just-bash 3.1.0 → 3.2.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # just-bash
 
+## 3.2.0
+
+### Minor Changes
+
+- [#304](https://github.com/vercel-labs/just-bash/pull/304) [`3d39a71`](https://github.com/vercel-labs/just-bash/commit/3d39a714b3751cedc173dffae27933dfe7b8b3b5) Thanks [@subsetpark](https://github.com/subsetpark)! - Add curl `-G`/`--get` query-string data handling and preserve command-line order when repeated `-d`, `--data-raw`, `--data-binary`, and `--data-urlencode` options are mixed, including `@file` forms. Data requests now also set curl's standard `application/x-www-form-urlencoded` content type unless the caller supplies one.
+
+- [#307](https://github.com/vercel-labs/just-bash/pull/307) [`7c4caed`](https://github.com/vercel-labs/just-bash/commit/7c4caedf02599628f19b243f960d480760f5e476) Thanks [@cramforce](https://github.com/cramforce)! - Harden untrusted execution with shared aggregate budgets, liberal normal and
+  opt-in hardened limit profiles, request-bound network validation, bounded
+  archive and worker processing, transactional filesystem and shell state, and
+  expanded adversarial regression checks.
+
+  Established command declarations and host-extension defaults remain source
+  compatible. Dispatched callbacks receive a `ResolvedCommandContext` with
+  required limits; applications can use `createCommandContext({ fs })` for direct
+  invocation, opt into restricted custom-command execution with `trusted: false`,
+  and select tighter resource policy with the `hardened` profile. All
+  host-registration paths keep their established trusted default. The supported
+  Node.js floor is now declared as `>=20.18.1`.
+
+### Patch Changes
+
+- [#315](https://github.com/vercel-labs/just-bash/pull/315) [`6df692f`](https://github.com/vercel-labs/just-bash/commit/6df692f236ca108c888552a67557998156ac845b) Thanks [@matchai](https://github.com/matchai)! - Treat `--` as the end of options in `grep`.
+
 ## 3.1.0
 
 ### Minor Changes

package/README.md

@@ -51,7 +51,31 @@ await bash.exec("hello Alice"); // "Hello, Alice!\n"
 await bash.exec("echo 'test' | upper"); // "TEST\n"
 ```
 
-Custom commands receive a `CommandContext` with `fs`, `cwd`, `env`, `stdin`, and `exec` (for subcommands), and work with pipes, redirections, and all shell features.
+Custom command callbacks receive a `ResolvedCommandContext` with `fs`, `cwd`,
+`env`, `stdin`, resolved `limits`, and `exec` (for subcommands), and work with
+pipes, redirections, and all shell features. The legacy `CommandContext` remains
+available for standalone context inputs; use `createCommandContext({ fs })` when
+calling a command directly with a fully resolved context.
+
+Host-provided commands preserve the legacy trusted default whether supplied to
+the `Bash` constructor, declared through `defineCommand`, loaded lazily, or
+added later with `bash.registerCommand()`. Set `trusted: false` (or use
+`defineCommand(name, execute, { trusted: false })`) to select the restricted
+extension boundary. Trusted commands run in the embedding process and should
+never execute guest-provided JavaScript.
+
+Every invocation is bound by `maxExecutionTimeMs`. On cancellation, just-bash
+revokes the command context immediately; `maxExtensionCleanupTimeMs` only
+bounds how long it waits for the now-authority-free command promise to settle.
+A late continuation cannot use `ctx.fs`, `ctx.env`, `ctx.exec`, or other context
+capabilities. Cleanup work that must run at scope closure can be registered with
+`ctx.executionScope.registerCleanup()`. A cleanup failure is returned as a
+generic exit-126 shell result rather than rejecting `Bash.exec()` or exposing
+host error details. JavaScript cannot forcibly stop arbitrary host code, so
+extensions requiring a hard guarantee against external side effects must run
+in a terminable worker or process. Tests that invoke command objects directly
+can use `createCommandContext({ fs })` to get a fully resolved context without
+duplicating internal defaults.
 
 <details>
 <summary><h2>Supported Commands</h2></summary>
@@ -189,13 +213,21 @@ const env = new Bash({
 import { Bash } from "just-bash";
 import { OverlayFs } from "just-bash/fs/overlay-fs";
 
-const overlay = new OverlayFs({ root: "/path/to/project" });
+const overlay = new OverlayFs({
+  root: "/path/to/project",
+  // Copy-on-write data is bounded independently from real-file reads.
+  maxMemoryBytes: 256 * 1024 * 1024,
+});
 const env = new Bash({ fs: overlay, cwd: overlay.getMountPoint() });
 
 await env.exec("cat package.json"); // reads from disk
 await env.exec('echo "modified" > package.json'); // stays in memory
 ```
 
