dotdo 0.0.1 → 0.1.0

package/dist/lib/mixins/bash.js

@@ -0,0 +1,753 @@
+/**
+ * withBash Mixin - Shell Execution Capability
+ *
+ * Adds $.bash to the WorkflowContext with shell operations:
+ * - Tagged template execution: $.bash`command`
+ * - exec, run, spawn methods
+ * - parse, analyze, isDangerous utilities
+ *
+ * @example
+ * ```typescript
+ * import { withBash } from 'dotdo/mixins'
+ * import { withFs } from 'dotdo/mixins'
+ * import { DO } from 'dotdo'
+ *
+ * // Basic usage with executor
+ * class MyDO extends withBash(DO, {
+ *   executor: () => ({
+ *     execute: async (cmd, opts) => {
+ *       // Execute via Containers, RPC, etc.
+ *       return await containerExecutor.run(cmd, opts)
+ *     }
+ *   })
+ * }) {
+ *   async deploy() {
+ *     const result = await this.$.bash.exec('npm', ['run', 'build'])
+ *     return result.exitCode === 0
+ *   }
+ * }
+ *
+ * // With FsCapability integration for native file ops
+ * class MyDO extends withBash(withFs(DO), {
+ *   executor: () => containerExecutor,
+ *   fs: (instance) => instance.$.fs  // 'cat' uses $.fs.read() natively
+ * }) {
+ *   async readConfig() {
+ *     // 'cat config.json' uses $.fs.read() - Tier 1, fast!
+ *     const result = await this.$.bash.exec('cat', ['config.json'])
+ *     return result.stdout
+ *   }
+ * }
+ * ```
+ *
+ * @module dotdo/mixins/bash
+ */
+// ============================================================================
+// NATIVE FS COMMANDS
+// ============================================================================
+const NATIVE_FS_COMMANDS = new Set(['cat', 'head', 'tail', 'ls', 'test']);
+// ============================================================================
+// DANGEROUS COMMAND PATTERNS
+// ============================================================================
+/**
+ * Patterns that indicate critically dangerous commands.
+ */
+const DANGEROUS_PATTERNS = [
+    { pattern: /\brm\s+(-[rfvdi]*\s+)*\/($|\s|[^\/])/, reason: 'Dangerous: rm targeting root directory is blocked' },
+    { pattern: /\brm\s+(-[rfvdi]*\s+)*\/\*/, reason: 'Dangerous: rm targeting root directory contents is blocked' },
+    { pattern: /\brm\s+(-[rfvdi]*\s+)*~\//, reason: 'Dangerous: rm targeting home directory is blocked' },
+    { pattern: /\bchmod\s+[0-7]{3,4}\s+\/($|\s)/, reason: 'Dangerous: chmod on root directory is blocked' },
+    { pattern: /\bchmod\s+-[rR]\s+[0-7]{3,4}\s+\//, reason: 'Dangerous: recursive chmod on root is blocked' },
+    { pattern: /\bdd\s+.*\bof=\/dev\/[hs]d[a-z]/, reason: 'Dangerous: dd writing to disk device is blocked' },
+    { pattern: /\bmkfs\b/, reason: 'Dangerous: filesystem formatting command is blocked' },
+    { pattern: /\bshutdown\b/, reason: 'Dangerous: system shutdown command is blocked' },
+    { pattern: /\breboot\b/, reason: 'Dangerous: system reboot command is blocked' },
+    { pattern: /:\(\)\s*\{\s*:\|\:&\s*\}\s*;\s*:/, reason: 'Dangerous: fork bomb is blocked' },
+    { pattern: /\bsudo\b.*\brm\s+-rf\s+\//, reason: 'Dangerous: sudo rm -rf / is blocked' },
+];
+/**
+ * Commands that require network access.
+ */
+const NETWORK_COMMANDS = new Set([
+    'curl', 'wget', 'ssh', 'scp', 'rsync', 'nc', 'netcat', 'telnet', 'ftp', 'sftp',
+    'git push', 'git pull', 'git fetch', 'git clone', 'npm publish', 'pip upload',
+]);
+/**
+ * Commands that indicate elevated privileges.
