@tishlang/tish-format 2.37.0 → 2.38.0

package/crates/tish_compile/src/codegen.rs

@@ -1714,6 +1714,15 @@ impl Codegen {
                     "readLine" => Some("Value::native(|args: &[Value]| tishlang_runtime::tty_read_line(args))"),
                     _ => None,
                 },
+            "tish:pty" if self.has_feature("pty") => match export_name {
+                    "spawn" => Some("Value::native(|args: &[Value]| tishlang_runtime::pty_spawn(args))"),
+                    "read" => Some("Value::native(|args: &[Value]| tishlang_runtime::pty_read(args))"),
+                    "write" => Some("Value::native(|args: &[Value]| tishlang_runtime::pty_write(args))"),
+                    "resize" => Some("Value::native(|args: &[Value]| tishlang_runtime::pty_resize(args))"),
+                    "kill" => Some("Value::native(|args: &[Value]| tishlang_runtime::pty_kill(args))"),
+                    "pid" => Some("Value::native(|args: &[Value]| tishlang_runtime::pty_pid(args))"),
+                    _ => None,
+                },
             _ => return None,
         };
         init.map(String::from)
@@ -1723,7 +1732,7 @@ impl Codegen {
         if self.features.contains("full") {
             matches!(
                 name,
-                "http" | "timers" | "fs" | "process" | "regex" | "ws" | "tty"
+                "http" | "timers" | "fs" | "process" | "regex" | "ws" | "tty" | "pty"
             )
         } else {
             self.features.contains(name)

package/crates/tish_compile/src/infer.rs

@@ -283,7 +283,7 @@ fn param_infer_program(program: Program) -> Program {
     // numeric" (`return SHARED`) yet the caller passes e.g. `"arg"`, which the f64 coercion would
     // panic on / turn to NaN where JS keeps the value. Skip those fns (they stay fully boxed). Same
     // set `collect_native_fns` uses to refuse the M5 native form.
-    let nonnumeric = crate::codegen::Codegen::fns_called_with_nonnumeric_arg(&program.statements);
+    let nonnumeric = fns_with_unsafe_numeric_arg(&program.statements);
     // Soundness (#477): a fn referenced as a first-class VALUE — passed as a call ARGUMENT
     // (`serve(port, handler)`), assigned, returned, or stored, i.e. any use that is NOT a direct
     // `f(...)` call — escapes into the boxed `Value::Function` path and is later invoked via
@@ -322,6 +322,522 @@ fn escaping_fn_names(statements: &[Statement]) -> HashSet<String> {
     out
 }
 
