just-bash 2.15.0-executor.0 → 3.0.0

package/dist/commands/tar/bzip2-compress.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Pure JavaScript bzip2 compressor.
+ *
+ * Implements the bzip2 compression algorithm (public domain, Julian Seward 1996).
+ * Pipeline: RLE1 → BWT → MTF → RLE2 (RUNA/RUNB) → Huffman → bitstream output.
+ *
+ * This exists because no permissively-licensed JS bzip2 compressor is available
+ * on npm. Decompression uses the MIT-licensed `seek-bzip` package instead.
+ */
+/**
+ * Compress data using bzip2 algorithm.
+ * @param data - Input data to compress
+ * @param blockSizeLevel - Block size level 1-9 (x 100KB), default 9
+ * @param maxSize - Maximum input size in bytes (default 10MB)
+ * @returns Compressed bzip2 data
+ */
+export declare function bzip2Compress(data: Uint8Array, blockSizeLevel?: number, maxSize?: number): Uint8Array;

package/dist/commands/worker-bridge/sync-backend.d.ts

@@ -57,6 +57,7 @@ export declare class SyncBackend {
         statusText: string;
         headers: Record<string, string>;
         body: string;
+        bodyBase64: string;
         url: string;
     };
     /**
@@ -78,7 +79,7 @@ export declare class SyncBackend {
         exitCode: number;
     };
     /**
-     * Invoke a tool through the main thread's tool invoker (executor mode).
+     * Invoke a tool through the main thread's invokeTool hook.
      * Returns the JSON-serialized result.
      */
     invokeTool(path: string, argsJson: string): string;

package/dist/encoding.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Byte/text boundary types for the shell pipeline.
+ *
+ * Shell pipes carry bytes, not text. Internally we represent a byte buffer as
+ * a JS string where `s.charCodeAt(i)` is the i-th byte (0–255), the same
+ * convention as `Buffer.from(s, "latin1")`. That's a space-cheap byte buffer,
+ * but the type system can't tell it apart from a real `string`, and command
+ * authors keep writing `ctx.stdin.split(...)` / `RegExp.test(ctx.stdin)` /
+ * `JSON.parse(ctx.stdin)` over data that is actually UTF-8 packed in latin1.
+ * The result is silent mojibake — every multibyte codepoint gets misread as
+ * several latin1 chars, then re-encoded as UTF-8 on the way out.
+ *
+ * `ByteString` is opaque (deliberately not assignable to/from `string`) so
+ * you cannot accidentally call string methods on it. The only ways out are
+ * `latin1FromBytes` (passthrough — stay byte-clean) and `decodeBytesToUtf8`
+ * (decode — process as text). Pick one explicitly per call site.
+ */
+declare const __byteString: unique symbol;
+export interface ByteString {
+    readonly [__byteString]: true;
+}
+/**
+ * Tag a latin1 byte buffer (each char = one byte) as a `ByteString`. Use at
+ * the pipeline edge: `cmdCtx.stdin = unsafeBytesFromLatin1(prevStdout)`.
+ * Avoid inside command implementations.
+ */
+export declare function unsafeBytesFromLatin1(s: string): ByteString;
+/**
+ * Reveal the underlying latin1 byte buffer. Use when a command intentionally
+ * forwards bytes unchanged (cat, head, tee, base64 -d, gzip, ...). Calling
+ * regex / parse / `.length-as-chars` on the result re-introduces the
+ * mojibake bug — if you need text, use `decodeBytesToUtf8` instead.
+ */
+export declare function latin1FromBytes(b: ByteString): string;
+/**
+ * Decode a `ByteString` as UTF-8. Use when a command interprets stdin as
+ * text (jq, sed, grep, awk, ...). Returns proper Unicode where multibyte
