buninu-linux 0.8.55 → 0.9.56

package/initramfs/buninu/apps/bunmsh/test/utility-reference-cases.mjs

@@ -0,0 +1,98 @@
+// Record system-tool results separately from the isolated bootstrap runtime:
+// node test/utility-reference-cases.mjs OUTPUT.json
+// BUNMSH_UTILITY_REFERENCE=/guest/OUTPUT.json bun test test/utility-reference.test.js
+import {mkdtempSync, mkdirSync, writeFileSync, rmSync, chmodSync, statSync} from 'node:fs';
+import {tmpdir} from 'node:os';
+import {join, resolve, dirname} from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {spawnSync} from 'node:child_process';
+const diff = (name, before, after, args=[]) => ({name, tool:'diff', files:{before,after}, args:[...args,'before','after']});
+const sed = (name, script, input, args=[]) => ({name, tool:'sed', files:{script}, args:[...args,'-f','script'], input});
+export const cases = [
+  ...[
+    ['adjacent only', [], 'a\na\nb\na\n'],
+    ['count', ['-c'], 'a\na\nb\n'],
+    ['repeated', ['-d'], 'a\na\nb\na\n'],
+    ['single', ['-u'], 'a\na\nb\na\n'],
+    ['count repeated', ['-cd'], 'a\na\nb\n'],
+    ['no repeated singles', ['-du'], 'a\na\nb\n'],
+    ['empty input', [], ''],
+    ['blank lines', [], '\n\nfirst\n\n'],
+    ['unterminated duplicate', [], 'a\na'],
+    ['unterminated distinct', [], 'a\nb'],
+    ['binary NUL', [], 'a\0b\na\0b\na\0c\n'],
+    ['file operand', ['--','input'], null],
+  ].map(([name,args,input])=>({name,tool:'uniq',args,files:input===null?{input:'a\na\nb\n'}:{},input:input??''})),
+  ...[
+    ['remove all write bits',0o666,'a-w'],
+    ['add user read and write',0o004,'u+rw'],
+    ['assign group and other permissions',0o770,'go=rx'],
+    ['sequential classes',0o777,'u=rw,g=r,o='],
+    ['conditional execute on plain file',0o644,'a+X'],
+    ['conditional execute on executable',0o744,'a+X'],
+    ['conditional execute after removal',0o755,'a-x,a+X'],
+    ['assignment clears file special bits',0o4766,'a=rw'],
+    ['multiple operations for one class',0o777,'u+rw-x'],
+  ].map(([name,mode,spec])=>({name,tool:'chmod',files:{file:'content'},modes:{file:mode},args:[spec,'--','file']})),
+  ...[
+    ['identical bytes', 'abc\n', 'abc\n', []],
+    ['first differing byte', 'same\nabc\n', 'same\nabX\n', []],
+    ['quiet difference', 'abc', 'ab', ['-s']],
+    ['shorter file', 'abc', 'abcd', []],
+    ['empty file', '', 'abc', []],
+    ['binary difference', 'a\0b', 'a\0c', []],
+  ].map(([name,before,after,args])=>({name,tool:'cmp',files:{before,after},args:[...args,'--','before','after']})),
+  {name:'squeeze spaces without translating s',tool:'tr',files:{},args:['-s',' '],input:'size_t   inbytesleft\n'},
+  {name:'translate then squeeze',tool:'tr',files:{},args:['-s','ab','x'],input:'aabbbcaa\n'},
+  {name:'delete then squeeze',tool:'tr',files:{},args:['-ds','x','a'],input:'axaxa bbb\n'},
+  {name:'delete only',tool:'tr',files:{},args:['-d','x'],input:'axxbbb\n'},
+  {name:'squeeze repeated newlines',tool:'tr',files:{},args:['-s','\\n'],input:'a\n\n\nb\n'},
+  {name:'literal hyphen set',tool:'tr',files:{},args:['--','-s','XY'],input:'-s-size_t\n'},
+  sed("make object extension","s=$[\\(\\{]OBJEXT[\\)\\}]=o=g\n","file.$(OBJEXT) file.${OBJEXT}\n"),
+  sed("BRE interior anchors","s/a^b/X/;s/c$d/Y/;s/^z$/Z/\n","a^b c$d\nz\n"),