+/// Shared candidate predicate: would param `pname` (unannotated, default-less) of a fn with `body`
+/// be M4-promoted to `: number` on the basis of its BODY uses (the #172 optimistic per-param
+/// fixpoint)? Used by BOTH pi_stmt (the promotion) and `numeric_candidate_positions` (the call-arg
+/// whitelist) so the two agree on exactly which positions are numeric candidates.
+fn param_is_body_numeric_candidate(body: &Statement, base_nums: &HashSet<String>, pname: &str) -> bool {
+    let mut nums = base_nums.clone();
+    nums.insert(pname.to_string());
+    collect_numeric_locals_fixpoint(body, &mut nums);
+    let copy_descendants: Vec<&String> = nums
+        .iter()
+        .filter(|x| x.as_str() != pname && !base_nums.contains(*x))
+        .collect();
+    nus_stmt(body, pname, &nums)
+        && copy_descendants.iter().all(|x| lns_stmt(body, x.as_str(), &nums))
+}
+
+/// analyze_aggregate's S-0 numeric-param set for one fn: the optimistic `pus_stmt` fixpoint (a param
+/// used only as an object-field VALUE / numeric operand is numeric). Shared with the call-arg
+/// whitelist so its candidate set covers what S-0 (via `stamp_numeric_params`) actually promotes.
+fn s0_numeric_candidates(params: &[FunParam], body: &Statement) -> HashSet<String> {
+    let mut nums = HashSet::new();
+    collect_numeric_locals_fixpoint(body, &mut nums);
+    let mut numeric_params: HashSet<String> = params
+        .iter()
+        .filter_map(|p| match p {
+            FunParam::Simple(tp) if tp.type_ann.is_none() && tp.default.is_none() => {
+                Some(tp.name.to_string())
+            }
+            _ => None,
+        })
+        .collect();
+    loop {
+        let mut local_nums = nums.clone();
+        for n in &numeric_params {
+            local_nums.insert(n.clone());
+        }
+        let drop: Vec<String> = numeric_params
+            .iter()
+            .filter(|n| !pus_stmt(body, n.as_str(), &local_nums))
+            .cloned()
+            .collect();
+        if drop.is_empty() {
+            break;
+        }
+        for n in drop {
+            numeric_params.remove(&n);
+        }
+    }
+    numeric_params
+}
+
+/// Per fn (top-level and nested), the parameter POSITIONS that are numeric candidates — i.e. either
+/// promotion path would M4-promote them to f64. The call-arg whitelist (#485/#477/#484) checks ONLY
+/// these positions, so array/object params (e.g. native-vec devirt) never disqualify a fn.
+pub(crate) fn numeric_candidate_positions(
+    statements: &[Statement],
+) -> std::collections::HashMap<String, Vec<(usize, String)>> {
+    let mut out = std::collections::HashMap::new();
+    ncp_stmt_list(statements, &mut out);
+    out
+}
+fn ncp_stmt_list(statements: &[Statement], out: &mut std::collections::HashMap<String, Vec<(usize, String)>>) {
+    for s in statements {
+        ncp_stmt(s, out);
+    }
+}
+fn ncp_stmt(s: &Statement, out: &mut std::collections::HashMap<String, Vec<(usize, String)>>) {
+    use Statement::*;
+    match s {
+        FunDecl { name, params, body, .. } => {
+            let mut base_nums = HashSet::new();
+            collect_numeric_locals_fixpoint(body, &mut base_nums);
+            // A position is a candidate if EITHER promotion path would take it: pi_stmt (nus_stmt) OR
+            // analyze_aggregate's S-0 (pus_stmt — which also accepts a param used as an object-field
+            // VALUE, e.g. `{ v: s }`). The whitelist must cover BOTH or a param S-0 promotes but
+            // pi_stmt doesn't (tishlang/tish#484) gets an f64 unbox with no call-arg check.
+            let s0 = s0_numeric_candidates(params, body);
+            let mut positions: Vec<(usize, String)> = Vec::new();
+            for (i, p) in params.iter().enumerate() {
+                if let FunParam::Simple(tp) = p {
+                    if tp.type_ann.is_none()
+                        && tp.default.is_none()
+                        && (param_is_body_numeric_candidate(body, &base_nums, tp.name.as_ref())
+                            || s0.contains(tp.name.as_ref()))
+                    {
+                        positions.push((i, tp.name.to_string()));
+                    }
+                }
+            }
+            if !positions.is_empty() {
+                out.insert(name.to_string(), positions);
+            }
+            ncp_stmt(body, out); // nested fns
+        }
+        Block { statements, .. } | Multi { statements, .. } => ncp_stmt_list(statements, out),
+        If { then_branch, else_branch, .. } => {
+            ncp_stmt(then_branch, out);
+            if let Some(e) = else_branch {
+                ncp_stmt(e, out);
+            }
+        }
+        While { body, .. }
+        | DoWhile { body, .. }
+        | For { body, .. }
+        | ForOf { body, .. }
+        | ForIn { body, .. } => ncp_stmt(body, out),
+        Try { body, catch_body, finally_body, .. } => {
+            ncp_stmt(body, out);
+            if let Some(c) = catch_body {
+                ncp_stmt(c, out);
+            }
+            if let Some(f) = finally_body {
+                ncp_stmt(f, out);
+            }
+        }
+        Switch { cases, default_body, .. } => {
+            for (_, b) in cases {
+                ncp_stmt_list(b, out);
+            }
+            if let Some(d) = default_body {
+                ncp_stmt_list(d, out);
+            }
+        }
+        Export { declaration, .. } => {
+            if let tishlang_ast::ExportDeclaration::Named(inner) = declaration.as_ref() {
+                ncp_stmt(inner, out);
+            }
+        }
+        _ => {}
+    }
+}
+
+// ---- interprocedural numeric-arg soundness (tishlang/tish#485/#477/#484) ----
+//
+// M4 promotes an unannotated param to native f64 and unboxes it at the (boxed) closure entry, which
+// panics `"expected number"` if a caller ever passes a non-number. Instead of BLACKLISTING the known
+// ways that happens (a non-numeric literal / an escaping fn / an await), compute — soundly, by
+// construction — which parameter POSITIONS provably receive only numbers, then disqualify any fn with
+// a body-numeric CANDIDATE position that is NOT provably numeric. An optimistic fixpoint (assume all
+// positions numeric, then drop any that a call site violates) makes pass-through params transitive:
+// `f(n)` where `n` is a numeric param of the caller stays numeric down the chain, back to a literal.
+
+#[derive(Clone)]
+enum ArgClass {
+    Num,                       // provably a number regardless of context (literal, arithmetic, Math)
+    NotNum,                    // provably NOT reliably a number (string/object/unknown-return call)
+    NeedsNumeric(Vec<String>), // a number iff every listed ident is numeric in the caller's context
+}
+
+struct CallSite {
+    caller: Option<String>, // enclosing fn (None = top level)
+    callee: String,
+    args: Vec<ArgClass>,
+    has_spread: bool,
+}
+
+fn arg_number_producing_call(callee: &Expr) -> bool {
+    match callee {
+        Expr::Ident { name, .. } => name.as_ref() == "Number",
+        Expr::Member { object, prop: tishlang_ast::MemberProp::Name { name: m, .. }, .. } => {
+            matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == "Math")
+                && matches!(
+                    m.as_ref(),
+                    "sqrt" | "sin" | "cos" | "tan" | "abs" | "floor" | "ceil" | "exp" | "trunc"
+                        | "log" | "log2" | "log10" | "round" | "pow" | "min" | "max" | "sign"
+                        | "cbrt" | "atan" | "atan2" | "asin" | "acos" | "hypot" | "random"
+                )
+        }
+        _ => false,
+    }
+}
+
+fn combine_add(l: ArgClass, r: ArgClass) -> ArgClass {
+    match (l, r) {
+        (ArgClass::NotNum, _) | (_, ArgClass::NotNum) => ArgClass::NotNum,
+        (ArgClass::Num, ArgClass::Num) => ArgClass::Num,
+        (ArgClass::Num, x) | (x, ArgClass::Num) => x,
