typescript-virtual-container 1.2.7 → 1.2.9

package/src/commands/index.ts

@@ -1,5 +1,7 @@
 /** biome-ignore-all lint/style/useNamingConvention: ENV VARIABLES */
+import { executeStatements } from "../SSHMimic/executor";
 import type { VirtualShell } from "../VirtualShell";
+import { parseScript } from "../VirtualShell/shellParser";
 import type {
 	CommandContext,
 	CommandMode,
@@ -8,6 +10,11 @@ import type {
 	ShellModule,
 } from "../types/commands";
 import { adduserCommand } from "./adduser";
+import { aliasCommand, unaliasCommand } from "./alias";
+import { testCommand } from "./test";
+import { sourceCommand } from "./source";
+import { historyCommand } from "./history";
+import { aptCacheCommand, aptCommand } from "./apt";
 import { awkCommand } from "./awk";
 import { base64Command } from "./base64";
 import { catCommand } from "./cat";
@@ -21,12 +28,14 @@ import { dateCommand } from "./date";
 import { deluserCommand } from "./deluser";
 import { dfCommand } from "./df";
 import { diffCommand } from "./diff";
+import { dpkgCommand, dpkgQueryCommand } from "./dpkg";
 import { duCommand } from "./du";
 import { echoCommand } from "./echo";
 import { envCommand } from "./env";
 import { exitCommand } from "./exit";
 import { exportCommand } from "./export";
 import { findCommand } from "./find";
+import { freeCommand } from "./free";
 import { grepCommand } from "./grep";
 import { groupsCommand } from "./groups";
 import { gunzipCommand, gzipCommand } from "./gzip";
@@ -38,6 +47,8 @@ import { idCommand } from "./id";
 import { killCommand } from "./kill";
 import { lnCommand } from "./ln";
 import { lsCommand } from "./ls";
+import { lsbReleaseCommand } from "./lsb-release";
+import { manCommand } from "./man";
 import { mkdirCommand } from "./mkdir";
 import { mvCommand } from "./mv";
 import { nanoCommand } from "./nano";
@@ -60,11 +71,14 @@ import { teeCommand } from "./tee";
 import { touchCommand } from "./touch";
 import { trCommand } from "./tr";
 import { treeCommand } from "./tree";
+import { typeCommand } from "./type";
 import { unameCommand } from "./uname";
 import { uniqCommand } from "./uniq";
 import { unsetCommand } from "./unset";
+import { uptimeCommand } from "./uptime";
 import { wcCommand } from "./wc";
 import { wgetCommand } from "./wget";
+import { whichCommand } from "./which";
 import { whoCommand } from "./who";
 import { whoamiCommand } from "./whoami";
 import { xargsCommand } from "./xargs";
@@ -95,6 +109,13 @@ const BASE_COMMANDS: ShellModule[] = [
 	adduserCommand, passwdCommand, deluserCommand, sudoCommand, suCommand,
 	// Misc
 	neofetchCommand,
+	// Package management
+	aptCommand, aptCacheCommand, dpkgCommand, dpkgQueryCommand,
+	// Shell (extended)
+	whichCommand, typeCommand, manCommand, aliasCommand, unaliasCommand,
+	testCommand, sourceCommand, historyCommand,
+	// System (extended)
+	uptimeCommand, freeCommand, lsbReleaseCommand,
 ];
 
 const customCommands: ShellModule[] = [];
@@ -196,6 +217,52 @@ export function makeDefaultEnv(authUser: string, hostname: string): ShellEnv {
 	};
 }
 
