buninu 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 0.4.2 - 2026-09-03
+
+### Changed
+
+- Update the bundled bunmsh from 0.2.0 to 0.3.3, which is what a `--local`
+  session runs. It gains a `curl` PATH-fallback builtin written on Bun's own
+  `fetch`, so a device that ships no `curl` binary can still run the download
+  and API scripts that expect one; `pspa` and `pspac`, the process listing this
+  tree's `.bashrc` aliases used to be the only way to get; and a `kill` that
+  works on Windows. Its JavaScript mode binds `$` to the shell's own variable
+  table, so `$.HOME` reads a shell variable and `$.TAG = "v1"` writes one that
+  later commands see, and completion learned shell variable names, command
+  names inside `$(`, and JavaScript lines. A real `curl`, `pspa` or `pspac` in
+  `PATH` still wins over any of the builtins; `builtin curl ...` selects
+  bunmsh's. Its own [CHANGELOG](apps/bunmsh/CHANGELOG.md) has the rest.
+
+### Fixed
+
+- The process-list helpers section, left behind by the bunmsh update above,
+  still described `--local` as a session with neither the bundled `.bashrc` nor
+  `$HOME/.bashrc`, and sent you to source the bundled file to get the aliases
+  back — where `pspac`, being two commands joined by `;`, would fail to define
+  as a bunmsh alias. bunmsh now has `pspa` and `pspac` as PATH-fallback
+  builtins, and colour aliases for `ls`, `grep` and `diff` of its own, so a
+  `--local` session already answers all five of those names and has no reason
+  to source anything. The section says so now, and says where the builtins
+  differ from the aliases they stand in for: `pspac` colours the table inline
+  rather than writing `$HOME/.pspidargs.sh` and paging it through `glow`, and
+  `pspa` answers on Windows as well, by querying `Win32_Process` through
+  PowerShell, where `ps -eo pid,args` has no counterpart — so the paragraph
+  ruling Windows out is now about the aliases rather than about both. Nothing
+  changed for the other routes: Android still loads the bundled file through
+  `ENV` for the shell jsgotty starts, and a remote Bash or mksh session on
+  Linux or macOS still sources it by hand.
+
 ## 0.4.1 - 2026-08-30
 
 ### Fixed

package/README.md

@@ -112,8 +112,8 @@ bun ~/somewhere/buninu/bin/init.js --local
 ```
 
 Command history is kept in your own home directory either way, so it survives
-`npx`. What does not is anything you add to the installation itself — aliases
-in its `.bashrc`, commands of your own under `apps/` — since that lives in the
+`npx`. What does not is anything you add to the installation itself — commands
+of your own under `apps/`, edits to its `.bashrc` — since that lives in the
 package, and under `npx` the package is a cache directory.
 See [Data & Persistence](#data--persistence).
 
@@ -126,6 +126,26 @@ bun ./bin/init.js --local
 Buninu's own tools (`rz`, `sz`, `showimg`, `tts`, `xdg-open`, `native-bridge`,
 etc.) stay available inside this shell too, same as in the browser session.
 
+Unlike the shells the browser terminal starts, **bunmsh does not read
+`.bashrc`**. It does not claim complete POSIX behavior yet, so a startup file
+written for a full shell can fail part way through — and a startup file that
+fails is a shell you cannot get into. Nothing is read automatically until that
+is no longer a risk. Source it yourself when you want it:
+
+```sh
+. ./.bashrc
+```
+
+The shell starts in `BUNINU_HOME`, so that path works as written at first;
+after moving elsewhere, use `. "$BUNINU_HOME/.bashrc"`.
+
+There is no setting that does this for you yet, and
+[`buninu.command`](#startup-command-optional) is not it:
+`--local` does not run it at all, and the browser terminal, which does, runs it
+in a subshell before starting a fresh shell — so aliases and functions a
+startup command defines are gone by the time you reach a prompt either way.
+Until bunmsh reads a startup file of its own, sourcing it by hand is the way.
+
 ## Data & Persistence
 
 Running Buninu via `npx` works like a container: `npx` fetches the package into
@@ -624,6 +644,16 @@ terminal returns to an interactive shell.
 For compatibility, `"command": "..."` is also accepted as a shared command
 for every platform.
 
+The command runs in a subshell, and the interactive shell that follows is a
+fresh one, so anything it defines rather than does — aliases, functions, shell
+variables — is gone before you reach a prompt. Use it to run something, print
+something, or start something; a startup file that configures the session is a
+job for the shell itself, through `ENV` for the shells that honor it.
+
+It applies to the browser terminal only. `--local` does not run it, so a
+`bunmsh` session starts with nothing from this setting; see
+[Start a local shell in a Terminal](#start-a-local-shell-in-a-terminal-experimental).
+
 Override it for one run with:
 