+        (ArgClass::NeedsNumeric(mut a), ArgClass::NeedsNumeric(b)) => {
+            a.extend(b);
+            ArgClass::NeedsNumeric(a)
+        }
+    }
+}
+
+fn classify_arg(e: &Expr) -> ArgClass {
+    use tishlang_ast::BinOp::*;
+    match e {
+        Expr::Literal { value: Literal::Number(_), .. } => ArgClass::Num,
+        Expr::Ident { name, .. } => ArgClass::NeedsNumeric(vec![name.to_string()]),
+        // `-`,`*`,`/`,`%`,`**`, bitwise/shift JS-ToNumber unconditionally → always a number.
+        Expr::Binary {
+            op: Sub | Mul | Div | Mod | Pow | BitAnd | BitOr | BitXor | Shl | Shr | UShr,
+            ..
+        } => ArgClass::Num,
+        // `+` is a number only if BOTH sides are (else string concat).
+        Expr::Binary { op: Add, left, right, .. } => {
+            combine_add(classify_arg(left), classify_arg(right))
+        }
+        Expr::Unary {
+            op:
+                tishlang_ast::UnaryOp::Neg
+                | tishlang_ast::UnaryOp::Pos
+                | tishlang_ast::UnaryOp::BitNot,
+            ..
+        } => ArgClass::Num,
+        Expr::Call { callee, .. } | Expr::New { callee, .. } => {
+            if arg_number_producing_call(callee) {
+                ArgClass::Num
+            } else {
+                ArgClass::NotNum
+            }
+        }
+        _ => ArgClass::NotNum,
+    }
+}
+
+fn arg_ok(ac: &ArgClass, ctx: &HashSet<String>) -> bool {
+    match ac {
+        ArgClass::Num => true,
+        ArgClass::NotNum => false,
+        ArgClass::NeedsNumeric(idents) => idents.iter().all(|n| ctx.contains(n)),
+    }
+}
+
+// Collect (param-name-list, numeric-locals) for every fn (top-level and nested).
+fn cfm_stmt(
+    s: &Statement,
+    params: &mut std::collections::HashMap<String, Vec<String>>,
+    locals: &mut std::collections::HashMap<String, HashSet<String>>,
+) {
+    use Statement::*;
+    match s {
+        FunDecl { name, params: ps, body, .. } => {
+            let pnames: Vec<String> = ps
+                .iter()
+                .map(|p| match p {
+                    FunParam::Simple(tp) => tp.name.to_string(),
+                    _ => String::new(),
+                })
+                .collect();
+            params.insert(name.to_string(), pnames);
+            let mut nums = HashSet::new();
+            collect_numeric_locals_fixpoint(body, &mut nums);
+            locals.insert(name.to_string(), nums);
+            cfm_stmt(body, params, locals);
+        }
+        Block { statements, .. } | Multi { statements, .. } => {
+            for x in statements {
+                cfm_stmt(x, params, locals);
+            }
+        }
+        If { then_branch, else_branch, .. } => {
+            cfm_stmt(then_branch, params, locals);
+            if let Some(e) = else_branch {
+                cfm_stmt(e, params, locals);
+            }
+        }
+        While { body, .. } | DoWhile { body, .. } | For { body, .. } | ForOf { body, .. }
+        | ForIn { body, .. } => cfm_stmt(body, params, locals),
+        Try { body, catch_body, finally_body, .. } => {
+            cfm_stmt(body, params, locals);
+            if let Some(c) = catch_body {
+                cfm_stmt(c, params, locals);
+            }
+            if let Some(f) = finally_body {
+                cfm_stmt(f, params, locals);
+            }
+        }
+        Switch { cases, default_body, .. } => {
+            for (_, b) in cases {
+                for x in b {
+                    cfm_stmt(x, params, locals);
+                }
+            }
+            if let Some(d) = default_body {
+                for x in d {
+                    cfm_stmt(x, params, locals);
+                }
+            }
+        }
+        Export { declaration, .. } => {
+            if let tishlang_ast::ExportDeclaration::Named(inner) = declaration.as_ref() {
+                cfm_stmt(inner, params, locals);
+            }
+        }
+        _ => {}
+    }
+}
+
+// Record every direct `f(...)` call in `e`, tagged with the enclosing fn; recurse into sub-exprs.
+fn collect_calls_expr(e: &Expr, encl: &Option<String>, out: &mut Vec<CallSite>) {
+    if let Expr::Call { callee, args, .. } | Expr::New { callee, args, .. } = e {
+        if let Expr::Ident { name, .. } = callee.as_ref() {
+            let mut classes = Vec::new();
+            let mut has_spread = false;
+            for a in args {
+                match a {
+                    CallArg::Expr(x) => classes.push(classify_arg(x)),
+                    CallArg::Spread(_) => has_spread = true,
+                }
+            }
+            out.push(CallSite {
+                caller: encl.clone(),
+                callee: name.to_string(),
+                args: classes,
+                has_spread,
+            });
+        }
+    }
+    walk_exprs_expr(e, &mut |sub| {
+        if let Expr::Call { callee, args, .. } | Expr::New { callee, args, .. } = sub {
+            if !std::ptr::eq(sub, e) {
+                if let Expr::Ident { name, .. } = callee.as_ref() {
+                    let mut classes = Vec::new();
+                    let mut has_spread = false;
+                    for a in args {
+                        match a {
+                            CallArg::Expr(x) => classes.push(classify_arg(x)),
+                            CallArg::Spread(_) => has_spread = true,
+                        }
+                    }
+                    out.push(CallSite {
+                        caller: encl.clone(),
+                        callee: name.to_string(),
+                        args: classes,
+                        has_spread,
+                    });
+                }
+            }
+        }
+    });
+}
+
+fn collect_calls_stmt(s: &Statement, encl: &Option<String>, out: &mut Vec<CallSite>) {
+    use Statement::*;
+    match s {
+        FunDecl { name, body, .. } => {
+            let inner = Some(name.to_string());
+            collect_calls_stmt(body, &inner, out);
+        }
+        Block { statements, .. } | Multi { statements, .. } => {
+            for x in statements {
+                collect_calls_stmt(x, encl, out);
+            }
+        }
+        VarDecl { init: Some(e), .. } => collect_calls_expr(e, encl, out),
+        VarDeclDestructure { init, .. } => collect_calls_expr(init, encl, out),
+        ExprStmt { expr, .. } => collect_calls_expr(expr, encl, out),
+        Return { value: Some(e), .. } | Throw { value: e, .. } => collect_calls_expr(e, encl, out),
+        If { cond, then_branch, else_branch, .. } => {
+            collect_calls_expr(cond, encl, out);
+            collect_calls_stmt(then_branch, encl, out);
+            if let Some(e) = else_branch {
+                collect_calls_stmt(e, encl, out);
+            }
+        }
+        While { cond, body, .. } | DoWhile { cond, body, .. } => {
+            collect_calls_expr(cond, encl, out);
+            collect_calls_stmt(body, encl, out);
+        }
+        For { init, cond, update, body, .. } => {
+            if let Some(i) = init {
+                collect_calls_stmt(i, encl, out);
+            }
+            if let Some(c) = cond {
+                collect_calls_expr(c, encl, out);
+            }
+            if let Some(u) = update {
+                collect_calls_expr(u, encl, out);
+            }
+            collect_calls_stmt(body, encl, out);
+        }
+        ForOf { iterable, body, .. } | ForIn { object: iterable, body, .. } => {
+            collect_calls_expr(iterable, encl, out);
+            collect_calls_stmt(body, encl, out);
+        }
+        Switch { expr, cases, default_body, .. } => {
+            collect_calls_expr(expr, encl, out);
+            for (g, b) in cases {
+                if let Some(ge) = g {
+                    collect_calls_expr(ge, encl, out);
+                }
+                for x in b {
+                    collect_calls_stmt(x, encl, out);
+                }
+            }