+/**
+ * Execute a pre-parsed command directly by name and argument list.
+ *
+ * Unlike `runCommand`, this function does NOT re-join name+args into a string
+ * and re-parse — so arguments that contain special characters (`;`, `|`, `>`,
+ * quotes) are passed through verbatim. Use this from the pipeline executor.
+ */
+export async function runCommandDirect(
+	name: string,
+	args: string[],
+	authUser: string,
+	hostname: string,
+	mode: CommandMode,
+	cwd: string,
+	shell: VirtualShell,
+	stdin: string | undefined,
+	env: ShellEnv,
+): Promise<CommandResult> {
+	// Alias expansion on the command name
+	const aliasVal = env.vars[`__alias_${name}`];
+	if (aliasVal) {
+		// Alias may expand to a multi-word command — re-route through runCommand
+		return runCommand(`${aliasVal} ${args.join(" ")}`, authUser, hostname, mode, cwd, shell, stdin, env);
+	}
+
+	const mod = resolveModule(name);
+	if (!mod) return { stderr: `${name}: command not found`, exitCode: 127 };
+
+	try {
+		return await mod.run({
+			authUser,
+			hostname,
+			activeSessions: shell.users.listActiveSessions(),
+			rawInput: [name, ...args].join(" "),
+			mode,
+			args,
+			stdin,
+			cwd,
+			shell,
+			env,
+		});
+	} catch (error: unknown) {
+		return { stderr: error instanceof Error ? error.message : "Command failed", exitCode: 1 };
+	}
+}
+
 export async function runCommand(
 	rawInput: string,
 	authUser: string,
@@ -211,18 +278,56 @@ export async function runCommand(
 
 	const shellEnv: ShellEnv = env ?? makeDefaultEnv(authUser, hostname);
 
+	// ── $(cmd) command substitution ──────────────────────────────────────────
+	let expanded = trimmed;
+	if (expanded.includes("$(")) {
+		// Only substitute $(…) that are NOT inside single quotes
+		// Strategy: walk char by char, track single-quote state
+		let result = "";
+		let inSingle = false;
+		let i = 0;
+		while (i < expanded.length) {
+			const ch = expanded[i]!;
+			if (ch === "'" && !inSingle) { inSingle = true; result += ch; i++; continue; }
+			if (ch === "'" && inSingle)  { inSingle = false; result += ch; i++; continue; }
+			if (!inSingle && ch === "$" && expanded[i + 1] === "(") {
+				// Find matching closing )
+				let depth = 0;
+				let j = i + 1;
+				while (j < expanded.length) {
+					if (expanded[j] === "(") depth++;
+					else if (expanded[j] === ")") { depth--; if (depth === 0) break; }
+					j++;
+				}
+				const sub = expanded.slice(i + 2, j).trim();
+				const subResult = await runCommand(sub, authUser, hostname, mode, cwd, shell, undefined, shellEnv);
+				const subOut = (subResult.stdout ?? "").replace(/\n$/, "");
+				result += subOut;
+				i = j + 1;
+				continue;
+			}
+			result += ch; i++;
+		}
+		expanded = result;
+	}
+
+	// ── alias expansion ───────────────────────────────────────────────────────
+	const firstWord = expanded.split(/\s+/)[0] ?? "";
+	const aliasVal = shellEnv.vars[`__alias_${firstWord}`];
+	if (aliasVal) {
+		expanded = expanded.replace(firstWord, aliasVal);
+	}
+
 	// Detect shell operators
 	if (
-		/(?<![|&])[|](?![|])/.test(trimmed) ||
-		trimmed.includes(">") ||
-		trimmed.includes("<") ||
-		trimmed.includes("&&") ||
-		trimmed.includes("||") ||
-		trimmed.includes(";")
+		/(?<![|&])[|](?![|])/.test(expanded) ||
+		expanded.includes(">") ||
+		expanded.includes("<") ||
+		expanded.includes("&&") ||
+		expanded.includes("||") ||
+		expanded.includes(";")
 	) {
-		const { parseScript } = await import("../VirtualShell/shellParser");
-		const { executeStatements } = await import("../SSHMimic/executor");
-		const script = parseScript(trimmed);
+		const script = parseScript(expanded);
 		if (!script.isValid) return { stderr: script.error || "Syntax error", exitCode: 1 };
 		try {
 			return await executeStatements(script.statements, authUser, hostname, mode, cwd, shell, shellEnv);
@@ -231,7 +336,7 @@ export async function runCommand(
 		}
 	}
 
