This is the initial checkin of Larry Doolittle's hush.c, using his

April 25, 2001 snapshot, adjusted a bit by me so it has cmdedit support.

This checkin also removes sh.c.  In the future sh.c will be a symlink to
your shell of choice.  For now, this symlink will default to pointing to
lash.c (as in the past).  If you change the symlink to point to hush.c,
then thats what you will get.  This symlink business is a temporary situation,
which will be cleaned up Real Soon Now(tm).

 -Erik

4 files changed, 4383 insertions, 1935 deletions

diff --git a/Makefile b/Makefile
index dcf6bd641..5a62cb0ef 100644
--- a/Makefile
+++ b/Makefile
@@ -271,6 +271,7 @@ CFLAGS += $(CFLAGS_EXTRA)
 all: applet_source_list busybox busybox.links doc
 
 applet_source_list: busybox.sh Config.h
+	if [ ! -L sh.c ] ; then ln -s lash.c sh.c ; fi
 	(echo -n "APPLET_SOURCES := "; $(SHELL) $^ $(BB_SRC_DIR)) > $@
 
 doc: olddoc
diff --git a/hush.c b/hush.c
new file mode 100644
index 000000000..f2a4ea410
--- /dev/null
+++ b/hush.c
@@ -0,0 +1,2191 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * sh.c -- a prototype Bourne shell grammar parser
+ *      Intended to follow the original Thompson and Ritchie
+ *      "small and simple is beautiful" philosophy, which
+ *      incidentally is a good match to today's BusyBox.
+ *
+ * Copyright (C) 2000,2001  Larry Doolittle  <larry@doolittle.boa.org>
+ *
+ * Credits:
+ *      The parser routines proper are all original material, first
+ *      written Dec 2000 and Jan 2001 by Larry Doolittle.
+ *      The execution engine, the builtins, and much of the underlying
+ *      support has been adapted from busybox-0.49pre's lash,
+ *      which is Copyright (C) 2000 by Lineo, Inc., and
+ *      written by Erik Andersen <andersen@lineo.com>, <andersee@debian.org>.
+ *      That, in turn, is based in part on ladsh.c, by Michael K. Johnson and
+ *      Erik W. Troan, which they placed in the public domain.  I don't know
+ *      how much of the Johnson/Troan code has survived the repeated rewrites.
+ * Other credits:
+ *      simple_itoa() was lifted from boa-0.93.15
+ *      b_addchr() derived from similar w_addchar function in glibc-2.2
+ *      setup_redirect(), redirect_opt_num(), and big chunks of main()
+ *        and many builtins derived from contributions by Erik Andersen
+ *      miscellaneous bugfixes from Matt Kraai
+ *
+ * There are two big (and related) architecture differences between
+ * this parser and the lash parser.  One is that this version is
+ * actually designed from the ground up to understand nearly all
+ * of the Bourne grammar.  The second, consequential change is that
+ * the parser and input reader have been turned inside out.  Now,
+ * the parser is in control, and asks for input as needed.  The old
+ * way had the input reader in control, and it asked for parsing to
+ * take place as needed.  The new way makes it much easier to properly
+ * handle the recursion implicit in the various substitutions, especially
+ * across continuation lines.
+ *
+ * Bash grammar not implemented: (how many of these were in original sh?)
+ *      $@ (those sure look like weird quoting rules)
+ *      $_
+ *      ! negation operator for pipes
+ *      &> and >& redirection of stdout+stderr
+ *      Brace Expansion
+ *      Tilde Expansion
+ *      fancy forms of Parameter Expansion
+ *      Arithmetic Expansion
+ *      <(list) and >(list) Process Substitution
+ *      reserved words: if, then, elif, else, fi, while, until, for,
+ *                      do, done, case
+ *      Here Documents ( << word )
+ *      Functions
+ * Major bugs:
+ *      job handling woefully incomplete and buggy
+ *      reserved word execution woefully incomplete and buggy
+ *      incomplete reserved word sequence doesn't request more lines of input
+ * to-do:
+ *      port selected bugfixes from post-0.49 busybox lash
+ *      finish implementing reserved words
+ *      handle children going into background
+ *      clean up recognition of null pipes
+ *      have builtin_exec set flag to avoid restore_redirects
+ *      figure out if "echo foo}" is fixable
+ *      check setting of global_argc and global_argv
+ *      control-C handling, probably with longjmp
+ *      VAR=value prefix for simple commands
+ *      follow IFS rules more precisely, including update semantics
+ *      write builtin_eval, builtin_ulimit, builtin_umask
+ *      figure out what to do with backslash-newline
+ *      explain why we use signal instead of sigaction
+ *      propagate syntax errors, die on resource errors?
+ *      continuation lines, both explicit and implicit - done?
+ *      memory leak finding and plugging - done?
+ *      more testing, especially quoting rules and redirection
+ *      maybe change map[] to use 2-bit entries
+ *      (eventually) remove all the printf's
+ *      more integration with BusyBox: prompts, cmdedit, applets
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#include <ctype.h>     /* isalpha, isdigit */
+#include <unistd.h>    /* getpid */
+#include <stdlib.h>    /* getenv, atoi */
+#include <string.h>    /* strchr */
+#include <stdio.h>     /* popen etc. */
+#include <glob.h>      /* glob, of course */
+#include <stdarg.h>    /* va_list */
+#include <errno.h>
+#include <fcntl.h>
+#include <getopt.h>    /* should be pretty obvious */
+
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <signal.h>
+
+/* #include <dmalloc.h> */
+/* #define DEBUG_SHELL */
+
+#ifdef BB_VER
+#include "busybox.h"
+#include "cmdedit.h"
+#else
+/* in place of #include "busybox.h"; much of this is indeed
+ * pasted in from the copy of busybox.h in busybox-0.49pre */
+
+#define xrealloc realloc
+#define applet_name "hush"
+#define shell_main main
+
+extern void *xmalloc(size_t size)
+{
+	void *ptr = malloc(size);
+
+	if (!ptr) {
+		fprintf(stderr, "memory_exhausted\n");
+		exit (EXIT_FAILURE);
+	}
+	return ptr;
+}
+
+extern void usage(const char *usage)
+{
+	fprintf(stderr, "Usage: %s\n", usage);
+	exit(EXIT_FAILURE);
+}
+
+static void verror_msg(const char *s, va_list p)
+{
+	fflush(stdout);
+	fprintf(stderr, "%s: ", applet_name);
+	vfprintf(stderr, s, p);
+	fflush(stderr);
+}
+
+extern void error_msg(const char *s, ...)
+{
+	va_list p;
+
+	va_start(p, s);
+	verror_msg(s, p);
+	va_end(p);
+}
+
+extern void error_msg_and_die(const char *s, ...)
+{
+	va_list p;
+
+	va_start(p, s);
+	verror_msg(s, p);
+	va_end(p);
+	exit(EXIT_FAILURE);
+}
+
+static void vperror_msg(const char *s, va_list p)
+{
+	fflush(stdout);
+	fprintf(stderr, "%s: ", applet_name);
+	if (s && *s) {
+		vfprintf(stderr, s, p);
+		fputs(": ", stderr);
+	}
+	fprintf(stderr, "%s\n", strerror(errno));
+	fflush(stderr);
+}
+
+extern void perror_msg(const char *s, ...)
+{
+	va_list p;
+
+	va_start(p, s);
+	vperror_msg(s, p);
+	va_end(p);
+}
+
+extern void perror_msg_and_die(const char *s, ...)
+{
+	va_list p;
+
+	va_start(p, s);
+	vperror_msg(s, p);
+	va_end(p);
+	exit(EXIT_FAILURE);
+}
+
+FILE *xfopen(const char *path, const char *mode)
+{
+	FILE *fp;
+	if ((fp = fopen(path, mode)) == NULL)
+		perror_msg_and_die(path);
+	return fp;
+}
+#endif  /* of busybox.h replacement */
+
+typedef enum {
+	REDIRECT_INPUT     = 1,
+	REDIRECT_OVERWRITE = 2,
+	REDIRECT_APPEND    = 3,
+	REDIRECT_HEREIS    = 4,
+	REDIRECT_IO        = 5
+} redir_type;
+
+/* The descrip member of this structure is only used to make debugging
+ * output pretty */
+struct {int mode; int default_fd; char *descrip;} redir_table[] = {
+	{ 0,                         0, "()" },
+	{ O_RDONLY,                  0, "<"  },
+	{ O_CREAT|O_TRUNC|O_WRONLY,  1, ">"  },
+	{ O_CREAT|O_APPEND|O_WRONLY, 1, ">>" },
+	{ O_RDONLY,                 -1, "<<" },
+	{ O_RDWR,                    1, "<>" }
+};
+
+typedef enum {
+	PIPE_SEQ = 1,
+	PIPE_AND = 2,
+	PIPE_OR  = 3,
+	PIPE_BG  = 4,
+} pipe_style;
+
+/* might eventually control execution */
+typedef enum {
+	RES_NONE  = 0,
+	RES_IF    = 1,
+	RES_THEN  = 2,
+	RES_ELIF  = 3,
+	RES_ELSE  = 4,
+	RES_FI    = 5,
+	RES_FOR   = 6,
+	RES_WHILE = 7,
+	RES_UNTIL = 8,
+	RES_DO    = 9,
+	RES_DONE  = 10,
+	RES_XXXX  = 11
+} reserved_style;
+#define FLAG_END   (1<<RES_NONE)
+#define FLAG_IF    (1<<RES_IF)
+#define FLAG_THEN  (1<<RES_THEN)
+#define FLAG_ELIF  (1<<RES_ELIF)
+#define FLAG_ELSE  (1<<RES_ELSE)
+#define FLAG_FI    (1<<RES_FI)
+#define FLAG_FOR   (1<<RES_FOR)
+#define FLAG_WHILE (1<<RES_WHILE)
+#define FLAG_UNTIL (1<<RES_UNTIL)
+#define FLAG_DO    (1<<RES_DO)
+#define FLAG_DONE  (1<<RES_DONE)
+#define FLAG_START (1<<RES_XXXX)
+
+/* This holds pointers to the various results of parsing */
+struct p_context {
+	struct child_prog *child;
+	struct pipe *list_head;
+	struct pipe *pipe;
+	struct redir_struct *pending_redirect;
+	reserved_style w;
+	int old_flag;				/* for figuring out valid reserved words */
+	struct p_context *stack;
+	/* How about quoting status? */
+};
+
+struct redir_struct {
+	redir_type type;			/* type of redirection */
+	int fd;						/* file descriptor being redirected */
+	int dup;					/* -1, or file descriptor being duplicated */
+	struct redir_struct *next;	/* pointer to the next redirect in the list */ 
+	glob_t word;				/* *word.gl_pathv is the filename */
+};
+
+struct child_prog {
+	pid_t pid;					/* 0 if exited */
+	char **argv;				/* program name and arguments */
+	struct pipe *group;			/* if non-NULL, first in group or subshell */
+	int subshell;				/* flag, non-zero if group must be forked */
+	struct redir_struct *redirects;	/* I/O redirections */
+	glob_t glob_result;			/* result of parameter globbing */
+	int is_stopped;				/* is the program currently running? */
+	struct pipe *family;		/* pointer back to the child's parent pipe */
+};
+
+struct pipe {
+	int jobid;					/* job number */
+	int num_progs;				/* total number of programs in job */
+	int running_progs;			/* number of programs running */
+	char *text;					/* name of job */
+	char *cmdbuf;				/* buffer various argv's point into */
+	pid_t pgrp;					/* process group ID for the job */
+	struct child_prog *progs;	/* array of commands in pipe */
+	struct pipe *next;			/* to track background commands */
+	int stopped_progs;			/* number of programs alive, but stopped */
+	int job_context;			/* bitmask defining current context */
+	pipe_style followup;		/* PIPE_BG, PIPE_SEQ, PIPE_OR, PIPE_AND */
+	reserved_style r_mode;		/* supports if, for, while, until */
+	struct jobset *job_list;
+};
+
+struct jobset {
+	struct pipe *head;			/* head of list of running jobs */
+	struct pipe *fg;			/* current foreground job */
+};
+
+struct close_me {
+	int fd;
+	struct close_me *next;
+};
+
+/* globals, connect us to the outside world
+ * the first three support $?, $#, and $1 */
+char **global_argv;
+unsigned int global_argc;
+unsigned int last_return_code;
+extern char **environ; /* This is in <unistd.h>, but protected with __USE_GNU */
+ 
+/* Variables we export */
+unsigned int shell_context;  /* Used in cmdedit.c to reset the
+                              * context when someone hits ^C */
+
+/* "globals" within this file */
+static char *ifs=NULL;
+static char map[256];
+static int fake_mode=0;
+static int interactive=0;
+static struct close_me *close_me_head = NULL;
+static char *cwd;
+static struct jobset job_list = { NULL, NULL };
+static unsigned int last_bg_pid=0;
+static char *PS1;
+static char *PS2 = "> ";
+
+#define B_CHUNK (100)
+#define B_NOSPAC 1
+#define MAX_LINE 256       /* for cwd */
+#define MAX_READ 256       /* for builtin_read */
+
+typedef struct {
+	char *data;
+	int length;
+	int maxlen;
+	int quote;
+	int nonnull;
+} o_string;
+#define NULL_O_STRING {NULL,0,0,0,0}
+/* used for initialization:
+	o_string foo = NULL_O_STRING; */
+
+/* I can almost use ordinary FILE *.  Is open_memstream() universally
+ * available?  Where is it documented? */
+struct in_str {
+	const char *p;
+	int __promptme;
+	int promptmode;
+	FILE *file;
+	int (*get) (struct in_str *);
+	int (*peek) (struct in_str *);
+};
+#define b_getch(input) ((input)->get(input))
+#define b_peek(input) ((input)->peek(input))
+
+#define JOB_STATUS_FORMAT "[%d] %-22s %.40s\n"
+
+struct built_in_command {
+	char *cmd;					/* name */
+	char *descr;				/* description */
+	int (*function) (struct child_prog *);	/* function ptr */
+};
+
+/* belongs in busybox.h */
+static inline int max(int a, int b) {
+	return (a>b)?a:b;
+}
+
+/* This should be in utility.c */
+#ifdef DEBUG_SHELL
+static void debug_printf(const char *format, ...)
+{
+	va_list args;
+	va_start(args, format);
+	vfprintf(stderr, format, args);
+	va_end(args);
+}
+#else
+static void debug_printf(const char *format, ...) { }
+#endif
+#define final_printf debug_printf
+
+void __syntax(char *file, int line) {
+	fprintf(stderr,"syntax error %s:%d\n",file,line);
+}
+#define syntax() __syntax(__FILE__, __LINE__)
+
+/* Index of subroutines: */
+/*   function prototypes for builtins */
+static int builtin_cd(struct child_prog *child);
+static int builtin_env(struct child_prog *child);
+static int builtin_exec(struct child_prog *child);
+static int builtin_exit(struct child_prog *child);
+static int builtin_export(struct child_prog *child);
+static int builtin_fg_bg(struct child_prog *child);
+static int builtin_help(struct child_prog *child);
+static int builtin_jobs(struct child_prog *child);
+static int builtin_pwd(struct child_prog *child);
+static int builtin_read(struct child_prog *child);
+static int builtin_shift(struct child_prog *child);
+static int builtin_source(struct child_prog *child);
+static int builtin_ulimit(struct child_prog *child);
+static int builtin_umask(struct child_prog *child);
+static int builtin_unset(struct child_prog *child);
+/*   o_string manipulation: */
+static int b_check_space(o_string *o, int len);
+static int b_addchr(o_string *o, int ch);
+static void b_reset(o_string *o);
+static int b_addqchr(o_string *o, int ch, int quote);
+static int b_adduint(o_string *o, unsigned int i);
+/*  in_str manipulations: */
+static int static_get(struct in_str *i);
+static int static_peek(struct in_str *i);
+static int file_get(struct in_str *i);
+static int file_peek(struct in_str *i);
+static void setup_file_in_str(struct in_str *i, FILE *f);
+static void setup_string_in_str(struct in_str *i, const char *s);
+/*  close_me manipulations: */
+static void mark_open(int fd);
+static void mark_closed(int fd);
+static void close_all();
+/*  "run" the final data structures: */
+static char *indenter(int i);
+static int run_list_test(struct pipe *head, int indent);
+static int run_pipe_test(struct pipe *pi, int indent);
+/*  really run the final data structures: */
+static int setup_redirects(struct child_prog *prog, int squirrel[]);
+static int pipe_wait(struct pipe *pi);
+static int run_list_real(struct pipe *pi);
+static void pseudo_exec(struct child_prog *child) __attribute__ ((noreturn));
+static int run_pipe_real(struct pipe *pi);
+/*   extended glob support: */
+static int globhack(const char *src, int flags, glob_t *pglob);
+static int glob_needed(const char *s);
+static int xglob(o_string *dest, int flags, glob_t *pglob);
+/*   data structure manipulation: */
+static int setup_redirect(struct p_context *ctx, int fd, redir_type style, struct in_str *input);
+static void initialize_context(struct p_context *ctx);
+static int done_word(o_string *dest, struct p_context *ctx);
+static int done_command(struct p_context *ctx);
+static int done_pipe(struct p_context *ctx, pipe_style type);
+/*   primary string parsing: */
+static int redirect_dup_num(struct in_str *input);
+static int redirect_opt_num(o_string *o);
+static int process_command_subs(o_string *dest, struct p_context *ctx, struct in_str *input, int subst_end);
+static int parse_group(o_string *dest, struct p_context *ctx, struct in_str *input, int ch);
+static void lookup_param(o_string *dest, struct p_context *ctx, o_string *src);
+static int handle_dollar(o_string *dest, struct p_context *ctx, struct in_str *input);
+static int parse_string(o_string *dest, struct p_context *ctx, const char *src);
+static int parse_stream(o_string *dest, struct p_context *ctx, struct in_str *input0, int end_trigger);
+/*   setup: */
+static int parse_stream_outer(struct in_str *inp);
+static int parse_string_outer(const char *s);
+static int parse_file_outer(FILE *f);
+
+/* Table of built-in functions.  They can be forked or not, depending on
+ * context: within pipes, they fork.  As simple commands, they do not.
+ * When used in non-forking context, they can change global variables
+ * in the parent shell process.  If forked, of course they can not.
+ * For example, 'unset foo | whatever' will parse and run, but foo will
+ * still be set at the end. */
+static struct built_in_command bltins[] = {
+	{"bg", "Resume a job in the background", builtin_fg_bg},
+	{"cd", "Change working directory", builtin_cd},
+	{"env", "Print all environment variables", builtin_env},
+	{"exec", "Exec command, replacing this shell with the exec'd process", builtin_exec},
+	{"exit", "Exit from shell()", builtin_exit},
+	{"export", "Set environment variable", builtin_export},
+	{"fg", "Bring job into the foreground", builtin_fg_bg},
+	{"jobs", "Lists the active jobs", builtin_jobs},
+	{"pwd", "Print current directory", builtin_pwd},
+	{"read", "Input environment variable", builtin_read},
+	{"shift", "Shift positional parameters", builtin_shift},
+	{"ulimit","Controls resource limits", builtin_ulimit},
+	{"umask","Sets file creation mask", builtin_umask},
+	{"unset", "Unset environment variable", builtin_unset},
+	{".", "Source-in and run commands in a file", builtin_source},
+	{"help", "List shell built-in commands", builtin_help},
+	{NULL, NULL, NULL}
+};
+
+/* built-in 'cd <path>' handler */
+static int builtin_cd(struct child_prog *child)
+{
+	char *newdir;
+	if (child->argv[1] == NULL)
+		newdir = getenv("HOME");
+	else
+		newdir = child->argv[1];
+	if (chdir(newdir)) {
+		printf("cd: %s: %s\n", newdir, strerror(errno));
+		return EXIT_FAILURE;
+	}
+	getcwd(cwd, sizeof(char)*MAX_LINE);
+	return EXIT_SUCCESS;
+}
+
+/* built-in 'env' handler */
+static int builtin_env(struct child_prog *dummy)
+{
+	char **e = environ;
+	if (e == NULL) return EXIT_FAILURE;
+	for (; *e; e++) {
+		puts(*e);
+	}
+	return EXIT_SUCCESS;
+}
+
+/* built-in 'exec' handler */
+static int builtin_exec(struct child_prog *child)
+{
+	if (child->argv[1] == NULL)
+		return EXIT_SUCCESS;   /* Really? */
+	child->argv++;
+	pseudo_exec(child);
+	/* never returns */
+}
+
+/* built-in 'exit' handler */
+static int builtin_exit(struct child_prog *child)
+{
+	if (child->argv[1] == NULL)
+		exit(EXIT_SUCCESS);
+	exit (atoi(child->argv[1]));
+}
+
+/* built-in 'export VAR=value' handler */
+static int builtin_export(struct child_prog *child)
+{
+	int res;
+
+	if (child->argv[1] == NULL) {
+		return (builtin_env(child));
+	}
+	res = putenv(child->argv[1]);
+	if (res)
+		fprintf(stderr, "export: %s\n", strerror(errno));
+	return (res);
+}
+
+/* built-in 'fg' and 'bg' handler */
+static int builtin_fg_bg(struct child_prog *child)
+{
+	int i, jobNum;
+	struct pipe *job=NULL;
+	
+	if (!child->argv[1] || child->argv[2]) {
+		error_msg("%s: exactly one argument is expected\n",
+				child->argv[0]);
+		return EXIT_FAILURE;
+	}
+
+	if (sscanf(child->argv[1], "%%%d", &jobNum) != 1) {
+		error_msg("%s: bad argument '%s'\n",
+				child->argv[0], child->argv[1]);
+		return EXIT_FAILURE;
+	}
+
+	for (job = child->family->job_list->head; job; job = job->next) {
+		if (job->jobid == jobNum) {
+			break;
+		}
+	}
+
+	if (!job) {
+		error_msg("%s: unknown job %d\n",
+				child->argv[0], jobNum);
+		return EXIT_FAILURE;
+	}
+
+	if (*child->argv[0] == 'f') {
+		/* Make this job the foreground job */
+		/* suppress messages when run from /linuxrc mag@sysgo.de */
+		if (tcsetpgrp(0, job->pgrp) && errno != ENOTTY)
+			perror_msg("tcsetpgrp"); 
+		child->family->job_list->fg = job;
+	}
+
+	/* Restart the processes in the job */
+	for (i = 0; i < job->num_progs; i++)
+		job->progs[i].is_stopped = 0;
+
+	kill(-job->pgrp, SIGCONT);
+
+	job->stopped_progs = 0;
+	return EXIT_SUCCESS;
+}
+
+/* built-in 'help' handler */
+static int builtin_help(struct child_prog *dummy)
+{
+	struct built_in_command *x;
+
+	printf("\nBuilt-in commands:\n");
+	printf("-------------------\n");
+	for (x = bltins; x->cmd; x++) {
+		if (x->descr==NULL)
+			continue;
+		printf("%s\t%s\n", x->cmd, x->descr);
+	}
+	printf("\n\n");
+	return EXIT_SUCCESS;
+}
+
+/* built-in 'jobs' handler */
+static int builtin_jobs(struct child_prog *child)
+{
+	struct pipe *job;
+	char *status_string;
+
+	for (job = child->family->job_list->head; job; job = job->next) {
+		if (job->running_progs == job->stopped_progs)
+			status_string = "Stopped";
+		else
+			status_string = "Running";
+		printf(JOB_STATUS_FORMAT, job->jobid, status_string, job->text);
+	}
+	return EXIT_SUCCESS;
+}
+
+
+/* built-in 'pwd' handler */
+static int builtin_pwd(struct child_prog *dummy)
+{
+	getcwd(cwd, MAX_LINE);
+	puts(cwd);
+	return EXIT_SUCCESS;
+}
+
+/* built-in 'read VAR' handler */
+static int builtin_read(struct child_prog *child)
+{
+	int res = 0, len, newlen;
+	char *s;
+	char string[MAX_READ];
+
+	if (child->argv[1]) {
+		/* argument (VAR) given: put "VAR=" into buffer */
+		strcpy(string, child->argv[1]);
+		len = strlen(string);
+		string[len++] = '=';
+		string[len]   = '\0';
+		/* XXX would it be better to go through in_str? */
+		fgets(&string[len], sizeof(string) - len, stdin);	/* read string */
+		newlen = strlen(string);
+		if(newlen > len)
+			string[--newlen] = '\0';	/* chomp trailing newline */
+		/*
+		** string should now contain "VAR=<value>"
+		** copy it (putenv() won't do that, so we must make sure
+		** the string resides in a static buffer!)
+		*/
+		res = -1;
+		if((s = strdup(string)))
+			res = putenv(s);
+		if (res)
+			fprintf(stderr, "read: %s\n", strerror(errno));
+	}
+	else
+		fgets(string, sizeof(string), stdin);
+
+	return (res);
+}
+
+/* Built-in 'shift' handler */
+static int builtin_shift(struct child_prog *child)
+{
+	int n=1;
+	if (child->argv[1]) {
+		n=atoi(child->argv[1]);
+	}
+	if (n>=0 && n<global_argc) {
+		/* XXX This probably breaks $0 */
+		global_argc -= n;
+		global_argv += n;
+		return EXIT_SUCCESS;
+	} else {
+		return EXIT_FAILURE;
+	}
+}
+
+/* Built-in '.' handler (read-in and execute commands from file) */
+static int builtin_source(struct child_prog *child)
+{
+	FILE *input;
+	int status;
+
+	if (child->argv[1] == NULL)
+		return EXIT_FAILURE;
+
+	/* XXX search through $PATH is missing */
+	input = fopen(child->argv[1], "r");
+	if (!input) {
+		fprintf(stderr, "Couldn't open file '%s'\n", child->argv[1]);
+		return EXIT_FAILURE;
+	}
+
+	/* Now run the file */
+	/* XXX argv and argc are broken; need to save old global_argv
+	 * (pointer only is OK!) on this stack frame,
+	 * set global_argv=child->argv+1, recurse, and restore. */
+	mark_open(fileno(input));
+	status = parse_file_outer(input);
+	mark_closed(fileno(input));
+	fclose(input);
+	return (status);
+}
+
+static int builtin_ulimit(struct child_prog *child)
+{
+	printf("builtin_ulimit not written\n");
+	return EXIT_FAILURE;
+}
+
+static int builtin_umask(struct child_prog *child)
+{
+	printf("builtin_umask not written\n");
+	return EXIT_FAILURE;
+}
+
+/* built-in 'unset VAR' handler */
+static int builtin_unset(struct child_prog *child)
+{
+	if (child->argv[1] == NULL) {
+		fprintf(stderr, "unset: parameter required.\n");
+		return EXIT_FAILURE;
+	}
+	unsetenv(child->argv[1]);
+	return EXIT_SUCCESS;
+}
+
+static int b_check_space(o_string *o, int len)
+{
+	/* It would be easy to drop a more restrictive policy
+	 * in here, such as setting a maximum string length */
+	if (o->length + len > o->maxlen) {
+		char *old_data = o->data;
+		/* assert (data == NULL || o->maxlen != 0); */
+		o->maxlen += max(2*len, B_CHUNK);
+		o->data = realloc(o->data, 1 + o->maxlen);
+		if (o->data == NULL) {
+			free(old_data);
+		}
+	}
+	return o->data == NULL;
+}
+
+static int b_addchr(o_string *o, int ch)
+{
+	debug_printf("b_addchr: %c %d %p\n", ch, o->length, o);
+	if (b_check_space(o, 1)) return B_NOSPAC;
+	o->data[o->length] = ch;
+	o->length++;
+	o->data[o->length] = '\0';
+	return 0;
+}
+
+static void b_reset(o_string *o)
+{
+	o->length = 0;
+	o->nonnull = 0;
+	if (o->data != NULL) *o->data = '\0';
+}
+
+static void b_free(o_string *o)
+{
+	b_reset(o);
+	if (o->data != NULL) free(o->data);
+	o->data = NULL;
+	o->maxlen = 0;
+}
+
+/* My analysis of quoting semantics tells me that state information
+ * is associated with a destination, not a source.