+ */
+const ELEVATED_COMMANDS = new Set(['sudo', 'doas', 'su', 'pkexec']);
+// ============================================================================
+// SHELL ESCAPING
+// ============================================================================
+function escapeForShell(value) {
+    const str = String(value);
+    if (str === '') {
+        return "''";
+    }
+    if (/^[a-zA-Z0-9_\-./:=@]+$/.test(str)) {
+        return str;
+    }
+    return "'" + str.replace(/'/g, "'\"'\"'") + "'";
+}
+function buildEscapedCommand(strings, values) {
+    return strings.reduce((acc, str, i) => acc + str + (values[i] !== undefined ? escapeForShell(values[i]) : ''), '');
+}
+// ============================================================================
+// LOCAL PARSING & ANALYSIS
+// ============================================================================
+/**
+ * Simple parser for bash commands (returns basic AST structure).
+ */
+function parse(input) {
+    // Extract command parts
+    const trimmed = input.trim();
+    const commands = [];
+    // Split on pipes and operators
+    const parts = trimmed.split(/\s*(\||&&|\|\||;)\s*/);
+    for (const part of parts) {
+        const cmd = part.trim().split(/\s+/)[0];
+        if (cmd && !['|', '&&', '||', ';'].includes(cmd)) {
+            commands.push(cmd);
+        }
+    }
+    return {
+        type: 'Program',
+        body: [{
+                type: 'Command',
+                name: commands[0] || '',
+                commands,
+                raw: trimmed,
+            }],
+    };
+}
+/**
+ * Analyze a command for safety classification.
+ */
+function analyze(ast) {
+    const raw = ast.body[0]?.raw || '';
+    const commands = ast.body[0]?.commands || [];
+    // Determine type
+    let type = 'read';
+    let impact = 'none';
+    let reversible = true;
+    let reason = 'Command analyzed';
+    // Extract info for intent
+    const reads = [];
+    const writes = [];
+    const deletes = [];
+    let network = false;
+    let elevated = false;
+    // Check for elevated commands
+    for (const cmd of commands) {
+        if (ELEVATED_COMMANDS.has(cmd)) {
+            elevated = true;
+        }
+    }
+    // Check for network commands
+    for (const cmd of commands) {
+        if (NETWORK_COMMANDS.has(cmd)) {
+            network = true;
+            type = 'network';
+        }
+    }
+    // Check for specific command types
+    const firstCmd = commands[0]?.toLowerCase() || '';
+    if (['ls', 'cat', 'head', 'tail', 'less', 'more', 'find', 'grep', 'wc', 'pwd', 'echo', 'date', 'whoami', 'id', 'env', 'printenv'].includes(firstCmd)) {
+        type = 'read';
+        impact = 'none';
+        reason = 'Read-only command';
+        // Extract read paths from arguments
+        const match = raw.match(/\s+([\/~][\w\/.-]+)/g);
+        if (match) {
+            reads.push(...match.map(m => m.trim()));
+        }
+    }
+    else if (['rm', 'rmdir', 'unlink'].includes(firstCmd)) {
+        type = 'delete';
+        reversible = false;
+        reason = 'Delete operation';
+        // Check for recursive flag
+        if (raw.includes('-r') || raw.includes('-R') || raw.includes('-rf') || raw.includes('-fr')) {
+            impact = 'high';
+            reason = 'Recursive delete operation';
+        }
+        else {
+            impact = 'medium';
+        }
+        // Check for root path
+        if (/\s+\/($|\s)/.test(raw) || raw.includes('/*')) {
+            impact = 'critical';
+            reason = 'Delete targeting root or all files';
+        }
+        // Extract delete paths
+        const pathMatch = raw.match(/\s+([\/~\w][\w\/.-]*)/g);
+        if (pathMatch) {
+            deletes.push(...pathMatch.map(m => m.trim()).filter(p => !p.startsWith('-')));
+        }
+    }
+    else if (['mv', 'cp', 'touch', 'mkdir', 'tee'].includes(firstCmd)) {
+        type = 'write';
+        impact = 'low';
+        reversible = true;
+        reason = 'Write operation';
+        // Extract write paths
+        const pathMatch = raw.match(/\s+([\/~\w][\w\/.-]*)/g);
+        if (pathMatch) {
+            const paths = pathMatch.map(m => m.trim()).filter(p => !p.startsWith('-'));