-	const { commandName, args } = parseInput(trimmed);
+	const { commandName, args } = parseInput(expanded);
 	const mod = resolveModule(commandName);
 
 	if (!mod) return { stderr: `${commandName}: command not found`, exitCode: 127 };
@@ -241,7 +346,7 @@ export async function runCommand(
 			authUser,
 			hostname,
 			activeSessions: shell.users.listActiveSessions(),
-			rawInput: trimmed,
+			rawInput: expanded,
 			mode,
 			args,
 			stdin,

package/src/commands/ls.ts

@@ -30,15 +30,16 @@ export const lsCommand: ShellModule = {
 	name: "ls",
 	description: "List directory contents",
 	category: "navigation",
-	params: ["[path]"],
+	params: ["[-la] [path]"],
 	run: ({ authUser, shell, cwd, args }) => {
-		const longFormat = ifFlag(args, ["-l", "--long"]);
-		const targetArg = getArg(args, 0, { flags: ["-l", "--long"] });
+		const longFormat  = ifFlag(args, ["-l", "--long"]);
+		const showHidden  = ifFlag(args, ["-a", "--all"]);
+		const targetArg   = getArg(args, 0, { flags: ["-l", "--long", "-a", "--all", "-la", "-al"] });
 		const target = resolvePath(cwd, targetArg ?? cwd);
 		assertPathAccess(authUser, target, "ls");
 		const items = shell.vfs
 			.list(target)
-			.filter((name) => !name.startsWith("."));
+			.filter((name) => showHidden || !name.startsWith("."));
 		const rendered = longFormat
 			? items
 					.map((name) => {

package/src/commands/lsb-release.ts

@@ -0,0 +1,52 @@
+import type { ShellModule } from "../types/commands";
+import { ifFlag } from "./command-helpers";
+
+export const lsbReleaseCommand: ShellModule = {
+	name: "lsb_release",
+	description: "Print distribution-specific information",
+	category: "system",
+	params: ["[-a] [-i] [-d] [-r] [-c]"],
+	run: ({ args, shell }) => {
+		let osName = shell.properties?.os ?? "Fortune GNU/Linux x64";
+		let codename = "aurora";
+		let version = "1.0";
+
+		try {
+			const content = shell.vfs.readFile("/etc/os-release");
+			for (const line of content.split("\n")) {
+				if (line.startsWith("PRETTY_NAME="))
+					osName = line.slice("PRETTY_NAME=".length).replace(/^"|"$/g, "").trim();
+				if (line.startsWith("VERSION_CODENAME="))
+					codename = line.slice("VERSION_CODENAME=".length).trim();
+				if (line.startsWith("VERSION_ID="))
+					version = line.slice("VERSION_ID=".length).replace(/^"|"$/g, "").trim();
+			}
+		} catch {}
+
+		const all = ifFlag(args, ["-a", "--all"]);
+		const showId = ifFlag(args, ["-i", "--id"]);
+		const showDesc = ifFlag(args, ["-d", "--description"]);
+		const showRelease = ifFlag(args, ["-r", "--release"]);
+		const showCodename = ifFlag(args, ["-c", "--codename"]);
+
+		if (all || args.length === 0) {
+			return {
+				stdout: [
+					`Distributor ID:\tFortune`,
+					`Description:\t${osName}`,
+					`Release:\t${version}`,
+					`Codename:\t${codename}`,
+				].join("\n"),
+				exitCode: 0,
+			};
+		}
+
+		const lines: string[] = [];
+		if (showId) lines.push(`Distributor ID:\tFortune`);
+		if (showDesc) lines.push(`Description:\t${osName}`);
+		if (showRelease) lines.push(`Release:\t${version}`);
+		if (showCodename) lines.push(`Codename:\t${codename}`);
+
+		return { stdout: lines.join("\n"), exitCode: 0 };
+	},
+};

