buninu 0.1.8 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 0.2.0 - 2026-08-17
+
+### Added
+
+- Add `--jsgotty`, `--jsmdcui`, and `--musl-la` as the first argument to
+  `bin/init.js` to spawn that app directly, forwarding every remaining
+  argument to it and exiting with its exit code. This bypasses the shell and
+  startup-command flow entirely, and lets `--jsgotty --help` (and the same for
+  the other two) show the app's own option reference instead of Buninu's.
+- Add `buninu-help`, a POSIX and Windows multicall command that renders
+  README.md with jsmdcui's `--cat` mode and then displays `icon.png` with
+  jsgotty's `--viu`. The default startup greeting now points to it instead of
+  separately mentioning `glow`/`README.md`.
+
+### Security
+
+- Bind jsgotty to `127.0.0.1` by default instead of `0.0.0.0` in
+  `scripts.start`. Previously the terminal server accepted connections from
+  any device able to reach the host on its network, relying only on the
+  random port and `--random-url` path segment for protection. Pass
+  `--address <value>` through to `bin/init.js` (forwarded arguments override
+  the flags baked into `scripts.start`) to opt back into listening on other
+  interfaces.
+
+## 0.1.9 - 2026-08-17
+
+### Fixed
+
+- Correct `apps/musl-la/NOTICE`: it listed 11 third-party components
+  (llama.cpp, nghttp2/nghttp3, OpenSSL, libssh2, curl, zlib, libidn2,
+  libunistring, brotli, c-ares, libpsl) with no corresponding files anywhere
+  in the package — leftover from an unrelated bundle. The only files actually
+  shipped in that directory are `ld-musl-aarch64.so.1`, `libgcc_s.so.1`, and
+  `libstdc++.so.6`; the notice now covers only those, identifying the exact
+  build (GCC 14.2.0, packaged as Alpine Linux 3.22's `libgcc`/`libstdc++`
+  14.2.0-r6, aarch64) with matching SHA-256 hashes and a link to Alpine's
+  build recipe pinned to the commit for that package revision, satisfying the
+  GCC Runtime Library Exception's corresponding-source requirement.
+
 ## 0.1.8 - 2026-08-17
 
 ### Changed

package/README.md

@@ -1,6 +1,6 @@
 # Buninu
 
-![icon](icon.png)
+![icon](https://raw.githubusercontent.com/jjtseng93/buninu/main/icon.png)
 
 > **Early development:** Buninu is still at an early stage of development.
 > Features, configuration, and command-line behavior may change between releases.
@@ -70,8 +70,33 @@ shell for the current platform. Other arguments are forwarded to jsgotty:
 ```sh
 npx buninu --credential user:pass
 npx buninu --port 9000
+npx buninu --jsgotty --help
+
+# public: listen on every interface, reachable from other devices on the network, be cautious!
+npx buninu -a 0.0.0.0
 ```
 
+As the first argument, `--jsgotty`, `--jsmdcui`, or `--musl-la` bypasses the
+shell/command startup flow entirely: it spawns that app directly with every
+remaining argument forwarded to it, and exits with its exit code. Use this to
+reach an app's own options directly, for example `npx buninu --jsgotty --help`
+to see jsgotty's actual flag reference instead of Buninu's.
+
+## Security
+
+`scripts.start` binds jsgotty to `127.0.0.1` by default, so the terminal
+server only accepts connections from the same machine. It is not reachable
+from other devices on the network unless you explicitly opt in.
+
+The terminal itself is writable (`-w`) and unauthenticated by default; only
+the loopback binding and jsgotty's random URL path (`-r`) stand between a
+local process and a shell with Buninu's permissions. To listen on another
+interface, forward `--address <value>` (see [Start](#start)); forwarded
+arguments override the flags baked into `scripts.start`. Also pass
+`--credential user:pass` when doing so, since the random port and URL path
+are not a substitute for authentication once the server is reachable from
+outside the machine.
+
 ## Command-line information
 
 ```text
@@ -79,8 +104,16 @@ npx buninu --port 9000
 -V, --version    Show the Buninu, Bun, platform, and architecture versions
 --readme          Render README.md in the terminal
 --changelog       Render CHANGELOG.md in the terminal
+--jsgotty [args...]  Spawn jsgotty directly and exit with its exit code
+--jsmdcui [args...]  Spawn jsmdcui directly and exit with its exit code
+--musl-la [args...]  Spawn musl-la directly and exit with its exit code
 ```
 