+            if (firstCmd === 'mv' || firstCmd === 'cp') {
+                // Last path is destination
+                if (paths.length >= 2) {
+                    reads.push(...paths.slice(0, -1));
+                    writes.push(paths[paths.length - 1]);
+                }
+            }
+            else {
+                writes.push(...paths);
+            }
+        }
+    }
+    else if (['chmod', 'chown', 'chgrp'].includes(firstCmd)) {
+        type = 'system';
+        impact = 'medium';
+        reversible = true;
+        reason = 'Permission/ownership change';
+        if (raw.includes('-R') || raw.includes('-r')) {
+            impact = 'high';
+            reason = 'Recursive permission change';
+        }
+        if (/\s+\/($|\s)/.test(raw)) {
+            impact = 'critical';
+            reason = 'Permission change on root directory';
+        }
+    }
+    else if (['curl', 'wget', 'ssh', 'scp', 'rsync'].includes(firstCmd)) {
+        type = 'network';
+        network = true;
+        impact = 'low';
+        reversible = true;
+        reason = 'Network operation';
+        if (raw.includes('-X POST') || raw.includes('--data') || raw.includes('-d ')) {
+            impact = 'medium';
+            reason = 'Network request with data';
+        }
+    }
+    else if (['git'].includes(firstCmd)) {
+        if (raw.includes('push')) {
+            type = 'network';
+            network = true;
+            impact = 'medium';
+            reason = 'Git push operation';
+        }
+        else if (raw.includes('pull') || raw.includes('fetch') || raw.includes('clone')) {
+            type = 'network';
+            network = true;
+            impact = 'low';
+            reason = 'Git network operation';
+        }
+        else {
+            type = 'read';
+            impact = 'none';
+            reason = 'Git local operation';
+        }
+    }
+    else if (['npm', 'yarn', 'pnpm'].includes(firstCmd)) {
+        if (raw.includes('install') || raw.includes('add')) {
+            type = 'write';
+            impact = 'low';
+            reason = 'Package installation';
+        }
+        else if (raw.includes('publish')) {
+            type = 'network';
+            network = true;
+            impact = 'high';
+            reason = 'Package publish operation';
+        }
+        else {
+            type = 'execute';
+            impact = 'low';
+            reason = 'Package manager operation';
+        }
+    }
+    else if (['dd', 'mkfs', 'fdisk', 'parted'].includes(firstCmd)) {
+        type = 'system';
+        impact = 'critical';
+        reversible = false;
+        reason = 'Low-level disk operation';
+    }
+    else if (['shutdown', 'reboot', 'halt', 'poweroff'].includes(firstCmd)) {
+        type = 'system';
+        impact = 'critical';
+        reversible = false;
+        reason = 'System shutdown/reboot';
+    }
+    else if (elevated) {
+        type = 'system';
+        impact = 'high';
+        reason = 'Elevated privilege command';
+    }
+    // Check for dangerous patterns (strip quoted content first to avoid false positives)
+    const unquotedForPatterns = stripQuotedContent(raw);
+    for (const { pattern, reason: dangerReason } of DANGEROUS_PATTERNS) {
+        if (pattern.test(unquotedForPatterns)) {
+            impact = 'critical';
+            reason = dangerReason;
+            reversible = false;
+            break;
+        }
+    }
+    return {
+        classification: { type, impact, reversible, reason },
+        intent: { commands, reads, writes, deletes, network, elevated },
+    };
+}
+/**
+ * Strip quoted content from a command for safety analysis.
+ * This removes content within single/double quotes to avoid false positives
+ * when dangerous patterns appear as literal strings (e.g., echo '; rm -rf /').
+ */
+function stripQuotedContent(cmd) {
+    // Replace single-quoted strings with placeholder
+    let result = cmd.replace(/'[^']*'/g, "'QUOTED'");
+    // Replace double-quoted strings with placeholder
+    result = result.replace(/"[^"]*"/g, '"QUOTED"');
+    return result;
+}
+/**
+ * Check if a command is dangerous.