+ * codepoints occupy a single JS char, so regex and parsers work correctly.
+ *
+ * Falls back to the raw latin1 view if the bytes are not valid UTF-8 (e.g.
+ * a binary stream piped into grep). Callers that want hard failure on
+ * invalid UTF-8 should encode + decode manually with `{ fatal: true }`.
+ */
+export declare function decodeBytesToUtf8(b: ByteString): string;
+/**
+ * UTF-8 encode `s` (treating every char as a Unicode codepoint) into a
+ * `ByteString`. Use at sites that *know* their input is decoded Unicode
+ * text and need to emit it back as bytes — typically the inverse of an
+ * earlier `decodeBytesToUtf8` call inside the same command.
+ */
+export declare function encodeUtf8ToBytes(s: string): ByteString;
+/** The empty `ByteString`. */
+export declare const EMPTY_BYTES: ByteString;
+/**
+ * Convert a `Uint8Array` to a `ByteString`. Each byte becomes one char.
+ * The reverse is `Uint8Array.from(latin1FromBytes(b), (c) => c.charCodeAt(0))`.
+ */
+export declare function bytesFromUint8Array(buf: Uint8Array): ByteString;
+/**
+ * Read a file's raw bytes from any `IFileSystem`. Prefers the optional
+ * {@link IFileSystem.readFileBytes} method (built-in filesystems implement
+ * it natively), falling back to {@link IFileSystem.readFileBuffer} +
+ * conversion for external/custom filesystems written before
+ * `readFileBytes` existed. Use this from internal commands instead of
+ * calling `fs.readFileBytes` directly so user-supplied filesystems keep
+ * working.
+ */
+export declare function readBytesFrom(fs: {
+    readFileBytes?(path: string): Promise<ByteString>;
+    readFileBuffer(path: string): Promise<Uint8Array>;
+}, path: string): Promise<ByteString>;
+/** Either-or shape of a command's `stdout`. */
+export type OutputKind = "text" | "bytes";
+/**
+ * Read the explicit shape of a command's stdout. Falls back to the legacy
+ * `stdoutEncoding === "binary"` flag for results produced before the
+ * `stdoutKind` field existed; defaults to `"text"` otherwise.
+ */
+export declare function stdoutKind(result: {
+    stdoutKind?: OutputKind;
+    stdoutEncoding?: "binary";
+}): OutputKind;
+/**
+ * Coerce a command's stdout to a `ByteString` for the byte-shaped pipe.
+ * Text gets UTF-8 encoded once (codepoints → bytes); bytes pass through.
+ */
+export declare function stdoutAsBytes(result: {
+    stdout: string;
+    stdoutKind?: OutputKind;
+    stdoutEncoding?: "binary";
+}): ByteString;
+/**
+ * Build an `ExecResult`-shaped object whose stdout is decoded text. Sets
+ * `stdoutKind: "text"` so the pipe knows to UTF-8 encode it on handoff
+ * and redirects know to write it as UTF-8. Use for command authors that
+ * decode their input and emit Unicode text — they no longer have to
+ * manually re-encode for downstream byte consumers.
+ */
+export declare function textOutput(data: string): {
+    stdout: string;
+    stdoutKind: "text";
+};
+/**
+ * Build an `ExecResult`-shaped object whose stdout is a latin1 byte view.
+ * Sets both `stdoutKind: "bytes"` (new contract) and `stdoutEncoding:
+ * "binary"` (legacy alias) so older code paths keep working through the
+ * migration. Use for command authors that emit raw bytes (cat, gzip,
+ * tar, base64 -d, ...).
+ */
+export declare function bytesOutput(data: ByteString): {
+    stdout: string;
+    stdoutKind: "bytes";
+    stdoutEncoding: "binary";
+};
+export {};