+            if let Some(d) = default_body {
+                for x in d {
+                    collect_calls_stmt(x, encl, out);
+                }
+            }
+        }
+        Try { body, catch_body, finally_body, .. } => {
+            collect_calls_stmt(body, encl, out);
+            if let Some(c) = catch_body {
+                collect_calls_stmt(c, encl, out);
+            }
+            if let Some(f) = finally_body {
+                collect_calls_stmt(f, encl, out);
+            }
+        }
+        Export { declaration, .. } => {
+            if let tishlang_ast::ExportDeclaration::Named(inner) = declaration.as_ref() {
+                collect_calls_stmt(inner, encl, out);
+            }
+        }
+        _ => {}
+    }
+}
+
+/// SOUND replacement for the "nonnumeric arg" blacklist (tishlang/tish#485/#477/#484): a per-position
+/// interprocedural fixpoint. Returns the set of fns that have a body-numeric CANDIDATE param position
+/// which is NOT provably fed numbers at every call site — those must stay boxed (not `: number`).
+pub(crate) fn fns_with_unsafe_numeric_arg(statements: &[Statement]) -> HashSet<String> {
+    let cand = numeric_candidate_positions(statements);
+    if cand.is_empty() {
+        return HashSet::new();
+    }
+    let mut all_params: std::collections::HashMap<String, Vec<String>> =
+        std::collections::HashMap::new();
+    let mut fn_locals: std::collections::HashMap<String, HashSet<String>> =
+        std::collections::HashMap::new();
+    for s in statements {
+        cfm_stmt(s, &mut all_params, &mut fn_locals);
+    }
+    // Top-level numeric locals — run a fixpoint ACROSS statements so a chain propagates
+    // (`let PI = …; let SOLAR_MASS = 4 * PI * PI` ⇒ both numeric, so `body(…, SOLAR_MASS)` is safe).
+    let mut top_nums = HashSet::new();
+    loop {
+        let before = top_nums.len();
+        for s in statements {
+            collect_numeric_locals_fixpoint(s, &mut top_nums);
+        }
+        if top_nums.len() == before {
+            break;
+        }
+    }
+    let mut calls = Vec::new();
+    for s in statements {
+        collect_calls_stmt(s, &None, &mut calls);
+    }
+
+    // numeric_pos[f] = positions currently believed to receive only numbers. Start optimistic (all).
+    let mut numeric_pos: std::collections::HashMap<String, HashSet<usize>> = all_params
+        .iter()
+        .map(|(f, ps)| (f.clone(), (0..ps.len()).collect()))
+        .collect();
+
+    loop {
+        let mut changed = false;
+        for cs in &calls {
+            if !numeric_pos.contains_key(&cs.callee) {
+                continue;
+            }
+            // Caller context: its numeric locals + params whose position is still numeric.
+            let ctx: HashSet<String> = match &cs.caller {
+                None => top_nums.clone(),
+                Some(c) => {
+                    // Top-level numeric globals (`SOLAR_MASS`, `PI`, …) are numeric inside every fn,
+                    // plus this fn's numeric locals + its still-numeric params.
+                    let mut ctx = top_nums.clone();
+                    ctx.extend(fn_locals.get(c).cloned().unwrap_or_default());
+                    if let (Some(ps), Some(np)) = (all_params.get(c), numeric_pos.get(c)) {
+                        for &pos in np {
+                            if let Some(n) = ps.get(pos) {
+                                ctx.insert(n.clone());
+                            }
+                        }
+                    }
+                    ctx
+                }
+            };
+            let arity = all_params.get(&cs.callee).map(|p| p.len()).unwrap_or(0);
+            let set = numeric_pos.get_mut(&cs.callee).unwrap();
+            if cs.has_spread {
+                if !set.is_empty() {
+                    set.clear();
+                    changed = true;
+                }
+                continue;
+            }
+            for pos in 0..arity {
+                if !set.contains(&pos) {
+                    continue;
+                }
+                let ok = match cs.args.get(pos) {
+                    Some(ac) => arg_ok(ac, &ctx),
+                    None => false, // missing arg → undefined/Null → not a number
+                };
+                if !ok {
+                    set.remove(&pos);
+                    changed = true;
+                }
+            }
+        }
+        if !changed {
+            break;
+        }
+    }
+
+    let mut disq = HashSet::new();
+    for (f, positions) in &cand {
+        match numeric_pos.get(f) {
+            Some(np) => {
+                if positions.iter().any(|(pos, _)| !np.contains(pos)) {
+                    disq.insert(f.clone());
+                }
+            }
+            None => {
+                disq.insert(f.clone());
+            }
+        }
+    }
+    disq
+}
+
 fn pi_stmt(s: Statement, nonnumeric: &HashSet<String>, escaping: &HashSet<String>) -> Statement {
     if let Statement::FunDecl {
         async_,
@@ -374,21 +890,9 @@ fn pi_stmt(s: Statement, nonnumeric: &HashSet<String>, escaping: &HashSet<String
                     // Monotone, locals/param-candidate-only.
                     if tp.type_ann.is_none()
                         && tp.default.is_none()
+                        && param_is_body_numeric_candidate(&body, &base_nums, tp.name.as_ref())
                     {
-                        let mut nums = base_nums.clone();
-                        nums.insert(tp.name.to_string());
-                        collect_numeric_locals_fixpoint(&body, &mut nums);
-                        let copy_descendants: Vec<&String> = nums
-                            .iter()
-                            .filter(|x| x.as_str() != tp.name.as_ref() && !base_nums.contains(*x))
-                            .collect();
-                        if nus_stmt(&body, tp.name.as_ref(), &nums)
-                            && copy_descendants
-                                .iter()
-                                .all(|x| lns_stmt(&body, x.as_str(), &nums))
-                        {
-                            tp.type_ann = Some(TypeAnnotation::Simple(std::sync::Arc::from("number"), tishlang_ast::Span::default()));
-                        }
+                        tp.type_ann = Some(TypeAnnotation::Simple(std::sync::Arc::from("number"), tishlang_ast::Span::default()));
                     }
                     FunParam::Simple(tp)
                 }
@@ -484,7 +988,7 @@ fn collect_numeric_locals(s: &Statement, out: &mut HashSet<String>) {
 /// names (a copy of an already-numeric source), so it converges in at most one pass per copy-chain
 /// link; the `out.len()` watermark detects quiescence. Soundness: every added name is a copy of a
 /// value already proven/assumed numeric, the same basis as the literal seeding.
-fn collect_numeric_locals_fixpoint(body: &Statement, out: &mut HashSet<String>) {
+pub(crate) fn collect_numeric_locals_fixpoint(body: &Statement, out: &mut HashSet<String>) {
     loop {
         let before = out.len();
         collect_numeric_locals(body, out);
@@ -3710,7 +4214,7 @@ pub fn analyze_aggregate(program: &Program) -> AggregateAnalysis {
     // params either — `fn makeRecord(id, name){ return {id, name} }` called `makeRecord(1, "Alice")`
     // would otherwise emit a `match … panic!("expected number")` coercion on the String. Same set the
     // M4 `param_infer` path uses (infer.rs:273).
-    let nonnumeric = crate::codegen::Codegen::fns_called_with_nonnumeric_arg(&program.statements);
+    let nonnumeric = fns_with_unsafe_numeric_arg(&program.statements);
     // Soundness (#477): a fn referenced as a first-class VALUE (a `serve` handler / stored callback)
     // is invoked via the boxed `Value::Function` path with arbitrary runtime Values, so — exactly as
     // in `param_infer_program` — its params must NOT get an S-0 `: number` shadow either. Without this

