typescript-virtual-container 1.5.2 → 1.5.3

package/builds/{fortune-nyx-v1.5.1-web.min.js → fortune-nyx-v1.5.3-web.min.js}

@@ -2277,7 +2277,21 @@ function resolveVfsBinary(name, env, shell, authUser) {
   }
   return null;
 }
+var MAX_CALL_DEPTH = 8;
+var _callDepth = 0;
 async function runCommandDirect(name, args, authUser, hostname, mode, cwd, shell, stdin, env) {
+  _callDepth++;
+  if (_callDepth > MAX_CALL_DEPTH) {
+    _callDepth--;
+    return { stderr: `${name}: maximum call depth (${MAX_CALL_DEPTH}) exceeded`, exitCode: 126 };
+  }
+  try {
+    return await _runCommandDirectInner(name, args, authUser, hostname, mode, cwd, shell, stdin, env);
+  } finally {
+    _callDepth--;
+  }
+}
+async function _runCommandDirectInner(name, args, authUser, hostname, mode, cwd, shell, stdin, env) {
   const assignRe = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
   const invocation = [name, ...args];
   let assignCount = 0;
@@ -2350,6 +2364,7 @@ async function runCommandDirect(name, args, authUser, hostname, mode, cwd, shell
             env
           });
         }
+        return { stderr: `${name}: exec builtin '${builtinMatch[1]}' not found`, exitCode: 127 };
       }
       const shMod = resolveModule("sh");
       if (shMod) {
@@ -2393,100 +2408,122 @@ async function runCommand(rawInput, authUser, hostname, mode, cwd, shell, stdin,
   const trimmed = rawInput.trim();
   if (trimmed.length === 0) return { exitCode: 0 };
   const shellEnv = env ?? makeDefaultEnv(authUser, hostname);
-  const rawTokens = tokenizeCommand(trimmed);
-  const rawFirstWord = rawTokens[0]?.toLowerCase() ?? "";
-  const aliasVal = shellEnv.vars[`__alias_${rawFirstWord}`];
-  const aliasExpanded = aliasVal ? trimmed.replace(rawFirstWord, aliasVal) : trimmed;
-  const isShScript = /\bfor\s+\w+\s+in\b/.test(aliasExpanded) || /\bwhile\s+/.test(aliasExpanded) || /\bif\s+/.test(aliasExpanded) || /\w+\s*\(\s*\)\s*\{/.test(aliasExpanded) || /\bfunction\s+\w+/.test(aliasExpanded) || /\(\(\s*.+\s*\)\)/.test(aliasExpanded);
-  const hasOperators = /(?<![|&])[|](?![|])/.test(aliasExpanded) || aliasExpanded.includes(">") || aliasExpanded.includes("<") || aliasExpanded.includes("&&") || aliasExpanded.includes("||") || aliasExpanded.includes(";");
-  if (isShScript && rawFirstWord !== "sh" && rawFirstWord !== "bash" || hasOperators) {
-    if (isShScript && rawFirstWord !== "sh" && rawFirstWord !== "bash") {
-      const shMod = resolveModule("sh");
-      if (shMod) {
-        return await shMod.run({
+  _callDepth++;
+  if (_callDepth > MAX_CALL_DEPTH) {
+    _callDepth--;
+    return { stderr: `${trimmed.split(" ")[0]}: maximum call depth (${MAX_CALL_DEPTH}) exceeded`, exitCode: 126 };
+  }
+  try {
+    const rawTokens = tokenizeCommand(trimmed);
+    const rawFirstWord = rawTokens[0]?.toLowerCase() ?? "";
+    const aliasVal = shellEnv.vars[`__alias_${rawFirstWord}`];
+    const aliasExpanded = aliasVal ? trimmed.replace(rawFirstWord, aliasVal) : trimmed;
+    const isShScript = /\bfor\s+\w+\s+in\b/.test(aliasExpanded) || /\bwhile\s+/.test(aliasExpanded) || /\bif\s+/.test(aliasExpanded) || /\w+\s*\(\s*\)\s*\{/.test(aliasExpanded) || /\bfunction\s+\w+/.test(aliasExpanded) || /\(\(\s*.+\s*\)\)/.test(aliasExpanded);
+    const hasOperators = /(?<![|&])[|](?![|])/.test(aliasExpanded) || aliasExpanded.includes(">") || aliasExpanded.includes("<") || aliasExpanded.includes("&&") || aliasExpanded.includes("||") || aliasExpanded.includes(";");
+    if (isShScript && rawFirstWord !== "sh" && rawFirstWord !== "bash" || hasOperators) {
+      if (isShScript && rawFirstWord !== "sh" && rawFirstWord !== "bash") {
+        const shMod = resolveModule("sh");
+        if (shMod) {
+          return await shMod.run({
+            authUser,
+            hostname,
+            activeSessions: shell.users.listActiveSessions(),
+            rawInput: aliasExpanded,
+            mode,
+            args: ["-c", aliasExpanded],
+            stdin: void 0,
+            cwd,
+            shell,
