@tishlang/tish-lint 2.12.0 → 2.35.0

package/crates/tish_eval/src/eval.rs

@@ -2,6 +2,7 @@
 
 #![allow(clippy::type_complexity, clippy::cloned_ref_to_slice_refs)]
 
+use std::cell::Cell;
 use std::cell::RefCell;
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
@@ -21,6 +22,74 @@ use crate::value::{
     eval_object_get, eval_object_has, eval_object_set, EvalObjectData, PropMap, Value,
 };
 
+// #203: cursor cache for O(1)/near-O(1) character indexing in the interpreter. Twin of the one in
+// `tishlang_builtins::string` (used by the native/VM backends); duplicated here because the
+// interpreter has its own `Value`/`Arc<str>` string type rather than `tishlang_core`'s `ArcStr`. tish
+// strings are UTF-8, so `chars().nth(i)` is O(i) — turning indexed/strided scans into O(n^2). For each
+// recently-indexed string we cache whether it is all-ASCII (then a character index equals a byte index
+// → O(1)) plus a forward cursor (so non-ASCII sequential/strided scans advance from the last position).
+// Safety: the entry holds an `Arc<str>` CLONE, keeping the allocation alive so its data pointer can't
+// be reused while cached (no ABA), and since strings are immutable the cached ASCII flag stays valid.
+struct EvalCharCursor {
+    s: Arc<str>,
+    ascii: bool,
+    len_chars: usize,
+    char_idx: usize,
+    byte_off: usize,
+}
+
+thread_local! {
+    static EVAL_INDEX_CURSOR: RefCell<Option<EvalCharCursor>> = const { RefCell::new(None) };
+}
+
+fn with_eval_cursor<R>(s: &Arc<str>, f: impl FnOnce(&mut EvalCharCursor, &Arc<str>) -> R) -> R {
+    EVAL_INDEX_CURSOR.with(|cell| {
+        let mut slot = cell.borrow_mut();
+        let hit = matches!(slot.as_ref(), Some(c)
+            if std::ptr::eq(c.s.as_bytes().as_ptr(), s.as_bytes().as_ptr()) && c.s.len() == s.len());
+        if !hit {
+            let ascii = s.as_bytes().is_ascii();
+            let len_chars = if ascii { s.len() } else { s.chars().count() };
+            *slot = Some(EvalCharCursor {
+                s: Arc::clone(s),
+                ascii,
+                len_chars,
+                char_idx: 0,
+                byte_off: 0,
+            });
+        }
+        f(slot.as_mut().unwrap(), s)
+    })
+}
+
+/// Character (Unicode scalar) at index `idx` via the cursor cache. Identical results to
+/// `s.chars().nth(idx)`, but O(1) for ASCII and near-O(1) for forward/strided scans.
+fn nth_char_cached(s: &Arc<str>, idx: usize) -> Option<char> {
+    with_eval_cursor(s, |c, s| {
+        if c.ascii {
+            return s.as_bytes().get(idx).map(|&b| b as char);
+        }
+        let (base_idx, base_off) = if idx >= c.char_idx {
+            (c.char_idx, c.byte_off)
+        } else {
+            (0, 0)
+        };
+        match s[base_off..].char_indices().nth(idx - base_idx) {
+            Some((rel_off, ch)) => {
+                c.char_idx = idx;
+                c.byte_off = base_off + rel_off;
+                Some(ch)
+            }
+            None => None,
+        }
+    })
+}
+
+/// Character (Unicode scalar) count via the cursor cache — O(1) after the first call on a string.
+fn char_count_cached(s: &Arc<str>) -> usize {
+    with_eval_cursor(s, |c, _| c.len_chars)
+}
+
 pub struct Scope {
     // Scope vars: order is never observed (no Object.keys over a scope), so use a fast
     // unordered aHash map — NOT the object-strings PropMap (an insertion-ordered IndexMap),
@@ -30,6 +99,31 @@ pub struct Scope {
     parent: Option<Rc<std::cell::RefCell<Scope>>>,
 }
 