+  {name:'read file after address',tool:'sed',files:{extra:'inserted\n'},args:['/mark/r extra'],input:'before\nmark\nafter\n'},
+  {name:'read missing file',tool:'sed',files:{},args:['r missing'],input:'kept\n'},
+  {name:'read file with deleted pattern',tool:'sed',files:{extra:'inserted\n'},args:['-n','-e','r extra','-e','d'],input:'one\ntwo\n'},
+  diff('identical','a\nb\n','a\nb\n'),
+  diff('middle insertion','a\nb\nc\n','a\nx\nb\nc\n'),
+  diff('separated insertions','a\nb\nc\nd\n','a\nx\nb\nc\ny\nd\n'),
+  diff('separated deletions','a\nx\nb\nc\ny\nd\n','a\nb\nc\nd\n'),
+  diff('insertion then replacement','a\nb\nc\nd\ne\n','a\nx\nb\nc\nD\ne\n'),
+  diff('repeated lines','a\nsame\nsame\nz\n','a\nsame\nnew\nsame\nz\n'),
+  diff('empty left','','added\n'), diff('empty right','deleted\n',''),
+  diff('missing final newline','a\n','a'), diff('both missing final newline','old','new'),
+  diff('Chinese','前\n後\n','前\n中\n後\n'),
+  diff('CRLF','a\r\nb\r\n','a\r\nx\r\nb\r\n'),
+  diff('brief difference','a\n','b\n',['-q']),
+  sed('file script and branch','s/a/b/\nt done\n:done\np\n','a\n',['-n']),
+  sed('address range','2,3p\n','one\ntwo\nthree\nfour\n',['-n']),
+  sed('inverted address','/skip/!p\n','keep\nskip\nkeep again\n',['-n']),
+  sed('hold exchange','1h\n2{x;p;}\n','first\nsecond\n',['-n']),
+  sed('hold append','1h\n2{H;g;p;}\n','first\nsecond\n',['-n']),
+  sed('multiline N','N;s/\n/:/;p\n'.replace('s/\n','s/\\n'),'first\nsecond\n',['-n']),
+  sed('branch loop',':again\ns/aa/a/\nt again\np\n','aaaa\n',['-n']),
+  sed('translation','y/abc/ABC/\n','abc cab\n'),
+  sed('escaped delimiter','s|a\\|b|X|g\n','a|b a|b\n'),
+  sed('backreference','s/\\(ab\\)/[\\1]/g\n','abab\n'),
+  sed('missing input newline','s/a/b/\n','a'),
+  {name:'attached -f',tool:'sed',files:{script:'s/a/b/\n'},args:['-fscript'],input:'a\n'},
+];
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  if (!process.argv[2]) throw new Error('Output JSON path required');
+  const root=mkdtempSync(join(tmpdir(),'bunmsh-system-reference-'));
+  try {
+    const results=cases.map((c,index) => {
+      const cwd=join(root,String(index)); mkdirSync(cwd);
+      for (const [name,content] of Object.entries(c.files)) {
+        mkdirSync(dirname(join(cwd,name)),{recursive:true});writeFileSync(join(cwd,name),content);
+      }
+      for (const [name,mode] of Object.entries(c.modes??{})) chmodSync(join(cwd,name),mode);
+      const r=spawnSync(`/usr/bin/${c.tool}`,c.args,{cwd,input:c.input??'',encoding:'utf8',env:{...process.env,LC_ALL:'C'}});
+      if (r.error || r.signal || r.status===null) throw r.error??new Error(`Reference failed: ${c.name}`);
+      return {...c,expected:{status:r.status,stdout:r.stdout,stderr:r.stderr,...(c.modes?{modes:Object.fromEntries(Object.keys(c.modes).map(name=>[name,statSync(join(cwd,name)).mode&0o7777]))}:{})}};
+    });
+    const versions=Object.fromEntries(['diff','sed','tr','cmp','chmod','uniq'].map(tool=>[tool,spawnSync(`/usr/bin/${tool}`,['--version'],{encoding:'utf8'}).stdout.split('\n')[0]]));
+    writeFileSync(process.argv[2],JSON.stringify({versions,cases:results},null,2)+'\n');
+    console.log(JSON.stringify({versions,cases:results.length}));
+  } finally {rmSync(root,{recursive:true,force:true});}
+}