 ```sh
@@ -728,6 +758,57 @@ in a way that leaves the back key broken.
 The bundled `.bashrc` provides `pspa` (`ps -eo pid,args`) and `pspac`, which
 writes that process list to `$HOME/.pspidargs.sh` and displays it with `glow`.
 Buninu preserves an existing `HOME` rather than replacing or modifying the
-user's home; shells that honor `ENV` load the bundled file, while interactive
-Bash may load only `$HOME/.bashrc`, so add `. "$BUNINU_HOME/.bashrc"` to a
-custom Bash configuration when these aliases are not available.
+user's home, and points `ENV` at the bundled file. Whether that file is read
+depends entirely on the shell:
+
+| Where | Shell | The bundled `.bashrc` |
+|---|---|---|
+| Android, including a minapk APK | `/system/bin/sh`, which is mksh | Loaded through `ENV`; all of these aliases work |
+| Linux and macOS | Bash, usually | Not loaded — an interactive Bash reads `$HOME/.bashrc` and ignores `ENV` |
+| Windows | PowerShell, or `cmd.exe` | Not loaded, and these aliases would not carry over: listing processes is spelled differently there |
+| `--local` | bunmsh | Not loaded, and not needed: bunmsh answers all five names itself |
+
+So Android gets these aliases without doing anything, and everywhere else the
+bundled file sits unread — which also means your own `$HOME/.bashrc` is left
+entirely alone.
+
+Under `--local` these are bunmsh's own, not aliases read from a file, so they
+work with nothing sourced — and the two process helpers are not quite the same
+two commands. `pspa` prints the same PID-and-command-line table, but through
+bunmsh's own process query, which also answers on Windows, where
+`ps -eo pid,args` has no counterpart. `pspac` colours that table inline as
+shell syntax: it writes no `$HOME/.pspidargs.sh` and does not need `glow`.
+Both are PATH-fallback builtins, so a real `pspa` or `pspac` on `PATH` still
+wins and `builtin pspa` selects bunmsh's explicitly. Its `ls`, `grep` and
+`diff` colour aliases are built in as well, which is why nothing in the bundled
+file is missing from a `--local` session. See
+[bunmsh's PATH-fallback builtins](apps/bunmsh/README.md#path-fallback-builtins).
+
+On Windows the two *aliases* do not apply. Both wrap `ps -eo pid,args`, and
+that invocation has no counterpart: PowerShell does have `ps`, but as an alias
+for `Get-Process`, which takes its own options rather than those. List
+processes with `Get-Process` in PowerShell, or `tasklist` in `cmd.exe` — or use
+`--local`, where bunmsh's builtins of the same names answer by querying
+`Win32_Process` through PowerShell and print the same two columns.
+
+To get the aliases in a POSIX session that did not load them, source the file
+from the prompt:
+
+```sh
+. "$BUNINU_HOME/.bashrc"
+```
+
+Source it from the prompt rather than putting that line in your own
+`$HOME/.bashrc`: `BUNINU_HOME` is only set inside a Buninu session, so
+elsewhere the same line reads `. "/.bashrc"` and every shell you open either
+complains or, if that file happens to exist, sources something you did not
+mean to.
+
+That is for a Bash or mksh session that did not load the file — the remote
+route on Linux and macOS. A `--local` session has no reason to source it, since
+bunmsh defines all five names itself. Sourcing it there anyway still reports
+`alias: pspac: invalid alias` and carries on: a bunmsh alias is a list of
+words, and `pspac` is two commands joined by `;` with a redirection in the
+first, so it cannot be one — but the builtin of that name is already there, and
+an alias that fails to define leaves it reachable. See
+[Start a local shell in a Terminal](#start-a-local-shell-in-a-terminal-experimental).

package/apps/bunmsh/CHANGELOG.md

@@ -2,6 +2,182 @@
 
 All notable user-visible changes to bunmsh are documented here.
 