package/dist/fs/in-memory-fs/in-memory-fs.d.ts

@@ -1,3 +1,4 @@
+import { type ByteString } from "../../encoding.js";
 import type { BufferEncoding, CpOptions, DirectoryEntry, DirentEntry, FileContent, FileEntry, FsEntry, FsStat, IFileSystem, InitialFiles, LazyFileEntry, MkdirOptions, ReadFileOptions, RmOptions, SymlinkEntry, WriteFileOptions } from "../interface.js";
 export type { BufferEncoding, FileContent, FileEntry, LazyFileEntry, DirectoryEntry, SymlinkEntry, FsEntry, FsStat, IFileSystem, };
 export interface FsData {
@@ -25,6 +26,7 @@ export declare class InMemoryFs implements IFileSystem {
      */
     private materializeLazy;
     readFile(path: string, options?: ReadFileOptions | BufferEncoding): Promise<string>;
+    readFileBytes(path: string): Promise<ByteString>;
     readFileBuffer(path: string): Promise<Uint8Array>;
     writeFile(path: string, content: FileContent, options?: WriteFileOptions | BufferEncoding): Promise<void>;
     appendFile(path: string, content: FileContent, options?: WriteFileOptions | BufferEncoding): Promise<void>;

package/dist/fs/interface.d.ts

@@ -1,3 +1,4 @@
+import type { ByteString } from "../encoding.js";
 /**
  * Supported buffer encodings
  */
@@ -94,10 +95,31 @@ export interface CpOptions {
  */
 export interface IFileSystem {
     /**
-     * Read the contents of a file as a string (default: utf8)
+     * Read the contents of a file as decoded text. Default encoding is utf8;
+     * pass an explicit text encoding (`"ascii"`, etc.) to override.
+     *
+     * For raw bytes (encoding `"binary"` / `"latin1"`), use {@link readFileBytes}
+     * — the opaque return type forces callers to decide whether to forward
+     * bytes unchanged or decode as text.
+     *
      * @throws Error if file doesn't exist or is a directory
      */
     readFile(path: string, options?: ReadFileOptions | BufferEncoding): Promise<string>;
+    /**
+     * Read the raw bytes of a file as a {@link ByteString} (latin1-shaped: each
+     * char = one byte). Use when the bytes will be piped onward unchanged or
+     * explicitly decoded with `decodeBytesToUtf8` — never call string methods
+     * on the result, that's the bug class this type prevents.
+     *
+     * Optional for backwards compatibility with external `IFileSystem`
+     * implementations written before this method existed; built-in
+     * filesystems all implement it. Internal callers must route through the
+     * `readBytesFrom(fs, path)` helper, which falls back to `readFileBuffer`
+     * when this method is missing.
+     *
+     * @throws Error if file doesn't exist or is a directory
+     */
+    readFileBytes?(path: string): Promise<ByteString>;
     /**
      * Read the contents of a file as a Uint8Array (binary)
      * @throws Error if file doesn't exist or is a directory

package/dist/fs/mountable-fs/mountable-fs.d.ts

@@ -1,3 +1,4 @@
+import { type ByteString } from "../../encoding.js";
 import type { BufferEncoding, CpOptions, FileContent, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
 /**
  * Configuration for a mount point
@@ -80,6 +81,7 @@ export declare class MountableFs implements IFileSystem {
      */
     private getChildMountPoints;
     readFile(path: string, options?: ReadFileOptions | BufferEncoding): Promise<string>;
+    readFileBytes(path: string): Promise<ByteString>;
     readFileBuffer(path: string): Promise<Uint8Array>;
     writeFile(path: string, content: FileContent, options?: WriteFileOptions | BufferEncoding): Promise<void>;
     appendFile(path: string, content: FileContent, options?: WriteFileOptions | BufferEncoding): Promise<void>;

package/dist/fs/overlay-fs/overlay-fs.d.ts

@@ -10,6 +10,7 @@
  * canonical path for I/O (closing the TOCTOU gap). New methods must use these
  * gates — never access the real FS directly.
  */
+import { type ByteString } from "../../encoding.js";
 import { type FileContent } from "../encoding.js";
 import type { CpOptions, DirentEntry, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
 export interface OverlayFsOptions {
@@ -106,6 +107,7 @@ export declare class OverlayFs implements IFileSystem {
      */
     private existsInOverlay;
     readFile(path: string, options?: ReadFileOptions | BufferEncoding): Promise<string>;
+    readFileBytes(path: string): Promise<ByteString>;
     readFileBuffer(path: string, seen?: Set<string>): Promise<Uint8Array>;
     writeFile(path: string, content: FileContent, options?: WriteFileOptions | BufferEncoding): Promise<void>;
     appendFile(path: string, content: FileContent, options?: WriteFileOptions | BufferEncoding): Promise<void>;

package/dist/fs/read-write-fs/read-write-fs.d.ts

@@ -10,6 +10,7 @@
  * are allowed, targets are validated and transformed to stay within root.
  * New methods must use these gates — never access the real FS directly.
  */
+import { type ByteString } from "../../encoding.js";
 import { type FileContent } from "../encoding.js";
 import type { CpOptions, DirentEntry, FsStat, IFileSystem, MkdirOptions, ReadFileOptions, RmOptions, WriteFileOptions } from "../interface.js";
 export interface ReadWriteFsOptions {
@@ -56,6 +57,7 @@ export declare class ReadWriteFs implements IFileSystem {
      */
     private toRealPath;
     readFile(path: string, options?: ReadFileOptions | BufferEncoding): Promise<string>;
+    readFileBytes(path: string): Promise<ByteString>;
     readFileBuffer(path: string): Promise<Uint8Array>;
     writeFile(path: string, content: FileContent, options?: WriteFileOptions | BufferEncoding): Promise<void>;
     appendFile(path: string, content: FileContent, options?: WriteFileOptions | BufferEncoding): Promise<void>;

package/dist/index.d.cts

@@ -5,6 +5,8 @@ export type { AllCommandName, CommandName, JavaScriptCommandName, NetworkCommand
 export { getCommandNames, getJavaScriptCommandNames, getNetworkCommandNames, getPythonCommandNames, } from "./commands/registry.js";
 export type { CustomCommand, LazyCommand } from "./custom-commands.js";
 export { defineCommand } from "./custom-commands.js";
+export type { ByteString, OutputKind } from "./encoding.js";
+export { bytesOutput, decodeBytesToUtf8, EMPTY_BYTES, encodeUtf8ToBytes, latin1FromBytes, stdoutAsBytes, stdoutKind, textOutput, unsafeBytesFromLatin1, } from "./encoding.js";
 export { InMemoryFs } from "./fs/in-memory-fs/index.js";
 export type { BufferEncoding, CpOptions, DirectoryEntry, FileContent, FileEntry, FileInit, FileSystemFactory, FsEntry, FsStat, InitialFiles, LazyFileEntry, LazyFileProvider, MkdirOptions, RmOptions, SymlinkEntry, } from "./fs/interface.js";
 export { MountableFs, type MountableFsOptions, type MountConfig, } from "./fs/mountable-fs/index.js";

