bashkit 0.10.0__tar.gz → 0.11.0__tar.gz

{bashkit-0.10.0 → bashkit-0.11.0}/Cargo.lock

@@ -195,9 +195,9 @@ dependencies = [
 
 [[package]]
 name = "antithesis_sdk"
-version = "0.2.8"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18dbd97a5b6c21cc9176891cf715f7f0c273caf3959897f43b9bd1231939e675"
+checksum = "08410fcac93669a476c006cd6c4512ac1e2b30fd117231a5d55d8a2c76599b82"
 dependencies = [
  "libc",
  "libloading 0.8.9",
@@ -347,7 +347,7 @@ checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bashkit"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -400,7 +400,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-bench"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "anyhow",
  "bashkit",
@@ -415,7 +415,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-cli"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "anyhow",
  "bashkit",
@@ -429,7 +429,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-coreutils-port"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "anyhow",
  "prettyplease",
@@ -443,7 +443,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-eval"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -460,7 +460,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-js"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "bashkit",
  "napi",
@@ -472,7 +472,7 @@ dependencies = [
 
 [[package]]
 name = "bashkit-python"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "bashkit",
  "num-bigint",
@@ -676,9 +676,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.63"
+version = "1.2.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "556e016178bb5662a08681bbe0f00f8e17631781a4dfc8c45e466e4b185ec27f"
+checksum = "dad887fd958be91b5098c0248def011f4523ab786cd411be668777e55063501f"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -2481,9 +2481,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.100"
+version = "0.3.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2025f20d7a4fa7785846e7b63d10a76d3f1cee98ee5cb79ea59703f95e42162"
+checksum = "03d04c30968dffe80775bd4d7fb676131cd04a1fb46d2686dbffbaec2d9dfd31"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -2689,9 +2689,9 @@ checksum = "ae960838283323069879657ca3de837e9f7bbb4c7bf6ea7f1b290d5e9476d2e0"
 
 [[package]]
 name = "memchr"
-version = "2.8.1"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b947ae49db0d222b1dbc6b113ce7248a3fc3a6ca21b696717bfc000ba4484d8"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
 
 [[package]]
 name = "memoffset"
@@ -2811,9 +2811,9 @@ dependencies = [
 
 [[package]]
 name = "napi"
-version = "3.9.1"
+version = "3.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad513ff22558f1830b595ea6eb4091da48145d09a222ce157e781896f78be0b9"
+checksum = "26d3c7dd60231116a47854321c9ac8df6f13435d11aa3a59d8533a76e07a3730"
 dependencies = [
  "bitflags",
  "ctor",
@@ -4829,9 +4829,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 dependencies = [
  "serde",
 ]
@@ -5767,9 +5767,9 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.3+wasi-0.2.9"
+version = "1.0.4+wasi-0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
 dependencies = [
  "wit-bindgen 0.57.1",
 ]
@@ -5785,9 +5785,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.123"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a254a4b10c19a76f09a27640e7ffbf9bc30bf67e16a3bf28aaefa4920fe81563"
+checksum = "8ddb3f79143bced6de84270411622a2699cee572fc0875aeaf1e7867cf9fca1a"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -5798,9 +5798,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.73"
+version = "0.4.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54568702fabf5d4849ce2b90fadfa64168a097eaf4b351ce9df8b687a0086aaf"
+checksum = "503b14d284f2c8dac03b819967e155ea753f573586193b2b2c95990cb5d69280"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -5808,9 +5808,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.123"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24a40fc75b0ec6f3746ceb10d36f53a93dcd68a93b11b6445983945d79eba0dc"
+checksum = "4e21a184b13fb19e157296e2c46056aec9092264fab83e4ba59e68c61b323c3d"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -5818,9 +5818,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.123"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "908f34bd9b9ce3d4caf07b72dfab63d61504d156856c6bd3cd87fa350cf3985b"
+checksum = "fecefd9c35bd935a20fc3fc344b5f29138961e4f47fb03297d88f2587afb5ebd"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -5831,9 +5831,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.123"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7acbf7616c27b194bbb550bf77ed0c2c3e5b7fd1260a93082b95fb7f47959b92"
+checksum = "23939e44bb9a5d7576fa2b563dc2e136628f1224e88a8deed09e04858b77871f"
 dependencies = [
  "unicode-ident",
 ]
@@ -5887,9 +5887,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.100"
+version = "0.3.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e0871acf327f283dc6da28a1696cdc64fb355ba9f935d052021fa77f35cce69"
+checksum = "a6430a72df5eb332242960fe84b3002a241163998241eb596d4f739b9757061d"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -6331,9 +6331,9 @@ dependencies = [
 