+            env: shellEnv
+          });
+        }
+      }
+      const script = parseScript(aliasExpanded);
+      if (!script.isValid)
+        return { stderr: script.error || "Syntax error", exitCode: 1 };
+      try {
+        return await executeStatements(
+          script.statements,
           authUser,
           hostname,
-          activeSessions: shell.users.listActiveSessions(),
-          rawInput: aliasExpanded,
           mode,
-          args: ["-c", aliasExpanded],
-          stdin: void 0,
           cwd,
           shell,
-          env: shellEnv
-        });
+          shellEnv
+        );
+      } catch (error) {
+        return {
+          stderr: error instanceof Error ? error.message : "Execution failed",
+          exitCode: 1
+        };
       }
     }
-    const script = parseScript(aliasExpanded);
-    if (!script.isValid)
-      return { stderr: script.error || "Syntax error", exitCode: 1 };
-    try {
-      return await executeStatements(
-        script.statements,
+    const expanded = await expandAsync(
+      aliasExpanded,
+      shellEnv.vars,
+      shellEnv.lastExitCode,
+      (sub) => runCommand(
+        sub,
         authUser,
         hostname,
         mode,
         cwd,
         shell,
+        void 0,
+        shellEnv
+      ).then((r) => r.stdout ?? "")
+    );
+    const parts = tokenizeCommand(expanded.trim());
+    if (parts.length === 0) return { exitCode: 0 };
+    const assignRe = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
+    if (assignRe.test(parts[0])) {
+      return runCommandDirect(
+        parts[0],
+        parts.slice(1),
+        authUser,
+        hostname,
+        mode,
+        cwd,
+        shell,
+        stdin,
         shellEnv
       );
-    } catch (error) {
-      return {
-        stderr: error instanceof Error ? error.message : "Execution failed",
-        exitCode: 1
-      };
     }
-  }
-  const expanded = await expandAsync(
-    aliasExpanded,
-    shellEnv.vars,
-    shellEnv.lastExitCode,
-    (sub) => runCommand(
-      sub,
-      authUser,
-      hostname,
-      mode,
-      cwd,
-      shell,
-      void 0,
-      shellEnv
-    ).then((r) => r.stdout ?? "")
-  );
-  const parts = tokenizeCommand(expanded.trim());
-  if (parts.length === 0) return { exitCode: 0 };
-  const assignRe = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
-  if (assignRe.test(parts[0])) {
-    return runCommandDirect(
-      parts[0],
-      parts.slice(1),
-      authUser,
-      hostname,
-      mode,
-      cwd,
-      shell,
-      stdin,
-      shellEnv
-    );
-  }
-  const commandName = parts[0]?.toLowerCase() ?? "";
-  const args = parts.slice(1).flatMap(expandBraces);
-  const mod = resolveModule(commandName);
-  if (!mod) {
-    const vfsBinary = resolveVfsBinary(commandName, shellEnv, shell, authUser);
-    if (vfsBinary) {
-      const stubContent = shell.vfs.readFile(vfsBinary);
-      const builtinMatch = stubContent.match(/exec\s+builtin\s+(\S+)/);
-      if (builtinMatch) {
-        const builtinName = builtinMatch[1];
-        const builtinMod = resolveModule(builtinName);
-        if (builtinMod) {
-          return await builtinMod.run({
+    const commandName = parts[0]?.toLowerCase() ?? "";
+    const args = parts.slice(1).flatMap(expandBraces);
+    const mod = resolveModule(commandName);
+    if (!mod) {
+      const vfsBinary = resolveVfsBinary(commandName, shellEnv, shell, authUser);
+      if (vfsBinary) {
+        const stubContent = shell.vfs.readFile(vfsBinary);
+        const builtinMatch = stubContent.match(/exec\s+builtin\s+(\S+)/);
+        if (builtinMatch) {
+          const builtinName = builtinMatch[1];
+          const builtinMod = resolveModule(builtinName);
+          if (builtinMod) {
+            return await builtinMod.run({
+              authUser,
+              hostname,
+              activeSessions: shell.users.listActiveSessions(),
+              rawInput: [commandName, ...args].join(" "),
+              mode,
