just-bash

Minor Changes

• Add the mktemp command. It creates a unique temporary file (mode 0600) or directory (-d, mode 0700) and prints its path, supporting -p/--tmpdir[=DIR], -t, -u/--dry-run, -q/--quiet, --suffix=SUFF, GNU-style TEMPLATE expansion, --help and --version. The default directory is $TMPDIR when set and non-empty, otherwise /tmp, so sandboxed embedders that point TMPDIR at a writable directory get a usable path. Random name characters come from the platform CSPRNG (crypto.getRandomValues), and existing paths are never returned.

  Adds an optional createExclusive(path, { mode, directory }) method to IFileSystem, which creates an entry only if the name is free and applies the mode at creation time rather than via a follow-up chmod. All built-in filesystems implement it. The member is optional, so external IFileSystem implementations remain source compatible; mktemp reports that such a filesystem cannot create atomically rather than substituting a non-atomic sequence. The accompanying CreateExclusiveOptions type is exported alongside the existing MkdirOptions/RmOptions.

• Add the yes command. yes [STRING]... repeats a line built from its operands (y when there are none), so yes | head -3 and yes | some-prompt work instead of failing with exit 127. Because pipeline stages here run to completion rather than streaming, the stream is finite: it ends after executionLimits.maxLoopIterations lines, or earlier if the repeated line would exceed the output size limit.

Patch Changes

• interpreter: preserve complete associative-array values in declare -A compound assignments

  Quoted values containing whitespace were reconstructed without quoting before the declare builtin parsed them, so every value was silently truncated at its first space. Associative-array declarations now retain whitespace and other quoted content.

• fs: keep the Buffer-less fromBuffer fallback under the argument limit

  Without Buffer (for example in a Chrome extension service worker), fromBuffer converted base64, binary and latin1 content by spreading 64KB chunks into String.fromCharCode, which can exceed the engine's argument limit and throw RangeError: Maximum call stack size exceeded on a 64KB cat. The fallback now converts in 8KB chunks.

• Handle accessor descriptors when installing module defense-in-depth proxies on Bun, preserving blocking behavior and original descriptors on teardown.

• find: report a directory it cannot read and keep going

  A readdir failure inside the traversal threw out of the whole search, so one unreadable directory ended find with no results: exit 1 and find: EACCES: permission denied, scandir '<path>' on its own, and exit 0 with nothing at all once piped through head with stderr silenced. Every macOS home directory holds such a directory (.Trash, several under Library), so a recursive find over a mounted home directory never returned anything.

  GNU find names the directory on stderr, continues with everything else, and exits 1 at the end. It now does the same here. The message is find: <path>: Permission denied, with the phrase taken from the errno alone, so nothing from the underlying error's text reaches the output. A failure that is not one of the errnos a directory read can produce (a cancellation, an execution limit, a filesystem policy refusal) still ends the search as before.

  Messages are emitted in traversal order beside the node's own output, whatever order the parallel batch settled in, and a failed read still counts toward the trace's readdirCalls and readdirTime.

• Match real jq behavior for to_entries on arrays (numeric-key entries instead of null) and tonumber on empty or whitespace-only strings (error instead of 0).

• interpreter: give a loop left via break/continue status 0 instead of the last command's

  break and continue are builtins that return 0, and they are the last command a loop body runs. A loop exited through them reported the status of whatever ran before the break instead:

  while :; do false; break; done; echo $?            # was 1, bash says 0
  for i in 1; do false; break; done; echo $?         # was 1, bash says 0
  for i in 1 2; do false; continue; done; echo $?    # was 1, bash says 0

  All four loop forms were affected — for, C-style for, while, until — as was a break/continue in a while condition and a multi-level break 2 unwinding through an enclosing loop.

