just-bash 3.0.3 → 3.2.0

package/dist/index.d.cts

@@ -3,8 +3,8 @@ export type { BashLogger, BashOptions, ExecOptions, JavaScriptConfig, } from "./
 export { Bash } from "./Bash.js";
 export type { AllCommandName, CommandName, JavaScriptCommandName, NetworkCommandName, PythonCommandName, } from "./commands/registry.js";
 export { getCommandNames, getJavaScriptCommandNames, getNetworkCommandNames, getPythonCommandNames, } from "./commands/registry.js";
-export type { CustomCommand, LazyCommand } from "./custom-commands.js";
-export { defineCommand } from "./custom-commands.js";
+export type { CommandContextOptions, CustomCommand, LazyCommand, } from "./custom-commands.js";
+export { createCommandContext, defineCommand, } from "./custom-commands.js";
 export type { ByteString, OutputKind } from "./encoding.js";
 export { bytesOutput, decodeBytesToUtf8, EMPTY_BYTES, encodeUtf8ToBytes, latin1FromBytes, stdoutAsBytes, stdoutKind, textOutput, unsafeBytesFromLatin1, } from "./encoding.js";
 export { InMemoryFs } from "./fs/in-memory-fs/index.js";
@@ -17,7 +17,7 @@ export { NetworkAccessDeniedError, RedirectNotAllowedError, TooManyRedirectsErro
 export { parse } from "./parser/parser.js";
 export type { CommandFinished as SandboxCommandFinished, OutputMessage, SandboxOptions, WriteFilesInput, } from "./sandbox/index.js";
 export { Command as SandboxCommand, Sandbox } from "./sandbox/index.js";
-export type { DefenseInDepthConfig, DefenseInDepthHandle, DefenseInDepthStats, SecurityViolation, SecurityViolationType, } from "./security/index.js";
+export type { DefenseInDepthConfig, DefenseInDepthHandle, DefenseInDepthStats, DefenseInDepthStatus, SecurityViolation, SecurityViolationType, } from "./security/index.js";
 export { createConsoleViolationCallback, DefenseInDepthBox, SecurityViolationError, SecurityViolationLogger, } from "./security/index.js";
 export { BashTransformPipeline } from "./transform/pipeline.js";
 export type { CommandCollectorMetadata } from "./transform/plugins/command-collector.js";
@@ -26,4 +26,4 @@ export type { TeeFileInfo, TeePluginMetadata, TeePluginOptions, } from "./transf
 export { TeePlugin } from "./transform/plugins/tee-plugin.js";
 export { serialize } from "./transform/serialize.js";
 export type { BashTransformResult, TransformContext, TransformPlugin, TransformResult, } from "./transform/types.js";
-export type { BashExecResult, Command, CommandContext, ExecResult, IFileSystem, } from "./types.js";
+export type { BashExecResult, Command, CommandContext, ExecResult, IFileSystem, ResolvedCommandContext, } from "./types.js";

package/dist/index.d.ts

@@ -3,8 +3,8 @@ export type { BashLogger, BashOptions, ExecOptions, JavaScriptConfig, } from "./
 export { Bash } from "./Bash.js";
 export type { AllCommandName, CommandName, JavaScriptCommandName, NetworkCommandName, PythonCommandName, } from "./commands/registry.js";
 export { getCommandNames, getJavaScriptCommandNames, getNetworkCommandNames, getPythonCommandNames, } from "./commands/registry.js";
-export type { CustomCommand, LazyCommand } from "./custom-commands.js";
-export { defineCommand } from "./custom-commands.js";
+export type { CommandContextOptions, CustomCommand, LazyCommand, } from "./custom-commands.js";
+export { createCommandContext, defineCommand, } from "./custom-commands.js";
 export type { ByteString, OutputKind } from "./encoding.js";
 export { bytesOutput, decodeBytesToUtf8, EMPTY_BYTES, encodeUtf8ToBytes, latin1FromBytes, stdoutAsBytes, stdoutKind, textOutput, unsafeBytesFromLatin1, } from "./encoding.js";
 export { InMemoryFs } from "./fs/in-memory-fs/index.js";
@@ -17,7 +17,7 @@ export { NetworkAccessDeniedError, RedirectNotAllowedError, TooManyRedirectsErro
 export { parse } from "./parser/parser.js";
 export type { CommandFinished as SandboxCommandFinished, OutputMessage, SandboxOptions, WriteFilesInput, } from "./sandbox/index.js";
 export { Command as SandboxCommand, Sandbox } from "./sandbox/index.js";
-export type { DefenseInDepthConfig, DefenseInDepthHandle, DefenseInDepthStats, SecurityViolation, SecurityViolationType, } from "./security/index.js";
+export type { DefenseInDepthConfig, DefenseInDepthHandle, DefenseInDepthStats, DefenseInDepthStatus, SecurityViolation, SecurityViolationType, } from "./security/index.js";
 export { createConsoleViolationCallback, DefenseInDepthBox, SecurityViolationError, SecurityViolationLogger, } from "./security/index.js";
 export { BashTransformPipeline } from "./transform/pipeline.js";
 export type { CommandCollectorMetadata } from "./transform/plugins/command-collector.js";
@@ -26,4 +26,4 @@ export type { TeeFileInfo, TeePluginMetadata, TeePluginOptions, } from "./transf
 export { TeePlugin } from "./transform/plugins/tee-plugin.js";
 export { serialize } from "./transform/serialize.js";
 export type { BashTransformResult, TransformContext, TransformPlugin, TransformResult, } from "./transform/types.js";
-export type { BashExecResult, Command, CommandContext, ExecResult, IFileSystem, } from "./types.js";
+export type { BashExecResult, Command, CommandContext, ExecResult, IFileSystem, ResolvedCommandContext, } from "./types.js";