+              args,
+              stdin,
+              cwd,
+              shell,
+              env: shellEnv
+            });
+          }
+        }
+        const shMod = resolveModule("sh");
+        if (shMod) {
+          return await shMod.run({
             authUser,
             hostname,
             activeSessions: shell.users.listActiveSessions(),
-            rawInput: [commandName, ...args].join(" "),
+            rawInput: `sh -c ${JSON.stringify(stubContent)}`,
             mode,
-            args,
+            args: ["-c", stubContent, "--", ...args],
             stdin,
             cwd,
             shell,
@@ -2494,42 +2531,29 @@ async function runCommand(rawInput, authUser, hostname, mode, cwd, shell, stdin,
           });
         }
       }
-      const shMod = resolveModule("sh");
-      if (shMod) {
-        return await shMod.run({
-          authUser,
-          hostname,
-          activeSessions: shell.users.listActiveSessions(),
-          rawInput: `sh -c ${JSON.stringify(stubContent)}`,
-          mode,
-          args: ["-c", stubContent, "--", ...args],
-          stdin,
-          cwd,
-          shell,
-          env: shellEnv
-        });
-      }
+      return { stderr: `${commandName}: command not found`, exitCode: 127 };
     }
-    return { stderr: `${commandName}: command not found`, exitCode: 127 };
-  }
-  try {
-    return await mod.run({
-      authUser,
-      hostname,
-      activeSessions: shell.users.listActiveSessions(),
-      rawInput: expanded,
-      mode,
-      args,
-      stdin,
-      cwd,
-      shell,
-      env: shellEnv
-    });
-  } catch (error) {
-    return {
-      stderr: error instanceof Error ? error.message : "Command failed",
-      exitCode: 1
-    };
+    try {
+      return await mod.run({
+        authUser,
+        hostname,
+        activeSessions: shell.users.listActiveSessions(),
+        rawInput: expanded,
+        mode,
+        args,
+        stdin,
+        cwd,
+        shell,
+        env: shellEnv
+      });
+    } catch (error) {
+      return {
+        stderr: error instanceof Error ? error.message : "Command failed",
+        exitCode: 1
+      };
+    }
+  } finally {
+    _callDepth--;
   }
 }
 
@@ -13279,16 +13303,6 @@ var PACKAGE_REGISTRY = [
     shortDesc: "Vi IMproved",
     installedSizeKb: 3812,
     files: [
-      {
-        path: "/usr/bin/vim",
-        content: '#!/bin/sh\nexec builtin nano "$@"\n',
-        mode: 493
-      },
-      {
-        path: "/usr/bin/vi",
-        content: '#!/bin/sh\nexec builtin nano "$@"\n',
-        mode: 493
-      },
       {
         path: "/usr/share/doc/vim/README",
         content: "Vim editor \u2014 virtual package.\n"

package/dist/VirtualPackageManager/index.js

@@ -8,16 +8,6 @@ const PACKAGE_REGISTRY = [
         shortDesc: "Vi IMproved",
         installedSizeKb: 3812,
         files: [
-            {
-                path: "/usr/bin/vim",
-                content: "#!/bin/sh\nexec builtin nano \"$@\"\n",
-                mode: 0o755,
-            },
-            {
-                path: "/usr/bin/vi",
-                content: "#!/bin/sh\nexec builtin nano \"$@\"\n",
-                mode: 0o755,
-            },
             {
                 path: "/usr/share/doc/vim/README",
                 content: "Vim editor — virtual package.\n",

package/dist/commands/runtime.js

@@ -61,7 +61,25 @@ function resolveVfsBinary(name, env, shell, authUser) {
     }
     return null;
 }
+const MAX_CALL_DEPTH = 8;
+let _callDepth = 0;
 export async function runCommandDirect(name, args, authUser, hostname, mode, cwd, shell, stdin, env) {
+    // Anti-loop guard: track call depth via env to avoid infinite recursion
+    _callDepth++;
+    // console.debug(`[depth=${_callDepth}] runCommandDirect: ${name}`);
+    if (_callDepth > MAX_CALL_DEPTH) {
+        _callDepth--;
+        // console.debug(`[LOOP DETECTED] runCommandDirect blocked: ${name}`);
