just-bash 3.1.0 → 3.2.0

package/dist/bundle/chunks/js-exec-worker.js

@@ -12,6 +12,10 @@ import {
   getQuickJS
 } from "quickjs-emscripten";
 
+// src/security/defense-in-depth-box.ts
+import * as nodeAsyncHooks from "node:async_hooks";
+import * as nodeModule from "node:module";
+
 // src/security/blocked-globals.ts
 function getBlockedGlobals() {
   const globals = [
@@ -246,6 +250,21 @@ function getBlockedGlobals() {
       strategy: "throw",
       reason: "setUncaughtExceptionCaptureCallback could intercept security errors"
     },
+    ...[
+      "on",
+      "once",
+      "addListener",
+      "prependListener",
+      "prependOnceListener"
+    ].map(
+      (prop) => ({
+        prop,
+        target: process,
+        violationType: "process_exception_handler",
+        strategy: "throw",
+        reason: "process-global listeners can outlive the sandbox and lose its security context"
+      })
+    ),
     // IPC communication vectors (may be undefined in non-IPC contexts)
     {
       prop: "send",
@@ -482,10 +501,13 @@ function getBlockedGlobals() {
 // src/security/defense-in-depth-box.ts
 var IS_BROWSER = typeof __BROWSER__ !== "undefined" && __BROWSER__;
 var AsyncLocalStorageClass = null;
+var nodeModuleApi = null;
+var nodeModuleClass = null;
 if (!IS_BROWSER) {
   try {
-    const { AsyncLocalStorage } = __require("node:async_hooks");
-    AsyncLocalStorageClass = AsyncLocalStorage;
+    AsyncLocalStorageClass = nodeAsyncHooks.AsyncLocalStorage;
+    nodeModuleApi = nodeModule;
+    nodeModuleClass = nodeModuleApi.Module ?? nodeModuleApi.default ?? null;
   } catch {
   }
 }
@@ -502,6 +524,25 @@ var WorkerSecurityViolationError = class extends Error {
   violation;
 };
 var MAX_STORED_VIOLATIONS = 1e3;
+var nodeModuleClass2 = null;
+try {
+  const getBuiltinModule = process.getBuiltinModule;
+  const moduleApi = typeof getBuiltinModule === "function" ? getBuiltinModule("module") : typeof __require === "function" ? (
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    __require("node:module")
+  ) : null;
+  nodeModuleClass2 = moduleApi?.Module ?? moduleApi?.default ?? null;
+  if (typeof getBuiltinModule === "function") {
+    const workerThreads = getBuiltinModule("worker_threads");
+    const isWorkerThread = workerThreads?.isMainThread === false;
+    if (isWorkerThread) {
+      const cryptoApi = getBuiltinModule("crypto");
+      cryptoApi?.randomUUID?.();
+    }
+  }
+} catch {
+  nodeModuleClass2 = null;
+}
 function generateExecutionId() {
   if (typeof crypto !== "undefined" && crypto.randomUUID) {
     return crypto.randomUUID();
@@ -516,6 +557,7 @@ var WorkerDefenseInDepth = class {
   config;
   isActivated = false;
   originalDescriptors = [];
+  patchFailures = [];
   violations = [];
   executionId;
   /**
@@ -581,8 +623,14 @@ var WorkerDefenseInDepth = class {
     if (this.isActivated) {
       return;
     }
-    this.applyPatches();
-    this.isActivated = true;
+    try {
+      this.applyPatches();
+      this.isActivated = true;
+    } catch (error) {
+      this.restorePatches();
+      this.isActivated = false;
+      throw error;
+    }
   }
   /**
    * Get a human-readable path for a target object and property.
@@ -830,16 +878,64 @@ var WorkerDefenseInDepth = class {
       }
     });
   }
+  createReadonlyObjectProxy(original, path, violationType) {
+    const auditMode = this.config.auditMode;
+    const allowOrThrow = (operation) => {
+      const message = `${path} ${operation} is blocked in worker context`;
+      const violation = this.recordViolation(violationType, path, message);
+      if (!auditMode) {
+        throw new WorkerSecurityViolationError(message, violation);
+      }
+    };
+    return new this.originalProxy(original, {
+      set(target, prop, value, receiver) {
+        allowOrThrow("modification");
+        return Reflect.set(target, prop, value, receiver);
+      },
+      defineProperty(target, prop, descriptor) {
+        allowOrThrow("defineProperty");
+        return Reflect.defineProperty(target, prop, descriptor);
+      },
+      deleteProperty(target, prop) {
+        allowOrThrow("deletion");
+        return Reflect.deleteProperty(target, prop);
+      },
+      setPrototypeOf(target, prototype) {
+        allowOrThrow("setPrototypeOf");
+        return Reflect.setPrototypeOf(target, prototype);
+      },
+      preventExtensions(target) {
