just-bash 2.12.3 → 2.12.5

package/dist/bin/chunks/jq-F7FJ46VM.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-LWKIHJ5L.js";import"./chunk-W752QGNZ.js";import"./chunk-UYBH3FNE.js";import"./chunk-4PRVMER6.js";import"./chunk-ZRRNCS7N.js";import"./chunk-Q5MYEU7X.js";import"./chunk-SE4C7FJY.js";import"./chunk-5WFYIUU2.js";import"./chunk-6KZRLMG3.js";import"./chunk-OBH7XN5N.js";import"./chunk-SYG3IW7P.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as jqCommand};

package/dist/bin/chunks/ln-VAOSD4HK.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-YX7OOTPO.js";import"./chunk-SYG3IW7P.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as lnCommand};

package/dist/bin/chunks/mkdir-CH7JGW4N.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-OQV5J23L.js";import"./chunk-SYG3IW7P.js";import"./chunk-JBABAK44.js";import"./chunk-4VDEBYW7.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as mkdirCommand};

package/dist/bin/chunks/python3-QBGIYRFR.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import"./chunk-MY5PY2PL.js";import{a as M,b as c}from"./chunk-QZNF3Y3J.js";import{a as P,b as U}from"./chunk-UT6LUTWP.js";import{a as k}from"./chunk-4PRVMER6.js";import{c as F}from"./chunk-ZRRNCS7N.js";import{b as I}from"./chunk-Q5MYEU7X.js";import{a as l}from"./chunk-SYG3IW7P.js";import{a as L,b as N}from"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";import{fileURLToPath as H}from"node:url";import{Worker as W}from"node:worker_threads";var u={NOOP:0,READ_FILE:1,WRITE_FILE:2,STAT:3,READDIR:4,MKDIR:5,RM:6,EXISTS:7,APPEND_FILE:8,SYMLINK:9,READLINK:10,LSTAT:11,CHMOD:12,REALPATH:13,WRITE_STDOUT:100,WRITE_STDERR:101,EXIT:102,HTTP_REQUEST:200},a={PENDING:0,READY:1,SUCCESS:2,ERROR:3},E={NONE:0,NOT_FOUND:1,IS_DIRECTORY:2,NOT_DIRECTORY:3,EXISTS:4,PERMISSION_DENIED:5,INVALID_PATH:6,IO_ERROR:7,TIMEOUT:8,NETWORK_ERROR:9,NETWORK_NOT_CONFIGURED:10},i={OP_CODE:0,STATUS:4,PATH_LENGTH:8,DATA_LENGTH:12,RESULT_LENGTH:16,ERROR_CODE:20,FLAGS:24,MODE:28,PATH_BUFFER:32,DATA_BUFFER:4128},w={CONTROL_REGION:32,PATH_BUFFER:4096,DATA_BUFFER:1048576,TOTAL:1052704},y={NONE:0,RECURSIVE:1,FORCE:2,MKDIR_RECURSIVE:1},p={IS_FILE:0,IS_DIRECTORY:1,IS_SYMLINK:2,MODE:4,SIZE:8,MTIME:16,TOTAL:24};function V(){return new M(w.TOTAL)}var A=class{int32View;uint8View;dataView;constructor(t){this.int32View=new Int32Array(t),this.uint8View=new Uint8Array(t),this.dataView=new DataView(t)}getOpCode(){return c.load(this.int32View,i.OP_CODE/4)}setOpCode(t){c.store(this.int32View,i.OP_CODE/4,t)}getStatus(){return c.load(this.int32View,i.STATUS/4)}setStatus(t){c.store(this.int32View,i.STATUS/4,t)}getPathLength(){return c.load(this.int32View,i.PATH_LENGTH/4)}setPathLength(t){c.store(this.int32View,i.PATH_LENGTH/4,t)}getDataLength(){return c.load(this.int32View,i.DATA_LENGTH/4)}setDataLength(t){c.store(this.int32View,i.DATA_LENGTH/4,t)}getResultLength(){return c.load(this.int32View,i.RESULT_LENGTH/4)}setResultLength(t){c.store(this.int32View,i.RESULT_LENGTH/4,t)}getErrorCode(){return c.load(this.int32View,i.ERROR_CODE/4)}setErrorCode(t){c.store(this.int32View,i.ERROR_CODE/4,t)}getFlags(){return c.load(this.int32View,i.FLAGS/4)}setFlags(t){c.store(this.int32View,i.FLAGS/4,t)}getMode(){return c.load(this.int32View,i.MODE/4)}setMode(t){c.store(this.int32View,i.MODE/4,t)}getPath(){let t=this.getPathLength(),e=this.uint8View.slice(i.PATH_BUFFER,i.PATH_BUFFER+t);return new TextDecoder().decode(e)}setPath(t){let e=new TextEncoder().encode(t);if(e.length>w.PATH_BUFFER)throw new Error(`Path too long: ${e.length} > ${w.PATH_BUFFER}`);this.uint8View.set(e,i.PATH_BUFFER),this.setPathLength(e.length)}getData(){let t=this.getDataLength();return this.uint8View.slice(i.DATA_BUFFER,i.DATA_BUFFER+t)}setData(t){if(t.length>w.DATA_BUFFER)throw new Error(`Data too large: ${t.length} > ${w.DATA_BUFFER}`);this.uint8View.set(t,i.DATA_BUFFER),this.setDataLength(t.length)}getDataAsString(){let t=this.getData();return new