).toMatchObject({
+      stdout: "b\nc\n",
+    });
+    expect(await run("case b in a) echo a ;| b) echo b ;| *) echo star ;; esac")).toMatchObject({
+      stdout: "b\nstar\n",
+    });
+  });
+
+  test("accepts POSIX for headers with do on the next line", async () => {
+    expect(await run("for value in one two\ndo\n echo $value\ndone")).toMatchObject({
+      status: 0,
+      stdout: "one\ntwo\n",
+      stderr: "",
+    });
+    expect(await run("set -- left right; for arg\ndo echo $arg; done")).toMatchObject({
+      status: 0,
+      stdout: "left\nright\n",
+      stderr: "",
+    });
+    expect(await run("set -- a b; for arg; do printf '<%s>\\n' \"$arg\"; done")).toMatchObject({
+      status: 0,
+      stdout: "<a>\n<b>\n",
+      stderr: "",
+    });
+    expect(await run("for value in; do echo bad; done; echo empty")).toMatchObject({
+      status: 0,
+      stdout: "empty\n",
+      stderr: "",
+    });
+  });
+
   test("provides basic fallback text and utility commands", async () => {
     expect(await run("printf 'c\\na\\nb\\n' | builtin sort")).toMatchObject({ stdout: "a\nb\nc\n" });
     expect(await run("printf 'one two\\nthree\\n' | builtin wc -lwc")).toMatchObject({ stdout: "2 3 14\n" });
@@ -933,6 +996,7 @@ fi
   test("expands variables while respecting single quotes", async () => {
     const output = await run(`X=world; print -r -- "hello $X"; print -r -- '$X'`);
     expect(output.stdout).toBe("hello world\n$X\n");
+    expect((await run("printf '%s\\n' \"literal\\`backtick\"")).stdout).toBe("literal`backtick\n");
   });
 
   test("supports status connectors", async () => {

package/initramfs/buninu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu",
-  "version": "0.4.18",
+  "version": "0.4.19",
   "description": "Buninu is a portable, self-bootstrapping Unix-like userspace built on Bun that runs across operating systems",
   "type": "module",
   "main": "./bin/init.js",

package/initramfs/init.js

@@ -435,6 +435,11 @@ const launchBunmsh = () => {
 let replServer = null;
 
 const launchBuninu = async () => {
+  try {
+    await Bun.write("/proc/sys/kernel/hostname", "buninu\n");
+  } catch (error) {
+    console.error(`init.js: setting hostname: ${error?.message ?? error}`);
+  }
 
   console.log(`
 Type bunterm in bunmsh: Graphical Terminal

package/initramfs/lib/browser-resources.js

@@ -0,0 +1,25 @@
+// Distribution-owned startup hook: npm updates may replace the browser, but
+// cannot replace this helper. Existing package resources are never overwritten.
+import { lstatSync, mkdirSync, statSync, symlinkSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+
+const lstat = (path) => {
+  try { return lstatSync(path); }
+  catch (error) { if (error.code === "ENOENT") return null; throw error; }
+};
+
+export function ensureBrowserResources(browser, systemRoot = "/") {
+  const resources = [
+    ["usr/lib/canvaskit", "lib/canvaskit"],
+    ["usr/share/fonts", "usr/share/fonts"],
+  ];
+  for (const [local, shared] of resources) {
+    const path = join(browser, local);
+    if (lstat(path)) continue; // Includes symlinks: do not overwrite user data.
+    const target = resolve(systemRoot, shared);
+    if (!statSync(target).isDirectory()) throw new Error(`missing browser resources: ${target}`);
+    mkdirSync(dirname(path), { recursive: true });
+    try { symlinkSync(relative(dirname(path), target), path); }
+    catch (error) { if (error.code !== "EEXIST") throw error; }
+  }
+}