package/src/commands/man.ts

@@ -0,0 +1,166 @@
+import type { ShellModule } from "../types/commands";
+
+const MAN_PAGES: Record<string, string> = {
+	ls: `LS(1)                    User Commands                    LS(1)
+
+NAME
+       ls - list directory contents
+
+SYNOPSIS
+       ls [OPTION]... [FILE]...
+
+DESCRIPTION
+       List information about the FILEs (the current directory by default).
+
+OPTIONS
+       -l     use a long listing format
+       -a     do not ignore entries starting with .
+       -h     with -l, print human readable sizes
+       -r     reverse order while sorting
+       -t     sort by modification time
+
+AUTHOR
+       Written by Richard M. Stallman and David MacKenzie.`,
+
+	cat: `CAT(1)                   User Commands                    CAT(1)
+
+NAME
+       cat - concatenate files and print on the standard output
+
+SYNOPSIS
+       cat [OPTION]... [FILE]...
+
+DESCRIPTION
+       Concatenate FILE(s) to standard output.
+
+OPTIONS
+       -n, --number          number all output lines
+       -b, --number-nonblank number nonempty output lines`,
+
+	grep: `GREP(1)                  User Commands                    GREP(1)
+
+NAME
+       grep, egrep, fgrep - print lines that match patterns
+
+SYNOPSIS
+       grep [OPTION]... PATTERNS [FILE]...
+
+OPTIONS
+       -i, --ignore-case     ignore case distinctions in patterns and data
+       -v, --invert-match    select non-matching lines
+       -n, --line-number     print line number with output lines
+       -r, --recursive       read all files under each directory, recursively`,
+
+	apt: `APT(8)                   APT                             APT(8)
+
+NAME
+       apt - command-line interface
+
+SYNOPSIS
+       apt [options] command
+
+DESCRIPTION
+       apt provides a high-level commandline interface for the package
+       management system.
+
+COMMANDS
+       install pkg...   Install packages
+       remove pkg...    Remove packages
+       update           Download package information
+       upgrade          Upgrade installed packages
+       search term      Search in package descriptions
+       show pkg         Show package information
+       list             List packages`,
+
+	ssh: `SSH(1)                   OpenSSH                          SSH(1)
+
+NAME
+       ssh - OpenSSH remote login client
+
+SYNOPSIS
+       ssh [-p port] [user@]hostname [command]
+
+DESCRIPTION
+       ssh (SSH client) is a program for logging into a remote machine and
+       for executing commands on a remote machine.`,
+
+	curl: `CURL(1)                  User Commands                    CURL(1)
+
+NAME
+       curl - transfer a URL
+
+SYNOPSIS
+       curl [options / URLs]
+
+DESCRIPTION
+       curl is a tool for transferring data with URL syntax.
+
+OPTIONS
+       -o, --output <file>     Write output to <file>
+       -X, --request <method>  Specify request method
+       -d, --data <data>       HTTP POST data
+       -H, --header <header>   Pass custom header
+       -s, --silent            Silent mode
+       -I, --head              Show document info only
+       -L, --location          Follow redirects
+       -v, --verbose           Make the operation more talkative`,
+
+	chmod: `CHMOD(1)                 User Commands                    CHMOD(1)
+
+NAME
+       chmod - change file mode bits
+
+SYNOPSIS
+       chmod [OPTION]... MODE[,MODE]... FILE...
+       chmod [OPTION]... OCTAL-MODE FILE...
+
+DESCRIPTION
+       Change the file mode bits of each given file according to MODE.
+
+EXAMPLES
+       chmod 755 script.sh      rwxr-xr-x
+       chmod 644 file.txt       rw-r--r--
+       chmod +x script.sh       add execute permission`,
+
+	tar: `TAR(1)                   GNU tar Manual                   TAR(1)
+
+NAME
+       tar - an archiving utility
+
+SYNOPSIS
+       tar [OPTION...] [FILE]...
+
+DESCRIPTION
+       tar saves many files together into a single tape or disk archive,
+       and can restore individual files from the archive.
+
+OPTIONS
+       -c, --create           create a new archive
+       -x, --extract          extract files from an archive
+       -z, --gzip             filter the archive through gzip
+       -f, --file=ARCHIVE     use archive file or device ARCHIVE
+       -v, --verbose          verbosely list files processed
+       -t, --list             list the contents of an archive`,
+};
+
+export const manCommand: ShellModule = {
+	name: "man",
+	description: "Interface to the system reference manuals",
+	category: "shell",
+	params: ["<command>"],
+	run: ({ args, shell }) => {
+		const name = args[0];
+		if (!name) return { stderr: "What manual page do you want?", exitCode: 1 };
+
+		// VFS-installed man pages take priority
+		const manPath = `/usr/share/man/man1/${name}.1`;
+		if (shell.vfs.exists(manPath)) {
+			return { stdout: shell.vfs.readFile(manPath), exitCode: 0 };
+		}
+
+		const page = MAN_PAGES[name.toLowerCase()];
+		if (page) return { stdout: page, exitCode: 0 };
+
+		return { stderr: `No manual entry for ${name}`, exitCode: 16 };
+	},
+};

