reverseport 0.0.0-stage → 1.2.0

package/dist/native/pwntools/RecordedCrashStructureBindings.js

@@ -0,0 +1,103 @@
+import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
+// Exact amd64/core enum projections in the pinned pyelftools 0.33 profile.
+const segmentKinds = new Map([
+    [0, "PT_NULL"],
+    [1, "PT_LOAD"],
+    [2, "PT_DYNAMIC"],
+    [3, "PT_INTERP"],
+    [4, "PT_NOTE"],
+    [5, "PT_SHLIB"],
+    [6, "PT_PHDR"],
+    [7, "PT_TLS"],
+    [0x60000000, "PT_LOOS"],
+    [0x6fffffff, "PT_HIOS"],
+    [0x6474e550, "PT_GNU_EH_FRAME"],
+    [0x6474e551, "PT_GNU_STACK"],
+    [0x6474e552, "PT_GNU_RELRO"],
+    [0x6474e553, "PT_GNU_PROPERTY"],
+]);
+const noteKinds = new Map([
+    [1, "NT_PRSTATUS"],
+    [2, "NT_FPREGSET"],
+    [3, "NT_PRPSINFO"],
+    [4, "NT_TASKSTRUCT"],
+    [6, "NT_AUXV"],
+    [0x53494749, "NT_SIGINFO"],
+    [0x46494c45, "NT_FILE"],
+]);
+const matchesKind = (raw, reported, kinds) => {
+    const known = kinds.get(raw);
+    return typeof reported === "string"
+        ? reported === known
+        : known === undefined && reported === raw;
+};
+const segmentMatches = (segment, raw) => {
+    const type = raw.readUInt32LE(0);
+    return (matchesKind(type, segment.type, segmentKinds) &&
+        BigInt(segment.flags) === BigInt(raw.readUInt32LE(4)) &&
+        segment.file_backing ===
+            (type === 0 || raw.readBigUInt64LE(32) === 0n ? "none" : "file") &&
+        [
+            [segment.offset, 8],
+            [segment.virtual_address, 16],
+            [segment.physical_address, 24],
+            [segment.file_size, 32],
+            [segment.memory_size, 40],
+            [segment.alignment, 48],
+        ].every(([field, relative]) => BigInt(field) === raw.readBigUInt64LE(relative)));
+};
+/** Bind coverage-bearing ELF and note headers to the same snapshot as their payloads. */
+export function validateRecordedCrashStructure(report, snapshot, diagnostics) {
+    const fail = () => {
+        throw new AnalysisOutputError("inspect_recorded_crash", "Reported core structure differs from its original ELF/note headers.", { capturedOutput: diagnostics });
+    };
+    const bytesAt = (offset, bytes) => {
+        if (offset < 0n || offset > BigInt(snapshot.length - bytes))
+            return fail();
+        return snapshot.subarray(Number(offset), Number(offset) + bytes);
+    };
+    const header = bytesAt(0n, 64);
+    if (!header
+        .subarray(0, 6)
+        .equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46, 2, 1])) ||
+        header[6] !== 1 ||
+        header.readUInt32LE(20) !== 1 ||
+        ![0, 3].includes(header[7] ?? -1) ||
+        header[8] !== 0 ||
+        header.readUInt16LE(16) !== 4 ||
+        header.readUInt16LE(18) !== 62)
+        fail();
+    const table = header.readBigUInt64LE(32);
+    const entryBytes = header.readUInt16LE(54);
+    let count = header.readUInt16LE(56);
+    if (count === 0xffff) {
+        if (header.readUInt16LE(58) < 64)
+            return fail();
+        count = bytesAt(header.readBigUInt64LE(40), 64).readUInt32LE(44);
+    }
+    if (count !== report.segments.length || (count > 0 && entryBytes < 56))
+        fail();
+    for (const segment of report.segments) {
+        const offset = table + BigInt(segment.index) * BigInt(entryBytes);
+        if (BigInt(segment.header_location.offset) !== offset ||
+            BigInt(segment.header_location.bytes) !== BigInt(entryBytes))
+            fail();
+        const raw = bytesAt(offset, entryBytes);
+        if (!segmentMatches(segment, raw))
+            fail();
+    }
+    for (const note of report.notes) {
+        const raw = bytesAt(BigInt(note.location.offset), 12);
+        if (BigInt(note.owner_location.bytes) !== BigInt(raw.readUInt32LE(0)) ||
+            BigInt(note.descriptor_location.bytes) !== BigInt(raw.readUInt32LE(4)) ||
+            !matchesKind(raw.readUInt32LE(8), note.type, noteKinds))
+            fail();