package/crates/tish_compile/src/resolve.rs

@@ -59,6 +59,7 @@ const BUILTIN_ALIASES: &[(&str, &str)] = &[
     ("process", "tish:process"),
     ("ws", "tish:ws"),
     ("tty", "tish:tty"),
+    ("pty", "tish:pty"),
 ];
 
 /// Normalize built-in spec to canonical form. Handles the Node `node:` prefix
@@ -87,9 +88,10 @@ pub fn is_builtin_native_spec(spec: &str) -> bool {
             | "tish:process"
             | "tish:ws"
             | "tish:tty"
+            | "tish:pty"
     ) || matches!(
         spec,
-        "fs" | "fs/promises" | "http" | "timers" | "process" | "ws" | "tty"
+        "fs" | "fs/promises" | "http" | "timers" | "process" | "ws" | "tty" | "pty"
     )
 }
 

package/crates/tish_compile/src/types.rs

@@ -390,13 +390,18 @@ impl RustType {
                 let field_assigns = fields
                     .iter()
                     .map(|(k, ty)| {
-                        let fetch = format!("tishlang_runtime::get_prop(&_src, {:?})", k.as_ref());
+                        let fetch = format!("tishlang_runtime::get_prop(_src, {:?})", k.as_ref());
                         format!("{}: {}", field_ident(k), ty.from_value_expr(&fetch))
                     })
                     .collect::<Vec<_>>()
                     .join(", ");
+                // Bind `_src` as a BORROW (not a move) of the source Value: field fetches only need
+                // `&Value` (get_prop borrows), and moving would use-after-move a caller-owned temp —
+                // e.g. an assignment-as-expression `{ let _v = obj; lhs = <coerce _v>; _v }` reuses
+                // `_v` for its value (tishlang/tish#486). `&(expr)` evaluates the source once and
+                // (for a temporary) lifetime-extends it to this block, so it's still single-eval.
                 format!(
-                    "{{ let _src = {}; {} {{ {} }} }}",
+                    "{{ let _src = &({}); {} {{ {} }} }}",
                     value_expr,
                     named_struct_ident(name),
                     field_assigns
@@ -448,9 +453,13 @@ impl RustType {
                 )
             }
             RustType::Option(inner) => {
-                let inner_to_value = inner.to_value_expr("v");
+                // Box by REFERENCE so the source Option is NOT moved — it may be a local captured by
+                // an FnMut closure (a `serve()` handler, called per request) or used again after this
+                // conversion. Mirrors the Vec arm's `.iter()` (which likewise avoids moving). `(*v)`
+                // derefs the `&inner` the ref-match binds, so the inner's own clone/copy still applies.
+                let inner_to_value = inner.to_value_expr("(*v)");
                 format!(
-                    "match {} {{ Some(v) => {}, None => Value::Null }}",
+                    "match &({}) {{ Some(v) => {}, None => Value::Null }}",
                     native_expr, inner_to_value
                 )
             }

package/crates/tish_compile/tests/regr_484_obj_field_param.rs

@@ -0,0 +1,18 @@
+//! tishlang/tish#484 — a string param used only as an object-field VALUE (`{ v: s }`) must not be
+//! native-promoted to f64. analyze_aggregate's S-0 (`pus_stmt`) treats a field-value param as
+//! numeric; the call-arg whitelist must cover S-0's candidate set, so `f("hello")` disqualifies f.
+use std::path::PathBuf;
+use tishlang_compile::compile_project_full;
+fn compile(rel: &str) -> String {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let path = manifest.join("../..").join(rel).canonicalize().unwrap();
+    compile_project_full(&path, path.parent(), &[], true).unwrap().0
+}
+#[test]
+fn obj_field_string_param_stays_boxed() {
+    for f in ["tests/regression/obj_field_string_param.tish", "tests/regression/async_param_across_await.tish"] {
+        let rust = compile(f);
+        let bad: Vec<&str> = rust.lines().filter(|l| l.contains("expected number")).collect();
+        assert!(bad.is_empty(), "{f}: string field-value param must not f64-unbox:\n{}", bad.join("\n"));
+    }
+}

package/crates/tish_compile/tests/regr_e0382_typed_struct.rs

@@ -0,0 +1,26 @@
+//! tishlang/tish#486 — a typed nullable-struct local reassigned to a struct literal in a conditional
+//! must not emit a Value→struct coercion that MOVES the source temp, because the assignment-as-
+//! expression wrapper (`{ let _v = obj; lhs = <coerce _v>; _v }`) reuses that temp for its value —
+//! moving it produced `error[E0382]: use of moved value`. The coercion must borrow the source.
+use std::path::PathBuf;
+use tishlang_compile::compile_project_full;
+
+fn compile(rel: &str) -> String {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let path = manifest.join("../..").join(rel).canonicalize().unwrap();
+    compile_project_full(&path, path.parent(), &[], true).unwrap().0
+}
+
+#[test]
+fn typed_struct_coercion_borrows_source() {
+    let rust = compile("tests/regression/typed_struct_cond_assign.tish");
+    // The Value→struct coercion must bind `_src` by BORROW, never by moving a bare temp.
+    assert!(
+        rust.contains("let _src = &("),
+        "expected the struct coercion to borrow its source (`let _src = &(...)`)"
+    );
+    assert!(
+        !rust.contains("let _src = _v;"),
+        "tishlang/tish#486: struct coercion must not MOVE the wrapper temp `_v` (use-after-move / E0382)"
+    );
+}

package/crates/tish_compile/tests/regr_numeric_arg_whitelist.rs

@@ -0,0 +1,29 @@
+//! tishlang/tish#485/#477/#484 — SYSTEMIC: a param is native-promoted to f64 only if the
+//! interprocedural per-position fixpoint proves every call site feeds it numbers. #485's
+//! return-either-param helper (called with string|null results) must NOT get an f64 unbox; the
+//! recursive + pass-through numeric fns MUST still promote (no perf regression).
+use std::path::PathBuf;
+use tishlang_compile::compile_project_full;
+
+fn compile(rel: &str) -> String {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let path = manifest.join("../..").join(rel).canonicalize().unwrap();
+    compile_project_full(&path, path.parent(), &[], true).unwrap().0
+}
+
+#[test]
+fn unsafe_numeric_arg_stays_boxed_no_f64_unbox() {
+    let rust = compile("tests/regression/f64_return_either_param.tish");
+    let bad: Vec<&str> = rust.lines().filter(|l| l.contains("expected number")).collect();
+    assert!(bad.is_empty(), "no fn here does arithmetic; nothing should f64-unbox:\n{}", bad.join("\n"));
+}
+
+#[test]
+fn recursive_and_passthrough_numeric_fns_still_promote() {
+    let rust = compile("tests/regression/numeric_arg_whitelist.tish");
+    // fib(n-1)/fib(n-2): n is arithmetic → promoted; work(n) via driver's param n → pass-through.
+    assert!(
+        rust.contains("fib") && (rust.contains(": f64") || rust.contains("Value::Number")),
+        "recursive/pass-through numeric params must still get the native f64 fast path"
+    );
+}