+ */
+static int b_addqchr(o_string *o, int ch, int quote)
+{
+	if (quote && strchr("*?[\\",ch)) {
+		int rc;
+		rc = b_addchr(o, '\\');
+		if (rc) return rc;
+	}
+	return b_addchr(o, ch);
+}
+
+/* belongs in utility.c */
+char *simple_itoa(unsigned int i)
+{
+	/* 21 digits plus null terminator, good for 64-bit or smaller ints */
+	static char local[22];
+	char *p = &local[21];
+	*p-- = '\0';
+	do {
+		*p-- = '0' + i % 10;
+		i /= 10;
+	} while (i > 0);
+	return p + 1;
+}
+
+static int b_adduint(o_string *o, unsigned int i)
+{
+	int r;
+	char *p = simple_itoa(i);
+	/* no escape checking necessary */
+	do r=b_addchr(o, *p++); while (r==0 && *p);
+	return r;
+}
+
+static int static_get(struct in_str *i)
+{
+	int ch=*i->p++;
+	if (ch=='\0') return EOF;
+	return ch;
+}
+
+static int static_peek(struct in_str *i)
+{
+	return *i->p;
+}
+
+static inline void cmdedit_set_initial_prompt(void)
+{
+#ifdef BB_FEATURE_SH_SIMPLE_PROMPT
+	PS1 = NULL;
+#else
+	PS1 = getenv("PS1");
+	if(PS1==0)
+		PS1 = "\\w \\$ ";
+#endif	
+}
+
+static inline void setup_prompt_string(int promptmode, char **prompt_str)
+{
+#ifdef BB_FEATURE_SH_SIMPLE_PROMPT
+	/* Set up the prompt */
+	if (promptmode == 1) {
+		if (PS1)
+			free(PS1);
+		PS1=xmalloc(strlen(cwd)+4);
+		sprintf(PS1, "%s %s", cwd, ( geteuid() != 0 ) ?  "$ ":"# ");
+		*prompt_str = PS1;
+	} else {
+		*prompt_str = PS2;
+	}
+#else
+	*prompt_str = (promptmode==0)? PS1 : PS2;
+#endif	
+}
+
+static void get_user_input(struct in_str *i)
+{
+	char *prompt_str;
+	static char the_command[MAX_LINE];
+
+	setup_prompt_string(i->promptmode, &prompt_str);
+#ifdef BB_FEATURE_COMMAND_EDITING
+	/*
+	 ** enable command line editing only while a command line
+	 ** is actually being read; otherwise, we'll end up bequeathing
+	 ** atexit() handlers and other unwanted stuff to our
+	 ** child processes (rob@sysgo.de)
+	 */
+	cmdedit_read_input(prompt_str, the_command);
+	cmdedit_terminate();
+#else
+	fputs(prompt_str, stdout);
+	fflush(stdout);
+	the_command[0]=fgetc(i->file);
+	the_command[1]='\0';
+#endif
+	i->p = the_command;
+}
+
+/* This is the magic location that prints prompts 
+ * and gets data back from the user */
+static int file_get(struct in_str *i)
+{
+	int ch;
+
+	ch = 0;
+	/* If there is data waiting, eat it up */
+	if (i->p && *i->p) {
+		ch=*i->p++;
+	} else {
+		/* need to double check i->file because we might be doing something
+		 * more complicated by now, like sourcing or substituting. */
+		if (i->__promptme && interactive && i->file == stdin) {
+			get_user_input(i);
+			i->promptmode=2;
+		}
+		i->__promptme = 0;
+
+		if (i->p && *i->p) {
+			ch=*i->p++;
+		}
+		debug_printf("b_getch: got a %d\n", ch);
+	}
+	if (ch == '\n') i->__promptme=1;
+	return ch;
+}
+
+/* All the callers guarantee this routine will never be
+ * used right after a newline, so prompting is not needed.
+ */
+static int file_peek(struct in_str *i)
+{
+	if (i->p && *i->p) {
+		return *i->p;
+	} else {
+		static char buffer;
+		buffer = fgetc(i->file);
+		i->p = &buffer;
+		debug_printf("b_peek: got a %d\n", *i->p);
+		return *i->p; 
+	}
+}
+
+static void setup_file_in_str(struct in_str *i, FILE *f)
+{
+	i->peek = file_peek;
+	i->get = file_get;
+	i->__promptme=1;
+	i->promptmode=1;
+	i->file = f;
+	i->p = NULL;
+}
+
+static void setup_string_in_str(struct in_str *i, const char *s)
+{
+	i->peek = static_peek;
+	i->get = static_get;
+	i->__promptme=1;
+	i->promptmode=1;
+	i->p = s;
+}
+
+static void mark_open(int fd)
+{
+	struct close_me *new = xmalloc(sizeof(struct close_me));
+	new->fd = fd;
+	new->next = close_me_head;
+	close_me_head = new;
+}
+
+static void mark_closed(int fd)
+{
+	struct close_me *tmp;
+	if (close_me_head == NULL || close_me_head->fd != fd)
+		error_msg_and_die("corrupt close_me");
+	tmp = close_me_head;
+	close_me_head = close_me_head->next;
+	free(tmp);
+}
+
+static void close_all()
+{
+	struct close_me *c;
+	for (c=close_me_head; c; c=c->next) {
+		close(c->fd);
+	}
+	close_me_head = NULL;
+}
+
+/* squirrel != NULL means we squirrel away copies of stdin, stdout,
+ * and stderr if they are redirected. */
+static int setup_redirects(struct child_prog *prog, int squirrel[])
+{
+	int openfd, mode;
+	struct redir_struct *redir;
+
+	for (redir=prog->redirects; redir; redir=redir->next) {
+		if (redir->dup == -1) {
+			mode=redir_table[redir->type].mode;
+			openfd = open(redir->word.gl_pathv[0], mode, 0666);
+			if (openfd < 0) {
+			/* this could get lost if stderr has been redirected, but
+			   bash and ash both lose it as well (though zsh doesn't!) */
+				fprintf(stderr,"error opening %s: %s\n", redir->word.gl_pathv[0],
+					strerror(errno));
+				return 1;
+			}
+		} else {
+			openfd = redir->dup;
+		}
+
+		if (openfd != redir->fd) {
+			if (squirrel && redir->fd < 3) {
+				squirrel[redir->fd] = dup(redir->fd);
+			}
+			dup2(openfd, redir->fd);
+			close(openfd);
+		}
+	}
+	return 0;
+}
+
+static void restore_redirects(int squirrel[])
+{
+	int i, fd;
+	for (i=0; i<3; i++) {
+		fd = squirrel[i];
+		if (fd != -1) {
+			/* No error checking.  I sure wouldn't know what
+			 * to do with an error if I found one! */
+			dup2(fd, i);
+			close(fd);
+		}
+	}
+}
+
+/* XXX this definitely needs some more thought, work, and
+ * cribbing from other shells */
+static int pipe_wait(struct pipe *pi)
+{
+	int rcode=0, i, pid, running, status;
+	running = pi->num_progs;
+	while (running) {
+		pid=waitpid(-1, &status, 0);
+		if (pid < 0) perror_msg_and_die("waitpid");
+		for (i=0; i < pi->num_progs; i++) {
+			if (pi->progs[i].pid == pid) {
+				if (i==pi->num_progs-1) rcode=WEXITSTATUS(status);
+				pi->progs[i].pid = 0;
+				running--;
+				break;
+			}
+		}
+	}
+	return rcode;
+}
+
+/* very simple version for testing */
+static void pseudo_exec(struct child_prog *child)
+{
+	int rcode;
+	struct built_in_command *x;
+	if (child->argv) {
+		/*
+		 * Check if the command matches any of the builtins.
+		 * Depending on context, this might be redundant.  But it's
+		 * easier to waste a few CPU cycles than it is to figure out
+		 * if this is one of those cases.
+		 */
+		for (x = bltins; x->cmd; x++) {
+			if (strcmp(child->argv[0], x->cmd) == 0 ) {
+				debug_printf("builtin exec %s\n", child->argv[0]);
+				exit(x->function(child));
+			}
+		}
+		debug_printf("exec of %s\n",child->argv[0]);
+		execvp(child->argv[0],child->argv);
+		perror("execvp");
+		exit(1);
+	} else if (child->group) {
+		debug_printf("runtime nesting to group\n");
+		interactive=0;    /* crucial!!!! */
+		rcode = run_list_real(child->group);
+		/* OK to leak memory by not calling run_list_test,
+		 * since this process is about to exit */
+		exit(rcode);
+	} else {
+		/* Can happen.  See what bash does with ">foo" by itself. */
+		debug_printf("trying to pseudo_exec null command\n");
+		exit(EXIT_SUCCESS);
+	}
+}
+
+/* run_pipe_real() starts all the jobs, but doesn't wait for anything
+ * to finish.  See pipe_wait().
+ *
+ * return code is normally -1, when the caller has to wait for children
+ * to finish to determine the exit status of the pipe.  If the pipe
+ * is a simple builtin command, however, the action is done by the
+ * time run_pipe_real returns, and the exit code is provided as the
+ * return value.
+ *
+ * The input of the pipe is always stdin, the output is always
+ * stdout.  The outpipe[] mechanism in BusyBox-0.48 lash is bogus,
+ * because it tries to avoid running the command substitution in
+ * subshell, when that is in fact necessary.  The subshell process
+ * now has its stdout directed to the input of the appropriate pipe,
+ * so this routine is noticeably simpler.
+ */
+static int run_pipe_real(struct pipe *pi)
+{
+	int i;
+	int nextin, nextout;
+	int pipefds[2];				/* pipefds[0] is for reading */
+	struct child_prog *child;
+	struct built_in_command *x;
+
+	nextin = 0;
+	pi->pgrp = 0;
+
+	/* Check if this is a simple builtin (not part of a pipe).
+	 * Builtins within pipes have to fork anyway, and are handled in
+	 * pseudo_exec.  "echo foo | read bar" doesn't work on bash, either.
+	 */
+	if (pi->num_progs == 1 && pi->progs[0].argv != NULL) {
+		child = & (pi->progs[0]);
+		if (child->group && ! child->subshell) {
+			int squirrel[] = {-1, -1, -1};
+			int rcode;
+			debug_printf("non-subshell grouping\n");
+			setup_redirects(child, squirrel);
+			/* XXX could we merge code with following builtin case,
+			 * by creating a pseudo builtin that calls run_list_real? */
+			rcode = run_list_real(child->group);
+			restore_redirects(squirrel);
+			return rcode;
+		}
+		for (x = bltins; x->cmd; x++) {
+			if (strcmp(child->argv[0], x->cmd) == 0 ) {
+				int squirrel[] = {-1, -1, -1};
+				int rcode;
+				debug_printf("builtin inline %s\n", child->argv[0]);
+				/* XXX setup_redirects acts on file descriptors, not FILEs.
+				 * This is perfect for work that comes after exec().
+				 * Is it really safe for inline use?  Experimentally,
+				 * things seem to work with glibc. */
+				setup_redirects(child, squirrel);
+				rcode = x->function(child);
+				restore_redirects(squirrel);
+				return rcode;
+			}
+		}
+	}
+
+	for (i = 0; i < pi->num_progs; i++) {
+		child = & (pi->progs[i]);
+
+		/* pipes are inserted between pairs of commands */
+		if ((i + 1) < pi->num_progs) {
+			if (pipe(pipefds)<0) perror_msg_and_die("pipe");
+			nextout = pipefds[1];
+		} else {
+			nextout=1;
+			pipefds[0] = -1;
+		}
+
+		/* XXX test for failed fork()? */
+		if (!(child->pid = fork())) {
+			close_all();
+
+			if (nextin != 0) {
+				dup2(nextin, 0);
+				close(nextin);
+			}
+			if (nextout != 1) {
+				dup2(nextout, 1);
+				close(nextout);
+			}
+			if (pipefds[0]!=-1) {
+				close(pipefds[0]);  /* opposite end of our output pipe */
+			}
+
+			/* Like bash, explicit redirects override pipes,
+			 * and the pipe fd is available for dup'ing. */
+			setup_redirects(child,NULL);
+
+			pseudo_exec(child);
+		}
+		if (interactive) {
+			/* Put our child in the process group whose leader is the
+			 * first process in this pipe. */
+			if (pi->pgrp==0) {
+				pi->pgrp = child->pid;
+			}
+			/* Don't check for errors.  The child may be dead already,
+			 * in which case setpgid returns error code EACCES. */
+			setpgid(child->pid, pi->pgrp);
+		}
+		/* In the non-interactive case, do nothing.  Leave the children
+		 * with the process group that they inherited from us. */
+	
+		if (nextin != 0)
+			close(nextin);
+		if (nextout != 1)
+			close(nextout);
+
+		/* If there isn't another process, nextin is garbage 
+		   but it doesn't matter */
+		nextin = pipefds[0];
+	}
+	return -1;
+}
+
+static int run_list_real(struct pipe *pi)
+{
+	int rcode=0;
+	int if_code=0, next_if_code=0;  /* need double-buffer to handle elif */
+	reserved_style rmode=RES_NONE;
+	for (;pi;pi=pi->next) {
+		rmode = pi->r_mode;
+		debug_printf("rmode=%d  if_code=%d  next_if_code=%d\n", rmode, if_code, next_if_code);
+		if (rmode == RES_THEN || rmode == RES_ELSE) if_code = next_if_code;
+		if (rmode == RES_THEN &&  if_code) continue;
+		if (rmode == RES_ELSE && !if_code) continue;
+		if (rmode == RES_ELIF && !if_code) continue;
+		if (pi->num_progs == 0) break;
+		rcode = run_pipe_real(pi);
+		if (rcode!=-1) {
+			/* We only ran a builtin: rcode was set by the return value
+			 * of run_pipe_real(), and we don't need to wait for anything. */
+		} else if (pi->followup==PIPE_BG) {
+			/* XXX check bash's behavior with nontrivial pipes */
+			/* XXX compute jobid */
+			/* XXX what does bash do with attempts to background builtins? */
+			printf("[%d] %d\n", pi->jobid, pi->pgrp);
+			last_bg_pid = pi->pgrp;
+			rcode = EXIT_SUCCESS;
+		} else {
+			if (interactive) {
+				/* move the new process group into the foreground */
+				/* suppress messages when run from /linuxrc mag@sysgo.de */
+				signal(SIGTTIN, SIG_IGN);
+				signal(SIGTTOU, SIG_IGN);
+				if (tcsetpgrp(0, pi->pgrp) && errno != ENOTTY)
+					perror_msg("tcsetpgrp");
+				rcode = pipe_wait(pi);
+				if (tcsetpgrp(0, getpid()) && errno != ENOTTY)
+					perror_msg("tcsetpgrp");
+				signal(SIGTTIN, SIG_DFL);
+				signal(SIGTTOU, SIG_DFL);
+			} else {
+				rcode = pipe_wait(pi);
+			}
+		}
+		last_return_code=rcode;
+		if ( rmode == RES_IF || rmode == RES_ELIF )
+			next_if_code=rcode;  /* can be overwritten a number of times */
+		if ( (rcode==EXIT_SUCCESS && pi->followup==PIPE_OR) ||
+		     (rcode!=EXIT_SUCCESS && pi->followup==PIPE_AND) )
+			return rcode;  /* XXX broken if list is part of if/then/else */
+	}
+	return rcode;
+}
+
+/* broken, of course, but OK for testing */
+static char *indenter(int i)
+{
+	static char blanks[]="                                    ";
+	return &blanks[sizeof(blanks)-i-1];
+}
+
+/* return code is the exit status of the pipe */
+static int run_pipe_test(struct pipe *pi, int indent)
+{
+	char **p;
+	struct child_prog *child;
+	struct redir_struct *r, *rnext;
+	int a, i, ret_code=0;
+	char *ind = indenter(indent);
+	final_printf("%s run pipe: (pid %d)\n",ind,getpid());
+	for (i=0; i<pi->num_progs; i++) {
+		child = &pi->progs[i];
+		final_printf("%s  command %d:\n",ind,i);
+		if (child->argv) {
+			for (a=0,p=child->argv; *p; a++,p++) {
+				final_printf("%s   argv[%d] = %s\n",ind,a,*p);
+			}
+			globfree(&child->glob_result);
+			child->argv=NULL;
+		} else if (child->group) {
+			final_printf("%s   begin group (subshell:%d)\n",ind, child->subshell);
+			ret_code = run_list_test(child->group,indent+3);
+			final_printf("%s   end group\n",ind);
+		} else {
+			final_printf("%s   (nil)\n",ind);
+		}
+		for (r=child->redirects; r; r=rnext) {
+			final_printf("%s   redirect %d%s", ind, r->fd, redir_table[r->type].descrip);
+			if (r->dup == -1) {
+				final_printf(" %s\n", *r->word.gl_pathv);
+				globfree(&r->word);
+			} else {
+				final_printf("&%d\n", r->dup);
+			}
+			rnext=r->next;
+			free(r);
+		}
+		child->redirects=NULL;
+	}
+	free(pi->progs);   /* children are an array, they get freed all at once */
+	pi->progs=NULL;
+	return ret_code;
+}
+
+static int run_list_test(struct pipe *head, int indent)
+{
+	int rcode=0;   /* if list has no members */
+	struct pipe *pi, *next;
+	char *ind = indenter(indent);
+	for (pi=head; pi; pi=next) {
+		if (pi->num_progs == 0) break;
+		final_printf("%s pipe reserved mode %d\n", ind, pi->r_mode);
+		rcode = run_pipe_test(pi, indent);
+		final_printf("%s pipe followup code %d\n", ind, pi->followup);
+		next=pi->next;
+		pi->next=NULL;
+		free(pi);
+	}
+	return rcode;	
+}
+
+/* Select which version we will use */
+static int run_list(struct pipe *pi)
+{
+	int rcode=0;
+	if (fake_mode==0) {
+		rcode = run_list_real(pi);
+	} 
+	/* run_list_test has the side effect of clearing memory
+	 * In the long run that function can be merged with run_list_real,
+	 * but doing that now would hobble the debugging effort. */
+	run_list_test(pi,0);
+	return rcode;
+}
+
+/* The API for glob is arguably broken.  This routine pushes a non-matching
+ * string into the output structure, removing non-backslashed backslashes.
+ * If someone can prove me wrong, by performing this function within the
+ * original glob(3) api, feel free to rewrite this routine into oblivion.
+ * Return code (0 vs. GLOB_NOSPACE) matches glob(3).
+ * XXX broken if the last character is '\\', check that before calling.
+ */
+static int globhack(const char *src, int flags, glob_t *pglob)
+{
+	int cnt, pathc;
+	const char *s;
+	char *dest;
+	for (cnt=1, s=src; *s; s++) {
+		if (*s == '\\') s++;
+		cnt++;
+	}
+	dest = malloc(cnt);
+	if (!dest) return GLOB_NOSPACE;
+	if (!(flags & GLOB_APPEND)) {
+		pglob->gl_pathv=NULL;
+		pglob->gl_pathc=0;
+		pglob->gl_offs=0;
+		pglob->gl_offs=0;
+	}
+	pathc = ++pglob->gl_pathc;
+	pglob->gl_pathv = realloc(pglob->gl_pathv, (pathc+1)*sizeof(*pglob->gl_pathv));
+	if (pglob->gl_pathv == NULL) return GLOB_NOSPACE;
+	pglob->gl_pathv[pathc-1]=dest;
+	pglob->gl_pathv[pathc]=NULL;
+	for (s=src; *s; s++, dest++) {
+		if (*s == '\\') s++;
+		*dest = *s;
+	}
+	*dest='\0';
+	return 0;
+}
+
+/* XXX broken if the last character is '\\', check that before calling */
+static int glob_needed(const char *s)
+{
+	for (; *s; s++) {
+		if (*s == '\\') s++;
+		if (strchr("*[?",*s)) return 1;
+	}
+	return 0;
+}
+
+#if 0
+static void globprint(glob_t *pglob)
+{
+	int i;
+	debug_printf("glob_t at %p:\n", pglob);
+	debug_printf("  gl_pathc=%d  gl_pathv=%p  gl_offs=%d  gl_flags=%d\n",
+		pglob->gl_pathc, pglob->gl_pathv, pglob->gl_offs, pglob->gl_flags);
+	for (i=0; i<pglob->gl_pathc; i++)
+		debug_printf("pglob->gl_pathv[%d] = %p = %s\n", i,
+			pglob->gl_pathv[i], pglob->gl_pathv[i]);
+}
+#endif
+
+static int xglob(o_string *dest, int flags, glob_t *pglob)
+{
+	int gr;
+
+ 	/* short-circuit for null word */
+	/* we can code this better when the debug_printf's are gone */
+ 	if (dest->length == 0) {
+ 		if (dest->nonnull) {
+ 			/* bash man page calls this an "explicit" null */
+ 			gr = globhack(dest->data, flags, pglob);
+ 			debug_printf("globhack returned %d\n",gr);
+ 		} else {
+			return 0;
+		}
+ 	} else if (glob_needed(dest->data)) {
+		gr = glob(dest->data, flags, NULL, pglob);
+		debug_printf("glob returned %d\n",gr);
+		if (gr == GLOB_NOMATCH) {
+			/* quote removal, or more accurately, backslash removal */
+			gr = globhack(dest->data, flags, pglob);
+			debug_printf("globhack returned %d\n",gr);
+		}
+	} else {
+		gr = globhack(dest->data, flags, pglob);
+		debug_printf("globhack returned %d\n",gr);
+	}
+	if (gr == GLOB_NOSPACE) {
+		fprintf(stderr,"out of memory during glob\n");
+		exit(1);
+	}
+	if (gr != 0) { /* GLOB_ABORTED ? */
+		fprintf(stderr,"glob(3) error %d\n",gr);
+	}
+	/* globprint(glob_target); */
+	return gr;
+}
+
+/* the src parameter allows us to peek forward to a possible &n syntax
+ * for file descriptor duplication, e.g., "2>&1".
+ * Return code is 0 normally, 1 if a syntax error is detected in src.
+ * Resource errors (in xmalloc) cause the process to exit */
+static int setup_redirect(struct p_context *ctx, int fd, redir_type style,
+	struct in_str *input)
+{
+	struct child_prog *child=ctx->child;
+	struct redir_struct *redir = child->redirects;
+	struct redir_struct *last_redir=NULL;
+
+	/* Create a new redir_struct and drop it onto the end of the linked list */
+	while(redir) {
+		last_redir=redir;
+		redir=redir->next;
+	}
+	redir = xmalloc(sizeof(struct redir_struct));
+	redir->next=NULL;
+	if (last_redir) {
+		last_redir->next=redir;
+	} else {
+		child->redirects=redir;
+	}
+
+	redir->type=style;
+	redir->fd= (fd==-1) ? redir_table[style].default_fd : fd ;
+
+	debug_printf("Redirect type %d%s\n", redir->fd, redir_table[style].descrip);
+
+	/* Check for a '2>&1' type redirect */ 
+	redir->dup = redirect_dup_num(input);
+	if (redir->dup == -2) return 1;  /* syntax error */
+	if (redir->dup != -1) {
+		/* Erik had a check here that the file descriptor in question
+		 * is legit; I postpone that to "run time" */
+		debug_printf("Duplicating redirect '%d>&%d'\n", redir->fd, redir->dup);
+	} else {
+		/* We do _not_ try to open the file that src points to,
+		 * since we need to return and let src be expanded first.
+		 * Set ctx->pending_redirect, so we know what to do at the
+		 * end of the next parsed word.
+		 */
+		ctx->pending_redirect = redir;
+	}
+	return 0;
+}
+
+struct pipe *new_pipe(void) {
+	struct pipe *pi;
+	pi = xmalloc(sizeof(struct pipe));
+	pi->num_progs = 0;
+	pi->progs = NULL;
+	pi->next = NULL;
+	pi->followup = 0;  /* invalid */
+	return pi;
+}
+
+static void initialize_context(struct p_context *ctx)
+{
+	ctx->pipe=NULL;
+	ctx->pending_redirect=NULL;
+	ctx->child=NULL;
+	ctx->list_head=new_pipe();
+	ctx->pipe=ctx->list_head;
+	ctx->w=RES_NONE;
+	ctx->stack=NULL;
+	done_command(ctx);   /* creates the memory for working child */
+}
+
+/* normal return is 0
+ * if a reserved word is found, and processed, return 1
+ * should handle if, then, elif, else, fi, for, while, until, do, done.
+ * case, function, and select are obnoxious, save those for later.
+ */
+int reserved_word(o_string *dest, struct p_context *ctx)
+{
+	struct reserved_combo {
+		char *literal;
+		int code;
+		long flag;
+	};
+	/* Mostly a list of accepted follow-up reserved words.
+	 * FLAG_END means we are done with the sequence, and are ready
+	 * to turn the compound list into a command.
+	 * FLAG_START means the word must start a new compound list.