+// #186 / string_build: amortized O(1) `acc += x`. tish strings are an immutable `Arc<str>`, so the
+// generic `acc = acc + x` allocates a fresh String and copies the whole accumulator each time → O(n^2)
+// over a build loop. Instead we keep the accumulator in a growable `String` ("the pending builder")
+// and `push_str` onto it in O(1), writing it back to the scope slot ("flushing") the moment the
+// variable is observed. JS strings are immutable VALUES, so soundness requires that any read sees the
+// full current string: every read flushes first (see `flush_pending_for` at `Expr::Ident` and the
+// other read sites). The builder is keyed by the EXACT owning scope (captured `Rc`) plus name, so a
+// shadowing inner `acc` never appends onto an outer `acc`'s buffer. Shared across nested evaluators
+// (function calls / closures) via `Rc` so a callee that reads the variable flushes the same buffer.
+struct PendingAppend {
+    /// The exact scope that owns the accumulator variable (not necessarily the current scope).
+    scope: Rc<std::cell::RefCell<Scope>>,
+    name: Arc<str>,
+    /// The true current value of the accumulator while buffered; the scope slot is stale until flush.
+    buf: String,
+}
+
+#[derive(Default)]
+struct StringBuilderState {
+    /// Fast-path guard: a single `Cell<bool>` load lets the hot identifier-read path skip the
+    /// `RefCell` borrow entirely when no builder is active (the case for all non-building programs).
+    active: Cell<bool>,
+    pending: RefCell<Option<PendingAppend>>,
+}
+
 /// A reference-counted lexical scope. A `Value::Function` captures one of these at creation
 /// (the *defining* scope) so calls resolve free variables lexically — real closures.
 pub type ScopeRef = Rc<std::cell::RefCell<Scope>>;
@@ -91,6 +185,30 @@ pub struct Evaluator {
     current_dir: RefCell<Option<PathBuf>>,
     /// Extra `tish:*` builtins from `TishNativeModule::virtual_builtin_modules` (shared across nested evaluators).
     virtual_builtins: Rc<RefCell<HashMap<Arc<str>, Value>>>,
+    /// String-builder state for amortized O(1) `acc += x` (see [`StringBuilderState`]). Shared across
+    /// nested evaluators so a called function/closure that reads the accumulator flushes the buffer.
+    string_builder: Rc<StringBuilderState>,
+    /// Current user-function call depth, SHARED (`Rc`) across every nested call-frame evaluator so it
+    /// tracks total recursion. Past [`Evaluator::max_call_depth`] a call throws a catchable
+    /// `RangeError` instead of growing the stack toward OOM/abort (#381).
+    call_depth: Rc<std::cell::Cell<usize>>,
+    /// Recursion ceiling: past this many nested user-function frames a call throws a catchable
+    /// `RangeError('Maximum call stack size exceeded')`, matching JS, rather than aborting the process.
+    /// Defaults to [`DEFAULT_MAX_CALL_DEPTH`], overridable via `TISH_MAX_CALL_DEPTH`.
+    max_call_depth: usize,
+}
+
+/// Default recursion ceiling: far deeper than any real non-pathological recursion, yet below where
+/// `stacker`'s growth would exhaust memory (the accompanying `stacker::maybe_grow` was verified safe
+/// to depth 20000). Override with `TISH_MAX_CALL_DEPTH`.
+const DEFAULT_MAX_CALL_DEPTH: usize = 20_000;
+
+fn env_max_call_depth() -> usize {
+    std::env::var("TISH_MAX_CALL_DEPTH")
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .filter(|&n| n > 0)
+        .unwrap_or(DEFAULT_MAX_CALL_DEPTH)
 }
 
