buninu-linux 0.8.55 → 0.9.56

package/NOTICE.md

@@ -105,83 +105,83 @@ the built image redistributes them.
 - License: GPL-2.0-only WITH Linux-syscall-note
 - See: `LICENSES/GPL-2.0.txt` and `LICENSES/Linux-syscall-note.txt`
 
-Linux 6.18.55 as packaged by Alpine Linux 3.24 from the `linux-lts` aport.
-The default build uses package `linux-virt`, version 6.18.55-r0.
-`--linux-lts` and `--real` use package `linux-lts`, version 6.18.55-r0.
+Linux 6.18.56 as packaged by Alpine Linux 3.24 from the `linux-lts` aport.
+The default build uses package `linux-virt`, version 6.18.56-r0.
+`--linux-lts` and `--real` use package `linux-lts`, version 6.18.56-r0.
 Each comes from the x86_64 or aarch64 repository to match `--arch`. All
 listed modules are the selected package's `.ko.gz` files decompressed without
 modification.
 
-- Upstream source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.55.tar.xz
+- Upstream source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.56.tar.xz
 - Alpine build recipe, configuration and patches (Corresponding Source),
-  pinned to the commit shipping 6.18.55-r0 (the same for both architectures):
-  https://gitlab.alpinelinux.org/alpine/aports/-/blob/52fae6d7d56f3958f32e5bf9121a7536524b9ef4/main/linux-lts/APKBUILD
+  pinned to the commit shipping 6.18.56-r0 (the same for both architectures):
+  https://gitlab.alpinelinux.org/alpine/aports/-/blob/efc8ddbb20c827d2bd8223c19a2625e754e5cb3c/main/linux-lts/APKBUILD
 - Packages:
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-virt-6.18.55-r0.apk
-  SHA-256 `a941c15fc5db26b6692fd0140fa0970da76cb12aadf3dc8306c419f21bd39c93`
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-lts-6.18.55-r0.apk
-  SHA-256 `02ba9491d4cc110707de64ed03dd7e2fa5c93fdd851979c244ceb018785a9eea`
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-virt-6.18.55-r0.apk
-  SHA-256 `c7fb892408d7fe163a18671e5c7816752976d1c67fd17794dfba794aa0d6c1ac`
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-lts-6.18.55-r0.apk
-  SHA-256 `31aeae56fa527b2fb4fdd4aefbd693cbec210a8cbfd4ea7597a1773b832e9f83`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-virt-6.18.56-r0.apk
+  SHA-256 `755deb045cfeb8c2bcaa2b2febe01ab2101d747921e64d4cd54d0312321e8d5d`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-lts-6.18.56-r0.apk
+  SHA-256 `b0d8cc4d7e031b5619221e7978920d051bf1dd1e335f6d05d03964b2285fc3b4`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-virt-6.18.56-r0.apk
+  SHA-256 `e3839bfd751ff0a4421484f712b9b29efb514024523736a0ef62521521571b12`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-lts-6.18.56-r0.apk
+  SHA-256 `795bcd49840be7f4ff9566f5f669201bd41202376a455b720a98eb814f0e72f8`
 
 SHA-256 of files in the default x86_64 `linux-virt` image:
 
 ```text
-kernel/x86_64/vmlinuz-virt   fcee60bd42bdcc5f165278e092de0bb00d969843be326f7bd9a9602c2f52de9e
-failover.ko                  75d408861dd0ee89bf94753c9f2fff0f3831a6f76eaab8870d186910e6e2924b
-net_failover.ko              4db140c0f8e32a31e95f56f35af62e5279864104f57d30af0684c75e3505bdd5
-virtio_net.ko                f2867d641f808b7f5d7d4eb972c72398902589a83b48f6f7a174b844717da117
+kernel/x86_64/vmlinuz-virt   dc99c86bb8e58cb4eda5f01eac44c4d972105945a46dfe76a9e86e8529915c72
+failover.ko                  ddf94fe8a89b24e839f21866f828adc3eb91e62fa46dd977c74d7c2b6f92fe21
+net_failover.ko              fb710ef0450417dea2f6dede919d14f5a4a94b1be73f338cfe2ed05e32f0cc30
+virtio_net.ko                2fb98ab7d06cfb7a1e1a07dcc5098da44316360097d75e288a30ad4855c449f7
 ```
 