package/initramfs/buninu/apps/bunmsh/test/utility-reference.test.js

@@ -0,0 +1,23 @@
+import {test,expect} from 'bun:test';
+import {mkdtempSync,mkdirSync,readFileSync,writeFileSync,rmSync,chmodSync,statSync} from 'node:fs';
+import {tmpdir} from 'node:os';
+import {join,dirname} from 'node:path';
+import {createState,execute,decode} from '../src/shell.js';
+
+// Only data crosses into the guest. No host executables are mounted or spawned.
+const path=process.env.BUNMSH_UTILITY_REFERENCE;
+const fixtures=path ? JSON.parse(readFileSync(path,'utf8')).cases : [];
+if (!path) test.skip('system diff/sed reference (set BUNMSH_UTILITY_REFERENCE)',()=>{});
+for (const c of fixtures) test(`system ${c.tool} reference: ${c.name}`,async()=>{
+  const cwd=mkdtempSync(join(tmpdir(),'bunmsh-utility-reference-'));
+  try {
+    for (const [name,content] of Object.entries(c.files)) {
+      mkdirSync(dirname(join(cwd,name)),{recursive:true});writeFileSync(join(cwd,name),content);
+    }
+    for (const [name,mode] of Object.entries(c.modes??{})) chmodSync(join(cwd,name),mode);
+    const state=createState({cwd,env:{LC_ALL:'C'},shellOptions:{posix:true}});
+    const quote = value => "'" + value.replaceAll("'", "'\\''") + "'";
+    const r=await execute(['builtin',c.tool,...c.args].map(quote).join(' '),state,{capture:true,input:new Response(c.input??'').body});
+    expect({status:r.status,stdout:decode(r.stdout),stderr:decode(r.stderr),...(c.modes?{modes:Object.fromEntries(Object.keys(c.modes).map(name=>[name,statSync(join(cwd,name)).mode&0o7777]))}:{})}).toEqual(c.expected);
+  } finally {rmSync(cwd,{recursive:true,force:true});}
+});

package/initramfs/buninu/apps/jsgotty/client-kitty.mjs

@@ -0,0 +1,61 @@
+const KITTY_CHUNK_SIZE = 4096;
+const KITTY_TRANSPORT_KEYS = new Set(["m", "o", "O", "S", "t", "U", "mime"]);
+
+function kittyPacket(control, payload = "") {
+  const entries = Object.entries(control)
+    .filter(([, value]) => value !== undefined && value !== null && value !== false)
+    .map(([key, value]) => value === true ? key : `${key}=${value}`);
+  return `\u001b_G${entries.join(",")};${payload}\u001b\\`;
+}
+
+/** Convert the server's browser-neutral Kitty message back to native APCs. */
+export function encodeKittyGraphics(message) {
+  if (!message || typeof message !== "object") return "";
+  if (message.kind === "delete") {
+    const deletion = message.delete || {};
+    return kittyPacket({
+      a: "d",
+      d: deletion.scope || "a",
+      i: deletion.imageId || undefined,
+      p: deletion.placementId || undefined,
+    });
+  }
+  if (message.kind !== "placement" || !message.image?.data) return "";
+
+  const original = { ...(message.control || {}) };
+  const action = original.a || "t";
+  const placementOnly = action === "p";
+  const transfer = {};
+  for (const [key, value] of Object.entries(original)) {
+    if (!KITTY_TRANSPORT_KEYS.has(key)) transfer[key] = value;
+  }
+  transfer.a = placementOnly ? "t" : action;
+  transfer.t = "d";
+  transfer.f = message.image.format || transfer.f || 32;
+  if (message.image.width > 0) transfer.s = message.image.width;
+  if (message.image.height > 0) transfer.v = message.image.height;
+  if (!transfer.i && /^\d+$/.test(String(message.image.id || ""))) transfer.i = message.image.id;
+
+  const payload = String(message.image.data);
+  let output = "";
+  for (let offset = 0; offset < payload.length; offset += KITTY_CHUNK_SIZE) {
+    const more = offset + KITTY_CHUNK_SIZE < payload.length;
+    const control = offset === 0 ? { ...transfer, m: more ? 1 : 0 } : { m: more ? 1 : 0 };
+    output += kittyPacket(control, payload.slice(offset, offset + KITTY_CHUNK_SIZE));
+  }
+  if (placementOnly) output += kittyPacket(original);
+  return output;
+}
+
+/** Cursor motion the server adds for browser overlays; native Kitty does it itself. */
+export function syntheticKittyCursorMotion(message) {
+  if (message?.kind !== "placement") return "";
+  const control = message.control || {};
+  if (control.C === "1") return "";
+  const cols = Math.max(0, Number.parseInt(control.c || "0", 10) || 0);
+  const rows = Math.max(0, Number.parseInt(control.r || "0", 10) || 0);
+  const cursorCol = Math.max(1, Number.parseInt(message.cursor?.col || "1", 10) || 1);
+  const targetCol = Math.max(1, cursorCol + cols);
+  if (rows > 0) return "\r\n".repeat(rows) + `\u001b[${targetCol}G`;
+  return cols > 0 ? `\u001b[${targetCol}G` : "";
+}