package/dist/interpreter/alias-expansion.d.ts

@@ -15,6 +15,10 @@ import type { SimpleCommandNode } from "../ast/types.js";
  */
 export interface AliasExpansionContext {
     env: Map<string, string>;
+    limits: {
+        maxCallDepth: number;
+        maxStringLength: number;
+    };
 }
 /**
  * Expand alias in a SimpleCommandNode if applicable.

package/dist/interpreter/builtins/declare-array-parsing.d.ts

@@ -3,12 +3,16 @@
  *
  * Handles parsing of array literal syntax for the declare builtin.
  */
+export interface ArrayParseLimits {
+    maxElements: number;
+    maxStringBytes: number;
+}
 /**
  * Parse array elements from content like "1 2 3" or "'a b' c d"
  */
-export declare function parseArrayElements(content: string): string[];
+export declare function parseArrayElements(content: string, limits?: ArrayParseLimits): string[];
 /**
  * Parse associative array literal content like "['foo']=bar ['spam']=42"
  * Returns array of [key, value] pairs
  */
-export declare function parseAssocArrayLiteral(content: string): [string, string][];
+export declare function parseAssocArrayLiteral(content: string, limits?: ArrayParseLimits): [string, string][];

package/dist/interpreter/builtins/index.d.ts

@@ -42,4 +42,3 @@ export { handleSet } from "./set.js";
 export { handleShift } from "./shift.js";
 export { handleSource } from "./source.js";
 export { handleUnset } from "./unset.js";
-export { getLocalVarDepth } from "./variable-assignment.js";

package/dist/interpreter/builtins/variable-assignment.d.ts

@@ -17,7 +17,10 @@ export interface ParsedAssignment {
 /**
  * Parse an assignment argument like "name=value", "name=(a b c)", or "name[index]=value".
  */
-export declare function parseAssignment(arg: string): ParsedAssignment;
+export declare function parseAssignment(arg: string, limits?: {
+    maxElements: number;
+    maxStringBytes: number;
+}): ParsedAssignment;
 /**
  * Options for setting a variable.
  */

package/dist/interpreter/conditionals.d.ts

@@ -14,4 +14,4 @@ import type { ExecResult } from "../types.js";
 import type { InterpreterContext } from "./types.js";
 export declare function evaluateConditional(ctx: InterpreterContext, expr: ConditionalExpressionNode): Promise<boolean>;
 export declare function evaluateTestArgs(ctx: InterpreterContext, args: string[]): Promise<ExecResult>;
-export declare function matchPattern(value: string, pattern: string, nocasematch?: boolean, extglob?: boolean): boolean;
+export declare function matchPattern(value: string, pattern: string, nocasematch?: boolean, extglob?: boolean, maxDepth?: number): boolean;