+        allowOrThrow("preventExtensions");
+        return Reflect.preventExtensions(target);
+      }
+    });
+  }
   /**
    * Apply security patches to dangerous globals.
    */
   applyPatches() {
+    this.patchFailures = [];
     const blockedGlobals = getBlockedGlobals();
     const excludeTypes = new Set(this.config.excludeViolationTypes ?? []);
+    const workerInfrastructureListenerMethods = /* @__PURE__ */ new Set([
+      "on",
+      "once",
+      "addListener",
+      "prependListener",
+      "prependOnceListener"
+    ]);
+    const permanentIntrinsicPatches = [];
     for (const blocked of blockedGlobals) {
       if (excludeTypes.has(blocked.violationType)) {
         continue;
       }
+      if (blocked.target === process && workerInfrastructureListenerMethods.has(blocked.prop)) {
+        continue;
+      }
+      if (blocked.strategy === "freeze") {
+        permanentIntrinsicPatches.push(blocked);
+        continue;
+      }
       this.applyPatch(blocked);
     }
     if (!excludeTypes.has("function_constructor")) {
@@ -863,10 +959,27 @@ var WorkerDefenseInDepth = class {
     if (!excludeTypes.has("process_connected")) {
       this.protectProcessConnected();
     }
-    this.lockWellKnownSymbols();
     if (!excludeTypes.has("proxy")) {
       this.protectProxyRevocable();
     }
+    const criticalPaths = [
+      "Function.prototype.constructor",
+      "Module._load",
+      "Module._resolveFilename"
+    ];
+    const criticalFailures = this.patchFailures.filter(
+      (path) => criticalPaths.includes(path)
+    );
+    if (criticalFailures.length > 0) {
+      this.restorePatches();
+      throw new Error(
+        `WorkerDefenseInDepth: critical patches failed: ${criticalFailures.join(", ")}`
+      );
+    }
+    for (const blocked of permanentIntrinsicPatches) {
+      this.applyPatch(blocked);
+    }
+    this.lockWellKnownSymbols();
   }
   /**
    * Lock well-known Symbol properties on built-in constructors/prototypes.
@@ -921,23 +1034,6 @@ var WorkerDefenseInDepth = class {
     ]) {
       lock(proto, Symbol.toStringTag);
     }
-    try {
-      const stackDesc = Object.getOwnPropertyDescriptor(
-        Error,
-        "stackTraceLimit"
-      );
-      this.originalDescriptors.push({
-        target: Error,
-        prop: "stackTraceLimit",
-        descriptor: stackDesc
-      });
-      Object.defineProperty(Error, "stackTraceLimit", {
-        value: Error.stackTraceLimit,
-        writable: false,
-        configurable: true
-      });
-    } catch {
-    }
   }
   /**
    * Block Proxy.revocable to prevent bypassing Proxy constructor blocking.
@@ -1152,6 +1248,7 @@ var WorkerDefenseInDepth = class {
         configurable: true
       });
     } catch {
+      this.patchFailures.push(path);
     }
   }
   /**
@@ -1344,47 +1441,7 @@ var WorkerDefenseInDepth = class {
    * We access the Module class and replace _load with a blocking proxy.
    */
   protectModuleLoad() {
-    const self = this;
-    const auditMode = this.config.auditMode;
-    try {
-      let ModuleClass = null;
-      if (typeof process !== "undefined") {
-        const mainModule = process.mainModule;
-        if (mainModule && typeof mainModule === "object") {
-          ModuleClass = mainModule.constructor;
-        }
-      }
-      if (!ModuleClass && typeof __require !== "undefined" && typeof __require.main !== "undefined") {
-        ModuleClass = __require.main.constructor;
-      }
-      if (!ModuleClass || typeof ModuleClass._load !== "function") {
-        return;
-      }
-      const original = ModuleClass._load;
-      const descriptor = Object.getOwnPropertyDescriptor(ModuleClass, "_load");
-      this.originalDescriptors.push({
-        target: ModuleClass,
-        prop: "_load",
-        descriptor
-      });
-      const path = "Module._load";
-      const proxy = new this.originalProxy(original, {
-        apply(_target, _thisArg, _args) {
-          const message = `${path} is blocked in worker context`;
-          const violation = self.recordViolation("module_load", path, message);
-          if (!auditMode) {
-            throw new WorkerSecurityViolationError(message, violation);
-          }
-          return Reflect.apply(_target, _thisArg, _args);
-        }
-      });
-      Object.defineProperty(ModuleClass, "_load", {
-        value: proxy,
-        writable: true,
-        configurable: true
-      });
-    } catch {