package/initramfs/buninu/apps/jsgotty/client.mjs

@@ -3,6 +3,7 @@
 import process from "node:process";
 import { Buffer } from "node:buffer";
 import WebSocket from "ws";
+import { encodeKittyGraphics, syntheticKittyCursorMotion } from "./client-kitty.mjs";
 
 const MSG_INPUT = "1";
 const MSG_PING = "2";
@@ -15,6 +16,7 @@ const MSG_SET_WINDOW_TITLE = "3";
 const MSG_SET_PREFERENCES = "4";
 const MSG_SET_RECONNECT = "5";
 const MSG_SET_BUFFER_SIZE = "6";
+const MSG_KITTY_GRAPHICS = "7";
 const MSG_SET_ROLE = "a";
 const MSG_CONTROL_RESULT = "b";
 
@@ -420,6 +422,7 @@ async function main() {
   let fallbackOutputTail = "";
   let viewerInputActive = false;
   let sessionPid = "(unknown)";
+  let pendingKittyCursorMotion = "";
 
   const normalizeEcho = (value) => String(value)
     .replaceAll("\r", "")
@@ -603,6 +606,11 @@ pid:
       case MSG_OUTPUT:
         {
           const output = Buffer.from(payload, "base64");
+          if (pendingKittyCursorMotion && output.equals(Buffer.from(pendingKittyCursorMotion, "utf8"))) {
+            pendingKittyCursorMotion = "";
+            break;
+          }
+          pendingKittyCursorMotion = "";
           process.stdout.write(output);
           if (fallbackProbe && accessRole === "") {
             fallbackOutputTail = normalizeEcho(
@@ -625,6 +633,14 @@ pid:
           process.stdout.write(`\u001b]0;${payload}\u0007`);
         }
         break;
+      case MSG_KITTY_GRAPHICS:
+        try {
+          const message = JSON.parse(payload);
+          const encoded = encodeKittyGraphics(message);
+          pendingKittyCursorMotion = syntheticKittyCursorMotion(message);
+          if (encoded) process.stdout.write(encoded);
+        } catch {}
+        break;
       case MSG_SET_RECONNECT: {
         try {
           const reconnect = JSON.parse(payload);

package/initramfs/buninu/apps/jsgotty/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "jsgotty",
-  "version": "1.1.14",
+  "version": "1.1.15",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "jsgotty",
-      "version": "1.1.14",
+      "version": "1.1.15",
       "dependencies": {
         "node-addon-api": "^7.1.1",
         "ws": "^8.18.3"

package/initramfs/buninu/apps/jsgotty/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsgotty",
-  "version": "1.1.14",
+  "version": "1.1.15",
   "description": "Share your terminal as a web application: A JavaScript rewrite of GoTTY",
   "license": "MIT",
   "bin": {