TextDecoder().decode(t)}setDataFromString(t){let e=new TextEncoder().encode(t);this.setData(e)}getResult(){let t=this.getResultLength();return this.uint8View.slice(i.DATA_BUFFER,i.DATA_BUFFER+t)}setResult(t){if(t.length>w.DATA_BUFFER)throw new Error(`Result too large: ${t.length} > ${w.DATA_BUFFER}`);this.uint8View.set(t,i.DATA_BUFFER),this.setResultLength(t.length)}getResultAsString(){let t=this.getResult();return new TextDecoder().decode(t)}setResultFromString(t){let e=new TextEncoder().encode(t);this.setResult(e)}encodeStat(t){this.uint8View[i.DATA_BUFFER+p.IS_FILE]=t.isFile?1:0,this.uint8View[i.DATA_BUFFER+p.IS_DIRECTORY]=t.isDirectory?1:0,this.uint8View[i.DATA_BUFFER+p.IS_SYMLINK]=t.isSymbolicLink?1:0,this.dataView.setInt32(i.DATA_BUFFER+p.MODE,t.mode,!0);let e=Math.min(t.size,Number.MAX_SAFE_INTEGER);this.dataView.setFloat64(i.DATA_BUFFER+p.SIZE,e,!0),this.dataView.setFloat64(i.DATA_BUFFER+p.MTIME,t.mtime.getTime(),!0),this.setResultLength(p.TOTAL)}decodeStat(){return{isFile:this.uint8View[i.DATA_BUFFER+p.IS_FILE]===1,isDirectory:this.uint8View[i.DATA_BUFFER+p.IS_DIRECTORY]===1,isSymbolicLink:this.uint8View[i.DATA_BUFFER+p.IS_SYMLINK]===1,mode:this.dataView.getInt32(i.DATA_BUFFER+p.MODE,!0),size:this.dataView.getFloat64(i.DATA_BUFFER+p.SIZE,!0),mtime:new Date(this.dataView.getFloat64(i.DATA_BUFFER+p.MTIME,!0))}}waitForReady(t){return c.wait(this.int32View,i.STATUS/4,a.PENDING,t)}waitForReadyAsync(t){return c.waitAsync(this.int32View,i.STATUS/4,a.PENDING,t)}async waitUntilReady(t){let e=Date.now();for(;;){let s=this.getStatus();if(s===a.READY)return!0;let r=Date.now()-e;if(r>=t)return!1;let n=t-r,m=c.waitAsync(this.int32View,i.STATUS/4,s,n);if(m.async&&await m.value==="timed-out")return!1}}waitForResult(t){return c.wait(this.int32View,i.STATUS/4,a.READY,t)}notify(){return c.notify(this.int32View,i.STATUS/4)}reset(){this.setOpCode(u.NOOP),this.setStatus(a.PENDING),this.setPathLength(0),this.setDataLength(0),this.setResultLength(0),this.setErrorCode(E.NONE),this.setFlags(y.NONE),this.setMode(0)}};var D=class{fs;cwd;secureFetch;maxOutputSize;protocol;running=!1;output={stdout:"",stderr:"",exitCode:0};outputLimitExceeded=!1;constructor(t,e,s,r=void 0,n=0){this.fs=e,this.cwd=s,this.secureFetch=r,this.maxOutputSize=n,this.protocol=new A(t)}async run(t){this.running=!0;let e=Date.now();for(;this.running;){let s=Date.now()-e;if(s>=t){this.output.stderr+=`
+python3: execution timeout exceeded
+`,this.output.exitCode=124;break}let r=t-s;if(!await this.protocol.waitUntilReady(r)){this.output.stderr+=`
+python3: execution timeout exceeded
+`,this.output.exitCode=124;break}let m=this.protocol.getOpCode();await this.handleOperation(m),this.protocol.notify()}return this.output}stop(){this.running=!1}async handleOperation(t){try{switch(t){case u.READ_FILE:await this.handleReadFile();break;case u.WRITE_FILE:await this.handleWriteFile();break;case u.STAT:await this.handleStat();break;case u.LSTAT:await this.handleLstat();break;case u.READDIR:await this.handleReaddir();break;case u.MKDIR:await this.handleMkdir();break;case u.RM:await this.handleRm();break;case u.EXISTS:await this.handleExists();break;case u.APPEND_FILE:await this.handleAppendFile();break;case u.SYMLINK:await this.handleSymlink();break;case u.READLINK:await this.handleReadlink();break;case u.CHMOD:await this.handleChmod();break;case u.REALPATH:await this.handleRealpath();break;case u.WRITE_STDOUT:this.handleWriteStdout();break;case u.WRITE_STDERR:this.handleWriteStderr();break;case u.EXIT:this.handleExit();break;case u.HTTP_REQUEST:await this.handleHttpRequest();break;default:this.protocol.setErrorCode(E.IO_ERROR),this.protocol.setStatus(a.ERROR)}}catch(e){this.setErrorFromException(e)}}resolvePath(t){return this.fs.resolvePath(this.cwd,t)}async handleReadFile(){let t=this.resolvePath(this.protocol.getPath());try{let e=await this.fs.readFileBuffer(t);this.protocol.setResult(e),this.protocol.setStatus(a.SUCCESS)}catch(e){this.setErrorFromException(e)}}async