-    }
+    this.protectModuleMethod("_load", "module_load");
   }
   /**
    * Protect Module._resolveFilename from being called in worker context.
@@ -1396,53 +1453,55 @@ var WorkerDefenseInDepth = class {
    * in the main thread (DefenseInDepthBox.protectDynamicImport).
    */
   protectModuleResolveFilename() {
+    this.protectModuleMethod("_resolveFilename", "module_resolve_filename");
+  }
+  protectModuleMethod(prop, violationType) {
+    const path = `Module.${prop}`;
     const self = this;
     const auditMode = this.config.auditMode;
     try {
-      let ModuleClass = null;
-      if (typeof process !== "undefined") {
-        const mainModule = process.mainModule;
-        if (mainModule && typeof mainModule === "object") {
-          ModuleClass = mainModule.constructor;
-        }
-      }
-      if (!ModuleClass && typeof __require !== "undefined" && typeof __require.main !== "undefined") {
-        ModuleClass = __require.main.constructor;
+      const ModuleClass = nodeModuleClass2;
+      const original = ModuleClass?.[prop];
+      if (!ModuleClass || typeof original !== "function") {
+        throw new Error("node:module Module class or method is unavailable");
       }
-      if (!ModuleClass || typeof ModuleClass._resolveFilename !== "function") {
-        return;
+      const descriptor = Object.getOwnPropertyDescriptor(ModuleClass, prop);
+      if (!descriptor) throw new Error("method descriptor is unavailable");
+      if (descriptor.configurable === false && descriptor.writable === false) {
+        throw new Error("method is non-configurable and non-writable");
       }
-      const original = ModuleClass._resolveFilename;
-      const descriptor = Object.getOwnPropertyDescriptor(
-        ModuleClass,
-        "_resolveFilename"
+      const proxy = new this.originalProxy(
+        original,
+        {
+          apply(target, thisArg, args) {
+            const message = `${path} is blocked in worker context`;
+            const violation = self.recordViolation(
+              violationType,
+              path,
+              message
+            );
+            if (!auditMode) {
+              throw new WorkerSecurityViolationError(message, violation);
+            }
+            return Reflect.apply(target, thisArg, args);
+          }
+        }
       );
       this.originalDescriptors.push({
         target: ModuleClass,
-        prop: "_resolveFilename",
+        prop,
         descriptor
       });
-      const path = "Module._resolveFilename";
-      const proxy = new this.originalProxy(original, {
-        apply(_target, _thisArg, _args) {
-          const message = `${path} is blocked in worker context`;
-          const violation = self.recordViolation(
-            "module_resolve_filename",
-            path,
-            message
-          );
-          if (!auditMode) {
-            throw new WorkerSecurityViolationError(message, violation);
-          }
-          return Reflect.apply(_target, _thisArg, _args);
-        }
-      });
-      Object.defineProperty(ModuleClass, "_resolveFilename", {
-        value: proxy,
-        writable: true,
-        configurable: true
+      Object.defineProperty(ModuleClass, prop, {
+        ...descriptor,
+        value: proxy
       });
+      const installed = Object.getOwnPropertyDescriptor(ModuleClass, prop);
+      if (ModuleClass[prop] !== proxy || installed?.value !== proxy) {
+        throw new Error("installed patch failed verification");
+      }
     } catch {
+      this.patchFailures.push(path);
     }
   }
   /**
@@ -1460,6 +1519,16 @@ var WorkerDefenseInDepth = class {
       if (strategy === "freeze") {
         if (typeof original === "object" && original !== null) {
           Object.freeze(original);
+          const path = this.getPathForTarget(target, prop);
+          const proxy = this.createReadonlyObjectProxy(
+            original,
+            path,
+            violationType
+          );
+          Object.defineProperty(target, prop, {
+            ...descriptor,
+            value: proxy
+          });
         }
       } else {
         const path = this.getPathForTarget(target, prop);
@@ -1506,6 +1575,7 @@ var _SharedArrayBuffer = globalThis.SharedArrayBuffer;
 var _Atomics = globalThis.Atomics;
 var _performanceNow = performance.now.bind(performance);
 var _Headers = globalThis.Headers;
+var _Proxy = globalThis.Proxy;
 