package/crates/tish_compile/tests/regr_serve_closure.rs

@@ -0,0 +1,22 @@
+//! tishlang/tish — a typed Option (`string?`) captured by a long-lived FnMut closure (a `serve()`
+//! handler, called per request) must not be MOVED when boxed to a Value for a `=== null` comparison.
+//! `to_value_expr(Option)` must match by REFERENCE (`match &(…)`), like the Vec arm's `.iter()`.
+use std::path::PathBuf;
+use tishlang_compile::compile_project_full;
+fn compile(rel: &str) -> String {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let path = manifest.join("../..").join(rel).canonicalize().unwrap();
+    compile_project_full(&path, path.parent(), &[], true).unwrap().0
+}
+#[test]
+fn option_boxing_borrows_not_moves() {
+    let rust = compile("tests/regression/serve_closure_captures_typed.tish");
+    assert!(
+        rust.contains("match &(sToken)"),
+        "Option→Value boxing must match by reference so the source isn't moved"
+    );
+    assert!(
+        !rust.contains("match sToken { Some(v)"),
+        "Option→Value boxing must not match by value (moves the closure-captured Option)"
+    );
+}

package/crates/tish_fmt/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tishlang_fmt"
-version = "2.37.0"
+version = "2.38.0"
 edition = "2021"
 description = "Opinionated formatter for Tish source (parse → pretty-print)"
 license-file = { workspace = true }

package/crates/tish_native/src/build.rs

@@ -17,6 +17,7 @@ const RUNTIME_CARGO_FEATURES: &[&str] = &[
     "regex",
     "ws",
     "tty",
+    "pty",
 ];
 
 /// Map CLI/compile features to flags passed to `tishlang_runtime` in the temp crate's Cargo.toml.

package/crates/tish_runtime/Cargo.toml

@@ -58,6 +58,9 @@ fs = ["promise", "dep:rand"]
 process = []
 # Interactive terminal I/O (issue #101): raw mode, key/resize events, size, alt screen.
 tty = ["dep:crossterm"]
+# Pseudoterminal hosting (issue #493): spawn a shell/program on a real PTY, read/write/resize/kill —
+# so an interactive terminal emulator on the other end of a socket behaves like a real TTY.
+pty = ["dep:portable-pty", "dep:lazy_static"]
 regex = ["tishlang_core/regex"]
 # WebSocket (JS-like API). Modular: import { WebSocket, Server } from 'tish:ws'.
 # Requires `send-values` because the WS server keeps an `Arc<dyn Fn + Send +
@@ -90,6 +93,8 @@ libc = { version = "0.2", optional = true }
 arc-swap = { version = "1", optional = true }
 # Interactive terminal I/O (feature = tty): cross-platform raw mode, key/resize events, size.
 crossterm = { version = "0.28", optional = true }
+# Pseudoterminal hosting (feature = pty): cross-platform openpty + shell spawn (same crate Dune uses).
+portable-pty = { version = "0.9", optional = true }
 # hyper backend (feature = http-hyper)
 hyper = { version = "1", default-features = false, features = ["server", "http1", "http2"], optional = true }
 hyper-util = { version = "0.1", features = ["server", "tokio"], optional = true }

package/crates/tish_runtime/src/lib.rs

@@ -1727,6 +1727,11 @@ pub use tty::{
     tty_enter_alt_screen, tty_is_tty, tty_leave_alt_screen, tty_read, tty_read_line, tty_set_raw_mode, tty_size,
 };
 
+#[cfg(feature = "pty")]
+pub mod pty;
+#[cfg(feature = "pty")]
+pub use pty::{pty_kill, pty_pid, pty_read, pty_resize, pty_spawn, pty_write};
+
 #[cfg(feature = "ws")]
 pub use ws::{
     web_socket_client, web_socket_server_accept, web_socket_server_construct,