 SHA-256 of files in an x86_64 `--linux-lts` image:
 
 ```text
-kernel/x86_64/vmlinuz-lts   6c85e6375814c51257a3d1b21c3c4c02803231d42e42c1a3d50236bf543cbeba
-failover.ko                 b563c6734384c5c41ed1b227a221a3e7b511bca743e583dd33d6f85405a8df07
-net_failover.ko             4ee36e32ed5db502125b57d237b5db31509c7b9c9a49ca9221b704fcfcd80b1c
-virtio_net.ko               4aa2b98c0fed35be473ff22f4d3f89cb184ca13e6605dd9e8a68b5854eba7b6a
-virtio_ring.ko              ed1c704eddca74e4f68164efc62b65f8e8a8276b7ebb2eeb0185326dbd093603
-virtio.ko                   986cab65ecfce9c6291cc54598301ede8e8e2eca521a82dfbaf6dcf76ec6f8c6
-virtio_pci_legacy_dev.ko    dedd092324e5d23ac218dfa2aad3fa8bc2f0b49e54c1763423627c75a8c4e907
-virtio_pci_modern_dev.ko    855221097ff07f0981d4e9fbb4200a0628a154826f37299d1434811f21902388
-virtio_pci.ko               aee0a18cce24968d1e06c026a056e570b3039884b900385f019410a751ea8a44
+kernel/x86_64/vmlinuz-lts   e893ce0f7aecbdf2dcf012659ec5a0b35740780ae5c3af5ad188029f5cd4aa8f
+failover.ko                 59e4e4808dca2d18d849c2da850e4ea659485007b09a690c7e57fb0e623cd1df
+net_failover.ko             20dd06a6f6f1528079a438630d741f125d11cc9bae58d618e0e6381f8bff6f5c
+virtio_net.ko               39bcd12bfc3149351fa226dabdbb1f82137c53f3b1ccbacbf30661bf8ff99ad4
+virtio_ring.ko              e8fdebd89345ef39a54d3b23e6f2a57c6c4b201708b35113705b56d0fa373596
+virtio.ko                   d4ab148e31f5d4d5a1dd3c3f30bb52ba9a13e670929c9f7f1668396edf8049b7
+virtio_pci_legacy_dev.ko    15c35c8875b68dcaed3ac58d463d1b3f2c3e52dcf9a3840366d3fa6da7cd4dd7
+virtio_pci_modern_dev.ko    59bd6e34e6cf3c0ce54bab1eca1d7ac0325112280a6718613460002d2cde70d0
+virtio_pci.ko               cc3ad8eaffa321bd58dbd663afba074dee81a5ad6f283d50cd5b1b340672430e
 ```
 
 `--real` additionally includes the following modules from that same
 x86_64 `linux-lts` package for physical xHCI controllers and USB HID keyboards:
 
 ```text
-usb-common.ko               38a461cdee1e8dd82985fedbd050d3a496825c5b59c66dc3305c5508c93fb0e4
-usbcore.ko                  18949ea4cab0f98846f4fea192c9ebe9892c5504f6750529a4db8c1a718fdd3b
-xhci-hcd.ko                 aed7f3e8d2f1e2d722fb625fcd68adce5212a30ce1a25a934832177594670543
-xhci-pci.ko                 8959b6c1790ac1b656308278313f78cf4fde8b811456a42579b467a8196515b8
-xhci-pci-renesas.ko         3aa013b9ca71ee5bd16b30efb1f68aa2c29ac84cf15dd92caf413f7577fc36cf
-hid.ko                      e3fecc9b96b44d1c572337a937927291c3219d43a00a357049a1285ab57f5bbe
-hid-generic.ko              a3d76a35904f26d8bb8d5bff115de12a1cb966c3e428e529767dde28c24e4421
-usbhid.ko                   6b50c4a6037fa740b3f576d5bf362bdad7aa86ebc8da5e1777e69c03ed70f703
+usb-common.ko               37feaa14670d4bbd3dca77d701344d2fb02e2cb139d21c5af8b2c140aab5c6fe
+usbcore.ko                  75efddfd7d1bf996ad99f0d9be790be767ca72ebdb53a00194b449c3588faa16
+xhci-hcd.ko                 bd5772b2ba908dff16c74ae10211a1e5cfd72910d861dbdf30b8f71c5995066a
+xhci-pci.ko                 6c688038c9b45297fce752c8f0443cd0f398f31e0b4efffd7f869325ce9884fa
+xhci-pci-renesas.ko         aa08808c9e609fe570a1c5b90d0f0ba33f2ca2e7d84e8ccbb3a2856fe65a7b3f
+hid.ko                      161160bf12d18a24c25aef6355e265142fc4fb2122b09923a6e184fabedf6246
+hid-generic.ko              6d5ae3cfd8f8b034cbe444869485ac9012376c4ca604a3cd039f0cae442005f9
+usbhid.ko                   6ed1e4891b242f64520621d689a24828dfc24a96236c71b86d9af9361248aa5a
 ```
 
 SHA-256 of files in the default aarch64 `linux-virt` image:
 
 ```text
-kernel/aarch64/vmlinuz-virt  af8ad21e222dbff8c89909e1ef7b8b7607dd58188b2f3067128aac4f646d212d
-failover.ko                  aff1648d08436515b509c3c848049e44540ff0d26afc113a496db961f6871df6
-net_failover.ko              4461014c041c8cbdfc881c0d820361014a491547b694d36425d084ab9008a33f
-virtio_net.ko                7b6e3c89d666419d336990688711c4d6b0cab91e5934a7bd99e6d8dcc5caa40b
+kernel/aarch64/vmlinuz-virt  039c532c2fa8f49896a679065d79a03b8a444c9d54fa80ac9bc4d0ce1ecd0ca6
+failover.ko                  ce65a98acce98720753c4a9a7e339f6c70d22eae70b65cc1b4211543a7c6c3a3
+net_failover.ko              39c9222d800ae95d8a82ff797e408187411ac2ff47bec2c9d7ddbfe99537dbe3
+virtio_net.ko                762f8e362ae2e2bbf200ab9bc742524999e8bce12c72671bf8560fd9bb7907d5
 ```
 