package/dist/interpreter/defense-aware-command-context.d.ts

@@ -1,6 +1,6 @@
-import type { CommandContext } from "../types.js";
+import type { RuntimeCommandContext } from "../types.js";
 /**
  * Wrap command context APIs so async boundaries are fail-closed if defense
  * context is expected but missing.
  */
-export declare function createDefenseAwareCommandContext(ctx: CommandContext, commandName: string): CommandContext;
+export declare function createDefenseAwareCommandContext(ctx: RuntimeCommandContext, commandName: string): RuntimeCommandContext;

package/dist/interpreter/errors.d.ts

@@ -1,23 +1,14 @@
-/**
- * Control Flow Errors
- *
- * Error classes used to implement shell control flow:
- * - break: Exit loops
- * - continue: Skip to next iteration
- * - return: Exit functions
- * - errexit: Exit on error (set -e)
- * - nounset: Error on unset variables (set -u)
- *
- * All control flow errors carry stdout/stderr to accumulate output
- * as they propagate through the execution stack.
- */
 /**
  * Base class for all control flow errors.
  * Carries stdout/stderr to preserve output during propagation.
  */
-declare abstract class ControlFlowError extends Error {
+export declare abstract class ControlFlowError extends Error {
     stdout: string;
     stderr: string;
+    internalOutputAccounting: {
+        stdout: number;
+        stderr: number;
+    };
     constructor(message: string, stdout?: string, stderr?: string);
     /**
      * Prepend output from the current context before re-throwing.
@@ -115,10 +106,10 @@ export declare class BraceExpansionError extends ControlFlowError {
  * Exit code 126 indicates a limit was exceeded.
  */
 export declare class ExecutionLimitError extends ControlFlowError {
-    readonly limitType: "recursion" | "commands" | "iterations" | "string_length" | "glob_operations" | "substitution_depth" | "output_size" | "file_descriptors";
+    readonly limitType: "recursion" | "commands" | "iterations" | "string_length" | "glob_operations" | "substitution_depth" | "output_size" | "array_elements" | "file_descriptors";
     readonly name = "ExecutionLimitError";
     static readonly EXIT_CODE = 126;
-    constructor(message: string, limitType: "recursion" | "commands" | "iterations" | "string_length" | "glob_operations" | "substitution_depth" | "output_size" | "file_descriptors", stdout?: string, stderr?: string);
+    constructor(message: string, limitType: "recursion" | "commands" | "iterations" | "string_length" | "glob_operations" | "substitution_depth" | "output_size" | "array_elements" | "file_descriptors", stdout?: string, stderr?: string);
 }
 /**
  * Error thrown when execution is aborted via an AbortSignal.
@@ -155,4 +146,3 @@ export declare class PosixFatalError extends ControlFlowError {
     readonly name = "PosixFatalError";
     constructor(exitCode: number, stdout?: string, stderr?: string);
 }
-export {};

package/dist/interpreter/expansion/brace-range.d.ts

@@ -4,6 +4,10 @@
  * Handles numeric {1..10} and character {a..z} range expansion.
  * These are pure functions with no external dependencies.
  */
+export interface BraceRangeLimits {
+    maxResults: number;
+    maxStringBytes: number;
+}
 /**
  * Result of a brace range expansion.
  * Either contains expanded values or a literal fallback for invalid ranges.
@@ -17,4 +21,4 @@ export interface BraceRangeResult {
  * Handles both numeric and character ranges, returning either expanded values
  * or a literal string for invalid ranges.
  */
-export declare function expandBraceRange(start: number | string, end: number | string, step: number | undefined, startStr?: string, endStr?: string): BraceRangeResult;
+export declare function expandBraceRange(start: number | string, end: number | string, step: number | undefined, startStr?: string, endStr?: string, limits?: BraceRangeLimits): BraceRangeResult;

package/dist/interpreter/expansion/pattern-removal.d.ts

@@ -8,11 +8,10 @@ import type { InterpreterContext } from "../types.js";
  * Apply pattern removal (prefix or suffix strip) to a single value.
  * Used by both scalar and vectorized array operations.
  */
-export declare function applyPatternRemoval(value: string, regexStr: string, side: "prefix" | "suffix", greedy: boolean): string;
+export declare function applyPatternRemoval(ctx: InterpreterContext, value: string, regexStr: string, side: "prefix" | "suffix", greedy: boolean): string;
 /**
  * Get variable names that match a given prefix.
  * Used for ${!prefix*} and ${!prefix@} expansions.
- * Handles arrays properly - includes array base names from __length markers,
- * excludes internal storage keys like arr_0, arr__length.
+ * Includes names from both the scalar and structured-array namespaces.
  */
 export declare function getVarNamesWithPrefix(ctx: InterpreterContext, prefix: string): string[];