  The stale status is invisible until something reads $?, and under set -e the phantom failing loop ends the script with no output and no diagnostic:

  set -euo pipefail
  while :; do
    [ 5 -eq 0 ] && break     # correctly exempt from errexit as the left operand of &&
    break
  done
  echo ok                    # never ran

  $? moves with the status, so the next iteration sees it too — a for loop runs nothing between the continue and the next iteration's first command, and would otherwise still expose the failure there:

  for i in 1 2; do echo "$i:$?"; false; continue; done   # was 1:0 2:1, bash says 1:0 2:0

  continue sets the status at the point it runs but does not pin it: a later iteration still overwrites it, so for i in 1 2; do if [ $i = 1 ]; then true; continue; fi; false; done is still 1. A loop that ends normally is unchanged and reports its last command, and return from a function still reports the last command rather than 0.

  Reported downstream as ai-ecoverse/slicc#2978.

• Give MountableFs synchronous mkdirSync and writeFileSync, routed to the filesystem that owns the path, so Bash sets up /bin, /dev, /proc, /tmp and the working directory in its base. Paths on a filesystem without synchronous writes throw ENOSYS and are left out of the layout.

• Fix default, assignment, and alternative parameter expansions used as an entire double-quoted word under set -u. For example, echo "${U:-fallback}" now prints fallback when U is unset instead of reporting "unbound variable". This also lets scripts safely check optional CI variables such as GITHUB_STEP_SUMMARY.

• Bundle the patched smol-toml 1.9.0.

  The Node bundle inlines smol-toml, so a consumer can't pick up its fix through its own lockfile. Only a just-bash release carries it.

• Use a virtual executable name for CPython instead of the host worker path, avoiding script finalization failures under long installation paths without weakening worker protections.

• Repeated grep -e options overwrote the earlier patterns, so only the last one was used. All -e patterns now combine.

• Host operations that settle after a cancelled execution no longer surface as a process-level unhandledRejection.

  Aborting or timing out an execution while the worker bridge was awaiting a host tool (or an exec) left that operation to settle after the defense-in-depth box deactivated. The box's Promise.prototype.then guard, which blocks sandbox callbacks once their execution ends, then dropped the handlers meant to consume that result: a late rejection crashed processes that treat unhandled rejections as fatal, and a late success never reached the bridge. Host-side settlement now goes through await, which bypasses the guarded then.

• Keep leading blanks after a\, i\ and c\ in sed text, as GNU does, including blanks escaped with a backslash. The one-line a text form now strips every leading blank instead of only the first.

• Fix intermittent python3 failures with OSError: [Errno 29] I/O error on a busy host. A wakeup left over from the previous bridge call could end the wait for the next call before the main thread answered it. The worker now keeps waiting until the call is answered, within the same operation timeout.

• timeout: a deadline that lands while a command is still loading no longer aborts the rest of the script

  timeout on a cold command — the first use of any lazily loaded command — could return 124 and still kill every statement after it. Cancelled invocations now stop waiting for the load and report cancellation instead.

Minor Changes

• jq: add external-argument flags (--arg, --argjson, --rawfile, --slurpfile, --args, --jsonargs) and the $ARGS object ($ARGS.named / $ARGS.positional), matching real jq 1.7.1 behavior including exit codes, error messages, and prototype-sensitive key handling.

• Support user file descriptors (fd >= 3). exec 3< file, N< file / N> file / N>> file on any command, read -u N, read <&N, >&N, N<&M, and N<&- now go through a real descriptor table: a descriptor carries one shared read position, exec keeps it open until it is closed, and every other construct — including done N< file on a loop — gets it only for the duration of that command.

• Treat a - FILE operand in grep as standard input, matching GNU. grep PATTERN - now reads stdin instead of failing with "No such file or directory", stdin is labelled (standard input) in the multi-file prefix and in -l/-L/-c output, repeated - operands see the stream drained by the first one, and - is exempt from -r recursion and --include/--exclude filtering.

• Support process substitution <(cmd) and >(cmd).

  <(cmd) runs cmd and substitutes a readable /dev/fd/N path backed by an
  in-memory file; >(cmd) substitutes a writable path whose contents are fed to
  cmd once the outer command finishes. Descriptors are numbered from 63
  downwards like bash and released when the command that opened them completes.
  Process substitutions retain their surrounding word context in assignments,
  conditionals, regular expressions, and heredoc delimiters. Previously any use
  raised Parse error: Expected redirection target.