 // src/commands/worker-bridge/protocol.ts
 var OpCode = {
@@ -2293,7 +2363,7 @@ var FETCH_POLYFILL_SOURCE = `
 
   // --- Headers ---
   function Headers(init) {
-    this._map = {};
+    this._map = Object.create(null);
     if (!init) return;
     if (init instanceof Headers) {
       var keys = Object.keys(init._map);
@@ -2310,7 +2380,7 @@ var FETCH_POLYFILL_SOURCE = `
 
   Headers.prototype.append = function(name, value) {
     var key = String(name).toLowerCase();
-    if (!this._map[key]) this._map[key] = [];
+    if (!Object.prototype.hasOwnProperty.call(this._map, key)) this._map[key] = [];
     this._map[key].push(String(value));
   };
 
@@ -2324,7 +2394,7 @@ var FETCH_POLYFILL_SOURCE = `
   };
 
   Headers.prototype.has = function(name) {
-    return String(name).toLowerCase() in this._map;
+    return Object.prototype.hasOwnProperty.call(this._map, String(name).toLowerCase());
   };
 
   Headers.prototype.set = function(name, value) {
@@ -4613,17 +4683,23 @@ async function executeCode(input) {
     runtime?.dispose();
   }
 }
-var initPromise = initializeWithDefense().catch((e) => {
-  parentPort?.postMessage({
-    success: false,
-    // @banned-pattern-ignore: worker-internal init error; message stays within worker protocol, sanitized by js-exec.ts before user output
-    error: e.message,
-    defenseStats: defense?.getStats()
-  });
+var initPromise = initializeWithDefense();
+var initializationFailure;
+void initPromise.catch((error) => {
+  initializationFailure = error;
 });
 parentPort?.on("message", async (input) => {
+  let initialized = false;
   try {
-    await initPromise;
+    if (initializationFailure !== void 0) throw initializationFailure;
+    try {
+      await initPromise;
+    } catch (error) {
+      initializationFailure = error;
+      throw error;
+    }
+    if (initializationFailure !== void 0) throw initializationFailure;
+    initialized = true;
     const result = await executeCode(input);
     result.defenseStats = defense?.getStats();
     result.protocolToken = input.protocolToken;
@@ -4631,9 +4707,10 @@ parentPort?.on("message", async (input) => {
   } catch (e) {
     parentPort?.postMessage({
       protocolToken: input.protocolToken,
+      type: initialized ? void 0 : "initialization-failure",
       success: false,
       // @banned-pattern-ignore: worker-internal error; message stays within worker protocol, sanitized by js-exec.ts before user output
-      error: e.message,
+      error: e instanceof Error ? e.message : String(e),
       defenseStats: defense?.getStats()
     });
   }

package/dist/bundle/chunks/ln-VYDFOFNO.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-ELHOZMBD.js";import"./chunk-FOCWZZDE.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as lnCommand};