handleWriteFile(){let t=this.resolvePath(this.protocol.getPath()),e=this.protocol.getData();try{await this.fs.writeFile(t,e),this.protocol.setStatus(a.SUCCESS)}catch(s){this.setErrorFromException(s)}}async handleStat(){let t=this.resolvePath(this.protocol.getPath());try{let e=await this.fs.stat(t);this.protocol.encodeStat(e),this.protocol.setStatus(a.SUCCESS)}catch(e){this.setErrorFromException(e)}}async handleLstat(){let t=this.resolvePath(this.protocol.getPath());try{let e=await this.fs.lstat(t);this.protocol.encodeStat(e),this.protocol.setStatus(a.SUCCESS)}catch(e){this.setErrorFromException(e)}}async handleReaddir(){let t=this.resolvePath(this.protocol.getPath());try{let e=await this.fs.readdir(t);this.protocol.setResultFromString(JSON.stringify(e)),this.protocol.setStatus(a.SUCCESS)}catch(e){this.setErrorFromException(e)}}async handleMkdir(){let t=this.resolvePath(this.protocol.getPath()),s=(this.protocol.getFlags()&y.MKDIR_RECURSIVE)!==0;try{await this.fs.mkdir(t,{recursive:s}),this.protocol.setStatus(a.SUCCESS)}catch(r){this.setErrorFromException(r)}}async handleRm(){let t=this.resolvePath(this.protocol.getPath()),e=this.protocol.getFlags(),s=(e&y.RECURSIVE)!==0,r=(e&y.FORCE)!==0;try{await this.fs.rm(t,{recursive:s,force:r}),this.protocol.setStatus(a.SUCCESS)}catch(n){this.setErrorFromException(n)}}async handleExists(){let t=this.resolvePath(this.protocol.getPath());try{let e=await this.fs.exists(t);this.protocol.setResult(new Uint8Array([e?1:0])),this.protocol.setStatus(a.SUCCESS)}catch(e){this.setErrorFromException(e)}}async handleAppendFile(){let t=this.resolvePath(this.protocol.getPath()),e=this.protocol.getData();try{await this.fs.appendFile(t,e),this.protocol.setStatus(a.SUCCESS)}catch(s){this.setErrorFromException(s)}}async handleSymlink(){let t=this.protocol.getPath(),e=this.protocol.getDataAsString(),s=this.resolvePath(t);try{await this.fs.symlink(e,s),this.protocol.setStatus(a.SUCCESS)}catch(r){this.setErrorFromException(r)}}async handleReadlink(){let t=this.resolvePath(this.protocol.getPath());try{let e=await this.fs.readlink(t);this.protocol.setResultFromString(e),this.protocol.setStatus(a.SUCCESS)}catch(e){this.setErrorFromException(e)}}async handleChmod(){let t=this.resolvePath(this.protocol.getPath()),e=this.protocol.getMode();try{await this.fs.chmod(t,e),this.protocol.setStatus(a.SUCCESS)}catch(s){this.setErrorFromException(s)}}async handleRealpath(){let t=this.resolvePath(this.protocol.getPath());try{let e=await this.fs.realpath(t);this.protocol.setResultFromString(e),this.protocol.setStatus(a.SUCCESS)}catch(e){this.setErrorFromException(e)}}handleWriteStdout(){let t=this.protocol.getDataAsString();if(!this.tryAppendOutput("stdout",t)){this.outputLimitExceeded=!0,this.output.exitCode=1,this.appendOutputLimitError(),this.protocol.setErrorCode(E.IO_ERROR),this.protocol.setResultFromString("Output size limit exceeded"),this.protocol.setStatus(a.ERROR);return}this.protocol.setStatus(a.SUCCESS)}handleWriteStderr(){let t=this.protocol.getDataAsString();if(!this.tryAppendOutput("stderr",t)){this.outputLimitExceeded=!0,this.output.exitCode=1,this.appendOutputLimitError(),this.protocol.setErrorCode(E.IO_ERROR),this.protocol.setResultFromString("Output size limit exceeded"),this.protocol.setStatus(a.ERROR);return}this.protocol.setStatus(a.SUCCESS)}handleExit(){let t=this.protocol.getFlags();this.outputLimitExceeded?this.output.exitCode===0&&(this.output.exitCode=1):this.output.exitCode=t,this.protocol.setStatus(a.SUCCESS),this.running=!1}tryAppendOutput(t,e){return this.outputLimitExceeded?!1:this.maxOutputSize<=0?(t==="stdout"?this.output.stdout+=e:this.output.stderr+=e,!0):this.output.stdout.length+this.output.stderr.length+e.length>this.maxOutputSize?!1:(t==="stdout"?this.output.stdout+=e:this.output.stderr+=e,!0)}appendOutputLimitError(){if(this.maxOutputSize<=0)return;let t=`python3: total output size exceeded (>${this.maxOutputSize} bytes), increase executionLimits.maxOutputSize