package/dist/index.d.ts

@@ -5,6 +5,8 @@ export type { AllCommandName, CommandName, JavaScriptCommandName, NetworkCommand
 export { getCommandNames, getJavaScriptCommandNames, getNetworkCommandNames, getPythonCommandNames, } from "./commands/registry.js";
 export type { CustomCommand, LazyCommand } from "./custom-commands.js";
 export { defineCommand } from "./custom-commands.js";
+export type { ByteString, OutputKind } from "./encoding.js";
+export { bytesOutput, decodeBytesToUtf8, EMPTY_BYTES, encodeUtf8ToBytes, latin1FromBytes, stdoutAsBytes, stdoutKind, textOutput, unsafeBytesFromLatin1, } from "./encoding.js";
 export { InMemoryFs } from "./fs/in-memory-fs/index.js";
 export type { BufferEncoding, CpOptions, DirectoryEntry, FileContent, FileEntry, FileInit, FileSystemFactory, FsEntry, FsStat, InitialFiles, LazyFileEntry, LazyFileProvider, MkdirOptions, RmOptions, SymlinkEntry, } from "./fs/interface.js";
 export { MountableFs, type MountableFsOptions, type MountConfig, } from "./fs/mountable-fs/index.js";

package/dist/interpreter/interpreter.d.ts

@@ -41,8 +41,8 @@ export interface InterpreterOptions {
     requireDefenseContext?: boolean;
     /** Bootstrap JavaScript code for js-exec */
     jsBootstrapCode?: string;
-    /** Tool invoker for executor mode (js-exec) */
-    executorInvokeTool?: (path: string, argsJson: string) => Promise<string>;
+    /** Tool invoker hook for js-exec's `tools` proxy */
+    invokeTool?: (path: string, argsJson: string) => Promise<string>;
 }
 export declare class Interpreter {
     private ctx;

package/dist/interpreter/types.d.ts

@@ -342,8 +342,8 @@ export interface InterpreterContext {
      */
     jsBootstrapCode?: string;
     /**
-     * Tool invoker for executor mode (js-exec).
-     * When present, js-exec sets up a `tools` proxy.
+     * Tool invoker hook. When present, js-exec sets up a `tools` proxy that
+     * routes calls through this callback.
      */
-    executorInvokeTool?: (path: string, argsJson: string) => Promise<string>;
+    invokeTool?: (path: string, argsJson: string) => Promise<string>;
 }

package/dist/network/dns-pin.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Pin DNS resolution for the actual fetch to the IPs that were validated
+ * by the preflight private-range check, defeating DNS rebinding.
+ *
+ * How it works:
+ * - `dns.lookup` is monkey-patched once globally to consult an
+ *   AsyncLocalStorage store. When called inside a `pinDns(...)` async
+ *   context for the same hostname, it returns the pre-validated address
+ *   without performing any network DNS query.
+ * - Calls outside any pinning context (or for a different hostname)
+ *   are delegated to the original `dns.lookup`.
+ *
+ * Why `dns.lookup` and not `dns.promises.lookup`:
+ * - Node's `net.connect`/`tls.connect` (used by undici under `globalThis.fetch`)
+ *   reads `dns.lookup` at call time and uses the callback form.
+ * - We do not patch the promises form because it's not on the connect path.
+ *
+ * Browser builds: this module is imported transitively from `fetch.ts`
+ * (re-exported via `just-bash/browser`). `node:dns` is aliased to a
+ * stub by the browser build, but `node:async_hooks` cannot be aliased
+ * via a static import. We therefore lazy-load both via `require()`
+ * inside an `IS_BROWSER === false` guard so esbuild can dead-code
+ * eliminate the Node-only path. In the browser the exported `pinDns`
+ * is a passthrough that just runs the callback (the preflight that
+ * would have produced a `PinnedAddress` always throws first because
+ * `node:dns` is unavailable, so the passthrough is unreachable).
+ */
+export interface PinnedAddress {
+    hostname: string;
+    address: string;
+    family: 4 | 6;
+}
+/**
+ * Run `fn` with `dns.lookup` for `pinned.hostname` resolving to
+ * `pinned.address`/`pinned.family`. Resolutions for other hostnames
+ * pass through to the original `dns.lookup`.
+ */
+export declare function pinDns<T>(pinned: PinnedAddress, fn: () => Promise<T>): Promise<T>;
+/**
+ * @internal Exposed for tests to verify the patched dns.lookup behaves
+ * correctly inside and outside a pinning context.
+ */
+export declare function _ensureDnsHookInstalled(): void;