package/dist/bundle/chunks/ls-R5CQLZQM.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-INDA53JL.js";import"./chunk-AH7VTVWU.js";import"./chunk-STHBFACM.js";import"./chunk-IBRT3OJS.js";import"./chunk-YUSFCOM7.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-FOCWZZDE.js";import"./chunk-QIQMJJZ4.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as lsCommand};

package/dist/bundle/chunks/md5sum-JEDX55KS.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-ANCQ4SCV.js";import"./chunk-2KNTH3KH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as md5sumCommand};

package/dist/bundle/chunks/mkdir-WDDKK2P3.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-MLIO3BK2.js";import"./chunk-FOCWZZDE.js";import"./chunk-QIQMJJZ4.js";import"./chunk-W5DWRFSU.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as mkdirCommand};

package/dist/bundle/chunks/mv-XSJA2FNL.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-WHHRIZS3.js";import"./chunk-IBRT3OJS.js";import"./chunk-YUSFCOM7.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-FOCWZZDE.js";import"./chunk-QIQMJJZ4.js";import"./chunk-W5DWRFSU.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as mvCommand};

package/dist/bundle/chunks/nl-RFXH2GNX.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-5VCAQBXL.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as nl};

package/dist/bundle/chunks/od-YXD2NNIU.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-PJWSSENQ.js";import"./chunk-LJRVJXUI.js";import"./chunk-UBTKJ6MG.js";import"./chunk-AH7VTVWU.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as od};

package/dist/bundle/chunks/paste-ZU3EODNI.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-UB6T3UHL.js";import"./chunk-LJRVJXUI.js";import"./chunk-UBTKJ6MG.js";import"./chunk-AH7VTVWU.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-QIQMJJZ4.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as pasteCommand};

package/dist/bundle/chunks/printf-QHD2JRWQ.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-AMLHAS2N.js";import"./chunk-UHHCL65P.js";import"./chunk-6D3WD6YU.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-W5DWRFSU.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as printfCommand};

package/dist/bundle/chunks/pwd-76BPYV5F.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-SHKOQWO4.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as pwdCommand};