 SHA-256 of files in an aarch64 `--linux-lts` image:
 
 ```text
-kernel/aarch64/vmlinuz-lts  6c6625bc5ba59136101414d09efbeaaed000517e654a75157f42565cec15abad
-failover.ko                 1f10c1ac74c6d35f745227899372b1b6656a3197436d9c72e0bb39a19779c3a6
-net_failover.ko             5815342b859f820adfd90ffdddde689c73f0e6fcc34efbc9ada8beabb2fd37b2
-virtio_net.ko               2ef9114dea6b40bd9d2e1460c6be94859b5527af5479928cfd90a66eff843bab
-virtio_pci_legacy_dev.ko    be6654a06cfb30f2598b184f7a2b2372314c5a5325a984b73a7ef9a3c39e7eb3
-virtio_pci_modern_dev.ko    d88219ed14678c0aba06a882d6cf43b0ad9462eeae09638b6382ba5601b5a8c4
-virtio_pci.ko               6bdafb0472d289e2ca6dfc63bf2cb2e54e1258e9c4774317ca1c7df059dfb31e
+kernel/aarch64/vmlinuz-lts  de5ff95fd663a30e53765cb0794707656bb80749d77f16bbf94225d17c512447
+failover.ko                 7f3d40067603c9916d22e9d85fea1512bd95c087aaae774e5ea70f8bacb7ae04
+net_failover.ko             085e4fd53a40704408b6bf914ee464d16007296fa3615940fa54688afe84466c
+virtio_net.ko               4ea86521819063df91cfd18191e8bc2bd2551392e8f7a33126df0aba675ee409
+virtio_pci_legacy_dev.ko    baf8033c183819a8bccacf36677247740a5cff9eec9b403b94840af258b60b6e
+virtio_pci_modern_dev.ko    2905133de7c9baceff9fc6a27dba9b8469744019545c19cf1456e64f7e50f062
+virtio_pci.ko               3b506947c25866e08a311f124cd143bd0f501179f0b556aed7ca4d6632143d8d
 ```
 
 ### linuxx64.efi.stub and linuxaa64.efi.stub

package/README.md

@@ -1112,7 +1112,7 @@ initramfs/                init.js, commands, userspace: the same for every archi
 native/<arch>/            musl and the GCC runtime (committed); bun and modules (fetched)
 ```
 
-The `--real` inputs are Alpine v3.24 `linux-lts-6.18.55-r0`, musl `1.2.6-r2`,
+The `--real` inputs are Alpine v3.24 `linux-lts-6.18.56-r0`, musl `1.2.6-r2`,
 `systemd-efistub-260.2-r0`, `libstdc++`/`libgcc` `15.2.0-r5`, and Bun 1.4.2
 `linux-x64-musl-baseline`. The aarch64 guest uses the same versions from
 Alpine's aarch64 repository and Bun's `linux-aarch64-musl`. There is no BusyBox
@@ -1127,10 +1127,11 @@ extracts from it. Bumping a version changes both the file name and the hash, so
 it always refetches.
 
 The four application packages are pinned separately in
-`scripts/npm-packages.md`: `buninu-browser@0.2.2`,
+`scripts/npm-packages.md`: `buninu-browser@0.2.3`,
 `@drxiaozhi/casty@1.3.4`, `@drxiaozhi/jspulse@0.2.1`, and
 `@drxiaozhi/jspinyin@0.1.1`. These were npm's `latest` versions when checked
-on 2026-10-11; fetch never resolves `latest` or a version range at runtime.
+on 2026-10-11, with buninu-browser updated to npm's `latest` on 2026-10-12;
+fetch never resolves `latest` or a version range at runtime.
 Each registry tarball was checked against its published SHA-512 integrity
 before its SHA-256 was recorded in the shared pins file.
 
@@ -1274,7 +1275,7 @@ The physical boot chain is firmware → the UKI stub → its embedded
 and, with the currently pinned kernel, embeds this complete command line:
 
 ```text
-console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.55-0-lts rdinit=/bin/bun -- -e import('/init.js')
+console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.56-0-lts rdinit=/bin/bun -- -e import('/init.js')
 ```
 
 Serial kernel logging is retained, while the final console makes
@@ -1298,7 +1299,7 @@ the same way). Build without `--real`; this selects Alpine `linux-virt`, omits t
 module set, and puts `ttyS0` last so serial stdio owns `/dev/console`:
 