package/dist/interpreter/expansion/pattern-replacement.d.ts

@@ -0,0 +1,4 @@
+import type { RegexLike } from "../../regex/index.js";
+import type { InterpreterContext } from "../types.js";
+/** Build a regex replacement prospectively without an unbounded host replace. */
+export declare function applyPatternReplacementBounded(ctx: InterpreterContext, value: string, regex: RegexLike, replacement: string, replaceAll: boolean): string;

package/dist/interpreter/expansion/tilde.d.ts

@@ -10,3 +10,5 @@ import type { InterpreterContext } from "../types.js";
  * Only expands ~ at the start of the string followed by / or end of string.
  */
 export declare function applyTildeExpansion(ctx: InterpreterContext, value: string): string;
+/** Apply assignment-context tilde expansion at the start and after each `:`. */
+export declare function applyAssignmentTildeExpansion(ctx: InterpreterContext, value: string): string;

package/dist/interpreter/helpers/array.d.ts

@@ -2,10 +2,23 @@
  * Array helper functions for the interpreter.
  */
 import type { WordNode } from "../../ast/types.js";
-import type { InterpreterContext } from "../types.js";
+import type { InterpreterContext, ShellArray } from "../types.js";
+export declare function cloneArray(array: ShellArray): ShellArray;
+export declare function cloneArrays(arrays: Map<string, ShellArray> | undefined): Map<string, ShellArray>;
+export declare function getArray(ctx: InterpreterContext, arrayName: string): ShellArray | undefined;
+export declare function ensureArray(ctx: InterpreterContext, arrayName: string, kind?: "indexed" | "associative"): ShellArray;
+export declare function setArrayKind(ctx: InterpreterContext, arrayName: string, kind: "indexed" | "associative"): ShellArray;
+export declare function hasArray(ctx: InterpreterContext, arrayName: string): boolean;
+export declare function getArrayElement(ctx: InterpreterContext, arrayName: string, key: string | number): string | undefined;
+export declare function hasArrayElement(ctx: InterpreterContext, arrayName: string, key: string | number): boolean;
+export declare function setArrayElement(ctx: InterpreterContext, arrayName: string, key: string | number, value: string, kind?: "indexed" | "associative"): void;
+/** Prove a batch of distinct keys fits before any persistent mutation. */
+export declare function assertArrayKeysFit(ctx: InterpreterContext, arrayName: string, keys: Iterable<string | number>, replace?: boolean): void;
+export declare function deleteArrayElement(ctx: InterpreterContext, arrayName: string, key: string | number): boolean;
+export declare function deleteArray(ctx: InterpreterContext, arrayName: string): void;
 /**
  * Get all indices of an array, sorted in ascending order.
- * Arrays are stored as `name_0`, `name_1`, etc. in the environment.
+ * Indexed arrays are held in dedicated structured interpreter state.
  */
 export declare function getArrayIndices(ctx: InterpreterContext, arrayName: string): number[];
 /**
@@ -14,7 +27,7 @@ export declare function getArrayIndices(ctx: InterpreterContext, arrayName: stri
 export declare function clearArray(ctx: InterpreterContext, arrayName: string): void;
 /**
  * Get all keys of an associative array.
- * For associative arrays, keys are stored as `name_key` where key is a string.
+ * Associative keys are retained exactly in the array element map.
  */
 export declare function getAssocArrayKeys(ctx: InterpreterContext, arrayName: string): string[];
 /**

package/dist/interpreter/helpers/bounded-array.d.ts

@@ -0,0 +1,2 @@
+/** Append untrusted collections without argument spreading and with a cumulative cap. */
+export declare function appendBoundedElements<T>(target: T[], values: readonly T[], maximum: number, site: string): void;

package/dist/interpreter/helpers/condition.d.ts

@@ -5,12 +5,9 @@
  * Used by if, while, and until loops.
  */
 import type { StatementNode } from "../../ast/types.js";
+import type { ExecResult } from "../../types.js";
 import type { InterpreterContext } from "../types.js";
-export interface ConditionResult {
-    stdout: string;
-    stderr: string;
-    exitCode: number;
-}
+export type ConditionResult = Pick<ExecResult, "stdout" | "stderr" | "exitCode" | "internalOutputAccounting">;
 /**
  * Execute condition statements with inCondition flag set.
  * This prevents errexit from triggering during condition evaluation.

