just-bash 2.12.7 → 2.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (200) hide show
  1. package/README.md +89 -3
  2. package/dist/AGENTS.md +1 -1
  3. package/dist/Bash.d.ts +17 -0
  4. package/dist/bin/chunks/{awk2-EB5SCHVW.js → awk2-VTJMI54B.js} +1 -1
  5. package/dist/bin/chunks/chunk-3YMCKZTY.js +14 -0
  6. package/dist/bin/chunks/{chunk-O5B6WWQQ.js → chunk-A3HQTYHR.js} +1 -1
  7. package/dist/bin/chunks/chunk-AAW7UMPO.js +9 -0
  8. package/dist/bin/chunks/{chunk-ROMKUVHI.js → chunk-AXWFPG37.js} +1 -1
  9. package/dist/bin/chunks/{chunk-BBRVF6XE.js → chunk-B3RU2PUI.js} +27 -27
  10. package/dist/bin/chunks/chunk-CQG2HEAL.js +5 -0
  11. package/dist/bin/chunks/chunk-DOXYBGNA.js +12 -0
  12. package/dist/bin/chunks/{chunk-PIBXJ3VX.js → chunk-GR23MPTT.js} +1 -1
  13. package/dist/bin/chunks/{chunk-35JD7YEM.js → chunk-HJEHIH4P.js} +13 -13
  14. package/dist/bin/chunks/{chunk-ZNPXCE5B.js → chunk-LGF54XJQ.js} +1 -1
  15. package/dist/bin/{shell/chunks/chunk-5MUD3WB2.js → chunks/chunk-MO4RPBN2.js} +1 -1
  16. package/dist/bin/chunks/chunk-N6KA6G3Q.js +11 -0
  17. package/dist/bin/{shell/chunks/chunk-JX6YLHDX.js → chunks/chunk-OOJCYVYF.js} +1 -1
  18. package/dist/bin/{shell/chunks/chunk-2BC3N3L2.js → chunks/chunk-ORUYSLP4.js} +4 -4
  19. package/dist/bin/{shell/chunks/chunk-OLN6BSO3.js → chunks/chunk-SDLWFYVT.js} +2 -2
  20. package/dist/bin/chunks/{chunk-STOAUD75.js → chunk-THNL3XFF.js} +8 -8
  21. package/dist/bin/chunks/{chunk-DHFZMFUW.js → chunk-UPUMZYZE.js} +1 -1
  22. package/dist/bin/chunks/{chunk-ZJGIBTWD.js → chunk-V7ZOPVQS.js} +1 -1
  23. package/dist/bin/chunks/{chunk-IRCLOW32.js → chunk-VVFGRIJZ.js} +1 -1
  24. package/dist/bin/chunks/{chunk-QTII62YM.js → chunk-WS6P4H4S.js} +1 -1
  25. package/dist/bin/{shell/chunks/chunk-NTKUVXEL.js → chunks/chunk-YU6OGPZR.js} +2 -2
  26. package/dist/bin/{shell/chunks/chunk-PLKGKTIS.js → chunks/chunk-ZO5PSLKR.js} +2 -2
  27. package/dist/bin/{shell/chunks/curl-3GMIPMCI.js → chunks/curl-B64SIJOD.js} +1 -1
  28. package/dist/bin/chunks/env-NTPN5QYM.js +2 -0
  29. package/dist/bin/{shell/chunks/expansion-JBCP2CHQ.js → chunks/expansion-2RO5M3QC.js} +1 -1
  30. package/dist/bin/chunks/{find-MTLF23HX.js → find-GAYRV4IF.js} +1 -1
  31. package/dist/bin/chunks/flag-coverage-IRM4GISL.js +2 -0
  32. package/dist/bin/{shell/chunks/help-4H52JYYC.js → chunks/help-DVG4AAGE.js} +1 -1
  33. package/dist/bin/chunks/{jq-P457LMHU.js → jq-V7FYGIKO.js} +1 -1
  34. package/dist/bin/chunks/js-exec-YGYYZEEQ.js +97 -0
  35. package/dist/bin/chunks/js-exec-worker.js +4368 -0
  36. package/dist/bin/chunks/python3-EIXZW3LO.js +12 -0
  37. package/dist/bin/chunks/rg-C6KMBFNG.js +2 -0
  38. package/dist/bin/{shell/chunks/sed-UV2LTNVK.js → chunks/sed-3C6IBX5L.js} +1 -1
  39. package/dist/bin/chunks/sleep-ND6FZRZ4.js +2 -0
  40. package/dist/bin/chunks/{sqlite3-B3P3OMPI.js → sqlite3-TZEE4O7U.js} +1 -1
  41. package/dist/bin/chunks/tar-TOWX2TDU.js +2 -0
  42. package/dist/bin/{shell/chunks/time-GZSHCM77.js → chunks/time-VSKBXRQH.js} +1 -1
  43. package/dist/bin/chunks/timeout-Z24MNWOP.js +2 -0
  44. package/dist/bin/chunks/worker.js +168 -33
  45. package/dist/bin/chunks/xan-MOZFJGMY.js +2 -0
  46. package/dist/bin/chunks/xargs-SCYIFXOW.js +2 -0
  47. package/dist/bin/chunks/yq-JJLSDDST.js +2 -0
  48. package/dist/bin/just-bash.js +211 -210
  49. package/dist/bin/shell/chunks/{awk2-EB5SCHVW.js → awk2-VTJMI54B.js} +1 -1
  50. package/dist/bin/shell/chunks/chunk-3YMCKZTY.js +14 -0
  51. package/dist/bin/shell/chunks/{chunk-O5B6WWQQ.js → chunk-A3HQTYHR.js} +1 -1
  52. package/dist/bin/shell/chunks/chunk-AAW7UMPO.js +9 -0
  53. package/dist/bin/shell/chunks/{chunk-ROMKUVHI.js → chunk-AXWFPG37.js} +1 -1
  54. package/dist/bin/shell/chunks/{chunk-BBRVF6XE.js → chunk-B3RU2PUI.js} +27 -27
  55. package/dist/bin/shell/chunks/chunk-CQG2HEAL.js +5 -0
  56. package/dist/bin/shell/chunks/chunk-DOXYBGNA.js +12 -0
  57. package/dist/bin/shell/chunks/{chunk-PIBXJ3VX.js → chunk-GR23MPTT.js} +1 -1
  58. package/dist/bin/shell/chunks/{chunk-35JD7YEM.js → chunk-HJEHIH4P.js} +13 -13
  59. package/dist/bin/shell/chunks/{chunk-ZNPXCE5B.js → chunk-LGF54XJQ.js} +1 -1
  60. package/dist/bin/{chunks/chunk-5MUD3WB2.js → shell/chunks/chunk-MO4RPBN2.js} +1 -1