+These are flags to `bin/init.js` itself, resolved before Buninu starts. Once you
+are inside a running Buninu shell, run `buninu-help` instead: it renders
+README.md with jsmdcui's `--cat` mode and then shows `icon.png` with jsgotty's
+`--viu`. It is the command the default startup greeting points to.
+
 ## Export
 
 Export the current Buninu installation as a gzip-compressed tar archive:

package/apps/cmdlist

@@ -14,3 +14,6 @@ jsmdcui
 
 ### musl-la — Launch AArch64 ELF programs with the bundled musl loader
 musl-la
+
+### buninu-help — Render README.md with glow, then show icon.png with jsgotty --viu
+buninu-help

package/apps/musl-la/NOTICE

@@ -1,56 +1,20 @@
 This product includes third-party components:
 
-- llama.cpp (libllama, libggml)
-  License: MIT
-  https://github.com/ggml-org/llama.cpp
-
-- nghttp2 / nghttp3
-  License: MIT
-  https://github.com/nghttp2/nghttp2
-  Copyright (c) 2012, 2014, 2015, 2016 Tatsuhiro Tsujikawa
-  Copyright (c) 2012, 2014, 2015, 2016 nghttp2 contributors
-  Copyright (c) 2019 nghttp3 contributors
-
-- OpenSSL (libssl, libcrypto)
-  License: Apache License 2.0
-  https://github.com/openssl/openssl
-
-- libssh2
-  License: BSD-3-Clause license
-  https://github.com/libssh2/libssh2
-  
-- curl (libcurl)
-  License: curl license (MIT-like)
-  https://curl.se/
-
-- zlib
-  License: zlib
-  https://zlib.net/
-
-- libgcc/libgomp/libstdc++
+- libgcc_s.so.1 / libstdc++.so.6
   License: GPL-3.0 + GCC Runtime Library Exception
-  https://gcc.gnu.org/
-  See: ./LICENSES/gcc_runtime_exception.txt
+  See: ./LICENSES/GPL-3.0.txt and ./LICENSES/gcc_runtime_exception.txt
 
-- libidn2
-  License: LGPL-3.0 or later
-  https://www.gnu.org/software/libidn
-  https://gitlab.com/libidn/libidn2
+  Built from GCC 14.2.0, as packaged by Alpine Linux 3.22
+  (packages libgcc and libstdc++, version 14.2.0-r6, aarch64).
 
-- libunistring
-  License: LGPL-3.0 or later
-  https://www.gnu.org/software/libunistring
+  Upstream GCC source:
+  https://gcc.gnu.org/pub/gcc/releases/gcc-14.2.0/gcc-14.2.0.tar.xz
 
-- brotli
-  License: MIT
-  https://github.com/google/brotli
-  Copyright (c) 2009, 2010, 2013-2016 by the Brotli Authors.
-  
-- c-ares (libcares)
-  License: MIT
-  https://c-ares.org
+  Alpine's build recipe and patches (Corresponding Source for this exact
+  build), pinned to the commit matching pkgrel=6:
+  https://gitlab.alpinelinux.org/alpine/aports/-/blob/fbf60319be3bbaf6dd32ef55cc6fb7189e05c266/main/gcc/APKBUILD
 
-- libpsl
-  License: MIT
-  https://github.com/rockdaboot/libpsl
-  Copyright (C) 2014-2024 Tim Rühsen
+  SHA-256 (verified byte-for-byte identical to the official Alpine 3.22
+  aarch64 packages):
+    libgcc_s.so.1:  2d945d6ce360769b41fbffc652c2440014bbd69416f13fe206fbac19d32c9431
+    libstdc++.so.6: 85f2cd6db79578ab58be4d12b7df7482ebc003a37496c7544956d9157f8a2b3f

package/bin/buninu-help.bat

@@ -0,0 +1,4 @@
+@echo off
+call "%~dp0bun.bat" "%~dp0..\apps\jsmdcui\src\index.js" --cat "%~dp0..\README.md"
+call "%~dp0bun.bat" "%~dp0..\apps\jsgotty\gotty.js" --viu "%~dp0..\icon.png"
+exit /b %ERRORLEVEL%