package/dist/interpreter/helpers/ifs.d.ts

@@ -47,7 +47,7 @@ export declare function getIfsSeparator(env: Map<string, string>): string;
  * @param raw - If true, backslash escaping is disabled (like read -r)
  * @returns Object with words array and wordStarts array
  */
-export declare function splitByIfsForRead(value: string, ifs: string, maxSplit?: number, raw?: boolean): {
+export declare function splitByIfsForRead(value: string, ifs: string, maxArrayElements: number, maxSplit?: number, raw?: boolean): {
     words: string[];
     wordStarts: number[];
 };
@@ -79,8 +79,8 @@ export interface IfsExpansionSplitResult {
  * For example, in `-$x-` where `x='a b c '`, the trailing space means the final `-`
  * should become a separate word, not join with `c`.
  */
-export declare function splitByIfsForExpansionEx(value: string, ifs: string): IfsExpansionSplitResult;
-export declare function splitByIfsForExpansion(value: string, ifs: string): string[];
+export declare function splitByIfsForExpansionEx(value: string, ifs: string, maxArrayElements: number): IfsExpansionSplitResult;
+export declare function splitByIfsForExpansion(value: string, ifs: string, maxArrayElements: number): string[];
 /**
  * Strip trailing IFS from the last variable in read builtin.
  *

package/dist/interpreter/helpers/quoting.d.ts

@@ -11,11 +11,13 @@
  * - Single quotes for values with spaces or shell metacharacters
  * - $'...' quoting for values with control characters
  */
+export declare function quotedValueByteLength(value: string): number;
 export declare function quoteValue(value: string): string;
 /**
  * Quote a value for array element output
  * Uses $'...' for control characters, double quotes otherwise
  */
+export declare function quotedArrayValueByteLength(value: string): number;
 export declare function quoteArrayValue(value: string): string;
 /**
  * Quote a value for declare -p output

package/dist/interpreter/helpers/string-compare.d.ts

@@ -21,4 +21,4 @@ export declare function isStringCompareOp(op: string): op is StringCompareOp;
  * @param extglob - If true, enable extended glob patterns @(), *(), +(), ?(), !() (default: false)
  * @returns True if the comparison succeeds
  */
-export declare function compareStrings(op: StringCompareOp, left: string, right: string, usePattern?: boolean, nocasematch?: boolean, extglob?: boolean): boolean;
+export declare function compareStrings(op: StringCompareOp, left: string, right: string, usePattern?: boolean, nocasematch?: boolean, extglob?: boolean, maxPatternDepth?: number): boolean;

package/dist/interpreter/interpreter.d.ts

@@ -10,23 +10,19 @@
  * - Redirections (redirections.ts)
  */
 import type { ScriptNode } from "../ast/types.js";
+import type { ExecutionScope } from "../execution-scope.js";
 import type { IFileSystem } from "../fs/interface.js";
 import type { ExecutionLimits } from "../limits.js";
 import type { SecureFetch } from "../network/index.js";
 import type { CommandRegistry, ExecResult, FeatureCoverageWriter, TraceCallback } from "../types.js";
-import type { InterpreterState } from "./types.js";
+import type { InterpreterExecOptions, InterpreterState } from "./types.js";
 export type { InterpreterContext, InterpreterState } from "./types.js";
 export interface InterpreterOptions {
     fs: IFileSystem;
     commands: CommandRegistry;
     limits: Required<ExecutionLimits>;
-    exec: (script: string, options?: {
-        env?: Record<string, string>;
-        cwd?: string;
-        replaceEnv?: boolean;
-        signal?: AbortSignal;
-        args?: string[];
-    }) => Promise<ExecResult>;
+    executionScope: ExecutionScope;
+    exec: (script: string, options?: InterpreterExecOptions, stdinAlreadyAccounted?: boolean) => Promise<ExecResult>;
     /** Optional secure fetch function for network-enabled commands */
     fetch?: SecureFetch;
     /** Optional sleep function for testing with mock clocks */