+        const owner = bytesAt(BigInt(note.owner_location.offset), raw.readUInt32LE(0));
+        const terminator = owner.indexOf(0);
+        const display = owner.length === 0
+            ? null
+            : owner.subarray(0, terminator).toString("utf8");
+        if ((owner.length > 0 && terminator < 0) || note.owner_display !== display)
+            fail();
+    }
+}

package/dist/process/BoundedFileBytes.js

@@ -0,0 +1,40 @@
+/** Read through EOF, returning undefined on overflow; leave the handle open. */
+export const readBoundedFileBytes = async (handle, maxBytes, signal, expectedSize) => {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0)
+        throw new RangeError("File byte limit must be a nonnegative safe integer");
+    if (expectedSize !== undefined &&
+        (!Number.isSafeInteger(expectedSize) ||
+            expectedSize < 0 ||
+            expectedSize > maxBytes))
+        throw new RangeError("Expected file size must fit the byte limit");
+    if (expectedSize === undefined) {
+        const chunks = [];
+        const buffer = Buffer.allocUnsafe(Math.min(64 * 1_024, maxBytes + 1));
+        let total = 0;
+        for (;;) {
+            signal?.throwIfAborted();
+            const { bytesRead } = await handle.read(buffer, 0, Math.min(buffer.length, maxBytes - total + 1), null);
+            if (bytesRead === 0)
+                return Buffer.concat(chunks, total);
+            total += bytesRead;
+            if (total > maxBytes)
+                return undefined;
+            chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
+        }
+    }
+    const buffer = Buffer.allocUnsafe(expectedSize);
+    if (expectedSize === 0)
+        return buffer;
+    let total = 0;
+    for (;;) {
+        signal?.throwIfAborted();
+        const { bytesRead } = await handle.read(buffer, total, expectedSize - total, null);
+        if (bytesRead === 0)
+            return buffer.subarray(0, total);
+        total += bytesRead;
+        if (total > maxBytes)
+            return undefined;
+        if (total === expectedSize)
+            return buffer;
+    }
+};

package/dist/process/DarwinProcessRunTokenReader.js

@@ -0,0 +1,376 @@
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { z } from "zod";
+import { safeParseJson } from "../domain/safeJson.js";
+import { boundedUtf8Text } from "./boundedUtf8Text.js";
+import { execFileOutput, execFileOutputFailure } from "./ExecFileOutput.js";
+const responseSchema = z.strictObject({
+    results: z.array(z.discriminatedUnion("state", [
+        z.strictObject({
+            pid: z.number().int().positive(),
+            state: z.literal("readable"),
+            run_id: z.string().optional(),
+            reason: z.null().optional(),
+        }),
+        z.strictObject({
+            pid: z.number().int().positive(),
+            state: z.literal("unavailable"),
+            run_id: z.union([z.string(), z.null()]).optional(),
+            reason: z.string().min(1),
+        }),
+    ])),
+});
+const identityResponseSchema = z.strictObject({
+    results: z.array(z.discriminatedUnion("state", [
+        z.strictObject({
+            pid: z.number().int().positive(),
+            state: z.literal("readable"),
+            identity: z.string().min(1),
+            reason: z.null().optional(),
+        }),
+        z.strictObject({
+            pid: z.number().int().positive(),
+            state: z.literal("unavailable"),
+            identity: z.null().optional(),
+            reason: z.string().min(1),
+        }),
+    ])),
+});
+const sourceFiles = [
+    fileURLToPath(new URL("../../bridge/process/ProcessRunTokenReader.swift", import.meta.url)),
+    fileURLToPath(new URL("../../bridge/process/ProcessRunTokenReaderMain.swift", import.meta.url)),
+];
+/**
+ * swift-driver runs each frontend job in its own process group. On SIGINT it
+ * stops those jobs and deletes their objects before exiting; on SIGTERM it
+ * exits while a job can still write objects under TMPDIR.