  61. package/dist/bin/shell/chunks/chunk-N6KA6G3Q.js +11 -0
  62. package/dist/bin/{chunks/chunk-JX6YLHDX.js → shell/chunks/chunk-OOJCYVYF.js} +1 -1
  63. package/dist/bin/{chunks/chunk-2BC3N3L2.js → shell/chunks/chunk-ORUYSLP4.js} +4 -4
  64. package/dist/bin/{chunks/chunk-OLN6BSO3.js → shell/chunks/chunk-SDLWFYVT.js} +2 -2
  65. package/dist/bin/shell/chunks/{chunk-STOAUD75.js → chunk-THNL3XFF.js} +8 -8
  66. package/dist/bin/shell/chunks/{chunk-DHFZMFUW.js → chunk-UPUMZYZE.js} +1 -1
  67. package/dist/bin/shell/chunks/{chunk-ZJGIBTWD.js → chunk-V7ZOPVQS.js} +1 -1
  68. package/dist/bin/shell/chunks/{chunk-IRCLOW32.js → chunk-VVFGRIJZ.js} +1 -1
  69. package/dist/bin/shell/chunks/{chunk-QTII62YM.js → chunk-WS6P4H4S.js} +1 -1
  70. package/dist/bin/{chunks/chunk-NTKUVXEL.js → shell/chunks/chunk-YU6OGPZR.js} +2 -2
  71. package/dist/bin/{chunks/chunk-PLKGKTIS.js → shell/chunks/chunk-ZO5PSLKR.js} +2 -2
  72. package/dist/bin/{chunks/curl-3GMIPMCI.js → shell/chunks/curl-B64SIJOD.js} +1 -1
  73. package/dist/bin/shell/chunks/env-NTPN5QYM.js +2 -0
  74. package/dist/bin/{chunks/expansion-JBCP2CHQ.js → shell/chunks/expansion-2RO5M3QC.js} +1 -1
  75. package/dist/bin/shell/chunks/{find-MTLF23HX.js → find-GAYRV4IF.js} +1 -1
  76. package/dist/bin/shell/chunks/flag-coverage-IRM4GISL.js +2 -0
  77. package/dist/bin/{chunks/help-4H52JYYC.js → shell/chunks/help-DVG4AAGE.js} +1 -1
  78. package/dist/bin/shell/chunks/{jq-P457LMHU.js → jq-V7FYGIKO.js} +1 -1
  79. package/dist/bin/shell/chunks/js-exec-VYG74FQ3.js +97 -0
  80. package/dist/bin/shell/chunks/python3-WO3WFGMS.js +12 -0
  81. package/dist/bin/shell/chunks/rg-C6KMBFNG.js +2 -0
  82. package/dist/bin/{chunks/sed-UV2LTNVK.js → shell/chunks/sed-3C6IBX5L.js} +1 -1
  83. package/dist/bin/shell/chunks/sleep-ND6FZRZ4.js +2 -0
  84. package/dist/bin/shell/chunks/{sqlite3-B3P3OMPI.js → sqlite3-TZEE4O7U.js} +1 -1
  85. package/dist/bin/shell/chunks/tar-TOWX2TDU.js +2 -0
  86. package/dist/bin/{chunks/time-GZSHCM77.js → shell/chunks/time-VSKBXRQH.js} +1 -1
  87. package/dist/bin/shell/chunks/timeout-Z24MNWOP.js +2 -0
  88. package/dist/bin/shell/chunks/xan-MOZFJGMY.js +2 -0
  89. package/dist/bin/shell/chunks/xargs-SCYIFXOW.js +2 -0
  90. package/dist/bin/shell/chunks/yq-JJLSDDST.js +2 -0
  91. package/dist/bin/shell/shell.js +208 -208
  92. package/dist/bundle/browser.js +594 -594
  93. package/dist/bundle/chunks/{awk2-VPBKDCSO.js → awk2-POPGKRAI.js} +1 -1
  94. package/dist/bundle/chunks/{chunk-X36DXRVC.js → chunk-24IMIIXA.js} +1 -1
  95. package/dist/bundle/chunks/{chunk-72EQZSVH.js → chunk-5QMZ5MUS.js} +2 -2
  96. package/dist/bundle/chunks/{chunk-DZZS6SJP.js → chunk-7TSDKFEO.js} +1 -1
  97. package/dist/bundle/chunks/{chunk-7YDOWJ75.js → chunk-A5O5YHGN.js} +1 -1
  98. package/dist/bundle/chunks/{chunk-KZ7BI7TV.js → chunk-BBXLRYSX.js} +2 -2
  99. package/dist/bundle/chunks/{chunk-TRD56HID.js → chunk-FEIOJCZD.js} +1 -1
  100. package/dist/bundle/chunks/{chunk-X3CVFNQZ.js → chunk-GOV5EKKI.js} +1 -1
  101. package/dist/bundle/chunks/{chunk-AUD37QB3.js → chunk-IUWCBQII.js} +1 -1
  102. package/dist/bundle/chunks/chunk-JCMONG3T.js +13 -0
  103. package/dist/bundle/chunks/{chunk-D2FZX7A2.js → chunk-LPQPILI2.js} +8 -8
  104. package/dist/bundle/chunks/chunk-MJWMXCEJ.js +10 -0
  105. package/dist/bundle/chunks/{chunk-2GOYXRRP.js → chunk-MLXIYONF.js} +4 -4
  106. package/dist/bundle/chunks/chunk-NAERJDUW.js +8 -0
  107. package/dist/bundle/chunks/{chunk-OKEHYWBE.js → chunk-NYQYO467.js} +13 -13
  108. package/dist/bundle/chunks/{chunk-C7ZTXK5C.js → chunk-O2DBFL6Z.js} +1 -1
  109. package/dist/bundle/chunks/{chunk-VSWTMNI3.js → chunk-OARHFVLG.js} +2 -2
  110. package/dist/bundle/chunks/{chunk-U5FWK6IA.js → chunk-RUF7WQ7U.js} +1 -1
  111. package/dist/bundle/chunks/chunk-TOMNU26N.js +4 -0
  112. package/dist/bundle/chunks/{chunk-4YPFHVJJ.js → chunk-UNYNJIFU.js} +27 -27
  113. package/dist/bundle/chunks/{chunk-VBF2GWEM.js → chunk-V3IEYMEA.js} +1 -1
  114. package/dist/bundle/chunks/chunk-YTNYSM6T.js +11 -0
  115. package/dist/bundle/chunks/{chunk-BED5HSP2.js → chunk-ZXL7TQLN.js} +1 -1
  116. package/dist/bundle/chunks/{curl-KM2ZAUR6.js → curl-FCIO57JJ.js} +1 -1
  117. package/dist/bundle/chunks/env-5EPCWSXR.js +1 -0