package/dist/network/types.d.ts

@@ -119,7 +119,8 @@ export interface FetchResult {
     status: number;
     statusText: string;
     headers: Record<string, string>;
-    body: string;
+    /** Raw response bytes (never decoded as UTF-8 text). */
+    body: Uint8Array;
     url: string;
 }
 /**

package/dist/types.d.ts

@@ -1,3 +1,4 @@
+import type { ByteString } from "./encoding.js";
 import type { IFileSystem } from "./fs/interface.js";
 import type { ExecutionLimits } from "./limits.js";
 import type { SecureFetch } from "./network/index.js";
@@ -15,10 +16,25 @@ export interface ExecResult {
     /** The final environment variables after execution (only set by BashEnv.exec) */
     env?: Record<string, string>;
     /**
-     * Encoding hint for stdout content when writing to files via redirections.
-     * Set to "binary" by commands that produce binary output (e.g., cat, gzip)
-     * to prevent re-encoding of raw byte data as UTF-8.
-     * When not set, the redirect system uses UTF-8 for non-ASCII text.
+     * Explicit metadata for what shape `stdout` is in. The pipeline + redirect
+     * layers consult this instead of guessing from string contents:
+     *
+     *   - `"text"`: `stdout` is JS Unicode text. The pipeline UTF-8 encodes it
+     *     before handing it to the next command's stdin; redirects write it
+     *     as UTF-8.
+     *   - `"bytes"`: `stdout` is a latin1-shaped byte buffer (each char = one
+     *     byte). The pipeline forwards the bytes verbatim; redirects write
+     *     them as binary.
+     *
+     * Producers should set this via `textOutput()` / `bytesOutput()` from
+     * `encoding.ts` rather than poking the raw flag. Absent values fall back
+     * to the legacy `stdoutEncoding` heuristic for back-compat with older
+     * commands that haven't been migrated yet.
+     */
+    stdoutKind?: "text" | "bytes";
+    /**
+     * Legacy alias for `stdoutKind: "bytes"`. Older commands set this to
+     * `"binary"` to mark binary output. New code should prefer `stdoutKind`.
      */
     stdoutEncoding?: "binary";
 }
@@ -47,6 +63,17 @@ export interface CommandExecOptions {
      * Optional - if not provided, stdin will be empty.
      */
     stdin?: string;
+    /**
+     * Shape of {@link stdin}:
+     *   - `"text"` (default): JS Unicode text. UTF-8 encoded into bytes
+     *     before reaching the subcommand, so byte consumers (`wc -c`,
+     *     `base64`, `md5sum`) inside the script see real UTF-8 bytes.
+     *   - `"bytes"`: a latin1-shaped byte buffer (each char = one byte,
+     *     e.g. from `Buffer.from(...).toString("latin1")`). Forwarded
+     *     verbatim — useful for piping raw binary into commands like
+     *     `gzip -d`.
+     */
+    stdinKind?: "text" | "bytes";
     /**
      * Abort signal for cooperative cancellation.
      * When aborted, the interpreter stops executing at the next statement boundary.
@@ -106,8 +133,19 @@ export interface CommandContext {
      * In bash, only exported variables are passed to child processes.
      */
     exportedEnv?: Record<string, string>;
-    /** Standard input content */
-    stdin: string;
+    /**
+     * Standard input as a byte buffer. Opaque on purpose — see `encoding.ts`.
+     *
+     * Pipelines carry bytes (a previous command's stdout becomes this stdin).
+     * Choose a conversion at the use site:
+     *   - `latin1FromBytes(ctx.stdin)` to forward bytes unchanged (cat, head,
+     *     tee, base64 -d, gzip, ...).
+     *   - `decodeBytesToUtf8(ctx.stdin)` to interpret as UTF-8 text (jq, sed,
+     *     grep, awk, parsers, code execution, char-position math, ...).
+     * Mixing the two — calling string methods on a latin1 byte buffer that
+     * actually holds UTF-8 — is the bug class this type prevents.
+     */
+    stdin: ByteString;
     /**
      * Execution limits configuration.
      * Available when running commands via BashEnv interpreter.
@@ -183,11 +221,11 @@ export interface CommandContext {
      */
     jsBootstrapCode?: string;
     /**
-     * Tool invoker for executor mode (js-exec).
-     * When present, js-exec sets up a `tools` proxy that routes calls through this.
-     * The function receives (path, argsJson) and returns a JSON result string.
+     * Tool invoker hook. When present, js-exec sets up a `tools` proxy that
+     * routes calls through this callback. Receives `(path, argsJson)` and
+     * returns a JSON result string.
      */
-    executorInvokeTool?: (path: string, argsJson: string) => Promise<string>;
+    invokeTool?: (path: string, argsJson: string) => Promise<string>;
 }
 export interface Command {
     name: string;