package/src/commands/neofetch.ts

@@ -32,6 +32,11 @@ export const neofetchCommand: ShellModule = {
 				shell: env.SHELL,
 				shellProps: shell.properties,
 				terminal: env.TERM,
+				uptimeSeconds: Math.floor((Date.now() - shell.startTime) / 1000),
+				packages: (() => {
+					const count = shell.packageManager?.installedCount() ?? 0;
+					return `${count} (dpkg)`;
+				})(),
 			}),
 			exitCode: 0,
 		};

package/src/commands/ping.ts

@@ -1,4 +1,5 @@
 import type { ShellModule } from "../types/commands";
+import { parseArgs } from "./command-helpers";
 
 export const pingCommand: ShellModule = {
 	name: "ping",
@@ -6,8 +7,10 @@ export const pingCommand: ShellModule = {
 	category: "network",
 	params: ["[-c <count>] <host>"],
 	run: ({ args }) => {
-		const host = args.find((a) => !a.startsWith("-")) ?? "localhost";
-		const count = 4;
+		const { flagsWithValues, positionals } = parseArgs(args, { flagsWithValue: ["-c", "-i", "-W"] });
+		const host = positionals[0] ?? "localhost";
+		const countArg = flagsWithValues.get("-c");
+		const count = countArg ? Math.max(1, parseInt(countArg, 10) || 4) : 4;
 		const lines = [`PING ${host}: 56 data bytes`];
 		for (let i = 0; i < count; i++) {
 			const ms = (Math.random() * 10 + 1).toFixed(3);

package/src/commands/ps.ts

@@ -1,19 +1,41 @@
 import type { ShellModule } from "../types/commands";
+import { ifFlag } from "./command-helpers";
 
 export const psCommand: ShellModule = {
 	name: "ps",
 	description: "Report process status",
 	category: "system",
-	params: ["[-a] [-u] [-x]"],
-	run: ({ authUser, shell }) => {
+	params: ["[-a] [-u] [-x] [aux]"],
+	run: ({ authUser, shell, args }) => {
 		const sessions = shell.users.listActiveSessions();
-		const lines = ["  PID TTY          TIME CMD"];
+		const showUser = ifFlag(args, ["-u"]) || args.includes("u") || args.includes("aux") || args.includes("au");
+		const showAll  = ifFlag(args, ["-a", "-x"]) || args.includes("a") || args.includes("aux");
+
+		if (showUser) {
+			const header = "USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND";
+			const rows: string[] = [header];
+			let pid = 1000;
+			for (const s of sessions) {
+				const user = s.username.padEnd(10).slice(0, 10);
+				const mem  = (Math.random() * 0.5).toFixed(1);
+				const vsz  = Math.floor(Math.random() * 20000 + 5000);
+				const rss  = Math.floor(Math.random() * 5000 + 1000);
+				rows.push(`${user} ${String(pid).padStart(6)}  0.0  ${mem.padStart(4)} ${String(vsz).padStart(6)} ${String(rss).padStart(5)} ${s.tty.padEnd(8)} Ss   00:00   0:00 bash`);
+				pid++;
+			}
+			rows.push(`root       ${String(pid).padStart(6)}  0.0   0.0      0      0 ?        S    00:00   0:00 ps`);
+			return { stdout: rows.join("\n"), exitCode: 0 };
+		}
+
+		const header = "  PID TTY          TIME CMD";
+		const rows: string[] = [header];
 		let pid = 1000;
 		for (const s of sessions) {
-			lines.push(`${String(pid).padStart(5)} ${s.tty.padEnd(12)} 00:00:00 ${s.username === authUser ? "bash" : `bash (${s.username})`}`);
+			if (!showAll && s.username !== authUser) continue;
+			rows.push(`${String(pid).padStart(5)} ${s.tty.padEnd(12)} 00:00:00 ${s.username === authUser ? "bash" : `bash (${s.username})`}`);
 			pid++;
 		}
-		lines.push(`${String(pid).padStart(5)} pts/0        00:00:00 ps`);
-		return { stdout: lines.join("\n"), exitCode: 0 };
+		rows.push(`${String(pid).padStart(5)} pts/0        00:00:00 ps`);
+		return { stdout: rows.join("\n"), exitCode: 0 };
 	},
 };