+`maxMemoryBytes` defaults to 1 GiB and covers aggregate files retained in the
+copy-on-write layer, including append chunks. Set it to the deployment's memory
+budget when an `OverlayFs` is reused across executions.
+
 **ReadWriteFs** - Direct read-write access to a real directory. Use this if you want the agent to be able to write to your disk:
 
 ```typescript
@@ -368,7 +400,7 @@ await env.exec('js-exec -c "console.log(API_BASE)"');
 
 `fs.readFileSync()` returns a `Buffer` by default (matching Node.js). Pass an encoding like `'utf8'` to get a string.
 
-**Note:** The `js-exec` command only exists when `javascript` is configured. It is not available in browser environments. Execution runs in a QuickJS WASM sandbox with a 64 MB memory limit and configurable timeout (default: 10s, 60s with network).
+**Note:** The `js-exec` command only exists when `javascript` is configured. It is not available in browser environments. Execution runs in a QuickJS WASM sandbox with a 64 MB memory limit and configurable timeout (30 seconds in the default `normal` profile and 10 seconds in the opt-in `hardened` profile). Enabling network access does not extend the configured deadline.
 
 #### Tool Invocation Hook
 
@@ -433,7 +465,7 @@ await env.exec('sqlite3 :memory: "SELECT 1 + 1"');
 await env.exec('sqlite3 data.db "SELECT * FROM users"');
 ```
 
-**Note:** SQLite is not available in browser environments. Queries run in a worker thread with a configurable timeout (default: 5 seconds) to prevent runaway queries from blocking execution.
+**Note:** SQLite is not available in browser environments. Queries run in a worker thread with a configurable timeout (30 seconds in the default `normal` profile and 5 seconds in the opt-in `hardened` profile) to prevent runaway queries from blocking execution.
 
 ## AST Transform Plugins
 
@@ -571,25 +603,56 @@ Bash protects against infinite loops and deep recursion with configurable limits
 
 ```typescript
 const env = new Bash({
+  // `normal` is the liberal, compatibility-oriented default. Use `hardened`
+  // for tighter untrusted-workload policy, then override individual resources.
+  executionLimitProfile: "hardened",
   executionLimits: {
     maxCallDepth: 100, // Max function recursion depth
-    maxCommandCount: 10000, // Max total commands executed
-    maxLoopIterations: 10000, // Max iterations per loop
-    maxAwkIterations: 10000, // Max iterations in awk programs
-    maxSedIterations: 10000, // Max iterations in sed scripts
+    maxCommandCount: 20000, // Shared across nested execution
+    maxSourceBytes: 8 * 1024 * 1024, // Shell source before parsing
+    maxFileSystemBytes: 256 * 1024 * 1024, // Retained default-FS data
+    maxOutputSize: 32 * 1024 * 1024, // Aggregate stdout + stderr bytes
+    maxArchiveBytes: 256 * 1024 * 1024, // Expanded archive bytes
+    maxDatabaseBytes: 128 * 1024 * 1024, // SQLite image bytes
+    maxExecutionTimeMs: 30_000, // Whole execution wall-clock deadline
+    maxExtensionCleanupTimeMs: 25, // Cancellation acknowledgement grace
   },
 });
 ```
 
-All limits have defaults. Error messages tell you which limit was hit. Increase as needed for your workload.
+All resources remain bounded by default in both profiles. Explicit values
+override the selected profile; non-negative safe integers and the legacy
+`Infinity` spelling are accepted. Infinite deadlines omit the corresponding
+platform timer rather than overflowing it. Invalid values are rejected when
+`Bash` is constructed. Error messages identify the resource that was hit.
 