+	 */
+	static struct reserved_combo reserved_list[] = {
+		{ "if",    RES_IF,    FLAG_THEN | FLAG_START },
+		{ "then",  RES_THEN,  FLAG_ELIF | FLAG_ELSE | FLAG_FI },
+		{ "elif",  RES_ELIF,  FLAG_THEN },
+		{ "else",  RES_ELSE,  FLAG_FI   },
+		{ "fi",    RES_FI,    FLAG_END  },
+		{ "for",   RES_FOR,   FLAG_DO   | FLAG_START },
+		{ "while", RES_WHILE, FLAG_DO   | FLAG_START },
+		{ "until", RES_UNTIL, FLAG_DO   | FLAG_START },
+		{ "do",    RES_DO,    FLAG_DONE },
+		{ "done",  RES_DONE,  FLAG_END  }
+	};
+	struct reserved_combo *r;
+	for (r=reserved_list;
+#define NRES sizeof(reserved_list)/sizeof(struct reserved_combo)
+		r<reserved_list+NRES; r++) {
+		if (strcmp(dest->data, r->literal) == 0) {
+			debug_printf("found reserved word %s, code %d\n",r->literal,r->code);
+			if (r->flag & FLAG_START) {
+				struct p_context *new = xmalloc(sizeof(struct p_context));
+				debug_printf("push stack\n");
+				*new = *ctx;   /* physical copy */
+				initialize_context(ctx);
+				ctx->stack=new;
+			} else if ( ctx->w == RES_NONE || ! (ctx->old_flag & (1<<r->code))) {
+				syntax();  /* XXX how do we get out? */
+			}
+			ctx->w=r->code;
+			ctx->old_flag = r->flag;
+			if (ctx->old_flag & FLAG_END) {
+				struct p_context *old;
+				debug_printf("pop stack\n");
+				old = ctx->stack;
+				old->child->group = ctx->list_head;
+				*ctx = *old;   /* physical copy */
+				free(old);
+				ctx->w=RES_NONE;
+			}
+			b_reset (dest);
+			return 1;
+		}
+	}
+	return 0;
+}
+
+/* normal return is 0.
+ * Syntax or xglob errors return 1. */
+static int done_word(o_string *dest, struct p_context *ctx)
+{
+	struct child_prog *child=ctx->child;
+	glob_t *glob_target;
+	int gr, flags = 0;
+
+	debug_printf("done_word: %s %p\n", dest->data, child);
+	if (dest->length == 0 && !dest->nonnull) {
+		debug_printf("  true null, ignored\n");
+		return 0;
+	}
+	if (ctx->pending_redirect) {
+		glob_target = &ctx->pending_redirect->word;
+	} else {
+		if (child->group) {
+			syntax();
+			return 1;  /* syntax error, groups and arglists don't mix */
+		}
+		if (!child->argv) {
+			debug_printf("checking %s for reserved-ness\n",dest->data);
+			if (reserved_word(dest,ctx)) return 0;
+		}
+		glob_target = &child->glob_result;
+ 		if (child->argv) flags |= GLOB_APPEND;
+	}
+	gr = xglob(dest, flags, glob_target);
+	if (gr != 0) return 1;
+
+	b_reset(dest);
+	if (ctx->pending_redirect) {
+		ctx->pending_redirect=NULL;
+		if (glob_target->gl_pathc != 1) {
+			fprintf(stderr, "ambiguous redirect\n");
+			return 1;
+		}
+	} else {
+		child->argv = glob_target->gl_pathv;
+	}
+	return 0;
+}
+
+/* The only possible error here is out of memory, in which case
+ * xmalloc exits. */
+static int done_command(struct p_context *ctx)
+{
+	/* The child is really already in the pipe structure, so
+	 * advance the pipe counter and make a new, null child.
+	 * Only real trickiness here is that the uncommitted
+	 * child structure, to which ctx->child points, is not
+	 * counted in pi->num_progs. */
+	struct pipe *pi=ctx->pipe;
+	struct child_prog *prog=ctx->child;
+
+	if (prog && prog->group == NULL
+	         && prog->argv == NULL
+	         && prog->redirects == NULL) {
+		debug_printf("done_command: skipping null command\n");
+		return 0;
+	} else if (prog) {
+		pi->num_progs++;
+		debug_printf("done_command: num_progs incremented to %d\n",pi->num_progs);
+	} else {
+		debug_printf("done_command: initializing\n");
+	}
+	pi->progs = xrealloc(pi->progs, sizeof(*pi->progs) * (pi->num_progs+1));
+
+	prog = pi->progs + pi->num_progs;
+	prog->redirects = NULL;
+	prog->argv = NULL;
+	prog->is_stopped = 0;
+	prog->group = NULL;
+	prog->glob_result.gl_pathv = NULL;
+	prog->family = pi;
+
+	ctx->child=prog;
+	/* but ctx->pipe and ctx->list_head remain unchanged */
+	return 0;
+}
+
+static int done_pipe(struct p_context *ctx, pipe_style type)
+{
+	struct pipe *new_p;
+	done_command(ctx);  /* implicit closure of previous command */
+	debug_printf("done_pipe, type %d\n", type);
+	ctx->pipe->followup = type;
+	ctx->pipe->r_mode = ctx->w;
+	new_p=new_pipe();
+	ctx->pipe->next = new_p;
+	ctx->pipe = new_p;
+	ctx->child = NULL;
+	done_command(ctx);  /* set up new pipe to accept commands */
+	return 0;
+}
+
+/* peek ahead in the in_str to find out if we have a "&n" construct,
+ * as in "2>&1", that represents duplicating a file descriptor.
+ * returns either -2 (syntax error), -1 (no &), or the number found.
+ */
+static int redirect_dup_num(struct in_str *input)
+{
+	int ch, d=0, ok=0;
+	ch = b_peek(input);
+	if (ch != '&') return -1;
+
+	b_getch(input);  /* get the & */
+	while (ch=b_peek(input),isdigit(ch)) {
+		d = d*10+(ch-'0');
+		ok=1;
+		b_getch(input);
+	}
+	if (ok) return d;
+
+	fprintf(stderr, "ambiguous redirect\n");
+	return -2;
+}
+
+/* If a redirect is immediately preceded by a number, that number is
+ * supposed to tell which file descriptor to redirect.  This routine
+ * looks for such preceding numbers.  In an ideal world this routine
+ * needs to handle all the following classes of redirects...
+ *     echo 2>foo     # redirects fd  2 to file "foo", nothing passed to echo
+ *     echo 49>foo    # redirects fd 49 to file "foo", nothing passed to echo
+ *     echo -2>foo    # redirects fd  1 to file "foo",    "-2" passed to echo
+ *     echo 49x>foo   # redirects fd  1 to file "foo",   "49x" passed to echo
+ * A -1 output from this program means no valid number was found, so the
+ * caller should use the appropriate default for this redirection.
+ */
+static int redirect_opt_num(o_string *o)
+{
+	int num;
+
+	if (o->length==0) return -1;
+	for(num=0; num<o->length; num++) {
+		if (!isdigit(*(o->data+num))) {
+			return -1;
+		}
+	}
+	/* reuse num (and save an int) */
+	num=atoi(o->data);
+	b_reset(o);
+	return num;
+}
+
+FILE *generate_stream_from_list(struct pipe *head)
+{
+	FILE *pf;
+#if 1
+	int pid, channel[2];
+	if (pipe(channel)<0) perror_msg_and_die("pipe");
+	pid=fork();
+	if (pid<0) {
+		perror_msg_and_die("fork");
+	} else if (pid==0) {
+		close(channel[0]);
+		if (channel[1] != 1) {
+			dup2(channel[1],1);
+			close(channel[1]);
+		}
+#if 0
+#define SURROGATE "surrogate response"
+		write(1,SURROGATE,sizeof(SURROGATE));
+		exit(run_list(head));
+#else
+		exit(run_list_real(head));   /* leaks memory */
+#endif
+	}
+	debug_printf("forked child %d\n",pid);
+	close(channel[1]);
+	pf = fdopen(channel[0],"r");
+	debug_printf("pipe on FILE *%p\n",pf);
+#else
+	run_list_test(head,0);
+	pf=popen("echo surrogate response","r");
+	debug_printf("started fake pipe on FILE *%p\n",pf);
+#endif
+	return pf;
+}
+
+/* this version hacked for testing purposes */
+/* return code is exit status of the process that is run. */
+static int process_command_subs(o_string *dest, struct p_context *ctx, struct in_str *input, int subst_end)
+{
+	int retcode;
+	o_string result=NULL_O_STRING;
+	struct p_context inner;
+	FILE *p;
+	struct in_str pipe_str;
+	initialize_context(&inner);
+
+	/* recursion to generate command */
+	retcode = parse_stream(&result, &inner, input, subst_end);
+	if (retcode != 0) return retcode;  /* syntax error or EOF */
+	done_word(&result, &inner);
+	done_pipe(&inner, PIPE_SEQ);
+	b_free(&result);
+
+	p=generate_stream_from_list(inner.list_head);
+	if (p==NULL) return 1;
+	mark_open(fileno(p));
+	setup_file_in_str(&pipe_str, p);
+
+	/* now send results of command back into original context */
+	retcode = parse_stream(dest, ctx, &pipe_str, '\0');
+	/* XXX In case of a syntax error, should we try to kill the child?
+	 * That would be tough to do right, so just read until EOF. */
+	if (retcode == 1) {
+		while (b_getch(&pipe_str)!=EOF) { /* discard */ };
+	}
+
+	debug_printf("done reading from pipe, pclose()ing\n");
+	/* This is the step that wait()s for the child.  Should be pretty
+	 * safe, since we just read an EOF from its stdout.  We could try
+	 * to better, by using wait(), and keeping track of background jobs
+	 * at the same time.  That would be a lot of work, and contrary
+	 * to the KISS philosophy of this program. */
+	mark_closed(fileno(p));
+	retcode=pclose(p);
+	debug_printf("pclosed, retcode=%d\n",retcode);
+	/* XXX this process fails to trim a single trailing newline */
+	return retcode;
+}
+
+static int parse_group(o_string *dest, struct p_context *ctx,
+	struct in_str *input, int ch)
+{
+	int rcode, endch=0;
+	struct p_context sub;
+	struct child_prog *child = ctx->child;
+	if (child->argv) {
+		syntax();
+		return 1;  /* syntax error, groups and arglists don't mix */
+	}
+	initialize_context(&sub);
+	switch(ch) {
+		case '(': endch=')'; child->subshell=1; break;
+		case '{': endch='}'; break;
+		default: syntax();   /* really logic error */
+	}
+	rcode=parse_stream(dest,&sub,input,endch);
+	done_word(dest,&sub); /* finish off the final word in the subcontext */
+	done_pipe(&sub, PIPE_SEQ);  /* and the final command there, too */
+	child->group = sub.list_head;
+	return rcode;
+	/* child remains "open", available for possible redirects */
+}
+
+/* basically useful version until someone wants to get fancier,
+ * see the bash man page under "Parameter Expansion" */
+static void lookup_param(o_string *dest, struct p_context *ctx, o_string *src)
+{
+	const char *p=NULL;
+	if (src->data) p = getenv(src->data);
+	if (p) parse_string(dest, ctx, p);   /* recursion */
+	b_free(src);
+}
+
+/* return code: 0 for OK, 1 for syntax error */
+static int handle_dollar(o_string *dest, struct p_context *ctx, struct in_str *input)
+{
+	int i, advance=0;
+	o_string alt=NULL_O_STRING;
+	char sep[]=" ";
+	int ch = input->peek(input);  /* first character after the $ */
+	debug_printf("handle_dollar: ch=%c\n",ch);
+	if (isalpha(ch)) {
+		while(ch=b_peek(input),isalnum(ch) || ch=='_') {
+			b_getch(input);
+			b_addchr(&alt,ch);
+		}
+		lookup_param(dest, ctx, &alt);
+	} else if (isdigit(ch)) {
+		i = ch-'0';  /* XXX is $0 special? */
+		if (i<global_argc) {
+			parse_string(dest, ctx, global_argv[i]); /* recursion */
+		}
+		advance = 1;
+	} else switch (ch) {
+		case '$':
+			b_adduint(dest,getpid());
+			advance = 1;
+			break;
+		case '!':
+			if (last_bg_pid > 0) b_adduint(dest, last_bg_pid);
+			advance = 1;
+			break;
+		case '?':
+			b_adduint(dest,last_return_code);
+			advance = 1;
+			break;
+		case '#':
+			b_adduint(dest,global_argc ? global_argc-1 : 0);
+			advance = 1;
+			break;
+		case '{':
+			b_getch(input);
+			/* XXX maybe someone will try to escape the '}' */
+			while(ch=b_getch(input),ch!=EOF && ch!='}') {
+				b_addchr(&alt,ch);
+			}
+			if (ch != '}') {
+				syntax();
+				return 1;
+			}
+			lookup_param(dest, ctx, &alt);
+			break;
+		case '(':
+			process_command_subs(dest, ctx, input, ')');
+			break;
+		case '*':
+			sep[0]=ifs[0];
+			for (i=1; i<global_argc; i++) {
+				parse_string(dest, ctx, global_argv[i]);
+				if (i+1 < global_argc) parse_string(dest, ctx, sep);
+			}
+			break;
+		case '@':
+		case '-':
+		case '_':
+			/* still unhandled, but should be eventually */
+			fprintf(stderr,"unhandled syntax: $%c\n",ch);
+			return 1;
+			break;
+		default:
+			b_addqchr(dest,'$',dest->quote);
+	}
+	/* Eat the character if the flag was set.  If the compiler
+	 * is smart enough, we could substitute "b_getch(input);"
+	 * for all the "advance = 1;" above, and also end up with
+	 * a nice size-optimized program.  Hah!  That'll be the day.
+	 */
+	if (advance) b_getch(input);
+	return 0;
+}
+
+int parse_string(o_string *dest, struct p_context *ctx, const char *src)
+{
+	struct in_str foo;
+	setup_string_in_str(&foo, src);
+	return parse_stream(dest, ctx, &foo, '\0');
+}
+
+/* return code is 0 for normal exit, 1 for syntax error */
+int parse_stream(o_string *dest, struct p_context *ctx,
+	struct in_str *input, int end_trigger)
+{
+	unsigned int ch, m;
+	int redir_fd;
+	redir_type redir_style;
+	int next;
+
+	/* Only double-quote state is handled in the state variable dest->quote.
+	 * A single-quote triggers a bypass of the main loop until its mate is
+	 * found.  When recursing, quote state is passed in via dest->quote. */
+
+	debug_printf("parse_stream, end_trigger=%d\n",end_trigger);
+	while ((ch=b_getch(input))!=EOF) {
+		m = map[ch];
+		next = (ch == '\n') ? 0 : b_peek(input);
+		debug_printf("parse_stream: ch=%c (%d) m=%d quote=%d\n",
+			ch,ch,m,dest->quote);
+		if (m==0 || ((m==1 || m==2) && dest->quote)) {
+			b_addqchr(dest, ch, dest->quote);
+		} else if (ch == end_trigger && !dest->quote) {
+			debug_printf("leaving parse_stream\n");
+			return 0;
+		} else if (m==2 && !dest->quote) {  /* IFS */
+			done_word(dest, ctx);
+#if 0
+			if (ch=='\n') {
+				/* Yahoo!  Time to run with it! */
+				done_pipe(ctx,PIPE_SEQ);
+				run_list(ctx->list_head);
+				initialize_context(ctx);
+			}
+#endif
+		} else switch (ch) {
+		case '#':
+			if (dest->length == 0 && !dest->quote) {
+				while(ch=b_peek(input),ch!=EOF && ch!='\n') { b_getch(input); }
+			} else {
+				b_addqchr(dest, ch, dest->quote);
+			}
+			break;
+		case '\\':
+			if (next == EOF) {
+				syntax();
+				return 1;
+			}
+			b_addqchr(dest, '\\', dest->quote);
+			b_addqchr(dest, b_getch(input), dest->quote);
+			break;
+		case '$':
+			if (handle_dollar(dest, ctx, input)!=0) return 1;
+			break;
+		case '\'':
+			dest->nonnull = 1;
+			while(ch=b_getch(input),ch!=EOF && ch!='\'') {
+				b_addchr(dest,ch);
+			}
+			if (ch==EOF) {
+				syntax();
+				return 1;
+			}
+			break;
+		case '"':
+			dest->nonnull = 1;
+			dest->quote = !dest->quote;
+			break;
+		case '`':
+			process_command_subs(dest, ctx, input, '`');
+			break;
+		case '>':
+			redir_fd = redirect_opt_num(dest);
+			done_word(dest, ctx);
+			redir_style=REDIRECT_OVERWRITE;
+			if (next == '>') {
+				redir_style=REDIRECT_APPEND;
+				b_getch(input);
+			} else if (next == '(') {
+				syntax();   /* until we support >(list) Process Substitution */
+				return 1;
+			}
+			setup_redirect(ctx, redir_fd, redir_style, input);
+			break;
+		case '<':
+			redir_fd = redirect_opt_num(dest);
+			done_word(dest, ctx);
+			redir_style=REDIRECT_INPUT;
+			if (next == '<') {
+				redir_style=REDIRECT_HEREIS;
+				b_getch(input);
+			} else if (next == '>') {
+				redir_style=REDIRECT_IO;
+				b_getch(input);
+			} else if (next == '(') {
+				syntax();   /* until we support <(list) Process Substitution */
+				return 1;
+			}
+			setup_redirect(ctx, redir_fd, redir_style, input);
+			break;
+		case ';':
+			done_word(dest, ctx);
+			done_pipe(ctx,PIPE_SEQ);
+			break;
+		case '&':
+			done_word(dest, ctx);
+			if (next=='&') {
+				b_getch(input);
+				done_pipe(ctx,PIPE_AND);
+			} else {
+				done_pipe(ctx,PIPE_BG);
+			}
+			break;
+		case '|':
+			done_word(dest, ctx);
+			if (next=='|') {
+				b_getch(input);
+				done_pipe(ctx,PIPE_OR);
+			} else {
+				/* we could pick up a file descriptor choice here
+				 * with redirect_opt_num(), but bash doesn't do it.
+				 * "echo foo 2| cat" yields "foo 2". */
+				done_command(ctx);
+			}
+			break;
+		case '(':
+		case '{':
+			if (parse_group(dest, ctx, input, ch)!=0) return 1;
+			break;
+		case ')':
+		case '}':
+			syntax();   /* Proper use of this character caught by end_trigger */
+			return 1;
+			break;
+		default:
+			syntax();   /* this is really an internal logic error */
+			return 1;
+		}
+	}
+	/* complain if quote?  No, maybe we just finished a command substitution
+	 * that was quoted.  Example:
+	 * $ echo "`cat foo` plus more" 
+	 * and we just got the EOF generated by the subshell that ran "cat foo"
+	 * The only real complaint is if we got an EOF when end_trigger != '\0',
+	 * that is, we were really supposed to get end_trigger, and never got
+	 * one before the EOF.  Can't use the standard "syntax error" return code,
+	 * so that parse_stream_outer can distinguish the EOF and exit smoothly. */
+	if (end_trigger != '\0') return -1;
+	return 0;
+}
+
+void mapset(const unsigned char *set, int code)
+{
+	const unsigned char *s;
+	for (s=set; *s; s++) map[*s] = code;
+}
+
+void update_ifs_map(void)
+{
+	/* char *ifs and char map[256] are both globals. */
+	ifs = getenv("IFS");
+	if (ifs == NULL) ifs=" \t\n";
+	/* Precompute a list of 'flow through' behavior so it can be treated
+	 * quickly up front.  Computation is necessary because of IFS.
+	 * Special case handling of IFS == " \t\n" is not implemented.
+	 * The map[] array only really needs two bits each, and on most machines
+	 * that would be faster because of the reduced L1 cache footprint.
+	 */
+	memset(map,0,256);        /* most characters flow through always */
+	mapset("\\$'\"`", 3);     /* never flow through */
+	mapset("<>;&|(){}#", 1);  /* flow through if quoted */
+	mapset(ifs, 2);           /* also flow through if quoted */
+}
+
+/* most recursion does not come through here, the exeception is
+ * from builtin_source() */
+int parse_stream_outer(struct in_str *inp)
+{
+
+	struct p_context ctx;
+	o_string temp=NULL_O_STRING;
+	int rcode;
+	do {
+		initialize_context(&ctx);
+		update_ifs_map();
+		inp->promptmode=1;
+		rcode = parse_stream(&temp, &ctx, inp, '\n');
+		done_word(&temp, &ctx);
+		done_pipe(&ctx,PIPE_SEQ);
+		run_list(ctx.list_head);
+	} while (rcode != -1);   /* loop on syntax errors, return on EOF */
+	return 0;
+}
+
+static int parse_string_outer(const char *s)
+{
+	struct in_str input;
+	setup_string_in_str(&input, s);
+	return parse_stream_outer(&input);
+}
+
+static int parse_file_outer(FILE *f)
+{
+	int rcode;
+	struct in_str input;
+	setup_file_in_str(&input, f);
+	rcode = parse_stream_outer(&input);
+	return rcode;
+}
+
+int shell_main(int argc, char **argv)
+{
+	int opt;
+	FILE *input;
+
+	/* XXX what should these be while sourcing /etc/profile? */
+	global_argc = argc;
+	global_argv = argv;
+
+	if (argv[0] && argv[0][0] == '-') {
+		debug_printf("\nsourcing /etc/profile\n");
+		input = xfopen("/etc/profile", "r");
+		mark_open(fileno(input));
+		parse_file_outer(input);
+		mark_closed(fileno(input));
+		fclose(input);
+	}
+	input=stdin;
+	
+	/* initialize the cwd -- this is never freed...*/
+	cwd = xgetcwd(0);
+#ifdef BB_FEATURE_COMMAND_EDITING
+	cmdedit_set_initial_prompt();
+#else
+	PS1 = NULL;
+#endif
+	
+	while ((opt = getopt(argc, argv, "c:xif")) > 0) {
+		switch (opt) {
+			case 'c':
+				{
+					global_argv = argv+optind;
+					global_argc = argc-optind;
+					opt = parse_string_outer(optarg);
+					exit(opt);
+				}
+				break;
+			case 'i':
+				interactive++;
+				break;
+			case 'f':
+				fake_mode++;
+				break;
+			default:
+				fprintf(stderr, "Usage: sh [FILE]...\n"
+						"   or: sh -c command [args]...\n\n");
+				exit(EXIT_FAILURE);
+		}
+	}
+	/* A shell is interactive if the `-i' flag was given, or if all of
+	 * the following conditions are met:
+	 *	  no -c command
+	 *    no arguments remaining or the -s flag given
+	 *    standard input is a terminal
+	 *    standard output is a terminal
+	 *    Refer to Posix.2, the description of the `sh' utility. */
+	if (argv[optind]==NULL && input==stdin &&
+			isatty(fileno(stdin)) && isatty(fileno(stdout))) {
+		interactive++;
+	}
+	
+	if (interactive) {
+		/* Looks like they want an interactive shell */
+		fprintf(stdout, "\nhush -- the humble shell v0.01 (testing)\n\n");
+		exit(parse_file_outer(stdin));
+	}
+	debug_printf("\ninteractive=%d\n", interactive);
+
+	debug_printf("\nrunning script '%s'\n", argv[optind]);
+	global_argv = argv+optind;
+	global_argc = argc-optind;
+	input = xfopen(argv[optind], "r");
+	opt = parse_file_outer(input);
+
+#ifdef BB_FEATURE_CLEAN_UP
+	fclose(input.file);
+#endif
+
+	return(opt);
+}
diff --git a/sh.c b/sh.c
deleted file mode 100644
index 1d128355c..000000000
--- a/sh.c
+++ /dev/null
@@ -1,1935 +0,0 @@
-/* vi: set sw=4 ts=4: */
-/*
- * lash -- the BusyBox Lame-Ass SHell
- *
- * Copyright (C) 1999,2000,2001 by Lineo, inc.
- * Written by Erik Andersen <andersen@lineo.com>, <andersee@debian.org>
- *
- * Based in part on ladsh.c by Michael K. Johnson and Erik W. Troan, which is
- * under the following liberal license: "We have placed this source code in the
- * public domain. Use it in any project, free or commercial."
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- *
- */
-
-/* The parsing engine of this program is officially at a dead-end.
- * Future work in that direction should move to the work posted
- * at http://doolittle.faludi.com/~larry/parser.html .
- * A start on the integration of that work with the rest of sh.c
- * is at http://codepoet.org/sh.c .
- */
-//
-//This works pretty well now, and is now on by default.
-#define BB_FEATURE_SH_ENVIRONMENT
-//
-//Backtick support has some problems, use at your own risk!
-//#define BB_FEATURE_SH_BACKTICKS
-//
-//If, then, else, etc. support..  This should now behave basically
-//like any other Bourne shell -- sortof...
-#define BB_FEATURE_SH_IF_EXPRESSIONS
-//
-/* This is currently sortof broken, only for the brave... */
-#undef HANDLE_CONTINUATION_CHARS
-//
-/* This would be great -- if wordexp wouldn't strip all quoting
- * out from the target strings...  As is, a parser needs  */
-#undef BB_FEATURE_SH_WORDEXP
-//
-//For debugging/development on the shell only...