+ */
+function isDangerous(ast) {
+    const raw = ast.body[0]?.raw || '';
+    // Strip quoted content before checking patterns
+    // This prevents false positives when dangerous patterns appear as arguments
+    const unquoted = stripQuotedContent(raw);
+    for (const { pattern, reason } of DANGEROUS_PATTERNS) {
+        if (pattern.test(unquoted)) {
+            return { dangerous: true, reason };
+        }
+    }
+    const analysis = analyze(ast);
+    if (analysis.classification.impact === 'critical') {
+        return { dangerous: true, reason: analysis.classification.reason };
+    }
+    return { dangerous: false };
+}
+// ============================================================================
+// BASH CAPABILITY IMPLEMENTATION
+// ============================================================================
+function createBashCapability(executor, fsCapability, useNativeOps = true) {
+    function performSafetyAnalysis(command, options) {
+        const ast = parse(command);
+        const { classification, intent } = analyze(ast);
+        const dangerCheck = isDangerous(ast);
+        const requiresConfirm = classification.impact === 'critical' || classification.impact === 'high';
+        if (requiresConfirm && !options?.confirm) {
+            return createBlockedResult(command, classification, intent, dangerCheck.reason);
+        }
+        return null;
+    }
+    function createBlockedResult(command, classification, intent, reason) {
+        const blockReason = reason || classification.reason || 'Command blocked due to safety concerns';
+        return {
+            input: command,
+            command,
+            valid: true,
+            generated: false,
+            stdout: '',
+            stderr: '',
+            exitCode: 0,
+            intent,
+            classification,
+            blocked: true,
+            requiresConfirm: true,
+            blockReason,
+        };
+    }
+    function createNativeResult(command, stdout, stderr = '', exitCode = 0) {
+        return {
+            input: command,
+            command,
+            valid: true,
+            generated: false,
+            stdout,
+            stderr,
+            exitCode,
+            intent: {
+                commands: [command.split(' ')[0]],
+                reads: [],
+                writes: [],
+                deletes: [],
+                network: false,
+                elevated: false,
+            },
+            classification: {
+                type: 'read',
+                impact: 'none',
+                reversible: true,
+                reason: 'Native filesystem operation',
+            },
+        };
+    }
+    async function nativeCat(args) {
+        if (!fsCapability || args.length === 0)
+            return null;
+        const files = args.filter((arg) => !arg.startsWith('-'));
+        if (files.length === 0)
+            return null;
+        try {
+            const contents = await Promise.all(files.map((file) => fsCapability.read(file)));
+            const stdout = contents.join('');
+            return createNativeResult(`cat ${args.join(' ')}`, stdout);
+        }
+        catch (error) {
+            const stderr = error instanceof Error ? error.message : String(error);
+            return createNativeResult(`cat ${args.join(' ')}`, '', stderr, 1);
+        }
+    }
+    async function nativeLs(args) {
+        if (!fsCapability)
+            return null;
+        const paths = args.filter((arg) => !arg.startsWith('-'));
+        const path = paths[0] || '.';
+        try {
+            const entries = await fsCapability.list(path);
+            const stdout = entries
+                .map((e) => (e.isDirectory ? `${e.name}/` : e.name))
+                .join('\n') + '\n';
+            return createNativeResult(`ls ${args.join(' ')}`, stdout);
+        }
+        catch (error) {
+            const stderr = error instanceof Error ? error.message : String(error);
+            return createNativeResult(`ls ${args.join(' ')}`, '', stderr, 1);
+        }
+    }
+    async function nativeHead(args) {
+        if (!fsCapability)
+            return null;
+        let lines = 10;
+        let file;
+        for (let i = 0; i < args.length; i++) {
+            if (args[i] === '-n' && args[i + 1]) {
+                lines = parseInt(args[i + 1], 10);
+                i++;
+            }
+            else if (/^-\d+$/.test(args[i])) {
+                lines = parseInt(args[i].slice(1), 10);
+            }
+            else if (!args[i].startsWith('-')) {
+                file = args[i];
+            }
+        }
+        if (!file)
+            return null;
+        try {
+            const content = await fsCapability.read(file);
+            const allLines = content.split('\n');
+            const stdout = allLines.slice(0, lines).join('\n');
+            return createNativeResult(`head ${args.join(' ')}`, stdout);
+        }
+        catch (error) {
+            const stderr = error instanceof Error ? error.message : String(error);
+            return createNativeResult(`head ${args.join(' ')}`, '', stderr, 1);
+        }
+    }
+    async function nativeTail(args) {
+        if (!fsCapability)
+            return null;
+        let lines = 10;
+        let file;
+        for (let i = 0; i < args.length; i++) {
+            if (args[i] === '-n' && args[i + 1]) {
+                lines = parseInt(args[i + 1], 10);
+                i++;
+            }
+            else if (/^-\d+$/.test(args[i])) {
+                lines = parseInt(args[i].slice(1), 10);
+            }
+            else if (!args[i].startsWith('-')) {
+                file = args[i];
+            }
+        }
+        if (!file)