 [[package]]
 name = "zeroize"
-version = "1.8.2"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
 [[package]]
 name = "zerotrie"

{bashkit-0.10.0 → bashkit-0.11.0}/Cargo.toml

@@ -7,10 +7,10 @@ resolver = "2"
 members = ["crates/*"]
 
 [workspace.package]
-version = "0.10.0"
+version = "0.11.0"
 edition = "2024"
 license = "MIT"
-authors = ["Everruns"]
+authors = ["Mykhailo Chalyi <mike@chaliy.name>", "Everruns"]
 repository = "https://github.com/everruns/bashkit"
 description = "Awesomely fast virtual sandbox with bash and file system"
 keywords = ["bash", "virtual", "ai", "agent", "everruns"]

{bashkit-0.10.0 → bashkit-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bashkit
-Version: 0.10.0
+Version: 0.11.0
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -27,6 +27,7 @@ Provides-Extra: langchain
 Provides-Extra: pydantic-ai
 Summary: A sandboxed bash interpreter for AI agents
 Keywords: bash,sandbox,ai,agent,shell,interpreter
+Author-email: Mykhailo Chalyi <mike@chaliy.name>
 License: MIT
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
@@ -47,7 +48,7 @@ Homepage: [bashkit.sh](https://bashkit.sh)
 
 - Sandboxed execution in-process, without containers or subprocess orchestration
 - Full bash syntax: variables, pipelines, redirects, loops, functions, and arrays
-- 164 built-in commands including `grep`, `sed`, `awk`, `jq`, `curl`, and `find`
+- 156 built-in commands including `grep`, `sed`, `awk`, `jq`, `curl`, and `find`
 - Persistent interpreter state across calls, including variables, cwd, and VFS contents
 - Direct virtual filesystem APIs, constructor mounts, and live host mounts
 - Snapshot and restore support on `Bash` and `BashTool`
@@ -111,6 +112,8 @@ from bashkit import Bash
 bash = Bash(
     username="agent",
     hostname="sandbox",
+    cwd="/home/agent",
+    env={"LANG": "en_US.UTF-8"},
     max_commands=1000,
     max_loop_iterations=10000,
     max_memory=10 * 1024 * 1024,

{bashkit-0.10.0/crates/bashkit-python → bashkit-0.11.0}/README.md

@@ -10,7 +10,7 @@ Homepage: [bashkit.sh](https://bashkit.sh)
 
 - Sandboxed execution in-process, without containers or subprocess orchestration
 - Full bash syntax: variables, pipelines, redirects, loops, functions, and arrays
-- 164 built-in commands including `grep`, `sed`, `awk`, `jq`, `curl`, and `find`
+- 156 built-in commands including `grep`, `sed`, `awk`, `jq`, `curl`, and `find`
 - Persistent interpreter state across calls, including variables, cwd, and VFS contents
 - Direct virtual filesystem APIs, constructor mounts, and live host mounts
 - Snapshot and restore support on `Bash` and `BashTool`
@@ -74,6 +74,8 @@ from bashkit import Bash
 bash = Bash(
     username="agent",
     hostname="sandbox",
+    cwd="/home/agent",
+    env={"LANG": "en_US.UTF-8"},
     max_commands=1000,
     max_loop_iterations=10000,
     max_memory=10 * 1024 * 1024,