+## [0.3.3] - 2026-09-03
+
+### Fixed
+
+- Pass `--color` rather than `--color=auto` in the default `diff` alias.
+  Toybox's `diff` — the one Android answers `/system/bin/diff` with — spells
+  the option without a `=WHEN` argument and rejects the longer form outright
+  (`diff: Unknown option 'color=auto'`, status 2), so an unqualified `diff`
+  produced an error instead of a comparison. GNU diffutils accepts either
+  spelling, so nothing changes where that is the `diff` on `PATH`. The `ls` and
+  `grep` aliases keep `--color=auto`, which both of those do accept.
+
+  BusyBox `diff` has no colour option under either spelling and answers
+  `diff: unrecognized option: color`. Override the alias with `alias diff=diff`
+  where `diff` is BusyBox, as it is on Alpine.
+
+## [0.3.2] - 2026-09-01
+
+### Added
+
+- Bind `$` to the shell's variable table inside the highest-priority
+  JavaScript mode, so the two languages share one set of variables rather than
+  passing strings across a boundary. `Bun.e, $.HOME` reads one — exported or
+  not — `$.TAG = "v1"` writes one that later shell commands and external child
+  processes both see, `delete $.NAME` unsets one, and `Object.keys($)`
+  enumerates them. It is the live table rather than a copy, which is what makes
+  a write visible immediately; it also means a write bypasses `readonly`, so
+  `$` is an escape hatch as much as a convenience. Bun Shell's own `Bun.$` is
+  reached through the `Bun` object and is unaffected by the binding. Values
+  are shell values, so they are strings: `$.X + 1` concatenates unless
+  converted, and assigning a non-string stores it as-is, leaving JavaScript
+  with a number under that name while every name the shell set stays a string.
+  The README says so with examples.
+
+- Complete shell variable names. Typing `$HO` now ghosts `$HOME` and Tab
+  offers every matching name; `${HO` completes to `${HOME}`, closing the brace
+  it opened, and `${#HO` does the same. Names come from the shell's own
+  variable table, so unexported names — and anything JavaScript mode wrote
+  through `$` — are offered alongside the environment. It applies wherever an
+  expansion would happen (mid-word, after `X=`, inside double quotes, and in
+  command position), stays quiet inside single quotes, and is not offered for
+  the other things a `$` can start: `$(`, `$?`, `$1`, `$$`, and a
+  backslash-escaped `\$` (the backslashes are counted, so `\\$HO` still
+  suggests). A bare `$` ghosts nothing but still lists everything on Tab, the
+  way an empty word lists every file. Where both apply, the history ghost still
+  wins, since it completes the whole line.
+- Complete command names inside `$(`. A command substitution starts a new
+  command, but the completer used to read `$(l` as one long word and look for
+  a file by that name; it now offers commands there, and files after the
+  command, the way it does at the start of a line.
+
+- Complete on a JavaScript line too, reading it as JavaScript rather than as
+  shell text. After `$.` it offers shell variable names, and inside an unclosed
+  string literal it completes the text back to the opening quote as a path —
+  so `Bun.file("/tm` completes without the trailing space that used to be
+  needed to make the completer see a path at all, and without trimming that
+  space back off afterwards. A template's `${...}` counts as code again, so
+  `$.` completes inside it. A bare `$` completes nothing there, since in
+  JavaScript it is the variable table itself and a name only begins after the
+  dot. Where neither applies only the history ghost is offered.
+
+### Fixed
+
+- Stop asking a JavaScript line to continue when it cannot. A line ending in a
+  bare backslash used to get the shell's PS2 prompt, but a backslash outside a
+  string literal is a syntax error in JavaScript, so whatever was typed next
+  was guaranteed not to parse. An unterminated string or template still
+  continues, because that is JavaScript's own line continuation and the
+  evaluator does accept it — `Bun.e, "abc\` and `def"` on two lines prints
+  `abcdef`. The rule that decides JavaScript mode is now one exported
+  function, so the prompt, the completer and the evaluator cannot disagree
+  about what a line is.
+
+## [0.3.1] - 2026-09-01
+
+### Added
+
+- Ship `LICENSE`, `LICENSE-MKSH`, and `LICENSE-MICRO` as packaged assets, so
+  a standalone executable carries them the way it already carried the README
+  and this changelog. It matters for `LICENSE-MICRO` in particular: the binary
+  contains the highlighting rules transcribed from micro's
+  `runtime/syntax/sh.yaml`, and an MIT notice has to travel with the code it
+  covers, not only with the repository. Reading them back out of a build is
+  `--assets-extract` on the tar back end, or `builtin serve 'B:/~BUN'` on an
+  `ASSETS_BUNFS=1` one; both land the licences under
+  `assets/bunmsh@<version>/`, and the README's licence section says so.
+
+### Changed
+
+- Say plainly in the README and in `LICENSE-MICRO` that `catfancy` takes five
+  of micro's `monokai.micro` colour-links for its JSON, rather than only that
+  its colours happen to be the same five values. The palette was taken from
+  micro, so the attribution now says so.
+
+## [0.3.0] - 2026-09-01
+
+### Added
+