-//#define DEBUG_SHELL
-
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <ctype.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <signal.h>
-#include <string.h>
-#include <sys/ioctl.h>
-#include <sys/wait.h>
-#include <unistd.h>
-#include <getopt.h>
-#include "busybox.h"
-#include "cmdedit.h"
-
-#ifdef BB_LOCALE_SUPPORT
-#include <locale.h>
-#endif
-
-//#define BB_FEATURE_SH_WORDEXP
-
-#ifdef BB_FEATURE_SH_WORDEXP
-#include <wordexp.h>
-#define expand_t	wordexp_t
-#undef BB_FEATURE_SH_BACKTICKS
-#else
-#include <glob.h>
-#define expand_t	glob_t
-#endif	
-
-
-static const int MAX_READ = 128;	/* size of input buffer for `read' builtin */
-#define JOB_STATUS_FORMAT "[%d] %-22s %.40s\n"
-
-
-enum redir_type { REDIRECT_INPUT, REDIRECT_OVERWRITE,
-	REDIRECT_APPEND
-};
-
-static const unsigned int DEFAULT_CONTEXT=0x1;
-static const unsigned int IF_TRUE_CONTEXT=0x2;
-static const unsigned int IF_FALSE_CONTEXT=0x4;
-static const unsigned int THEN_EXP_CONTEXT=0x8;
-static const unsigned int ELSE_EXP_CONTEXT=0x10;
-
-
-struct jobset {
-	struct job *head;			/* head of list of running jobs */
-	struct job *fg;				/* current foreground job */
-};
-
-struct redir_struct {
-	enum redir_type type;	/* type of redirection */
-	int fd;						/* file descriptor being redirected */
-	char *filename;				/* file to redirect fd to */
-};
-
-struct child_prog {
-	pid_t pid;					/* 0 if exited */
-	char **argv;				/* program name and arguments */
-	int num_redirects;			/* elements in redirection array */
-	struct redir_struct *redirects;	/* I/O redirects */
-	int is_stopped;				/* is the program currently running? */
-	struct job *family;			/* pointer back to the child's parent job */
-};
-
-struct job {
-	int jobid;					/* job number */
-	int num_progs;				/* total number of programs in job */
-	int running_progs;			/* number of programs running */
-	char *text;					/* name of job */
-	char *cmdbuf;				/* buffer various argv's point into */
-	pid_t pgrp;					/* process group ID for the job */
-	struct child_prog *progs;	/* array of programs in job */
-	struct job *next;			/* to track background commands */
-	int stopped_progs;			/* number of programs alive, but stopped */
-	unsigned int job_context;	/* bitmask defining current context */
-	struct jobset *job_list;
-};
-
-struct built_in_command {
-	char *cmd;					/* name */
-	char *descr;				/* description */
-	int (*function) (struct child_prog *);	/* function ptr */
-};
-
-struct close_me {
-	int fd;
-	struct close_me *next;
-};
-
-/* function prototypes for builtins */
-static int builtin_cd(struct child_prog *cmd);
-static int builtin_exec(struct child_prog *cmd);
-static int builtin_exit(struct child_prog *cmd);
-static int builtin_fg_bg(struct child_prog *cmd);
-static int builtin_help(struct child_prog *cmd);
-static int builtin_jobs(struct child_prog *dummy);
-static int builtin_pwd(struct child_prog *dummy);
-static int builtin_export(struct child_prog *cmd);
-static int builtin_source(struct child_prog *cmd);
-static int builtin_unset(struct child_prog *cmd);
-static int builtin_read(struct child_prog *cmd);
-#ifdef BB_FEATURE_SH_IF_EXPRESSIONS
-static int builtin_if(struct child_prog *cmd);
-static int builtin_then(struct child_prog *cmd);
-static int builtin_else(struct child_prog *cmd);
-static int builtin_fi(struct child_prog *cmd);
-/* function prototypes for shell stuff */
-static int run_command_predicate(char *cmd);
-#endif
-
-
-/* function prototypes for shell stuff */
-static void mark_open(int fd);
-static void mark_closed(int fd);
-static void close_all(void);
-static void checkjobs(struct jobset *job_list);
-static int get_command(FILE * source, char *command);
-static int parse_command(char **command_ptr, struct job *job, int *inbg);
-static int run_command(struct job *newjob, int inbg, int outpipe[2]);
-static int pseudo_exec(struct child_prog *cmd) __attribute__ ((noreturn));
-static int busy_loop(FILE * input);
-
-
-/* Table of built-in functions (these are non-forking builtins, meaning they
- * can change global variables in the parent shell process but they will not
- * work with pipes and redirects; 'unset foo | whatever' will not work) */
-static struct built_in_command bltins[] = {
-	{"bg", "Resume a job in the background", builtin_fg_bg},
-	{"cd", "Change working directory", builtin_cd},
-	{"exec", "Exec command, replacing this shell with the exec'd process", builtin_exec},
-	{"exit", "Exit from shell()", builtin_exit},
-	{"fg", "Bring job into the foreground", builtin_fg_bg},
-	{"jobs", "Lists the active jobs", builtin_jobs},
-	{"export", "Set environment variable", builtin_export},
-	{"unset", "Unset environment variable", builtin_unset},
-	{"read", "Input environment variable", builtin_read},
-	{".", "Source-in and run commands in a file", builtin_source},
-	/* to do: add ulimit */
-#ifdef BB_FEATURE_SH_IF_EXPRESSIONS
-	{"if", NULL, builtin_if},
-	{"then", NULL, builtin_then},
-	{"else", NULL, builtin_else},
-	{"fi", NULL, builtin_fi},
-#endif
-	{NULL, NULL, NULL}
-};
-
-/* Table of forking built-in functions (things that fork cannot change global
- * variables in the parent process, such as the current working directory) */
-static struct built_in_command bltins_forking[] = {
-	{"pwd", "Print current directory", builtin_pwd},
-	{"help", "List shell built-in commands", builtin_help},
-	{NULL, NULL, NULL}
-};
-
-
-/* Variables we export */
-unsigned int shell_context;  /* Used in cmdedit.c to reset the
-								context when someone hits ^C */
-
-
-/* Globals that are static to this file */
-static char *cwd;
-static char *local_pending_command = NULL;
-static struct jobset job_list = { NULL, NULL };
-static int argc;
-static char **argv;
-static struct close_me *close_me_head;
-#ifdef BB_FEATURE_SH_ENVIRONMENT
-static int last_bg_pid;
-static int last_return_code;
-static int show_x_trace;
-#endif
-#ifdef BB_FEATURE_SH_IF_EXPRESSIONS
-static char syntax_err[]="syntax error near unexpected token";
-#endif
-
-static char *PS1;
-static char *PS2 = "> ";
-
-
-#ifdef DEBUG_SHELL
-static inline void debug_printf(const char *format, ...)
-{
-	va_list args;
-	va_start(args, format);
-	vfprintf(stderr, format, args);
-	va_end(args);
-}
-#else
-static inline void debug_printf(const char *format, ...) { }
-#endif
-
-/*
-	Most builtins need access to the struct child_prog that has
-	their arguments, previously coded as cmd->progs[0].  That coding
-	can exhibit a bug, if the builtin is not the first command in
-	a pipeline: "echo foo | exec sort" will attempt to exec foo.
-
-builtin   previous use      notes
------- -----------------  ---------
-cd      cmd->progs[0]
-exec    cmd->progs[0]  squashed bug: didn't look for applets or forking builtins
-exit    cmd->progs[0]
-fg_bg   cmd->progs[0], job_list->head, job_list->fg
-help    0
-jobs    job_list->head
-pwd     0
-export  cmd->progs[0]
-source  cmd->progs[0]
-unset   cmd->progs[0]
-read    cmd->progs[0]
-if      cmd->job_context,  cmd->text
-then    cmd->job_context,  cmd->text
-else    cmd->job_context,  cmd->text
-fi      cmd->job_context
-
-The use of cmd->text by if/then/else/fi is hopelessly hacky.
-Would it work to increment cmd->progs[0]->argv and recurse,
-somewhat like builtin_exec does?
-
-I added "struct job *family;" to struct child_prog,
-and switched API to builtin_foo(struct child_prog *child);
-So   cmd->text        becomes  child->family->text
-     cmd->job_context  becomes  child->family->job_context
-     cmd->progs[0]    becomes  *child
-     job_list          becomes  child->family->job_list
- */
-
-/* built-in 'cd <path>' handler */
-static int builtin_cd(struct child_prog *child)
-{
-	char *newdir;
-
-	if (child->argv[1] == NULL)
-		newdir = getenv("HOME");
-	else
-		newdir = child->argv[1];
-	if (chdir(newdir)) {
-		printf("cd: %s: %m\n", newdir);
-		return EXIT_FAILURE;
-	}
-	cwd = xgetcwd(cwd);
-
-	return EXIT_SUCCESS;
-}
-
-/* built-in 'exec' handler */
-static int builtin_exec(struct child_prog *child)
-{
-	if (child->argv[1] == NULL)
-		return EXIT_SUCCESS;   /* Really? */
-	child->argv++;
-	close_all();
-	pseudo_exec(child);
-	/* never returns */
-}
-
-/* built-in 'exit' handler */
-static int builtin_exit(struct child_prog *child)
-{
-	if (child->argv[1] == NULL)
-		exit(EXIT_SUCCESS);
-
-	exit (atoi(child->argv[1]));
-}
-
-/* built-in 'fg' and 'bg' handler */
-static int builtin_fg_bg(struct child_prog *child)
-{
-	int i, jobNum;
-	struct job *job=NULL;
-	
-	if (!child->argv[1] || child->argv[2]) {
-		error_msg("%s: exactly one argument is expected",
-				child->argv[0]);
-		return EXIT_FAILURE;
-	}
-
-	if (sscanf(child->argv[1], "%%%d", &jobNum) != 1) {
-		error_msg("%s: bad argument '%s'",
-				child->argv[0], child->argv[1]);
-		return EXIT_FAILURE;
-	}
-
-	for (job = child->family->job_list->head; job; job = job->next) {
-		if (job->jobid == jobNum) {
-			break;
-		}
-	}
-
-	if (!job) {
-		error_msg("%s: unknown job %d",
-				child->argv[0], jobNum);
-		return EXIT_FAILURE;
-	}
-
-	if (*child->argv[0] == 'f') {
-		/* Make this job the foreground job */
-		/* suppress messages when run from /linuxrc mag@sysgo.de */
-		if (tcsetpgrp(0, job->pgrp) && errno != ENOTTY)
-			perror_msg("tcsetpgrp"); 
-		child->family->job_list->fg = job;
-	}
-
-	/* Restart the processes in the job */
-	for (i = 0; i < job->num_progs; i++)
-		job->progs[i].is_stopped = 0;
-
-	kill(-job->pgrp, SIGCONT);
-
-	job->stopped_progs = 0;
-
-	return EXIT_SUCCESS;
-}
-
-/* built-in 'help' handler */
-static int builtin_help(struct child_prog *dummy)
-{
-	struct built_in_command *x;
-
-	printf("\nBuilt-in commands:\n");
-	printf("-------------------\n");
-	for (x = bltins; x->cmd; x++) {
-		if (x->descr==NULL)
-			continue;
-		printf("%s\t%s\n", x->cmd, x->descr);
-	}
-	for (x = bltins_forking; x->cmd; x++) {
-		if (x->descr==NULL)
-			continue;
-		printf("%s\t%s\n", x->cmd, x->descr);
-	}
-	printf("\n\n");
-	return EXIT_SUCCESS;
-}
-
-/* built-in 'jobs' handler */
-static int builtin_jobs(struct child_prog *child)
-{
-	struct job *job;
-	char *status_string;
-
-	for (job = child->family->job_list->head; job; job = job->next) {
-		if (job->running_progs == job->stopped_progs)
-			status_string = "Stopped";
-		else
-			status_string = "Running";
-
-		printf(JOB_STATUS_FORMAT, job->jobid, status_string, job->text);
-	}
-	return EXIT_SUCCESS;
-}
-
-
-/* built-in 'pwd' handler */
-static int builtin_pwd(struct child_prog *dummy)
-{
-	printf( "%s\n", cwd);
-	return EXIT_SUCCESS;
-}
-
-/* built-in 'export VAR=value' handler */
-static int builtin_export(struct child_prog *child)
-{
-	int res;
-	char *v = child->argv[1];
-
-	if (v == NULL) {
-		char **e;
-		for (e = environ; *e; e++) {
-			printf( "%s\n", *e);
-		}
-		return 0;
-	}
-	res = putenv(v);
-	if (res)
-		fprintf(stderr, "export: %m\n");
-#ifndef BB_FEATURE_SH_SIMPLE_PROMPT
-	if (strncmp(v, "PS1=", 4)==0)
-		PS1 = getenv("PS1");
-#endif
-
-#ifdef BB_LOCALE_SUPPORT
-	if(strncmp(v, "LC_ALL=", 7)==0)
-		setlocale(LC_ALL, getenv("LC_ALL"));
-	if(strncmp(v, "LC_CTYPE=", 9)==0)
-		setlocale(LC_CTYPE, getenv("LC_CTYPE"));
-#endif
-
-	return (res);
-}
-
-/* built-in 'read VAR' handler */
-static int builtin_read(struct child_prog *child)
-{
-	int res = 0, len, newlen;
-	char *s;
-	char string[MAX_READ];
-
-	if (child->argv[1]) {
-		/* argument (VAR) given: put "VAR=" into buffer */
-		strcpy(string, child->argv[1]);
-		len = strlen(string);
-		string[len++] = '=';
-		string[len]   = '\0';
-		fgets(&string[len], sizeof(string) - len, stdin);	/* read string */
-		newlen = strlen(string);
-		if(newlen > len)
-			string[--newlen] = '\0';	/* chomp trailing newline */
-		/*
-		** string should now contain "VAR=<value>"
-		** copy it (putenv() won't do that, so we must make sure
-		** the string resides in a static buffer!)
-		*/
-		res = -1;
-		if((s = strdup(string)))
-			res = putenv(s);
-		if (res)
-			fprintf(stderr, "read: %m\n");
-	}
-	else
-		fgets(string, sizeof(string), stdin);
-
-	return (res);
-}
-
-#ifdef BB_FEATURE_SH_IF_EXPRESSIONS
-/* Built-in handler for 'if' commands */
-static int builtin_if(struct child_prog *child)
-{
-	struct job *cmd = child->family;
-	int status;
-	char* charptr1=cmd->text+3; /* skip over the leading 'if ' */
-
-	/* Now run the 'if' command */
-	debug_printf( "job=%p entering builtin_if ('%s')-- context=%d\n", cmd, charptr1, cmd->job_context);
-	status = run_command_predicate(charptr1);
-	debug_printf( "if test returned ");
-	if (status == 0) {
-		debug_printf( "TRUE\n");
-		cmd->job_context |= IF_TRUE_CONTEXT;
-	} else {
-		debug_printf( "FALSE\n");
-		cmd->job_context |= IF_FALSE_CONTEXT;
-	}
-	debug_printf("job=%p builtin_if set job context to %x\n", cmd, cmd->job_context);
-	shell_context++;
-
-	return status;
-}
-
-/* Built-in handler for 'then' (part of the 'if' command) */
-static int builtin_then(struct child_prog *child)
-{
-	struct job *cmd = child->family;
-	char* charptr1=cmd->text+5; /* skip over the leading 'then ' */
-
-	debug_printf( "job=%p entering builtin_then ('%s')-- context=%d\n", cmd, charptr1, cmd->job_context);
-	if (! (cmd->job_context & (IF_TRUE_CONTEXT|IF_FALSE_CONTEXT))) {
-		shell_context = 0; /* Reset the shell's context on an error */
-		error_msg("%s `then'", syntax_err);
-		return EXIT_FAILURE;
-	}
-
-	cmd->job_context |= THEN_EXP_CONTEXT;
-	debug_printf("job=%p builtin_then set job context to %x\n", cmd, cmd->job_context);
-
-	/* If the if result was FALSE, skip the 'then' stuff */
-	if (cmd->job_context & IF_FALSE_CONTEXT) {
-		return EXIT_SUCCESS;
-	}
-
-	/* Seems the if result was TRUE, so run the 'then' command */
-	debug_printf( "'then' now running '%s'\n", charptr1);
-
-	return(run_command_predicate(charptr1));
-}
-
-/* Built-in handler for 'else' (part of the 'if' command) */
-static int builtin_else(struct child_prog *child)
-{
-	struct job *cmd = child->family;
-	char* charptr1=cmd->text+5; /* skip over the leading 'else ' */
-
-	debug_printf( "job=%p entering builtin_else ('%s')-- context=%d\n", cmd, charptr1, cmd->job_context);
-
-	if (! (cmd->job_context & THEN_EXP_CONTEXT)) {
-		shell_context = 0; /* Reset the shell's context on an error */
-		error_msg("%s `else'", syntax_err);
-		return EXIT_FAILURE;
-	}
-	/* If the if result was TRUE, skip the 'else' stuff */
-	if (cmd->job_context & IF_TRUE_CONTEXT) {
-		return EXIT_SUCCESS;
-	}
-
-	cmd->job_context |= ELSE_EXP_CONTEXT;
-	debug_printf("job=%p builtin_else set job context to %x\n", cmd, cmd->job_context);
-
-	/* Now run the 'else' command */
-	debug_printf( "'else' now running '%s'\n", charptr1);
-	return(run_command_predicate(charptr1));
-}
-
-/* Built-in handler for 'fi' (part of the 'if' command) */
-static int builtin_fi(struct child_prog *child)
-{
-	struct job *cmd = child->family;
-	debug_printf( "job=%p entering builtin_fi ('%s')-- context=%d\n", cmd, "", cmd->job_context);
-	if (! (cmd->job_context & (IF_TRUE_CONTEXT|IF_FALSE_CONTEXT))) {
-		shell_context = 0; /* Reset the shell's context on an error */
-		error_msg("%s `fi'", syntax_err);
-		return EXIT_FAILURE;
-	}
-	/* Clear out the if and then context bits */
-	cmd->job_context &= ~(IF_TRUE_CONTEXT|IF_FALSE_CONTEXT|THEN_EXP_CONTEXT|ELSE_EXP_CONTEXT);
-	debug_printf("job=%p builtin_fi set job context to %x\n", cmd, cmd->job_context);
-	shell_context--;
-	return EXIT_SUCCESS;
-}
-#endif
-
-/* Built-in '.' handler (read-in and execute commands from file) */
-static int builtin_source(struct child_prog *child)
-{
-	FILE *input;
-	int status;
-	int fd;
-
-	if (child->argv[1] == NULL)
-		return EXIT_FAILURE;
-
-	input = fopen(child->argv[1], "r");
-	if (!input) {
-		printf( "Couldn't open file '%s'\n", child->argv[1]);
-		return EXIT_FAILURE;
-	}
-
-	fd=fileno(input);
-	mark_open(fd);
-	/* Now run the file */
-	status = busy_loop(input);
-	fclose(input);
-	mark_closed(fd);
-	return (status);
-}
-
-/* built-in 'unset VAR' handler */
-static int builtin_unset(struct child_prog *child)
-{
-	if (child->argv[1] == NULL) {
-		printf( "unset: parameter required.\n");
-		return EXIT_FAILURE;
-	}
-	unsetenv(child->argv[1]);
-	return EXIT_SUCCESS;
-}
-
-#ifdef BB_FEATURE_SH_IF_EXPRESSIONS
-/* currently used by if/then/else.
- *
- * Reparsing the command line for this purpose is gross,
- * incorrect, and fundamentally unfixable; in particular,
- * think about what happens with command substitution.
- * We really need to pull out the run, wait, return status
- * functionality out of busy_loop so we can child->argv++
- * and use that, without going back through parse_command.
- */
-static int run_command_predicate(char *cmd)
-{
-	local_pending_command = xstrdup(cmd);
-	return( busy_loop(NULL));
-}
-#endif
-
-static void mark_open(int fd)
-{
-	struct close_me *new = xmalloc(sizeof(struct close_me));
-	new->fd = fd;
-	new->next = close_me_head;
-	close_me_head = new;
-}
-
-static void mark_closed(int fd)
-{
-	struct close_me *tmp;
-	if (close_me_head == NULL || close_me_head->fd != fd)
-		error_msg_and_die("corrupt close_me");
-	tmp = close_me_head;
-	close_me_head = close_me_head->next;
-	free(tmp);
-}
-
-static void close_all()
-{
-	struct close_me *c, *tmp;
-	for (c=close_me_head; c; c=tmp) {
-		close(c->fd);
-		tmp=c->next;
-		free(c);
-	}
-	close_me_head = NULL;
-}
-
-
-/* free up all memory from a job */
-static void free_job(struct job *cmd)
-{
-	int i;
-	struct jobset *keep;
-
-	for (i = 0; i < cmd->num_progs; i++) {
-		free(cmd->progs[i].argv);
-		if (cmd->progs[i].redirects)
-			free(cmd->progs[i].redirects);
-	}
-	if (cmd->progs)
-		free(cmd->progs);
-	if (cmd->text)
-		free(cmd->text);
-	if (cmd->cmdbuf)
-		free(cmd->cmdbuf);
-	keep = cmd->job_list;
-	memset(cmd, 0, sizeof(struct job));
-	cmd->job_list = keep;
-}
-
-/* remove a job from a jobset */
-static void remove_job(struct jobset *j_list, struct job *job)
-{
-	struct job *prevjob;
-
-	free_job(job);
-	if (job == j_list->head) {
-		j_list->head = job->next;
-	} else {
-		prevjob = j_list->head;
-		while (prevjob->next != job)
-			prevjob = prevjob->next;
-		prevjob->next = job->next;
-	}
-
-	free(job);
-}
-
-/* Checks to see if any background processes have exited -- if they 
-   have, figure out why and see if a job has completed */
-static void checkjobs(struct jobset *j_list)
-{
-	struct job *job;
-	pid_t childpid;
-	int status;
-	int prognum = 0;
-
-	while ((childpid = waitpid(-1, &status, WNOHANG | WUNTRACED)) > 0) {
-		for (job = j_list->head; job; job = job->next) {
-			prognum = 0;
-			while (prognum < job->num_progs &&
-				   job->progs[prognum].pid != childpid) prognum++;
-			if (prognum < job->num_progs)
-				break;
-		}
-
-		/* This happens on backticked commands */
-		if(job==NULL)
-			return;
-
-		if (WIFEXITED(status) || WIFSIGNALED(status)) {
-			/* child exited */
-			job->running_progs--;
-			job->progs[prognum].pid = 0;
-
-			if (!job->running_progs) {
-				printf(JOB_STATUS_FORMAT, job->jobid, "Done", job->text);
-				remove_job(j_list, job);
-			}
-		} else {
-			/* child stopped */
-			job->stopped_progs++;
-			job->progs[prognum].is_stopped = 1;
-
-			if (job->stopped_progs == job->num_progs) {
-				printf(JOB_STATUS_FORMAT, job->jobid, "Stopped",
-					   job->text);
-			}
-		}
-	}
-
-	if (childpid == -1 && errno != ECHILD)
-		perror_msg("waitpid");
-}
-
-/* squirrel != NULL means we squirrel away copies of stdin, stdout,
- * and stderr if they are redirected. */
-static int setup_redirects(struct child_prog *prog, int squirrel[])
-{
-	int i;
-	int openfd;
-	int mode = O_RDONLY;
-	struct redir_struct *redir = prog->redirects;
-
-	for (i = 0; i < prog->num_redirects; i++, redir++) {
-		switch (redir->type) {
-		case REDIRECT_INPUT:
-			mode = O_RDONLY;
-			break;
-		case REDIRECT_OVERWRITE:
-			mode = O_WRONLY | O_CREAT | O_TRUNC;
-			break;
-		case REDIRECT_APPEND:
-			mode = O_WRONLY | O_CREAT | O_APPEND;
-			break;
-		}
-
-		openfd = open(redir->filename, mode, 0666);
-		if (openfd < 0) {
-			/* this could get lost if stderr has been redirected, but
-			   bash and ash both lose it as well (though zsh doesn't!) */
-			perror_msg("error opening %s", redir->filename);
-			return 1;
-		}
-
-		if (openfd != redir->fd) {
-			if (squirrel && redir->fd < 3) {
-				squirrel[redir->fd] = dup(redir->fd);
-			}
-			dup2(openfd, redir->fd);
-			close(openfd);
-		}
-	}
-
-	return 0;
-}
-
-static void restore_redirects(int squirrel[])
-{
-	int i, fd;
-	for (i=0; i<3; i++) {
-		fd = squirrel[i];
-		if (fd != -1) {
-			/* No error checking.  I sure wouldn't know what
-			 * to do with an error if I found one! */
-			dup2(fd, i);
-			close(fd);
-		}
-	}
-}
-
-static inline void cmdedit_set_initial_prompt(void)
-{
-#ifdef BB_FEATURE_SH_SIMPLE_PROMPT
-	PS1 = NULL;
-#else
-	PS1 = getenv("PS1");
-	if(PS1==0)
-		PS1 = "\\w \\$ ";
-#endif	
-}
-
-static inline void setup_prompt_string(char **prompt_str)
-{
-#ifdef BB_FEATURE_SH_SIMPLE_PROMPT
-	/* Set up the prompt */
-	if (shell_context == 0) {
-		if (PS1)
-			free(PS1);
-		PS1=xmalloc(strlen(cwd)+4);
-		sprintf(PS1, "%s %s", cwd, ( geteuid() != 0 ) ?  "$ ":"# ");
-		*prompt_str = PS1;
-	} else {
-		*prompt_str = PS2;
-	}
-#else
-	*prompt_str = (shell_context==0)? PS1 : PS2;
-#endif	
-}
-
-static int get_command(FILE * source, char *command)
-{
-	char *prompt_str;
-
-	if (source == NULL) {
-		if (local_pending_command) {
-			/* a command specified (-c option): return it & mark it done */
-			strcpy(command, local_pending_command);
-			free(local_pending_command);
-			local_pending_command = NULL;
-			return 0;
-		}
-		return 1;
-	}
-
-	if (source == stdin) {
-		setup_prompt_string(&prompt_str);
-
-#ifdef BB_FEATURE_COMMAND_EDITING
-		/*
-		** enable command line editing only while a command line
-		** is actually being read; otherwise, we'll end up bequeathing
-		** atexit() handlers and other unwanted stuff to our
-		** child processes (rob@sysgo.de)
-		*/
-		cmdedit_read_input(prompt_str, command);
-		cmdedit_terminate();
-		return 0;
-#else
-		fputs(prompt_str, stdout);
-#endif
-	}
-
-	if (!fgets(command, BUFSIZ - 2, source)) {
-		if (source == stdin)
-			printf("\n");
-		return 1;
-	}
-
-	return 0;
-}
-
-#ifdef BB_FEATURE_SH_ENVIRONMENT
-static char* itoa(register int i)
-{
-	static char a[7]; /* Max 7 ints */
-	register char *b = a + sizeof(a) - 1;
-	int   sign = (i < 0);
-
-	if (sign)
-		i = -i;
-	*b = 0;
-	do
-	{
-		*--b = '0' + (i % 10);
-		i /= 10;
-	}
-	while (i);
-	if (sign)
-		*--b = '-';
-	return b;
-}
-#endif	
-
-#if defined BB_FEATURE_SH_ENVIRONMENT && ! defined BB_FEATURE_SH_WORDEXP
-char * strsep_space( char *string, int * ix)
-{
-	char *token, *begin;
-
-	begin = string;
-
-	/* Short circuit the trivial case */
-	if ( !string || ! string[*ix])
-		return NULL;
-
-	/* Find the end of the token. */
-	while( string && string[*ix] && !isspace(string[*ix]) ) {
-		(*ix)++;
-	}
-
-	/* Find the end of any whitespace trailing behind 
-	 * the token and let that be part of the token */
-	while( string && string[*ix] && isspace(string[*ix]) ) {
-		(*ix)++;
-	}
-
-	if (! string && *ix==0) {
-		/* Nothing useful was found */
-		return NULL;
-	}
-
-	token = xmalloc(*ix+1);
-	token[*ix] = '\0';
-	strncpy(token, string,  *ix); 
-
-	return token;
-}
-#endif	
-
-
-static int expand_arguments(char *command)
-{
-#ifdef BB_FEATURE_SH_ENVIRONMENT
-	expand_t expand_result;
-	char *src, *dst, *var;
-	int ix = 0;
-	int i=0, length, total_length=0, retval;
-	const char *out_of_space = "out of space during expansion"; 
-#endif
-
-	/* get rid of the terminating \n */
-	chomp(command);
-	
-	/* Fix up escape sequences to be the Real Thing(tm) */
-	while( command && command[ix]) {
-		if (command[ix] == '\\') {
-			const char *tmp = command+ix+1;
-			command[ix] = process_escape_sequence(  &tmp );
-			memmove(command+ix + 1, tmp, strlen(tmp)+1);
-		}
-		ix++;
-	}
-
-#ifdef BB_FEATURE_SH_ENVIRONMENT
-
-
-#ifdef BB_FEATURE_SH_WORDEXP
-	/* This first part uses wordexp() which is a wonderful C lib 
-	 * function which expands nearly everything.  */ 
-	retval = wordexp (command, &expand_result, WRDE_SHOWERR);
-	if (retval == WRDE_NOSPACE) {
-		/* Mem may have been allocated... */
-		wordfree (&expand_result);
-		error_msg(out_of_space);
-		return FALSE;
-	}
-	if (retval < 0) {
-		/* Some other error.  */
-		error_msg("syntax error");
-		return FALSE;
-	}
-	
-	if (expand_result.we_wordc > 0) {
-		/* Convert from char** (one word per string) to a simple char*,
-		 * but don't overflow command which is BUFSIZ in length */
-		*command = '\0';
-		while (i < expand_result.we_wordc && total_length < BUFSIZ) {
-			length=strlen(expand_result.we_wordv[i])+1;
-			if (BUFSIZ-total_length-length <= 0) {
-				error_msg(out_of_space);
-				return FALSE;
-			}
-			strcat(command+total_length, expand_result.we_wordv[i++]);
-			strcat(command+total_length, " ");
-			total_length+=length;
-		}
-		wordfree (&expand_result);
-	}
-#else
-
-	/* Ok.  They don't have a recent glibc and they don't have uClibc.  Chances
-	 * are about 100% they don't have wordexp(). So instead the best we can do
-	 * is use glob and then fixup environment variables and such ourselves.