+        return { stderr: `${name}: maximum call depth (${MAX_CALL_DEPTH}) exceeded`, exitCode: 126 };
+    }
+    try {
+        return await _runCommandDirectInner(name, args, authUser, hostname, mode, cwd, shell, stdin, env);
+    }
+    finally {
+        _callDepth--;
+    }
+}
+async function _runCommandDirectInner(name, args, authUser, hostname, mode, cwd, shell, stdin, env) {
     const assignRe = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
     const invocation = [name, ...args];
     let assignCount = 0;
@@ -118,6 +136,8 @@ export async function runCommandDirect(name, args, authUser, hostname, mode, cwd
                         env,
                     });
                 }
+                // builtin not found — stop here, don't fall through to sh -c (avoids infinite loop)
+                return { stderr: `${name}: exec builtin '${builtinMatch[1]}' not found`, exitCode: 127 };
             }
             const shMod = resolveModule("sh");
             if (shMod) {
@@ -163,84 +183,109 @@ export async function runCommand(rawInput, authUser, hostname, mode, cwd, shell,
     if (trimmed.length === 0)
         return { exitCode: 0 };
     const shellEnv = env ?? makeDefaultEnv(authUser, hostname);
-    const rawTokens = tokenizeCommand(trimmed);
-    const rawFirstWord = rawTokens[0]?.toLowerCase() ?? "";
-    const aliasVal = shellEnv.vars[`__alias_${rawFirstWord}`];
-    const aliasExpanded = aliasVal
-        ? trimmed.replace(rawFirstWord, aliasVal)
-        : trimmed;
-    // Detect sh-syntax constructs that must be handled by the sh interpreter
-    const isShScript = /\bfor\s+\w+\s+in\b/.test(aliasExpanded) ||
-        /\bwhile\s+/.test(aliasExpanded) ||
-        /\bif\s+/.test(aliasExpanded) ||
-        /\w+\s*\(\s*\)\s*\{/.test(aliasExpanded) ||
-        /\bfunction\s+\w+/.test(aliasExpanded) ||
-        /\(\(\s*.+\s*\)\)/.test(aliasExpanded);
-    const hasOperators = /(?<![|&])[|](?![|])/.test(aliasExpanded) ||
-        aliasExpanded.includes(">") ||
-        aliasExpanded.includes("<") ||
-        aliasExpanded.includes("&&") ||
-        aliasExpanded.includes("||") ||
-        aliasExpanded.includes(";");
-    if ((isShScript && rawFirstWord !== "sh" && rawFirstWord !== "bash") || hasOperators) {
-        // sh-syntax: route through sh interpreter to handle for/while/functions
-        if (isShScript && rawFirstWord !== "sh" && rawFirstWord !== "bash") {
-            const shMod = resolveModule("sh");
-            if (shMod) {
-                return await shMod.run({
-                    authUser, hostname,
-                    activeSessions: shell.users.listActiveSessions(),
-                    rawInput: aliasExpanded,
-                    mode,
-                    args: ["-c", aliasExpanded],
-                    stdin: undefined,
-                    cwd,
-                    shell,
-                    env: shellEnv,
-                });
+    // Anti-loop guard: check depth here too — catches sh -c recursive calls
+    _callDepth++;
+    // console.debug(`[depth=${_callDepth}] runCommand: ${trimmed.slice(0, 60)}`);
+    if (_callDepth > MAX_CALL_DEPTH) {
+        _callDepth--;
+        // console.debug(`[LOOP DETECTED] runCommand blocked: ${trimmed.slice(0, 60)}`);
+        return { stderr: `${trimmed.split(" ")[0]}: maximum call depth (${MAX_CALL_DEPTH}) exceeded`, exitCode: 126 };
+    }
+    try {
+        const rawTokens = tokenizeCommand(trimmed);
+        const rawFirstWord = rawTokens[0]?.toLowerCase() ?? "";
+        const aliasVal = shellEnv.vars[`__alias_${rawFirstWord}`];
+        const aliasExpanded = aliasVal
+            ? trimmed.replace(rawFirstWord, aliasVal)
+            : trimmed;
+        // Detect sh-syntax constructs that must be handled by the sh interpreter
+        const isShScript = /\bfor\s+\w+\s+in\b/.test(aliasExpanded) ||
+            /\bwhile\s+/.test(aliasExpanded) ||
+            /\bif\s+/.test(aliasExpanded) ||
+            /\w+\s*\(\s*\)\s*\{/.test(aliasExpanded) ||
+            /\bfunction\s+\w+/.test(aliasExpanded) ||