+`,e=t.length>this.maxOutputSize?t.slice(0,this.maxOutputSize):t;if(this.output.stderr.includes("total output size exceeded"))return;let r=this.output.stdout.length+this.output.stderr.length+e.length-this.maxOutputSize;if(r>0)if(this.output.stdout.length>=r)this.output.stdout=this.output.stdout.slice(0,this.output.stdout.length-r);else{let n=r-this.output.stdout.length;this.output.stdout="",n>=this.output.stderr.length?this.output.stderr="":this.output.stderr=this.output.stderr.slice(0,this.output.stderr.length-n)}this.output.stderr+=e}async handleHttpRequest(){if(!this.secureFetch){this.protocol.setErrorCode(E.NETWORK_NOT_CONFIGURED),this.protocol.setResultFromString("Network access not configured. Enable network in Bash options."),this.protocol.setStatus(a.ERROR);return}let t=this.protocol.getPath(),e=this.protocol.getDataAsString();try{let s=e?JSON.parse(e):{},r=await this.secureFetch(t,{method:s.method,headers:s.headers,body:s.body}),n=JSON.stringify({status:r.status,statusText:r.statusText,headers:r.headers,body:r.body,url:r.url});this.protocol.setResultFromString(n),this.protocol.setStatus(a.SUCCESS)}catch(s){let r=l(s instanceof Error?s.message:String(s));this.protocol.setErrorCode(E.NETWORK_ERROR),this.protocol.setResultFromString(r),this.protocol.setStatus(a.ERROR)}}setErrorFromException(t){let e=t instanceof Error?t.message:String(t),s=l(e),r=E.IO_ERROR,n=e.toLowerCase();n.includes("no such file")||n.includes("not found")||n.includes("enoent")?r=E.NOT_FOUND:n.includes("is a directory")||n.includes("eisdir")?r=E.IS_DIRECTORY:n.includes("not a directory")||n.includes("enotdir")?r=E.NOT_DIRECTORY:n.includes("already exists")||n.includes("eexist")?r=E.EXISTS:(n.includes("permission")||n.includes("eperm")||n.includes("eacces"))&&(r=E.PERMISSION_DENIED),this.protocol.setErrorCode(r),this.protocol.setResultFromString(s),this.protocol.setStatus(a.ERROR)}};var z=3e4,G={name:"python3",summary:"Execute Python code via CPython Emscripten",usage:"python3 [OPTIONS] [-c CODE | -m MODULE | FILE] [ARGS...]",description:["Execute Python code using CPython compiled to WebAssembly via Emscripten.","","This command runs Python in an isolated environment with access to","the virtual filesystem. Standard library modules are available."],options:["-c CODE     Execute CODE as Python script","-m MODULE   Run library module as a script","--version   Show Python version","--help      Show this help"],examples:['python3 -c "print(1 + 2)"','python3 -c "import sys; print(sys.version)"',"python3 script.py","python3 script.py arg1 arg2",`echo 'print("hello")' | python3`],notes:["CPython runs in WebAssembly, so execution may be slower than native Python.","Standard library modules are available (no pip install).","Maximum execution time is 30 seconds by default."]};function $(o){let t={code:null,module:null,scriptFile:null,showVersion:!1,scriptArgs:[]};if(o.length===0)return t;let e=o.findIndex(s=>!s.startsWith("-")||s==="-"||s==="--");for(let s=0;s<(e===-1?o.length:e);s++){let r=o[s];if(r==="-c")return s+1>=o.length?{stdout:"",stderr:`python3: option requires an argument -- 'c'
+`,exitCode:2}:(t.code=o[s+1],t.scriptArgs=o.slice(s+2),t);if(r==="-m")return s+1>=o.length?{stdout:"",stderr:`python3: option requires an argument -- 'm'
+`,exitCode:2}:(t.module=o[s+1],t.scriptArgs=o.slice(s+2),t);if(r==="--version"||r==="-V")return t.showVersion=!0,t;if(r.startsWith("-")&&r!=="-")return{stdout:"",stderr:`python3: unrecognized option '${r}'