 ## Security Model
 
+The Node.js package requires Node `>=20.18.1`.
+
 - The shell only has access to the provided filesystem.
 - All execution happens without VM isolation. This does introduce additional risk. The code base was designed to be robust against prototype-pollution attacks and other break outs to the host JS engine and filesystem.
 - There is no network access by default. When enabled, requests are checked against URL prefix allow-lists and HTTP-method allow-lists.
 - Python and JavaScript execution are off by default as they represent additional security surface.
 - Execution is protected against infinite loops and deep recursion with configurable limits.
+- Host-realm defense-in-depth uses the strongest scoped controls available on
+  each supported Node runtime. Where `node:module.registerHooks()` is present,
+  builtin ESM imports can also be denied only for the untrusted async context;
+  older runtimes retain best-effort scoped protection without failing existing
+  applications. It never installs a process-global deny-all loader. Query the
+  resolved capabilities with `DefenseInDepthBox.getInstance().getStatus()`.
+  Audit mode reports `level: "none"` because it records violations without
+  enforcing them.
+- Scoped defense uses reversible proxies for `Reflect`, `JSON`, and `Math` and
+  restores their host descriptors on deactivation. This is reported as
+  `intrinsicProtection: "scoped-best-effort"`: same-realm JavaScript that
+  cached an intrinsic or a mutation function before activation cannot be fully
+  revoked (including the direct `delete` operator). The separately named
+  `processLifetimeIntrinsicHardening: true` option permanently freezes those
+  objects and locks selected well-known Symbol descriptors; use it only in a
+  disposable or process-lifetime realm. Use an isolated worker/process when
+  complete protection and reversible host state are both required.
+- Node worker `resourceLimits` do not reliably cap the WebAssembly linear memory used by CPython or sql.js. Queue, deadline, file, database, bridge, and payload limits reduce exposure, but strong memory containment for these opt-in runtimes requires process/container isolation or a WASM build with a lower hard maximum.
 - Use [Vercel Sandbox](https://vercel.com/docs/vercel-sandbox) if you need a full VM with arbitrary binary execution.
 
 ## Browser Support

package/dist/Bash.d.ts

@@ -11,12 +11,12 @@ import "./timers.js";
 import { type CommandName } from "./commands/registry.js";
 import { type CustomCommand } from "./custom-commands.js";
 import type { IFileSystem, InitialFiles } from "./fs/interface.js";
-import { type ExecutionLimits } from "./limits.js";
+import { type ExecutionLimitProfile, type ExecutionLimits } from "./limits.js";
 import { type NetworkConfig, type SecureFetch } from "./network/index.js";
 import type { DefenseInDepthConfig } from "./security/types.js";
 import type { BashTransformResult, TransformPlugin } from "./transform/types.js";
 import type { BashExecResult, Command, FeatureCoverageWriter, TraceCallback } from "./types.js";
-export type { ExecutionLimits } from "./limits.js";
+export type { ExecutionLimitProfile, ExecutionLimits } from "./limits.js";
 /**
  * Logger interface for Bash execution logging.
  * Implement this interface to receive execution logs.
@@ -59,6 +59,8 @@ export interface BashOptions {
      * See ExecutionLimits interface for available options.
      */
     executionLimits?: ExecutionLimits;
+    /** Named execution-limit preset. Defaults to compatibility-oriented `normal`. */
+    executionLimitProfile?: ExecutionLimitProfile;
     /**
      * @deprecated Use executionLimits.maxCallDepth instead
      */
@@ -149,8 +151,8 @@ export interface BashOptions {
      *
      * @example
      * ```ts
-     * // Simple enable
-     * const bash = new Bash({ defenseInDepth: true });
+     * // Capability-detect the strongest available protection.
+     * const bash = new Bash({ defenseInDepth: { enabled: "auto" } });
      *
      * // With custom configuration
      * const bash = new Bash({
@@ -161,6 +163,9 @@ export interface BashOptions {
      *   },
      * });
      * ```
+     * Node versions without context-aware ESM loader hooks retain the scoped
+     * best-effort controls and report the unavailable loader capability in
+     * DefenseInDepthStatus.
      */
     defenseInDepth?: DefenseInDepthConfig | boolean;
     /**
@@ -245,8 +250,11 @@ export declare class Bash {
     private state;
     constructor(options?: BashOptions);
     registerCommand(command: Command): void;
+    private registerBundledCommand;
+    private registerCommandInternal;
     private logResult;
     exec(commandLine: string, options?: ExecOptions): Promise<BashExecResult>;
+    private execInScope;
     readFile(path: string): Promise<string>;
     writeFile(path: string, content: string): Promise<void>;
     getCwd(): string;

package/dist/abort-signals.d.ts

@@ -0,0 +1,10 @@
+export interface CombinedAbortSignal {
+    signal: AbortSignal | undefined;
+    cleanup(): void;
+}
+/**
+ * Compose abort signals without relying on AbortSignal.any(), which is not
+ * available in every supported runtime. The first abort reason wins and all
+ * listeners are removable by the caller's finally block.
+ */
+export declare function combineAbortSignals(...signals: Array<AbortSignal | undefined>): CombinedAbortSignal;

package/dist/bin/chunks/alias-3R4G6HQY.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b,c,d}from"./chunk-DJAX3ZRG.js";import"./chunk-MUFNRCMY.js";import"./chunk-DN2YCFOR.js";export{a as aliasCommand,c as flagsForFuzzing,b as unaliasCommand,d as unaliasFlagsForFuzzing};