package/dist/interpreter/redirections.d.ts

@@ -33,7 +33,7 @@ export declare function preExpandRedirectTargets(ctx: InterpreterContext, redire
  * This allocates FDs and sets variables before command execution.
  * Returns an error result if there's an issue, or null if successful.
  */
-export declare function processFdVariableRedirections(ctx: InterpreterContext, redirections: RedirectionNode[]): Promise<ExecResult | null>;
+export declare function processFdVariableRedirections(ctx: InterpreterContext, redirections: RedirectionNode[], preExpandedTargets?: ExpandedRedirectTargets): Promise<ExecResult | null>;
 /**
  * Pre-open (truncate) output redirect files before command execution.
  * This is needed for compound commands (subshell, for, case, [[) where
@@ -47,5 +47,8 @@ export declare function processFdVariableRedirections(ctx: InterpreterContext, r
  * Returns an error result if there's an issue (like directory or noclobber),
  * or null if pre-opening succeeded.
  */
-export declare function preOpenOutputRedirects(ctx: InterpreterContext, redirections: RedirectionNode[]): Promise<ExecResult | null>;
+export declare function preOpenOutputRedirects(ctx: InterpreterContext, redirections: RedirectionNode[]): Promise<{
+    targets: ExpandedRedirectTargets;
+    error: ExecResult | null;
+}>;
 export declare function applyRedirections(ctx: InterpreterContext, result: ExecResult, redirections: RedirectionNode[], preExpandedTargets?: ExpandedRedirectTargets): Promise<ExecResult>;

package/dist/interpreter/simple-command-assignments.d.ts

@@ -27,3 +27,10 @@ export interface AssignmentResult {
  * Returns assignment results including temp bindings and any errors.
  */
 export declare function processAssignments(ctx: InterpreterContext, node: SimpleCommandNode): Promise<AssignmentResult>;
+/**
+ * Compute the index for an indexed array subscript
+ */
+export declare function computeIndexedArrayIndex(ctx: InterpreterContext, arrayName: string, subscriptExpr: string): Promise<{
+    index: number;
+    error?: ExecResult;
+}>;

package/dist/interpreter/state-transaction.d.ts

@@ -0,0 +1,7 @@
+import type { InterpreterState } from "./types.js";
+/**
+ * Install an isolated copy of mutable shell namespace state and return an
+ * idempotent rollback. Process-wide accounting and PID allocation deliberately
+ * remain shared with the parent execution.
+ */
+export declare function beginIsolatedShellState(state: InterpreterState): () => void;

package/dist/interpreter/types.d.ts

@@ -2,10 +2,14 @@
  * Interpreter Types
  */
 import type { CommandNode, FunctionDefNode, ScriptNode, StatementNode } from "../ast/types.js";
+import type { ExecutionScope } from "../execution-scope.js";
 import type { IFileSystem } from "../fs/interface.js";
 import type { ExecutionLimits } from "../limits.js";
 import type { SecureFetch } from "../network/index.js";
-import type { CommandRegistry, ExecResult, FeatureCoverageWriter, TraceCallback } from "../types.js";
+import type { CommandExecOptions, CommandRegistry, ExecResult, FeatureCoverageWriter, TraceCallback } from "../types.js";
+export type InterpreterExecOptions = Omit<CommandExecOptions, "cwd"> & {
+    cwd?: string;
+};
 /**
  * Completion specification for a command, set by the `complete` builtin.
  */
@@ -127,6 +131,8 @@ export interface VariableAttributeState {
 export interface LocalScopingState {
     /** Stack of local variable scopes (one Map per function call) */
     localScopes: Map<string, string | undefined>[];
+    /** Whole-array snapshots parallel to localScopes. */
+    localArrayScopes?: Map<string, ShellArray | undefined>[];
     /**
      * Tracks at which call depth each local variable was declared.
      * Used for bash-specific unset scoping behavior:
@@ -271,6 +277,12 @@ export interface ExpansionState {
 export interface InterpreterState extends VariableAttributeState, LocalScopingState, CallStackState, ControlFlowState, ProcessState, IOState, ExpansionState {
     /** Environment variables (exported to commands) - uses Map to prevent prototype pollution */
     env: Map<string, string>;
+    /**
+     * Array values live outside the scalar environment namespace.  Shell names such
+     * as `a_0` and `a__length` are valid scalar variables and must never alias an
+     * element or interpreter metadata.
+     */
+    arrays?: Map<string, ShellArray>;
     /** Current working directory */
     cwd: string;
     /** Previous directory (for `cd -`) */
@@ -287,6 +299,10 @@ export interface InterpreterState extends VariableAttributeState, LocalScopingSt
     shoptOptions: ShoptOptions;
     /** Completion specifications set by the `complete` builtin */
     completionSpecs?: Map<string, CompletionSpec>;
+    /** Default completion policy (-D), kept outside the user command namespace. */
+    defaultCompletionSpec?: CompletionSpec;
+    /** Empty-line completion policy (-E), kept outside the user command namespace. */
+    emptyCompletionSpec?: CompletionSpec;
     /** Directory stack for pushd/popd/dirs */
     directoryStack?: string[];
     /** Hash table for PATH command lookup caching */
@@ -305,19 +321,19 @@ export interface InterpreterState extends VariableAttributeState, LocalScopingSt
     /** Extra arguments injected via exec({ args }), appended to first command's args */
     extraArgs?: string[];
 }
+export interface ShellArray {
+    kind: "indexed" | "associative";
+    elements: Map<string, string>;
+}
 export interface InterpreterContext {
     state: InterpreterState;
     fs: IFileSystem;
     commands: CommandRegistry;
     /** Execution limits configuration */
     limits: Required<ExecutionLimits>;
-    execFn: (script: string, options?: {
-        env?: Record<string, string>;
-        cwd?: string;
-        replaceEnv?: boolean;
-        signal?: AbortSignal;
-        args?: string[];
-    }) => Promise<ExecResult>;
+    /** Shared security accounting for this top-level execution and descendants. */
+    executionScope: ExecutionScope;
+    execFn: (script: string, options?: InterpreterExecOptions, stdinAlreadyAccounted?: boolean) => Promise<ExecResult>;
     executeScript: (node: ScriptNode) => Promise<ExecResult>;
     executeStatement: (node: StatementNode) => Promise<ExecResult>;
     executeCommand: (node: CommandNode, stdin: string) => Promise<ExecResult>;