 ```text
-console=tty0 console=ttyS0,115200 panic=0 PATH=/bin KERNEL_RELEASE=6.18.55-0-virt rdinit=/bin/bun -- -e import('/init.js')
+console=tty0 console=ttyS0,115200 panic=0 PATH=/bin KERNEL_RELEASE=6.18.56-0-virt rdinit=/bin/bun -- -e import('/init.js')
 ```
 
 Build and boot it with:
@@ -1415,7 +1416,7 @@ The default `--real` image embeds this kernel command line (shown for the
 currently pinned LTS release):
 
 ```text
-console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.55-0-lts rdinit=/bin/bun -- -e import('/init.js')
+console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.56-0-lts rdinit=/bin/bun -- -e import('/init.js')
 ```
 
 The physical display (`tty0`) is the final console and therefore owns PID 1's

package/initramfs/bin/tar

@@ -1,6 +1,7 @@
 #!/bin/bun
 // tar — a small tar/gzip/zstd CLI over Bun.Archive.
 
+import { gunzipSync } from "node:zlib";
 import { lstat, readdir } from "node:fs/promises";
 import { linkSync, mkdirSync, rmSync, symlinkSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
@@ -180,11 +181,20 @@ const scanEntries = (bytes) => {
   let longName = null;
   let longTarget = null;
   let extended = {};
+  let ended = false;
+  entries.concatenated = false;
   while (offset + BLOCK <= bytes.length) {
     const block = bytes.subarray(offset, offset + BLOCK);
     offset += BLOCK;
-    if (block.every((byte) => byte === 0)) break; // end-of-archive blocks
+    if (block.every((byte) => byte === 0)) {
+      // APK v2 joins tar streams; another header may follow the end markers.
+      ended = true;
+      longName = longTarget = null;
+      extended = {};
+      continue;
+    }
     if (!checksumMatches(block)) return entries.length ? entries : null;
+    if (ended) { entries.concatenated = true; ended = false; }
     const flag = String.fromCharCode(block[156] || 0x30);
     const size = extended.size !== undefined ? Number(extended.size) : octal(block, 124, 12);
     const dataBlocks = Math.ceil(size / BLOCK) * BLOCK;
@@ -227,7 +237,7 @@ const scanEntries = (bytes) => {
 };
 
 const tarBytes = (bytes) => {
-  if (bytes[0] === 0x1f && bytes[1] === 0x8b) return Bun.gunzipSync(bytes);
+  if (bytes[0] === 0x1f && bytes[1] === 0x8b) return gunzipSync(bytes);
   if (bytes[0] === 0x28 && bytes[1] === 0xb5 && bytes[2] === 0x2f && bytes[3] === 0xfd) {
     return Bun.zstdDecompressSync(bytes);
   }
@@ -292,59 +302,37 @@ const restoreLinks = (entries) => {
   }
 };
 
-// Opt-in path only: keep the existing Bun.Archive extraction unchanged for
-// ordinary extraction and --strip-components=0 without excludes. Reuse the
-// scanned-entry extractor for excludes: no glob whitelist can accidentally
-// reinterpret literal metacharacters in retained archive names.
-if (options.operation === "x" && (options.strip > 0 || options.excludes.length)) {
+// Read stdin only once. node:zlib expands every concatenated gzip member
+// (APK signature, control and data), rather than just the first stream.
+if (options.operation === "x" || options.operation === "t") {
   try {
     const bytes = tarBytes(await archiveBytes());
-    const entries = scanEntries(bytes);
-    if (!entries) throw new Error("invalid tar archive");
+    const scanned = scanEntries(bytes);
     const wanted = options.operands.length ? patterns().map((pattern) => new Bun.Glob(pattern)) : null;
+    const useScannedExtraction = options.strip > 0 || options.excludes.length || scanned?.concatenated;
+    if (useScannedExtraction && !scanned) throw new Error("invalid tar archive");
+    // Bun.Archive stops at the first tar end marker. Use the existing scanned
+    // extractor when later streams contain more entries; ordinary tar files
+    // retain the Bun.Archive extraction path.
+    const archive = useScannedExtraction ? null : new Bun.Archive(bytes);
+    const entries = scanned ?? [...(await archive.files(options.operands.length ? patterns() : undefined))]
+      .map(([name, file]) => ({ name, kind: "file", target: "", size: file.size, mode: 0o644, mtime: file.lastModified }));
     const members = entries.filter((entry) => !excluded(entry.name)
       && !(entry.kind === "hardlink" && excluded(entry.target))
       && (!wanted || wanted.some((glob) => glob.match(entry.name))));
-    extractStripped(bytes, members, options.directory, options.strip, {
-      verbose: options.verbose, filtered: options.operands.length > 0 || options.excludes.length > 0,
-    });
-  } catch (error) {
-    fail(error?.message || String(error));
-  }
-  process.exit(0);
-}
-
-if (options.operation === "x" || options.operation === "t") {
-  let archive;
-  try {
-    archive = new Bun.Archive(await archiveBytes());
-  } catch (error) {
-    fail(error?.message || String(error));
-  }
-
-  // The header scan is what makes listing and links complete; if the bytes
-  // do not parse as tar, fall back to what Bun.Archive reports.
-  const scanned = scanEntries(tarBytes(await archiveBytes()));
-  const wanted = options.operands.length ? patterns().map((pattern) => new Bun.Glob(pattern)) : null;
-  const members = scanned
-    ? scanned.filter((entry) => !wanted || wanted.some((glob) => glob.match(entry.name)))