+ */
+export const SWIFTC_INTERRUPT = "SIGINT";
+/** Deadline for the one-shot helper compilation. */
+const COMPILER_TIMEOUT_MS = 60_000;
+/** Bound on compiler diagnostics embedded in the inspection failure text. */
+const STDERR_EXCERPT_LIMIT = 512;
+/** The native Darwin process-ownership reader could not be prepared. */
+export class DarwinProcessOwnershipInspectionError extends Error {
+    constructor(message, options) {
+        const { compilerOutcome, ...errorOptions } = options ?? {};
+        super(message, errorOptions);
+        this.name = "DarwinProcessOwnershipInspectionError";
+        this.compilerOutcome = compilerOutcome;
+    }
+    compilerOutcome;
+}
+const MAX_COMPILER_STDERR_BYTES = 8 * 1024;
+const compilerOutcome = (cause, timeoutMs) => {
+    const failure = execFileOutputFailure(cause);
+    if (failure === undefined)
+        return undefined;
+    const stderr = boundedUtf8Text(failure.stderr, MAX_COMPILER_STDERR_BYTES);
+    const outcome = failure.code === "ETIMEDOUT"
+        ? "timed_out"
+        : typeof failure.code === "number"
+            ? "exited"
+            : failure.signal !== null
+                ? "signaled"
+                : failure.code === "ENOENT"
+                    ? "spawn_failed"
+                    : "failed";
+    return {
+        outcome,
+        code: failure.code,
+        signal: failure.signal,
+        stderr: stderr.text,
+        stderrBytes: Buffer.byteLength(failure.stderr, "utf8"),
+        stderrTruncated: stderr.truncated,
+        outputTruncated: failure.outputTruncated,
+        killed: failure.killed,
+        ...(outcome === "timed_out" ? { timeoutMs } : {}),
+    };
+};
+const compilerOutcomeDescription = (outcome, fallbackCode) => {
+    if (outcome === undefined)
+        return `compiler result: ${String(fallbackCode)}`;
+    if (outcome.outcome === "exited")
+        return `compiler result: exit code ${String(outcome.code)}`;
+    if (outcome.outcome === "timed_out")
+        return `compiler result: timed out after ${String(outcome.timeoutMs)} ms`;
+    if (outcome.outcome === "signaled")
+        return `compiler result: stopped by signal ${outcome.signal ?? "an unknown signal"}`;
+    return `compiler result: ${String(outcome.code)}`;
+};
+const compilerInspectionError = (cause, timeoutMs) => {
+    const outcome = compilerOutcome(cause, timeoutMs);
+    const code = outcome?.code ?? "unknown";
+    const description = compilerOutcomeDescription(outcome, code);
+    const prefix = code === "ENOENT"
+        ? "macOS process ownership inspection requires the Apple Swift compiler via xcrun"
+        : "macOS process ownership helper compilation failed via xcrun";
+    const stderr = boundedUtf8Text(outcome?.stderr ?? "", STDERR_EXCERPT_LIMIT);
+    const diagnostics = stderr.text.trim();
+    const truncated = stderr.truncated ||
+        outcome?.stderrTruncated === true ||
+        outcome?.outputTruncated === true;
+    const suffix = diagnostics
+        ? `: ${diagnostics}${truncated ? "… [diagnostics truncated]" : ""}`
+        : outcome === undefined
+            ? `: ${cause instanceof Error ? cause.message : String(cause)}`
+            : ": no compiler diagnostics were captured";