package/dist/limits.d.ts

@@ -9,44 +9,103 @@
  * All limits are optional - undefined values use defaults.
  */
 export interface ExecutionLimits {
-    /** Maximum function call/recursion depth (default: 100) */
+    /** Maximum shell source bytes accepted before parsing (normal default: 64 MiB) */
+    maxSourceBytes?: number;
+    /** Maximum nested interpreter executions through ctx.exec (default: 64) */
+    maxExecDepth?: number;
+    /** Maximum function call/recursion depth (normal default: 100) */
     maxCallDepth?: number;
-    /** Maximum number of commands to execute (default: 10000) */
+    /** Maximum number of commands to execute (normal default: 100000) */
     maxCommandCount?: number;
-    /** Maximum loop iterations for bash while/for/until loops (default: 10000) */
+    /** Maximum loop iterations for bash while/for/until loops (normal default: 100000) */
     maxLoopIterations?: number;
-    /** Maximum loop iterations for AWK while/for loops (default: 10000) */
+    /** Maximum loop iterations for AWK while/for loops (normal default: 100000) */
     maxAwkIterations?: number;
-    /** Maximum command iterations for SED (branch loops) (default: 10000) */
+    /** Maximum command iterations for SED branch loops (normal default: 100000) */
     maxSedIterations?: number;
-    /** Maximum iterations for jq loops (until, while, repeat) (default: 10000) */
+    /** Maximum iterations for jq loops (normal default: 100000) */
     maxJqIterations?: number;
-    /** Maximum sqlite3 query execution time in milliseconds (default: 5000) */
+    /** Maximum jq/yq parser tokens (default: 100000) */
+    maxQueryTokens?: number;
+    /** Maximum jq/yq object/query traversal depth (default: 1000) */
+    maxQueryDepth?: number;
+    /** Maximum jq/yq result elements (default: 1000000) */
+    maxQueryElements?: number;
+    /** Maximum AWK parser tokens (default: 100000) */
+    maxAwkParserTokens?: number;
+    /** Maximum AWK parser nesting depth (default: 256) */
+    maxAwkParserDepth?: number;
+    /** Maximum AWK parser operations (default: 1000000) */
+    maxAwkParserOperations?: number;
+    /** Maximum parsed CSV rows (default: 1000000) */
+    maxCsvRows?: number;
+    /** Maximum parsed CSV cells (default: 10000000) */
+    maxCsvCells?: number;
+    /** Aggregate execution work units shared across nested execution (default: 1000000) */
+    maxWorkUnits?: number;
+    /** Maximum filesystem entries visited by one traversal (default: 1000000) */
+    maxTraversalEntries?: number;
+    /** Maximum filesystem traversal nesting depth (default: 1000) */
+    maxTraversalDepth?: number;
+    /** Maximum filesystem traversal operations (default: 1000000) */
+    maxTraversalWork?: number;
+    /** Maximum reserved live/intermediate bytes (default: 512 MiB) */
+    maxLiveBytes?: number;
+    /** Maximum aggregate input bytes (default: 512 MiB) */
+    maxInputBytes?: number;
+    /** Maximum bytes retained by Bash's default in-memory filesystem (default: 1 GiB) */
+    maxFileSystemBytes?: number;
+    /** Maximum SQLite database image bytes (default: 1 GiB) */
+    maxDatabaseBytes?: number;
+    /** Maximum SQLite result bytes before output formatting (default: 256 MiB) */
+    maxDatabaseResultBytes?: number;
+    /** Maximum aggregate expanded archive bytes (default: 1 GiB) */