-    : [...(await archive.files(options.operands.length ? patterns() : undefined))]
-      .map(([name, file]) => ({ name, kind: "file", target: "", size: file.size, mode: 0o644, mtime: file.lastModified }));
-
-  if (options.operation === "t") {
-    for (const entry of members.filter((entry) => !excluded(entry.name))) {
-      console.log(options.verbose ? verboseListing(entry) : entry.name);
-    }
-  } else {
-    try {
-      if (options.verbose) {
-        for (const entry of members) console.log(entry.name);
-      }
+    if (options.operation === "t") {
+      for (const entry of members) console.log(options.verbose ? verboseListing(entry) : entry.name);
+    } else if (useScannedExtraction) {
+      extractStripped(bytes, members, options.directory, options.strip, {
+        verbose: options.verbose, filtered: options.operands.length > 0 || options.excludes.length > 0,
+      });
+    } else {
+      if (options.verbose) for (const entry of members) console.log(entry.name);
       await archive.extract(options.directory, options.operands.length ? { glob: patterns() } : undefined);
       restoreLinks(members);
-    } catch (error) {
-      fail(error?.message || String(error));
     }
+  } catch (error) {
+    fail(error?.message || String(error));
   }
   process.exit(0);
 }

package/initramfs/buninu/apps/bunmsh/CHANGELOG.md

@@ -2,6 +2,109 @@
 
 All notable user-visible changes to bunmsh are documented here.
 
+## [0.4.0] - 2026-10-13
+
+### Added and fixed
+
+- Respect builtin cat output redirects in shell subprocesses, including AWK pipes.
+
+- Stream external stdout/stderr to the correct pipeline endpoint for `2>&1`,
+  `2>&1 >file` and `1>&2`, retaining downstream early-close handling.
+
+- Support `cp -p` for regular files, preserving ownership, mode and timestamps.
+
+- Evaluate `!` inside if/elif conditions with normal pipeline precedence,
+  including conditions joined with `&&` or `||`.
+
+- AWK supports parenthesized print lists, continued arguments and buffered
+  output command pipes through bunmsh. Correct function parameter scope and
+  preserve replacement backslashes; GCC option generators match mawk output.
+
+- Process mkdir operands in order so parent/child paths do not race.
+
+- Preserve here-document bodies when connecting commands to compound operands.
+
+- Distinguish backquoted brace groups from parameter expansions during tokenization.
+
+- Handle traditional set - as an option delimiter, preserving bare-call arguments.
+
+- Add byte-preserving adjacent-line uniq with -c/-d/-u and input/output files.
+- Ignore empty nonexistent filenames with rm -f, including libtool cleanup.
+
+- Recognize case/esac next to subshell parentheses, including nested groups.
+
+- Keep awk quoted operator strings as data, including install path concatenation.
+
+- Remove the backquote escape layer before parsing command substitutions.
+
+- Preserve short circuiting across comments before compounds and parse simple
+  pipeline stages before a trailing compound command.
+
+- Keep persistent read descriptors open and consume one line without read-ahead.
+- Expand positional parameter lengths such as libtool's ${#1}.
+
+- Support explicit-class chmod rwxX modes such as a-w and u+rw.
+
+- Recognize comments after else and loop-closing done as compound syntax.
+
+- Apply enclosing descriptor redirects to compound-producer pipeline output.
+
+- Add bytewise cmp, legacy egrep/fgrep names, and tr squeeze/delete combinations.
+- Adapt mv/rm -- for Bun Shell while protecting option-looking filenames.
+
+- Preserve multiline parameter expansion operands inside compound bodies.
+- Accept combined print flags such as Autoconf's -rn.
+- Preserve compound commands and function declarations after recipe continuations.
+
+- Match quoted literals and bracket patterns in parameter prefix/suffix removal.
+- Capture subshell state at execution time and scope its internal transport to
+  that command, preserving changes from earlier commands in the same list.
+- Treat interior ^ and $ as literals in basic regular expressions, including
+  GNU make build.sh object-extension substitutions.
+
+- Add a pure JavaScript awk fallback interpreter with fields, arrays, rules,
+  functions, loops, string/regex operations and file I/O. Input command pipes
+  and system() remain unsupported; full POSIX/GNU compatibility is not claimed.
+- Preserve multiline quoted operands after compound pipeline connectors, quoted
+  backslash-newlines, heredoc AND/OR continuations, and case terminators after groups.
+- Preserve ASCII control characters used as Autoconf awk separators during expansion.
+- Keep nested redirected compound operands when reconstructing pipelines.
+- Support sed r FILE, including end-of-cycle output and silently missing files.
+
+- Add offline system diff/sed reference fixtures so isolated tests can compare
+  output and exit status without depending on host executables in the guest.
+
+- Add file diff using the jsmdcui Myers line alignment, with separate insertion,
+  deletion and replacement hunks, binary notices and missing-final-newline markers.