package/bin/buninu-help.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+sd=$(dirname "$(realpath "$0")")
+root=$sd/..
+
+bun "$root"/apps/jsmdcui/src/index.js --cat "$root"/README.md
+exec bun "$root"/apps/jsgotty/gotty.js --viu "$root"/icon.png

package/bin/init.js

@@ -30,6 +30,14 @@ Init options:
   --shell <path|name>    Override buninu.shell for this run
   --command <command>    Override buninu.command for this run
 
+Direct app launch (must be the first argument; skips the shell/command
+startup flow entirely):
+  --jsgotty [args...]    Spawn jsgotty directly, forwarding remaining
+                          arguments, and exit with its exit code
+                          (--jsgotty --help shows jsgotty's own options)
+  --jsmdcui [args...]    Spawn jsmdcui directly, same forwarding behavior
+  --musl-la [args...]    Spawn musl-la directly, same forwarding behavior
+
 Package configuration:
   package.json contains a buninu section for default and platform settings.
   buninu.shell          Select the shell to start
@@ -395,6 +403,34 @@ async function createChildEnvironment(environment) {
   };
 }
 
+const directAppTargets = {
+  "--jsgotty": "jsgotty",
+  "--jsmdcui": "jsmdcui",
+  "--musl-la": "musl-la",
+};
+
+async function runDirectApp(name, forwardedArgs, environment) {
+  const isWindows = environment.name === "windows";
+  const launcherPath = resolve(binDir, isWindows ? `${name}.bat` : name);
+  if (!await pathExists(launcherPath)) {
+    fail(`${name} is not available on ${environment.name}: ${launcherPath}`);
+  }
+
+  const childEnvironment = await createChildEnvironment(environment);
+  const argv = isWindows
+    ? [process.env.ComSpec || "cmd.exe", "/c", launcherPath, ...forwardedArgs]
+    : [launcherPath, ...forwardedArgs];
+
+  const child = Bun.spawn(argv, {
+    cwd: rootDir,
+    env: childEnvironment,
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+  });
+  process.exit(await child.exited);
+}
+
 function readInitArguments(arguments_) {
   const forwarded = [];
   let shell = null;
@@ -459,6 +495,14 @@ if (typeof startScript !== "string" || !startScript.trim()) {
   fail("package.json does not define scripts.start");
 }
 
+const directAppTarget = directAppTargets[process.argv[2]];
+if (directAppTarget) {
+  const directEnvironment = await detectEnvironment();
+  await runPlatformSwitch(directEnvironment);
+  await rebuildNativeSymlinks(directEnvironment);
+  await runDirectApp(directAppTarget, process.argv.slice(3), directEnvironment);
+}
+
 if (await handleInformationArguments(process.argv.slice(2))) process.exit(0);
 
 const command = splitCommand(startScript);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "description": "Buninu is a portable, self-bootstrapping Unix-like userspace built on Bun that runs across operating systems",
   "type": "module",
   "main": "./bin/init.js",
@@ -17,15 +17,15 @@
       "windows": null
     },
     "command": {
-      "default": "echo Welcome to Buninu, Try: glow apps/cmdlist",
-      "android": "if command -v libmain.so >/dev/null 2>&1; then libmain.so; else printf '%s\\n' '# Welcome to Buninu Android' '- Try: glow apps/cmdlist'; fi",
+      "default": "echo Welcome to Buninu, Try: glow apps/cmdlist, Help: buninu-help",
+      "android": "if command -v libmain.so >/dev/null 2>&1; then libmain.so; else printf '%s\\n' '# Welcome to Buninu Android' '- Try: glow apps/cmdlist' '- Help: buninu-help'; fi",
       "linux": null,
       "macos": null,
       "windows": null
     }
   },
   "scripts": {
-    "start": "bun ./apps/jsgotty/gotty.js --reconnect -r -w --webgl",
+    "start": "bun ./apps/jsgotty/gotty.js --reconnect -r -w --webgl -a 127.0.0.1",
     "check": "node --check ./bin/init.js"
   }
 }