package/dist/bin/chunks/awk2-7UZLEPVX.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-PKWK3LQM.js";import"./chunk-MROECM42.js";import"./chunk-4SQKKW2M.js";import"./chunk-CB4SODHK.js";import"./chunk-BNYIXXC2.js";import"./chunk-46CDVHZ3.js";import"./chunk-VLWZ6L7C.js";import"./chunk-CPTQXTBJ.js";import"./chunk-LCP3IKI7.js";import"./chunk-CPKBPQ2C.js";import"./chunk-MUFNRCMY.js";import"./chunk-DN2YCFOR.js";export{a as awkCommand2,b as flagsForFuzzing};

package/dist/bin/chunks/base64-W6FVFNXJ.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-MZM7RVYU.js";import"./chunk-O74FSWB4.js";import"./chunk-BNYIXXC2.js";import"./chunk-46CDVHZ3.js";import"./chunk-7JZKVC3F.js";import"./chunk-LCP3IKI7.js";import"./chunk-CPKBPQ2C.js";import"./chunk-NE4R2FVV.js";import"./chunk-MUFNRCMY.js";import"./chunk-DN2YCFOR.js";export{a as base64Command,b as flagsForFuzzing};

package/dist/bin/chunks/basename-C4CRGDXP.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-YJ5OCPSK.js";import"./chunk-MUFNRCMY.js";import"./chunk-DN2YCFOR.js";export{a as basenameCommand,b as flagsForFuzzing};

package/dist/bin/chunks/bash-CFCBBWVH.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b,c,d}from"./chunk-MYTNZ7MA.js";import"./chunk-MROECM42.js";import"./chunk-CPKBPQ2C.js";import"./chunk-MUFNRCMY.js";import"./chunk-DN2YCFOR.js";export{a as bashCommand,c as flagsForFuzzing,b as shCommand,d as shFlagsForFuzzing};

package/dist/bin/chunks/cat-5YECZSFQ.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-W4U4QOZF.js";import"./chunk-O74FSWB4.js";import"./chunk-BNYIXXC2.js";import"./chunk-46CDVHZ3.js";import"./chunk-7JZKVC3F.js";import"./chunk-LCP3IKI7.js";import"./chunk-CPKBPQ2C.js";import"./chunk-NE4R2FVV.js";import"./chunk-MUFNRCMY.js";import"./chunk-DN2YCFOR.js";export{a as catCommand,b as flagsForFuzzing};

package/dist/bin/chunks/chmod-45TMYSW2.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-NGD6G5ZG.js";import"./chunk-BNYIXXC2.js";import"./chunk-46CDVHZ3.js";import"./chunk-CPTQXTBJ.js";import"./chunk-H4BRFPKY.js";import"./chunk-43E7AR6A.js";import"./chunk-LCP3IKI7.js";import"./chunk-CPKBPQ2C.js";import"./chunk-PBOVSFTJ.js";import"./chunk-MUFNRCMY.js";import"./chunk-DN2YCFOR.js";export{a as chmodCommand,b as flagsForFuzzing};