-	 * This is better then nothing, but certainly not perfect */
-
-	/* It turns out that glob is very stupid.  We have to feed it one word at a
-	 * time since it can't cope with a full string.  Here we convert command
-	 * (char*) into cmd (char**, one word per string) */
-	{
-        
-		int flags = GLOB_NOCHECK
-#ifdef GLOB_BRACE
-				| GLOB_BRACE
-#endif	
-#ifdef GLOB_TILDE
-				| GLOB_TILDE
-#endif	
-			;
-		char *tmpcmd, *cmd, *cmd_copy;
-		/* We need a clean copy, so strsep can mess up the copy while
-		 * we write stuff into the original (in a minute) */
-		cmd = cmd_copy = strdup(command);
-		*command = '\0';
-		for (ix = 0, tmpcmd = cmd; 
-				(tmpcmd = strsep_space(cmd, &ix)) != NULL; cmd += ix, ix=0) {
-			if (*tmpcmd == '\0')
-				break;
-			/* we need to trim() the result for glob! */
-			trim(tmpcmd);
-			retval = glob(tmpcmd, flags, NULL, &expand_result);
-			free(tmpcmd); /* Free mem allocated by strsep_space */
-			if (retval == GLOB_NOSPACE) {
-				/* Mem may have been allocated... */
-				globfree (&expand_result);
-				error_msg(out_of_space);
-				return FALSE;
-			} else if (retval != 0) {
-				/* Some other error.  GLOB_NOMATCH shouldn't
-				 * happen because of the GLOB_NOCHECK flag in 
-				 * the glob call. */
-				error_msg("syntax error");
-				return FALSE;
-			} else {
-			/* Convert from char** (one word per string) to a simple char*,
-			 * but don't overflow command which is BUFSIZ in length */
-				for (i=0; i < expand_result.gl_pathc; i++) {
-					length=strlen(expand_result.gl_pathv[i]);
-					if (total_length+length+1 >= BUFSIZ) {
-						error_msg(out_of_space);
-						return FALSE;
-					}
-					strcat(command+total_length, " ");
-					total_length+=1;
-					strcat(command+total_length, expand_result.gl_pathv[i]);
-					total_length+=length;
-				}
-				globfree (&expand_result);
-			}
-		}
-		free(cmd_copy);
-		trim(command);
-	}
-	
-#endif	
-
-	/* Now do the shell variable substitutions which 
-	 * wordexp can't do for us, namely $? and $! */
-	src = command;
-	while((dst = strchr(src,'$')) != NULL){
-		var = NULL;
-		switch(*(dst+1)) {
-			case '?':
-				var = itoa(last_return_code);
-				break;
-			case '!':
-				if (last_bg_pid==-1)
-					*(var)='\0';
-				else
-					var = itoa(last_bg_pid);
-				break;
-				/* Everything else like $$, $#, $[0-9], etc should all be
-				 * expanded by wordexp(), so we can in theory skip that stuff
-				 * here, but just to be on the safe side (i.e. since uClibc
-				 * wordexp doesn't do this stuff yet), lets leave it in for
-				 * now. */
-			case '$':
-				var = itoa(getpid());
-				break;
-			case '#':
-				var = itoa(argc-1);
-				break;
-			case '0':case '1':case '2':case '3':case '4':
-			case '5':case '6':case '7':case '8':case '9':
-				{
-					int ixx=*(dst + 1)-48;
-					if (ixx >= argc) {
-						var='\0';
-					} else {
-						var = argv[ixx];
-					}
-				}
-				break;
-
-		}
-		if (var) {
-			/* a single character construction was found, and 
-			 * already handled in the case statement */
-			src=dst+2;
-		} else {
-			/* Looks like an environment variable */
-			char delim_hold;
-			int num_skip_chars=0;
-			int dstlen = strlen(dst);
-			/* Is this a ${foo} type variable? */
-			if (dstlen >=2 && *(dst+1) == '{') {
-				src=strchr(dst+1, '}');
-				num_skip_chars=1;
-			} else {
-				src=dst+1;
-				while(isalnum(*src) || *src=='_') src++;
-			}
-			if (src == NULL) {
-				src = dst+dstlen;
-			}
-			delim_hold=*src;
-			*src='\0';  /* temporary */
-			var = getenv(dst + 1 + num_skip_chars);
-			*src=delim_hold;
-			src += num_skip_chars;
-		}
-		if (var == NULL) {
-			/* Seems we got an un-expandable variable.  So delete it. */
-			var = "";
-		}
-		{
-			int subst_len = strlen(var);
-			int trail_len = strlen(src);
-			if (dst+subst_len+trail_len >= command+BUFSIZ) {
-				error_msg(out_of_space);
-				return FALSE;
-			}
-			/* Move stuff to the end of the string to accommodate
-			 * filling the created gap with the new stuff */
-			memmove(dst+subst_len, src, trail_len+1);
-			/* Now copy in the new stuff */
-			memcpy(dst, var, subst_len);
-			src = dst+subst_len;
-		}
-	}
-
-#endif	
-	return TRUE;
-}
-
-/* Return cmd->num_progs as 0 if no command is present (e.g. an empty
-   line). If a valid command is found, command_ptr is set to point to
-   the beginning of the next command (if the original command had more 
-   then one job associated with it) or NULL if no more commands are 
-   present. */
-static int parse_command(char **command_ptr, struct job *job, int *inbg)
-{
-	char *command;
-	char *return_command = NULL;
-	char *src, *buf, *chptr;
-	int argc_l = 0;
-	int done = 0;
-	int argv_alloced;
-	int i, saw_quote = 0;
-	char quote = '\0';
-	int count;
-	struct child_prog *prog;
-
-	/* skip leading white space */
-	while (**command_ptr && isspace(**command_ptr))
-		(*command_ptr)++;
-
-	/* this handles empty lines or leading '#' characters */
-	if (!**command_ptr || (**command_ptr == '#')) {
-		job->num_progs=0;
-		return 0;
-	}
-
-	*inbg = 0;
-	job->num_progs = 1;
-	job->progs = xmalloc(sizeof(*job->progs));
-
-	/* We set the argv elements to point inside of this string. The 
-	   memory is freed by free_job(). Allocate twice the original
-	   length in case we need to quote every single character.
-
-	   Getting clean memory relieves us of the task of NULL 
-	   terminating things and makes the rest of this look a bit 
-	   cleaner (though it is, admittedly, a tad less efficient) */
-	job->cmdbuf = command = xcalloc(2*strlen(*command_ptr) + 1, sizeof(char));
-	job->text = NULL;
-
-	prog = job->progs;
-	prog->num_redirects = 0;
-	prog->redirects = NULL;
-	prog->is_stopped = 0;
-	prog->family = job;
-
-	argv_alloced = 5;
-	prog->argv = xmalloc(sizeof(*prog->argv) * argv_alloced);
-	prog->argv[0] = job->cmdbuf;
-
-	buf = command;
-	src = *command_ptr;
-	while (*src && !done) {
-		if (quote == *src) {
-			quote = '\0';
-		} else if (quote) {
-			if (*src == '\\') {
-				src++;
-				if (!*src) {
-					error_msg("character expected after \\");
-					free_job(job);
-					return 1;
-				}
-
-				/* in shell, "\'" should yield \' */
-				if (*src != quote) {
-					*buf++ = '\\';
-					*buf++ = '\\';
-				}
-			} else if (*src == '*' || *src == '?' || *src == '[' ||
-					   *src == ']') *buf++ = '\\';
-			*buf++ = *src;
-		} else if (isspace(*src)) {
-			if (*prog->argv[argc_l] || saw_quote) {
-				buf++, argc_l++;
-				/* +1 here leaves room for the NULL which ends argv */
-				if ((argc_l + 1) == argv_alloced) {
-					argv_alloced += 5;
-					prog->argv = xrealloc(prog->argv,
-										  sizeof(*prog->argv) *
-										  argv_alloced);
-				}
-				prog->argv[argc_l] = buf;
-				saw_quote = 0;
-			}
-		} else
-			switch (*src) {
-			case '"':
-			case '\'':
-				quote = *src;
-				saw_quote = 1;
-				break;
-
-			case '#':			/* comment */
-				if (*(src-1)== '$')
-					*buf++ = *src;
-				else
-					done = 1;
-				break;
-
-			case '>':			/* redirects */
-			case '<':
-				i = prog->num_redirects++;
-				prog->redirects = xrealloc(prog->redirects,
-											  sizeof(*prog->redirects) *
-											  (i + 1));
-
-				prog->redirects[i].fd = -1;
-				if (buf != prog->argv[argc_l]) {
-					/* the stuff before this character may be the file number 
-					   being redirected */
-					prog->redirects[i].fd =
-						strtol(prog->argv[argc_l], &chptr, 10);
-
-					if (*chptr && *prog->argv[argc_l]) {
-						buf++, argc_l++;
-						prog->argv[argc_l] = buf;
-					}
-				}
-
-				if (prog->redirects[i].fd == -1) {
-					if (*src == '>')
-						prog->redirects[i].fd = 1;
-					else
-						prog->redirects[i].fd = 0;
-				}
-
-				if (*src++ == '>') {
-					if (*src == '>')
-						prog->redirects[i].type =
-							REDIRECT_APPEND, src++;
-					else
-						prog->redirects[i].type = REDIRECT_OVERWRITE;
-				} else {
-					prog->redirects[i].type = REDIRECT_INPUT;
-				}
-
-				/* This isn't POSIX sh compliant. Oh well. */
-				chptr = src;
-				while (isspace(*chptr))
-					chptr++;
-
-				if (!*chptr) {
-					error_msg("file name expected after %c", *(src-1));
-					free_job(job);
-					job->num_progs=0;
-					return 1;
-				}
-
-				prog->redirects[i].filename = buf;
-				while (*chptr && !isspace(*chptr))
-					*buf++ = *chptr++;
-
-				src = chptr - 1;	/* we src++ later */
-				prog->argv[argc_l] = ++buf;
-				break;
-
-			case '|':			/* pipe */
-				/* finish this command */
-				if (*prog->argv[argc_l] || saw_quote)
-					argc_l++;
-				if (!argc_l) {
-					error_msg("empty command in pipe");
-					free_job(job);
-					job->num_progs=0;
-					return 1;
-				}
-				prog->argv[argc_l] = NULL;
-
-				/* and start the next */
-				job->num_progs++;
-				job->progs = xrealloc(job->progs,
-									  sizeof(*job->progs) * job->num_progs);
-				prog = job->progs + (job->num_progs - 1);
-				prog->num_redirects = 0;
-				prog->redirects = NULL;
-				prog->is_stopped = 0;
-				prog->family = job;
-				argc_l = 0;
-
-				argv_alloced = 5;
-				prog->argv = xmalloc(sizeof(*prog->argv) * argv_alloced);
-				prog->argv[0] = ++buf;
-
-				src++;
-				while (*src && isspace(*src))
-					src++;
-
-				if (!*src) {
-					error_msg("empty command in pipe");
-					free_job(job);
-					job->num_progs=0;
-					return 1;
-				}
-				src--;			/* we'll ++ it at the end of the loop */
-
-				break;
-
-			case '&':			/* background */
-				*inbg = 1;
-			case ';':			/* multiple commands */
-				done = 1;
-				return_command = *command_ptr + (src - *command_ptr) + 1;
-				break;
-
-#ifdef BB_FEATURE_SH_BACKTICKS
-			case '`':
-				/* Exec a backtick-ed command */
-				/* Besides any previous brokenness, I have not
-				 * updated backtick handling for close_me support.
-				 * I don't know if it needs it or not.  -- LRD */
-				{
-					char* charptr1=NULL, *charptr2;
-					char* ptr=NULL;
-					struct job *newjob;
-					struct jobset njob_list = { NULL, NULL };
-					int pipefd[2];
-					int size;
-
-					ptr=strchr(++src, '`');
-					if (ptr==NULL) {
-						fprintf(stderr, "Unmatched '`' in command\n");
-						free_job(job);
-						return 1;
-					}
-
-					/* Make some space to hold just the backticked command */
-					charptr1 = charptr2 = xmalloc(1+ptr-src);
-					memcpy(charptr1, src, ptr-src);
-					charptr1[ptr-src] = '\0';
-					newjob = xmalloc(sizeof(struct job));
-					newjob->job_list = &njob_list;
-					/* Now parse and run the backticked command */
-					if (!parse_command(&charptr1, newjob, inbg) 
-							&& newjob->num_progs) {
-						pipe(pipefd);
-						run_command(newjob, 0, pipefd);
-					}
-					checkjobs(job->job_list);
-					free_job(newjob);  /* doesn't actually free newjob,
-					                     looks like a memory leak */
-					free(charptr2);
-					
-					/* Make a copy of any stuff left over in the command 
-					 * line after the second backtick */
-					charptr2 = xmalloc(strlen(ptr)+1);
-					memcpy(charptr2, ptr+1, strlen(ptr));
-
-
-					/* Copy the output from the backtick-ed command into the
-					 * command line, making extra room as needed  */
-					--src;
-					charptr1 = xmalloc(BUFSIZ);
-					while ( (size=full_read(pipefd[0], charptr1, BUFSIZ-1)) >0) {
-						int newsize=src - *command_ptr + size + 1 + strlen(charptr2);
-						if (newsize > BUFSIZ) {
-							*command_ptr=xrealloc(*command_ptr, newsize);
-						}
-						memcpy(src, charptr1, size); 
-						src+=size;
-					}
-					free(charptr1);
-					close(pipefd[0]);
-					if (*(src-1)=='\n')
-						--src;
-
-					/* Now paste into the *command_ptr all the stuff 
-					 * leftover after the second backtick */
-					memcpy(src, charptr2, strlen(charptr2)+1);
-					free(charptr2);
-
-					/* Now recursively call parse_command to deal with the new
-					 * and improved version of the command line with the backtick
-					 * results expanded in place... */
-					{
-						struct jobset *jl=job->job_list;
-						free_job(job);
-						job->job_list = jl;
-					}
-					return(parse_command(command_ptr, job, inbg));
-				}
-				break;
-#endif // BB_FEATURE_SH_BACKTICKS
-
-			case '\\':
-				src++;
-				if (!*src) {
-/* This is currently a little broken... */
-#ifdef HANDLE_CONTINUATION_CHARS
-					/* They fed us a continuation char, so continue reading stuff
-					 * on the next line, then tack that onto the end of the current
-					 * command */
-					char *command;
-					int newsize;
-					printf("erik: found a continue char at EOL...\n");
-					command = (char *) xcalloc(BUFSIZ, sizeof(char));
-					if (get_command(input, command)) {
-						error_msg("character expected after \\");
-						free(command);
-						free_job(job);
-						return 1;
-					}
-					newsize = strlen(*command_ptr) + strlen(command) + 2;
-					if (newsize > BUFSIZ) {
-						printf("erik: doing realloc\n");
-						*command_ptr=xrealloc(*command_ptr, newsize);
-					}
-					printf("erik: A: *command_ptr='%s'\n", *command_ptr);
-					memcpy(--src, command, strlen(command)); 
-					printf("erik: B: *command_ptr='%s'\n", *command_ptr);
-					free(command);
-					break;
-#else
-					error_msg("character expected after \\");
-					free_job(job);
-					return 1;
-#endif
-				}
-				if (*src == '*' || *src == '[' || *src == ']'
-					|| *src == '?') *buf++ = '\\';
-				/* fallthrough */
-			default:
-				*buf++ = *src;
-			}
-
-		src++;
-	}
-
-	if (*prog->argv[argc_l] || saw_quote) {
-		argc_l++;
-	}
-	if (!argc_l) {
-		free_job(job);
-		return 0;
-	}
-	prog->argv[argc_l] = NULL;
-
-	if (!return_command) {
-		job->text = xmalloc(strlen(*command_ptr) + 1);
-		strcpy(job->text, *command_ptr);
-	} else {
-		/* This leaves any trailing spaces, which is a bit sloppy */
-		count = return_command - *command_ptr;
-		job->text = xmalloc(count + 1);
-		strncpy(job->text, *command_ptr, count);
-		job->text[count] = '\0';
-	}
-
-	*command_ptr = return_command;
-	
-	return 0;
-}
-
-/* Run the child_prog, no matter what kind of command it uses.
- */
-static int pseudo_exec(struct child_prog *child)
-{
-	struct built_in_command *x;
-#ifdef BB_FEATURE_SH_STANDALONE_SHELL
-	char *name;
-#endif
-
-	/* Check if the command matches any of the non-forking builtins.
-	 * Depending on context, this might be redundant.  But it's
-	 * easier to waste a few CPU cycles than it is to figure out
-	 * if this is one of those cases.
-	 */
-	for (x = bltins; x->cmd; x++) {
-		if (strcmp(child->argv[0], x->cmd) == 0 ) {
-			exit(x->function(child));
-		}
-	}
-
-	/* Check if the command matches any of the forking builtins. */
-	for (x = bltins_forking; x->cmd; x++) {
-		if (strcmp(child->argv[0], x->cmd) == 0) {
-			applet_name=x->cmd;
-			exit (x->function(child));
-		}
-	}
-#ifdef BB_FEATURE_SH_STANDALONE_SHELL
-	/* Check if the command matches any busybox internal
-	 * commands ("applets") here.  Following discussions from
-	 * November 2000 on busybox@opensource.lineo.com, don't use
-	 * get_last_path_component().  This way explicit (with
-	 * slashes) filenames will never be interpreted as an
-	 * applet, just like with builtins.  This way the user can
-	 * override an applet with an explicit filename reference.
-	 * The only downside to this change is that an explicit
-	 * /bin/foo invocation will fork and exec /bin/foo, even if
-	 * /bin/foo is a symlink to busybox.
-	 */
-	name = child->argv[0];
-
-#ifdef BB_FEATURE_SH_APPLETS_ALWAYS_WIN
-	/* If you enable BB_FEATURE_SH_APPLETS_ALWAYS_WIN, then
-	 * if you run /bin/cat, it will use BusyBox cat even if 
-	 * /bin/cat exists on the filesystem and is _not_ busybox.
-	 * Some systems want this, others do not.  Choose wisely.  :-)
-	 */
-	name = get_last_path_component(name);
-#endif
-
-	{
-	    char** argv_l=child->argv;
-	    int argc_l;
-	    for(argc_l=0;*argv_l!=NULL; argv_l++, argc_l++);
-	    optind = 1;
-	    run_applet_by_name(name, argc_l, child->argv);
-	}
-#endif
-
-	execvp(child->argv[0], child->argv);
-	perror_msg_and_die("%s", child->argv[0]);
-}
-
-static void insert_job(struct job *newjob, int inbg)
-{
-	struct job *thejob;
-	struct jobset *j_list=newjob->job_list;
-
-	/* find the ID for thejob to use */
-	newjob->jobid = 1;
-	for (thejob = j_list->head; thejob; thejob = thejob->next)
-		if (thejob->jobid >= newjob->jobid)
-			newjob->jobid = thejob->jobid + 1;
-
-	/* add thejob to the list of running jobs */
-	if (!j_list->head) {
-		thejob = j_list->head = xmalloc(sizeof(*thejob));
-	} else {
-		for (thejob = j_list->head; thejob->next; thejob = thejob->next) /* nothing */;
-		thejob->next = xmalloc(sizeof(*thejob));
-		thejob = thejob->next;
-	}
-
-	*thejob = *newjob;   /* physically copy the struct job */
-	thejob->next = NULL;
-	thejob->running_progs = thejob->num_progs;
-	thejob->stopped_progs = 0;
-
-	if (inbg) {
-		/* we don't wait for background thejobs to return -- append it 
-		   to the list of backgrounded thejobs and leave it alone */
-		printf("[%d] %d\n", thejob->jobid,
-			   newjob->progs[newjob->num_progs - 1].pid);
-#ifdef BB_FEATURE_SH_ENVIRONMENT
-		last_bg_pid=newjob->progs[newjob->num_progs - 1].pid;
-#endif
-	} else {
-		newjob->job_list->fg = thejob;
-
-		/* move the new process group into the foreground */
-		/* suppress messages when run from /linuxrc mag@sysgo.de */
-		if (tcsetpgrp(0, newjob->pgrp) && errno != ENOTTY)
-			perror_msg("tcsetpgrp");
-	}
-}
-
-static int run_command(struct job *newjob, int inbg, int outpipe[2])
-{
-	/* struct job *thejob; */
-	int i;
-	int nextin, nextout;
-	int pipefds[2];				/* pipefd[0] is for reading */
-	struct built_in_command *x;
-	struct child_prog *child;
-
-	nextin = 0, nextout = 1;
-	for (i = 0; i < newjob->num_progs; i++) {
-		child = & (newjob->progs[i]);
-
-		if ((i + 1) < newjob->num_progs) {
-			if (pipe(pipefds)<0) perror_msg_and_die("pipe");
-			nextout = pipefds[1];
-		} else {
-			if (outpipe[1]!=-1) {
-				nextout = outpipe[1];
-			} else {
-				nextout = 1;
-			}
-		}
-
-#ifdef BB_FEATURE_SH_ENVIRONMENT
-		if (show_x_trace==TRUE) {
-			int j;
-			fputc('+', stderr);
-			for (j = 0; child->argv[j]; j++) {
-				fputc(' ', stderr);
-				fputs(child->argv[j], stderr);
-			}
-			fputc('\n', stderr);
-		}
-#endif
-
-		/* Check if the command matches any non-forking builtins,
-		 * but only if this is a simple command.
-		 * Non-forking builtins within pipes have to fork anyway,
-		 * and are handled in pseudo_exec.  "echo foo | read bar"
-		 * is doomed to failure, and doesn't work on bash, either.