package/initramfs/buninu/apps/jsgotty/tests/client-kitty.test.mjs

@@ -0,0 +1,43 @@
+import { expect, test } from "bun:test";
+import { encodeKittyGraphics, syntheticKittyCursorMotion } from "../client-kitty.mjs";
+
+test("CLI converts a server Kitty placement to native direct-transfer APC", () => {
+  const encoded = encodeKittyGraphics({
+    kind: "placement",
+    control: { a: "T", t: "f", f: "100", i: "7", p: "9", c: "4", r: "2", o: "z" },
+    image: { id: "7", format: 100, width: 30, height: 20, data: "AA==" },
+  });
+  expect(encoded).toBe("\x1b_Ga=T,f=100,i=7,p=9,c=4,r=2,t=d,s=30,v=20,m=0;AA==\x1b\\");
+});
+
+test("CLI retransmits cached data before a placement-only Kitty command", () => {
+  const data = "A".repeat(4100);
+  const encoded = encodeKittyGraphics({
+    kind: "placement",
+    control: { a: "p", i: "8", p: "2", C: "1" },
+    image: { id: "8", format: 100, width: 1, height: 1, data },
+  });
+  expect(encoded).toContain("\x1b_Ga=t,i=8,p=2,C=1,t=d,f=100,s=1,v=1,m=1;");
+  expect(encoded).toContain("\x1b_Gm=0;AAAA\x1b\\");
+  expect(encoded.endsWith("\x1b_Ga=p,i=8,p=2,C=1;\x1b\\")).toBe(true);
+});
+
+test("CLI converts Kitty deletion messages", () => {
+  expect(encodeKittyGraphics({
+    kind: "delete",
+    delete: { scope: "I", imageId: "7", placementId: "3" },
+  })).toBe("\x1b_Ga=d,d=I,i=7,p=3;\x1b\\");
+});
+
+test("CLI identifies browser-only cursor motion after native Kitty placement", () => {
+  expect(syntheticKittyCursorMotion({
+    kind: "placement",
+    cursor: { row: 3, col: 4 },
+    control: { c: "6", r: "2" },
+  })).toBe("\r\n\r\n\x1b[10G");
+  expect(syntheticKittyCursorMotion({
+    kind: "placement",
+    cursor: { row: 3, col: 4 },
+    control: { c: "6", r: "2", C: "1" },
+  })).toBe("");
+});

package/initramfs/etc/resolv.conf

@@ -1 +1,2 @@
-nameserver 10.0.2.3
+nameserver 1.1.1.1
+nameserver 8.8.8.8

package/initramfs/usr/share/doc/buninu-linux/tar.md

@@ -3,6 +3,17 @@
 `/bin/tar` is a small Bun script over `Bun.Archive`. It handles uncompressed
 tar archives plus gzip and zstd without invoking another program.
 