+`,exitCode:2}}if(e!==-1){let s=o[e];s==="--"?e+1<o.length&&(t.scriptFile=o[e+1],t.scriptArgs=o.slice(e+2)):(t.scriptFile=s,t.scriptArgs=o.slice(e+1))}return t}var _=new WeakMap;function Y(o){let t=_.get(o);return t||(t={executionQueue:[],isExecuting:!1},_.set(o,t)),t}function pt(){_=new WeakMap}var K=H(new URL("./worker.js",import.meta.url));function Q(o){if(!o||typeof o!="object")return{success:!1,error:"Malformed worker response"};let t=o;return t.type==="security-violation"?{success:!1,error:`Security violation: ${typeof t.violation?.type=="string"?t.violation.type:"unknown"}`}:typeof t.success!="boolean"?{success:!1,error:"Malformed worker response: missing success flag"}:t.success?{success:!0}:{success:!1,error:typeof t.error=="string"&&t.error.length>0?t.error:"Worker execution failed"}}function S(o){if(o.isExecuting||o.executionQueue.length===0)return;for(;o.executionQueue.length>0&&o.executionQueue[0].canceled;)o.executionQueue.shift();if(o.executionQueue.length===0)return;let t=o.executionQueue.shift();if(!t)return;o.isExecuting=!0;let e;try{e=I.runTrusted(()=>new W(K,{workerData:t.input}))}catch(h){let d=h instanceof Error?h.message:String(h);t.resolve({success:!1,error:l(d)}),o.isExecuting=!1,S(o);return}t.workerRef&&(t.workerRef.current=e);let s=F(t.requireDefenseContext,"python3","worker message callback",h=>{t.resolve(Q(h)),o.isExecuting=!1,e.terminate(),S(o)}),r=F(t.requireDefenseContext,"python3","worker error callback",h=>{t.resolve({success:!1,error:l(h.message)}),o.isExecuting=!1,S(o)}),n=F(t.requireDefenseContext,"python3","worker exit callback",()=>{o.isExecuting&&(t.resolve({success:!1,error:"Worker exited unexpectedly"}),o.isExecuting=!1,S(o))}),m=h=>{try{s(h)}catch(d){let g=d instanceof Error?d.message:String(d);t.resolve({success:!1,error:l(g)}),o.isExecuting=!1,e.terminate(),S(o)}},f=h=>{try{r(h)}catch(d){let g=d instanceof Error?d.message:String(d);t.resolve({success:!1,error:l(g)}),o.isExecuting=!1,S(o)}},x=()=>{try{n()}catch(h){let d=h instanceof Error?h.message:String(h);t.resolve({success:!1,error:l(d)}),o.isExecuting=!1,S(o)}};e.on("message",m),e.on("error",f),e.on("exit",x)}async function X(o,t,e,s=[]){let r=V(),n=new D(r,t.fs,t.cwd,t.fetch,t.limits?.maxOutputSize??0),m=t.limits?.maxPythonTimeoutMs??z,f=Y(t.fs),x={sharedBuffer:r,pythonCode:o,cwd:t.cwd,env:k(t.env),args:s,scriptPath:e},h={current:null},d=new Promise(R=>{let C={input:x,resolve:()=>{},workerRef:h,requireDefenseContext:t.requireDefenseContext},b=F(t.requireDefenseContext,"python3","worker timeout callback",()=>{h.current?h.current.terminate():C.canceled=!0,R({success:!1,error:`Execution timeout: exceeded ${m}ms limit`})}),v=P(()=>{try{b()}catch(T){let B=T instanceof Error?T.message:String(T);R({success:!1,error:l(B)})}},m);C.resolve=T=>{U(v),R(T)},f.executionQueue.push(C),S(f)}),[g,O]=await Promise.all([n.run(m).catch(R=>({stdout:"",stderr:`python3: bridge error: ${l(R.message)}
+`,exitCode:1})),d.catch(R=>({success:!1,error:l(R.message)}))]);if(!O.success&&O.error){let R=l(O.error);return{stdout:g.stdout,stderr:`${g.stderr}python3: ${R}
+`,exitCode:g.exitCode||1}}return g}var Z={name:"python3",async execute(o,t){if(N(o))return L(G);let e=$(o);if("exitCode"in e)return e;if(e.showVersion)return{stdout:`Python 3.13.2 (Emscripten)
+`,stderr:"",exitCode:0};let s,r;if(e.code!==null)s=e.code,r="-c";else if(e.module!==null){if(!/^[a-zA-Z_][a-zA-Z0-9_.]*$/.test(e.module))return{stdout:"",stderr:`python3: No module named '${e.module.slice(0,200)}'
+`,exitCode:1};s=`import runpy; runpy.run_module('${e.module}', run_name='__main__')`,r=e.module}else if(e.scriptFile!==null){let n=t.fs.resolvePath(t.cwd,e.scriptFile);if(!await t.fs.exists(n))return{stdout:"",stderr:`python3: can't open file '${e.scriptFile}': [Errno 2] No such file or directory
+`,exitCode:2};try{s=await t.fs.readFile(n),r=e.scriptFile}catch(m){let f=l(m.message);return{stdout:"",stderr:`python3: can't open file '${e.scriptFile}': ${f}
+`,exitCode:2}}}else if(t.stdin.trim())s=t.stdin,r="<stdin>";else return{stdout:"",stderr:`python3: no input provided (use -c CODE, -m MODULE, or provide a script file)
+`,exitCode:2};return X(s,t,r,e.scriptArgs)}},Et={name:"python",async execute(o,t){return Z.execute(o,t)}};export{pt as _resetExecutionQueue,Z as python3Command,Et as pythonCommand};