package/dist/bundle/chunks/python3-QDNG2UXX.js

@@ -0,0 +1,13 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a as Q,b as F}from"./chunk-CN3HTJTZ.js";import{a as I}from"./chunk-UK4BO5W3.js";import"./chunk-WNH3HOQA.js";import"./chunk-KIGPB52X.js";import"./chunk-K3XJ2WT4.js";import"./chunk-L2UW7DWF.js";import{a as A}from"./chunk-DLL7UR66.js";import{c as E}from"./chunk-AI5LSBJC.js";import{b}from"./chunk-UBTKJ6MG.js";import{d as v}from"./chunk-GN6CQ3J4.js";import{a as D,b as d}from"./chunk-FOCWZZDE.js";import{a as g}from"./chunk-W5DWRFSU.js";import{a as M,b as P}from"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";import{fileURLToPath as $}from"node:url";import{Worker as L}from"node:worker_threads";var z={name:"python3",summary:"Execute Python code via CPython Emscripten",usage:"python3 [OPTIONS] [-c CODE | -m MODULE | FILE] [ARGS...]",description:["Execute Python code using CPython compiled to WebAssembly via Emscripten.","","This command runs Python in an isolated environment with access to","the virtual filesystem. Standard library modules are available."],options:["-c CODE     Execute CODE as Python script","-m MODULE   Run library module as a script","--version   Show Python version","--help      Show this help"],examples:['python3 -c "print(1 + 2)"','python3 -c "import sys; print(sys.version)"',"python3 script.py","python3 script.py arg1 arg2",`echo 'print("hello")' | python3`],notes:["CPython runs in WebAssembly, so execution may be slower than native Python.","Standard library modules are available (no pip install).","Maximum execution time is 30 seconds by default."]};function B(r){let e={code:null,module:null,scriptFile:null,showVersion:!1,scriptArgs:[]};if(r.length===0)return e;let t=r.findIndex(n=>!n.startsWith("-")||n==="-"||n==="--");for(let n=0;n<(t===-1?r.length:t);n++){let i=r[n];if(i==="-c")return n+1>=r.length?{stdout:"",stderr:`python3: option requires an argument -- 'c'
+`,exitCode:2}:(e.code=r[n+1],e.scriptArgs=r.slice(n+2),e);if(i==="-m")return n+1>=r.length?{stdout:"",stderr:`python3: option requires an argument -- 'm'
+`,exitCode:2}:(e.module=r[n+1],e.scriptArgs=r.slice(n+2),e);if(i==="--version"||i==="-V")return e.showVersion=!0,e;if(i.startsWith("-")&&i!=="-")return{stdout:"",stderr:`python3: unrecognized option '${i}'
+`,exitCode:2}}if(t!==-1){let n=r[t];n==="--"?t+1<r.length&&(e.scriptFile=r[t+1],e.scriptArgs=r.slice(t+2)):(e.scriptFile=n,e.scriptArgs=r.slice(t+1))}return e}var C=new WeakMap;function _(r){let e=C.get(r);return e||(e={executionQueue:[],activeExecution:null,poisonedError:null},C.set(r,e)),e}function te(){C=new WeakMap}var R=$(new URL("./worker.js",import.meta.url));function H(r,e){if(!r||typeof r!="object")return{success:!1,error:"Malformed worker response"};let t=r;return typeof t.protocolToken!="string"||t.protocolToken!==e?{success:!1,error:"Malformed worker response: invalid protocol token"}:t.type==="security-violation"?{success:!1,error:`Security violation: ${typeof t.violation?.type=="string"?t.violation.type:"unknown"}`}:typeof t.success!="boolean"?{success:!1,error:"Malformed worker response: missing success flag"}:t.success?{success:!0}:{success:!1,error:typeof t.error=="string"&&t.error.length>0?t.error:"Worker execution failed"}}function w(r){if(r.poisonedError!==null){for(let o of r.executionQueue.splice(0))o.state==="queued"&&(o.state="settled",o.stopBridge(),o.settle({success:!1,error:r.poisonedError}));return}if(r.activeExecution!==null||r.executionQueue.length===0)return;for(;r.executionQueue.length>0&&r.executionQueue[0]?.state!=="queued";)r.executionQueue.shift();if(r.executionQueue.length===0)return;let e=r.executionQueue.shift();if(!e)return;e.state="running",r.activeExecution=e;let t;try{t=b.runTrusted(()=>new L(R,{workerData:e.input}))}catch(o){let s=o instanceof Error?o.message:String(o);e.state="settled",e.settle({success:!1,error:d(s)}),r.activeExecution===e&&(r.activeExecution=null,w(r));return}e.worker=t;let n=!0,i=()=>{n&&(n=!1,t.removeListener("message",x),t.removeListener("error",k),t.removeListener("exit",m))},c=async(o,s)=>{if(!(r.activeExecution?.executionId!