package/dist/bin/chunks/chunk-23OI2XDJ.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{b as D}from"./chunk-CPKBPQ2C.js";import{a as N}from"./chunk-NE4R2FVV.js";import{a as H,b as A}from"./chunk-MUFNRCMY.js";var b=class{diff(e,n,t={}){let i;typeof t=="function"?(i=t,t={}):"callback"in t&&(i=t.callback);let d=this.castInput(e,t),o=this.castInput(n,t),s=this.removeEmpty(this.tokenize(d,t)),a=this.removeEmpty(this.tokenize(o,t));return this.diffWithOptionsObj(s,a,t,i)}diffWithOptionsObj(e,n,t,i){var d;let o=l=>{if(l=this.postProcess(l,t),i){setTimeout(function(){i(l)},0);return}else return l},s=n.length,a=e.length,u=1,r=s+a;t.maxEditLength!=null&&(r=Math.min(r,t.maxEditLength));let g=(d=t.timeout)!==null&&d!==void 0?d:1/0,w=Date.now()+g,m=[{oldPos:-1,lastComponent:void 0}],C=this.extractCommon(m[0],n,e,0,t);if(m[0].oldPos+1>=a&&C+1>=s)return o(this.buildValues(m[0].lastComponent,n,e));let P=-1/0,x=1/0,L=()=>{for(let l=Math.max(P,-u);l<=Math.min(x,u);l+=2){let c,h=m[l-1],p=m[l+1];h&&(m[l-1]=void 0);let y=!1;if(p){let S=p.oldPos-l;y=p&&0<=S&&S<s}let v=h&&h.oldPos+1<a;if(!y&&!v){m[l]=void 0;continue}if(!v||y&&h.oldPos<p.oldPos?c=this.addToPath(p,!0,!1,0,t):c=this.addToPath(h,!1,!0,1,t),C=this.extractCommon(c,n,e,l,t),c.oldPos+1>=a&&C+1>=s)return o(this.buildValues(c.lastComponent,n,e))||!0;m[l]=c,c.oldPos+1>=a&&(x=Math.min(x,l-1)),C+1>=s&&(P=Math.max(P,l+1))}u++};if(i)(function l(){setTimeout(function(){if(u>r||Date.now()>w)return i(void 0);L()||l()},0)})();else for(;u<=r&&Date.now()<=w;){let l=L();if(l)return l}}addToPath(e,n,t,i,d){let o=e.lastComponent;return o&&!d.oneChangePerToken&&o.added===n&&o.removed===t?{oldPos:e.oldPos+i,lastComponent:{count:o.count+1,added:n,removed:t,previousComponent:o.previousComponent}}:{oldPos:e.oldPos+i,lastComponent:{count:1,added:n,removed:t,previousComponent:o}}}extractCommon(e,n,t,i,d){let o=n.length,s=t.length,a=e.oldPos,u=a-i,r=0;for(;u+1<o&&a+1<s&&this.equals(t[a+1],n[u+1],d);)u++,a++,r++,d.oneChangePerToken&&(e.lastComponent={count:1,previousComponent:e.lastComponent,added:!1,removed:!1});return r&&!d.oneChangePerToken&&(e.lastComponent={count:r,previousComponent:e.lastComponent,added:!1,removed:!1}),e.oldPos=a,u}equals(e,n,t){return t.comparator?t.comparator(e,n):e===n||!!t.ignoreCase&&e.toLowerCase()===n.toLowerCase()}removeEmpty(e){let n=[];for(let t=0;t<e.length;t++)e[t]&&n.push(e[t]);return n}castInput(e,n){return e}tokenize(e,n){return Array.from(e)}join(e){return e.join("")}postProcess(e,n){return e}get useLongestToken(){return!1}buildValues(e,n,t){let i=[],d;for(;e;)i.push(e),d=e.previousComponent,delete e.previousComponent,e=d;i.reverse();let o=i.length,s=0,a=0,u=0;for(;s<o;s++){let r=i[s];if(r.removed)r.value=this.join(t.slice(u,u+r.count)),u+=r.count;else{if(!r.added&&this.useLongestToken){let g=n.slice(a,a+r.count);g=g.map(function(w,m){let C=t[u+m];return C.length>w.length?C:w}),r.value=this.join(g)}else r.value=this.join(n.slice(a,a+r.count));a+=r.count,r.added||(u+=r.count)}}return i}};var I=class extends b{constructor(){super(...arguments),this.tokenize=W}equals(e,n,t){return t.ignoreWhitespace?((!t.newlineIsToken||!e.includes(`
+`))&&(e=e.trim()),(!t.newlineIsToken||!n.includes(`
+`))&&(n=n.trim())):t.ignoreNewlineAtEof&&!t.newlineIsToken&&(e.endsWith(`
+`)&&(e=e.slice(0,-1)),n.endsWith(`
+`)&&(n=n.slice(0,-1))),super.equals(e,n,t)}},O=new I;function T(f,e,n){return O.diff(f,e,n)}function W(f,e){e.stripTrailingCr&&(f=f.replace(/\r\n/g,`