  118. package/dist/bundle/chunks/{expansion-XG7G47TX.js → expansion-ENLSRCXJ.js} +1 -1
  119. package/dist/bundle/chunks/{find-DOIVMX6X.js → find-TPUOAIUQ.js} +1 -1
  120. package/dist/bundle/chunks/flag-coverage-SPT2DN2I.js +1 -0
  121. package/dist/bundle/chunks/{help-IA5CMGR4.js → help-VVWX7SA5.js} +1 -1
  122. package/dist/bundle/chunks/{jq-NLRWI2Q6.js → jq-DIRZBOTX.js} +1 -1
  123. package/dist/bundle/chunks/js-exec-R2LSP7M4.js +96 -0
  124. package/dist/bundle/chunks/js-exec-worker.js +4368 -0
  125. package/dist/bundle/chunks/python3-DH2SBOI3.js +11 -0
  126. package/dist/bundle/chunks/rg-FOQSCCX3.js +1 -0
  127. package/dist/bundle/chunks/{sed-2BILOGNL.js → sed-DISNI47D.js} +1 -1
  128. package/dist/bundle/chunks/sleep-VZFPZFWA.js +1 -0
  129. package/dist/bundle/chunks/{sqlite3-VEDNWJL6.js → sqlite3-7F22DOIP.js} +1 -1
  130. package/dist/bundle/chunks/tar-232RCEFK.js +1 -0
  131. package/dist/bundle/chunks/{time-XL42Z4U5.js → time-FABCOJJU.js} +1 -1
  132. package/dist/bundle/chunks/timeout-VRKMCG72.js +1 -0
  133. package/dist/bundle/chunks/worker.js +168 -33
  134. package/dist/bundle/chunks/xan-BXDXYEIB.js +1 -0
  135. package/dist/bundle/chunks/xargs-I6EZUCYF.js +1 -0
  136. package/dist/bundle/chunks/yq-XMVSIL6Z.js +1 -0
  137. package/dist/bundle/index.cjs +976 -877
  138. package/dist/bundle/index.js +245 -245
  139. package/dist/commands/js-exec/fetch-polyfill.d.ts +6 -0
  140. package/dist/commands/js-exec/js-exec.d.ts +11 -0
  141. package/dist/commands/js-exec/module-shims.d.ts +29 -0
  142. package/dist/commands/js-exec/path-polyfill.d.ts +6 -0
  143. package/dist/commands/js-exec/worker.d.ts +30 -0
  144. package/dist/commands/python3/worker.d.ts +1 -0
  145. package/dist/commands/query-engine/safe-object.d.ts +11 -0
  146. package/dist/commands/registry.d.ts +13 -2
  147. package/dist/commands/{python3/fs-bridge-handler.d.ts → worker-bridge/bridge-handler.d.ts} +25 -8
  148. package/dist/commands/{python3 → worker-bridge}/protocol.d.ts +6 -3
  149. package/dist/commands/{python3/sync-fs-backend.d.ts → worker-bridge/sync-backend.d.ts} +25 -4
  150. package/dist/index.d.cts +3 -3
  151. package/dist/index.d.ts +3 -3
  152. package/dist/interpreter/interpreter.d.ts +3 -0
  153. package/dist/interpreter/types.d.ts +8 -0
  154. package/dist/limits.d.ts +3 -1
  155. package/dist/network/allow-list/shared.d.ts +8 -0
  156. package/dist/network/types.d.ts +15 -1
  157. package/dist/types.d.ts +12 -0
  158. package/package.json +12 -11
  159. package/dist/bin/chunks/chunk-47HZU3SY.js +0 -5
  160. package/dist/bin/chunks/chunk-N4EU64Y4.js +0 -9
  161. package/dist/bin/chunks/chunk-VCKKRS7V.js +0 -12
  162. package/dist/bin/chunks/chunk-VIYJJTN2.js +0 -14
  163. package/dist/bin/chunks/env-HOVBNLUR.js +0 -2
  164. package/dist/bin/chunks/flag-coverage-7GOZYXJT.js +0 -2
  165. package/dist/bin/chunks/python3-45TMCI4M.js +0 -17
  166. package/dist/bin/chunks/rg-34GE6REQ.js +0 -2
  167. package/dist/bin/chunks/sleep-3WHM7JMW.js +0 -2
  168. package/dist/bin/chunks/tar-SO3XDDIW.js +0 -2
  169. package/dist/bin/chunks/timeout-BYB3L2JA.js +0 -2
  170. package/dist/bin/chunks/xan-FZB7FHX3.js +0 -2
  171. package/dist/bin/chunks/xargs-GBL6PZ2K.js +0 -2
  172. package/dist/bin/chunks/yq-H7D2U3HS.js +0 -2
  173. package/dist/bin/shell/chunks/chunk-47HZU3SY.js +0 -5
  174. package/dist/bin/shell/chunks/chunk-N4EU64Y4.js +0 -9
  175. package/dist/bin/shell/chunks/chunk-VCKKRS7V.js +0 -12
  176. package/dist/bin/shell/chunks/chunk-VIYJJTN2.js +0 -14
  177. package/dist/bin/shell/chunks/env-HOVBNLUR.js +0 -2
  178. package/dist/bin/shell/chunks/flag-coverage-7GOZYXJT.js +0 -2
  179. package/dist/bin/shell/chunks/python3-IV3DBMHM.js +0 -17
  180. package/dist/bin/shell/chunks/rg-34GE6REQ.js +0 -2
  181. package/dist/bin/shell/chunks/sleep-3WHM7JMW.js +0 -2
  182. package/dist/bin/shell/chunks/tar-SO3XDDIW.js +0 -2
  183. package/dist/bin/shell/chunks/timeout-BYB3L2JA.js +0 -2
  184. package/dist/bin/shell/chunks/xan-FZB7FHX3.js +0 -2
  185. package/dist/bin/shell/chunks/xargs-GBL6PZ2K.js +0 -2
  186. package/dist/bin/shell/chunks/yq-H7D2U3HS.js +0 -2
  187. package/dist/bundle/chunks/chunk-3RA5L262.js +0 -8
  188. package/dist/bundle/chunks/chunk-6HBBXB3L.js +0 -11
  189. package/dist/bundle/chunks/chunk-EX62JIX3.js +0 -13