==e.executionId||e.state!=="running")){if(e.state="terminating",i(),e.settle(o),s&&!await e.controller.terminate(t)){let p="Worker termination was not acknowledged";e.worker=null,e.state="settled",r.poisonedError=p,r.activeExecution?.executionId===e.executionId&&(r.activeExecution=null),w(r);return}e.worker=null,e.state="settled",r.activeExecution?.executionId===e.executionId&&(r.activeExecution=null,w(r))}};e.cancel=o=>{c(o,!0)};let f=E(e.requireDefenseContext,"python3","worker message callback",o=>{try{e.controller.assertMessageSize(o,"response")}catch(s){c({success:!1,error:d(g(s))},!0);return}c(H(o,e.input.protocolToken),!0)}),l=E(e.requireDefenseContext,"python3","worker error callback",o=>{let s=d(g(o));c({success:!1,error:s},!0)}),u=E(e.requireDefenseContext,"python3","worker exit callback",()=>{c({success:!1,error:"Worker exited unexpectedly"},!1)}),x=o=>{try{f(o)}catch(s){let a=s instanceof Error?s.message:String(s);c({success:!1,error:d(a)},!0)}},k=o=>{try{l(o)}catch(s){let a=s instanceof Error?s.message:String(s);c({success:!1,error:d(a)},!0)}},m=()=>{try{u()}catch(o){let s=o instanceof Error?o.message:String(o);c({success:!1,error:d(s)},!0)}};t.on("message",x),t.on("error",k),t.on("exit",m)}async function U(r,e,t,n=[]){let i=Q(),c=new F(i,e.fs,e.cwd,"python3",e.fetch,e.limits.maxOutputSize),f=e.limits.maxPythonTimeoutMs,l=_(e.fs);if(l.poisonedError!==null)return{stdout:"",stderr:`python3: ${l.poisonedError}
+`,exitCode:1};let u=new I({commandName:"python3",timeoutMs:f,signal:e.signal,maxMessageBytes:e.limits.maxWorkerMessageBytes}),x={protocolToken:u.protocolToken,sharedBuffer:i,pythonCode:r,cwd:e.cwd,env:A(e.env),args:n,scriptPath:t,timeoutMs:f,maxFileSize:e.limits.maxStringLength};u.assertMessageSize({...x,sharedBuffer:void 0},"request");let k=new Promise(s=>{let a=!1,p={executionId:Symbol("python3 execution"),input:x,settle:h=>{a||(a=!0,u.close(),s(h))},requireDefenseContext:e.requireDefenseContext,state:"queued",worker:null,controller:u,stopBridge:()=>c.stop?.(),cancel:()=>{}};p.cancel=h=>{if(p.state!=="queued")return;p.state="settled";let y=l.executionQueue.indexOf(p);y!==-1&&l.executionQueue.splice(y,1),p.settle(h),w(l)};let W=E(e.requireDefenseContext,"python3","worker cancellation callback",h=>{c.stop?.(),p.cancel({success:!1,error:h==="abort"?u.abortMessage():u.timeoutMessage()})}),O=h=>{try{W(h)}catch(y){let T=y instanceof Error?y.message:String(y);p.cancel({success:!1,error:d(T)})}};u.arm(O),u.isCanceled||(l.executionQueue.push(p),w(l))}),[m,o]=await Promise.all([c.run(f).catch(s=>({stdout:"",stderr:`python3: bridge error: ${d(g(s))}
+`,exitCode:1})),k.catch(s=>({success:!1,error:d(g(s))}))]);if(!o.success&&o.error){let s=d(o.error),a=o.error===u.timeoutMessage()||o.error===u.abortMessage();return{stdout:m.stdout,stderr:`${m.stderr}python3: ${s}
+`,exitCode:m.exitCode||(a?124:1)}}return{...m}}var N={name:"python3",async execute(r,e){if(P(r))return M(z);let t=B(r);if("exitCode"in t)return t;if(t.showVersion)return{stdout:`Python 3.13.2 (Emscripten)
+`,stderr:"",exitCode:0};let n,i;if(t.code!==null)n=t.code,i="-c";else if(t.module!==null){if(!/^[a-zA-Z_][a-zA-Z0-9_.]*$/.test(t.module))return{stdout:"",stderr:`python3: No module named '${t.module.slice(0,200)}'
+`,exitCode:1};n=`import runpy; runpy.run_module('${t.module}', run_name='__main__')`,i=t.module}else if(t.scriptFile==="-")n=v(e.stdin),i="-";else if(t.scriptFile!==null){let c=e.fs.resolvePath(e.cwd,t.scriptFile);if(!await e.fs.exists(c))return{stdout:"",stderr:`python3: can't open file '${t.scriptFile}': [Errno 2] No such file or directory
+`,exitCode:2};try{n=await e.fs.readFile(c),i=t.scriptFile}catch(f){let l=D(f.message);return{stdout:"",stderr:`python3: can't open file '${t.scriptFile}': ${l}
+`,exitCode:2}}}else if(v(e.stdin).trim())n=v(e.stdin),i="<stdin>";else return{stdout:"",stderr:`python3: no input provided (use -c CODE, -m MODULE, or provide a script file)
+`,exitCode:2};return U(n,e,i,t.scriptArgs)}},oe={name:"python",async execute(r,e){return N.execute(r,e)}};export{te as _resetExecutionQueue,N as python3Command,oe as pythonCommand};

