[pitboss] phase 13: Track B — JavaScript + TypeScript harness emitter shapes

tests/dynamic_fixtures/javascript/commonjs_export/benign.js

@@ -0,0 +1,20 @@
+// Phase 13 — CommonJS export, benign control.
+
+'use strict';
+const { execFileSync } = require('child_process');
+
+function runPing(host) {
+    process.stdout.write('__NYX_SINK_HIT__\n');
+    try {
+        execFileSync('true', [host], {
+            encoding: 'utf8',
+            timeout: 5000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return 'ok';
+    } catch (_e) {
+        return 'err';
+    }
+}
+
+module.exports = { runPing };

tests/dynamic_fixtures/javascript/commonjs_export/vuln.js

@@ -0,0 +1,21 @@
+// Phase 13 — CommonJS export, vulnerable.
+//
+// Synchronous `execSync` with shell:true via string concat.  Stdlib only.
+
+'use strict';
+const { execSync } = require('child_process');
+
+function runPing(host) {
+    process.stdout.write('__NYX_SINK_HIT__\n');
+    try {
+        const out = execSync('echo hello ' + host, { encoding: 'utf8', timeout: 5000 });
+        process.stdout.write(out);
+        return out;
+    } catch (e) {
+        const out = (e.stdout || '') + (e.stderr || '');
+        process.stdout.write(out);
+        return out;
+    }
+}
+
+module.exports = { runPing };