{bashkit-0.10.0 → bashkit-0.11.0}/bashkit/_bashkit.pyi

@@ -465,6 +465,8 @@ class Bash:
         self,
         username: str | None = None,
         hostname: str | None = None,
+        cwd: str | None = None,
+        env: Mapping[str, str] | None = None,
         max_commands: int | None = None,
         max_loop_iterations: int | None = None,
         max_memory: int | None = None,
@@ -485,6 +487,10 @@ class Bash:
         Args:
             username: Custom username (default ``"user"``).
             hostname: Custom hostname (default ``"bashkit"``).
+            cwd: Initial working directory for the shell. Sets the starting
+                directory directly instead of running a leading ``cd``.
+            env: Initial environment variables applied before execution, so
+                scripts see them without an ``export`` prelude.
             max_commands: Limit total commands executed.
             max_loop_iterations: Limit iterations per loop.
             max_memory: Memory limit in bytes for the VFS.
@@ -716,6 +722,8 @@ class Bash:
         data: bytes,
         username: str | None = None,
         hostname: str | None = None,
+        cwd: str | None = None,
+        env: Mapping[str, str] | None = None,
         max_commands: int | None = None,
         max_loop_iterations: int | None = None,
         max_memory: int | None = None,
@@ -740,6 +748,8 @@ class Bash:
         key: bytes,
         username: str | None = None,
         hostname: str | None = None,
+        cwd: str | None = None,
+        env: Mapping[str, str] | None = None,
         max_commands: int | None = None,
         max_loop_iterations: int | None = None,
         max_memory: int | None = None,
@@ -922,6 +932,8 @@ class BashTool:
         self,
         username: str | None = None,
         hostname: str | None = None,
+        cwd: str | None = None,
+        env: Mapping[str, str] | None = None,
         max_commands: int | None = None,
         max_loop_iterations: int | None = None,
         max_memory: int | None = None,
@@ -938,6 +950,10 @@ class BashTool:
         Args:
             username: Custom username (default ``"user"``).
             hostname: Custom hostname (default ``"bashkit"``).
+            cwd: Initial working directory for the shell. Sets the starting
+                directory directly instead of running a leading ``cd``.
+            env: Initial environment variables applied before execution, so
+                scripts see them without an ``export`` prelude.
             max_commands: Limit total commands executed.
             max_loop_iterations: Limit iterations per loop.
             max_memory: Memory limit in bytes for the VFS.
@@ -1188,6 +1204,8 @@ class BashTool:
         data: bytes,
         username: str | None = None,
         hostname: str | None = None,
+        cwd: str | None = None,
+        env: Mapping[str, str] | None = None,
         max_commands: int | None = None,
         max_loop_iterations: int | None = None,
         max_memory: int | None = None,
@@ -1208,6 +1226,8 @@ class BashTool:
         key: bytes,
         username: str | None = None,
         hostname: str | None = None,
+        cwd: str | None = None,
+        env: Mapping[str, str] | None = None,
         max_commands: int | None = None,
         max_loop_iterations: int | None = None,
         max_memory: int | None = None,

{bashkit-0.10.0 → bashkit-0.11.0}/crates/bashkit/README.md

@@ -14,7 +14,7 @@ Homepage: [bashkit.sh](https://bashkit.sh)
 
 - **Secure by default** - No process spawning, no filesystem access, no network access unless explicitly enabled. [280+ threats](specs/threat-model.md) analyzed and mitigated
 - **POSIX compliant** - Substantial IEEE 1003.1-2024 Shell Command Language compliance
-- **Sandboxed, in-process execution** - All 164 commands reimplemented in Rust, no `fork`/`exec`
+- **Sandboxed, in-process execution** - All 156 commands reimplemented in Rust, no `fork`/`exec`
 - **Virtual filesystem** - InMemoryFs, OverlayFs, MountableFs with optional RealFs backend (`realfs` feature)
 - **Resource limits** - Command count, loop iterations, function depth, output size, filesystem size, parser fuel
 - **Network allowlist** - HTTP access denied by default, per-domain control
@@ -123,7 +123,7 @@ assert_eq!(output.result["stdout"], "hello\nworld\n");
   </a>
 </div>
 
-## Built-in Commands (164)
+## Built-in Commands (156)
 
 | Category | Commands |
 |----------|----------|
@@ -540,7 +540,7 @@ Bashkit is built for running untrusted scripts from AI agents and users. Securit
 
 | Layer | Protection |
 |-------|------------|
-| **No process spawning** | All 164 commands are reimplemented in Rust — no `fork`, `exec`, or shell escape |
+| **No process spawning** | All 156 commands are reimplemented in Rust — no `fork`, `exec`, or shell escape |
 | **Virtual filesystem** | Scripts see an in-memory FS by default; no host filesystem access unless explicitly mounted |
 | **Network allowlist** | HTTP access is denied by default; each domain must be explicitly allowed |
 | **Resource limits** | Configurable caps on commands (10K), loop iterations (100K), function depth (100), output (10MB), input (10MB) |

