chore: release

examples/executor-tools/CHANGELOG.md

@@ -1,5 +1,13 @@
 # executor-tools-example
 
+## 1.0.4
+
+### Patch Changes
+
+- Updated dependencies [[`150a915`](https://github.com/vercel-labs/just-bash/commit/150a915a1d45a2cc7f2b6aec3268f27116c34916), [`75d8dfd`](https://github.com/vercel-labs/just-bash/commit/75d8dfd3a322786250e3b0f81b1500c87610acb7), [`1369b77`](https://github.com/vercel-labs/just-bash/commit/1369b772fe887694c09ce834d1b0b21aa6420b59), [`4ece258`](https://github.com/vercel-labs/just-bash/commit/4ece2580d8cb707e6c6b7fa22897ea3fdd21739a), [`d64009a`](https://github.com/vercel-labs/just-bash/commit/d64009aef6bc1556e7c84b22ed455863275ea953), [`c9904de`](https://github.com/vercel-labs/just-bash/commit/c9904dea24ad2aa847749ee6289239c2a2c651fc)]:
+  - just-bash@3.0.2
+  - @just-bash/executor@1.0.3
+
 ## 1.0.3
 
 ### Patch Changes

examples/executor-tools/package.json

@@ -1,6 +1,6 @@
 {
   "name": "executor-tools-example",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Example of @just-bash/executor — inline tools + GraphQL/OpenAPI/MCP discovery",
   "type": "module",
   "scripts": {

packages/just-bash-executor/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @just-bash/executor
 
+## 1.0.3
+
+### Patch Changes
+
+- Updated dependencies [[`150a915`](https://github.com/vercel-labs/just-bash/commit/150a915a1d45a2cc7f2b6aec3268f27116c34916), [`75d8dfd`](https://github.com/vercel-labs/just-bash/commit/75d8dfd3a322786250e3b0f81b1500c87610acb7), [`1369b77`](https://github.com/vercel-labs/just-bash/commit/1369b772fe887694c09ce834d1b0b21aa6420b59), [`4ece258`](https://github.com/vercel-labs/just-bash/commit/4ece2580d8cb707e6c6b7fa22897ea3fdd21739a), [`d64009a`](https://github.com/vercel-labs/just-bash/commit/d64009aef6bc1556e7c84b22ed455863275ea953), [`c9904de`](https://github.com/vercel-labs/just-bash/commit/c9904dea24ad2aa847749ee6289239c2a2c651fc)]:
+  - just-bash@3.0.2
+
 ## 1.0.2
 
 ### Patch Changes

packages/just-bash-executor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@just-bash/executor",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Experimental tool-invocation companion for just-bash. Wires @executor-js/sdk into js-exec via the invokeTool hook.",
   "repository": {
     "type": "git",