package/initramfs/lib/tar-exclude.js

@@ -0,0 +1,20 @@
+// Match original archive paths, before --strip-components. Testing ancestors
+// makes an excluded directory exclude its whole subtree, even without a
+// directory header. Like tar's default excludes, matches may start at any
+// path component. Glob syntax is Bun.Glob's, not every GNU tar extension.
+const normalize = (name) => name.replace(/^(?:\.\/)+/, "").replace(/^\/+|\/+$/g, "");
+
+export function excludeMatcher(patterns) {
+  if (!patterns.length) return () => false;
+  const globs = patterns.map((pattern) => new Bun.Glob(normalize(pattern)));
+  return (name) => {
+    const parts = normalize(name).split("/");
+    for (let end = parts.length; end > 0; end--) {
+      for (let start = 0; start < end; start++) {
+        const candidate = parts.slice(start, end).join("/");
+        if (globs.some((glob) => glob.match(candidate))) return true;
+      }
+    }
+    return false;
+  };
+}

package/initramfs/lib/tar-strip.js

@@ -0,0 +1,94 @@
+// Opt-in --strip-components / --exclude extraction (count may be zero).
+// The ordinary Bun.Archive path is
+// deliberately separate. Payload offsets come from the CLI's tar scanner.
+import { linkSync, lstatSync, mkdirSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+export function strippedName(name, count) {
+  const parts = name.replace(/^\/+/, "").split("/").filter(Boolean);
+  // Validate before stripping so removed prefixes cannot hide traversal.
+  if (parts.includes("..") || name.includes("\0")) throw new Error(`unsafe archive path: ${name}`);
+  // A leading './' counts as a component, as in GNU tar. Interior '.'
+  // components can be removed after counting to form the destination path.
+  const remaining = parts.slice(count).filter((part) => part !== ".");
+  return remaining.length ? remaining.join("/") : null;
+}
+
+const stat = (path) => {
+  try { return lstatSync(path); }
+  catch (error) { if (error.code === "ENOENT") return null; throw error; }
+};
+
+export function extractStripped(bytes, entries, directory, count, { verbose = false, filtered = false } = {}) {
+  mkdirSync(directory, { recursive: true });
+  const root = realpathSync(directory);
+  // Refuse existing symlink ancestors too, not just links in this archive.
+  const ensureDirectory = (name) => {
+    let path = root;
+    for (const part of name.split("/")) {
+      if (!part || part === ".") continue;
+      path = join(path, part);
+      const info = stat(path);
+      if (info && (!info.isDirectory() || info.isSymbolicLink())) throw new Error(`not a safe directory: ${path}`);
+      if (!info) mkdirSync(path);
+    }
+    return path;
+  };
+  const destination = (name) => {
+    ensureDirectory(dirname(name));
+    return join(root, name);
+  };
+  const removeLeaf = (path) => {
+    if (stat(path)) rmSync(path); // Never recursively remove directories.
+  };
+  const hardlinks = [], symlinks = [];
+  for (const entry of entries) {
+    const name = strippedName(entry.archiveName ?? entry.name, count);
+    if (!name) continue;
+    if (verbose) console.log(entry.name);
+    if (entry.kind === "directory") {
+      ensureDirectory(name);
+    } else if (entry.kind === "file") {
+      const { dataOffset: start, size } = entry;
+      if (!Number.isSafeInteger(start) || !Number.isSafeInteger(size) || size < 0
+          || start < 0 || size > bytes.length - start) throw new Error(`truncated tar member: ${entry.name}`);
+      const path = destination(name);
+      removeLeaf(path);
+      writeFileSync(path, bytes.subarray(start, start + size), { flag: "wx" });
+    } else if (entry.kind === "hardlink") {
+      const target = strippedName(entry.target, count);
+      if (target) hardlinks.push({ name, target });
+    } else if (entry.kind === "symlink") {
+      symlinks.push({ name, target: entry.target });
+    }
+    // Device nodes and FIFOs remain unsupported, like Bun.Archive.
+  }
+  // Hardlink targets are archive-root-relative and must also be stripped.
+  // Retry forward references and chains before making any symbolic links.
+  let pending = hardlinks;
+  while (pending.length) {
+    const next = [];
+    for (const entry of pending) {
+      const source = destination(entry.target);
+      const info = stat(source);
+      if (!info) { next.push(entry); continue; }
+      if (!info.isFile() || info.isSymbolicLink()) throw new Error(`unsafe hardlink target: ${entry.target}`);
+      const path = destination(entry.name);
+      if (path === source) continue;
+      removeLeaf(path);
+      linkSync(source, path);
+    }
+    if (next.length === pending.length) {
+      if (!filtered) throw new Error(`missing hardlink target: ${next[0].target}`);
+      break;
+    }
+    pending = next;
+  }
+  // Symbolic link contents are not member names: preserve them verbatim,
+  // including absolute rootfs targets. No file data is written afterwards.
+  for (const entry of symlinks) {
+    const path = destination(entry.name);
+    removeLeaf(path);
+    symlinkSync(entry.target, path);
+  }
+}

