safe-bash: register sha512sum/sha384sum/sha224sum (checksum engine already supports these algorithms)

[kamilio]

Missing: sha512sum, sha384sum, sha224sum. Only sha256sum, sha1sum, md5sum, cksum are registered.

Cheap win: the checksum engine already implements sha512/sha384/sha224 (src/commands/bytes/checksums/index.ts:13 Algorithm union; digit widths at :175). Only the command registration at :274 omits them. Add command("sha512sum","sha512",…) etc. sha512sum is very common.

Behavior: match GNU coreutils sha512sum (default and -c/--check, --tag, -z, escaped-filename \ prefix) — identical to the existing sha256sum implementation.

From the safe-bash command gap analysis (2026-09-08). Sandbox constraints apply: bounded input/CPU/memory, VFS-only paths, cooperative cancellation, no host process/network beyond the existing curl authorizer.

[kamilio]

Validated against the current portable implementation and an actual packed/offline-installed local candidate (not a new published release): all three command names are absent and return exit 127. The existing portable engine does implement all three digests; six streamed ASCII/binary checks through cksum -a match the independently installed GNU coreutils 8.30 commands.

One scope correction: the requested GNU --tag behavior is not already supported by the existing sha256sum wrapper. It currently rejects --tag, and its check mode rejects tagged records generated by cksum. Resolving the full request therefore needs the three registrations plus shared tag parsing/rendering/verification and regression coverage—not just three registration lines. No new hash dependency or native fallback is needed. This is validated and queued after the prioritized #669/#672 delivery; it is not marked fixed.

[kamilio]

Delivered and verified on remote main at d623ff5. Adds sha512sum/sha384sum/sha224sum and shared GNU-style --tag generation plus tagged/traditional --check parsing; this is not just three registrations. Keeps bounded streaming Noble hashes, cancellation, VFS-only access and existing diagnostic conventions. Validation: TDD red reproduced missing commands/tag handling; 246 focused integration cases and 11 bundle/packaging cases pass; 54 independent GNU differential observations match; maintained lint/types/workflow lint and normal build pass. Fresh installed Node/Bun/browser smoke exercises fixed vectors, tags, checks and NUL records; browser declarations pass without ambient Node types. Detailed bounds and GNU-version diagnostic caveats are in docs/plans/issue-673-sha2-commands.md. Closing immediately after verified push; publication is being monitored separately.

[kamilio]

Publication verified: @poe-platform/safe-bash, @poe-platform/safe-fs, and @poe-platform/safe-js are all live on npm as latest version 0.1.500. Scoped release run 34280542193 succeeded for d623ff5, including installed-tarball checks and provenance publishing. The separate CLI release run 34280542482 is still running its validation gates; it has not been canceled or restarted.

[kamilio]

Follow-up release-test correction delivered and verified on remote main at 4c4a37f. The prior CLI run exposed additional stale aggregate/playground inventory expectations (79 instead of 82); current independent inventories and byte-family collision checks now include the three new SHA-2 commands, while frozen evidence remains unchanged. All 777 affected SafeBash regressions, 166 playground tests, and full maintained lint/types/workflow checks pass. Full local workspace testing continues, and the push starts fresh GitHub release validation; no active release was canceled. Scoped 0.1.500 remains published.

[kamilio]

Release verified: poe-code@14.0.94 is live on npm as latest, with gitHead 4c4a37f matching remote main. GitHub release v14.0.94 was published September 8, 2026 at 22:09:21 UTC. Run 34282420136 succeeded with all build, audit, smoke, cached/fresh unit, four Bash shards, and stable-publishing gates passing. SafeBash, SafeFS and SafeJS latest are all 0.1.501, from successful scoped run 34282419931. Full maintained local npm test also completed with exit 0 (/tmp/kamilio-673-release-repair-full-test.exit); final lint/types/workflow checks passed. No active release was canceled.