+            return null;
+        try {
+            const content = await fsCapability.read(file);
+            const allLines = content.split('\n');
+            const effectiveLines = allLines[allLines.length - 1] === '' ? allLines.slice(0, -1) : allLines;
+            const stdout = effectiveLines.slice(-lines).join('\n') + '\n';
+            return createNativeResult(`tail ${args.join(' ')}`, stdout);
+        }
+        catch (error) {
+            const stderr = error instanceof Error ? error.message : String(error);
+            return createNativeResult(`tail ${args.join(' ')}`, '', stderr, 1);
+        }
+    }
+    async function tryNativeExec(command, args) {
+        if (!fsCapability || !useNativeOps)
+            return null;
+        switch (command) {
+            case 'cat':
+                return nativeCat(args);
+            case 'ls':
+                return nativeLs(args);
+            case 'head':
+                return nativeHead(args);
+            case 'tail':
+                return nativeTail(args);
+            default:
+                return null;
+        }
+    }
+    async function exec(command, args, options) {
+        const fullCommand = args && args.length > 0 ? `${command} ${args.join(' ')}` : command;
+        if (options?.dryRun) {
+            const ast = parse(fullCommand);
+            const { classification, intent } = analyze(ast);
+            return {
+                input: fullCommand,
+                command: fullCommand,
+                valid: true,
+                generated: false,
+                stdout: `[DRY RUN] Would execute: ${fullCommand}`,
+                stderr: '',
+                exitCode: 0,
+                intent,
+                classification,
+            };
+        }
+        const safetyResult = performSafetyAnalysis(fullCommand, options);
+        if (safetyResult) {
+            return safetyResult;
+        }
+        const ast = parse(fullCommand);
+        const { classification, intent } = analyze(ast);
+        if (useNativeOps && fsCapability && NATIVE_FS_COMMANDS.has(command)) {
+            const nativeResult = await tryNativeExec(command, args || []);
+            if (nativeResult) {
+                return nativeResult;
+            }
+        }
+        const result = await executor.execute(fullCommand, options);
+        // Always use our local analysis, overriding the executor's default classification
+        // This ensures consistent behavior regardless of the executor implementation
+        result.classification = classification;
+        result.intent = intent;
+        return result;
+    }
+    async function spawn(command, args, options) {
+        if (!executor.spawn) {
+            throw new Error('Spawn not supported by this executor');
+        }
+        return executor.spawn(command, args, options);
+    }
+    async function run(script, options) {
+        const safetyResult = performSafetyAnalysis(script, options);
+        if (safetyResult) {
+            throw new Error(safetyResult.blockReason || 'Command blocked due to safety concerns');
+        }
+        const result = await executor.execute(script, options);
+        if (result.exitCode !== 0) {
+            throw new Error(result.stderr || `Command failed with exit code ${result.exitCode}`);
+        }
+        return result;
+    }
+    function bashParse(input) {
+        return parse(input);
+    }
+    function bashAnalyze(input) {
+        const ast = parse(input);
+        return analyze(ast);
+    }
+    function bashIsDangerous(input) {
+        const ast = parse(input);
+        return isDangerous(ast);
+    }
+    /**
+     * Handle output redirection natively using fs capability.
+     * Matches patterns like: echo "content" > /path/to/file
+     * Returns null if no redirection or fs not available.
+     */
+    async function handleNativeRedirection(command) {
+        if (!fsCapability || !useNativeOps)
+            return null;
+        // Match echo "content" > /path or echo 'content' > /path
+        const redirectMatch = command.match(/^echo\s+["'](.*)["']\s*>\s*(.+)$/);
+        if (redirectMatch) {
+            const content = redirectMatch[1];
+            const filePath = redirectMatch[2].trim();
+            try {
+                await fsCapability.write(filePath, content);
+                return {
+                    input: command,
+                    command,
+                    valid: true,
+                    generated: false,
+                    stdout: '',
+                    stderr: '',
+                    exitCode: 0,
+                    intent: {
+                        commands: ['echo'],
+                        reads: [],
+                        writes: [filePath],
+                        deletes: [],
+                        network: false,
+                        elevated: false,
+                    },
+                    classification: {
+                        type: 'write',
+                        impact: 'low',
+                        reversible: true,
+                        reason: 'Native filesystem write via redirection',
+                    },
+                };
+            }
+            catch (error) {
+                const stderr = error instanceof Error ? error.message : String(error);
+                return {
+                    input: command,
+                    command,
+                    valid: true,
+                    generated: false,
+                    stdout: '',
+                    stderr,
+                    exitCode: 1,
+                    intent: {
+                        commands: ['echo'],
+                        reads: [],
+                        writes: [filePath],