-		 */
-		if (newjob->num_progs == 1) {
-			for (x = bltins; x->cmd; x++) {
-				if (strcmp(child->argv[0], x->cmd) == 0 ) {
-					int squirrel[] = {-1, -1, -1};
-					int rcode;
-					setup_redirects(child, squirrel);
-					rcode = x->function(child);
-					restore_redirects(squirrel);
-					return rcode;
-				}
-			}
-		}
-
-		if (!(child->pid = fork())) {
-			signal(SIGTTOU, SIG_DFL);
-
-			close_all();
-
-			if (outpipe[1]!=-1) {
-				close(outpipe[0]);
-			}
-			if (nextin != 0) {
-				dup2(nextin, 0);
-				close(nextin);
-			}
-
-			if (nextout != 1) {
-				dup2(nextout, 1);
-				dup2(nextout, 2);  /* Really? */
-				close(nextout);
-				close(pipefds[0]);
-			}
-
-			/* explicit redirects override pipes */
-			setup_redirects(child,NULL);
-
-			pseudo_exec(child);
-		}
-		if (outpipe[1]!=-1) {
-			close(outpipe[1]);
-		}
-
-		/* put our child in the process group whose leader is the
-		   first process in this pipe */
-		setpgid(child->pid, newjob->progs[0].pid);
-		if (nextin != 0)
-			close(nextin);
-		if (nextout != 1)
-			close(nextout);
-
-		/* If there isn't another process, nextin is garbage 
-		   but it doesn't matter */
-		nextin = pipefds[0];
-	}
-
-	newjob->pgrp = newjob->progs[0].pid;
-
-	insert_job(newjob, inbg);
-
-	return 0;
-}
-
-static int busy_loop(FILE * input)
-{
-	char *command;
-	char *next_command = NULL;
-	struct job newjob;
-	pid_t  parent_pgrp;
-	int i;
-	int inbg;
-	int status;
-	newjob.job_list = &job_list;
-	newjob.job_context = DEFAULT_CONTEXT;
-
-	/* save current owner of TTY so we can restore it on exit */
-	parent_pgrp = tcgetpgrp(0);
-
-	command = (char *) xcalloc(BUFSIZ, sizeof(char));
-
-	/* don't pay any attention to this signal; it just confuses 
-	   things and isn't really meant for shells anyway */
-	signal(SIGTTOU, SIG_IGN);
-
-	while (1) {
-		if (!job_list.fg) {
-			/* no job is in the foreground */
-
-			/* see if any background processes have exited */
-			checkjobs(&job_list);
-
-			if (!next_command) {
-				if (get_command(input, command))
-					break;
-				next_command = command;
-			}
-
-			if (expand_arguments(next_command) == FALSE) {
-				free(command);
-				command = (char *) xcalloc(BUFSIZ, sizeof(char));
-				next_command = NULL;
-				continue;
-			}
-
-			if (!parse_command(&next_command, &newjob, &inbg) &&
-				newjob.num_progs) {
-				int pipefds[2] = {-1,-1};
-				debug_printf( "job=%p fed to run_command by busy_loop()'\n", 
-						&newjob);
-				run_command(&newjob, inbg, pipefds);
-			}
-			else {
-				free(command);
-				command = (char *) xcalloc(BUFSIZ, sizeof(char));
-				next_command = NULL;
-			}
-		} else {
-			/* a job is running in the foreground; wait for it */
-			i = 0;
-			while (!job_list.fg->progs[i].pid ||
-				   job_list.fg->progs[i].is_stopped == 1) i++;
-
-			if (waitpid(job_list.fg->progs[i].pid, &status, WUNTRACED)<0)
-				perror_msg_and_die("waitpid(%d)",job_list.fg->progs[i].pid);
-
-			if (WIFEXITED(status) || WIFSIGNALED(status)) {
-				/* the child exited */
-				job_list.fg->running_progs--;
-				job_list.fg->progs[i].pid = 0;
-
-#ifdef BB_FEATURE_SH_ENVIRONMENT
-				last_return_code=WEXITSTATUS(status);
-				debug_printf("'%s' exited -- return code %d\n",
-						job_list.fg->text, last_return_code);
-#endif
-				if (!job_list.fg->running_progs) {
-					/* child exited */
-					remove_job(&job_list, job_list.fg);
-					job_list.fg = NULL;
-				}
-			} else {
-				/* the child was stopped */
-				job_list.fg->stopped_progs++;
-				job_list.fg->progs[i].is_stopped = 1;
-
-				if (job_list.fg->stopped_progs == job_list.fg->running_progs) {
-					printf("\n" JOB_STATUS_FORMAT, job_list.fg->jobid,
-						   "Stopped", job_list.fg->text);
-					job_list.fg = NULL;
-				}
-			}
-
-			if (!job_list.fg) {
-				/* move the shell to the foreground */
-				/* suppress messages when run from /linuxrc mag@sysgo.de */
-				if (tcsetpgrp(0, getpgrp()) && errno != ENOTTY)
-					perror_msg("tcsetpgrp"); 
-			}
-		}
-	}
-	free(command);
-
-	/* return controlling TTY back to parent process group before exiting */
-	if (tcsetpgrp(0, parent_pgrp))
-		perror_msg("tcsetpgrp");
-
-	/* return exit status if called with "-c" */
-	if (input == NULL && WIFEXITED(status))
-		return WEXITSTATUS(status);
-	
-	return 0;
-}
-
-
-#ifdef BB_FEATURE_CLEAN_UP
-void free_memory(void)
-{
-	if (cwd) {
-		free(cwd);
-		cwd = NULL;
-	}
-	if (local_pending_command)
-		free(local_pending_command);
-
-	if (job_list.fg && !job_list.fg->running_progs) {
-		remove_job(&job_list, job_list.fg);
-	}
-}
-#endif
-
-
-int shell_main(int argc_l, char **argv_l)
-{
-	int opt, interactive=FALSE;
-	FILE *input = stdin;
-	argc = argc_l;
-	argv = argv_l;
-
-	/* These variables need re-initializing when recursing */
-	shell_context = 0;
-	local_pending_command = NULL;
-	close_me_head = NULL;
-	job_list.head = NULL;
-	job_list.fg = NULL;
-#ifdef BB_FEATURE_SH_ENVIRONMENT
-	last_bg_pid=1;
-	last_return_code=1;
-	show_x_trace=FALSE;
-#endif
-
-	if (argv[0] && argv[0][0] == '-') {
-		FILE *prof_input;
-		prof_input = fopen("/etc/profile", "r");
-		if (!prof_input) {
-			printf( "Couldn't open file '/etc/profile'\n");
-		} else {
-			int tmp_fd = fileno(prof_input);
-			mark_open(tmp_fd);	
-			/* Now run the file */
-			busy_loop(prof_input);
-			fclose(prof_input);
-			mark_closed(tmp_fd);
-		}
-	}
-
-	while ((opt = getopt(argc_l, argv_l, "cxi")) > 0) {
-		switch (opt) {
-			case 'c':
-				input = NULL;
-				if (local_pending_command != 0)
-					error_msg_and_die("multiple -c arguments");
-				local_pending_command = xstrdup(argv[optind]);
-				optind++;
-				argv = argv+optind;
-				break;
-#ifdef BB_FEATURE_SH_ENVIRONMENT
-			case 'x':
-				show_x_trace = TRUE;
-				break;
-#endif
-			case 'i':
-				interactive = TRUE;
-				break;
-			default:
-				show_usage();
-		}
-	}
-	/* A shell is interactive if the `-i' flag was given, or if all of
-	 * the following conditions are met:
-	 *	  no -c command
-	 *    no arguments remaining or the -s flag given
-	 *    standard input is a terminal
-	 *    standard output is a terminal
-	 *    Refer to Posix.2, the description of the `sh' utility. */
-	if (argv[optind]==NULL && input==stdin &&
-			isatty(fileno(stdin)) && isatty(fileno(stdout))) {
-		interactive=TRUE;
-	}
-	if (interactive==TRUE) {
-		//printf( "optind=%d  argv[optind]='%s'\n", optind, argv[optind]);
-		/* Looks like they want an interactive shell */
-		printf( "\n\n" BB_BANNER " Built-in shell (lash)\n");
-		printf( "Enter 'help' for a list of built-in commands.\n\n");
-	} else if (local_pending_command==NULL) {
-		//printf( "optind=%d  argv[optind]='%s'\n", optind, argv[optind]);
-		input = xfopen(argv[optind], "r");
-		mark_open(fileno(input));  /* be lazy, never mark this closed */
-	}
-
-	/* initialize the cwd -- this is never freed...*/
-	cwd = xgetcwd(0);
-
-#ifdef BB_FEATURE_CLEAN_UP
-	atexit(free_memory);
-#endif
-
-#ifdef BB_FEATURE_COMMAND_EDITING
-	cmdedit_set_initial_prompt();
-#else
-	PS1 = NULL;
-#endif
-	
-	return (busy_loop(input));
-}
-
diff --git a/shell/hush.c b/shell/hush.c
new file mode 100644
index 000000000..f2a4ea410
--- /dev/null
+++ b/shell/hush.c
@@ -0,0 +1,2191 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * sh.c -- a prototype Bourne shell grammar parser
+ *      Intended to follow the original Thompson and Ritchie
+ *      "small and simple is beautiful" philosophy, which
+ *      incidentally is a good match to today's BusyBox.
+ *
+ * Copyright (C) 2000,2001  Larry Doolittle  <larry@doolittle.boa.org>
+ *
+ * Credits:
+ *      The parser routines proper are all original material, first
+ *      written Dec 2000 and Jan 2001 by Larry Doolittle.
+ *      The execution engine, the builtins, and much of the underlying
+ *      support has been adapted from busybox-0.49pre's lash,
+ *      which is Copyright (C) 2000 by Lineo, Inc., and
+ *      written by Erik Andersen <andersen@lineo.com>, <andersee@debian.org>.
+ *      That, in turn, is based in part on ladsh.c, by Michael K. Johnson and
+ *      Erik W. Troan, which they placed in the public domain.  I don't know
+ *      how much of the Johnson/Troan code has survived the repeated rewrites.
+ * Other credits:
+ *      simple_itoa() was lifted from boa-0.93.15
+ *      b_addchr() derived from similar w_addchar function in glibc-2.2
+ *      setup_redirect(), redirect_opt_num(), and big chunks of main()
+ *        and many builtins derived from contributions by Erik Andersen
+ *      miscellaneous bugfixes from Matt Kraai
+ *
+ * There are two big (and related) architecture differences between
+ * this parser and the lash parser.  One is that this version is
+ * actually designed from the ground up to understand nearly all
+ * of the Bourne grammar.  The second, consequential change is that
+ * the parser and input reader have been turned inside out.  Now,
+ * the parser is in control, and asks for input as needed.  The old
+ * way had the input reader in control, and it asked for parsing to
+ * take place as needed.  The new way makes it much easier to properly
+ * handle the recursion implicit in the various substitutions, especially
+ * across continuation lines.
+ *
+ * Bash grammar not implemented: (how many of these were in original sh?)
+ *      $@ (those sure look like weird quoting rules)
+ *      $_
+ *      ! negation operator for pipes
+ *      &> and >& redirection of stdout+stderr
+ *      Brace Expansion
+ *      Tilde Expansion
+ *      fancy forms of Parameter Expansion
+ *      Arithmetic Expansion
+ *      <(list) and >(list) Process Substitution
+ *      reserved words: if, then, elif, else, fi, while, until, for,
+ *                      do, done, case
+ *      Here Documents ( << word )
+ *      Functions
+ * Major bugs:
+ *      job handling woefully incomplete and buggy
+ *      reserved word execution woefully incomplete and buggy
+ *      incomplete reserved word sequence doesn't request more lines of input
+ * to-do:
+ *      port selected bugfixes from post-0.49 busybox lash
+ *      finish implementing reserved words
+ *      handle children going into background
+ *      clean up recognition of null pipes
+ *      have builtin_exec set flag to avoid restore_redirects
+ *      figure out if "echo foo}" is fixable
+ *      check setting of global_argc and global_argv
+ *      control-C handling, probably with longjmp
+ *      VAR=value prefix for simple commands
+ *      follow IFS rules more precisely, including update semantics
+ *      write builtin_eval, builtin_ulimit, builtin_umask
+ *      figure out what to do with backslash-newline
+ *      explain why we use signal instead of sigaction
+ *      propagate syntax errors, die on resource errors?
+ *      continuation lines, both explicit and implicit - done?
+ *      memory leak finding and plugging - done?
+ *      more testing, especially quoting rules and redirection
+ *      maybe change map[] to use 2-bit entries
+ *      (eventually) remove all the printf's
+ *      more integration with BusyBox: prompts, cmdedit, applets
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#include <ctype.h>     /* isalpha, isdigit */
+#include <unistd.h>    /* getpid */
+#include <stdlib.h>    /* getenv, atoi */
+#include <string.h>    /* strchr */
+#include <stdio.h>     /* popen etc. */
+#include <glob.h>      /* glob, of course */
+#include <stdarg.h>    /* va_list */
+#include <errno.h>
+#include <fcntl.h>
+#include <getopt.h>    /* should be pretty obvious */
+
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <signal.h>
+
+/* #include <dmalloc.h> */
+/* #define DEBUG_SHELL */
+
+#ifdef BB_VER
+#include "busybox.h"
+#include "cmdedit.h"
+#else
+/* in place of #include "busybox.h"; much of this is indeed
+ * pasted in from the copy of busybox.h in busybox-0.49pre */
+
+#define xrealloc realloc
+#define applet_name "hush"
+#define shell_main main
+
+extern void *xmalloc(size_t size)
+{
+	void *ptr = malloc(size);
+
+	if (!ptr) {
+		fprintf(stderr, "memory_exhausted\n");
+		exit (EXIT_FAILURE);
+	}
+	return ptr;
+}
+
+extern void usage(const char *usage)
+{
+	fprintf(stderr, "Usage: %s\n", usage);
+	exit(EXIT_FAILURE);
+}
+
+static void verror_msg(const char *s, va_list p)
+{
+	fflush(stdout);
+	fprintf(stderr, "%s: ", applet_name);
+	vfprintf(stderr, s, p);
+	fflush(stderr);
+}
+
+extern void error_msg(const char *s, ...)
+{
+	va_list p;
+
+	va_start(p, s);
+	verror_msg(s, p);
+	va_end(p);
+}
+
+extern void error_msg_and_die(const char *s, ...)
+{
+	va_list p;
+
+	va_start(p, s);
+	verror_msg(s, p);
+	va_end(p);
+	exit(EXIT_FAILURE);
+}
+
+static void vperror_msg(const char *s, va_list p)
+{
+	fflush(stdout);
+	fprintf(stderr, "%s: ", applet_name);
+	if (s && *s) {
+		vfprintf(stderr, s, p);
+		fputs(": ", stderr);
+	}
+	fprintf(stderr, "%s\n", strerror(errno));
+	fflush(stderr);
+}
+
+extern void perror_msg(const char *s, ...)
+{
+	va_list p;
+
+	va_start(p, s);
+	vperror_msg(s, p);
+	va_end(p);
+}
+
+extern void perror_msg_and_die(const char *s, ...)
+{
+	va_list p;
+
+	va_start(p, s);
+	vperror_msg(s, p);
+	va_end(p);
+	exit(EXIT_FAILURE);
+}
+
+FILE *xfopen(const char *path, const char *mode)
+{
+	FILE *fp;
+	if ((fp = fopen(path, mode)) == NULL)
+		perror_msg_and_die(path);
+	return fp;
+}
+#endif  /* of busybox.h replacement */
+
+typedef enum {
+	REDIRECT_INPUT     = 1,
+	REDIRECT_OVERWRITE = 2,
+	REDIRECT_APPEND    = 3,
+	REDIRECT_HEREIS    = 4,
+	REDIRECT_IO        = 5
+} redir_type;
+
+/* The descrip member of this structure is only used to make debugging
+ * output pretty */
+struct {int mode; int default_fd; char *descrip;} redir_table[] = {
+	{ 0,                         0, "()" },
+	{ O_RDONLY,                  0, "<"  },
+	{ O_CREAT|O_TRUNC|O_WRONLY,  1, ">"  },
+	{ O_CREAT|O_APPEND|O_WRONLY, 1, ">>" },
+	{ O_RDONLY,                 -1, "<<" },
+	{ O_RDWR,                    1, "<>" }
+};
+
+typedef enum {
+	PIPE_SEQ = 1,
+	PIPE_AND = 2,
+	PIPE_OR  = 3,
+	PIPE_BG  = 4,
+} pipe_style;
+
+/* might eventually control execution */
+typedef enum {
+	RES_NONE  = 0,
+	RES_IF    = 1,
+	RES_THEN  = 2,
+	RES_ELIF  = 3,
+	RES_ELSE  = 4,
+	RES_FI    = 5,
+	RES_FOR   = 6,
+	RES_WHILE = 7,
+	RES_UNTIL = 8,
+	RES_DO    = 9,
+	RES_DONE  = 10,
+	RES_XXXX  = 11
+} reserved_style;
+#define FLAG_END   (1<<RES_NONE)
+#define FLAG_IF    (1<<RES_IF)
+#define FLAG_THEN  (1<<RES_THEN)
+#define FLAG_ELIF  (1<<RES_ELIF)
+#define FLAG_ELSE  (1<<RES_ELSE)
+#define FLAG_FI    (1<<RES_FI)
+#define FLAG_FOR   (1<<RES_FOR)
+#define FLAG_WHILE (1<<RES_WHILE)
+#define FLAG_UNTIL (1<<RES_UNTIL)
+#define FLAG_DO    (1<<RES_DO)
+#define FLAG_DONE  (1<<RES_DONE)
+#define FLAG_START (1<<RES_XXXX)
+
+/* This holds pointers to the various results of parsing */
+struct p_context {
+	struct child_prog *child;
+	struct pipe *list_head;
+	struct pipe *pipe;
+	struct redir_struct *pending_redirect;
+	reserved_style w;
+	int old_flag;				/* for figuring out valid reserved words */
+	struct p_context *stack;
+	/* How about quoting status? */
+};
+
+struct redir_struct {
+	redir_type type;			/* type of redirection */
+	int fd;						/* file descriptor being redirected */
+	int dup;					/* -1, or file descriptor being duplicated */
+	struct redir_struct *next;	/* pointer to the next redirect in the list */ 
+	glob_t word;				/* *word.gl_pathv is the filename */
+};
+
+struct child_prog {
+	pid_t pid;					/* 0 if exited */
+	char **argv;				/* program name and arguments */
+	struct pipe *group;			/* if non-NULL, first in group or subshell */
+	int subshell;				/* flag, non-zero if group must be forked */
+	struct redir_struct *redirects;	/* I/O redirections */
+	glob_t glob_result;			/* result of parameter globbing */
+	int is_stopped;				/* is the program currently running? */
+	struct pipe *family;		/* pointer back to the child's parent pipe */
+};
+
+struct pipe {
+	int jobid;					/* job number */
+	int num_progs;				/* total number of programs in job */
+	int running_progs;			/* number of programs running */
+	char *text;					/* name of job */
+	char *cmdbuf;				/* buffer various argv's point into */
+	pid_t pgrp;					/* process group ID for the job */
+	struct child_prog *progs;	/* array of commands in pipe */
+	struct pipe *next;			/* to track background commands */
+	int stopped_progs;			/* number of programs alive, but stopped */
+	int job_context;			/* bitmask defining current context */
+	pipe_style followup;		/* PIPE_BG, PIPE_SEQ, PIPE_OR, PIPE_AND */
+	reserved_style r_mode;		/* supports if, for, while, until */
+	struct jobset *job_list;
+};
+
+struct jobset {
+	struct pipe *head;			/* head of list of running jobs */
+	struct pipe *fg;			/* current foreground job */
+};
+
+struct close_me {
+	int fd;
+	struct close_me *next;
+};
+
+/* globals, connect us to the outside world
+ * the first three support $?, $#, and $1 */
+char **global_argv;
+unsigned int global_argc;
+unsigned int last_return_code;
+extern char **environ; /* This is in <unistd.h>, but protected with __USE_GNU */
+ 
+/* Variables we export */
+unsigned int shell_context;  /* Used in cmdedit.c to reset the
+                              * context when someone hits ^C */
+
+/* "globals" within this file */
+static char *ifs=NULL;
+static char map[256];
+static int fake_mode=0;
+static int interactive=0;
+static struct close_me *close_me_head = NULL;
+static char *cwd;
+static struct jobset job_list = { NULL, NULL };
+static unsigned int last_bg_pid=0;
+static char *PS1;
+static char *PS2 = "> ";
+
+#define B_CHUNK (100)
+#define B_NOSPAC 1
+#define MAX_LINE 256       /* for cwd */
+#define MAX_READ 256       /* for builtin_read */
+
+typedef struct {
+	char *data;
+	int length;
+	int maxlen;
+	int quote;
+	int nonnull;
+} o_string;
+#define NULL_O_STRING {NULL,0,0,0,0}
+/* used for initialization:
+	o_string foo = NULL_O_STRING; */
+
+/* I can almost use ordinary FILE *.  Is open_memstream() universally
+ * available?  Where is it documented? */
+struct in_str {
+	const char *p;
+	int __promptme;
+	int promptmode;
+	FILE *file;
+	int (*get) (struct in_str *);
+	int (*peek) (struct in_str *);
+};
+#define b_getch(input) ((input)->get(input))
+#define b_peek(input) ((input)->peek(input))
+
+#define JOB_STATUS_FORMAT "[%d] %-22s %.40s\n"
+
+struct built_in_command {
+	char *cmd;					/* name */
+	char *descr;				/* description */
+	int (*function) (struct child_prog *);	/* function ptr */
+};
+
+/* belongs in busybox.h */
+static inline int max(int a, int b) {
+	return (a>b)?a:b;
+}
+
+/* This should be in utility.c */
+#ifdef DEBUG_SHELL
+static void debug_printf(const char *format, ...)
+{
+	va_list args;
+	va_start(args, format);
+	vfprintf(stderr, format, args);
+	va_end(args);
+}
+#else
+static void debug_printf(const char *format, ...) { }
+#endif
+#define final_printf debug_printf
+
+void __syntax(char *file, int line) {
+	fprintf(stderr,"syntax error %s:%d\n",file,line);
+}
+#define syntax() __syntax(__FILE__, __LINE__)
+
+/* Index of subroutines: */
+/*   function prototypes for builtins */
+static int builtin_cd(struct child_prog *child);
+static int builtin_env(struct child_prog *child);
+static int builtin_exec(struct child_prog *child);
+static int builtin_exit(struct child_prog *child);
+static int builtin_export(struct child_prog *child);
+static int builtin_fg_bg(struct child_prog *child);
+static int builtin_help(struct child_prog *child);
+static int builtin_jobs(struct child_prog *child);
+static int builtin_pwd(struct child_prog *child);
+static int builtin_read(struct child_prog *child);
+static int builtin_shift(struct child_prog *child);
+static int builtin_source(struct child_prog *child);
+static int builtin_ulimit(struct child_prog *child);
+static int builtin_umask(struct child_prog *child);
+static int builtin_unset(struct child_prog *child);
+/*   o_string manipulation: */
+static int b_check_space(o_string *o, int len);
+static int b_addchr(o_string *o, int ch);
+static void b_reset(o_string *o);
+static int b_addqchr(o_string *o, int ch, int quote);
+static int b_adduint(o_string *o, unsigned int i);
+/*  in_str manipulations: */
+static int static_get(struct in_str *i);
+static int static_peek(struct in_str *i);
+static int file_get(struct in_str *i);
+static int file_peek(struct in_str *i);
+static void setup_file_in_str(struct in_str *i, FILE *f);
+static void setup_string_in_str(struct in_str *i, const char *s);
+/*  close_me manipulations: */
+static void mark_open(int fd);
+static void mark_closed(int fd);
+static void close_all();
+/*  "run" the final data structures: */
+static char *indenter(int i);
+static int run_list_test(struct pipe *head, int indent);
+static int run_pipe_test(struct pipe *pi, int indent);
+/*  really run the final data structures: */
+static int setup_redirects(struct child_prog *prog, int squirrel[]);
+static int pipe_wait(struct pipe *pi);
+static int run_list_real(struct pipe *pi);
+static void pseudo_exec(struct child_prog *child) __attribute__ ((noreturn));
+static int run_pipe_real(struct pipe *pi);
+/*   extended glob support: */
+static int globhack(const char *src, int flags, glob_t *pglob);
+static int glob_needed(const char *s);
+static int xglob(o_string *dest, int flags, glob_t *pglob);
+/*   data structure manipulation: */
+static int setup_redirect(struct p_context *ctx, int fd, redir_type style, struct in_str *input);
+static void initialize_context(struct p_context *ctx);
+static int done_word(o_string *dest, struct p_context *ctx);
+static int done_command(struct p_context *ctx);
+static int done_pipe(struct p_context *ctx, pipe_style type);
+/*   primary string parsing: */
+static int redirect_dup_num(struct in_str *input);
+static int redirect_opt_num(o_string *o);
+static int process_command_subs(o_string *dest, struct p_context *ctx, struct in_str *input, int subst_end);
+static int parse_group(o_string *dest, struct p_context *ctx, struct in_str *input, int ch);
+static void lookup_param(o_string *dest, struct p_context *ctx, o_string *src);
+static int handle_dollar(o_string *dest, struct p_context *ctx, struct in_str *input);
+static int parse_string(o_string *dest, struct p_context *ctx, const char *src);
+static int parse_stream(o_string *dest, struct p_context *ctx, struct in_str *input0, int end_trigger);
+/*   setup: */
+static int parse_stream_outer(struct in_str *inp);
+static int parse_string_outer(const char *s);
+static int parse_file_outer(FILE *f);
+
+/* Table of built-in functions.  They can be forked or not, depending on
+ * context: within pipes, they fork.  As simple commands, they do not.
+ * When used in non-forking context, they can change global variables
+ * in the parent shell process.  If forked, of course they can not.
+ * For example, 'unset foo | whatever' will parse and run, but foo will
+ * still be set at the end. */
+static struct built_in_command bltins[] = {
+	{"bg", "Resume a job in the background", builtin_fg_bg},
+	{"cd", "Change working directory", builtin_cd},
+	{"env", "Print all environment variables", builtin_env},
+	{"exec", "Exec command, replacing this shell with the exec'd process", builtin_exec},
+	{"exit", "Exit from shell()", builtin_exit},
+	{"export", "Set environment variable", builtin_export},
+	{"fg", "Bring job into the foreground", builtin_fg_bg},
+	{"jobs", "Lists the active jobs", builtin_jobs},
+	{"pwd", "Print current directory", builtin_pwd},
+	{"read", "Input environment variable", builtin_read},
+	{"shift", "Shift positional parameters", builtin_shift},
+	{"ulimit","Controls resource limits", builtin_ulimit},
+	{"umask","Sets file creation mask", builtin_umask},
+	{"unset", "Unset environment variable", builtin_unset},
+	{".", "Source-in and run commands in a file", builtin_source},
+	{"help", "List shell built-in commands", builtin_help},
+	{NULL, NULL, NULL}
+};
+
+/* built-in 'cd <path>' handler */
+static int builtin_cd(struct child_prog *child)
+{
+	char *newdir;
+	if (child->argv[1] == NULL)
+		newdir = getenv("HOME");
+	else
+		newdir = child->argv[1];
+	if (chdir(newdir)) {
+		printf("cd: %s: %s\n", newdir, strerror(errno));
+		return EXIT_FAILURE;
+	}
+	getcwd(cwd, sizeof(char)*MAX_LINE);
+	return EXIT_SUCCESS;
+}
+
+/* built-in 'env' handler */
+static int builtin_env(struct child_prog *dummy)
+{
+	char **e = environ;
+	if (e == NULL) return EXIT_FAILURE;
+	for (; *e; e++) {
+		puts(*e);
+	}
+	return EXIT_SUCCESS;
+}
+
+/* built-in 'exec' handler */
+static int builtin_exec(struct child_prog *child)
+{
+	if (child->argv[1] == NULL)
+		return EXIT_SUCCESS;   /* Really? */
+	child->argv++;
+	pseudo_exec(child);
+	/* never returns */
+}
+
+/* built-in 'exit' handler */
+static int builtin_exit(struct child_prog *child)
+{
+	if (child->argv[1] == NULL)
+		exit(EXIT_SUCCESS);
+	exit (atoi(child->argv[1]));
+}
+
+/* built-in 'export VAR=value' handler */
+static int builtin_export(struct child_prog *child)
+{
+	int res;
+
+	if (child->argv[1] == NULL) {
+		return (builtin_env(child));
+	}
+	res = putenv(child->argv[1]);
+	if (res)
+		fprintf(stderr, "export: %s\n", strerror(errno));
+	return (res);
+}
+
+/* built-in 'fg' and 'bg' handler */
+static int builtin_fg_bg(struct child_prog *child)
+{
+	int i, jobNum;
+	struct pipe *job=NULL;
+	
+	if (!child->argv[1] || child->argv[2]) {
+		error_msg("%s: exactly one argument is expected\n",
+				child->argv[0]);
+		return EXIT_FAILURE;
+	}
+
+	if (sscanf(child->argv[1], "%%%d", &jobNum) != 1) {
+		error_msg("%s: bad argument '%s'\n",
+				child->argv[0], child->argv[1]);
+		return EXIT_FAILURE;
+	}
+
+	for (job = child->family->job_list->head; job; job = job->next) {
+		if (job->jobid == jobNum) {
+			break;
+		}
+	}
+
+	if (!job) {
+		error_msg("%s: unknown job %d\n",
+				child->argv[0], jobNum);
+		return EXIT_FAILURE;
+	}
+
+	if (*child->argv[0] == 'f') {
+		/* Make this job the foreground job */
+		/* suppress messages when run from /linuxrc mag@sysgo.de */
+		if (tcsetpgrp(0, job->pgrp) && errno != ENOTTY)
+			perror_msg("tcsetpgrp"); 
+		child->family->job_list->fg = job;
+	}
+
+	/* Restart the processes in the job */
+	for (i = 0; i < job->num_progs; i++)
+		job->progs[i].is_stopped = 0;
+
+	kill(-job->pgrp, SIGCONT);
+
+	job->stopped_progs = 0;
+	return EXIT_SUCCESS;
+}
+
+/* built-in 'help' handler */
+static int builtin_help(struct child_prog *dummy)
+{
+	struct built_in_command *x;
+
+	printf("\nBuilt-in commands:\n");
+	printf("-------------------\n");
+	for (x = bltins; x->cmd; x++) {
+		if (x->descr==NULL)
+			continue;
+		printf("%s\t%s\n", x->cmd, x->descr);
+	}
+	printf("\n\n");
+	return EXIT_SUCCESS;
+}
+
+/* built-in 'jobs' handler */
+static int builtin_jobs(struct child_prog *child)
+{
+	struct pipe *job;
+	char *status_string;
+
+	for (job = child->family->job_list->head; job; job = job->next) {
+		if (job->running_progs == job->stopped_progs)
+			status_string = "Stopped";
+		else
+			status_string = "Running";
+		printf(JOB_STATUS_FORMAT, job->jobid, status_string, job->text);
+	}
+	return EXIT_SUCCESS;
+}
+
+
+/* built-in 'pwd' handler */
+static int builtin_pwd(struct child_prog *dummy)
+{
+	getcwd(cwd, MAX_LINE);
+	puts(cwd);
+	return EXIT_SUCCESS;
+}
+
+/* built-in 'read VAR' handler */
+static int builtin_read(struct child_prog *child)
+{
+	int res = 0, len, newlen;
+	char *s;
+	char string[MAX_READ];
+
+	if (child->argv[1]) {
+		/* argument (VAR) given: put "VAR=" into buffer */
+		strcpy(string, child->argv[1]);
+		len = strlen(string);
+		string[len++] = '=';
+		string[len]   = '\0';
+		/* XXX would it be better to go through in_str? */
+		fgets(&string[len], sizeof(string) - len, stdin);	/* read string */
+		newlen = strlen(string);
+		if(newlen > len)
+			string[--newlen] = '\0';	/* chomp trailing newline */
+		/*
+		** string should now contain "VAR=<value>"
+		** copy it (putenv() won't do that, so we must make sure
+		** the string resides in a static buffer!)