{bashkit-0.10.0 → bashkit-0.11.0}/crates/bashkit/docs/compatibility.md

@@ -12,7 +12,7 @@
 ## POSIX Shell Compliance
 
 Bashkit provides substantial compliance with IEEE Std 1003.1-2024 (POSIX.1-2024)
-Shell Command Language. See [specs/implementation-status.md](../specs/implementation-status.md)
+Shell Command Language. See [specs/limitations.md](../specs/limitations.md)
 for detailed compliance status.
 
 | POSIX Category | Status |
@@ -479,5 +479,5 @@ Identified from eval analysis — all items now implemented:
 
 ## See Also
 
-- [specs/implementation-status.md](../../../specs/implementation-status.md) - Detailed implementation status
+- [specs/limitations.md](../../../specs/limitations.md) - Intentional gaps and partial features
 - [specs/](../../../specs/) - Design specifications

{bashkit-0.10.0 → bashkit-0.11.0}/crates/bashkit/docs/threat-model.md

@@ -671,6 +671,68 @@ let bash = Bash::builder()
 // Commits use virtual identity, never host ~/.gitconfig
 ```
 
+### SSH Security (TM-SSH-*)
+
+The `ssh`/`scp`/`sftp` builtins (opt-in `ssh` feature) connect to remote hosts
+through a sandboxed client. Connections are default-deny: callers must allowlist
+each host via `SshConfig::allow(...)`, and credentials come only from the VFS —
+never the host `~/.ssh/`.
+
+| Threat | Attack Example | Mitigation | Status |
+|--------|---------------|------------|--------|
+| Unauthorized host access (TM-SSH-001) | Connect to arbitrary hosts | Host allowlist (default-deny) | MITIGATED |
+| Credential leakage (TM-SSH-002) | Read host `~/.ssh/` keys | Keys from VFS only | MITIGATED |
+| Session exhaustion (TM-SSH-003) | Open many concurrent sessions | Max concurrent sessions limit | MITIGATED |
+| OOM via large response (TM-SSH-004) | Server sends huge output | Streaming size limit | MITIGATED |
+| Connection hang (TM-SSH-005) | Server never responds | Configurable timeout | MITIGATED |
+| MITM via unverified host key (TM-SSH-006) | Attacker intercepts connection | Strict host key checking (default: on) | MITIGATED |
+| Non-standard port access (TM-SSH-007) | Connect to services on unexpected ports | Port allowlist | MITIGATED |
+| Remote command injection (TM-SSH-008) | Inject via remote path in SCP | Shell-escape remote paths | MITIGATED |
+
+### TypeScript / ZapCode Security (TM-TS-*)
+
+The `typescript` feature embeds the ZapCode runtime. Scripts run under
+wall-clock, memory, allocation, and stack-depth limits, and all filesystem
+access is bridged through Bashkit's VFS — never the host filesystem.
+
+| Threat | Attack Example | Mitigation | Status |
+|--------|---------------|------------|--------|
+| Infinite loop (TM-TS-001) | `while (true) {}` | ZapCode time limit (default 30s) | MITIGATED |
+| Memory exhaustion (TM-TS-002) | Large allocation | `max_memory` (64MB) + `max_allocations` (1M) | MITIGATED |
+| Stack overflow (TM-TS-003) | Deep recursion | `max_stack_depth` (512) | MITIGATED |
+| Allocation bomb (TM-TS-004) | Many small objects | `max_allocations` (1M) | MITIGATED |
+| Real filesystem read (TM-TS-005) | Read host files via VFS | VFS bridge reads only Bashkit VFS | MITIGATED |
+| VFS write escape (TM-TS-006) | Write to host | VFS bridge writes only Bashkit VFS | MITIGATED |
+| Path traversal (TM-TS-007) | `../../etc/passwd` | Paths resolved within sandbox | MITIGATED |
+| Host `/tmp` escape (TM-TS-011) | Operations escape to host | All operations through Bashkit VFS | MITIGATED |
+| Limit bypass (TM-TS-018) | Evade Bashkit caps via TS | Command budget still enforced | MITIGATED |
+
+Full per-threat coverage (TM-TS-001 … TM-TS-020), including error-isolation and
+exit-code propagation cases, lives in the spec and the `threat_ts_*` tests.
+
+### Request Signing & Snapshot Integrity (TM-CRY-*, TM-SNAP-*)
+