package/initramfs/lib/top-memory.js

@@ -0,0 +1,12 @@
+// /proc/meminfo reports KiB. Cache is informational, not all reclaimable.
+export function memoryText(memory) {
+  const total = memory.MemTotal ?? 0;
+  const free = memory.MemFree ?? 0;
+  const available = memory.MemAvailable;
+  // Old kernels without MemAvailable: conservatively count everything not
+  // free as used, and do not present that fallback as a kernel estimate.
+  const used = Math.max(0, total - (available ?? free));
+  const cache = (memory.Buffers ?? 0) + (memory.Cached ?? 0) + (memory.SReclaimable ?? 0);
+  const mib = (value) => (value / 1024).toFixed(1);
+  return `MiB Mem : ${mib(total)} total, ${mib(free)} free, ${mib(used)} used, ${mib(cache)} buff/cache, ${available == null ? "n/a" : mib(available)} available`;
+}

package/initramfs/usr/share/doc/buninu-linux/tar.md

@@ -25,11 +25,12 @@ Use `-` as ARCHIVE to read from standard input or write to standard output.
 | `-t` | List archive members. |
 | `-f ARCHIVE`, `--file=ARCHIVE` | Archive file, or `-` for standard input/output. |
 | `-C DIR`, `--directory=DIR` | Read input files from DIR, or extract into DIR. |
+| `--strip-components=N`, `--strip-components N` | Remove N leading path components when extracting. N must be a non-negative integer. Members with no remaining name are skipped. |
 | `-z`, `--gzip` | Create gzip-compressed tar, or explicitly identify gzip input. |
 | `--zstd` | Create or read a zstd-compressed tar. A `.zst` or `.tzst` input is also detected by name. |
 | `-v` | Print names while creating/extracting; with `-t`, also show each member's size, modification time, kind and link target. |
 | `-o`, `--no-same-owner`, `--no-same-permissions`, `--overwrite` | GNU tar compatibility for extraction; these already match Bun.Archive's behaviour. |
-| `--exclude=PATTERN` | Accepted for js-udocker compatibility. Device nodes are not extracted and js-udocker removes whiteout files separately. |
+| `--exclude=PATTERN`, `--exclude PATTERN` | Exclude matching paths and their descendants during creation, listing, or extraction. Repeat to exclude multiple patterns. Uses Bun.Glob syntax; quote wildcards to prevent shell expansion. |
 
 Short options can be combined, for example `-xzvf` or `-czf`.
 For the traditional first option word, the leading hyphen is optional, so
@@ -45,6 +46,12 @@ tar -tf source.tar.gz
 tar --zstd -cf backup.tar.zst home
 tar --zstd -xf backup.tar.zst -C /mnt/restore
 
+# Remove the package/ directory from an npm tarball
+tar -xzf package.tgz -C /tmp/package --strip-components=1
+
+# Exclude browser resources; match before removing package/
+tar -xzf buninu-browser-0.2.2.tgz -C /tmp/browser --strip-components=1 --exclude=package/usr
+
 # An Alpine root filesystem, symbolic links and all; then enter it
 tar -xzf alpine-minirootfs-3.24.1-x86_64.tar.gz -C /mnt/alpine
 chroot /mnt/alpine
@@ -52,6 +59,22 @@ chroot /mnt/alpine
 