+`));let n=[],t=f.split(/(\n|\r\n)/);t[t.length-1]||t.pop();for(let i=0;i<t.length;i++){let d=t[i];i%2&&!e.newlineIsToken?n[n.length-1]+=d:n.push(d)}return n}var j={includeIndex:!0,includeUnderline:!0,includeFileHeaders:!0};function F(f,e,n,t,i,d,o){let s;o?typeof o=="function"?s={callback:o}:s=o:s={},typeof s.context>"u"&&(s.context=4);let a=s.context;if(s.newlineIsToken)throw new Error("newlineIsToken may not be used with patch-generation functions, only with diffing functions");if(s.callback){let{callback:r}=s;T(n,t,Object.assign(Object.assign({},s),{callback:g=>{let w=u(g);r(w)}}))}else return u(T(n,t,s));function u(r){if(!r)return;r.push({value:"",lines:[]});function g(l){return l.map(function(c){return" "+c})}let w=[],m=0,C=0,P=[],x=1,L=1;for(let l=0;l<r.length;l++){let c=r[l],h=c.lines||R(c.value);if(c.lines=h,c.added||c.removed){if(!m){let p=r[l-1];m=x,C=L,p&&(P=a>0?g(p.lines.slice(-a)):[],m-=P.length,C-=P.length)}for(let p of h)P.push((c.added?"+":"-")+p);c.added?L+=h.length:x+=h.length}else{if(m)if(h.length<=a*2&&l<r.length-2)for(let p of g(h))P.push(p);else{let p=Math.min(h.length,a);for(let v of g(h.slice(0,p)))P.push(v);let y={oldStart:m,oldLines:x-m+p,newStart:C,newLines:L-C+p,lines:P};w.push(y),m=0,C=0,P=[]}x+=h.length,L+=h.length}}for(let l of w)for(let c=0;c<l.lines.length;c++)l.lines[c].endsWith(`
+`)?l.lines[c]=l.lines[c].slice(0,-1):(l.lines.splice(c+1,0,"\"),c++);return{oldFileName:f,newFileName:e,oldHeader:i,newHeader:d,hunks:w}}}function E(f,e){if(e||(e=j),Array.isArray(f)){if(f.length>1&&!e.includeFileHeaders)throw new Error("Cannot omit file headers on a multi-file patch. (The result would be unparseable; how would a tool trying to apply the patch know which changes are to which file?)");return f.map(t=>E(t,e)).join(`
+`)}let n=[];e.includeIndex&&f.oldFileName==f.newFileName&&n.push("Index: "+f.oldFileName),e.includeUnderline&&n.push("==================================================================="),e.includeFileHeaders&&(n.push("--- "+f.oldFileName+(typeof f.oldHeader>"u"?"":"	"+f.oldHeader)),n.push("+++ "+f.newFileName+(typeof f.newHeader>"u"?"":"	"+f.newHeader)));for(let t=0;t<f.hunks.length;t++){let i=f.hunks[t];i.oldLines===0&&(i.oldStart-=1),i.newLines===0&&(i.newStart-=1),n.push("@@ -"+i.oldStart+","+i.oldLines+" +"+i.newStart+","+i.newLines+" @@");for(let d of i.lines)n.push(d)}return n.join(`
+`)+`
+`}function k(f,e,n,t,i,d,o){if(typeof o=="function"&&(o={callback:o}),o?.callback){let{callback:s}=o;F(f,e,n,t,i,d,Object.assign(Object.assign({},o),{callback:a=>{s(a?E(a,o.headerOptions):void 0)}}))}else{let s=F(f,e,n,t,i,d,o);return s?E(s,o?.headerOptions):void 0}}function R(f){let e=f.endsWith(`
+`),n=f.split(`
+`).map(t=>t+`
+`);return e?n.pop():n.push(n.pop().slice(0,-1)),n}var z={name:"diff",summary:"compare files line by line",usage:"diff [OPTION]... FILE1 FILE2",options:["-u, --unified     output unified diff format (default)","-q, --brief       report only whether files differ","-s, --report-identical-files  report when files are the same","-i, --ignore-case  ignore case differences","    --help        display this help and exit"]},_={unified:{short:"u",long:"unified",type:"boolean"},brief:{short:"q",long:"brief",type:"boolean"},reportSame:{short:"s",long:"report-identical-files",type:"boolean"},ignoreCase:{short:"i",long:"ignore-case",type:"boolean"}},ee={name:"diff",async execute(f,e){if(A(f))return H(z);let n=N("diff",f,_);if(!n.ok)return n.error;let t=n.result.flags.brief,i=n.result.flags.reportSame,d=n.result.flags.ignoreCase,o=n.result.positional;if(n.result.flags.unified,o.length<2)return{stdout:"",stderr:`diff: missing operand
+`,exitCode:2};let s,a,[u,r]=o;try{s=u==="-"?D(e.stdin):await e.fs.readFile(e.fs.resolvePath(e.cwd,u))}catch{return{stdout:"",stderr:`diff: ${u}: No such file or directory
+`,exitCode:2}}try{a=r==="-"?D(e.stdin):await e.fs.readFile(e.fs.resolvePath(e.cwd,r))}catch{return{stdout:"",stderr:`diff: ${r}: No such file or directory
+`,exitCode:2}}let g=s,w=a;return d&&(g=g.toLowerCase(),w=w.toLowerCase()),g===w?i?{stdout:`Files ${u} and ${r} are identical
+`,stderr:"",exitCode:0}:{stdout:"",stderr:"",exitCode:0}:t?{stdout:`Files ${u} and ${r} differ
+`,stderr:"",exitCode:1}:{stdout:k(u,r,s,a,"","",{context:3}),stderr:"",exitCode:1}}},ne={name:"diff",flags:[{flag:"-u",type:"boolean"},{flag:"-q",type:"boolean"},{flag:"-s",type:"boolean"},{flag:"-i",type:"boolean"}],needsArgs:!0,minArgs:2};export{ee as a,ne as b};