package/dist/bundle/chunks/readlink-IY6QKK2P.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-G4SEENI7.js";import"./chunk-IBRT3OJS.js";import"./chunk-YUSFCOM7.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-FOCWZZDE.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as readlinkCommand};

package/dist/bundle/chunks/rev-EPOS3MFH.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-LVDUF74R.js";import"./chunk-GN6CQ3J4.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as rev};

package/dist/bundle/chunks/rg-OUJZ5DH6.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-RAHPENCM.js";import"./chunk-FIMO5HLX.js";import"./chunk-WENIVVEE.js";import"./chunk-L2UW7DWF.js";import"./chunk-XVL654YD.js";import"./chunk-LJRVJXUI.js";import"./chunk-UBTKJ6MG.js";import"./chunk-AH7VTVWU.js";import"./chunk-IBRT3OJS.js";import"./chunk-YUSFCOM7.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-FOCWZZDE.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as rgCommand};

package/dist/bundle/chunks/rm-JQ4GDKDD.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-LPJEKUCB.js";import"./chunk-FOCWZZDE.js";import"./chunk-QIQMJJZ4.js";import"./chunk-W5DWRFSU.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as rmCommand};

package/dist/bundle/chunks/rmdir-WZKAT6M5.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-MFGH46GH.js";import"./chunk-IBRT3OJS.js";import"./chunk-YUSFCOM7.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-FOCWZZDE.js";import"./chunk-QIQMJJZ4.js";import"./chunk-W5DWRFSU.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as rmdirCommand};

package/dist/bundle/chunks/sed-TZIPJOGL.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-NNH4ERNJ.js";import"./chunk-AI5LSBJC.js";import"./chunk-XVL654YD.js";import"./chunk-UBTKJ6MG.js";import"./chunk-6D3WD6YU.js";import"./chunk-AH7VTVWU.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-FOCWZZDE.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as sedCommand};

package/dist/bundle/chunks/seq-5R2GKXC6.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-N4TGZ6H7.js";import"./chunk-AH7VTVWU.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as seqCommand};

package/dist/bundle/chunks/sha1sum-BLPZJ6MP.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-FT6ODGOU.js";import"./chunk-2KNTH3KH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as sha1sumCommand};

package/dist/bundle/chunks/sha256sum-VJZ4PHQ4.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-OQ7C4FYO.js";import"./chunk-2KNTH3KH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as sha256sumCommand};

package/dist/bundle/chunks/sleep-VPYWSKDR.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-SELXJ5KQ.js";import"./chunk-SX2HC7SO.js";import"./chunk-K3XJ2WT4.js";import"./chunk-UBTKJ6MG.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as sleepCommand};

package/dist/bundle/chunks/sort-PV2NEQHF.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-6R4OQQWP.js";import"./chunk-CHHWTPDH.js";import"./chunk-STHBFACM.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as sortCommand};

package/dist/bundle/chunks/split-KNDNAFPT.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b}from"./chunk-E3D4WVAH.js";import"./chunk-LJRVJXUI.js";import"./chunk-UBTKJ6MG.js";import"./chunk-IBRT3OJS.js";import"./chunk-YUSFCOM7.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-FOCWZZDE.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{b as flagsForFuzzing,a as split};

package/dist/bundle/chunks/sqlite3-WWZJZW37.js

@@ -0,0 +1,2 @@
+import{createRequire} from"node:module";const require=createRequire(import.meta.url);
+import{a,b,c}from"./chunk-EWWPEE2G.js";import"./chunk-UK4BO5W3.js";import"./chunk-K3XJ2WT4.js";import"./chunk-AI5LSBJC.js";import"./chunk-UBTKJ6MG.js";import"./chunk-IBRT3OJS.js";import"./chunk-YUSFCOM7.js";import"./chunk-EFORKKSH.js";import"./chunk-GN6CQ3J4.js";import"./chunk-FOCWZZDE.js";import"./chunk-W5DWRFSU.js";import"./chunk-QAYAQNCG.js";import"./chunk-NCUTH6QL.js";export{a as _internals,c as flagsForFuzzing,b as sqlite3Command};