+- Expand parameters and substitutions inside arithmetic, including Autoconf `$(( $* ))`.
+
+- In `set -o posix` mode, send only exported variables and command-prefix
+  assignments to external programs, while preserving complete internal state
+  for pipeline/subshell Bun children. Default mode still passes all variables.
+- Match newlines with case wildcards, including Autoconf POSIX-mode detection.
+- Keep heredoc contents out of subshell rewriting, support pipelines feeding
+  compound cases, accept operand-free rm -f, grep -e/-c, and sed -f.
+
+- Track command source lines, preserve quotes and argument boundaries in selected
+  parameter operands, and parse nested compound conditions and subshell cases.
+- Add expr and extend fallback sed with addresses, branches and hold-space edits.
+- Make `set -o posix` an observable option: only this mode removes fallback ls
+  icons and implicit directory suffixes. Normal ls and lsfancy retain icons.
+- Support ls inode/dereference options and sorting multiple file operands.
+- Transport large internal subprocess state through a private temporary file;
+  retain the full function AST and clean up after foreground execution.
+
+- Accept inline and next-line function braces, brace groups with redirects and
+  pipelines, multiline pipelines, and nested case clauses with here-documents.
+- Implement return and counted break/continue with function/source/loop boundaries.
+- Add persistent numeric fd bindings for exec, ordered duplication, scoped
+  restoration, and descriptor inheritance for external and subshell commands.
+- Add conditional errexit, nounset/noglob, xtrace, option queries, EXIT handlers
+  and deferred signal traps. See PORTING.md for the remaining POSIX boundaries.
+- Preserve the minimal background-command contract: original Bun.Subprocess
+  objects, append-only stable Bun.sha.procs indices, immediate return and unref;
+  no implicit waiting, killing or widening of accepted background syntax.
+
 ## [0.3.11] - 2026-10-12
 
 ### Fixed

package/initramfs/buninu/apps/bunmsh/PORTING.md

@@ -38,8 +38,28 @@ pseudo-terminal tests.
   Background pipelines, builtins, functions, and all redirections are rejected
   before files are opened. General asynchronous command lists, job control,
   and coprocesses are not implemented.
-- Brace command groups, `select`, arithmetic commands, and `[[ ... ]]` are
-  not implemented.
+  Compatibility invariant: keep the original `Bun.Subprocess` objects in an
+  append-only `Bun.sha.procs` array with stable indices, immediate return and
+  `unref()`. POSIX foreground work must not add implicit waiting, killing,
+  removal of completed entries, or a job-wrapper replacement.
+- Brace command groups run in the current shell, including scoped redirects
+  and group pipelines. `select`, arithmetic commands, and `[[ ... ]]` remain
+  unimplemented. Function opening braces may be on the same or next line;
+  inline bodies and nested case clauses are supported.
+- `return` stops at the function/source boundary; `break N` and `continue N`
+  unwind enclosing loops. Functions and sourced files establish their own
+  loop boundary, following mksh STOP_BRKCONT.
+- `set -e` uses a dynamically inherited error-ignore context for conditions,
+  non-final AND/OR commands and negation, following mksh XERROK. `set -u`,
+  `set -f`, `set -x`, option queries and corresponding CLI flags are supported.
+  `-v` currently prints initial CLI input only; it is not an incremental reader.
+  `set -o posix` is listed and stored as an option. It makes fallback `ls`
+  omit icons and automatic directory suffixes; `lsfancy` remains decorative.
+  External environments in this mode contain only inherited/exported names
+  and command-prefix assignments. Full variables and export attributes travel
+  with internal pipeline/subshell state, separately from the native environment.
+  Default mode continues passing all shell variables to external programs.
+  It does not imply full POSIX conformance.
 - Functions and subshells cover practical cases but do not yet reproduce every
   mksh scoping, local-variable, trap, and diagnostic edge case.
 - Pipelines isolate builtin/function state through subprocess copies. Changes
@@ -75,9 +95,17 @@ pseudo-terminal tests.
   pathname expansion, or tilde expansion, and a trailing newline is appended.
   It follows the same dash/`/bin/sh` comparison harness as everything else in
   this codebase, except `<<<` itself, since dash does not implement it.
-- Arbitrary descriptor allocation/manipulation, descriptor variables,
-  heredocs targeting a descriptor other than stdin, and every ordering edge
-  case remain incomplete.
+- Numeric file descriptors support file open, append, read/write (`<>`),
+  duplication and shell-level closure, with left-to-right redirect ordering.
+  `exec` without a command persists bindings. Compound/function redirections
+  restore only the descriptors they changed; native open handles retained by
+  another binding stay alive. External/pipeline children inherit extra fds
+  through Bun.spawn stdio. No native compiler or host shell is required.