+    return new DarwinProcessOwnershipInspectionError(`${prefix} (${description})${suffix}`, {
+        cause,
+        ...(outcome === undefined ? {} : { compilerOutcome: outcome }),
+    });
+};
+const abortReason = (signal) => {
+    if (signal.reason !== undefined)
+        return signal.reason;
+    const error = new Error("The operation was aborted");
+    error.name = "AbortError";
+    return error;
+};
+const isExpectedAbort = (cause, signal) => signal.aborted &&
+    (cause === signal.reason ||
+        (cause instanceof Error && cause.name === "AbortError"));
+const waitForCompilation = async (promise, signal) => {
+    if (signal === undefined)
+        return promise;
+    if (signal.aborted)
+        throw abortReason(signal);
+    return new Promise((resolve, reject) => {
+        let completed = false;
+        const finish = (callback) => {
+            if (completed)
+                return;
+            completed = true;
+            signal.removeEventListener("abort", onAbort);
+            callback();
+        };
+        const onAbort = () => finish(() => reject(abortReason(signal)));
+        signal.addEventListener("abort", onAbort, { once: true });
+        promise.then((value) => finish(() => resolve(value)), (cause) => finish(() => reject(cause)));
+        if (signal.aborted)
+            onAbort();
+    });
+};
+/** Compile and retain the narrow Darwin sysctl reader for this REA process. */
+export const createDarwinProcessRunTokenReader = (options = {}) => {
+    const compilerTimeoutMs = options.compileTimeoutMs ?? COMPILER_TIMEOUT_MS;
+    let root;
+    let executable;
+    let compilation;
+    let closePromise;
+    let closed = false;
+    let exitCleanupInstalled = false;
+    const cleanupAtExit = () => {
+        if (root !== undefined)
+            rmSync(root, { recursive: true, force: true });
+    };
+    const cleanupRoot = async (target = root) => {
+        if (target === undefined)
+            return;
+        await rm(target, { recursive: true, force: true });
+        if (root !== target)
+            return;
+        root = undefined;
+        executable = undefined;
+        if (exitCleanupInstalled)
+            process.removeListener("exit", cleanupAtExit);
+        exitCleanupInstalled = false;
+    };
+    const runCompilation = async (signal) => {
+        let operationRoot;
+        try {
+            operationRoot = await mkdtemp(join(tmpdir(), "rea-process-token-"));
+            root = operationRoot;
+            process.once("exit", cleanupAtExit);
+            exitCleanupInstalled = true;
+            if (signal.aborted || closed)
+                throw abortReason(signal);
+            const output = join(operationRoot, "reader");
+            // swiftc keeps intermediate objects under TMPDIR, so keep them inside
+            // the root that cleanup removes.
+            const compilerTemporary = join(operationRoot, "tmp");
+            await mkdir(compilerTemporary);
+            const compilerEnvironment = {
+                ...process.env,
+                TMPDIR: compilerTemporary,
+            };
+            // Use Swift's reusable default cache for REA's internal helper compilation.