+The `bot-auth` request signer (Ed25519, RFC 9421) and the snapshot
+serialization API both handle key material and integrity tags.
+
+| Threat | Attack Example | Mitigation | Status |
+|--------|---------------|------------|--------|
+| Private key recovery (TM-CRY-001) | Heap/core-dump inspection of the Ed25519 seed | `BotAuthConfig` zeroizes the seed in `Drop`; debug output redacts key material | MITIGATED |
+| Snapshot forgery (TM-SNAP-001) | Forge a valid digest using the public `BKSNAP01` tag | Keyed HMAC API (`to_bytes_keyed`/`from_bytes_keyed`) for tamper-evident snapshots | MITIGATED |
+
+`from_bytes` uses `SHA-256(BKSNAP01 || payload)` (the tag is a public constant,
+so it detects accidental corruption, not forgery); `from_bytes_keyed` uses
+`HMAC-SHA256(secret_key, payload)` with a caller-provided key for authenticity.
+
+### RealFs Mount Security (TM-FS-*)
+
+The `realfs` feature can mount real host directories into the VFS. Mounts are
+read-only by default and gated by an allowlist.
+
+| Threat | Attack Example | Mitigation | Status |
+|--------|---------------|------------|--------|
+| Permissive RealFs mount (TM-FS-013) | `mount_real_readonly_at("/", …)` exposes the whole host | Allowlist-first: broad roots (`/`, `/etc`, `/root`, `/home`, …) and any path component matching `.ssh`, `.aws`, `.kube`, `.docker`, `.gnupg`, `.gcloud` are refused unless explicitly allowlisted | MITIGATED |
+
 ### Unicode Security (TM-UNI-*)
 
 Unicode input from untrusted scripts creates attack surface across the parser, builtins,
@@ -789,8 +851,13 @@ All threats use stable IDs in the format `TM-<CATEGORY>-<NUMBER>`:
 | TM-INT | Internal Error Handling |
 | TM-LOG | Logging Security |
 | TM-GIT | Git Security |
+| TM-SSH | SSH Security |
 | TM-PY | Python/Monty Security |
 | TM-SQL | SQLite Security |
+| TM-TS | TypeScript/ZapCode Security |
+| TM-CRY | Cryptography / Request Signing |
+| TM-SNAP | Snapshot Integrity |
+| TM-FS | RealFs Mount Security |
 | TM-UNI | Unicode Security |
 
 Full threat analysis: [`specs/threat-model.md`][spec]

bashkit-0.11.0/crates/bashkit/examples/dump_builtins.rs

@@ -0,0 +1,78 @@
+//! Dump the canonical builtin inventory as JSON.
+//!
+//! Source generator for `specs/status/builtins.json` (the data behind the
+//! site's builtins page). Run via `just regen-builtins`, which enables every
+//! builtin-affecting feature so the inventory is complete; the
+//! `builtins-drift` workflow regenerates and fails on diff.
+//!
+//! Attribution: builder-registered opt-ins (python, typescript, sqlite) are
+//! discovered by diffing `builtin_names()` against a default `Bash`;
+//! cfg-registered families are tagged from the table below, which must stay
+//! in sync with the `#[cfg(feature = ...)]` blocks in
+//! `interpreter::with_config`.
+
+use bashkit::Bash;
+use std::collections::BTreeMap;
+
+/// Families registered by compile feature alone (present in a default-built
+/// `Bash` whenever the feature is on).
+const CFG_REGISTERED: &[(&str, &[&str])] = &[
+    ("jq", &["jq"]),
+    ("git", &["git"]),
+    ("ssh", &["ssh", "scp", "sftp"]),
+];
+
+fn main() {
+    let base = Bash::new().builtin_names();
+    let mut feature_of: BTreeMap<String, String> = BTreeMap::new();
+
+    for (feature, names) in CFG_REGISTERED {
+        for name in *names {
+            if base.iter().any(|n| n == name) {
+                feature_of.insert((*name).to_string(), (*feature).to_string());
+            }
+        }
+    }
+
+    let mut tag_builder_optin = |names: Vec<String>, feature: &str| {
+        for name in names {
+            if !base.contains(&name) {
+                feature_of.insert(name, feature.to_string());
+            }
+        }
+    };
+
+    #[cfg(feature = "python")]
+    tag_builder_optin(Bash::builder().python().build().builtin_names(), "python");