+- Add a `curl` PATH-fallback builtin implemented on Bun's own `fetch`, so a
+  device that ships no `curl` binary can still run the download and API
+  scripts that expect one. A real `curl` in `PATH` still wins;
+  `builtin curl ...` selects this one. A URL with no scheme gets one —
+  `http://`, or `https://` when the port is `443`, or whatever
+  `--proto-default` names — so `curl localhost:8080` and `curl example.com`
+  behave the way they do with the real curl.
+  - Downloads: `-o`, `-O`, `-J`, `--output-dir`, `--create-dirs`, `-a`, and
+    `-C -`/`-C OFFSET` resume, which sizes the partial file, asks for the rest
+    with a `Range` header, appends when the server answers `206`, rewrites when
+    a `200` says the range was ignored, and treats `416` as "already complete".
+  - Request bodies: `-X`, `-H` (including curl's `'Name;'` empty-value and
+    `'Name:'` removal forms), `-d`, `--data-raw`, `--data-binary`,
+    `--data-ascii`, `--data-urlencode`, `--json`, `-G`, `-F`,
+    `--form-string`, `-T`, `-u`, `--oauth2-bearer`, `-A`, `-e`, `-b`, `-r`,
+    `--compressed`, and `-x`, with `@file` and `@-` reading a body from a file
+    or from stdin — enough to call a JSON API such as OpenAI's chat
+    completions endpoint from the shell.
+  - Responses and reporting: `-i`, `-I`, `-D`, `-w` with the usual
+    `%{variable}` set, `-L` with `--max-redirs` and the `301`/`302`/`303`
+    POST-to-GET rule, `-f`, `--fail-with-body`, `-k`, `-m`,
+    `--connect-timeout`, `--retry` and friends, `-s`, `-S`, `-v`, `-#`, and a
+    curl-shaped progress meter that appears only when the body is not being
+    painted on the terminal. curl's exit codes are reproduced, including `22`,
+    `6`, `7`, `28`, `47`, `60`, and `2`.
+  - Short clusters parse the way curl's do, so the invocations packaging
+    scripts use — `-kLO`, `-C - -kLO`, `-fsSL`, `-kfsS`, `-#k` — work
+    unchanged. TLS-material and connection-tuning options (`--cacert`,
+    `--cert`, `--interface`, `--limit-rate`, `-4`, `--http2`, and the rest)
+    are parsed and then ignored so a script does not die on them.
+  - Bodies stream, so `curl -N` on a server-sent-events endpoint prints each
+    chunk as it arrives and a large download never buffers in memory.
+  - `test/reference.test.js` compares the builtin against the system `curl`
+    over a local server: bodies, exit codes, redirect handling, request bodies,
+    and `--write-out` output are byte-for-byte identical, and `-i` matches once
+    header order and casing — which `fetch` does not preserve — are normalised.
+
+- Add a `pspa` PATH-fallback builtin that lists every process as a PID and its
+  full command line, so a device with no process viewer still has one. POSIX
+  runs `ps -eo pid,args` and passes its output through untouched — reading it
+  over a pipe is also what stops procps from cutting long command lines at the
+  terminal width. Windows, which has no `ps`, queries `Win32_Process` through
+  PowerShell and lays the same two columns out itself, using the image name
+  for a system process that reports no command line. It takes no options; pipe
+  it into `grep` to narrow the listing and into `kill` to act on it.
+- Add `pspac`, the same process listing with the PID and the command line
+  coloured. The COMMAND column is a shell command line, so it is highlighted
+  as one, following micro's `syntax/sh.yaml` rules and its
+  `colorschemes/monokai.micro` colour-links — the palette `catfancy` already
+  uses — down to its region handling (a `#` inside a quoted argument does not
+  open a comment) and its rule precedence (`--cat` is a flag, not the
+  coreutils `cat`). Two things a listing needs that a script does not: the
+  directory in front of the program is dimmed, and the program's own name is
+  coloured as a command whether or not sh.yaml's word lists have heard of it.
+  Like `catfancy` it always colours; strip the colour from its output and
+  `pspa`'s is what remains, which is what its tests assert.
+- Add `LICENSE-MICRO` and a "Syntax highlighting" section under the README's
+  licence heading, covering what the colouring inherits from
+  [micro](https://github.com/zyedidia/micro): `pspac` transcribes the rules of
+  its `runtime/syntax/sh.yaml` (MIT "Expat", Copyright (c) 2020: Zachary
+  Yedidia, et al.), and both `pspac` and `catfancy` paint with the
+  colour-links of its `runtime/colorschemes/monokai.micro` (micro itself: MIT,
+  Copyright (c) 2016-2020: Zachary Yedidia, et al.), which renders Wimer
+  Hazenberg's Monokai palette. No micro file is bundled, but the rules are
+  transcribed from one, so the licence notice ships with them.
+
+### Fixed
+
+- Make `kill` work on Windows. It went through the runtime's `process.kill`,
+  which there turns SIGTERM, SIGINT, and SIGKILL into an unconditional
+  `TerminateProcess`, refuses every other signal name outright, and in no case
+  reaches the target's children. A terminating signal is now sent as
+  `taskkill /PID PID /T /F` — the form bun-taskmgr verified on Windows 11 —
+  so every signal name works and a process tree goes down with its root. The
+  name is still not honoured as a signal, because Windows has none to deliver;
+  `-0` continues to probe through the runtime, since `taskkill` has no way to
+  ask whether a PID exists without killing it.
+
 ## [0.2.0] - 2026-08-29
 