+            delete compilerEnvironment.CLANG_MODULE_CACHE_PATH;
+            try {
+                await execFileOutput(options.xcrun ?? "/usr/bin/xcrun", ["swiftc", ...sourceFiles, "-o", output], {
+                    timeout: compilerTimeoutMs,
+                    maxBuffer: 1024 * 1024,
+                    signal,
+                    stopSignal: SWIFTC_INTERRUPT,
+                    env: compilerEnvironment,
+                });
+            }
+            catch (cause) {
+                if (isExpectedAbort(cause, signal))
+                    throw cause;
+                throw compilerInspectionError(cause, compilerTimeoutMs);
+            }
+            if (signal.aborted || closed)
+                throw abortReason(signal);
+            executable = output;
+            return output;
+        }
+        catch (cause) {
+            const ownsRoot = operationRoot !== undefined && root === operationRoot;
+            if (operationRoot !== undefined) {
+                if (ownsRoot)
+                    await cleanupRoot(operationRoot);
+                else
+                    await rm(operationRoot, { recursive: true, force: true });
+            }
+            throw cause;
+        }
+    };
+    const beginCompilation = () => {
+        const controller = new AbortController();
+        const operation = {
+            controller,
+            promise: runCompilation(controller.signal).finally(() => {
+                operation.settled = true;
+                if (compilation === operation)
+                    compilation = undefined;
+            }),
+            waiters: 0,
+            aborting: false,
+            settled: false,
+        };
+        compilation = operation;
+        return operation;
+    };
+    const compile = async (signal) => {
+        if (closed)
+            throw new Error("Darwin process token reader is closed");
+        signal?.throwIfAborted();
+        while (true) {
+            if (closed)
+                throw new Error("Darwin process token reader is closed");
+            signal?.throwIfAborted();
+            if (executable !== undefined)
+                return executable;
+            if (compilation === undefined && root !== undefined) {
+                await cleanupRoot();
+                continue;
+            }
+            let operation = compilation;
+            if (operation?.aborting === true) {
+                try {
+                    await waitForCompilation(operation.promise, signal);
+                }
+                catch (cause) {
+                    if (signal !== undefined && isExpectedAbort(cause, signal))
+                        throw cause;
+                }
+                continue;
+            }
+            operation ??= beginCompilation();
+            operation.waiters += 1;
+            try {
+                return await waitForCompilation(operation.promise, signal);
+            }
+            finally {
+                operation.waiters -= 1;
+                if (operation.waiters === 0 &&
+                    !operation.settled &&
+                    !operation.aborting) {
+                    operation.aborting = true;
+                    operation.controller.abort();
+                    await operation.promise.catch(() => undefined);
+                }
+            }
+        }
+    };
+    const read = async (processes, signal) => {
+        signal?.throwIfAborted();
+        if (processes.length === 0)
+            return new Map();
+        const binary = await compile(signal);
+        const pids = processes.map(({ pid }) => String(pid));
+        const { stdout } = await execFileOutput(binary, pids, {
+            timeout: 15_000,
+            ...(signal === undefined ? {} : { signal }),
+        });
+        signal?.throwIfAborted();
+        const decoded = safeParseJson(stdout);
+        if (!decoded.ok)
+            throw new Error(`macOS process token helper returned invalid JSON: ${decoded.error}`, { cause: decoded.cause });
+        const parsed = responseSchema.safeParse(decoded.value);
+        if (!parsed.success)
+            throw new Error("macOS process token helper returned an invalid response", {
+                cause: parsed.error,
+            });
+        const requested = new Set(processes.map(({ pid }) => pid));
+        const observations = new Map();
+        for (const result of parsed.data.results) {
+            if (!requested.has(result.pid) || observations.has(result.pid))
+                throw new Error("macOS process token helper returned an unexpected PID set");
+            observations.set(result.pid, result.state === "readable"
+                ? { state: "readable", runId: result.run_id }
+                : {
+                    state: "unavailable",
+                    reason: result.reason ?? "process token observation is unavailable",
+                });
+        }
+        if (observations.size !== requested.size)
+            throw new Error("macOS process token helper returned an incomplete PID set");
+        return observations;
+    };
+    const identities = async (processes, signal) => {
+        if (processes.length === 0)
+            return new Map();
+        const binary = await compile(signal);
+        const pids = processes.map(({ pid }) => String(pid));
+        const { stdout } = await execFileOutput(binary, ["--identities", ...pids], {
+            timeout: 15_000,