packages/just-bash/CHANGELOG.md

@@ -1,5 +1,68 @@
 # just-bash
 
+## 3.0.2
+
+### Patch Changes
+
+- [#272](https://github.com/vercel-labs/just-bash/pull/272) [`150a915`](https://github.com/vercel-labs/just-bash/commit/150a915a1d45a2cc7f2b6aec3268f27116c34916) Thanks [@trieloff](https://github.com/trieloff)! - interpreter: fix UTF-8 mojibake when a script interleaves text-output and byte-output statements
+
+  A single `exec()` can interleave text-shaped statements (sed, awk, echo — `ö`
+  as `U+00F6`) with byte-shaped ones (grep | head, cat — `ö` as bytes
+  `0xC3 0xB6`). `executeScript` / `executeStatement` concatenated each result's
+  raw stdout, so the lone high byte from the text half made the combined stream
+  invalid UTF-8, the output-boundary decoder bailed, and the byte half came back
+  as Latin-1 mojibake (`Köpenicker` for `Köpenicker`). The same path backs
+  command substitution, so `echo "你好: $(cat /file)"` was affected too.
+
+  The fix decodes each statement/pipeline result to text via its explicit
+  `stdoutKind` (`decodedTextFromResult`) before concatenating — no guessing from
+  string contents, so text whose code units merely look like UTF-8 (`ö`) is
+  preserved. `tac` (stdin path) and `curl` (response body) now declare
+  `stdoutKind: "bytes"` on the results that forward raw bytes, so the decode is
+  driven per output rather than by inspecting characters.
+
+- [#256](https://github.com/vercel-labs/just-bash/pull/256) [`75d8dfd`](https://github.com/vercel-labs/just-bash/commit/75d8dfd3a322786250e3b0f81b1500c87610acb7) Thanks [@Hazzng](https://github.com/Hazzng)! - js-exec: fix Buffer shim correctness — ascii encode now uses & 0xff (not & 0x7f), consolidate latin1/ascii into shared \_rawEncode, fix Buffer.from(ArrayBuffer, offset, length), throw on invalid byteLength input, clamp negative toString start, throw RangeError for out-of-range write offset
+
+- [#239](https://github.com/vercel-labs/just-bash/pull/239) [`1369b77`](https://github.com/vercel-labs/just-bash/commit/1369b772fe887694c09ce834d1b0b21aa6420b59) Thanks [@trieloff](https://github.com/trieloff)! - curl: interpret `@file` for `-d`/`--data`, `--data-binary`, and `--data-urlencode`
+
+  Real curl reads file contents when these flags are passed `@filename`:
+
+  - `-d @file` / `--data @file` — read file contents, strip CR/LF.
+  - `--data-binary @file` — read file contents verbatim (newlines preserved).
+  - `--data-urlencode @file` — read file, URL-encode the contents.
+  - `--data-urlencode name@file` — prefix the URL-encoded contents with `name=`.
+
+  just-bash's curl previously passed `@filename` through verbatim as the HTTP body. Posting JSON or any non-trivial payload via `curl --data-binary @payload.json https://…` sent the literal string `@payload.json` instead of the file. The new behavior matches upstream curl; `--data-raw` keeps the documented "no `@` interpretation" semantics.
+
+- [#262](https://github.com/vercel-labs/just-bash/pull/262) [`4ece258`](https://github.com/vercel-labs/just-bash/commit/4ece2580d8cb707e6c6b7fa22897ea3fdd21739a) Thanks [@chernetsov](https://github.com/chernetsov)! - parser: don't treat quotes inside a heredoc body as shell quotes when finding the end of a command substitution
+
+  A command substitution whose body contained a heredoc with an unbalanced quote in its body — most commonly an apostrophe in literal prose, e.g. `June's` — failed to parse with `bash: syntax error: ... unexpected EOF while looking for matching ')'`:
+
+  ```bash
+  OUT=$(cat <<'SCRIPT'
+  June's moon
+  SCRIPT
+  )
+  ```
+
+  Both the lexer's `$(...)` word scanner and the substitution boundary scanner walked into the heredoc body and applied shell quote tracking to it. The `'` in `June's` opened a single-quoted string that never closed, so the closing `)` was swallowed and the scan ran to EOF. In bash a heredoc body is literal text and must be skipped wholesale when locating the substitution boundary.
+
+  Both scanners are now heredoc-aware: when scanning a `$(...)` they recognize `<<` / `<<-` operators (but not the `<<<` here-string), capture the possibly-quoted delimiter, and skip the heredoc body lines literally — without quote or paren tracking — up to the terminator. Multiple heredocs on one line and tab-stripping (`<<-`) are handled. This fixes the common pattern of capturing the output of a connector/CLI invocation that is fed a heredoc script containing apostrophes, backticks, or parentheses.
+
+  The heredoc scan also tracks arithmetic `((...))` nesting so a `<<` left-shift inside `$((...))` (or a nested arithmetic expansion) is not mistaken for a heredoc opener — previously a multi-line arithmetic expansion containing a shift, e.g. `$((\n1 << 2\n))`, had its closing `))` swallowed by spurious body-skipping.
+
+- [#248](https://github.com/vercel-labs/just-bash/pull/248) [`d64009a`](https://github.com/vercel-labs/just-bash/commit/d64009aef6bc1556e7c84b22ed455863275ea953) Thanks [@Hazzng](https://github.com/Hazzng)! - perf(grep): up to 14.5× speedup via preFilter extensions and matcher reuse.
+
+  Anchored alternation patterns like `^def \|^async def` now extract literal needles (stripping outer `^`/`$`), enabling the `String.indexOf` fast-path. Files with no matching needle are rejected before `split("\n")`, skipping RE2 entirely. `acquireMatcher()` extended to `match()`, `replace()`, `search()`, and `matchAll()` to reduce GC pressure across awk/sed hot-paths.
+
+- [#261](https://github.com/vercel-labs/just-bash/pull/261) [`c9904de`](https://github.com/vercel-labs/just-bash/commit/c9904dea24ad2aa847749ee6289239c2a2c651fc) Thanks [@chernetsov](https://github.com/chernetsov)! - set: support a bundled `-o`/`+o` long option inside a short-flag cluster (e.g. `set -euo pipefail`)
+
+  The `set` builtin previously rejected `set -euo pipefail` with `bash: set: -o: invalid option`, because it parsed each character after the `-` as an independent short flag and has no `o` short flag. `-o` was only honored as its own token (`set -eu -o pipefail`).
+
+  This is the canonical "bash strict mode" idiom and is extremely common in generated scripts, so the whole script would abort on its first line.
+
+  `set` now matches bash: an `o` inside a cluster consumes the _next word_ as its long-option name, and the remaining characters keep being parsed as short flags. So `set -euo pipefail` is equivalent to `set -e -u -o pipefail`, `set -oe pipefail` enables both `pipefail` and `errexit`, trailing words become positional parameters, and `+`-clusters (`set +euo pipefail`) disable the options. An invalid bundled name (`set -euo bogus`) still reports `invalid option name`, and an `o` with no following argument falls back to the standalone `-o`/`+o` listing.
+
 ## 3.0.1
 
 ### Patch Changes

packages/just-bash/package.json

@@ -1,6 +1,6 @@
 {
   "name": "just-bash",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "A simulated bash environment with virtual filesystem",
   "repository": {
     "type": "git",