  190. package/dist/bundle/chunks/chunk-ZSJYNBAF.js +0 -4
  191. package/dist/bundle/chunks/env-XZY4LKEO.js +0 -1
  192. package/dist/bundle/chunks/flag-coverage-NT32EG6Q.js +0 -1
  193. package/dist/bundle/chunks/python3-G2ZUJAQL.js +0 -16
  194. package/dist/bundle/chunks/rg-RAICUFGG.js +0 -1
  195. package/dist/bundle/chunks/sleep-IUBP5GMH.js +0 -1
  196. package/dist/bundle/chunks/tar-LKO7DKAK.js +0 -1
  197. package/dist/bundle/chunks/timeout-TL4Q5YKZ.js +0 -1
  198. package/dist/bundle/chunks/xan-KSDYKKEK.js +0 -1
  199. package/dist/bundle/chunks/xargs-2BBAQDTC.js +0 -1
  200. package/dist/bundle/chunks/yq-HIQ4WMDY.js +0 -1
@@ -0,0 +1,12 @@
1
+ #!/usr/bin/env node
2
+ import{a as M,b as D}from"./chunk-N6KA6G3Q.js";import"./chunk-4OALHZXB.js";import"./chunk-MY5PY2PL.js";import"./chunk-QZNF3Y3J.js";import{a as C,b as v}from"./chunk-OOJCYVYF.js";import{a as b}from"./chunk-4PRVMER6.js";import{c as h}from"./chunk-MO4RPBN2.js";import{b as k}from"./chunk-YU6OGPZR.js";import{a as c}from"./chunk-SYG3IW7P.js";import{a as T,b as P}from"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";import{randomBytes as F}from"node:crypto";import{fileURLToPath as W}from"node:url";import{Worker as $}from"node:worker_threads";var Q=1e4,R=6e4,U={name:"python3",summary:"Execute Python code via CPython Emscripten",usage:"python3 [OPTIONS] [-c CODE | -m MODULE | FILE] [ARGS...]",description:["Execute Python code using CPython compiled to WebAssembly via Emscripten.","","This command runs Python in an isolated environment with access to","the virtual filesystem. Standard library modules are available."],options:["-c CODE Execute CODE as Python script","-m MODULE Run library module as a script","--version Show Python version","--help Show this help"],examples:['python3 -c "print(1 + 2)"','python3 -c "import sys; print(sys.version)"',"python3 script.py","python3 script.py arg1 arg2",`echo 'print("hello")' | python3`],notes:["CPython runs in WebAssembly, so execution may be slower than native Python.","Standard library modules are available (no pip install).","Maximum execution time is 30 seconds by default."]};function I(r){let e={code:null,module:null,scriptFile:null,showVersion:!1,scriptArgs:[]};if(r.length===0)return e;let t=r.findIndex(o=>!o.startsWith("-")||o==="-"||o==="--");for(let o=0;o<(t===-1?r.length:t);o++){let s=r[o];if(s==="-c")return o+1>=r.length?{stdout:"",stderr:`python3: option requires an argument -- 'c'
3
+ `,exitCode:2}:(e.code=r[o+1],e.scriptArgs=r.slice(o+2),e);if(s==="-m")return o+1>=r.length?{stdout:"",stderr:`python3: option requires an argument -- 'm'
4
+ `,exitCode:2}:(e.module=r[o+1],e.scriptArgs=r.slice(o+2),e);if(s==="--version"||s==="-V")return e.showVersion=!0,e;if(s.startsWith("-")&&s!=="-")return{stdout:"",stderr:`python3: unrecognized option '${s}'
5
+ `,exitCode:2}}if(t!==-1){let o=r[t];o==="--"?t+1<r.length&&(e.scriptFile=r[t+1],e.scriptArgs=r.slice(t+2)):(e.scriptFile=o,e.scriptArgs=r.slice(t+1))}return e}var w=new WeakMap;function L(r){let e=w.get(r);return e||(e={executionQueue:[],isExecuting:!1},w.set(r,e)),e}function oe(){w=new WeakMap}var H=W(new URL("./worker.js",import.meta.url));function N(){return F(16).toString("hex")}function z(r,e){if(!r||typeof r!="object")return{success:!1,error:"Malformed worker response"};let t=r;return typeof t.protocolToken!="string"||t.protocolToken!==e?{success:!1,error:"Malformed worker response: invalid protocol token"}:t.type==="security-violation"?{success:!1,error:`Security violation: ${typeof t.violation?.type=="string"?t.violation.type:"unknown"}`}:typeof t.success!="boolean"?{success:!1,error:"Malformed worker response: missing success flag"}:t.success?