+            /\(\(\s*.+\s*\)\)/.test(aliasExpanded);
+        const hasOperators = /(?<![|&])[|](?![|])/.test(aliasExpanded) ||
+            aliasExpanded.includes(">") ||
+            aliasExpanded.includes("<") ||
+            aliasExpanded.includes("&&") ||
+            aliasExpanded.includes("||") ||
+            aliasExpanded.includes(";");
+        if ((isShScript && rawFirstWord !== "sh" && rawFirstWord !== "bash") || hasOperators) {
+            // sh-syntax: route through sh interpreter to handle for/while/functions
+            if (isShScript && rawFirstWord !== "sh" && rawFirstWord !== "bash") {
+                const shMod = resolveModule("sh");
+                if (shMod) {
+                    return await shMod.run({
+                        authUser, hostname,
+                        activeSessions: shell.users.listActiveSessions(),
+                        rawInput: aliasExpanded,
+                        mode,
+                        args: ["-c", aliasExpanded],
+                        stdin: undefined,
+                        cwd,
+                        shell,
+                        env: shellEnv,
+                    });
+                }
+            }
+            const script = parseScript(aliasExpanded);
+            if (!script.isValid)
+                return { stderr: script.error || "Syntax error", exitCode: 1 };
+            try {
+                return await executeStatements(script.statements, authUser, hostname, mode, cwd, shell, shellEnv);
+            }
+            catch (error) {
+                return {
+                    stderr: error instanceof Error ? error.message : "Execution failed",
+                    exitCode: 1,
+                };
             }
         }
-        const script = parseScript(aliasExpanded);
-        if (!script.isValid)
-            return { stderr: script.error || "Syntax error", exitCode: 1 };
-        try {
-            return await executeStatements(script.statements, authUser, hostname, mode, cwd, shell, shellEnv);
-        }
-        catch (error) {
-            return {
-                stderr: error instanceof Error ? error.message : "Execution failed",
-                exitCode: 1,
-            };
+        const expanded = await expandAsync(aliasExpanded, shellEnv.vars, shellEnv.lastExitCode, (sub) => runCommand(sub, authUser, hostname, mode, cwd, shell, undefined, shellEnv).then((r) => r.stdout ?? ""));
+        const parts = tokenizeCommand(expanded.trim());
+        if (parts.length === 0)
+            return { exitCode: 0 };
+        const assignRe = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
+        if (assignRe.test(parts[0])) {
+            return runCommandDirect(parts[0], parts.slice(1), authUser, hostname, mode, cwd, shell, stdin, shellEnv);
         }
-    }
-    const expanded = await expandAsync(aliasExpanded, shellEnv.vars, shellEnv.lastExitCode, (sub) => runCommand(sub, authUser, hostname, mode, cwd, shell, undefined, shellEnv).then((r) => r.stdout ?? ""));
-    const parts = tokenizeCommand(expanded.trim());
-    if (parts.length === 0)
-        return { exitCode: 0 };
-    const assignRe = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
-    if (assignRe.test(parts[0])) {
-        return runCommandDirect(parts[0], parts.slice(1), authUser, hostname, mode, cwd, shell, stdin, shellEnv);
-    }
-    const commandName = parts[0]?.toLowerCase() ?? "";
-    // Apply brace expansion to each arg token
-    const args = parts.slice(1).flatMap(expandBraces);
-    const mod = resolveModule(commandName);
-    if (!mod) {
-        const vfsBinary = resolveVfsBinary(commandName, shellEnv, shell, authUser);
-        if (vfsBinary) {
-            const stubContent = shell.vfs.readFile(vfsBinary);
-            const builtinMatch = stubContent.match(/exec\s+builtin\s+(\S+)/);
-            if (builtinMatch) {
-                const builtinName = builtinMatch[1];
-                const builtinMod = resolveModule(builtinName);