package/dist/bin/chunks/chunk-2OQ5HPZE.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{c as E}from"./chunk-O74FSWB4.js";import{d as W}from"./chunk-CPTQXTBJ.js";import{l as h}from"./chunk-LCP3IKI7.js";import{b as N}from"./chunk-CPKBPQ2C.js";import{a as v,b as L,c as b}from"./chunk-MUFNRCMY.js";var k={name:"cut",summary:"remove sections from each line of files",usage:"cut [OPTION]... [FILE]...",options:["-c LIST              select only these characters","-d DELIM             use DELIM instead of TAB for field delimiter","-f LIST              select only these fields","-s, --only-delimited  do not print lines without delimiters","    --help           display this help and exit"]};function M(r,o){let l=[],a=r.split(",");if(a.length>o)throw new h(`cut: range count limit exceeded (${o})`,"array_elements");for(let s of a)if(s.includes("-")){let[i,u]=s.split("-"),t=i?Number(i):1,f=u?Number(u):null;if(!Number.isSafeInteger(t)||t<1||f!==null&&(!Number.isSafeInteger(f)||f<t))throw new h("cut: invalid range","array_elements");l.push({start:t,end:f})}else{let i=Number(s);if(!Number.isSafeInteger(i)||i<1)throw new h("cut: invalid range","array_elements");l.push({start:i,end:i})}return l}function B(r,o){let l=[],a=new Set;for(let s of o){let i=s.start-1,u=s.end===null?r.length:s.end;for(let t=i;t<u&&t<r.length;t++)t>=0&&!a.has(t)&&(a.add(t),l.push(r[t]))}return l}var R={name:"cut",async execute(r,o){if(L(r))return v(k);let l="	",a=null,s=null,i=!1,u=[];for(let n=0;n<r.length;n++){let e=r[n];if(e==="-d")l=r[++n]||"	";else if(e.startsWith("-d"))l=e.slice(2);else if(e==="-f")a=r[++n];else if(e.startsWith("-f"))a=e.slice(2);else if(e==="-c")s=r[++n];else if(e.startsWith("-c"))s=e.slice(2);else if(e==="-s"||e==="--only-delimited")i=!0;else{if(e.startsWith("--"))return b("cut",e);if(e.startsWith("-")){let d=!1;for(let c of e.slice(1))if(c==="s")i=!0;else if(!"dfc".includes(c)){d=!0;break}if(d)return b("cut",e)}else u.push(e)}}if(!a&&!s)return{stdout:"",stderr:`cut: you must specify a list of bytes, characters, or fields
+`,exitCode:1};let t=await E(o,u,{cmdName:"cut"});if(!t.ok)return t.error;let m=(s?N(t.content):t.content).split(`
+`);m.length>0&&m[m.length-1]===""&&m.pop();let x=M(a||s||"1",o.limits.maxArrayElements),g=new W(Math.min(o.limits.maxOutputSize,o.limits.maxStringLength),"cut"),S=0,I=n=>{if(!Number.isSafeInteger(n)||n<0||n>o.limits.maxLoopIterations-S)throw new h(`cut: range expansion limit exceeded (${o.limits.maxLoopIterations})`,"iterations");S+=n,o.executionScope?.consumeWork(n,"cut range expansion")};for(let n of m)if(s){let e=Array.from(n),d=[];for(let c of x){let y=c.start-1,w=c.end===null?e.length:c.end;I(Math.max(0,Math.min(w,e.length)-y));for(let p=y;p<w&&p<e.length;p++)p>=0&&d.push(e[p])}g.append(`${d.join("")}
+`)}else{if(i&&!n.includes(l))continue;let e=n.split(l);for(let c of x){let y=c.start-1,w=c.end===null?e.length:c.end;I(Math.max(0,Math.min(w,e.length)-y))}let d=B(e,x);g.append(`${d.join(l)}
+`)}return s?{stdout:g.build(),stderr:"",exitCode:0}:{stdout:g.build(),stderr:"",exitCode:0,stdoutKind:"bytes",stdoutEncoding:"binary"}}},$={name:"cut",flags:[{flag:"-d",type:"value",valueHint:"delimiter"},{flag:"-f",type:"value",valueHint:"string"},{flag:"-c",type:"value",valueHint:"string"},{flag:"-s",type:"boolean"}],stdinType:"text",needsFiles:!0};export{R as a,$ as b};

