just-bash 2.11.2 → 2.11.3

package/dist/fs/init.d.ts

@@ -5,8 +5,18 @@
  * including /dev, /proc, and common directories.
  */
 import type { IFileSystem } from "./interface.js";
+/**
+ * Virtual process info for /proc filesystem initialization.
+ */
+interface VirtualProcessInfo {
+    pid: number;
+    ppid: number;
+    uid: number;
+    gid: number;
+}
 /**
  * Initialize the filesystem with standard directories and files
  * Works with both InMemoryFs and OverlayFs (both write to memory)
  */
-export declare function initFilesystem(fs: IFileSystem, useDefaultLayout: boolean): void;
+export declare function initFilesystem(fs: IFileSystem, useDefaultLayout: boolean, processInfo?: VirtualProcessInfo): void;
+export {};

package/dist/fs/overlay-fs/overlay-fs.d.ts

@@ -5,9 +5,10 @@
  * Changes don't persist to disk and can't escape the root directory.
  *
  * Security: Symlinks are blocked by default (allowSymlinks: false).
- * All real-FS access goes through validateRealPath_() / validateRealPathParent_()
- * gates which detect symlink traversal via path comparison. New methods must
- * use these gates — never access the real FS directly.
+ * All real-FS access goes through resolveRealPath_() / resolveRealPathParent_()
+ * gates which detect symlink traversal via path comparison and return the
+ * canonical path for I/O (closing the TOCTOU gap). New methods must use these
+ * gates — never access the real FS directly.
  */
 import { type FileContent } from "../encoding.js";
 import type { CpOptions, DirentEntry, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
@@ -84,16 +85,21 @@ export declare class OverlayFs implements IFileSystem {
     private toRealPath;
     private dirname;
     /**
-     * Validate a real-FS path (follows symlinks).
-     * When !allowSymlinks, also rejects paths that traverse any symlink.
+     * Resolve a real-FS path to its canonical form and validate it stays
+     * within the sandbox.  Returns the canonical path for I/O, or null if
+     * the path escapes the root or traverses a symlink (when !allowSymlinks).
+     *
+     * Callers MUST use the returned canonical path for subsequent I/O to
+     * close the TOCTOU gap between validation and use.
      */
-    private validateRealPath_;
+    private resolveRealPath_;
     /**
-     * Validate only the parent directory of a real-FS path.
-     * Used by lstat/readlink/existsInOverlay where the final component
-     * may itself be a symlink we want to inspect (not follow).
+     * Resolve only the parent directory of a real-FS path, then join with
+     * the original basename.  Used by lstat/readlink/existsInOverlay where
+     * the final component may itself be a symlink we want to inspect (not
+     * follow).  Returns the canonical parent + basename for I/O, or null.
      */
-    private validateRealPathParent_;
+    private resolveRealPathParent_;
     private ensureParentDirs;
     /**
      * Check if a path exists in the overlay (memory + real fs - deleted)

package/dist/interpreter/types.d.ts

@@ -224,6 +224,14 @@ export interface ProcessState {
     bashPid: number;
     /** Counter for generating unique virtual PIDs for subshells */
     nextVirtualPid: number;
+    /** Virtual main shell PID for $$ (default 1, never exposes real process.pid) */
+    virtualPid: number;
+    /** Virtual parent PID for $PPID (default 0, never exposes real process.ppid) */
+    virtualPpid: number;
+    /** Virtual user ID for $UID/$EUID (default 1000, never exposes real UID) */
+    virtualUid: number;
+    /** Virtual group ID (default 1000, never exposes real GID) */
+    virtualGid: number;
 }
 /**
  * Tracks file descriptors and stdin content for I/O operations.

package/dist/shell-metadata.d.ts

@@ -14,15 +14,12 @@ export declare const BASH_VERSION = "5.1.0(1)-release";
  */
 export declare const KERNEL_VERSION = "Linux version 5.15.0-generic (just-bash) #1 SMP PREEMPT";
 /**
- * Get process metadata (values that come from the running Node process)
+ * Format /proc/self/status content using virtual process info.
+ * Never exposes real host process information.
  */
-export declare function getProcessInfo(): {
+export declare function formatProcStatus(info: {
     pid: number;
     ppid: number;
     uid: number;
     gid: number;
-};
-/**
- * Format /proc/self/status content
- */
-export declare function formatProcStatus(): string;
+}): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "just-bash",
-  "version": "2.11.2",
+  "version": "2.11.3",
   "description": "A simulated bash environment with virtual filesystem",
   "repository": {
     "type": "git",