 impl Evaluator {
@@ -120,6 +238,9 @@ impl Evaluator {
             );
             s.set("decodeURI".into(), Value::Native(natives::decode_uri), true);
             s.set("encodeURI".into(), Value::Native(natives::encode_uri), true);
+            s.set("encodeURIComponent".into(), Value::Native(natives::encode_uri_component), true);
+            s.set("decodeURIComponent".into(), Value::Native(natives::decode_uri_component), true);
+            s.set("structuredClone".into(), Value::Native(natives::structured_clone), true);
             s.set(
                 "htmlEscape".into(),
                 Value::Native(natives::html_escape),
@@ -144,6 +265,7 @@ impl Evaluator {
             math.insert("round".into(), Value::Native(natives::math_round));
             math.insert("random".into(), Value::Native(natives::math_random));
             math.insert("pow".into(), Value::Native(natives::math_pow));
+            math.insert("imul".into(), Value::Native(natives::math_imul));
             math.insert("hypot".into(), Value::Native(natives::math_hypot));
             math.insert("asin".into(), Value::Native(natives::math_asin));
             math.insert("acos".into(), Value::Native(natives::math_acos));
@@ -163,6 +285,10 @@ impl Evaluator {
             math.insert("acosh".into(), Value::Native(natives::math_acosh));
             math.insert("atanh".into(), Value::Native(natives::math_atanh));
             math.insert("cbrt".into(), Value::Native(natives::math_cbrt));
+            math.insert("expm1".into(), Value::Native(natives::math_expm1));
+            math.insert("log1p".into(), Value::Native(natives::math_log1p));
+            math.insert("clz32".into(), Value::Native(natives::math_clz32));
+            math.insert("fround".into(), Value::Native(natives::math_fround));
             math.insert("log2".into(), Value::Native(natives::math_log2));
             math.insert("log10".into(), Value::Native(natives::math_log10));
             math.insert("PI".into(), Value::Number(std::f64::consts::PI));
@@ -193,6 +319,7 @@ impl Evaluator {
                 process_obj.insert("exit".into(), Value::Native(natives::process_exit));
                 process_obj.insert("cwd".into(), Value::Native(natives::process_cwd));
                 process_obj.insert("exec".into(), Value::Native(natives::process_exec));
+                process_obj.insert("execFile".into(), Value::Native(natives::process_exec_file));
                 let argv: Vec<Value> = tishlang_core::process_argv()
                     .into_iter()
                     .map(|s| Value::String(s.into()))
@@ -210,6 +337,10 @@ impl Evaluator {
             object.insert("values".into(), Value::Native(Self::object_values));
             object.insert("entries".into(), Value::Native(Self::object_entries));
             object.insert("assign".into(), Value::Native(Self::object_assign));
+            object.insert("is".into(), Value::Native(natives::object_is));
+            object.insert("hasOwn".into(), Value::Native(natives::object_has_own));
+            // getOwnPropertyNames ≈ keys for tish's plain objects (own string keys, insertion order).
+            object.insert("getOwnPropertyNames".into(), Value::Native(Self::object_keys));
             object.insert(
                 "fromEntries".into(),
                 Value::Native(Self::object_from_entries),
@@ -222,6 +353,7 @@ impl Evaluator {
 
             let mut array_obj = PropMap::with_capacity(3);
             array_obj.insert("isArray".into(), Value::Native(natives::array_is_array));
+            array_obj.insert("of".into(), Value::Native(natives::array_of));
             // `Array(n)` and `new Array(n)` constructor (issue #72).
             array_obj.insert("__call".into(), Value::Native(natives::array_construct));
             array_obj.insert("__construct".into(), Value::Native(natives::array_construct));
@@ -257,9 +389,23 @@ impl Evaluator {
                 true,
             );
 