+            ...(signal === undefined ? {} : { signal }),
+        });
+        const decoded = safeParseJson(stdout);
+        if (!decoded.ok)
+            throw new Error(`macOS process identity helper returned invalid JSON: ${decoded.error}`, { cause: decoded.cause });
+        const parsed = identityResponseSchema.safeParse(decoded.value);
+        if (!parsed.success)
+            throw new Error("macOS process identity helper returned an invalid response", {
+                cause: parsed.error,
+            });
+        const requested = new Set(processes.map(({ pid }) => pid));
+        const observations = new Map();
+        for (const result of parsed.data.results) {
+            if (!requested.has(result.pid) || observations.has(result.pid))
+                throw new Error("macOS process identity helper returned an unexpected PID set");
+            observations.set(result.pid, result.state === "readable"
+                ? { state: "readable", identity: result.identity }
+                : { state: "unavailable", reason: result.reason });
+        }
+        if (observations.size !== requested.size)
+            throw new Error("macOS process identity helper returned an incomplete PID set");
+        return observations;
+    };
+    const close = () => {
+        if (closePromise !== undefined)
+            return closePromise;
+        closed = true;
+        const pendingClose = (async () => {
+            const operation = compilation;
+            if (operation !== undefined && !operation.settled) {
+                operation.aborting = true;
+                operation.controller.abort();
+                await operation.promise.catch(() => undefined);
+            }
+            await cleanupRoot();
+        })().catch((cause) => {
+            if (closePromise === pendingClose)
+                closePromise = undefined;
+            throw cause;
+        });
+        closePromise = pendingClose;
+        return closePromise;
+    };
+    return { read, identities, prepare: compile, close };
+};

package/dist/process/ExecFileOutput.js

@@ -0,0 +1,124 @@
+import { execFile, } from "node:child_process";
+/** How long a stopped process may take to exit before it is killed. */
+const STOP_GRACE_MS = 5_000;
+const abortError = (signal) => {
+    const error = new Error("The operation was aborted", {
+        cause: signal.reason,
+    });
+    error.name = "AbortError";
+    Reflect.set(error, "code", "ABORT_ERR");
+    return error;
+};
+/**
+ * A command stopped at its timeout can still exit cleanly, so the timeout is
+ * the failure. Like Node's execFile timeout, it reports `killed: true`.
+ */
+const timeoutError = (command, timeout, exit) => {
+    const error = new Error(`Command timed out after ${String(timeout)} ms: ${command}`, exit === null ? undefined : { cause: exit });
+    Reflect.set(error, "code", "ETIMEDOUT");
+    Reflect.set(error, "killed", true);
+    Reflect.set(error, "signal", exit === null ? null : (Reflect.get(exit, "signal") ?? null));
+    return error;
+};
+/**
+ * The `timeout` contract for both modes, checked before spawning. A stoppable
+ * command keeps its own deadline, so execFile never validates it. Node 26's
+ * execFile also caps it at Number.MAX_SAFE_INTEGER; Node 22 and 24 accept
+ * larger integers, which their timers then clamp to 1 ms.
+ */
+const invalidTimeout = (timeout) => {
+    if (Number.isSafeInteger(timeout) && timeout >= 0)
+        return undefined;
+    const error = new RangeError(`The value of "timeout" is out of range. It must be an unsigned integer. Received ${String(timeout)}`);
+    Reflect.set(error, "code", "ERR_OUT_OF_RANGE");
+    return error;
+};
+/** Read captured output metadata from a failed execFileOutput invocation. */
+export const execFileOutputFailure = (cause) => {
+    if (!(cause instanceof Error))
+        return undefined;
+    const stdout = Reflect.get(cause, "stdout");
+    const stderr = Reflect.get(cause, "stderr");
+    const code = Reflect.get(cause, "code");
+    const signal = Reflect.get(cause, "signal");
+    const killed = Reflect.get(cause, "killed");
+    if (typeof stdout !== "string" || typeof stderr !== "string")
+        return undefined;
+    return {
+        stdout,
+        stderr,
+        code: typeof code === "string" || typeof code === "number" ? code : null,
+        signal: typeof signal === "string" ? signal : null,
+        killed: killed === true,
+        outputTruncated: code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER",
+    };
+};
+/** Run a shell-free command while capturing its complete output bytes. */
+export const execFileBytes = (command, arguments_, options = {}) => new Promise((resolve, reject) => {
+    const { stopSignal, signal, timeout, ...execOptions } = options;
+    const invalid = timeout === undefined ? undefined : invalidTimeout(timeout);
+    if (invalid !== undefined) {
+        reject(invalid);
+        return;
+    }
+    if (stopSignal !== undefined && signal?.aborted === true) {
+        reject(abortError(signal));
+        return;
+    }
+    let stopped;
+    let deadline;
+    let grace;
+    const child = execFile(command, [...arguments_], {
+        ...execOptions,
+        // A stoppable command's abort and timeout are handled below, because
+        // execFile neither waits for the exit on abort nor kills a process
+        // that ignores its timeout signal.