 ## Links
 
+`--strip-components` applies only to extraction. Member filters match the
+original archive names, before stripping; listing still shows original names.
+Hardlink targets have the same number of components removed, while symbolic
+link targets are preserved verbatim. A leading `./` counts as one component.
+Exclude patterns match original paths, ignoring a leading `./` or `/` and
+trailing `/`. They may match starting at any path component; `usr` excludes
+any directory or file named `usr`, while `package/usr` targets that path.
+An excluded directory excludes all descendants, even without a directory
+header in the archive. Excluded hardlink targets are not restored from
+pre-existing destination files; symbolic link targets remain verbatim.
+This is not a complete implementation of GNU tar's pattern options.
+
+Without excludes and with no stripping (or `--strip-components=0`), the existing
+`Bun.Archive.extract()` route is unchanged. Positive counts or excludes use a separate
+extractor which rejects `..` components and symlink ancestors in output paths.
+
 Extraction restores symbolic links exactly as the archive records them,
 including absolute targets such as `/bin/busybox` and targets that do not
 exist yet, and it restores hard links. This is what GNU tar does, and it is

package/initramfs/usr/share/doc/buninu-linux/top.md

@@ -21,3 +21,21 @@ While running interactively, press `q` to quit, `P` to sort by CPU, `M` to
 sort by memory, or `N` to sort by PID. The first screen shows the lifetime CPU
 average available from `ps`; later screens show usage during the refresh
 interval.
+
+## Memory summary
+
+The summary uses `/proc/meminfo`, converting KiB to MiB:
+
+- `total`: `MemTotal`.
+- `free`: `MemFree`, currently unused memory.
+- `used`: `MemTotal - MemAvailable` (clamped at zero).
+- `available`: `MemAvailable`, the kernel's estimate of memory available to
+  new applications without swapping.
+- `buff/cache`: `Buffers + Cached + SReclaimable`, shown for reference.
+
+Cache is not all immediately reclaimable, particularly with memory-backed
+filesystems. It is no longer subtracted directly to calculate `used`.
+These fields overlap: `used + free + buff/cache` need not equal `total`.
+If a kernel does not report `MemAvailable`, `available` shows `n/a` and
+`used` falls back to `MemTotal - MemFree`, without subtracting cache.
+Per-process memory columns are unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu-linux",
-  "version": "0.7.5",
+  "version": "0.8.55",
   "description": "A Linux distribution running Bun as PID 1 with the Buninu userspace.",
   "type": "module",
   "main": "./index.js",

package/scripts/arch.js

@@ -16,8 +16,8 @@ export const rootDir = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
 const pins = {
   x86_64: {
-    linuxVirtSha256: "57a522d2b6e9d1b6c9de6b9f7fc42aa4b8d33ebf9f2b42b4251dbee6ff2d9839",
-    linuxLtsSha256: "1d02a1b74a8a09c476a3c01782c0b8613ae2935988e65d4d31e6bef44dfb8b64",
+    linuxVirtSha256: "a941c15fc5db26b6692fd0140fa0970da76cb12aadf3dc8306c419f21bd39c93",
+    linuxLtsSha256: "02ba9491d4cc110707de64ed03dd7e2fa5c93fdd851979c244ceb018785a9eea",
     muslSha256: "573712e2f49c15bfc20a2699f204acdfc74c772722b15e7353d768057fae0e71",
     stubSha256: "8e64a5a3afee5f930e6e6716be726dc6d405530ac7f8fa5be6251dae68671ec9",
     libstdcppSha256: "14c987b556f5385a5db18376e788c75f37d85321b8dc1920d926ea7daac1d6f6",
@@ -32,8 +32,8 @@ const pins = {
     serialMajor: 4,
   },
   aarch64: {
-    linuxVirtSha256: "9a4a6fa042b60b70f453dded99762810516b35793c64d776d75986b0b110b6e0",
-    linuxLtsSha256: "f945ddcc306546c7c22cf10249f637fc6e806ecc40286fb50950558dd573e7e9",
+    linuxVirtSha256: "c7fb892408d7fe163a18671e5c7816752976d1c67fd17794dfba794aa0d6c1ac",
+    linuxLtsSha256: "31aeae56fa527b2fb4fdd4aefbd693cbec210a8cbfd4ea7597a1773b832e9f83",
     muslSha256: "5e9674b7f41152fe2119093b5cb4c13eaaadb19c2d5422b2d7267913e663ee6e",
     stubSha256: "a1823d2d7082db555d528f82c1809f276c818aeb5b40f198f4565f104e055c38",
     libstdcppSha256: "2302e766d4e4926038ec166ecb85837ee884576115236ddb565e3a5fca4a11d7",
@@ -67,7 +67,7 @@ export const config = ({
   // The Alpine repository keeps only the newest build of a package, so a pin
   // stops downloading when Alpine bumps it; the hashes then fail loudly.
   const alpineBase = `${mirror}/v3.24/main/${arch}`;
-  const kernelVersion = "6.18.54";
+  const kernelVersion = "6.18.55";
   const kernelRelease = `${kernelVersion}-0-${flavor}`;
   const bunVersion = "1.4.2";
   const downloadsDir = join(rootDir, "downloads", arch);

