just-bash 2.8.1 → 2.9.0

package/dist/Bash.d.ts

@@ -12,6 +12,7 @@ import { type CustomCommand } from "./custom-commands.js";
 import type { IFileSystem, InitialFiles } from "./fs/interface.js";
 import { type ExecutionLimits } from "./limits.js";
 import { type NetworkConfig } from "./network/index.js";
+import type { DefenseInDepthConfig } from "./security/types.js";
 import type { BashExecResult, Command, TraceCallback } from "./types.js";
 export type { ExecutionLimits } from "./limits.js";
 /**
@@ -99,6 +100,33 @@ export interface BashOptions {
      * Useful for identifying performance bottlenecks.
      */
     trace?: TraceCallback;
+    /**
+     * Defense-in-depth configuration.
+     *
+     * When enabled, monkey-patches dangerous JavaScript globals (Function, eval,
+     * setTimeout, process, etc.) during script execution to block potential
+     * escape vectors.
+     *
+     * IMPORTANT: This is a SECONDARY defense layer. It should never be relied
+     * upon as the primary security mechanism. The primary security comes from
+     * proper sandboxing, input validation, and architectural constraints.
+     *
+     * @example
+     * ```ts
+     * // Simple enable
+     * const bash = new Bash({ defenseInDepth: true });
+     *
+     * // With custom configuration
+     * const bash = new Bash({
+     *   defenseInDepth: {
+     *     enabled: true,
+     *     auditMode: false, // Set to true to log but not block
+     *     onViolation: (v) => console.warn('Violation:', v),
+     *   },
+     * });
+     * ```
+     */
+    defenseInDepth?: DefenseInDepthConfig | boolean;
 }
 export interface ExecOptions {
     /**
@@ -127,6 +155,7 @@ export declare class Bash {
     private sleepFn?;
     private traceFn?;
     private logger?;
+    private defenseInDepthConfig?;
     private state;
     constructor(options?: BashOptions);
     registerCommand(command: Command): void;