package/dist/bin/{shell/chunks/readlink-YNOUXNUY.js → chunks/readlink-BD5VFOC5.js}

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{a,b}from"./chunk-D2GFNFUN.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as readlinkCommand};
+import{a,b}from"./chunk-ZSVBYEY4.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as readlinkCommand};

package/dist/bin/chunks/rm-GWYJO4W7.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-R2LDP472.js";import"./chunk-SYG3IW7P.js";import"./chunk-JBABAK44.js";import"./chunk-4VDEBYW7.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as rmCommand};

package/dist/bin/chunks/sed-ENUQOCBB.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-5ATRLST6.js";import"./chunk-ZRRNCS7N.js";import"./chunk-Q5MYEU7X.js";import"./chunk-SE4C7FJY.js";import"./chunk-6KZRLMG3.js";import"./chunk-SYG3IW7P.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as sedCommand};

package/dist/bin/chunks/sleep-5T34UFNF.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-RS2PRILS.js";import"./chunk-YTIURC67.js";import"./chunk-UT6LUTWP.js";import"./chunk-Q5MYEU7X.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as sleepCommand};

package/dist/bin/chunks/sqlite3-4SBQACEE.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b,c}from"./chunk-DERQIX2O.js";import"./chunk-UT6LUTWP.js";import"./chunk-ZRRNCS7N.js";import"./chunk-Q5MYEU7X.js";import"./chunk-SYG3IW7P.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{a as _internals,c as flagsForFuzzing,b as sqlite3Command};

package/dist/bin/chunks/stat-XS2LXYS2.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-YWZOGBFE.js";import"./chunk-YMMJLYIX.js";import"./chunk-JBABAK44.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as statCommand};

package/dist/bin/chunks/tar-3UIZ4IRM.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-WWVVJW3F.js";import"./chunk-YMMJLYIX.js";import"./chunk-Q5MYEU7X.js";import"./chunk-SE4C7FJY.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as tarCommand};

package/dist/bin/chunks/time-GZSHCM77.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-VIYJJTN2.js";import"./chunk-4OALHZXB.js";import"./chunk-QZNF3Y3J.js";import"./chunk-4PRVMER6.js";import"./chunk-SYG3IW7P.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as timeCommand};

package/dist/bin/chunks/timeout-7ECKKPNP.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-2HDH5VPF.js";import"./chunk-YTIURC67.js";import"./chunk-4OALHZXB.js";import"./chunk-UT6LUTWP.js";import"./chunk-Q5MYEU7X.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as timeoutCommand};

package/dist/bin/chunks/tr-LZF57GYP.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-SYL34GE7.js";import"./chunk-SYG3IW7P.js";import"./chunk-JBABAK44.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as trCommand};

package/dist/bin/chunks/worker.js

@@ -10,6 +10,19 @@ import { createRequire } from "node:module";
 import { dirname } from "node:path";
 import { parentPort, workerData } from "node:worker_threads";
 