+    maxArchiveBytes?: number;
+    /** Maximum compressed archive input bytes (default: 512 MiB) */
+    maxArchiveCompressedBytes?: number;
+    /** Maximum bytes in one archive entry (default: 512 MiB) */
+    maxArchiveEntryBytes?: number;
+    /** Maximum archive entries (default: 1000000) */
+    maxArchiveEntries?: number;
+    /** Maximum worker request or response payload bytes (default: 64 MiB) */
+    maxWorkerMessageBytes?: number;
+    /** Maximum top-level execution wall time in milliseconds (default: 1 hour) */
+    maxExecutionTimeMs?: number;
+    /**
+     * Maximum time to let an aborted command acknowledge cancellation before its
+     * execution context is revoked (normal default: 100ms).
+     */
+    maxExtensionCleanupTimeMs?: number;
+    /** Maximum sqlite3 query execution time in milliseconds (normal default: 30000) */
     maxSqliteTimeoutMs?: number;
-    /** Maximum Python execution time in milliseconds (default: 10000, or 60000 with network) */
+    /** Maximum Python execution time in milliseconds (normal default: 30000) */
     maxPythonTimeoutMs?: number;
-    /** Maximum JavaScript (js-exec) execution time in milliseconds (default: 10000, or 60000 with network) */
+    /** Maximum JavaScript execution time in milliseconds (normal default: 30000) */
     maxJsTimeoutMs?: number;
-    /** Maximum glob filesystem operations (default: 100000) */
+    /** Maximum glob filesystem operations (normal default: 1000000) */
     maxGlobOperations?: number;
-    /** Maximum string length in bytes (default: 10MB = 10485760) */
+    /** Maximum string length in bytes (normal default: 64 MiB) */
     maxStringLength?: number;
-    /** Maximum array elements (default: 100000) */
+    /** Maximum array elements (normal default: 1000000) */
     maxArrayElements?: number;
-    /** Maximum heredoc size in bytes (default: 10MB = 10485760) */
+    /** Maximum heredoc size in bytes (normal default: 64 MiB) */
     maxHeredocSize?: number;
     /** Maximum command substitution nesting depth (default: 50) */
     maxSubstitutionDepth?: number;
-    /** Maximum brace expansion results (default: 10000) */
+    /** Maximum brace expansion results (normal default: 100000) */
     maxBraceExpansionResults?: number;
-    /** Maximum total output size (stdout + stderr) in bytes (default: 10MB = 10485760) */
+    /** Maximum total output size in bytes (normal default: 256 MiB) */
     maxOutputSize?: number;
-    /** Maximum number of open file descriptors (default: 1024) */
+    /** Maximum number of open file descriptors (normal default: 4096) */
     maxFileDescriptors?: number;
     /** Maximum source/. nesting depth (default: 100) */
     maxSourceDepth?: number;
 }
+/** Named limit presets. `normal` favors compatibility; `hardened` is opt-in. */
+export type ExecutionLimitProfile = "normal" | "hardened";
+/** Liberal default shared by shell and standalone transform entry points. */
+export declare const DEFAULT_MAX_SOURCE_BYTES: number;
 /**
  * Resolve execution limits by merging user-provided limits with defaults.
  */
-export declare function resolveLimits(userLimits?: ExecutionLimits): Required<ExecutionLimits>;
+export declare function resolveLimits(userLimits?: ExecutionLimits, profile?: ExecutionLimitProfile): Required<ExecutionLimits>;