package/dist/bin/chunks/chunk-2YLY6FJA.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{b as U}from"./chunk-CPKBPQ2C.js";import{a as $,b as F,c as k}from"./chunk-MUFNRCMY.js";var L=new Map([["sha1","SHA-1"],["sha256","SHA-256"]]);function D(n){function h(r,u){return r<<u|r>>>32-u}let g=new Uint32Array([3614090360,3905402710,606105819,3250441966,4118548399,1200080426,2821735955,4249261313,1770035416,2336552879,4294925233,2304563134,1804603682,4254626195,2792965006,1236535329,4129170786,3225465664,643717713,3921069994,3593408605,38016083,3634488961,3889429448,568446438,3275163606,4107603335,1163531501,2850285829,4243563512,1735328473,2368359562,4294588738,2272392833,1839030562,4259657740,2763975236,1272893353,4139469664,3200236656,681279174,3936430074,3572445317,76029189,3654602809,3873151461,530742520,3299628645,4096336452,1126891415,2878612391,4237533241,1700485571,2399980690,4293915773,2240044497,1873313359,4264355552,2734768916,1309151649,4149444226,3174756917,718787259,3951481745]),A=[7,12,17,22,7,12,17,22,7,12,17,22,7,12,17,22,5,9,14,20,5,9,14,20,5,9,14,20,5,9,14,20,4,11,16,23,4,11,16,23,4,11,16,23,4,11,16,23,6,10,15,21,6,10,15,21,6,10,15,21,6,10,15,21],b=n.length*8,c=(n.length%64<56?56:120)-n.length%64,s=new Uint8Array(n.length+c+8);s.set(n),s[n.length]=128;let d=new DataView(s.buffer);d.setUint32(s.length-8,b>>>0,!0),d.setUint32(s.length-4,Math.floor(b/4294967296),!0);let w=1732584193,l=4023233417,p=2562383102,e=271733878;for(let r=0;r<s.length;r+=64){let u=new Uint32Array(16);for(let t=0;t<16;t++)u[t]=d.getUint32(r+t*4,!0);let m=w,a=l,x=p,o=e;for(let t=0;t<64;t++){let i,y;t<16?(i=a&x|~a&o,y=t):t<32?(i=o&a|~o&x,y=(5*t+1)%16):t<48?(i=a^x^o,y=(3*t+5)%16):(i=x^(a|~o),y=7*t%16),i=i+m+g[t]+u[y]>>>0,m=o,o=x,x=a,a=a+h(i,A[t])>>>0}w=w+m>>>0,l=l+a>>>0,p=p+x>>>0,e=e+o>>>0}let f=new Uint8Array(16);return new DataView(f.buffer).setUint32(0,w,!0),new DataView(f.buffer).setUint32(4,l,!0),new DataView(f.buffer).setUint32(8,p,!0),new DataView(f.buffer).setUint32(12,e,!0),Array.from(f).map(r=>r.toString(16).padStart(2,"0")).join("")}async function C(n,h){if(n==="md5")return D(h);let g=L.get(n);if(!g)throw new Error(`Unknown algorithm: ${n}`);let A=await globalThis.crypto.subtle.digest(g,new Uint8Array(h).buffer);return Array.from(new Uint8Array(A)).map(b=>b.toString(16).padStart(2,"0")).join("")}function I(n,h,g){let A={name:n,summary:g,usage:`${n} [OPTION]... [FILE]...`,options:["-c, --check    read checksums from FILEs and check them","    --help     display this help and exit"]};return{name:n,async execute(b,c){if(F(b))return $(A);let s=!1,d=[];for(let e of b)if(e==="-c"||e==="--check")s=!0;else if(!(e==="-b"||e==="-t"||e==="--binary"||e==="--text")){if(e.startsWith("-")&&e!=="-")return k(n,e);d.push(e)}d.length===0&&d.push("-");let w=async e=>{if(e==="-")return Uint8Array.from(c.stdin,f=>f.charCodeAt(0));try{return await c.fs.readFileBuffer(c.fs.resolvePath(c.cwd,e))}catch{return null}};if(s){let e=0,f="";for(let r of d){let u=r==="-"?U(c.stdin):await c.fs.readFile(c.fs.resolvePath(c.cwd,r)).catch(()=>null);if(u===null)return{stdout:"",stderr:`${n}: ${r}: No such file or directory
+`,exitCode:1};for(let m of u.split(`
+`)){let a=m.match(/^([a-fA-F0-9]+)\s+[* ]?(.+)$/);if(!a)continue;let[,x,o]=a,t=await w(o);if(t===null){f+=`${o}: FAILED open or read
+`,e++;continue}let i=await C(h,t)===x.toLowerCase();f+=`${o}: ${i?"OK":"FAILED"}
+`,i||e++}}return e>0&&(f+=`${n}: WARNING: ${e} computed checksum${e>1?"s":""} did NOT match
+`),{stdout:f,stderr:"",exitCode:e>0?1:0}}let l="",p=0;for(let e of d){let f=await w(e);if(f===null){l+=`${n}: ${e}: No such file or directory
+`,p=1;continue}l+=`${await C(h,f)}  ${e}
+`}return{stdout:l,stderr:"",exitCode:p}}}}export{I as a};