+// src/fs/sanitize-error.ts
+function sanitizeErrorMessage(message) {
+  if (!message) return message;
+  let sanitized = message.replace(/\n\s+at\s.*/g, "");
+  sanitized = sanitized.replace(
+    /(?:\/(?:Users|home|private|var|opt|Library|System|usr|etc|tmp|nix|snap))\b[^\s'",)}\]:]*/g,
+    "<path>"
+  );
+  sanitized = sanitized.replace(/node:internal\/[^\s'",)}\]:]+/g, "<internal>");
+  sanitized = sanitized.replace(/[A-Z]:\\[^\s'",)}\]:]+/g, "<path>");
+  return sanitized;
+}
+
 // src/security/blocked-globals.ts
 function getBlockedGlobals() {
   const globals = [
@@ -177,7 +190,14 @@ function getBlockedGlobals() {
     // in defense-in-depth-box.ts and worker-defense-in-depth.ts
     // Note: process.connected is a boolean primitive, handled specially
     // in defense-in-depth-box.ts and worker-defense-in-depth.ts
-    // Working directory manipulation
+    // Working directory access/manipulation
+    {
+      prop: "cwd",
+      target: process,
+      violationType: "process_chdir",
+      strategy: "throw",
+      reason: "process.cwd could disclose real host working directory path"
+    },
     {
       prop: "chdir",
       target: process,
@@ -241,6 +261,13 @@ function getBlockedGlobals() {
       reason: "FinalizationRegistry could be used to leak references outside sandbox"
     },
     // Introspection/interception vectors (freeze instead of throw)
+    // SECURITY RATIONALE: Reflect is frozen (not blocked) because:
+    // 1. Defense infrastructure uses Reflect.apply/get/set/construct internally
+    // 2. Frozen Reflect cannot be mutated but remains fully functional
+    // 3. Reflect.construct(Function, ['code']) IS safe because globalThis.Function
+    //    is replaced with a blocking proxy — Reflect.construct receives the proxy
+    // 4. Security depends on NEVER leaking original Function/eval references.
+    //    If an unpatched Function ref leaked, Reflect.construct would bypass defense.
     {
       prop: "Reflect",
       target: globalThis,
@@ -697,6 +724,64 @@ var WorkerDefenseInDepth = class {
         } finally {
           self.inTrap = false;
         }
+      },
+      deleteProperty(target, prop) {
+        if (self.inTrap) {
+          return Reflect.deleteProperty(target, prop);
+        }
+        self.inTrap = true;
+        try {
+          const fullPath = `${path}.${String(prop)}`;
+          const message = `${fullPath} deletion is blocked in worker context`;
+          const violation = self.recordViolation(
+            violationType,
+            fullPath,
+            message
+          );
+          if (!auditMode) {
+            throw new WorkerSecurityViolationError(message, violation);
+          }
+          return Reflect.deleteProperty(target, prop);
+        } finally {
+          self.inTrap = false;
+        }
+      },
+      setPrototypeOf(target, proto) {
+        if (self.inTrap) {
+          return Reflect.setPrototypeOf(target, proto);
+        }
+        self.inTrap = true;
+        try {
+          const message = `${path} setPrototypeOf is blocked in worker context`;
+          const violation = self.recordViolation(violationType, path, message);
+          if (!auditMode) {
+            throw new WorkerSecurityViolationError(message, violation);
+          }
+          return Reflect.setPrototypeOf(target, proto);
+        } finally {
+          self.inTrap = false;
+        }
+      },
+      defineProperty(target, prop, descriptor) {
+        if (self.inTrap) {
+          return Reflect.defineProperty(target, prop, descriptor);
+        }
+        self.inTrap = true;
+        try {
+          const fullPath = `${path}.${String(prop)}`;
+          const message = `${fullPath} defineProperty is blocked in worker context`;
+          const violation = self.recordViolation(
+            violationType,
+            fullPath,
+            message
+          );
+          if (!auditMode) {
+            throw new WorkerSecurityViolationError(message, violation);
+          }
+          return Reflect.defineProperty(target, prop, descriptor);
+        } finally {
+          self.inTrap = false;
+        }
       }
     });
   }
@@ -1253,9 +1338,23 @@ var WorkerDefenseInDepth = class {
   }
 };
 