+		*/
+		res = -1;
+		if((s = strdup(string)))
+			res = putenv(s);
+		if (res)
+			fprintf(stderr, "read: %s\n", strerror(errno));
+	}
+	else
+		fgets(string, sizeof(string), stdin);
+
+	return (res);
+}
+
+/* Built-in 'shift' handler */
+static int builtin_shift(struct child_prog *child)
+{
+	int n=1;
+	if (child->argv[1]) {
+		n=atoi(child->argv[1]);
+	}
+	if (n>=0 && n<global_argc) {
+		/* XXX This probably breaks $0 */
+		global_argc -= n;
+		global_argv += n;
+		return EXIT_SUCCESS;
+	} else {
+		return EXIT_FAILURE;
+	}
+}
+
+/* Built-in '.' handler (read-in and execute commands from file) */
+static int builtin_source(struct child_prog *child)
+{
+	FILE *input;
+	int status;
+
+	if (child->argv[1] == NULL)
+		return EXIT_FAILURE;
+
+	/* XXX search through $PATH is missing */
+	input = fopen(child->argv[1], "r");
+	if (!input) {
+		fprintf(stderr, "Couldn't open file '%s'\n", child->argv[1]);
+		return EXIT_FAILURE;
+	}
+
+	/* Now run the file */
+	/* XXX argv and argc are broken; need to save old global_argv
+	 * (pointer only is OK!) on this stack frame,
+	 * set global_argv=child->argv+1, recurse, and restore. */
+	mark_open(fileno(input));
+	status = parse_file_outer(input);
+	mark_closed(fileno(input));
+	fclose(input);
+	return (status);
+}
+
+static int builtin_ulimit(struct child_prog *child)
+{
+	printf("builtin_ulimit not written\n");
+	return EXIT_FAILURE;
+}
+
+static int builtin_umask(struct child_prog *child)
+{
+	printf("builtin_umask not written\n");
+	return EXIT_FAILURE;
+}
+
+/* built-in 'unset VAR' handler */
+static int builtin_unset(struct child_prog *child)
+{
+	if (child->argv[1] == NULL) {
+		fprintf(stderr, "unset: parameter required.\n");
+		return EXIT_FAILURE;
+	}
+	unsetenv(child->argv[1]);
+	return EXIT_SUCCESS;
+}
+
+static int b_check_space(o_string *o, int len)
+{
+	/* It would be easy to drop a more restrictive policy
+	 * in here, such as setting a maximum string length */
+	if (o->length + len > o->maxlen) {
+		char *old_data = o->data;
+		/* assert (data == NULL || o->maxlen != 0); */
+		o->maxlen += max(2*len, B_CHUNK);
+		o->data = realloc(o->data, 1 + o->maxlen);
+		if (o->data == NULL) {
+			free(old_data);
+		}
+	}
+	return o->data == NULL;
+}
+
+static int b_addchr(o_string *o, int ch)
+{
+	debug_printf("b_addchr: %c %d %p\n", ch, o->length, o);
+	if (b_check_space(o, 1)) return B_NOSPAC;
+	o->data[o->length] = ch;
+	o->length++;
+	o->data[o->length] = '\0';
+	return 0;
+}
+
+static void b_reset(o_string *o)
+{
+	o->length = 0;
+	o->nonnull = 0;
+	if (o->data != NULL) *o->data = '\0';
+}
+
+static void b_free(o_string *o)
+{
+	b_reset(o);
+	if (o->data != NULL) free(o->data);
+	o->data = NULL;
+	o->maxlen = 0;
+}
+
+/* My analysis of quoting semantics tells me that state information
+ * is associated with a destination, not a source.
+ */
+static int b_addqchr(o_string *o, int ch, int quote)
+{
+	if (quote && strchr("*?[\\",ch)) {
+		int rc;
+		rc = b_addchr(o, '\\');
+		if (rc) return rc;
+	}
+	return b_addchr(o, ch);
+}
+
+/* belongs in utility.c */
+char *simple_itoa(unsigned int i)
+{
+	/* 21 digits plus null terminator, good for 64-bit or smaller ints */
+	static char local[22];
+	char *p = &local[21];
+	*p-- = '\0';
+	do {
+		*p-- = '0' + i % 10;
+		i /= 10;
+	} while (i > 0);
+	return p + 1;
+}
+
+static int b_adduint(o_string *o, unsigned int i)
+{
+	int r;
+	char *p = simple_itoa(i);
+	/* no escape checking necessary */
+	do r=b_addchr(o, *p++); while (r==0 && *p);
+	return r;
+}
+
+static int static_get(struct in_str *i)
+{
+	int ch=*i->p++;
+	if (ch=='\0') return EOF;
+	return ch;
+}
+
+static int static_peek(struct in_str *i)
+{
+	return *i->p;
+}
+
+static inline void cmdedit_set_initial_prompt(void)
+{
+#ifdef BB_FEATURE_SH_SIMPLE_PROMPT
+	PS1 = NULL;
+#else
+	PS1 = getenv("PS1");
+	if(PS1==0)
+		PS1 = "\\w \\$ ";
+#endif	
+}
+
+static inline void setup_prompt_string(int promptmode, char **prompt_str)
+{
+#ifdef BB_FEATURE_SH_SIMPLE_PROMPT
+	/* Set up the prompt */
+	if (promptmode == 1) {
+		if (PS1)
+			free(PS1);
+		PS1=xmalloc(strlen(cwd)+4);
+		sprintf(PS1, "%s %s", cwd, ( geteuid() != 0 ) ?  "$ ":"# ");
+		*prompt_str = PS1;
+	} else {
+		*prompt_str = PS2;
+	}
+#else
+	*prompt_str = (promptmode==0)? PS1 : PS2;
+#endif	
+}
+
+static void get_user_input(struct in_str *i)
+{
+	char *prompt_str;
+	static char the_command[MAX_LINE];
+
+	setup_prompt_string(i->promptmode, &prompt_str);
+#ifdef BB_FEATURE_COMMAND_EDITING
+	/*
+	 ** enable command line editing only while a command line
+	 ** is actually being read; otherwise, we'll end up bequeathing
+	 ** atexit() handlers and other unwanted stuff to our
+	 ** child processes (rob@sysgo.de)
+	 */
+	cmdedit_read_input(prompt_str, the_command);
+	cmdedit_terminate();
+#else
+	fputs(prompt_str, stdout);
+	fflush(stdout);
+	the_command[0]=fgetc(i->file);
+	the_command[1]='\0';
+#endif
+	i->p = the_command;
+}
+
+/* This is the magic location that prints prompts 
+ * and gets data back from the user */
+static int file_get(struct in_str *i)
+{
+	int ch;
+
+	ch = 0;
+	/* If there is data waiting, eat it up */
+	if (i->p && *i->p) {
+		ch=*i->p++;
+	} else {
+		/* need to double check i->file because we might be doing something
+		 * more complicated by now, like sourcing or substituting. */
+		if (i->__promptme && interactive && i->file == stdin) {
+			get_user_input(i);
+			i->promptmode=2;
+		}
+		i->__promptme = 0;
+
+		if (i->p && *i->p) {
+			ch=*i->p++;
+		}
+		debug_printf("b_getch: got a %d\n", ch);
+	}
+	if (ch == '\n') i->__promptme=1;
+	return ch;
+}
+
+/* All the callers guarantee this routine will never be
+ * used right after a newline, so prompting is not needed.
+ */
+static int file_peek(struct in_str *i)
+{
+	if (i->p && *i->p) {
+		return *i->p;
+	} else {
+		static char buffer;
+		buffer = fgetc(i->file);
+		i->p = &buffer;
+		debug_printf("b_peek: got a %d\n", *i->p);
+		return *i->p; 
+	}
+}
+
+static void setup_file_in_str(struct in_str *i, FILE *f)
+{
+	i->peek = file_peek;
+	i->get = file_get;
+	i->__promptme=1;
+	i->promptmode=1;
+	i->file = f;
+	i->p = NULL;
+}
+
+static void setup_string_in_str(struct in_str *i, const char *s)
+{
+	i->peek = static_peek;
+	i->get = static_get;
+	i->__promptme=1;
+	i->promptmode=1;
+	i->p = s;
+}
+
+static void mark_open(int fd)
+{
+	struct close_me *new = xmalloc(sizeof(struct close_me));
+	new->fd = fd;
+	new->next = close_me_head;
+	close_me_head = new;
+}
+
+static void mark_closed(int fd)
+{
+	struct close_me *tmp;
+	if (close_me_head == NULL || close_me_head->fd != fd)
+		error_msg_and_die("corrupt close_me");
+	tmp = close_me_head;
+	close_me_head = close_me_head->next;
+	free(tmp);
+}
+
+static void close_all()
+{
+	struct close_me *c;
+	for (c=close_me_head; c; c=c->next) {
+		close(c->fd);
+	}
+	close_me_head = NULL;
+}
+
+/* squirrel != NULL means we squirrel away copies of stdin, stdout,
+ * and stderr if they are redirected. */
+static int setup_redirects(struct child_prog *prog, int squirrel[])
+{
+	int openfd, mode;
+	struct redir_struct *redir;
+
+	for (redir=prog->redirects; redir; redir=redir->next) {
+		if (redir->dup == -1) {
+			mode=redir_table[redir->type].mode;
+			openfd = open(redir->word.gl_pathv[0], mode, 0666);
+			if (openfd < 0) {
+			/* this could get lost if stderr has been redirected, but
+			   bash and ash both lose it as well (though zsh doesn't!) */
+				fprintf(stderr,"error opening %s: %s\n", redir->word.gl_pathv[0],
+					strerror(errno));
+				return 1;
+			}
+		} else {
+			openfd = redir->dup;
+		}
+
+		if (openfd != redir->fd) {
+			if (squirrel && redir->fd < 3) {
+				squirrel[redir->fd] = dup(redir->fd);
+			}
+			dup2(openfd, redir->fd);
+			close(openfd);
+		}
+	}
+	return 0;
+}
+
+static void restore_redirects(int squirrel[])
+{
+	int i, fd;
+	for (i=0; i<3; i++) {
+		fd = squirrel[i];
+		if (fd != -1) {
+			/* No error checking.  I sure wouldn't know what
+			 * to do with an error if I found one! */
+			dup2(fd, i);
+			close(fd);
+		}
+	}
+}
+
+/* XXX this definitely needs some more thought, work, and
+ * cribbing from other shells */
+static int pipe_wait(struct pipe *pi)
+{
+	int rcode=0, i, pid, running, status;
+	running = pi->num_progs;
+	while (running) {
+		pid=waitpid(-1, &status, 0);
+		if (pid < 0) perror_msg_and_die("waitpid");
+		for (i=0; i < pi->num_progs; i++) {
+			if (pi->progs[i].pid == pid) {
+				if (i==pi->num_progs-1) rcode=WEXITSTATUS(status);
+				pi->progs[i].pid = 0;
+				running--;
+				break;
+			}
+		}
+	}
+	return rcode;
+}
+
+/* very simple version for testing */
+static void pseudo_exec(struct child_prog *child)
+{
+	int rcode;
+	struct built_in_command *x;
+	if (child->argv) {
+		/*
+		 * Check if the command matches any of the builtins.
+		 * Depending on context, this might be redundant.  But it's
+		 * easier to waste a few CPU cycles than it is to figure out
+		 * if this is one of those cases.
+		 */
+		for (x = bltins; x->cmd; x++) {
+			if (strcmp(child->argv[0], x->cmd) == 0 ) {
+				debug_printf("builtin exec %s\n", child->argv[0]);
+				exit(x->function(child));
+			}
+		}
+		debug_printf("exec of %s\n",child->argv[0]);
+		execvp(child->argv[0],child->argv);
+		perror("execvp");
+		exit(1);
+	} else if (child->group) {
+		debug_printf("runtime nesting to group\n");
+		interactive=0;    /* crucial!!!! */
+		rcode = run_list_real(child->group);
+		/* OK to leak memory by not calling run_list_test,
+		 * since this process is about to exit */
+		exit(rcode);
+	} else {
+		/* Can happen.  See what bash does with ">foo" by itself. */
+		debug_printf("trying to pseudo_exec null command\n");
+		exit(EXIT_SUCCESS);
+	}
+}
+
+/* run_pipe_real() starts all the jobs, but doesn't wait for anything
+ * to finish.  See pipe_wait().
+ *
+ * return code is normally -1, when the caller has to wait for children
+ * to finish to determine the exit status of the pipe.  If the pipe
+ * is a simple builtin command, however, the action is done by the
+ * time run_pipe_real returns, and the exit code is provided as the
+ * return value.
+ *
+ * The input of the pipe is always stdin, the output is always
+ * stdout.  The outpipe[] mechanism in BusyBox-0.48 lash is bogus,
+ * because it tries to avoid running the command substitution in
+ * subshell, when that is in fact necessary.  The subshell process
+ * now has its stdout directed to the input of the appropriate pipe,
+ * so this routine is noticeably simpler.
+ */
+static int run_pipe_real(struct pipe *pi)
+{
+	int i;
+	int nextin, nextout;
+	int pipefds[2];				/* pipefds[0] is for reading */
+	struct child_prog *child;
+	struct built_in_command *x;
+
+	nextin = 0;
+	pi->pgrp = 0;
+
+	/* Check if this is a simple builtin (not part of a pipe).
+	 * Builtins within pipes have to fork anyway, and are handled in
+	 * pseudo_exec.  "echo foo | read bar" doesn't work on bash, either.
+	 */
+	if (pi->num_progs == 1 && pi->progs[0].argv != NULL) {
+		child = & (pi->progs[0]);
+		if (child->group && ! child->subshell) {
+			int squirrel[] = {-1, -1, -1};
+			int rcode;
+			debug_printf("non-subshell grouping\n");
+			setup_redirects(child, squirrel);
+			/* XXX could we merge code with following builtin case,
+			 * by creating a pseudo builtin that calls run_list_real? */
+			rcode = run_list_real(child->group);
+			restore_redirects(squirrel);
+			return rcode;
+		}
+		for (x = bltins; x->cmd; x++) {
+			if (strcmp(child->argv[0], x->cmd) == 0 ) {
+				int squirrel[] = {-1, -1, -1};
+				int rcode;
+				debug_printf("builtin inline %s\n", child->argv[0]);
+				/* XXX setup_redirects acts on file descriptors, not FILEs.
+				 * This is perfect for work that comes after exec().
+				 * Is it really safe for inline use?  Experimentally,
+				 * things seem to work with glibc. */
+				setup_redirects(child, squirrel);
+				rcode = x->function(child);
+				restore_redirects(squirrel);
+				return rcode;
+			}
+		}
+	}
+
+	for (i = 0; i < pi->num_progs; i++) {
+		child = & (pi->progs[i]);
+
+		/* pipes are inserted between pairs of commands */
+		if ((i + 1) < pi->num_progs) {
+			if (pipe(pipefds)<0) perror_msg_and_die("pipe");
+			nextout = pipefds[1];
+		} else {
+			nextout=1;
+			pipefds[0] = -1;
+		}
+
+		/* XXX test for failed fork()? */
+		if (!(child->pid = fork())) {
+			close_all();
+
+			if (nextin != 0) {
+				dup2(nextin, 0);
+				close(nextin);
+			}
+			if (nextout != 1) {
+				dup2(nextout, 1);
+				close(nextout);
+			}
+			if (pipefds[0]!=-1) {
+				close(pipefds[0]);  /* opposite end of our output pipe */
+			}
+
+			/* Like bash, explicit redirects override pipes,
+			 * and the pipe fd is available for dup'ing. */
+			setup_redirects(child,NULL);
+
+			pseudo_exec(child);
+		}
+		if (interactive) {
+			/* Put our child in the process group whose leader is the
+			 * first process in this pipe. */
+			if (pi->pgrp==0) {
+				pi->pgrp = child->pid;
+			}
+			/* Don't check for errors.  The child may be dead already,
+			 * in which case setpgid returns error code EACCES. */
+			setpgid(child->pid, pi->pgrp);
+		}
+		/* In the non-interactive case, do nothing.  Leave the children
+		 * with the process group that they inherited from us. */
+	
+		if (nextin != 0)
+			close(nextin);
+		if (nextout != 1)
+			close(nextout);
+
+		/* If there isn't another process, nextin is garbage 
+		   but it doesn't matter */
+		nextin = pipefds[0];
+	}
+	return -1;
+}
+
+static int run_list_real(struct pipe *pi)
+{
+	int rcode=0;
+	int if_code=0, next_if_code=0;  /* need double-buffer to handle elif */
+	reserved_style rmode=RES_NONE;
+	for (;pi;pi=pi->next) {
+		rmode = pi->r_mode;
+		debug_printf("rmode=%d  if_code=%d  next_if_code=%d\n", rmode, if_code, next_if_code);
+		if (rmode == RES_THEN || rmode == RES_ELSE) if_code = next_if_code;
+		if (rmode == RES_THEN &&  if_code) continue;
+		if (rmode == RES_ELSE && !if_code) continue;
+		if (rmode == RES_ELIF && !if_code) continue;
+		if (pi->num_progs == 0) break;
+		rcode = run_pipe_real(pi);
+		if (rcode!=-1) {
+			/* We only ran a builtin: rcode was set by the return value
+			 * of run_pipe_real(), and we don't need to wait for anything. */
+		} else if (pi->followup==PIPE_BG) {
+			/* XXX check bash's behavior with nontrivial pipes */
+			/* XXX compute jobid */
+			/* XXX what does bash do with attempts to background builtins? */
+			printf("[%d] %d\n", pi->jobid, pi->pgrp);
+			last_bg_pid = pi->pgrp;
+			rcode = EXIT_SUCCESS;
+		} else {
+			if (interactive) {
+				/* move the new process group into the foreground */
+				/* suppress messages when run from /linuxrc mag@sysgo.de */
+				signal(SIGTTIN, SIG_IGN);
+				signal(SIGTTOU, SIG_IGN);
+				if (tcsetpgrp(0, pi->pgrp) && errno != ENOTTY)
+					perror_msg("tcsetpgrp");
+				rcode = pipe_wait(pi);
+				if (tcsetpgrp(0, getpid()) && errno != ENOTTY)
+					perror_msg("tcsetpgrp");
+				signal(SIGTTIN, SIG_DFL);
+				signal(SIGTTOU, SIG_DFL);
+			} else {
+				rcode = pipe_wait(pi);
+			}
+		}
+		last_return_code=rcode;
+		if ( rmode == RES_IF || rmode == RES_ELIF )
+			next_if_code=rcode;  /* can be overwritten a number of times */
+		if ( (rcode==EXIT_SUCCESS && pi->followup==PIPE_OR) ||
+		     (rcode!=EXIT_SUCCESS && pi->followup==PIPE_AND) )
+			return rcode;  /* XXX broken if list is part of if/then/else */
+	}
+	return rcode;
+}
+
+/* broken, of course, but OK for testing */
+static char *indenter(int i)
+{
+	static char blanks[]="                                    ";
+	return &blanks[sizeof(blanks)-i-1];
+}
+
+/* return code is the exit status of the pipe */
+static int run_pipe_test(struct pipe *pi, int indent)
+{
+	char **p;
+	struct child_prog *child;
+	struct redir_struct *r, *rnext;
+	int a, i, ret_code=0;
+	char *ind = indenter(indent);
+	final_printf("%s run pipe: (pid %d)\n",ind,getpid());
+	for (i=0; i<pi->num_progs; i++) {
+		child = &pi->progs[i];
+		final_printf("%s  command %d:\n",ind,i);
+		if (child->argv) {
+			for (a=0,p=child->argv; *p; a++,p++) {
+				final_printf("%s   argv[%d] = %s\n",ind,a,*p);
+			}
+			globfree(&child->glob_result);
+			child->argv=NULL;
+		} else if (child->group) {
+			final_printf("%s   begin group (subshell:%d)\n",ind, child->subshell);
+			ret_code = run_list_test(child->group,indent+3);
+			final_printf("%s   end group\n",ind);
+		} else {
+			final_printf("%s   (nil)\n",ind);
+		}
+		for (r=child->redirects; r; r=rnext) {
+			final_printf("%s   redirect %d%s", ind, r->fd, redir_table[r->type].descrip);
+			if (r->dup == -1) {
+				final_printf(" %s\n", *r->word.gl_pathv);
+				globfree(&r->word);
+			} else {
+				final_printf("&%d\n", r->dup);
+			}
+			rnext=r->next;
+			free(r);
+		}
+		child->redirects=NULL;
+	}
+	free(pi->progs);   /* children are an array, they get freed all at once */
+	pi->progs=NULL;
+	return ret_code;
+}
+
+static int run_list_test(struct pipe *head, int indent)
+{
+	int rcode=0;   /* if list has no members */
+	struct pipe *pi, *next;
+	char *ind = indenter(indent);
+	for (pi=head; pi; pi=next) {
+		if (pi->num_progs == 0) break;
+		final_printf("%s pipe reserved mode %d\n", ind, pi->r_mode);
+		rcode = run_pipe_test(pi, indent);
+		final_printf("%s pipe followup code %d\n", ind, pi->followup);
+		next=pi->next;
+		pi->next=NULL;
+		free(pi);
+	}
+	return rcode;	
+}
+
+/* Select which version we will use */
+static int run_list(struct pipe *pi)
+{
+	int rcode=0;
+	if (fake_mode==0) {
+		rcode = run_list_real(pi);
+	} 
+	/* run_list_test has the side effect of clearing memory
+	 * In the long run that function can be merged with run_list_real,
+	 * but doing that now would hobble the debugging effort. */
+	run_list_test(pi,0);
+	return rcode;
+}
+
+/* The API for glob is arguably broken.  This routine pushes a non-matching
+ * string into the output structure, removing non-backslashed backslashes.
+ * If someone can prove me wrong, by performing this function within the
+ * original glob(3) api, feel free to rewrite this routine into oblivion.
+ * Return code (0 vs. GLOB_NOSPACE) matches glob(3).
+ * XXX broken if the last character is '\\', check that before calling.
+ */
+static int globhack(const char *src, int flags, glob_t *pglob)
+{
+	int cnt, pathc;
+	const char *s;
+	char *dest;
+	for (cnt=1, s=src; *s; s++) {
+		if (*s == '\\') s++;
+		cnt++;
+	}
+	dest = malloc(cnt);
+	if (!dest) return GLOB_NOSPACE;
+	if (!(flags & GLOB_APPEND)) {
+		pglob->gl_pathv=NULL;
+		pglob->gl_pathc=0;
+		pglob->gl_offs=0;
+		pglob->gl_offs=0;
+	}
+	pathc = ++pglob->gl_pathc;
+	pglob->gl_pathv = realloc(pglob->gl_pathv, (pathc+1)*sizeof(*pglob->gl_pathv));
+	if (pglob->gl_pathv == NULL) return GLOB_NOSPACE;
+	pglob->gl_pathv[pathc-1]=dest;
+	pglob->gl_pathv[pathc]=NULL;
+	for (s=src; *s; s++, dest++) {
+		if (*s == '\\') s++;
+		*dest = *s;
+	}
+	*dest='\0';
+	return 0;
+}
+
+/* XXX broken if the last character is '\\', check that before calling */
+static int glob_needed(const char *s)
+{
+	for (; *s; s++) {
+		if (*s == '\\') s++;
+		if (strchr("*[?",*s)) return 1;
+	}
+	return 0;
+}
+
+#if 0
+static void globprint(glob_t *pglob)
+{
+	int i;
+	debug_printf("glob_t at %p:\n", pglob);
+	debug_printf("  gl_pathc=%d  gl_pathv=%p  gl_offs=%d  gl_flags=%d\n",
+		pglob->gl_pathc, pglob->gl_pathv, pglob->gl_offs, pglob->gl_flags);
+	for (i=0; i<pglob->gl_pathc; i++)
+		debug_printf("pglob->gl_pathv[%d] = %p = %s\n", i,
+			pglob->gl_pathv[i], pglob->gl_pathv[i]);
+}
+#endif
+
+static int xglob(o_string *dest, int flags, glob_t *pglob)
+{
+	int gr;
+
+ 	/* short-circuit for null word */
+	/* we can code this better when the debug_printf's are gone */
+ 	if (dest->length == 0) {
+ 		if (dest->nonnull) {
+ 			/* bash man page calls this an "explicit" null */
+ 			gr = globhack(dest->data, flags, pglob);
+ 			debug_printf("globhack returned %d\n",gr);
+ 		} else {
+			return 0;
+		}
+ 	} else if (glob_needed(dest->data)) {
+		gr = glob(dest->data, flags, NULL, pglob);
+		debug_printf("glob returned %d\n",gr);
+		if (gr == GLOB_NOMATCH) {
+			/* quote removal, or more accurately, backslash removal */
+			gr = globhack(dest->data, flags, pglob);
+			debug_printf("globhack returned %d\n",gr);
+		}
+	} else {
+		gr = globhack(dest->data, flags, pglob);
+		debug_printf("globhack returned %d\n",gr);
+	}
+	if (gr == GLOB_NOSPACE) {
+		fprintf(stderr,"out of memory during glob\n");
+		exit(1);
+	}
+	if (gr != 0) { /* GLOB_ABORTED ? */
+		fprintf(stderr,"glob(3) error %d\n",gr);
+	}
+	/* globprint(glob_target); */
+	return gr;
+}
+
+/* the src parameter allows us to peek forward to a possible &n syntax
+ * for file descriptor duplication, e.g., "2>&1".