package/scripts/arch.sh

@@ -44,7 +44,7 @@ fi
 alpine_mirror=${ALPINE_MIRROR:-https://dl-cdn.alpinelinux.org/alpine}
 alpine_base="$alpine_mirror/v3.24/main/$arch"
 
-kernel_version=6.18.54
+kernel_version=6.18.55
 kernel_release="$kernel_version-0-$linux_flavor"
 linux_package="linux-$linux_flavor-$kernel_version-r0.apk"
 musl_package=musl-1.2.6-r2.apk
@@ -63,8 +63,8 @@ musl_libc="libc.musl-$arch.so.1"
 
 case $arch in
     x86_64)
-        linux_virt_sha256=57a522d2b6e9d1b6c9de6b9f7fc42aa4b8d33ebf9f2b42b4251dbee6ff2d9839
-        linux_lts_sha256=1d02a1b74a8a09c476a3c01782c0b8613ae2935988e65d4d31e6bef44dfb8b64
+        linux_virt_sha256=a941c15fc5db26b6692fd0140fa0970da76cb12aadf3dc8306c419f21bd39c93
+        linux_lts_sha256=02ba9491d4cc110707de64ed03dd7e2fa5c93fdd851979c244ceb018785a9eea
         musl_sha256=573712e2f49c15bfc20a2699f204acdfc74c772722b15e7353d768057fae0e71
         stub_sha256=8e64a5a3afee5f930e6e6716be726dc6d405530ac7f8fa5be6251dae68671ec9
         libstdcpp_sha256=14c987b556f5385a5db18376e788c75f37d85321b8dc1920d926ea7daac1d6f6
@@ -82,8 +82,8 @@ case $arch in
         serial_major=4
         ;;
     aarch64)
-        linux_virt_sha256=9a4a6fa042b60b70f453dded99762810516b35793c64d776d75986b0b110b6e0
-        linux_lts_sha256=f945ddcc306546c7c22cf10249f637fc6e806ecc40286fb50950558dd573e7e9
+        linux_virt_sha256=c7fb892408d7fe163a18671e5c7816752976d1c67fd17794dfba794aa0d6c1ac
+        linux_lts_sha256=31aeae56fa527b2fb4fdd4aefbd693cbec210a8cbfd4ea7597a1773b832e9f83
         musl_sha256=5e9674b7f41152fe2119093b5cb4c13eaaadb19c2d5422b2d7267913e663ee6e
         stub_sha256=a1823d2d7082db555d528f82c1809f276c818aeb5b40f198f4565f104e055c38
         libstdcpp_sha256=2302e766d4e4926038ec166ecb85837ee884576115236ddb565e3a5fca4a11d7