+- Descriptor variables and heredocs targeting non-stdin fds are not implemented.
+  Closing a descriptor denies subsequent shell duplication/use, but Bun.spawn
+  maps a closed child stdio slot to `ignore` (/dev/null), not native EBADF.
+  Aliases of captured stdout/stderr passed as extra fds to an arbitrary external
+  program do not yet reproduce every pipe/capture ordering case.
 - External processes use `Bun.spawn`; regular and fallback builtins may execute
   in-process or in a self-spawned bunmsh pipeline child depending on streaming
   and state-isolation requirements.
@@ -96,13 +124,16 @@ pseudo-terminal tests.
 - Ctrl-D on an empty readline input sends EOF and exits the interactive shell.
   This is deliberately distinct from Ctrl-C, following the same high-level
   editor/main-loop separation used by mksh.
-- The current implementation handles SIGINT through readline while editing and
-  through a process signal listener while a foreground operation owns the
-  terminal. It does not yet have mksh's general pending-signal table and safe
-  trap checkpoints.
-- There is no `trap` builtin or support for user handlers for signals, `EXIT`,
-  or `ERR`. Signal handlers therefore cannot yet execute shell source, be
-  listed, ignored, reset, or inherited with POSIX/mksh semantics.
+- `trap` supports listing, reset (`-`), shell-local ignore (empty action),
+  EXIT/0 and catchable signal names/numbers. Signal callbacks enqueue handlers;
+  shell source runs at command boundaries, following mksh's pending-trap model.
+  Handlers preserve `$?`; EXIT runs once and can explicitly override status.
+  Shell finalization releases its fd resources and listeners, never background
+  subprocesses or Bun.sha.procs entries.
+- Complete native signal semantics are not claimed: ignored handlers do not
+  establish inherited SIG_IGN in external children, handlers waiting at an idle
+  interactive prompt run at the next command boundary, and there is no ERR trap,
+  process-group forwarding, `wait` integration or general builtin cancellation.
 - Status 130 is defined for an interrupted `serve`, and its SIGTERM path uses
   143. Signal-derived statuses are not yet normalised consistently for every
   external command, builtin, pipeline stage, and command substitution.
@@ -182,11 +213,11 @@ pseudo-terminal tests.
 
 ## Remaining major work
 
-1. Background jobs, process groups, complete signal-status handling, traps,
+1. General background jobs, process groups, complete signal/trap inheritance,
    general builtin cancellation, and `jobs`/`fg`/`bg`/`wait`.
-2. Shell options such as `errexit`, `nounset`, `pipefail`, `xtrace`, and POSIX
+2. Full shell-option edge cases, `pipefail`, incremental verbose input and POSIX
    mode, plus startup/login/restricted-shell files and modes.
-3. Brace groups, `[[ ... ]]`, arithmetic commands,
+3. `[[ ... ]]`, arithmetic commands,
    extended globs, process substitution, and fuller mksh expansion semantics.
 4. Arrays, associative arrays, namerefs, `typeset`/scope semantics, and more
    complete special builtins.
@@ -194,3 +225,90 @@ pseudo-terminal tests.
    `fc`, and automatic history policy.
 6. Broader POSIX conformance testing, mksh `check.t` coverage, exact diagnostics,
    and exit-status compatibility for edge cases.
+
+## Bootstrap compatibility verification (2026-10-13)
+
+Implementation reference: sibling `mksh/syn.c` (`function_body`/brace grammar),
+`exec.c` (TBRACE, XERROK, E_LOOP), `funcs.c` (c_exitreturn, c_brkcont, c_trap),
+and `histrap.c` (runtrap/cleartraps). The JavaScript execution and descriptor
+model is adapted to Bun; no C code or native signal/job-control layer is copied.
+
+`test/posix-bootstrap.test.js` covers finite control-flow, descriptor, trap,
+option and background-registry cases without requiring a reference shell.
+Tests were run with musl Bun 1.4.2 in `bunproot -r rfs1`. The guest's `/bin/sh`
+is itself bunmsh, so reference.test.js comparisons there would not constitute
+an independent POSIX oracle.
+
+The next configure compatibility batch adds physical source-line tracking for
+ordinary commands and nested function/case bodies, quoted parameter operands
+(including `${1+"$@"}`), compound conditions containing nested groups/if, and
+multiline subshells containing case clauses. LINENO handling is not yet complete
+for every condition, eval, subshell, or user-assignment edge case.
+
+The sed fallback now has addresses/ranges, labels/branches, pattern/hold-space
+operations, and text commands; expr provides arithmetic/comparison/BRE matching.
+File diff uses the jsmdcui Myers alignment and normal-format change hunks;
+directory comparison and unified/context output are not implemented.
+Subprocess state still includes the complete function AST. Large internal state
+uses a private temporary file cleaned by the spawning foreground process. This
+avoids the observed bunproot environment-string limit without changing the
+Bun.sha.procs registry or background process lifecycle.
+
+GNU make 4.4.1 configure validation is ongoing; no complete run is claimed.
+Its LINENO/re-exec blockers and large unexported test-source environment values
