just-bash 2.7.2 → 2.8.0

package/README.md

@@ -283,7 +283,7 @@ pnpm shell --no-network
 
 ### Data Processing
 
-`jq` (JSON), `python3`/`python` (Python via Pyodide), `sqlite3` (SQLite), `xan` (CSV), `yq` (YAML/XML/TOML/CSV)
+`jq` (JSON), `python3`/`python` (Python via Pyodide; required opt-in), `sqlite3` (SQLite), `xan` (CSV), `yq` (YAML/XML/TOML/CSV)
 
 ### Compression & Archives
 
@@ -360,6 +360,24 @@ const env = new Bash({
 
 **Note:** The `curl` command only exists when network is configured. Without network configuration, `curl` returns "command not found".
 
+## Python Support
+
+Python support via Pyodide is opt-in due to additional security surface. Enable it explicitly, but be aware of the risk:
+
+```typescript
+const env = new Bash({
+  python: true,
+});
+
+// Execute Python code
+await env.exec('python3 -c "print(1 + 2)"');
+
+// Run Python scripts
+await env.exec('python3 script.py');
+```
+
+**Note:** The `python3` and `python` commands only exist when `python: true` is configured. Python is not available in browser environments.
+
 ## SQLite Support
 
 The `sqlite3` command uses sql.js (WASM-based SQLite) which is fully sandboxed and cannot access the real filesystem:

package/dist/Bash.d.ts

@@ -51,6 +51,12 @@ export interface BashOptions {
      * Network access is disabled by default - you must explicitly configure allowed URLs.
      */
     network?: NetworkConfig;
+    /**
+     * Enable python3/python commands.
+     * Python is disabled by default as it introduces additional security surface
+     * (arbitrary code execution via pyodide).
+     */
+    python?: boolean;
     /**
      * Optional list of command names to register.
      * If not provided, all built-in commands are available.