+Alpine APK v2 archives are supported directly, including their concatenated
+gzip streams and tar sections. For example:
+
+```sh
+tar -tf musl-dev-1.2.6-r2.apk
+tar -xf musl-dev-1.2.6-r2.apk -C ./musl-dev
+```
+
+This extracts archive contents, including package metadata; it does not
+install the package or execute its package scripts.
+
 ## Synopsis
 
 ```sh
@@ -50,7 +61,7 @@ tar --zstd -xf backup.tar.zst -C /mnt/restore
 tar -xzf package.tgz -C /tmp/package --strip-components=1
 
 # Exclude browser resources; match before removing package/
-tar -xzf buninu-browser-0.2.2.tgz -C /tmp/browser --strip-components=1 --exclude=package/usr
+tar -xzf buninu-browser-*.tgz -C /tmp/browser --strip-components=1 --exclude=package/usr
 
 # An Alpine root filesystem, symbolic links and all; then enter it
 tar -xzf alpine-minirootfs-3.24.1-x86_64.tar.gz -C /mnt/alpine

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu-linux",
-  "version": "0.8.55",
+  "version": "0.9.56",
   "description": "A Linux distribution running Bun as PID 1 with the Buninu userspace.",
   "type": "module",
   "main": "./index.js",

package/scripts/arch.js

@@ -16,8 +16,8 @@ export const rootDir = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
 const pins = {
   x86_64: {
-    linuxVirtSha256: "a941c15fc5db26b6692fd0140fa0970da76cb12aadf3dc8306c419f21bd39c93",
-    linuxLtsSha256: "02ba9491d4cc110707de64ed03dd7e2fa5c93fdd851979c244ceb018785a9eea",
+    linuxVirtSha256: "755deb045cfeb8c2bcaa2b2febe01ab2101d747921e64d4cd54d0312321e8d5d",
+    linuxLtsSha256: "b0d8cc4d7e031b5619221e7978920d051bf1dd1e335f6d05d03964b2285fc3b4",
     muslSha256: "573712e2f49c15bfc20a2699f204acdfc74c772722b15e7353d768057fae0e71",
     stubSha256: "8e64a5a3afee5f930e6e6716be726dc6d405530ac7f8fa5be6251dae68671ec9",
     libstdcppSha256: "14c987b556f5385a5db18376e788c75f37d85321b8dc1920d926ea7daac1d6f6",
@@ -32,8 +32,8 @@ const pins = {
     serialMajor: 4,
   },
   aarch64: {
-    linuxVirtSha256: "c7fb892408d7fe163a18671e5c7816752976d1c67fd17794dfba794aa0d6c1ac",
-    linuxLtsSha256: "31aeae56fa527b2fb4fdd4aefbd693cbec210a8cbfd4ea7597a1773b832e9f83",
+    linuxVirtSha256: "e3839bfd751ff0a4421484f712b9b29efb514024523736a0ef62521521571b12",
+    linuxLtsSha256: "795bcd49840be7f4ff9566f5f669201bd41202376a455b720a98eb814f0e72f8",
     muslSha256: "5e9674b7f41152fe2119093b5cb4c13eaaadb19c2d5422b2d7267913e663ee6e",
     stubSha256: "a1823d2d7082db555d528f82c1809f276c818aeb5b40f198f4565f104e055c38",
     libstdcppSha256: "2302e766d4e4926038ec166ecb85837ee884576115236ddb565e3a5fca4a11d7",
@@ -67,7 +67,7 @@ export const config = ({
   // The Alpine repository keeps only the newest build of a package, so a pin
   // stops downloading when Alpine bumps it; the hashes then fail loudly.
   const alpineBase = `${mirror}/v3.24/main/${arch}`;
-  const kernelVersion = "6.18.55";
+  const kernelVersion = "6.18.56";
   const kernelRelease = `${kernelVersion}-0-${flavor}`;
   const bunVersion = "1.4.2";
   const downloadsDir = join(rootDir, "downloads", arch);

package/scripts/arch.sh

@@ -44,7 +44,7 @@ fi
 alpine_mirror=${ALPINE_MIRROR:-https://dl-cdn.alpinelinux.org/alpine}
 alpine_base="$alpine_mirror/v3.24/main/$arch"
 
-kernel_version=6.18.55
+kernel_version=6.18.56
 kernel_release="$kernel_version-0-$linux_flavor"
 linux_package="linux-$linux_flavor-$kernel_version-r0.apk"
 musl_package=musl-1.2.6-r2.apk
@@ -63,8 +63,8 @@ musl_libc="libc.musl-$arch.so.1"
 
 case $arch in
     x86_64)
-        linux_virt_sha256=a941c15fc5db26b6692fd0140fa0970da76cb12aadf3dc8306c419f21bd39c93
-        linux_lts_sha256=02ba9491d4cc110707de64ed03dd7e2fa5c93fdd851979c244ceb018785a9eea
+        linux_virt_sha256=755deb045cfeb8c2bcaa2b2febe01ab2101d747921e64d4cd54d0312321e8d5d
+        linux_lts_sha256=b0d8cc4d7e031b5619221e7978920d051bf1dd1e335f6d05d03964b2285fc3b4
         musl_sha256=573712e2f49c15bfc20a2699f204acdfc74c772722b15e7353d768057fae0e71
         stub_sha256=8e64a5a3afee5f930e6e6716be726dc6d405530ac7f8fa5be6251dae68671ec9
         libstdcpp_sha256=14c987b556f5385a5db18376e788c75f37d85321b8dc1920d926ea7daac1d6f6
@@ -82,8 +82,8 @@ case $arch in
         serial_major=4
         ;;
     aarch64)
-        linux_virt_sha256=c7fb892408d7fe163a18671e5c7816752976d1c67fd17794dfba794aa0d6c1ac
-        linux_lts_sha256=31aeae56fa527b2fb4fdd4aefbd693cbec210a8cbfd4ea7597a1773b832e9f83