package/crates/tish_runtime/src/pty.rs

@@ -0,0 +1,451 @@
+//! Pseudoterminal (PTY) module for Tish (`tish:pty`), behind the `pty` feature.
+//!
+//! Spawns a real OS pseudoterminal with a live shell/program attached — so an interactive
+//! terminal emulator (xterm.js) on the other end of a socket behaves like a real TTY:
+//! `isatty()` passes, so line-editing and curses apps (vim, top, ssh, tab-completion, and
+//! `SIGWINCH` resize) all work. This is what `tish:process` (run-to-completion capture) and
+//! `tish:tty` (this process's OWN controlling terminal) cannot do. Imported as
+//! `import { spawn, read, write, resize, kill } from 'tish:pty'`.
+//!
+//! Polling model (transport-agnostic — pairs with a `tish:ws` pump or an HTTP long-poll):
+//!   - `spawn({ program?, cwd?, cols?, rows?, env? }) -> id | null`
+//!   - `read(id, timeoutMs?) -> string | null`   (`""` = live but no output yet; `null` = EOF/unknown)
+//!   - `write(id, data) -> bool`
+//!   - `resize(id, cols, rows) -> bool`
+//!   - `kill(id) -> bool`
+//!   - `pid(id) -> number | null`
+//!
+//! A per-session reader thread fills a byte buffer that `read` drains at a UTF-8 boundary
+//! (incomplete trailing multibyte sequences are held for the next read — no mojibake). A global
+//! `Mutex<HashMap<id, PtySession>>` registry mirrors `ws.rs`'s `CONNS`. Errors surface as
+//! `null`/`false` rather than panicking.
+
+use std::collections::HashMap;
+use std::io::{Read, Write};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::{Arc, Condvar, Mutex};
+use std::time::Duration;
+
+use lazy_static::lazy_static;
+use portable_pty::{native_pty_system, Child, CommandBuilder, MasterPty, PtySize};
+use tishlang_core::Value;
+
+/// Output accumulated by the reader thread, drained by `read`.
+struct PtyBuf {
+    data: Vec<u8>,
+    eof: bool,
+}
+
+struct PtySession {
+    child: Mutex<Box<dyn Child + Send + Sync>>,
+    master: Mutex<Box<dyn MasterPty + Send>>,
+    writer: Mutex<Box<dyn Write + Send>>,
+    buf: Arc<(Mutex<PtyBuf>, Condvar)>,
+    pid: Option<u32>,
+}
+
+lazy_static! {
+    static ref SESSIONS: Mutex<HashMap<u64, PtySession>> = Mutex::new(HashMap::new());
+}
+
+static NEXT_ID: AtomicU64 = AtomicU64::new(1);
+
+// --- Value helpers (mirror the ws.rs idioms) ---
+
+fn arg_u64(args: &[Value], i: usize) -> Option<u64> {
+    match args.get(i) {
+        Some(Value::Number(n)) if n.is_finite() && *n >= 0.0 => Some(*n as u64),
+        _ => None,
+    }
+}
+
+fn arg_u16(args: &[Value], i: usize) -> Option<u16> {
+    match args.get(i) {
+        Some(Value::Number(n)) if n.is_finite() && *n >= 0.0 => Some(*n as u16),
+        _ => None,
+    }
+}
+
+/// Clone a field out of an options object (`{ key: value }`), or `None` if the arg isn't an object.
+fn obj_field(o: &Value, key: &str) -> Option<Value> {
+    if let Value::Object(m) = o {
+        return m.borrow().strings.get(key).cloned();
+    }
+    None
+}
+
+fn obj_str(o: &Value, key: &str) -> Option<String> {
+    match obj_field(o, key) {
+        Some(Value::String(s)) => Some(s.to_string()),
+        Some(Value::Null) | None => None,
+        Some(v) => Some(v.to_display_string()),
+    }
+}
+
+fn obj_num(o: &Value, key: &str) -> Option<f64> {
+    match obj_field(o, key) {
+        Some(Value::Number(n)) if n.is_finite() => Some(n),
+        _ => None,
+    }
+}
+
+/// `spawn({ program?, cwd?, cols?, rows?, env? })` → a stable id for read/write/resize/kill,
+/// or `null` on failure.
+pub fn pty_spawn(args: &[Value]) -> Value {
+    let null = Value::Null;
+    let opts = args.first().unwrap_or(&null);
+
+    let cols = obj_num(opts, "cols").filter(|n| *n > 0.0).unwrap_or(80.0) as u16;
+    let rows = obj_num(opts, "rows").filter(|n| *n > 0.0).unwrap_or(24.0) as u16;
+
+    let pty_system = native_pty_system();
+    let pair = match pty_system.openpty(PtySize {
+        rows,
+        cols,
+        pixel_width: 0,
+        pixel_height: 0,
+    }) {
+        Ok(p) => p,
+        Err(_) => return Value::Null,
+    };
+
+    let mut cmd = if let Some(prog) = obj_str(opts, "program") {
+        CommandBuilder::new(prog)
+    } else if cfg!(windows) {
+        CommandBuilder::new("powershell.exe")
+    } else {
+        let shell = std::env::var("SHELL").unwrap_or_else(|_| "/bin/bash".to_string());
+        CommandBuilder::new(shell)
+    };
+
+    if let Some(cwd) = obj_str(opts, "cwd") {
+        cmd.cwd(cwd);
+    }
+
+    // Caller-supplied env overrides inherit the parent environment (portable_pty default); we
+    // only add. Ensure TERM is set so curses apps negotiate correctly unless overridden.
+    let mut has_term = false;
+    if let Some(Value::Object(em)) = obj_field(opts, "env") {
+        for (k, v) in em.borrow().strings.iter() {
+            if k.as_ref() == "TERM" {
+                has_term = true;
+            }
+            cmd.env(k.as_ref(), v.to_display_string());
+        }
+    }
+    if !has_term {
+        cmd.env("TERM", "xterm-256color");
+    }
+
+    let child = match pair.slave.spawn_command(cmd) {
+        Ok(c) => c,
+        Err(_) => return Value::Null,
+    };
+    let reader = match pair.master.try_clone_reader() {
+        Ok(r) => r,
+        Err(_) => return Value::Null,
+    };
+    let writer = match pair.master.take_writer() {
+        Ok(w) => w,
+        Err(_) => return Value::Null,
+    };
+    let pid = child.process_id();
+
+    let buf = Arc::new((
+        Mutex::new(PtyBuf {
+            data: Vec::new(),
+            eof: false,
+        }),
+        Condvar::new(),
+    ));
+
+    // Reader thread: block on the master, append bytes, wake any waiting `read`. On EOF/error,
+    // mark eof so `read` can return null once the buffer drains.
+    {
+        let buf = buf.clone();
+        let mut reader = reader;
+        std::thread::spawn(move || {
+            let mut tmp = [0u8; 8192];
+            loop {
+                match reader.read(&mut tmp) {
+                    Ok(0) => {
+                        let (lock, cv) = &*buf;
+                        if let Ok(mut b) = lock.lock() {
+                            b.eof = true;
+                        }
+                        cv.notify_all();
+                        break;
+                    }
+                    Ok(n) => {
+                        let (lock, cv) = &*buf;
+                        if let Ok(mut b) = lock.lock() {
+                            b.data.extend_from_slice(&tmp[..n]);
+                        }
+                        cv.notify_all();
+                    }
+                    Err(_) => {
+                        let (lock, cv) = &*buf;
+                        if let Ok(mut b) = lock.lock() {
+                            b.eof = true;
+                        }
+                        cv.notify_all();
+                        break;
+                    }
+                }
+            }
+        });
+    }
+
+    let id = NEXT_ID.fetch_add(1, Ordering::SeqCst);
+    let session = PtySession {
+        child: Mutex::new(child),
+        master: Mutex::new(pair.master),
+        writer: Mutex::new(writer),
+        buf,
+        pid,
+    };
+    match SESSIONS.lock() {
+        Ok(mut g) => {
+            g.insert(id, session);
+        }
+        Err(_) => return Value::Null,
+    }
+    Value::Number(id as f64)
+}
+
+/// `read(id, timeoutMs?)` → available output as a string (possibly `""` if none arrived within the
+/// timeout), or `null` at EOF / for an unknown id. Drains only a valid UTF-8 prefix, holding any
+/// incomplete trailing multibyte bytes for the next call.