package/src/commands/sh.ts

@@ -1,10 +1,13 @@
 import type { CommandContext, CommandResult, ShellModule } from "../types/commands";
-import { getArg, ifFlag } from "./command-helpers";
+import { ifFlag } from "./command-helpers";
 import { resolvePath } from "./helpers";
 import { runCommand } from "./index";
 
-/** Expand $VAR and ${VAR:-default} in a line using the current env */
-function expandVars(line: string, env: Record<string, string>, lastExit: number): string {
+/** Alias for clarity inside sh.ts */
+type ShellContext = CommandContext;
+
+/** Expand $VAR and ${VAR:-default} in a line using the current env (sync, no $(cmd)) */
+function expandVarsSync(line: string, env: Record<string, string>, lastExit: number): string {
 	return line
 		.replace(/\$\?/g, String(lastExit))
 		.replace(/\$\{([^}:]+):-([^}]*)\}/g, (_, n, d) => env[n] ?? d)
@@ -13,6 +16,25 @@ function expandVars(line: string, env: Record<string, string>, lastExit: number)
 		.replace(/^~(\/|$)/, `${env.HOME ?? "/home/user"}$1`);
 }
 
+/**
+ * Expand $VAR, ${VAR:-default}, and $(cmd) substitution asynchronously.
+ * Used before executing each line in sh script context.
+ */
+async function expandVars(line: string, env: Record<string, string>, lastExit: number, ctx: ShellContext): Promise<string> {
+	// $(cmd) substitution first
+	if (line.includes("$(")) {
+		const subRe = /\$\(([^)]+)\)/g;
+		const matches = [...line.matchAll(subRe)];
+		for (const m of matches) {
+			const sub = m[1]?.trim() ?? "";
+			const subResult = await runCommand(sub, ctx.authUser, ctx.hostname, ctx.mode, ctx.cwd, ctx.shell, undefined, ctx.env);
+			const subOut = (subResult.stdout ?? "").replace(/\n$/, "");
+			line = line.replace(m[0], subOut);
+		}
+	}
+	return expandVarsSync(line, env, lastExit);
+}
+
 type Block =
 	| { type: "if"; cond: string; then: string[]; elif: Array<{ cond: string; body: string[] }>; else_: string[] }
 	| { type: "for"; var: string; list: string; body: string[] }
@@ -54,8 +76,8 @@ function parseBlocks(lines: string[]): Block[] {
 				const body: string[] = [];
 				i++;
 				while (i < lines.length && lines[i]?.trim() !== "done") {
-					const l = lines[i]!.trim();
-					if (l !== "do") body.push(l);
+					const l = lines[i]!.trim().replace(/^do\s+/, "");
+					if (l && l !== "do") body.push(l);
 					i++;
 				}
 				blocks.push({ type: "for", var: m[1]!, list: m[2]!, body });
@@ -65,8 +87,8 @@ function parseBlocks(lines: string[]): Block[] {
 			const body: string[] = [];
 			i++;
 			while (i < lines.length && lines[i]?.trim() !== "done") {
-				const l = lines[i]!.trim();
-				if (l !== "do") body.push(l);
+				const l = lines[i]!.trim().replace(/^do\s+/, "");
+				if (l && l !== "do") body.push(l);
 				i++;
 			}
 			blocks.push({ type: "while", cond, body });
@@ -79,7 +101,7 @@ function parseBlocks(lines: string[]): Block[] {
 }
 