package/scripts/fetch-npm.js

@@ -0,0 +1,51 @@
+// Fetch only: no package manager, lifecycle scripts, extraction or install
+// paths. Shell and JS use the same pins; both architectures share the cache.
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { rootDir, runIfMain } from "./arch.js";
+import { download } from "./fetch.js";
+
+export function parseNpmPins(text) {
+  // Only check the fixed shell-compatible shape here (including mandatory
+  // double quotes). Values are parsed once below, then validated as data.
+  const lines = text.split(/\r?\n/).filter((line) => line.trim() && !line.startsWith("#"));
+  const shape = [/^"[^"\\]+":$/, /^  - https:\/\/[^\s"#]+$/, /^  - sha256:[^\s"#]+$/];
+  if (!lines.length || lines.length % 3 || lines.some((line, index) => !shape[index % 3].test(line))) {
+    throw new Error("invalid npm pin format");
+  }
+  // Bun uses its native YAML parser. Node's fallback reads only the fixed
+  // three-line format, without a YAML dependency or a second parse on Bun.
+  const document = globalThis.Bun?.YAML
+    ? Bun.YAML.parse(text)
+    : Object.fromEntries(lines.flatMap((line, index) => index % 3 ? [] : [
+      [line.slice(1, -2), [lines[index + 1].slice(4), lines[index + 2].slice(4)]],
+    ]));
+  const entries = Object.entries(document);
+  if (entries.length !== lines.length / 3) throw new Error("duplicate npm pin");
+  const archives = new Set();
+  return entries.map(([key, values]) => {
+    const header = key.match(/^((?:@[a-z0-9._-]+\/)?[a-z0-9._-]+)@(\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?)$/);
+    if (!header || !Array.isArray(values) || values.length !== 2
+        || typeof values[0] !== "string" || typeof values[1] !== "string"
+        || !/^https:\/\/registry\.npmjs\.org\/[^\s"#]+\.tgz$/.test(values[0])
+        || !/^sha256:[a-f0-9]{64}$/.test(values[1])) throw new Error(`invalid npm pin: ${key}`);
+    const [, name, version] = header;
+    const archive = `${name.replace(/^@/, "").replace("/", "-")}-${version}.tgz`;
+    if (archives.has(archive)) throw new Error(`duplicate npm pin: ${name}`);
+    archives.add(archive);
+    return { name, version, archive, url: values[0], sha256: values[1].slice(7) };
+  });
+}
+
+export const npmPackages = parseNpmPins(readFileSync(new URL("./npm-packages.md", import.meta.url), "utf8"));
+export const npmDownloadsDir = join(rootDir, "downloads", "npm");
+
+export async function fetchNpm({ downloadsDir = npmDownloadsDir, downloadFile = download } = {}) {
+  const paths = [];
+  for (const pkg of npmPackages) {
+    paths.push(await downloadFile({ downloadsDir }, pkg.url, pkg.archive, pkg.sha256));
+  }
+  return paths;
+}
+
+runIfMain(import.meta.url, () => fetchNpm());

package/scripts/fetch.js

@@ -189,6 +189,7 @@ export const fetchBun = (cfg = config()) => withUmask022(async () => {
 export const fetchAll = async (cfg = config()) => {
   await fetchAlpine(cfg);
   await fetchBun(cfg);
+  await (await import("./fetch-npm.js")).fetchNpm();
 };
 
 runIfMain(import.meta.url, () => fetchAll());

package/scripts/js-tools.js

@@ -0,0 +1,3 @@
+// Opt out explicitly; unset, empty and other values keep the JS tools enabled.
+export const jsToolsEnabled = (value = process.env.BUNINU_JS_TOOLS) =>
+  !["0", "off", "false"].includes(String(value ?? "").trim().toLowerCase());

package/scripts/npm-packages.md

@@ -0,0 +1,18 @@
+# npm packages
+# Latest versions checked on 2026-10-11; SHA-256 pins verified against registry SHA-512 integrity.
+
+"buninu-browser@0.2.2":
+  - https://registry.npmjs.org/buninu-browser/-/buninu-browser-0.2.2.tgz
+  - sha256:d551fec88f0fe8a6494f806cc8b4b560454796e25f25493e8a3b5b77e6f7f10b
+
+"@drxiaozhi/casty@1.3.4":
+  - https://registry.npmjs.org/@drxiaozhi/casty/-/casty-1.3.4.tgz
+  - sha256:1899179d173702721c2f6e8bbffab51ca3421e899ac59c58b2588cfc342fa0df
+
+"@drxiaozhi/jspulse@0.2.1":
+  - https://registry.npmjs.org/@drxiaozhi/jspulse/-/jspulse-0.2.1.tgz
+  - sha256:9a34a76b1edac6767fa90e33cbc4d3a511c082e9ab73fb196390f841aad37839
+
+"@drxiaozhi/jspinyin@0.1.1":
+  - https://registry.npmjs.org/@drxiaozhi/jspinyin/-/jspinyin-0.1.1.tgz
+  - sha256:c6d10a40b6c93a942d85dff69ed2e45dacf506b15caab6821688e8e29df810ed