+have dedicated regressions. Autoconf's multiline case wildcard now detects the
+listed posix option and enables it. Further utility/parser blockers may remain.
+
+Independent utility references can be recorded outside the bootstrap guest with
+`node test/utility-reference-cases.mjs OUTPUT.json`, using `/usr/bin/diff` and
+`/usr/bin/sed`. Make only that JSON data accessible inside the guest, then run
+`BUNMSH_UTILITY_REFERENCE=/guest/OUTPUT.json bun test test/utility-reference.test.js`.
+The test compares status, stdout and stderr from explicit bunmsh builtins; it
+does not invoke or mount host reference executables. Without the environment
+variable, the reference fixture suite is skipped explicitly.
+
+The current 13 file-diff and 15 sed cases passed under musl Bun/bunproot against
+GNU diffutils 3.10 and GNU sed 4.9. They cover middle edits, repeated lines,
+newline boundaries, UTF-8, sed script files, addresses, branches, hold space and file reads.
+These are selected compatibility cases, not a claim of complete GNU behavior.
+
+The awk fallback is a JavaScript parser/interpreter in src/awk.js, with no
+native awk or FFI dependency. It supports BEGIN/END, pattern/action records,
+fields, associative arrays, functions/control flow, regex/string operations,
+getline and file redirection. Output command pipes run through bunmsh, with
+input buffered until close or program end; streaming and interactive pipe
+communication are not supported. Input command pipes and system() fail
+explicitly. JavaScript regex, string and numeric behavior imposes remaining
+locale/formatting limits; this is not full POSIX or GNU awk compatibility.
+The optional test/awk-reference.test.js suite compares a separately supplied
+BUNMSH_AWK_REFERENCE executable; it is never used by the builtin itself.
+
+### Additional Autoconf regressions
+
+Compound normalization removes only lexer-recognized line continuations; it
+preserves backslash-newlines inside single quotes and heredoc bodies. Case `;;`
+terminators remain adjacent after brace groups. AND/OR operators continue across
+heredoc bodies, and pipelines retain redirected compound operands. Expansion
+markers use reserved Unicode noncharacters instead of ASCII control bytes, so
+Autoconf's BEL separator reaches awk intact. Sed `r FILE` appends raw file data
+at the end of the cycle (including after `d`); missing files contribute nothing.
+
+GNU make build.sh additionally exercises bracket/quoted parameter trimming and
+subshell snapshots taken at execution time. Internal state transport is scoped
+to its command even outside POSIX mode; default user variable export behavior
+and the background process registry are unchanged. Basic regex anchors are
+context-sensitive so literal make variable references can be substituted.
+
+Binutils bootstrap coverage additionally includes multiline `${...}` operands
+inside compound bodies, legacy egrep/fgrep fallback names, bytewise cmp (normal
+and quiet modes), tr squeezing with optional translation/deletion, and an
+adapter for Bun Shell mv's missing `--` support. The adapter protects filenames
+beginning with `-` by prefixing `./` after removing the option delimiter. The
+cmp and tr subset has offline GNU command reference fixtures;
+unsupported extensions remain errors, not successful no-ops.
+
+The uniq fallback preserves byte comparisons and adjacent groups, supports
+-c/-d/-u, -- and input/output operands. Other GNU extensions are explicit
+errors. Twelve GNU reference fixtures cover ordering, flags, blank lines,
+missing final newlines and NUL bytes. rm -f discards empty nonexistent path
+operands before Bun Shell can incorrectly treat them as the current directory.

package/initramfs/buninu/apps/bunmsh/help/awk.md

@@ -0,0 +1,38 @@
+## awk
+
+Scan records and evaluate AWK programs using a JavaScript interpreter.
+
+### Usage
+
+```sh
+awk [-F SEPARATOR] [-v NAME=VALUE] [-f SCRIPT_FILE] [PROGRAM] [FILE ...]
+```
+
+### Options and forms
+
+- `-F`: Set the field separator; `-v`: assign a variable before BEGIN.
+- `-f`: Read program text from a file; `-e`: append program text.
+- BEGIN/END, pattern/action rules, fields, variables, associative arrays,
+  functions, conditionals, loops, next/nextfile, exit and delete.
+- print/printf, arithmetic, comparisons, regular expressions, concatenation,
+  split, substr, index, length, match, sub/gsub and common numeric functions.
+- getline from input or files; file output with `>` and `>>`; close.
+- Parenthesized print/printf lists and continued arguments after commas.
+- Output pipes run through bunmsh, buffering input until close or program end.
+  They do not provide streaming or interactive communication. close returns
+  the command status; closing and reopening starts a fresh command.
+- This is a subset, not full POSIX/GNU compatibility. Input command pipes and
+  system() are unsupported and report errors. Text processing uses JavaScript strings
+  and regular expressions; locale and floating-point edge cases may differ.
+
+### Example
+
+```sh
+printf 'apple 2\npear 3\n' | awk '{total += $2} END {print total}'
+```
+
+Output:
+
+```text
+5
+```