+    #[cfg(feature = "typescript")]
+    tag_builder_optin(
+        Bash::builder().typescript().build().builtin_names(),
+        "typescript",
+    );
+    #[cfg(feature = "sqlite")]
+    tag_builder_optin(Bash::builder().sqlite().build().builtin_names(), "sqlite");
+    #[cfg(not(any(feature = "python", feature = "typescript", feature = "sqlite")))]
+    let _ = &mut tag_builder_optin;
+
+    let mut all: Vec<String> = base;
+    all.extend(feature_of.keys().cloned());
+    all.sort();
+    all.dedup();
+
+    let builtins: Vec<serde_json::Value> = all
+        .iter()
+        .map(|name| {
+            serde_json::json!({
+                "name": name,
+                "feature": feature_of.get(name),
+            })
+        })
+        .collect();
+
+    let doc = serde_json::json!({
+        "_generated": "just regen-builtins — do not edit by hand",
+        "count": builtins.len(),
+        "builtins": builtins,
+    });
+    println!("{}", serde_json::to_string_pretty(&doc).expect("serialize"));
+}

{bashkit-0.10.0 → bashkit-0.11.0}/crates/bashkit/src/builtins/awk/parser.rs

@@ -3,7 +3,10 @@
 use std::collections::HashMap;
 
 use super::{AwkAction, AwkExpr, AwkFunctionDef, AwkOutputTarget, AwkPattern, AwkProgram, AwkRule};
-use crate::builtins::limits::AWK_MAX_PARSER_DEPTH as MAX_AWK_PARSER_DEPTH;
+use crate::builtins::limits::{
+    AWK_MAX_MULTI_SUBSCRIPTS as MAX_AWK_MULTI_SUBSCRIPTS,
+    AWK_MAX_PARSER_DEPTH as MAX_AWK_PARSER_DEPTH,
+};
 use crate::builtins::search_common::build_regex;
 use crate::error::{Error, Result};
 
@@ -1484,8 +1487,15 @@ impl<'a> AwkParser<'a> {
                 self.pos += 1; // consume '['
                 let mut subscripts = vec![self.parse_expression()?];
                 self.skip_whitespace();
-                // Handle multi-subscript: arr[e1, e2, ...] joined by SUBSEP
+                // THREAT[TM-DOS-027]: SUBSEP_CONCAT still evaluates recursively, so cap
+                // attacker-controlled comma lists before folding them into a left-deep AST.
                 while self.pos < self.input.len() && self.current_char().unwrap() == ',' {
+                    if subscripts.len() >= MAX_AWK_MULTI_SUBSCRIPTS {
+                        return Err(Error::Execution(format!(
+                            "awk: too many array subscripts (max {})",
+                            MAX_AWK_MULTI_SUBSCRIPTS
+                        )));
+                    }
                     self.pos += 1; // consume ','
                     self.skip_whitespace();
                     subscripts.push(self.parse_expression()?);

{bashkit-0.10.0 → bashkit-0.11.0}/crates/bashkit/src/builtins/awk/tests.rs

@@ -7,6 +7,7 @@ use crate::builtins::limits::{
     AWK_MAX_GETLINE_CACHE_BYTES as MAX_GETLINE_CACHE_BYTES,
     AWK_MAX_GETLINE_CACHED_FILES as MAX_GETLINE_CACHED_FILES,
     AWK_MAX_GETLINE_FILE_BYTES as MAX_GETLINE_FILE_BYTES,
+    AWK_MAX_MULTI_SUBSCRIPTS,
     AWK_MAX_OUTPUT_BYTES as MAX_OUTPUT_BYTES,
     AWK_MAX_OUTPUT_TARGETS as MAX_OUTPUT_TARGETS,
 };
@@ -593,6 +594,19 @@ async fn test_awk_multi_subscript() {
     assert_eq!(result.stdout.trim(), "1");
 }
 
+#[tokio::test]
+async fn test_awk_rejects_too_many_multi_subscripts() {
+    // Regression: unbounded multi-subscript lists built a recursive SUBSEP_CONCAT AST.
+    let subscripts = std::iter::repeat_n("1", AWK_MAX_MULTI_SUBSCRIPTS + 1)
+        .collect::<Vec<_>>()
+        .join(",");
+    let program = format!("BEGIN {{ a[{subscripts}] = 1 }}");
+
+    let err = run_awk(&[&program], Some("")).await.unwrap_err();
+
+    assert!(err.to_string().contains("too many array subscripts"));
+}
+
 #[tokio::test]
 async fn test_awk_subsep_defined() {
     // Issue #396.3: SUBSEP should be defined as \034