{success:!0}:{success:!1,error:typeof t.error=="string"&&t.error.length>0?t.error:"Worker execution failed"}}function a(r){if(r.isExecuting||r.executionQueue.length===0)return;for(;r.executionQueue.length>0&&r.executionQueue[0].canceled;)r.executionQueue.shift();if(r.executionQueue.length===0)return;let e=r.executionQueue.shift();if(!e)return;r.isExecuting=!0;let t;try{t=k.runTrusted(()=>new $(H,{workerData:e.input}))}catch(n){let i=n instanceof Error?n.message:String(n);e.resolve({success:!1,error:c(i)}),r.isExecuting=!1,a(r);return}e.workerRef&&(e.workerRef.current=t);let o=h(e.requireDefenseContext,"python3","worker message callback",n=>{e.resolve(z(n,e.input.protocolToken)),r.isExecuting=!1,t.terminate(),a(r)}),s=h(e.requireDefenseContext,"python3","worker error callback",n=>{e.resolve({success:!1,error:c(n.message)}),r.isExecuting=!1,a(r)}),p=h(e.requireDefenseContext,"python3","worker exit callback",()=>{r.isExecuting&&(e.resolve({success:!1,error:"Worker exited unexpectedly"}),r.isExecuting=!1,a(r))}),f=n=>{try{o(n)}catch(i){let m=i instanceof Error?i.message:String(i);e.resolve({success:!1,error:c(m)}),r.isExecuting=!1,t.terminate(),a(r)}},l=n=>{try{s(n)}catch(i){let m=i instanceof Error?i.message:String(i);e.resolve({success:!1,error:c(m)}),r.isExecuting=!1,a(r)}},y=()=>{try{p()}catch(n){let i=n instanceof Error?n.message:String(n);e.resolve({success:!1,error:c(i)}),r.isExecuting=!1,a(r)}};t.on("message",f),t.on("error",l),t.on("exit",y)}async function B(r,e,t,o=[]){let s=M(),p=new D(s,e.fs,e.cwd,"python3",e.fetch,e.limits?.maxOutputSize??0),f=e.limits?.maxPythonTimeoutMs??Q,l=e.fetch?Math.max(f,R):f,y=L(e.fs),n={protocolToken:N(),sharedBuffer:s,pythonCode:r,cwd:e.cwd,env:b(e.env),args:o,scriptPath:t,timeoutMs:l},i={current:null},m=new Promise(u=>{let E={input:n,resolve:()=>{},workerRef:i,requireDefenseContext:e.requireDefenseContext},_=h(e.requireDefenseContext,"python3","worker timeout callback",()=>{i.current?i.current.terminate():E.canceled=!0,u({success:!1,error:`Execution timeout: exceeded ${l}ms limit`})}),O=C(()=>{try{_()}catch(d){let A=d instanceof Error?d.message:String(d);u({success:!1,error:c(A)})}},l);E.resolve=d=>{v(O),u(d)},y.executionQueue.push(E),a(y)}),[g,x]=await Promise.all([p.run(l).catch(u=>({stdout:"",stderr:`python3: bridge error: ${c(u.message)}
6
+ `,exitCode:1})),m.catch(u=>({success:!1,error:c(u.message)}))]);if(!x.success&&x.error){let u=c(x.error);return{stdout:g.stdout,stderr:`${g.stderr}python3: ${u}
7
+ `,exitCode:g.exitCode||1}}return g}var V={name:"python3",async execute(r,e){if(P(r))return T(U);let t=I(r);if("exitCode"in t)return t;if(t.showVersion)return{stdout:`Python 3.13.2 (Emscripten)
8
+ `,stderr:"",exitCode:0};let o,s;if(t.code!==null)o=t.code,s="-c";else if(t.module!==null){if(!/^[a-zA-Z_][a-zA-Z0-9_.]*$/.test(t.module))return{stdout:"",stderr:`python3: No module named '${t.module.slice(0,200)}'
9
+ `,exitCode:1};o=`import runpy; runpy.run_module('${t.module}', run_name='__main__')`,s=t.module}else if(t.scriptFile!==null){let p=e.fs.resolvePath(e.cwd,t.scriptFile);if(!await e.fs.exists(p))return{stdout:"",stderr:`python3: can't open file '${t.scriptFile}': [Errno 2] No such file or directory
10
+ `,exitCode:2};try{o=await e.fs.readFile(p),s=t.scriptFile}catch(f){let l=c(f.message);return{stdout:"",stderr:`python3: can't open file '${t.scriptFile}': ${l}
11
+ `,exitCode:2}}}else if(e.stdin.trim())o=e.stdin,s="<stdin>";else return{stdout:"",stderr:`python3: no input provided (use -c CODE, -m MODULE, or provide a script file)
12
+ `,exitCode:2};return B(o,e,s,t.scriptArgs)}},se={name:"python",async execute(r,e){return V.execute(r,e)}};export{oe as _resetExecutionQueue,V as python3Command,se as pythonCommand};
@@ -0,0 +1,2 @@
1
+ #!/usr/bin/env node
2
+ import{a,b}from"./chunk-HJEHIH4P.js";import"./chunk-V7ZOPVQS.js";import"./chunk-4OALHZXB.js";import"./chunk-G43H2WGH.js";import"./chunk-SE4C7FJY.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as rgCommand};
@@ -1,2 +1,2 @@
1
1
  #!/usr/bin/env node
2
- import{a,b}from"./chunk-IRCLOW32.js";import"./chunk-5MUD3WB2.js";import"./chunk-NTKUVXEL.js";import"./chunk-SE4C7FJY.js";import"./chunk-6KZRLMG3.js";import"./chunk-SYG3IW7P.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as sedCommand};
2
+ import{a,b}from"./chunk-VVFGRIJZ.js";import"./chunk-MO4RPBN2.js";import"./chunk-YU6OGPZR.js";import"./chunk-SE4C7FJY.js";import"./chunk-6KZRLMG3.js";import"./chunk-SYG3IW7P.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as sedCommand};
@@ -0,0 +1,2 @@
1
+ #!/usr/bin/env node
2
+ import{a,b}from"./chunk-AXWFPG37.js";import"./chunk-YTIURC67.js";import"./chunk-OOJCYVYF.js";import"./chunk-YU6OGPZR.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as sleepCommand};
@@ -1,2 +1,2 @@
1
1
  #!/usr/bin/env node