 ### Added

package/apps/bunmsh/LICENSE-MICRO

@@ -0,0 +1,58 @@
+Terms and Conditions - micro syntax rules and colour scheme
+===========================================================
+
+bunmsh does not bundle any file from micro, the Go terminal editor at
+https://github.com/zyedidia/micro. What it derives from micro is:
+
+  * The shell-syntax highlighting rules `pspac` applies to the COMMAND column
+    of its process listing. The patterns and word lists of micro's
+    `runtime/syntax/sh.yaml` — keywords, command names, flags, variables,
+    strings, comments — and the order they resolve in were transcribed into
+    `src/shell.js`.
+
+  * The colours those classes are painted in, which are the colour-links of
+    micro's `runtime/colorschemes/monokai.micro`, transcribed into the same
+    file. `src/cat-fancy.js` takes five of the same colour-links for the
+    JSON it colours.
+
+Both come from micro's own tree — `runtime/syntax/sh.yaml` and
+`runtime/colorschemes/monokai.micro` — and that is where to trace this
+licence from: `runtime/syntax/LICENSE` and `LICENSE` in
+https://github.com/zyedidia/micro.
+
+Micro's syntax files are licensed under the MIT "Expat" License:
+
+Copyright (c) 2020: Zachary Yedidia, et al.
+
+Micro itself, which its colour schemes are part of, carries the same licence:
+
+Copyright (c) 2016-2020: Zachary Yedidia, et al.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+Further attribution
+-------------------
+
+micro's `runtime/syntax/README.md` records that its syntax files originate
+from Nano's `nanorc` collection (https://github.com/scopatz/nanorc), converted
+to micro's own format.
+
+The Monokai palette that `monokai.micro` renders was created by Wimer
+Hazenberg.