+        ...(stopSignal === undefined
+            ? {
+                ...(signal === undefined ? {} : { signal }),
+                ...(timeout === undefined ? {} : { timeout }),
+            }
+            : { killSignal: stopSignal }),
+        encoding: "buffer",
+        maxBuffer: options.maxBuffer ?? Number.POSITIVE_INFINITY,
+    }, (error, stdout, stderr) => {
+        signal?.removeEventListener("abort", onAbort);
+        clearTimeout(deadline);
+        clearTimeout(grace);
+        const failure = stopped === "abort" && signal !== undefined
+            ? abortError(signal)
+            : stopped === "timeout" && timeout !== undefined
+                ? timeoutError(command, timeout, error)
+                : error;
+        if (failure !== null) {
+            Reflect.set(failure, "stdout", stdout.toString("utf8"));
+            Reflect.set(failure, "stderr", stderr.toString("utf8"));
+            reject(failure);
+            return;
+        }
+        resolve({ stdout, stderr });
+    });
+    // The first stop request names the failure; a later one is not resent.
+    const stop = (reason) => {
+        if (stopped !== undefined)
+            return;
+        stopped = reason;
+        child.kill(stopSignal);
+        grace = setTimeout(() => child.kill("SIGKILL"), STOP_GRACE_MS);
+    };
+    const onAbort = () => {
+        stop("abort");
+    };
+    if (stopSignal === undefined)
+        return;
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (timeout !== undefined && timeout > 0)
+        deadline = setTimeout(() => {
+            stop("timeout");
+        }, timeout);
+});
+/** Run a shell-free command while capturing its complete UTF-8 output. */
+export const execFileOutput = (command, arguments_, options = {}) => execFileBytes(command, arguments_, options).then(({ stdout, stderr }) => ({
+    stdout: stdout.toString("utf8"),
+    stderr: stderr.toString("utf8"),
+}));

package/dist/process/JavaScriptWorkerMemoryLimit.js

@@ -0,0 +1,25 @@
+import { javaScriptRuntime } from "../domain/runtimeVersion.js";
+const MIB = 1024 * 1024;
+/**
+ * Commit reserved for Bun itself above a worker's heap budget.
+ *
+ * Measured on Windows x64 (Bun 1.4.2, 32 logical processors) as the peak Job
+ * Object commit of each REA worker on a trivial input: `bun -e 1` commits
+ * 52 MiB, while the source-map codec (278-368 MiB), HAR decoder (300-345 MiB)
+ * and JavaScript analysis worker (321-346 MiB) commit up to 368 MiB before any
+ * real workload because JavaScriptCore commits parsed and compiled module code
+ * and per-thread runtime state. 512 MiB covers that peak with about 40%
+ * margin for hosts with other processor counts or module layouts.
+ */
+export const BUN_WORKER_RUNTIME_RESERVE_BYTES = 512 * MIB;
+/**
+ * Process commit limit for a JavaScript worker launched on `process.execPath`.
+ *
+ * Node.js enforces each worker's V8 heap flags, so it receives no process
+ * limit (null) and its launch is unchanged. Bun ignores those flags; on Windows
+ * the owned Job Object then enforces the worker's heap budget plus Bun's
+ * runtime reserve. Bun elsewhere has no owned enforcement and also gets null.
+ */
+export const javaScriptWorkerMemoryLimitBytes = (heapBudgetMiB, host = process) => host.platform === "win32" && javaScriptRuntime(host.versions).id === "bun"
+    ? heapBudgetMiB * MIB + BUN_WORKER_RUNTIME_RESERVE_BYTES
+    : null;