2
- import{a,b,c}from"./chunk-DHFZMFUW.js";import"./chunk-JX6YLHDX.js";import"./chunk-5MUD3WB2.js";import"./chunk-NTKUVXEL.js";import"./chunk-SYG3IW7P.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{a as _internals,c as flagsForFuzzing,b as sqlite3Command};
2
+ import{a,b,c}from"./chunk-UPUMZYZE.js";import"./chunk-OOJCYVYF.js";import"./chunk-MO4RPBN2.js";import"./chunk-YU6OGPZR.js";import"./chunk-SYG3IW7P.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{a as _internals,c as flagsForFuzzing,b as sqlite3Command};
@@ -0,0 +1,2 @@
1
+ #!/usr/bin/env node
2
+ import{a,b}from"./chunk-WS6P4H4S.js";import"./chunk-YMMJLYIX.js";import"./chunk-YU6OGPZR.js";import"./chunk-SE4C7FJY.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as tarCommand};
@@ -1,2 +1,2 @@
1
1
  #!/usr/bin/env node
2
- import{a,b}from"./chunk-VIYJJTN2.js";import"./chunk-4OALHZXB.js";import"./chunk-QZNF3Y3J.js";import"./chunk-4PRVMER6.js";import"./chunk-SYG3IW7P.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as timeCommand};
2
+ import{a,b}from"./chunk-3YMCKZTY.js";import"./chunk-4OALHZXB.js";import"./chunk-QZNF3Y3J.js";import"./chunk-4PRVMER6.js";import"./chunk-SYG3IW7P.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as timeCommand};
@@ -0,0 +1,2 @@
1
+ #!/usr/bin/env node
2
+ import{a,b}from"./chunk-DOXYBGNA.js";import"./chunk-YTIURC67.js";import"./chunk-4OALHZXB.js";import"./chunk-OOJCYVYF.js";import"./chunk-YU6OGPZR.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as timeoutCommand};
@@ -647,7 +647,6 @@ var WorkerDefenseInDepth = class {
647
647
  * Create a blocking proxy for a function.
648
648
  * In worker context, always blocks (no context check needed).
649
649
  */
650
- // @banned-pattern-ignore: intentional use of Function type for security proxy
651
650
  createBlockingProxy(original, path, violationType) {
652
651
  const self = this;
653
652
  const auditMode = this.config.auditMode;
@@ -673,7 +672,7 @@ var WorkerDefenseInDepth = class {
673
672
  /**
674
673
  * Create a blocking proxy for an object (blocks all property access).
675
674
  */
676
- createBlockingObjectProxy(original, path, violationType) {
675
+ createBlockingObjectProxy(original, path, violationType, allowedKeys) {
677
676
  const self = this;
678
677
  const auditMode = this.config.auditMode;
679
678
  return new this.originalProxy(original, {
@@ -681,6 +680,9 @@ var WorkerDefenseInDepth = class {
681
680
  if (self.inTrap) {
682
681
  return Reflect.get(target, prop, receiver);
683
682
  }
683
+ if (allowedKeys && typeof prop === "string" && allowedKeys.has(prop)) {
684
+ return Reflect.get(target, prop, receiver);
685
+ }
684
686
  self.inTrap = true;
685
687
  try {
686
688
  const fullPath = `${path}.${String(prop)}`;
@@ -871,6 +873,9 @@ var WorkerDefenseInDepth = class {
871
873
  this.protectProcessConnected();
872
874
  }
873
875
  this.lockWellKnownSymbols();
876
+ if (!excludeTypes.has("proxy")) {
877
+ this.protectProxyRevocable();
878
+ }
874
879
  }
875
880
  /**
876
881
  * Lock well-known Symbol properties on built-in constructors/prototypes.
@@ -906,6 +911,84 @@ var WorkerDefenseInDepth = class {
906
911
  }
907
912
  lock(Symbol.prototype, Symbol.toPrimitive);
908
913
  lock(Date.prototype, Symbol.toPrimitive);
914
+ for (const sym of [
915
+ Symbol.match,
916
+ Symbol.matchAll,
917
+ Symbol.replace,
918
+ Symbol.search,
919
+ Symbol.split
920
+ ]) {
921
+ lock(RegExp.prototype, sym);
922
+ }
923
+ lock(Function.prototype, Symbol.hasInstance);
924
+ lock(Array.prototype, Symbol.unscopables);
925
+ for (const proto of [
926
+ Map.prototype,
927
+ Set.prototype,
928
+ Promise.prototype,
929
+ ArrayBuffer.prototype
930
+ ]) {
931
+ lock(proto, Symbol.toStringTag);
932
+ }
933
+ try {
934
+ const stackDesc = Object.getOwnPropertyDescriptor(
935
+ Error,
936
+ "stackTraceLimit"
937
+ );
938
+ this.originalDescriptors.push({
939
+ target: Error,
940
+ prop: "stackTraceLimit",
941
+ descriptor: stackDesc
942
+ });
943
+ Object.defineProperty(Error, "stackTraceLimit", {
944
+ value: Error.stackTraceLimit,
945
+ writable: false,
946
+ configurable: true
947
+ });
948
+ } catch {
949
+ }
950
+ }
951
+ /**
952
+ * Block Proxy.revocable to prevent bypassing Proxy constructor blocking.