package/scripts/pack-initramfs.sh

@@ -25,6 +25,7 @@ trap 'rm -rf "$staging"; rm -f "$archive"' EXIT
 cp -a --reflink=auto initramfs/. "$staging/"
 rm -rf "$staging/bin/bun" "$staging/lib/modules"
 cp -a --reflink=auto "$native_dir/." "$staging/"
+bash scripts/stage-npm.sh "$staging"
 # Only this kernel's modules: native/<arch>/ keeps every release fetched so
 # far (an older pin, the other flavor), and none of those can load.
 for release_dir in "$staging/lib/modules"/*; do

package/scripts/pack.js

@@ -25,6 +25,7 @@ import {
 } from "node:fs";
 import { join } from "node:path";
 import { config, jsRuntime, rootDir, runIfMain } from "./arch.js";
+import { stageNpm } from "./stage-npm.js";
 
 /**
  * `cp -a SOURCE/. TARGET/`: modes, times and symlinks kept, directories
@@ -138,6 +139,7 @@ const packStaging = (cfg) => {
     rmSync(join(staging, "bin", "bun"), { force: true });
     rmSync(join(staging, "lib", "modules"), { recursive: true, force: true });
     copyTree(cfg.nativeDir, staging);
+    stageNpm(staging);
     // Only this kernel's modules: native/<arch>/ keeps every release fetched
     // so far (an older pin, the other flavor), and none of those can load.
     const modules = join(staging, "lib", "modules");

package/scripts/stage-npm.js

@@ -0,0 +1,57 @@
+// Assemble fetched packages in a disposable pack staging tree, never in the
+// source initramfs. No registry access, dependency resolution or lifecycle code.
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+import { jsRuntime, rootDir, runIfMain } from "./arch.js";
+import { npmDownloadsDir, npmPackages } from "./fetch-npm.js";
+
+export function stageNpm(staging, { packages = npmPackages, downloadsDir = npmDownloadsDir } = {}) {
+  const lib = resolve(staging, "usr/lib");
+  if (existsSync(join(lib, "package.json")) || existsSync(join(lib, "node_modules"))) {
+    throw new Error("npm staging destination already exists; refusing to overwrite it");
+  }
+  // Validate every archive before extracting any of them, including cached data.
+  for (const pkg of packages) {
+    const archive = join(downloadsDir, pkg.archive);
+    if (!existsSync(archive)) throw new Error(`missing ${archive}; run the fetch stage first`);
+    if (createHash("sha256").update(readFileSync(archive)).digest("hex") !== pkg.sha256) {
+      throw new Error(`SHA-256 mismatch: ${archive}`);
+    }
+  }
+  const runtime = jsRuntime();
+  const probe = spawnSync(runtime, ["-e", "process.exit(typeof Bun === 'undefined' ? 1 : 0)"], { stdio: "ignore" });
+  if (probe.status !== 0) throw new Error("JS npm extraction requires host Bun on PATH (for initramfs/bin/tar)");
+  const bins = join(lib, "node_modules/.bin");
+  mkdirSync(bins, { recursive: true });
+  for (const pkg of packages) {
+    const destination = join(lib, "node_modules", pkg.name);
+    mkdirSync(destination, { recursive: true });
+    const args = [join(rootDir, "initramfs/bin/tar"), "-xf", join(downloadsDir, pkg.archive),
+      "-C", destination, "--strip-components=1"];
+    if (pkg.name === "buninu-browser") args.push(
+      "--exclude=package/usr/lib/canvaskit", "--exclude=package/usr/share/fonts");
+    const result = spawnSync(runtime, args, { stdio: "inherit" });
+    if (result.status !== 0) throw new Error(`npm extraction failed: ${pkg.name}`);
+    const info = JSON.parse(readFileSync(join(destination, "package.json"), "utf8"));
+    if (info.name !== pkg.name || info.version !== pkg.version) throw new Error(`npm identity mismatch: ${pkg.name}`);
+    const entries = typeof info.bin === "string" ? { [pkg.name.split("/").pop()]: info.bin } : info.bin ?? {};
+    for (const [name, file] of Object.entries(entries)) {
+      const target = resolve(destination, file);
+      if (!/^[a-zA-Z0-9._-]+$/.test(name) || name === "." || name === ".."
+          || !target.startsWith(destination + "/")) throw new Error(`unsafe npm bin: ${name}`);
+      chmodSync(target, 0o755);
+      symlinkSync(relative(bins, target), join(bins, name));
+    }
+  }
+  writeFileSync(join(lib, "package.json"), JSON.stringify({
+    name: "buninu-system-apps", private: true,
+    dependencies: Object.fromEntries(packages.map(({ name, version }) => [name, version])),
+  }, null, 2) + "\n");
+}
+
+runIfMain(import.meta.url, () => {
+  if (!process.argv[2]) throw new Error("usage: bun scripts/stage-npm.js STAGING_DIRECTORY");
+  stageNpm(process.argv[2]);
+});