• Add grep -f FILE / --file=FILE to read patterns from a file (one per line). Patterns from -f OR-combine with -e patterns and with each other, -f - reads patterns from stdin, empty pattern lines match every line, and an empty pattern file selects nothing (exit 1). Newline-separated PATTERNS operands are now split into individual patterns, and -x groups alternatives correctly (^(?:a|b)$).

Patch Changes

• Parse and serialize bare file descriptor variable redirections such as {output}>output.log and {input}<<EOF. Bare redirects create their target with a command-scoped descriptor, while named command forms keep the allocated descriptor available.

• Fix escaped reserved words being parsed as shell syntax. Unquoted escapes now retain their provenance through lexing and word parsing, including when the word is serialized back to Bash.

• Fix grep -L exit status to match GNU grep. The status reports whether a line
  was selected, not whether a filename was printed, so grep -L now exits 0 when
  every file matched (printing nothing) and 1 when no file matched (printing every
  name) — previously these were inverted.

• network: restore private-range-enforced requests from the bundled build

  Every request made with denyPrivateRanges enabled failed with Network access denied: DNS pinning unavailable for private IP enforcement, so curl could not reach any host at all. The published ESM bundle was affected; source consumers and the CommonJS bundle were not.

  The pinned connection owner reads Agent and fetch off a dynamic import("undici"). Node's resolution of the package exposes those as named exports, but the ESM build inlines undici's CommonJS module into a chunk whose namespace carries it under default alone, so Agent was undefined and the TypeError from constructing it was reported as a runtime incapable of pinning.

  The namespace is now normalized before the transport is read off it, which also covers a consumer that bundles just-bash further.

• Stop command groups, function bodies and eval from rewinding stdin they never replaced, so { { read a; }; read b; } gives b the second line instead of replaying the first.

• Reject unsupported command-leading reserved words in every parser context instead of discarding them or executing them as simple commands. Unknown command AST nodes now fail explicitly instead of returning a successful result.

• Restore command groups and subshells after the process-substitution and stdin-ownership changes were combined without forwarding ownership through inner command dispatch.

• Apply output redirections attached to while and until loops. while true; do echo x; break; done >/dev/null no longer leaks its output to the caller, and > file, >>, 2>, 2>&1, &> and >| now behave on loops the way they already did on for and case. until loops also gained the input-redirection handling while loops already had, so until ! read l; do ...; done < file reads from the file. A loop now only restores stdin it owns, so reading inside a loop no longer rewinds an enclosing group's read position: printf 'a\nb\n' | { while read x; do break; done; read y; } sees y=b.

• Stop pipelines from draining the enclosing shell's stdin, so while read …; do … | …; done < file runs once per line again.

• Process redirections through policy-driven transactions that preserve Bash ordering, descriptor lifetimes, persistent exec routes, compound-command stdin, control-flow output routing, and shared read-write descriptor positions without duplicate expansion or opening.

• FS sym-link hardening

• sqlite3: report failed statements on stderr and exit non-zero without -bail

  A statement that failed was written to stdout as Error: ... and the command still exited 0 unless -bail was passed. Real sqlite3 writes the error to stderr and exits 1 in either mode; -bail only decides whether the remaining statements still run.

  Two consequences for callers: sqlite3 db "SELECT ..." > out.csv silently wrote the error text into the data file, and sqlite3 db "..." && next-step ran next-step after the query had failed, so a shell script could not detect a bad query without opting into -bail and losing the ability to see later statements.

  Errors now accumulate on stderr in statement order and the exit status is 1 whenever any statement failed. Successful runs are unchanged, -bail still stops at the first failure, and the partial stdout produced before a failure is still emitted. Writeback of a partially-successful script is also unchanged.

• Preserve whether a here-document ended at its delimiter or at end-of-input. Unterminated final body lines now receive Bash's trailing newline, backslash-newline continuations are removed during expansion, and serialization rejects unterminated documents rather than manufacturing a closing delimiter.