953
+ *
954
+ * Proxy.revocable internally uses the real Proxy constructor, so it bypasses
955
+ * our blocking proxy on globalThis.Proxy. We replace it with a wrapper that
956
+ * always blocks in worker context.
957
+ */
958
+ protectProxyRevocable() {
959
+ const self = this;
960
+ const auditMode = this.config.auditMode;
961
+ try {
962
+ const originalRevocable = this.originalProxy.revocable;
963
+ if (typeof originalRevocable !== "function") return;
964
+ const descriptor = Object.getOwnPropertyDescriptor(
965
+ this.originalProxy,
966
+ "revocable"
967
+ );
968
+ this.originalDescriptors.push({
969
+ target: this.originalProxy,
970
+ prop: "revocable",
971
+ descriptor
972
+ });
973
+ Object.defineProperty(this.originalProxy, "revocable", {
974
+ value: function revocable(_target, _handler) {
975
+ const message = "Proxy.revocable is blocked in worker context";
976
+ const violation = self.recordViolation(
977
+ "proxy",
978
+ "Proxy.revocable",
979
+ message
980
+ );
981
+ if (!auditMode) {
982
+ throw new WorkerSecurityViolationError(message, violation);
983
+ }
984
+ return originalRevocable(_target, _handler);
985
+ },
986
+ writable: false,
987
+ configurable: true
988
+ // Must be configurable for restoration
989
+ });
990
+ } catch {
991
+ }
909
992
  }
910
993
  /**
911
994
  * Protect against .constructor.constructor escape vector.
@@ -1396,7 +1479,8 @@ var WorkerDefenseInDepth = class {
1396
1479
  ) : this.createBlockingObjectProxy(
1397
1480
  original,
1398
1481
  path,
1399
- violationType
1482
+ violationType,
1483
+ blocked.allowedKeys
1400
1484
  );
1401
1485
  Object.defineProperty(target, prop, {
1402
1486
  value: proxy,
@@ -1447,7 +1531,7 @@ var _SharedArrayBuffer = globalThis.SharedArrayBuffer;
1447
1531
  var _Atomics = globalThis.Atomics;
1448
1532
  var _performanceNow = performance.now.bind(performance);
1449
1533
 
1450
- // src/commands/python3/protocol.ts
1534
+ // src/commands/worker-bridge/protocol.ts
1451
1535
  var OpCode = {
1452
1536
  NOOP: 0,
1453
1537
  READ_FILE: 1,
@@ -1463,12 +1547,16 @@ var OpCode = {
1463
1547
  LSTAT: 11,
1464
1548
  CHMOD: 12,
1465
1549
  REALPATH: 13,
1466
- // Special operations for Python I/O
1550
+ RENAME: 14,
1551
+ COPY_FILE: 15,
1552
+ // Special operations for I/O
1467
1553
  WRITE_STDOUT: 100,
1468
1554
  WRITE_STDERR: 101,
1469
1555
  EXIT: 102,
1470
1556
  // HTTP operations
1471
- HTTP_REQUEST: 200
1557
+ HTTP_REQUEST: 200,
1558
+ // Sub-shell execution
1559
+ EXEC_COMMAND: 300
1472
1560
  };
1473
1561
  var Status = {
1474
1562
  PENDING: 0,
@@ -1505,8 +1593,10 @@ var Offset = {
1505
1593
  var Size = {
1506
1594
  CONTROL_REGION: 32,
1507
1595
  PATH_BUFFER: 4096,
1596
+ // 1MB limit applies to all FS read/write operations through the bridge.
1597
+ // Files larger than this will be truncated. This is tight — consider
1598
+ // increasing if real workloads hit the cap. Reduced from 16MB for faster tests.
1508
1599
  DATA_BUFFER: 1048576,
1509
- // 1MB (reduced from 16MB for faster tests)
1510
1600
  TOTAL: 1052704
1511
1601
  // 32 + 4096 + 1MB
1512
1602
  };
@@ -1747,11 +1837,13 @@ var ProtocolBuffer = class {
1747
1837
  }
1748
1838
  };
1749
1839
 
1750
- // src/commands/python3/sync-fs-backend.ts
1751
- var SyncFsBackend = class {
1840
+ // src/commands/worker-bridge/sync-backend.ts
1841
+ var SyncBackend = class {
1752
1842
  protocol;
1753
- constructor(sharedBuffer) {
1843
+ operationTimeoutMs;
1844
+ constructor(sharedBuffer, operationTimeoutMs = 3e4) {
1754
1845
  this.protocol = new ProtocolBuffer(sharedBuffer);
1846
+ this.operationTimeoutMs = operationTimeoutMs;
1755
1847
  }
1756
1848
  execSync(opCode, path, data, flags = 0, mode = 0) {
1757
1849
  this.protocol.reset();
@@ -1764,7 +1856,7 @@ var SyncFsBackend = class {
1764
1856
  }
1765
1857
  this.protocol.setStatus(Status.READY);
1766
1858
  this.protocol.notify();
1767
- const waitResult = this.protocol.waitForResult(5e3);
1859
+ const waitResult = this.protocol.waitForResult(this.operationTimeoutMs);
1768
1860
  if (waitResult === "timed-out") {
1769
1861
  return { success: false, error: "Operation timed out" };
1770
1862
  }
@@ -1867,6 +1959,20 @@ var SyncFsBackend = class {
1867
1959
  }
1868
1960
  return this.protocol.getResultAsString();
1869
1961
  }
1962
+ rename(oldPath, newPath) {
1963
+ const newPathData = new TextEncoder().encode(newPath);
1964
+ const result = this.execSync(OpCode.RENAME, oldPath, newPathData);
1965
+ if (!result.success) {
1966
+ throw new Error(result.error || "Failed to rename");
1967
+ }
1968
+ }
1969
+ copyFile(src, dest) {
1970
+ const destData = new TextEncoder().encode(dest);
1971
+ const result = this.execSync(OpCode.COPY_FILE, src, destData);
1972
+ if (!result.success) {
1973
+ throw new Error(result.error || "Failed to copyFile");
1974
+ }
1975
+ }
1870
1976
  writeStdout(data) {
1871
1977
  const encoded = new TextEncoder().encode(data);
1872
1978
  const result = this.execSync(OpCode.WRITE_STDOUT, "", encoded);
@@ -1897,6 +2003,32 @@ var SyncFsBackend = class {
1897
2003
  const responseJson = new TextDecoder().decode(result.result);
1898
2004
  return JSON.parse(responseJson);
1899
2005
  }
2006
+ /**
2007
+ * Execute a shell command through the main thread's exec function.
