typescript-virtual-container 1.5.2 → 1.5.3

package/examples/demo.html

@@ -5,7 +5,7 @@
             <meta name="viewport" content="width=device-width, initial-scale=1.0">
             <title>Virtual Env JS</title>
             <script type="module">
-                import { VirtualShell, VirtualFileSystem } from '../builds/fortune-nyx-v1.5.2-web.min.js';
+                import { VirtualShell, VirtualFileSystem } from '../builds/fortune-nyx-v1.5.3-web.min.js';
 
                 const now1 = new Date();
                 const ready = await globalThis.__fsReady__;

package/package.json

@@ -4,7 +4,7 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/VirtualPackageManager/index.ts

@@ -87,16 +87,6 @@ const PACKAGE_REGISTRY: PackageDefinition[] = [
 		shortDesc: "Vi IMproved",
 		installedSizeKb: 3812,
 		files: [
-			{
-				path: "/usr/bin/vim",
-				content: "#!/bin/sh\nexec builtin nano \"$@\"\n",
-				mode: 0o755,
-			},
-			{
-				path: "/usr/bin/vi",
-				content: "#!/bin/sh\nexec builtin nano \"$@\"\n",
-				mode: 0o755,
-			},
 			{
 				path: "/usr/share/doc/vim/README",
 				content: "Vim editor — virtual package.\n",

package/src/commands/runtime.ts

@@ -71,6 +71,9 @@ function resolveVfsBinary(
 	return null;
 }
 
+const MAX_CALL_DEPTH = 8;
+let _callDepth = 0;
+
 export async function runCommandDirect(
 	name: string,
 	args: string[],
@@ -81,6 +84,32 @@ export async function runCommandDirect(
 	shell: VirtualShell,
 	stdin: string | undefined,
 	env: ShellEnv,
+): Promise<CommandResult> {
+	// Anti-loop guard: track call depth via env to avoid infinite recursion
+	_callDepth++;
+	// console.debug(`[depth=${_callDepth}] runCommandDirect: ${name}`);
+	if (_callDepth > MAX_CALL_DEPTH) {
+		_callDepth--;
+		// console.debug(`[LOOP DETECTED] runCommandDirect blocked: ${name}`);
+		return { stderr: `${name}: maximum call depth (${MAX_CALL_DEPTH}) exceeded`, exitCode: 126 };
+	}
+	try {
+		return await _runCommandDirectInner(name, args, authUser, hostname, mode, cwd, shell, stdin, env);
+	} finally {
+		_callDepth--;
+	}
+}
+
+async function _runCommandDirectInner(
+	name: string,
+	args: string[],
+	authUser: string,
+	hostname: string,
+	mode: CommandMode,
+	cwd: string,
+	shell: VirtualShell,
+	stdin: string | undefined,
+	env: ShellEnv,
 ): Promise<CommandResult> {
 	const assignRe = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
 	const invocation = [name, ...args];
@@ -156,6 +185,8 @@ export async function runCommandDirect(
 						env,
 					});
 				}
+				// builtin not found — stop here, don't fall through to sh -c (avoids infinite loop)
+				return { stderr: `${name}: exec builtin '${builtinMatch[1]}' not found`, exitCode: 127 };
 			}
 			const shMod = resolveModule("sh");
 			if (shMod) {
@@ -212,6 +243,15 @@ export async function runCommand(
 
 	const shellEnv: ShellEnv = env ?? makeDefaultEnv(authUser, hostname);
 
+	// Anti-loop guard: check depth here too — catches sh -c recursive calls
+	_callDepth++;
+	// console.debug(`[depth=${_callDepth}] runCommand: ${trimmed.slice(0, 60)}`);
+	if (_callDepth > MAX_CALL_DEPTH) {
+		_callDepth--;
+		// console.debug(`[LOOP DETECTED] runCommand blocked: ${trimmed.slice(0, 60)}`);
+		return { stderr: `${trimmed.split(" ")[0]}: maximum call depth (${MAX_CALL_DEPTH}) exceeded`, exitCode: 126 };
+	}
+	try {
 	const rawTokens = tokenizeCommand(trimmed);
 	const rawFirstWord = rawTokens[0]?.toLowerCase() ?? "";
 	const aliasVal = shellEnv.vars[`__alias_${rawFirstWord}`];
@@ -375,4 +415,7 @@ export async function runCommand(
 			exitCode: 1,
 		};
 	}
-}
+	} finally {
+		_callDepth--;
+	}
+}