+ * Return code is 0 normally, 1 if a syntax error is detected in src.
+ * Resource errors (in xmalloc) cause the process to exit */
+static int setup_redirect(struct p_context *ctx, int fd, redir_type style,
+	struct in_str *input)
+{
+	struct child_prog *child=ctx->child;
+	struct redir_struct *redir = child->redirects;
+	struct redir_struct *last_redir=NULL;
+
+	/* Create a new redir_struct and drop it onto the end of the linked list */
+	while(redir) {
+		last_redir=redir;
+		redir=redir->next;
+	}
+	redir = xmalloc(sizeof(struct redir_struct));
+	redir->next=NULL;
+	if (last_redir) {
+		last_redir->next=redir;
+	} else {
+		child->redirects=redir;
+	}
+
+	redir->type=style;
+	redir->fd= (fd==-1) ? redir_table[style].default_fd : fd ;
+
+	debug_printf("Redirect type %d%s\n", redir->fd, redir_table[style].descrip);
+
+	/* Check for a '2>&1' type redirect */ 
+	redir->dup = redirect_dup_num(input);
+	if (redir->dup == -2) return 1;  /* syntax error */
+	if (redir->dup != -1) {
+		/* Erik had a check here that the file descriptor in question
+		 * is legit; I postpone that to "run time" */
+		debug_printf("Duplicating redirect '%d>&%d'\n", redir->fd, redir->dup);
+	} else {
+		/* We do _not_ try to open the file that src points to,
+		 * since we need to return and let src be expanded first.
+		 * Set ctx->pending_redirect, so we know what to do at the
+		 * end of the next parsed word.
+		 */
+		ctx->pending_redirect = redir;
+	}
+	return 0;
+}
+
+struct pipe *new_pipe(void) {
+	struct pipe *pi;
+	pi = xmalloc(sizeof(struct pipe));
+	pi->num_progs = 0;
+	pi->progs = NULL;
+	pi->next = NULL;
+	pi->followup = 0;  /* invalid */
+	return pi;
+}
+
+static void initialize_context(struct p_context *ctx)
+{
+	ctx->pipe=NULL;
+	ctx->pending_redirect=NULL;
+	ctx->child=NULL;
+	ctx->list_head=new_pipe();
+	ctx->pipe=ctx->list_head;
+	ctx->w=RES_NONE;
+	ctx->stack=NULL;
+	done_command(ctx);   /* creates the memory for working child */
+}
+
+/* normal return is 0
+ * if a reserved word is found, and processed, return 1
+ * should handle if, then, elif, else, fi, for, while, until, do, done.
+ * case, function, and select are obnoxious, save those for later.
+ */
+int reserved_word(o_string *dest, struct p_context *ctx)
+{
+	struct reserved_combo {
+		char *literal;
+		int code;
+		long flag;
+	};
+	/* Mostly a list of accepted follow-up reserved words.
+	 * FLAG_END means we are done with the sequence, and are ready
+	 * to turn the compound list into a command.
+	 * FLAG_START means the word must start a new compound list.
+	 */
+	static struct reserved_combo reserved_list[] = {
+		{ "if",    RES_IF,    FLAG_THEN | FLAG_START },
+		{ "then",  RES_THEN,  FLAG_ELIF | FLAG_ELSE | FLAG_FI },
+		{ "elif",  RES_ELIF,  FLAG_THEN },
+		{ "else",  RES_ELSE,  FLAG_FI   },
+		{ "fi",    RES_FI,    FLAG_END  },
+		{ "for",   RES_FOR,   FLAG_DO   | FLAG_START },
+		{ "while", RES_WHILE, FLAG_DO   | FLAG_START },
+		{ "until", RES_UNTIL, FLAG_DO   | FLAG_START },
+		{ "do",    RES_DO,    FLAG_DONE },
+		{ "done",  RES_DONE,  FLAG_END  }
+	};
+	struct reserved_combo *r;
+	for (r=reserved_list;
+#define NRES sizeof(reserved_list)/sizeof(struct reserved_combo)
+		r<reserved_list+NRES; r++) {
+		if (strcmp(dest->data, r->literal) == 0) {
+			debug_printf("found reserved word %s, code %d\n",r->literal,r->code);
+			if (r->flag & FLAG_START) {
+				struct p_context *new = xmalloc(sizeof(struct p_context));
+				debug_printf("push stack\n");
+				*new = *ctx;   /* physical copy */
+				initialize_context(ctx);
+				ctx->stack=new;
+			} else if ( ctx->w == RES_NONE || ! (ctx->old_flag & (1<<r->code))) {
+				syntax();  /* XXX how do we get out? */
+			}
+			ctx->w=r->code;
+			ctx->old_flag = r->flag;
+			if (ctx->old_flag & FLAG_END) {
+				struct p_context *old;
+				debug_printf("pop stack\n");
+				old = ctx->stack;
+				old->child->group = ctx->list_head;
+				*ctx = *old;   /* physical copy */
+				free(old);
+				ctx->w=RES_NONE;
+			}
+			b_reset (dest);
+			return 1;
+		}
+	}
+	return 0;
+}
+
+/* normal return is 0.
+ * Syntax or xglob errors return 1. */
+static int done_word(o_string *dest, struct p_context *ctx)
+{
+	struct child_prog *child=ctx->child;
+	glob_t *glob_target;
+	int gr, flags = 0;
+
+	debug_printf("done_word: %s %p\n", dest->data, child);
+	if (dest->length == 0 && !dest->nonnull) {
+		debug_printf("  true null, ignored\n");
+		return 0;
+	}
+	if (ctx->pending_redirect) {
+		glob_target = &ctx->pending_redirect->word;
+	} else {
+		if (child->group) {
+			syntax();
+			return 1;  /* syntax error, groups and arglists don't mix */
+		}
+		if (!child->argv) {
+			debug_printf("checking %s for reserved-ness\n",dest->data);
+			if (reserved_word(dest,ctx)) return 0;
+		}
+		glob_target = &child->glob_result;
+ 		if (child->argv) flags |= GLOB_APPEND;
+	}
+	gr = xglob(dest, flags, glob_target);
+	if (gr != 0) return 1;
+
+	b_reset(dest);
+	if (ctx->pending_redirect) {
+		ctx->pending_redirect=NULL;
+		if (glob_target->gl_pathc != 1) {
+			fprintf(stderr, "ambiguous redirect\n");
+			return 1;
+		}
+	} else {
+		child->argv = glob_target->gl_pathv;
+	}
+	return 0;
+}
+
+/* The only possible error here is out of memory, in which case
+ * xmalloc exits. */
+static int done_command(struct p_context *ctx)
+{
+	/* The child is really already in the pipe structure, so
+	 * advance the pipe counter and make a new, null child.
+	 * Only real trickiness here is that the uncommitted
+	 * child structure, to which ctx->child points, is not
+	 * counted in pi->num_progs. */
+	struct pipe *pi=ctx->pipe;
+	struct child_prog *prog=ctx->child;
+
+	if (prog && prog->group == NULL
+	         && prog->argv == NULL
+	         && prog->redirects == NULL) {
+		debug_printf("done_command: skipping null command\n");
+		return 0;
+	} else if (prog) {
+		pi->num_progs++;
+		debug_printf("done_command: num_progs incremented to %d\n",pi->num_progs);
+	} else {
+		debug_printf("done_command: initializing\n");
+	}
+	pi->progs = xrealloc(pi->progs, sizeof(*pi->progs) * (pi->num_progs+1));
+
+	prog = pi->progs + pi->num_progs;
+	prog->redirects = NULL;
+	prog->argv = NULL;
+	prog->is_stopped = 0;
+	prog->group = NULL;
+	prog->glob_result.gl_pathv = NULL;
+	prog->family = pi;
+
+	ctx->child=prog;
+	/* but ctx->pipe and ctx->list_head remain unchanged */
+	return 0;
+}
+
+static int done_pipe(struct p_context *ctx, pipe_style type)
+{
+	struct pipe *new_p;
+	done_command(ctx);  /* implicit closure of previous command */
+	debug_printf("done_pipe, type %d\n", type);
+	ctx->pipe->followup = type;
+	ctx->pipe->r_mode = ctx->w;
+	new_p=new_pipe();
+	ctx->pipe->next = new_p;
+	ctx->pipe = new_p;
+	ctx->child = NULL;
+	done_command(ctx);  /* set up new pipe to accept commands */
+	return 0;
+}
+
+/* peek ahead in the in_str to find out if we have a "&n" construct,
+ * as in "2>&1", that represents duplicating a file descriptor.
+ * returns either -2 (syntax error), -1 (no &), or the number found.
+ */
+static int redirect_dup_num(struct in_str *input)
+{
+	int ch, d=0, ok=0;
+	ch = b_peek(input);
+	if (ch != '&') return -1;
+
+	b_getch(input);  /* get the & */
+	while (ch=b_peek(input),isdigit(ch)) {
+		d = d*10+(ch-'0');
+		ok=1;
+		b_getch(input);
+	}
+	if (ok) return d;
+
+	fprintf(stderr, "ambiguous redirect\n");
+	return -2;
+}
+
+/* If a redirect is immediately preceded by a number, that number is
+ * supposed to tell which file descriptor to redirect.  This routine
+ * looks for such preceding numbers.  In an ideal world this routine
+ * needs to handle all the following classes of redirects...
+ *     echo 2>foo     # redirects fd  2 to file "foo", nothing passed to echo
+ *     echo 49>foo    # redirects fd 49 to file "foo", nothing passed to echo
+ *     echo -2>foo    # redirects fd  1 to file "foo",    "-2" passed to echo
+ *     echo 49x>foo   # redirects fd  1 to file "foo",   "49x" passed to echo
+ * A -1 output from this program means no valid number was found, so the
+ * caller should use the appropriate default for this redirection.
+ */
+static int redirect_opt_num(o_string *o)
+{
+	int num;
+
+	if (o->length==0) return -1;
+	for(num=0; num<o->length; num++) {
+		if (!isdigit(*(o->data+num))) {
+			return -1;
+		}
+	}
+	/* reuse num (and save an int) */
+	num=atoi(o->data);
+	b_reset(o);
+	return num;
+}
+
+FILE *generate_stream_from_list(struct pipe *head)
+{
+	FILE *pf;
+#if 1
+	int pid, channel[2];
+	if (pipe(channel)<0) perror_msg_and_die("pipe");
+	pid=fork();
+	if (pid<0) {
+		perror_msg_and_die("fork");
+	} else if (pid==0) {
+		close(channel[0]);
+		if (channel[1] != 1) {
+			dup2(channel[1],1);
+			close(channel[1]);
+		}
+#if 0
+#define SURROGATE "surrogate response"
+		write(1,SURROGATE,sizeof(SURROGATE));
+		exit(run_list(head));
+#else
+		exit(run_list_real(head));   /* leaks memory */
+#endif
+	}
+	debug_printf("forked child %d\n",pid);
+	close(channel[1]);
+	pf = fdopen(channel[0],"r");
+	debug_printf("pipe on FILE *%p\n",pf);
+#else
+	run_list_test(head,0);
+	pf=popen("echo surrogate response","r");
+	debug_printf("started fake pipe on FILE *%p\n",pf);
+#endif
+	return pf;
+}
+
+/* this version hacked for testing purposes */
+/* return code is exit status of the process that is run. */
+static int process_command_subs(o_string *dest, struct p_context *ctx, struct in_str *input, int subst_end)
+{
+	int retcode;
+	o_string result=NULL_O_STRING;
+	struct p_context inner;
+	FILE *p;
+	struct in_str pipe_str;
+	initialize_context(&inner);
+
+	/* recursion to generate command */
+	retcode = parse_stream(&result, &inner, input, subst_end);
+	if (retcode != 0) return retcode;  /* syntax error or EOF */
+	done_word(&result, &inner);
+	done_pipe(&inner, PIPE_SEQ);
+	b_free(&result);
+
+	p=generate_stream_from_list(inner.list_head);
+	if (p==NULL) return 1;
+	mark_open(fileno(p));
+	setup_file_in_str(&pipe_str, p);
+
+	/* now send results of command back into original context */
+	retcode = parse_stream(dest, ctx, &pipe_str, '\0');
+	/* XXX In case of a syntax error, should we try to kill the child?
+	 * That would be tough to do right, so just read until EOF. */
+	if (retcode == 1) {
+		while (b_getch(&pipe_str)!=EOF) { /* discard */ };
+	}
+
+	debug_printf("done reading from pipe, pclose()ing\n");
+	/* This is the step that wait()s for the child.  Should be pretty
+	 * safe, since we just read an EOF from its stdout.  We could try
+	 * to better, by using wait(), and keeping track of background jobs
+	 * at the same time.  That would be a lot of work, and contrary
+	 * to the KISS philosophy of this program. */
+	mark_closed(fileno(p));
+	retcode=pclose(p);
+	debug_printf("pclosed, retcode=%d\n",retcode);
+	/* XXX this process fails to trim a single trailing newline */
+	return retcode;
+}
+
+static int parse_group(o_string *dest, struct p_context *ctx,
+	struct in_str *input, int ch)
+{
+	int rcode, endch=0;
+	struct p_context sub;
+	struct child_prog *child = ctx->child;
+	if (child->argv) {
+		syntax();
+		return 1;  /* syntax error, groups and arglists don't mix */
+	}
+	initialize_context(&sub);
+	switch(ch) {
+		case '(': endch=')'; child->subshell=1; break;
+		case '{': endch='}'; break;
+		default: syntax();   /* really logic error */
+	}
+	rcode=parse_stream(dest,&sub,input,endch);
+	done_word(dest,&sub); /* finish off the final word in the subcontext */
+	done_pipe(&sub, PIPE_SEQ);  /* and the final command there, too */
+	child->group = sub.list_head;
+	return rcode;
+	/* child remains "open", available for possible redirects */
+}
+
+/* basically useful version until someone wants to get fancier,
+ * see the bash man page under "Parameter Expansion" */
+static void lookup_param(o_string *dest, struct p_context *ctx, o_string *src)
+{
+	const char *p=NULL;
+	if (src->data) p = getenv(src->data);
+	if (p) parse_string(dest, ctx, p);   /* recursion */
+	b_free(src);
+}
+
+/* return code: 0 for OK, 1 for syntax error */
+static int handle_dollar(o_string *dest, struct p_context *ctx, struct in_str *input)
+{
+	int i, advance=0;
+	o_string alt=NULL_O_STRING;
+	char sep[]=" ";
+	int ch = input->peek(input);  /* first character after the $ */
+	debug_printf("handle_dollar: ch=%c\n",ch);
+	if (isalpha(ch)) {
+		while(ch=b_peek(input),isalnum(ch) || ch=='_') {
+			b_getch(input);
+			b_addchr(&alt,ch);
+		}
+		lookup_param(dest, ctx, &alt);
+	} else if (isdigit(ch)) {
+		i = ch-'0';  /* XXX is $0 special? */
+		if (i<global_argc) {
+			parse_string(dest, ctx, global_argv[i]); /* recursion */
+		}
+		advance = 1;
+	} else switch (ch) {
+		case '$':
+			b_adduint(dest,getpid());
+			advance = 1;
+			break;
+		case '!':
+			if (last_bg_pid > 0) b_adduint(dest, last_bg_pid);
+			advance = 1;
+			break;
+		case '?':
+			b_adduint(dest,last_return_code);
+			advance = 1;
+			break;
+		case '#':
+			b_adduint(dest,global_argc ? global_argc-1 : 0);
+			advance = 1;
+			break;
+		case '{':
+			b_getch(input);
+			/* XXX maybe someone will try to escape the '}' */
+			while(ch=b_getch(input),ch!=EOF && ch!='}') {
+				b_addchr(&alt,ch);
+			}
+			if (ch != '}') {
+				syntax();
+				return 1;
+			}
+			lookup_param(dest, ctx, &alt);
+			break;
+		case '(':
+			process_command_subs(dest, ctx, input, ')');
+			break;
+		case '*':
+			sep[0]=ifs[0];
+			for (i=1; i<global_argc; i++) {
+				parse_string(dest, ctx, global_argv[i]);
+				if (i+1 < global_argc) parse_string(dest, ctx, sep);
+			}
+			break;
+		case '@':
+		case '-':
+		case '_':
+			/* still unhandled, but should be eventually */
+			fprintf(stderr,"unhandled syntax: $%c\n",ch);
+			return 1;
+			break;
+		default:
+			b_addqchr(dest,'$',dest->quote);
+	}
+	/* Eat the character if the flag was set.  If the compiler
+	 * is smart enough, we could substitute "b_getch(input);"
+	 * for all the "advance = 1;" above, and also end up with
+	 * a nice size-optimized program.  Hah!  That'll be the day.
+	 */
+	if (advance) b_getch(input);
+	return 0;
+}
+
+int parse_string(o_string *dest, struct p_context *ctx, const char *src)
+{
+	struct in_str foo;
+	setup_string_in_str(&foo, src);
+	return parse_stream(dest, ctx, &foo, '\0');
+}
+
+/* return code is 0 for normal exit, 1 for syntax error */
+int parse_stream(o_string *dest, struct p_context *ctx,
+	struct in_str *input, int end_trigger)
+{
+	unsigned int ch, m;
+	int redir_fd;
+	redir_type redir_style;
+	int next;
+
+	/* Only double-quote state is handled in the state variable dest->quote.
+	 * A single-quote triggers a bypass of the main loop until its mate is
+	 * found.  When recursing, quote state is passed in via dest->quote. */
+
+	debug_printf("parse_stream, end_trigger=%d\n",end_trigger);
+	while ((ch=b_getch(input))!=EOF) {
+		m = map[ch];
+		next = (ch == '\n') ? 0 : b_peek(input);
+		debug_printf("parse_stream: ch=%c (%d) m=%d quote=%d\n",
+			ch,ch,m,dest->quote);
+		if (m==0 || ((m==1 || m==2) && dest->quote)) {
+			b_addqchr(dest, ch, dest->quote);
+		} else if (ch == end_trigger && !dest->quote) {
+			debug_printf("leaving parse_stream\n");
+			return 0;
+		} else if (m==2 && !dest->quote) {  /* IFS */
+			done_word(dest, ctx);
+#if 0
+			if (ch=='\n') {
+				/* Yahoo!  Time to run with it! */
+				done_pipe(ctx,PIPE_SEQ);
+				run_list(ctx->list_head);
+				initialize_context(ctx);
+			}
+#endif
+		} else switch (ch) {
+		case '#':
+			if (dest->length == 0 && !dest->quote) {
+				while(ch=b_peek(input),ch!=EOF && ch!='\n') { b_getch(input); }
+			} else {
+				b_addqchr(dest, ch, dest->quote);
+			}
+			break;
+		case '\\':
+			if (next == EOF) {
+				syntax();
+				return 1;
+			}
+			b_addqchr(dest, '\\', dest->quote);
+			b_addqchr(dest, b_getch(input), dest->quote);
+			break;
+		case '$':
+			if (handle_dollar(dest, ctx, input)!=0) return 1;
+			break;
+		case '\'':
+			dest->nonnull = 1;
+			while(ch=b_getch(input),ch!=EOF && ch!='\'') {
+				b_addchr(dest,ch);
+			}
+			if (ch==EOF) {
+				syntax();
+				return 1;
+			}
+			break;
+		case '"':
+			dest->nonnull = 1;
+			dest->quote = !dest->quote;
+			break;
+		case '`':
+			process_command_subs(dest, ctx, input, '`');
+			break;
+		case '>':
+			redir_fd = redirect_opt_num(dest);
+			done_word(dest, ctx);
+			redir_style=REDIRECT_OVERWRITE;
+			if (next == '>') {
+				redir_style=REDIRECT_APPEND;
+				b_getch(input);
+			} else if (next == '(') {
+				syntax();   /* until we support >(list) Process Substitution */
+				return 1;
+			}
+			setup_redirect(ctx, redir_fd, redir_style, input);
+			break;
+		case '<':
+			redir_fd = redirect_opt_num(dest);
+			done_word(dest, ctx);
+			redir_style=REDIRECT_INPUT;
+			if (next == '<') {
+				redir_style=REDIRECT_HEREIS;
+				b_getch(input);
+			} else if (next == '>') {
+				redir_style=REDIRECT_IO;
+				b_getch(input);
+			} else if (next == '(') {
+				syntax();   /* until we support <(list) Process Substitution */
+				return 1;
+			}
+			setup_redirect(ctx, redir_fd, redir_style, input);
+			break;
+		case ';':
+			done_word(dest, ctx);
+			done_pipe(ctx,PIPE_SEQ);
+			break;
+		case '&':
+			done_word(dest, ctx);
+			if (next=='&') {
+				b_getch(input);
+				done_pipe(ctx,PIPE_AND);
+			} else {
+				done_pipe(ctx,PIPE_BG);
+			}
+			break;
+		case '|':
+			done_word(dest, ctx);
+			if (next=='|') {
+				b_getch(input);
+				done_pipe(ctx,PIPE_OR);
+			} else {
+				/* we could pick up a file descriptor choice here
+				 * with redirect_opt_num(), but bash doesn't do it.
+				 * "echo foo 2| cat" yields "foo 2". */
+				done_command(ctx);
+			}
+			break;
+		case '(':
+		case '{':
+			if (parse_group(dest, ctx, input, ch)!=0) return 1;
+			break;
+		case ')':
+		case '}':
+			syntax();   /* Proper use of this character caught by end_trigger */
+			return 1;
+			break;
+		default:
+			syntax();   /* this is really an internal logic error */
+			return 1;
+		}
+	}
+	/* complain if quote?  No, maybe we just finished a command substitution
+	 * that was quoted.  Example:
+	 * $ echo "`cat foo` plus more" 
+	 * and we just got the EOF generated by the subshell that ran "cat foo"
+	 * The only real complaint is if we got an EOF when end_trigger != '\0',
+	 * that is, we were really supposed to get end_trigger, and never got
+	 * one before the EOF.  Can't use the standard "syntax error" return code,
+	 * so that parse_stream_outer can distinguish the EOF and exit smoothly. */
+	if (end_trigger != '\0') return -1;
+	return 0;
+}
+
+void mapset(const unsigned char *set, int code)
+{
+	const unsigned char *s;
+	for (s=set; *s; s++) map[*s] = code;
+}
+
+void update_ifs_map(void)
+{
+	/* char *ifs and char map[256] are both globals. */
+	ifs = getenv("IFS");
+	if (ifs == NULL) ifs=" \t\n";
+	/* Precompute a list of 'flow through' behavior so it can be treated
+	 * quickly up front.  Computation is necessary because of IFS.
+	 * Special case handling of IFS == " \t\n" is not implemented.
+	 * The map[] array only really needs two bits each, and on most machines
+	 * that would be faster because of the reduced L1 cache footprint.
+	 */
+	memset(map,0,256);        /* most characters flow through always */
+	mapset("\\$'\"`", 3);     /* never flow through */
+	mapset("<>;&|(){}#", 1);  /* flow through if quoted */
+	mapset(ifs, 2);           /* also flow through if quoted */
+}
+
+/* most recursion does not come through here, the exeception is
+ * from builtin_source() */
+int parse_stream_outer(struct in_str *inp)
+{
+
+	struct p_context ctx;
+	o_string temp=NULL_O_STRING;
+	int rcode;
+	do {
+		initialize_context(&ctx);
+		update_ifs_map();
+		inp->promptmode=1;
+		rcode = parse_stream(&temp, &ctx, inp, '\n');
+		done_word(&temp, &ctx);
+		done_pipe(&ctx,PIPE_SEQ);
+		run_list(ctx.list_head);
+	} while (rcode != -1);   /* loop on syntax errors, return on EOF */
+	return 0;
+}
+
+static int parse_string_outer(const char *s)
+{
+	struct in_str input;
+	setup_string_in_str(&input, s);
+	return parse_stream_outer(&input);
+}
+
+static int parse_file_outer(FILE *f)
+{
+	int rcode;
+	struct in_str input;
+	setup_file_in_str(&input, f);
+	rcode = parse_stream_outer(&input);
+	return rcode;
+}
+
+int shell_main(int argc, char **argv)
+{
+	int opt;
+	FILE *input;
+
+	/* XXX what should these be while sourcing /etc/profile? */
+	global_argc = argc;
+	global_argv = argv;
+
+	if (argv[0] && argv[0][0] == '-') {
+		debug_printf("\nsourcing /etc/profile\n");
+		input = xfopen("/etc/profile", "r");
+		mark_open(fileno(input));
+		parse_file_outer(input);
+		mark_closed(fileno(input));
+		fclose(input);
+	}
+	input=stdin;
+	
+	/* initialize the cwd -- this is never freed...*/
+	cwd = xgetcwd(0);
+#ifdef BB_FEATURE_COMMAND_EDITING
+	cmdedit_set_initial_prompt();
+#else
+	PS1 = NULL;
+#endif
+	
+	while ((opt = getopt(argc, argv, "c:xif")) > 0) {
+		switch (opt) {
+			case 'c':
+				{
+					global_argv = argv+optind;
+					global_argc = argc-optind;
+					opt = parse_string_outer(optarg);
+					exit(opt);
+				}
+				break;
+			case 'i':
+				interactive++;
+				break;
+			case 'f':
+				fake_mode++;
+				break;
+			default:
+				fprintf(stderr, "Usage: sh [FILE]...\n"
+						"   or: sh -c command [args]...\n\n");
+				exit(EXIT_FAILURE);
+		}
+	}
+	/* A shell is interactive if the `-i' flag was given, or if all of
+	 * the following conditions are met:
+	 *	  no -c command
+	 *    no arguments remaining or the -s flag given
+	 *    standard input is a terminal
+	 *    standard output is a terminal
+	 *    Refer to Posix.2, the description of the `sh' utility. */
+	if (argv[optind]==NULL && input==stdin &&
+			isatty(fileno(stdin)) && isatty(fileno(stdout))) {
+		interactive++;
+	}
+	
+	if (interactive) {
+		/* Looks like they want an interactive shell */
+		fprintf(stdout, "\nhush -- the humble shell v0.01 (testing)\n\n");
+		exit(parse_file_outer(stdin));
+	}
+	debug_printf("\ninteractive=%d\n", interactive);
+
+	debug_printf("\nrunning script '%s'\n", argv[optind]);
+	global_argv = argv+optind;
+	global_argc = argc-optind;
+	input = xfopen(argv[optind], "r");
+	opt = parse_file_outer(input);
+
+#ifdef BB_FEATURE_CLEAN_UP
+	fclose(input.file);
+#endif
+
+	return(opt);
+}