+pub fn pty_read(args: &[Value]) -> Value {
+    let id = match arg_u64(args, 0) {
+        Some(x) => x,
+        None => return Value::Null,
+    };
+    let timeout_ms = match args.get(1) {
+        Some(Value::Number(n)) if n.is_finite() && *n >= 0.0 => *n as u64,
+        _ => 0,
+    };
+
+    let buf = {
+        let g = match SESSIONS.lock() {
+            Ok(g) => g,
+            Err(_) => return Value::Null,
+        };
+        match g.get(&id) {
+            Some(s) => s.buf.clone(),
+            None => return Value::Null,
+        }
+    };
+
+    let (lock, cv) = &*buf;
+    let mut b = match lock.lock() {
+        Ok(b) => b,
+        Err(_) => return Value::Null,
+    };
+    if b.data.is_empty() && !b.eof && timeout_ms > 0 {
+        let res = cv.wait_timeout_while(b, Duration::from_millis(timeout_ms), |b| {
+            b.data.is_empty() && !b.eof
+        });
+        b = match res {
+            Ok((g, _)) => g,
+            Err(e) => e.into_inner().0,
+        };
+    }
+
+    if b.data.is_empty() {
+        if b.eof {
+            return Value::Null;
+        }
+        return Value::String("".into());
+    }
+
+    // Drain up to the last complete UTF-8 code point; keep the incomplete tail for next time.
+    let valid = match std::str::from_utf8(&b.data) {
+        Ok(_) => b.data.len(),
+        Err(e) => e.valid_up_to(),
+    };
+    if valid == 0 {
+        // A leading incomplete multibyte sequence. If the stream is done, flush it lossily so
+        // nothing is stranded; otherwise wait for the rest.
+        if b.eof {
+            let s = String::from_utf8_lossy(&b.data).into_owned();
+            b.data.clear();
+            return Value::String(s.into());
+        }
+        return Value::String("".into());
+    }
+    let out: Vec<u8> = b.data.drain(..valid).collect();
+    let s = String::from_utf8(out).unwrap_or_default();
+    Value::String(s.into())
+}
+
+/// `write(id, data)` → feed input bytes to the PTY. Returns whether the write succeeded.
+pub fn pty_write(args: &[Value]) -> Value {
+    let id = match arg_u64(args, 0) {
+        Some(x) => x,
+        None => return Value::Bool(false),
+    };
+    let data = match args.get(1) {
+        Some(Value::String(s)) => s.to_string(),
+        Some(v) => v.to_display_string(),
+        None => return Value::Bool(false),
+    };
+    let g = match SESSIONS.lock() {
+        Ok(g) => g,
+        Err(_) => return Value::Bool(false),
+    };
+    let s = match g.get(&id) {
+        Some(s) => s,
+        None => return Value::Bool(false),
+    };
+    let mut w = match s.writer.lock() {
+        Ok(w) => w,
+        Err(_) => return Value::Bool(false),
+    };
+    match w.write_all(data.as_bytes()).and_then(|_| w.flush()) {
+        Ok(_) => Value::Bool(true),
+        Err(_) => Value::Bool(false),
+    }
+}
+
+/// `resize(id, cols, rows)` → tell the PTY its new window size (fires `SIGWINCH` in the child).
+pub fn pty_resize(args: &[Value]) -> Value {
+    let id = match arg_u64(args, 0) {
+        Some(x) => x,
+        None => return Value::Bool(false),
+    };
+    let cols = match arg_u16(args, 1) {
+        Some(c) if c > 0 => c,
+        _ => return Value::Bool(false),
+    };
+    let rows = match arg_u16(args, 2) {
+        Some(r) if r > 0 => r,
+        _ => return Value::Bool(false),
+    };
+    let g = match SESSIONS.lock() {
+        Ok(g) => g,
+        Err(_) => return Value::Bool(false),
+    };
+    let s = match g.get(&id) {
+        Some(s) => s,
+        None => return Value::Bool(false),
+    };
+    let m = match s.master.lock() {
+        Ok(m) => m,
+        Err(_) => return Value::Bool(false),
+    };
+    match m.resize(PtySize {
+        rows,
+        cols,
+        pixel_width: 0,
+        pixel_height: 0,
+    }) {
+        Ok(_) => Value::Bool(true),
+        Err(_) => Value::Bool(false),
+    }
+}
+
+/// `kill(id)` → terminate the child and drop the session. Returns whether the id was live.
+pub fn pty_kill(args: &[Value]) -> Value {
+    let id = match arg_u64(args, 0) {
+        Some(x) => x,
+        None => return Value::Bool(false),
+    };
+    let sess = {
+        let mut g = match SESSIONS.lock() {
+            Ok(g) => g,
+            Err(_) => return Value::Bool(false),
+        };
+        g.remove(&id)
+    };
+    match sess {
+        Some(s) => {
+            if let Ok(mut c) = s.child.lock() {
+                let _ = c.kill();
+                let _ = c.wait();
+            }
+            Value::Bool(true)
+        }
+        None => Value::Bool(false),
+    }
+}
+
+/// `pid(id)` → the child process id, or `null` for an unknown id / no pid.
+pub fn pty_pid(args: &[Value]) -> Value {
+    let id = match arg_u64(args, 0) {
+        Some(x) => x,
+        None => return Value::Null,
+    };
+    let g = match SESSIONS.lock() {
+        Ok(g) => g,
+        Err(_) => return Value::Null,
+    };
+    match g.get(&id).and_then(|s| s.pid) {
+        Some(p) => Value::Number(p as f64),
+        None => Value::Null,
+    }
+}
+
+#[cfg(all(test, unix))]
+mod tests {
+    use super::*;
+
+    /// Proves a LIVE interactive PTY (persistent shell on a pseudoterminal), not run-to-completion:
+    /// spawn a shell, write a command, and read its executed output back.
+    #[test]
+    fn spawn_write_read_roundtrip() {
+        let id = match pty_spawn(&[]) {
+            Value::Number(n) => n,
+            other => panic!("spawn failed: {:?}", other),
+        };
+        // Drain the shell's startup banner/prompt.
+        let _ = pty_read(&[Value::Number(id), Value::Number(300.0)]);
+        assert!(matches!(
+            pty_write(&[Value::Number(id), Value::String("echo pty_ok_123\n".into())]),
+            Value::Bool(true)
+        ));
+        let mut acc = String::new();
+        for _ in 0..100 {
+            match pty_read(&[Value::Number(id), Value::Number(50.0)]) {
+                Value::String(s) => acc.push_str(&s),
+                Value::Null => break,
+                _ => {}
+            }
+            if acc.contains("pty_ok_123") {
+                break;
+            }
+        }
+        let _ = pty_kill(&[Value::Number(id)]);
+        assert!(acc.contains("pty_ok_123"), "pty output missing echo: {:?}", acc);
+    }
+
+    #[test]
+    fn resize_live_session_ok() {
+        let id = match pty_spawn(&[]) {
+            Value::Number(n) => n,
+            other => panic!("spawn failed: {:?}", other),
+        };
+        assert!(matches!(
+            pty_resize(&[Value::Number(id), Value::Number(120.0), Value::Number(40.0)]),
+            Value::Bool(true)
+        ));
+        assert!(matches!(pty_pid(&[Value::Number(id)]), Value::Number(_)));
+        assert!(matches!(pty_kill(&[Value::Number(id)]), Value::Bool(true)));
+    }
+
+    #[test]
+    fn unknown_id_surfaces_null_or_false() {
+        let bad = 9_999_999.0;
+        assert!(matches!(pty_read(&[Value::Number(bad)]), Value::Null));
+        assert!(matches!(
+            pty_write(&[Value::Number(bad), Value::String("x".into())]),
+            Value::Bool(false)
+        ));
+        assert!(matches!(
+            pty_resize(&[Value::Number(bad), Value::Number(80.0), Value::Number(24.0)]),
+            Value::Bool(false)
+        ));
+        assert!(matches!(pty_kill(&[Value::Number(bad)]), Value::Bool(false)));
+        assert!(matches!(pty_pid(&[Value::Number(bad)]), Value::Null));
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tishlang/tish-format",
-  "version": "2.37.0",
+  "version": "2.38.0",
   "description": "Tish code formatter",
   "license": "PIF",
   "repository": {