 async function evalCondition(cond: string, ctx: CommandContext): Promise<boolean> {
-	const expanded = expandVars(cond, ctx.env.vars, ctx.env.lastExitCode);
+	const expanded = await expandVars(cond, ctx.env.vars, ctx.env.lastExitCode, ctx);
 	// test -f / test -d / [ ... ]
 	const testMatch = expanded.match(/^\[?\s*(.+?)\s*\]?$/);
 	if (testMatch) {
@@ -126,7 +148,7 @@ async function runBlocks(blocks: Block[], ctx: CommandContext): Promise<CommandR
 
 	for (const block of blocks) {
 		if (block.type === "cmd") {
-			const expanded = expandVars(block.line, ctx.env.vars, ctx.env.lastExitCode);
+			const expanded = await expandVars(block.line, ctx.env.vars, ctx.env.lastExitCode, ctx);
 			const r = await runCommand(expanded, ctx.authUser, ctx.hostname, ctx.mode, ctx.cwd, ctx.shell, undefined, ctx.env);
 			ctx.env.lastExitCode = r.exitCode ?? 0;
 			if (r.stdout) output += `${r.stdout}\n`;
@@ -152,7 +174,7 @@ async function runBlocks(blocks: Block[], ctx: CommandContext): Promise<CommandR
 				}
 			}
 		} else if (block.type === "for") {
-			const listExpanded = expandVars(block.list, ctx.env.vars, ctx.env.lastExitCode);
+			const listExpanded = await expandVars(block.list, ctx.env.vars, ctx.env.lastExitCode, ctx);
 			const items = listExpanded.trim().split(/\s+/);
 			for (const item of items) {
 				ctx.env.vars[block.var] = item;
@@ -184,7 +206,7 @@ export const shCommand: ShellModule = {
 
 		// sh -c "inline script"
 		if (ifFlag(args, "-c")) {
-			const script = getArg(args, 1) ?? "";
+			const script = args[args.indexOf("-c") + 1] ?? "";
 			if (!script) return { stderr: "sh: -c requires a script", exitCode: 1 };
 			const lines = script.split(/[;\n]/).map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
 			const blocks = parseBlocks(lines);

package/src/commands/source.ts

@@ -0,0 +1,35 @@
+import type { ShellModule } from "../types/commands";
+import { resolvePath } from "./helpers";
+import { runCommand } from ".";
+
+export const sourceCommand: ShellModule = {
+	name: "source",
+	aliases: ["."],
+	description: "Execute commands from a file in the current shell environment",
+	category: "shell",
+	params: ["<file> [args...]"],
+	run: async ({ args, authUser, hostname, cwd, shell, env }) => {
+		const fileArg = args[0];
+		if (!fileArg) {
+			return { stderr: "source: missing filename", exitCode: 1 };
+		}
+
+		const filePath = resolvePath(cwd, fileArg);
+		if (!shell.vfs.exists(filePath)) {
+			return { stderr: `source: ${fileArg}: No such file or directory`, exitCode: 1 };
+		}
+
+		const content = shell.vfs.readFile(filePath);
+		let lastExitCode = 0;
+
+		for (const line of content.split("\n")) {
+			const l = line.trim();
+			if (!l || l.startsWith("#")) continue;
+			const result = await runCommand(l, authUser, hostname, "shell", cwd, shell, undefined, env);
+			lastExitCode = result.exitCode ?? 0;
+			if (result.closeSession || result.switchUser) return result;
+		}
+
+		return { exitCode: lastExitCode };
+	},
+};