package/dist/utils/file-reader.d.ts

@@ -4,6 +4,7 @@
  * Provides common patterns for reading from files or stdin,
  * including parallel batch reading for performance.
  */
+import { type ByteString } from "../encoding.js";
 import type { CommandContext, ExecResult } from "../types.js";
 export interface ReadFilesOptions {
     /** Command name for error messages */
@@ -18,8 +19,12 @@ export interface ReadFilesOptions {
 export interface FileContent {
     /** File name (or "-" for stdin, or "" if stdin with no files) */
     filename: string;
-    /** File content */
-    content: string;
+    /**
+     * File content as a byte buffer (latin1-shaped). Decode with
+     * `decodeBytesToUtf8` before regex/parsing/char-position math; pass through
+     * `latin1FromBytes` if forwarding bytes unchanged.
+     */
+    content: ByteString;
 }
 export interface ReadFilesResult {
     /** Successfully read files */
@@ -46,21 +51,23 @@ export interface ReadFilesResult {
  */
 export declare function readFiles(ctx: CommandContext, files: string[], options: ReadFilesOptions): Promise<ReadFilesResult>;
 /**
- * Read and concatenate all files into a single string.
+ * Read and concatenate all files into a single byte buffer.
  *
  * Useful for commands like sort and uniq that process all input together.
+ * Callers must `decodeBytesToUtf8` (text processing) or `latin1FromBytes`
+ * (byte passthrough) before using the content.
  *
  * @example
  * const result = await readAndConcat(ctx, files, { cmdName: "sort" });
  * if (!result.ok) return result.error;
- * const lines = result.content.split("\n");
+ * const lines = decodeBytesToUtf8(result.content).split("\n");
  */
 export declare function readAndConcat(ctx: CommandContext, files: string[], options: {
     cmdName: string;
     allowStdinMarker?: boolean;
 }): Promise<{
     ok: true;
-    content: string;
+    content: ByteString;
 } | {
     ok: false;
     error: ExecResult;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "just-bash",
-  "version": "2.15.0-executor.0",
+  "version": "3.0.0",
   "description": "A simulated bash environment with virtual filesystem",
   "repository": {
     "type": "git",
@@ -37,6 +37,7 @@
     "dist/*.d.cts",
     "dist/ast/*.d.ts",
     "dist/commands/**/*.d.ts",
+    "dist/commands/sqlite3/worker.js",
     "dist/fs/**/*.d.ts",
     "dist/interpreter/**/*.d.ts",
     "dist/network/**/*.d.ts",
@@ -44,8 +45,8 @@
     "dist/sandbox/*.d.ts",
     "dist/utils/*.d.ts",
     "vendor/cpython-emscripten/",
-    "vendor/executor/",
     "README.md",
+    "CHANGELOG.md",
     "dist/AGENTS.md"
   ],
   "bin": {
@@ -55,43 +56,10 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "rm -rf dist && tsc && pnpm build:lib && pnpm build:lib:cjs && pnpm build:browser && pnpm build:cli && pnpm build:shell && pnpm build:worker && pnpm build:clean && cp dist/index.d.ts dist/index.d.cts && sed '1,/^-->/d' AGENTS.npm.md > dist/AGENTS.md",
-    "build:clean": "find dist -name '*.test.js' -delete && find dist -name '*.test.d.ts' -delete",
-    "build:worker": "esbuild src/commands/python3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/python3/worker.js --external:../../../vendor/cpython-emscripten/* && cp src/commands/python3/worker.js dist/commands/python3/worker.js && mkdir -p dist/bin/chunks && cp src/commands/python3/worker.js dist/bin/chunks/worker.js && mkdir -p dist/bundle/chunks && cp src/commands/python3/worker.js dist/bundle/chunks/worker.js && esbuild src/commands/js-exec/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/js-exec/worker.js --external:quickjs-emscripten && cp src/commands/js-exec/worker.js dist/commands/js-exec/worker.js && cp src/commands/js-exec/worker.js dist/bin/chunks/js-exec-worker.js && cp src/commands/js-exec/worker.js dist/bundle/chunks/js-exec-worker.js",
-    "build:lib": "esbuild dist/index.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bundle --chunk-names=chunks/[name]-[hash] --external:diff --external:minimatch --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:compressjs --external:effect --external:@effect/platform --external:@effect/platform-node --external:../vendor/executor/*",