+        linux_virt_sha256=e3839bfd751ff0a4421484f712b9b29efb514024523736a0ef62521521571b12
+        linux_lts_sha256=795bcd49840be7f4ff9566f5f669201bd41202376a455b720a98eb814f0e72f8
         musl_sha256=5e9674b7f41152fe2119093b5cb4c13eaaadb19c2d5422b2d7267913e663ee6e
         stub_sha256=a1823d2d7082db555d528f82c1809f276c818aeb5b40f198f4565f104e055c38
         libstdcpp_sha256=2302e766d4e4926038ec166ecb85837ee884576115236ddb565e3a5fca4a11d7

package/scripts/fetch.js

@@ -98,6 +98,8 @@ export const readTar = (path) => {
     if (type === "0" || type === "\0") files.set(name.replace(/^\.\//, ""), body);
   }
   return {
+    // Enumerate regular files without exposing the Map's mutation methods.
+    entries() { return files.entries(); },
     get(name) {
       const bytes = files.get(name);
       if (!bytes) throw new Error(`${path}: no ${name}`);

package/scripts/npm-packages.md

@@ -1,9 +1,10 @@
 # npm packages
 # Latest versions checked on 2026-10-11; SHA-256 pins verified against registry SHA-512 integrity.
+# buninu-browser updated and verified on 2026-10-12.
 
-"buninu-browser@0.2.2":
-  - https://registry.npmjs.org/buninu-browser/-/buninu-browser-0.2.2.tgz
-  - sha256:d551fec88f0fe8a6494f806cc8b4b560454796e25f25493e8a3b5b77e6f7f10b
+"buninu-browser@0.2.3":
+  - https://registry.npmjs.org/buninu-browser/-/buninu-browser-0.2.3.tgz
+  - sha256:0f7c9cd9df689d7b0900fdf3172851125ebd8aba12bed555be7e091d427146e8
 
 "@drxiaozhi/casty@1.3.4":
   - https://registry.npmjs.org/@drxiaozhi/casty/-/casty-1.3.4.tgz

package/test/fetch-npm.test.js

@@ -23,7 +23,7 @@ const url = `http://127.0.0.1:${server.port}/archive`;
 
 test("four exact registry pins share an architecture-independent cache", () => {
   expect(npmPackages.map(({ name, version }) => `${name}@${version}`)).toEqual([
-    "buninu-browser@0.2.2", "@drxiaozhi/casty@1.3.4",
+    "buninu-browser@0.2.3", "@drxiaozhi/casty@1.3.4",
     "@drxiaozhi/jspulse@0.2.1", "@drxiaozhi/jspinyin@0.1.1",
   ]);
   expect(basename(npmDownloadsDir)).toBe("npm");

package/test/tar-strip.test.js

@@ -216,3 +216,39 @@ test("does not follow a pre-existing symlink parent or an archive symlink parent
   expect(result.status).toBe(2);
   expect(existsSync(join(outside, "nested"))).toBe(false);
 });
+
+test("APK concatenated gzip/tar streams list and extract every section", () => {
+  const signature = tar([{ name: ".SIGN.test", data: "signature" }]);
+  const control = tar([{ name: ".PKGINFO", data: "pkgname = sample\n" }]);
+  const data = tar([
+    { name: "usr/include/stdio.h", data: "header\n" },
+    { name: "usr/lib/crt1.o", data: "object\n" },
+    { name: "usr/lib/link", type: "2", target: "crt1.o" },
+  ]);
+  // APK signature/control streams can omit end markers; also cover complete
+  // concatenated tar archives, and a single gzip stream containing them all.
+  for (const raw of [false, true]) {
+    const parts = [raw ? signature.subarray(0, -1024) : signature,
+      raw ? control.subarray(0, -1024) : control, data];
+    for (const bytes of [Buffer.concat(parts.map(p => Bun.gzipSync(p))), Bun.gzipSync(Buffer.concat(parts))]) {
+      const result = extract(bytes, [], true);
+      expect(result.status).toBe(0);
+      expect(readFileSync(join(result.dir, ".PKGINFO"), "utf8")).toBe("pkgname = sample\n");
+      expect(readFileSync(join(result.dir, "usr/include/stdio.h"), "utf8")).toBe("header\n");
+      expect(readlinkSync(join(result.dir, "usr/lib/link"))).toBe("crt1.o");
+      const listed = run(["-tf", "-"], bytes);
+      expect(listed.status).toBe(0);
+      expect(listed.stdout.trim().split("\n")).toEqual([
+        ".SIGN.test", ".PKGINFO", "usr/include/stdio.h", "usr/lib/crt1.o", "usr/lib/link",
+      ]);
+      const selected = extract(bytes, ["usr/include"], true);
+      expect(selected.status).toBe(0);
+      expect(existsSync(join(selected.dir, ".PKGINFO"))).toBe(false);
+      expect(readFileSync(join(selected.dir, "usr/include/stdio.h"), "utf8")).toBe("header\n");
+      const stripped = extract(bytes, ["--strip-components=2", "--exclude=usr/lib", "usr"], true);
+      expect(stripped.status).toBe(0);
+      expect(readFileSync(join(stripped.dir, "stdio.h"), "utf8")).toBe("header\n");
+      expect(existsSync(join(stripped.dir, "crt1.o"))).toBe(false);
+    }
+  }
+});