2008
+ * Returns the result as { stdout, stderr, exitCode }.
2009
+ */
2010
+ execCommand(command, stdin) {
2011
+ const requestData = stdin ? new TextEncoder().encode(JSON.stringify({ stdin })) : void 0;
2012
+ const result = this.execSync(OpCode.EXEC_COMMAND, command, requestData);
2013
+ if (!result.success) {
2014
+ throw new Error(result.error || "Command execution failed");
2015
+ }
2016
+ const responseJson = new TextDecoder().decode(result.result);
2017
+ return JSON.parse(responseJson);
2018
+ }
2019
+ /**
2020
+ * Execute a shell command with structured args (shell-escaped on the main thread).
2021
+ * Prevents command injection from unsanitized args.
2022
+ */
2023
+ execCommandArgs(command, args) {
2024
+ const requestData = new TextEncoder().encode(JSON.stringify({ args }));
2025
+ const result = this.execSync(OpCode.EXEC_COMMAND, command, requestData);
2026
+ if (!result.success) {
2027
+ throw new Error(result.error || "Command execution failed");
2028
+ }
2029
+ const responseJson = new TextDecoder().decode(result.result);
2030
+ return JSON.parse(responseJson);
2031
+ }
1900
2032
  };
1901
2033
 
1902
2034
  // src/commands/python3/worker.ts
@@ -1979,27 +2111,30 @@ var cpythonDir = dirname(cpythonEntryPath);
1979
2111
  var stdlibZipPath = `${cpythonDir}/python313.zip`;
1980
2112
  assertApprovedPath(stdlibZipPath, "cpython-stdlib");
1981
2113
  function createHOSTFS(backend, FS, PATH) {
1982
- const ERRNO_CODES = {
1983
- EPERM: 63,
1984
- ENOENT: 44,
1985
- EIO: 29,
1986
- EBADF: 8,
1987
- EAGAIN: 6,
1988
- EACCES: 2,
1989
- EBUSY: 10,
1990
- EEXIST: 20,
1991
- ENOTDIR: 54,
1992
- EISDIR: 31,
1993
- EINVAL: 28,
1994
- EMFILE: 33,
1995
- ENOSPC: 51,
1996
- ESPIPE: 70,
1997
- EROFS: 69,
1998
- ENOTEMPTY: 55,
1999
- ENOSYS: 52,
2000
- ENOTSUP: 138,
2001
- ENODATA: 42
2002
- };
2114
+ const ERRNO_CODES = Object.assign(
2115
+ /* @__PURE__ */ Object.create(null),
2116
+ {
2117
+ EPERM: 63,
2118
+ ENOENT: 44,
2119
+ EIO: 29,
2120
+ EBADF: 8,
2121
+ EAGAIN: 6,
2122
+ EACCES: 2,
2123
+ EBUSY: 10,
2124
+ EEXIST: 20,
2125
+ ENOTDIR: 54,
2126
+ EISDIR: 31,
2127
+ EINVAL: 28,
2128
+ EMFILE: 33,
2129
+ ENOSPC: 51,
2130
+ ESPIPE: 70,
2131
+ EROFS: 69,
2132
+ ENOTEMPTY: 55,
2133
+ ENOSYS: 52,
2134
+ ENOTSUP: 138,
2135
+ ENODATA: 42
2136
+ }
2137
+ );
2003
2138
  function realPath(node) {
2004
2139
  const parts = [];
2005
2140
  while (node.parent !== node) {
@@ -2783,7 +2918,7 @@ async function runPython(input) {
2783
2918
  error: "Defense-in-depth module-loader guard failed to initialize; refusing to execute Python worker"
2784
2919
  };
2785
2920
  }
2786
- const backend = new SyncFsBackend(input.sharedBuffer);
2921
+ const backend = new SyncBackend(input.sharedBuffer, input.timeoutMs);
2787
2922
  assertApprovedPath(cpythonEntryPath, "cpython-entry");
2788
2923
  const createPythonModule = require2(cpythonEntryPath);
2789
2924
  let moduleReady = false;
@@ -0,0 +1,2 @@
1
+ #!/usr/bin/env node
2
+ import{a,b}from"./chunk-B3RU2PUI.js";import"./chunk-GZHFXDDO.js";import"./chunk-QSDVMMYI.js";import"./chunk-ZO5PSLKR.js";import"./chunk-V7ZOPVQS.js";import"./chunk-4PRVMER6.js";import"./chunk-MO4RPBN2.js";import"./chunk-YU6OGPZR.js";import"./chunk-SE4C7FJY.js";import"./chunk-5WFYIUU2.js";import"./chunk-6KZRLMG3.js";import"./chunk-OBH7XN5N.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as xanCommand};
@@ -0,0 +1,2 @@
1
+ #!/usr/bin/env node
2
+ import{a,b}from"./chunk-CQG2HEAL.js";import"./chunk-4OALHZXB.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as xargsCommand};
@@ -0,0 +1,2 @@
1
+ #!/usr/bin/env node
2
+ import{a,b}from"./chunk-LGF54XJQ.js";import"./chunk-QSDVMMYI.js";import"./chunk-ZO5PSLKR.js";import"./chunk-V7ZOPVQS.js";import"./chunk-4PRVMER6.js";import"./chunk-MO4RPBN2.js";import"./chunk-YU6OGPZR.js";import"./chunk-SE4C7FJY.js";import"./chunk-6KZRLMG3.js";import"./chunk-SYG3IW7P.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{b as flagsForFuzzing,a as yqCommand};