-                if (builtinMod) {
-                    return await builtinMod.run({
+        const commandName = parts[0]?.toLowerCase() ?? "";
+        // Apply brace expansion to each arg token
+        const args = parts.slice(1).flatMap(expandBraces);
+        const mod = resolveModule(commandName);
+        if (!mod) {
+            const vfsBinary = resolveVfsBinary(commandName, shellEnv, shell, authUser);
+            if (vfsBinary) {
+                const stubContent = shell.vfs.readFile(vfsBinary);
+                const builtinMatch = stubContent.match(/exec\s+builtin\s+(\S+)/);
+                if (builtinMatch) {
+                    const builtinName = builtinMatch[1];
+                    const builtinMod = resolveModule(builtinName);
+                    if (builtinMod) {
+                        return await builtinMod.run({
+                            authUser,
+                            hostname,
+                            activeSessions: shell.users.listActiveSessions(),
+                            rawInput: [commandName, ...args].join(" "),
+                            mode,
+                            args,
+                            stdin,
+                            cwd,
+                            shell,
+                            env: shellEnv,
+                        });
+                    }
+                }
+                const shMod = resolveModule("sh");
+                if (shMod) {
+                    return await shMod.run({
                         authUser,
                         hostname,
                         activeSessions: shell.users.listActiveSessions(),
-                        rawInput: [commandName, ...args].join(" "),
+                        rawInput: `sh -c ${JSON.stringify(stubContent)}`,
                         mode,
-                        args,
+                        args: ["-c", stubContent, "--", ...args],
                         stdin,
                         cwd,
                         shell,
@@ -248,42 +293,30 @@ export async function runCommand(rawInput, authUser, hostname, mode, cwd, shell,
                     });
                 }
             }
-            const shMod = resolveModule("sh");
-            if (shMod) {
-                return await shMod.run({
-                    authUser,
-                    hostname,
-                    activeSessions: shell.users.listActiveSessions(),
-                    rawInput: `sh -c ${JSON.stringify(stubContent)}`,
-                    mode,
-                    args: ["-c", stubContent, "--", ...args],
-                    stdin,
-                    cwd,
-                    shell,
-                    env: shellEnv,
-                });
-            }
+            return { stderr: `${commandName}: command not found`, exitCode: 127 };
+        }
+        try {
+            return await mod.run({
+                authUser,
+                hostname,
+                activeSessions: shell.users.listActiveSessions(),
+                rawInput: expanded,
+                mode,
+                args,
+                stdin,
+                cwd,
+                shell,
+                env: shellEnv,
+            });
+        }
+        catch (error) {
+            return {
+                stderr: error instanceof Error ? error.message : "Command failed",
+                exitCode: 1,
+            };
         }
-        return { stderr: `${commandName}: command not found`, exitCode: 127 };
-    }
-    try {
-        return await mod.run({
-            authUser,
-            hostname,
-            activeSessions: shell.users.listActiveSessions(),
-            rawInput: expanded,
-            mode,
-            args,
-            stdin,
-            cwd,
-            shell,
-            env: shellEnv,
-        });
     }
-    catch (error) {
-        return {
-            stderr: error instanceof Error ? error.message : "Command failed",
-            exitCode: 1,
-        };
+    finally {
+        _callDepth--;
     }
 }