-    "build:lib:cjs": "esbuild dist/index.js --bundle --platform=node --format=cjs --minify --outfile=dist/bundle/index.cjs --external:diff --external:minimatch --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:compressjs --external:effect --external:@effect/platform --external:@effect/platform-node --external:../vendor/executor/*",
-    "build:browser": "esbuild dist/browser.js --bundle --platform=browser --format=esm --minify --outfile=dist/bundle/browser.js --external:diff --external:minimatch --external:sprintf-js --external:turndown --external:node:zlib --external:@mongodb-js/zstd --external:node-liblzma --external:compressjs --define:__BROWSER__=true --alias:node:dns=./src/shims/browser-unsupported.js",
-    "build:cli": "esbuild dist/cli/just-bash.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:compressjs --external:effect --external:@effect/platform --external:@effect/platform-node --external:../vendor/executor/*",
-    "build:shell": "esbuild dist/cli/shell.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin/shell --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:compressjs",
-    "prepublishOnly": "pnpm validate",
-    "validate": "pnpm lint && pnpm knip && pnpm typecheck &&  pnpm build && pnpm check:worker-sync && pnpm test:run && pnpm test:wasm && pnpm test:dist && pnpm test:examples",
-    "test:examples": "cd examples/cjs-consumer && pnpm install --no-frozen-lockfile && npx tsc --noEmit",
-    "typecheck": "tsc --noEmit",
-    "lint": "biome check . && pnpm lint:banned",
-    "check:worker-sync": "node scripts/check-worker-sync.js",
-    "lint:banned": "node scripts/check-banned-patterns.js",
-    "lint:fix": "biome check --write .",
-    "knip": "knip",
-    "test": "vitest",
-    "test:run": "vitest run --exclude src/security/fuzzing/ --exclude src/commands/python3/ --exclude src/commands/sqlite3/ --exclude src/commands/js-exec/ --exclude src/agent-examples/python-scripting.test.ts",
-    "test:dist": "vitest run src/cli/just-bash.bundle.test.ts",
-    "test:unit": "vitest run --config vitest.unit.config.ts",
-    "test:wasm": "vitest run --config vitest.wasm.config.ts",
-    "test:comparison": "vitest run --config vitest.comparison.config.ts",
-    "test:comparison:record": "RECORD_FIXTURES=1 vitest run --config vitest.comparison.config.ts",
-    "test:coverage": "vitest run --coverage",
-    "test:coverage:unit": "vitest run --config vitest.unit.config.ts --coverage",
-    "test:fuzz": "vitest run src/security/fuzzing/",
-    "test:fuzz:long": "FUZZ_RUNS=10000 vitest run src/security/fuzzing/",
-    "shell": "npx tsx src/cli/shell.ts",
-    "dev:exec": "npx tsx src/cli/exec.ts"
-  },
   "keywords": [],
   "author": "Malte and Claude",
   "license": "Apache-2.0",
   "devDependencies": {
-    "@biomejs/biome": "^2.3.10",
     "@types/ini": "^4.1.1",
     "@types/node": "^25.0.3",
     "@types/papaparse": "^5.5.2",
@@ -106,10 +74,9 @@
     "vitest": "^4.0.16"
   },
   "dependencies": {
-    "compressjs": "^1.0.3",
+    "seek-bzip": "^2.0.0",
     "diff": "^8.0.2",
-    "effect": "^3.21.0",
-    "fast-xml-parser": "^5.3.3",
+    "fast-xml-parser": "^5.7.3",
     "file-type": "^21.2.0",
     "ini": "^6.0.0",
     "minimatch": "^10.1.1",
@@ -127,5 +94,34 @@
     "@mongodb-js/zstd": "^7.0.0",
     "node-liblzma": "^2.0.3"
   },
-  "packageManager": "pnpm@8.15.9+sha512.499434c9d8fdd1a2794ebf4552b3b25c0a633abcee5bb15e7b5de90f32f47b513aca98cd5cfd001c31f0db454bc3804edccd578501e4ca293a6816166bbd9f81"
-}
+  "scripts": {
+    "build": "rm -rf dist && tsc && pnpm build:lib && pnpm build:lib:cjs && pnpm build:browser && pnpm build:cli && pnpm build:shell && pnpm build:worker && pnpm build:clean && cp dist/index.d.ts dist/index.d.cts && sed '1,/^-->/d' AGENTS.npm.md > dist/AGENTS.md",
+    "build:clean": "find dist -name '*.test.js' -delete && find dist -name '*.test.d.ts' -delete",
