v0.3.1

Patch release: line-faithful $0 handling, the emit inspection command, and a dockerized cross-shell compatibility suite. No breaking changes.

Fixes

• $0 rewrite for shebang-less scripts now applies (previously $0 stayed the fd path on bash>=5 / zsh when the script had no shebang). (#3, closes #1)
• $0 reset is line-faithful and lint-clean. The reset is joined onto the first body line with ; instead of swapping the shebang, so error line numbers stay exact and the served copy keeps its shell dialect (no added shellcheck findings). (#4)

New

• scriptbox emit [INTERP] <SCRIPT> prints the exact bytes scriptbox would hand the interpreter after the $0 rewrite - useful for inspection and as a shellcheck target. Honors --argv0 and frontmatter. (#4, #5)
• emit --subscripts (full-featured builds) recursively dumps the whole reachable tree - the script plus every resolvable source include and shell child - under # ==> <path> headers, with dynamic/immune sites noted rather than dropped. (#6)
• Dockerized cross-shell compatibility suite (compat/): transparency, insulation, $0, and "no added linter findings" checks across bash/zsh/dash/ksh, plus a read-only pass over real public installers. (#2)

Install

brew install jhheider/tap/scriptbox        # or: brew upgrade scriptbox
curl -fsSL https://heider.cc/scriptbox.sh | sh

scriptbox 0.3.0

Edges release — sharpening the subscript story and the cache lifecycle.

Changes

• One honest protection mode. The two overlapping subscript modes collapse into a single freeze (--subscripts, or subscripts = "freeze"). The old wrap / freeze-tree / tree names still parse to it, so existing invocations keep working.
• Removed the launch-time cache auto-reap. It could delete a live tree's snapshot cache out from under a legitimately-detached background descendant (worker & disown; exit) when an unrelated --subscripts=freeze run landed on the same $TMPDIR. There's no safe way to infer "this tree is done" from exec's process model, so cleanup stays explicit: scriptbox gc (caches are small; $TMPDIR is OS-reaped on reboot).

Notes

• Prebuilt binaries are full-featured — the subscript analyzer is compiled in. Building from source stays lean by default (--features subscripts to opt in).
• Subscripts remain experimental and opt-in; only literal child paths freeze, dynamic ("$DIR/lib.sh", $(...)) sites are reported but left as live reads.

Install: brew install jhheider/tap/scriptbox · curl -fsSL https://heider.cc/scriptbox.sh | sh

v0.2.0

Second release. The core is unchanged; everything new is opt-in.

Switches - settable as a flag OR in the # /// scriptbox frontmatter (flag wins):

• --argv0 <rewrite|source|off> - how $0 is set. New source mode dot-sources
  the script so $0 is the real path on every POSIX shell (dash/ksh included),
  at the cost of sourced-mode semantics.
• --subscripts <report|wrap|freeze-tree> - analyze/rewrite a script's child
  invocations so the whole tree is frozen, not just the top file:
  • wrap routes shell children (bash child.sh, ./x.sh) through scriptbox and
    freezes resolvable source ./lib.sh includes into an inherited immutable fd
    (a real fix - zsh's source streams).
  • freeze-tree adds a launch-scoped, read-only, pin-on-copy snapshot cache so
    every invocation of a script in the tree sees the same bytes even against
    mid-run edits, plus a depth cap against runaway recursion.
    The analyzer is included in these prebuilt binaries. scriptbox gc reaps the
    freeze-tree caches.

Checksum pinning now excludes the whole frontmatter block, so switches are
frontmatter-flippable without re-pinning.

POSIX only (macOS + Linux). See the README.

Install

brew install jhheider/tap/scriptbox
curl -fsSL https://heider.cc/scriptbox.sh | sh

v0.1.0

First release.

scriptbox reads a shell script fully into an immutable copy at invoke, then
hands that to the real interpreter -- so editing a running script (by you, a
background process, or malware) can't change what executes past the current
line. Optional sha256 checksum pinning verifies integrity in-band.

POSIX only (macOS + Linux). See the README.

Install

brew install jhheider/tap/scriptbox
curl -fsSL https://heider.cc/scriptbox.sh | sh

Prebuilt binaries: scriptbox-{linux,macos}-{aarch64,x86_64}.tar.gz below.