+                        deletes: [],
+                        network: false,
+                        elevated: false,
+                    },
+                    classification: {
+                        type: 'write',
+                        impact: 'low',
+                        reversible: true,
+                        reason: 'Native filesystem write failed',
+                    },
+                };
+            }
+        }
+        return null;
+    }
+    const taggedTemplate = async function (strings, ...values) {
+        const command = buildEscapedCommand(strings, values);
+        const ast = parse(command);
+        const dangerCheck = isDangerous(ast);
+        const { classification, intent } = analyze(ast);
+        if (dangerCheck.dangerous) {
+            throw new Error(dangerCheck.reason || 'Dangerous command blocked');
+        }
+        if (classification.impact === 'critical' || classification.impact === 'high') {
+            throw new Error(classification.reason || 'Critical/high impact command blocked');
+        }
+        // Try native redirection handling first
+        const nativeRedirectResult = await handleNativeRedirection(command);
+        if (nativeRedirectResult) {
+            return nativeRedirectResult;
+        }
+        // Pass empty object when no options to satisfy expect.anything() in tests
+        const result = await executor.execute(command, {});
+        // Always use our local analysis for consistency
+        result.classification = classification;
+        result.intent = intent;
+        return result;
+    };
+    const capability = taggedTemplate;
+    capability.exec = exec;
+    capability.spawn = spawn;
+    capability.run = run;
+    capability.parse = bashParse;
+    capability.analyze = bashAnalyze;
+    capability.isDangerous = bashIsDangerous;
+    return capability;
+}
+// ============================================================================
+// MIXIN IMPLEMENTATION
+// ============================================================================
+const BASH_CAPABILITY_CACHE = Symbol('bashCapabilityCache');
+export function withBash(Base, config) {
+    return class WithBash extends Base {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        static capabilities = [...(Base.capabilities || []), 'bash'];
+        hasCapability(name) {
+            if (name === 'bash')
+                return true;
+            const baseProto = Base.prototype;
+            if (baseProto && typeof baseProto.hasCapability === 'function') {
+                return baseProto.hasCapability.call(this, name);
+            }
+            return false;
+        }
+        [BASH_CAPABILITY_CACHE];
+        get bashCapability() {
+            if (!this[BASH_CAPABILITY_CACHE]) {
+                const executor = config.executor(this);
+                const fs = config.fs?.(this);
+                this[BASH_CAPABILITY_CACHE] = createBashCapability(executor, fs, config.useNativeOps ?? true);
+            }
+            return this[BASH_CAPABILITY_CACHE];
+        }
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        constructor(...args) {
+            super(...args);
+            if (config.requireFs) {
+                const hasFs = Base.capabilities?.includes('fs') ||
+                    this.hasCapability?.('fs');
+                if (!hasFs) {
+                    throw new Error('withBash requires withFs capability when requireFs is true. Apply withFs(Base) first.');
+                }
+            }
+            const originalContext = this.$;
+            const self = this;
+            this.$ = new Proxy(originalContext, {
+                get(target, prop) {
+                    if (prop === 'bash') {
+                        return self.bashCapability;
+                    }
+                    const value = target[prop];
+                    if (typeof value === 'function') {
+                        // Only bind if it has a bind method (not a Proxy or capability object)
+                        if (typeof value.bind === 'function') {
+                            // Don't bind capability functions that have custom properties
+                            const customProps = Object.getOwnPropertyNames(value).filter((p) => p !== 'length' && p !== 'name' && p !== 'prototype');
+                            if (customProps.length > 0) {
+                                return value;
+                            }
+                            return value.bind(target);
+                        }
+                    }
+                    return value;
+                },
+            });
+        }
+    };
+}
+// ============================================================================
+// LEGACY EXPORTS (for backward compatibility)
+// ============================================================================
+/** @deprecated Use createBashCapability instead */
+export class BashModule {
+    capability;
+    constructor(executor, options) {
+        this.capability = createBashCapability(executor, options?.fs, options?.useNativeOps ?? true);
+    }
+    async exec(command, args, options) {
+        return this.capability.exec(command, args, options);
+    }
+    async spawn(command, args, options) {
+        return this.capability.spawn(command, args, options);
+    }
+    async run(script, options) {
+        return this.capability.run(script, options);
+    }
+    parse(input) {
+        return this.capability.parse(input);
+    }
+    analyze(input) {
+        return this.capability.analyze(input);
+    }
+    isDangerous(input) {
+        return this.capability.isDangerous(input);
+    }
+}
+//# sourceMappingURL=bash.js.map