package/scripts/stage-npm.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Shell pack counterpart: the Docker toolchain intentionally needs no host Bun.
+set -euo pipefail
+umask 022
+cd "$(dirname "$0")/.."
+staging=${1:?usage: stage-npm.sh STAGING_DIRECTORY}
+lib="$staging/usr/lib"
+[[ ! -e "$lib/package.json" && ! -e "$lib/node_modules" ]] || {
+    echo 'error: npm staging destination already exists' >&2; exit 1;
+}
+header='^"((@[a-z0-9._-]+/)?[a-z0-9._-]+)@([0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.-]+)?)":$'
+source='^  - https://registry\.npmjs\.org/[^[:space:]"#]+\.tgz$'
+digest='^  - sha256:([a-f0-9]{64})$'
+invalid() { echo "error: invalid npm pin: $line" >&2; exit 1; }
+state=0
+names=() versions=() archives=() hashes=()
+seen='|'
+while IFS= read -r line || [[ -n "$line" ]]; do
+    line=${line%$'\r'}
+    [[ "$line" =~ ^[[:space:]]*$ || "$line" == \#* ]] && continue
+    case "$state" in
+        0)
+            [[ "$line" =~ $header ]] || invalid
+            name=${BASH_REMATCH[1]} version=${BASH_REMATCH[3]}
+            [[ "$seen" != *"|$name|"* ]] || invalid
+            seen="$seen$name|"
+            archive=${name#@}; archive=${archive/\//-}-$version.tgz
+            state=1 ;;
+        1) [[ "$line" =~ $source ]] || invalid; state=2 ;;
+        2)
+            [[ "$line" =~ $digest ]] || invalid
+            names+=("$name") versions+=("$version") archives+=("$archive") hashes+=("${BASH_REMATCH[1]}")
+            state=0 ;;
+    esac
+done < scripts/npm-packages.md
+[[ "$state" == 0 && ${#names[@]} -gt 0 ]] || invalid
+for ((i=0; i<${#names[@]}; i++)); do
+    printf '%s  %s\n' "${hashes[i]}" "downloads/npm/${archives[i]}" | sha256sum -c -
+done
+mkdir -p "$lib/node_modules/.bin"
+for ((i=0; i<${#names[@]}; i++)); do
+    name=${names[i]}
+    destination="$lib/node_modules/$name"
+    mkdir -p "$destination"
+    extra=()
+    [[ "$name" != buninu-browser ]] || extra+=(--exclude=package/usr/lib/canvaskit --exclude=package/usr/share/fonts)
+    tar -xf "downloads/npm/${archives[i]}" -C "$destination" --strip-components=1 "${extra[@]}"
+    # Bin entries of the four SHA-pinned packages; no package scripts execute.
+    bin=${name##*/}; entry=index.js
+    [[ "$name" != @drxiaozhi/jspulse ]] || entry=jspulse.js
+    chmod 755 "$destination/$entry"
+    ln -s "../$name/$entry" "$lib/node_modules/.bin/$bin"
+done
+{
+    printf '{\n  "name": "buninu-system-apps",\n  "private": true,\n  "dependencies": {\n'
+    for ((i=0; i<${#names[@]}; i++)); do
+        comma=,
+        [[ "$i" != "$((${#names[@]} - 1))" ]] || comma=''
+        printf '    "%s": "%s"%s\n' "${names[i]}" "${versions[i]}" "$comma"
+    done
+    printf '  }\n}\n'
+} > "$lib/package.json"