+    "build:worker": "esbuild src/commands/python3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/python3/worker.js --external:../../../vendor/cpython-emscripten/* && cp src/commands/python3/worker.js dist/commands/python3/worker.js && mkdir -p dist/bin/chunks && cp src/commands/python3/worker.js dist/bin/chunks/worker.js && mkdir -p dist/bundle/chunks && cp src/commands/python3/worker.js dist/bundle/chunks/worker.js && esbuild src/commands/js-exec/js-exec-worker.ts --bundle --platform=node --format=esm --outfile=src/commands/js-exec/js-exec-worker.js --external:quickjs-emscripten && cp src/commands/js-exec/js-exec-worker.js dist/commands/js-exec/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bin/chunks/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bundle/chunks/js-exec-worker.js && esbuild src/commands/sqlite3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/sqlite3/worker.js --external:sql.js && mkdir -p dist/commands/sqlite3 && cp src/commands/sqlite3/worker.js dist/commands/sqlite3/worker.js && cp src/commands/sqlite3/worker.js dist/bin/chunks/sqlite3-worker.js && cp src/commands/sqlite3/worker.js dist/bundle/chunks/sqlite3-worker.js",
+    "build:lib": "esbuild dist/index.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bundle --chunk-names=chunks/[name]-[hash] --external:diff --external:minimatch --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
+    "build:lib:cjs": "esbuild dist/index.js --bundle --platform=node --format=cjs --minify --outfile=dist/bundle/index.cjs --external:diff --external:minimatch --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
+    "build:browser": "esbuild dist/browser.js --bundle --platform=browser --format=esm --minify --outfile=dist/bundle/browser.js --external:diff --external:minimatch --external:sprintf-js --external:turndown --external:node:zlib --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --define:__BROWSER__=true --alias:node:dns=./src/shims/browser-unsupported.js",
+    "build:cli": "esbuild dist/cli/just-bash.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
+    "build:shell": "esbuild dist/cli/shell.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin/shell --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
+    "validate": "pnpm lint && pnpm knip && pnpm typecheck && pnpm build && pnpm check:worker-sync && pnpm test:run && pnpm test:wasm && pnpm test:dist",
+    "typecheck": "tsc --noEmit",
+    "lint": "pnpm lint:banned",
+    "check:worker-sync": "node scripts/check-worker-sync.js",
+    "lint:banned": "node scripts/check-banned-patterns.js",
+    "lint:fix": "pnpm --workspace-root lint:fix",
+    "knip": "knip",
+    "test": "vitest",
+    "test:run": "vitest run --exclude src/security/fuzzing/ --exclude src/commands/python3/ --exclude src/commands/sqlite3/ --exclude src/commands/js-exec/ --exclude src/agent-examples/python-scripting.test.ts",
+    "test:dist": "vitest run src/cli/just-bash.bundle.test.ts",
+    "test:unit": "vitest run --config vitest.unit.config.ts",
+    "test:wasm": "vitest run --config vitest.wasm.config.ts",
+    "test:comparison": "vitest run --config vitest.comparison.config.ts",
+    "test:comparison:record": "RECORD_FIXTURES=1 vitest run --config vitest.comparison.config.ts",
+    "test:coverage": "vitest run --coverage",
+    "test:coverage:unit": "vitest run --config vitest.unit.config.ts --coverage",
+    "test:fuzz": "vitest run src/security/fuzzing/",
+    "test:fuzz:long": "FUZZ_RUNS=10000 vitest run src/security/fuzzing/",
+    "shell": "npx tsx src/cli/shell.ts",
+    "dev:exec": "npx tsx src/cli/exec.ts"
+  }
+}

package/dist/bin/chunks/awk2-VTJMI54B.js

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-import{a,b}from"./chunk-SDLWFYVT.js";import"./chunk-4PRVMER6.js";import"./chunk-MO4RPBN2.js";import"./chunk-YU6OGPZR.js";import"./chunk-SE4C7FJY.js";import"./chunk-6KZRLMG3.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{a as awkCommand2,b as flagsForFuzzing};

package/dist/bin/chunks/base64-43M2R3GA.js

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-import{a,b}from"./chunk-GOJZHH3L.js";import"./chunk-JBABAK44.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{a as base64Command,b as flagsForFuzzing};

package/dist/bin/chunks/bash-6ZHZ6BX7.js

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-import{a,b,c,d}from"./chunk-GO6FXSC4.js";import"./chunk-4PRVMER6.js";import"./chunk-GTNBSMZR.js";import"./chunk-KGOUQS5A.js";export{a as bashCommand,c as flagsForFuzzing,b as shCommand,d as shFlagsForFuzzing};