-// src/timers.ts
-var _setTimeout = globalThis.setTimeout;
-var _clearTimeout = globalThis.clearTimeout;
+// src/security/wasm-callback.ts
+function sanitizeUnknownError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return sanitizeErrorMessage(message);
+}
+function wrapWasmCallback(component, phase, callback) {
+  return (...args) => {
+    try {
+      return callback(...args);
+    } catch (error) {
+      const message = sanitizeUnknownError(error);
+      throw new Error(`${component} ${phase} callback failed: ${message}`);
+    }
+  };
+}
+
+// src/security/trusted-globals.ts
 var _SharedArrayBuffer = globalThis.SharedArrayBuffer;
 var _Atomics = globalThis.Atomics;
 var _performanceNow = performance.now.bind(performance);
@@ -2413,9 +2512,8 @@ function createHTTPFS(backend, FS) {
             });
             lastResponse = encoder.encode(JSON.stringify(result));
           } catch (e) {
-            lastResponse = encoder.encode(
-              JSON.stringify({ error: e.message })
-            );
+            const message = sanitizeErrorMessage(e.message);
+            lastResponse = encoder.encode(JSON.stringify({ error: message }));
           }
         }
         delete stream.hostContent;
@@ -2543,6 +2641,16 @@ sys.modules['jb_http'] = jb_http
 `;
 }
 var cachedStdlibZip = new Uint8Array(readFileSync(stdlibZipPath));
+function postWorkerMessage(message) {
+  try {
+    parentPort?.postMessage(message);
+  } catch (error) {
+    console.debug(
+      "[python3-worker] failed to post worker message:",
+      sanitizeUnknownError(error)
+    );
+  }
+}
 async function runPython(input) {
   const backend = new SyncFsBackend(input.sharedBuffer);
   const createPythonModule = require2(`${cpythonDir}/python.cjs`);
@@ -2551,17 +2659,20 @@ async function runPython(input) {
   const pendingStderr = [];
   let Module;
   try {
-    Module = await createPythonModule({
-      noInitialRun: true,
-      preRun: [
-        (mod) => {
-          mod.FS.mkdirTree("/lib");
-          mod.FS.writeFile("/lib/python313.zip", cachedStdlibZip);
-          mod.ENV.PYTHONHOME = "/";
-          mod.ENV.PYTHONPATH = "/lib/python313.zip";
-        }
-      ],
-      print: (text) => {
+    const onPreRun = wrapWasmCallback(
+      "python3-worker",
+      "preRun",
+      (mod) => {
+        mod.FS.mkdirTree("/lib");
+        mod.FS.writeFile("/lib/python313.zip", cachedStdlibZip);
+        mod.ENV.PYTHONHOME = "/";
+        mod.ENV.PYTHONPATH = "/lib/python313.zip";
+      }
+    );
+    const onPrint = wrapWasmCallback(
+      "python3-worker",
+      "print",
+      (text) => {
         if (moduleReady) {
           backend.writeStdout(`${text}
 `);
@@ -2569,8 +2680,12 @@ async function runPython(input) {
           pendingStdout.push(`${text}
 `);
         }
-      },
-      printErr: (text) => {
+      }
+    );
+    const onPrintErr = wrapWasmCallback(
+      "python3-worker",
+      "printErr",
+      (text) => {
         if (typeof text === "string" && (text.includes("Could not find platform") || text.includes("LLVM Profile Error"))) {
           return;
         }
@@ -2582,11 +2697,18 @@ async function runPython(input) {
 `);
         }
       }
+    );
+    Module = await createPythonModule({
+      noInitialRun: true,
+      preRun: [onPreRun],
+      print: onPrint,
+      printErr: onPrintErr
     });
   } catch (e) {
+    const message = sanitizeErrorMessage(e.message);
     return {
       success: false,
-      error: `Failed to load CPython: ${e.message}`
+      error: `Failed to load CPython: ${message}`
     };
   }
   activateDefense();
@@ -2598,9 +2720,10 @@ async function runPython(input) {
     Module.FS.mkdir("/host");
     Module.FS.mount(HOSTFS, { root: "/" }, "/host");
   } catch (e) {
+    const message = sanitizeErrorMessage(e.message);
     return {
       success: false,
-      error: `Failed to mount HOSTFS: ${e.message}`
+      error: `Failed to mount HOSTFS: ${message}`
     };
   }
   const HTTPFS = createHTTPFS(backend, Module.FS);
@@ -2608,9 +2731,10 @@ async function runPython(input) {
     Module.FS.mkdir("/_jb_http");
     Module.FS.mount(HTTPFS, { root: "/" }, "/_jb_http");
   } catch (e) {
+    const message = sanitizeErrorMessage(e.message);
     return {
       success: false,
-      error: `Failed to mount HTTPFS: ${e.message}`
+      error: `Failed to mount HTTPFS: ${message}`
     };
   }
   const setupCode = generateSetupCode(input);
@@ -2660,6 +2784,13 @@ function activateDefense() {
     writable: true,
     configurable: true
   });
+  const onViolation = wrapWasmCallback(
+    "python3-worker",
+    "onViolation",
+    (v) => {
+      postWorkerMessage({ type: "security-violation", violation: v });
+    }
+  );
   defense = new WorkerDefenseInDepth({
     excludeViolationTypes: [
       // SharedArrayBuffer/Atomics: Used by sync-fs-backend.ts for synchronous
@@ -2670,26 +2801,26 @@ function activateDefense() {
       // stub. Defense doesn't need to block it — it's already degraded.
       "performance_timing"
     ],
-    onViolation: (v) => {
-      parentPort?.postMessage({ type: "security-violation", violation: v });
-    }
+    onViolation
   });
 }
 process.on("uncaughtException", (e) => {
-  parentPort?.postMessage({
+  const message = sanitizeErrorMessage(e.message);
+  postWorkerMessage({
     success: false,
-    error: `Worker uncaught exception: ${e.message}`
+    error: `Worker uncaught exception: ${message}`
   });
 });
 if (parentPort) {
   if (workerData) {
     runPython(workerData).then((result) => {
       result.defenseStats = defense?.getStats();
-      parentPort?.postMessage(result);
+      postWorkerMessage(result);
     }).catch((e) => {
-      parentPort?.postMessage({
+      const message = sanitizeUnknownError(e);
+      postWorkerMessage({
         success: false,
-        error: e.message,
+        error: message,
         defenseStats: defense?.getStats()
       });
     });

package/dist/bin/chunks/xan-5QTBTP4U.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-EMSJEY2U.js";import"./chunk-GZHFXDDO.js";import"./chunk-QSDVMMYI.js";import"./chunk-W752QGNZ.js";import"./chunk-UYBH3FNE.js";import"./chunk-4PRVMER6.js";import"./chunk-ZRRNCS7N.js";import"./chunk-Q5MYEU7X.js";import"./chunk-SE4C7FJY.js";import"./chunk-5WFYIUU2.js";import"./chunk-6KZRLMG3.js";import"./chunk-OBH7XN5N.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as xanCommand};

package/dist/bin/chunks/yq-O5RSLLA3.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{a,b}from"./chunk-6W7JTG6A.js";import"./chunk-QSDVMMYI.js";import"./chunk-W752QGNZ.js";import"./chunk-UYBH3FNE.js";import"./chunk-4PRVMER6.js";import"./chunk-ZRRNCS7N.js";import"./chunk-Q5MYEU7X.js";import"./chunk-SE4C7FJY.js";import"./chunk-6KZRLMG3.js";import"./chunk-SYG3IW7P.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as yqCommand};