-            // `Number(value)` coercion as a callable global (issue #36).
-            let mut number_obj = PropMap::with_capacity(1);
+            // `Number(value)` coercion as a callable global (issue #36) + the `Number.*` statics.
+            let mut number_obj = PropMap::with_capacity(15);
             number_obj.insert("__call".into(), Value::Native(natives::number_convert));
+            number_obj.insert("isInteger".into(), Value::Native(natives::number_is_integer));
+            number_obj.insert("isSafeInteger".into(), Value::Native(natives::number_is_safe_integer));
+            number_obj.insert("isNaN".into(), Value::Native(natives::number_is_nan));
+            number_obj.insert("isFinite".into(), Value::Native(natives::number_is_finite));
+            number_obj.insert("parseInt".into(), Value::Native(natives::parse_int));
+            number_obj.insert("parseFloat".into(), Value::Native(natives::parse_float));
+            number_obj.insert("MAX_SAFE_INTEGER".into(), Value::Number(9_007_199_254_740_991.0));
+            number_obj.insert("MIN_SAFE_INTEGER".into(), Value::Number(-9_007_199_254_740_991.0));
+            number_obj.insert("EPSILON".into(), Value::Number(f64::EPSILON));
+            number_obj.insert("MAX_VALUE".into(), Value::Number(f64::MAX));
+            number_obj.insert("MIN_VALUE".into(), Value::Number(5e-324));
+            number_obj.insert("POSITIVE_INFINITY".into(), Value::Number(f64::INFINITY));
+            number_obj.insert("NEGATIVE_INFINITY".into(), Value::Number(f64::NEG_INFINITY));
+            number_obj.insert("NaN".into(), Value::Number(f64::NAN));
             s.set("Number".into(), Value::object(number_obj), true);
 
             s.set(
@@ -367,6 +513,9 @@ impl Evaluator {
             module_cache: Rc::new(RefCell::new(HashMap::new())),
             current_dir: RefCell::new(None),
             virtual_builtins: Rc::new(RefCell::new(HashMap::new())),
+            string_builder: Rc::new(StringBuilderState::default()),
+            call_depth: Rc::new(std::cell::Cell::new(0)),
+            max_call_depth: env_max_call_depth(),
         }
     }
 
@@ -401,6 +550,9 @@ impl Evaluator {
         for stmt in &program.statements {
             last = self.eval_statement(stmt).map_err(|e| e.to_string())?;
         }
+        // Flush any still-buffered string accumulator so the variable's slot is correct for any
+        // post-run observation (timers, REPL, embedders reading scope state).
+        self.flush_pending();
         Ok(last)
     }
 
@@ -451,7 +603,11 @@ impl Evaluator {
                 self.bind_destruct_pattern(pattern, &value, *mutable)?;
                 Ok(Value::Null)
             }
-            Statement::ExprStmt { expr, .. } => self.eval_expr(expr),
+            Statement::ExprStmt { expr, .. } => {
+                // Statement position: route through the path that keeps statement-position
+                // `acc += x` O(1) (no result materialization) while preserving values otherwise.
+                self.eval_expr_discard(expr)
+            }
             Statement::If {
                 cond,
                 then_branch,
@@ -531,6 +687,51 @@ impl Evaluator {
                 self.scope = outer;
                 ret
             }
+            Statement::ForIn {
+                name,
+                object,
+                body,
+                ..
+            } => {
+                let obj_val = self.eval_expr(object)?;
+                // for-in enumerates OWN ENUMERABLE KEYS as strings (JS semantics): objects yield keys
+                // in insertion order, arrays yield index strings "0".."len-1", and a non-object
+                // (incl. null) yields nothing — a no-op, matching JS `for (k in null)`.
+                let keys: Vec<crate::value::Value> = match &obj_val {
+                    crate::value::Value::Object(obj) => obj
+                        .borrow()
+                        .strings
+                        .keys()
+                        .map(|k| crate::value::Value::String(Arc::clone(k)))
+                        .collect(),
+                    crate::value::Value::Array(arr) => {
+                        let len = arr.borrow().len();
+                        (0..len)
+                            .map(|i| crate::value::Value::String(Arc::from(i.to_string())))
+                            .collect()
+                    }
+                    _ => Vec::new(),
+                };
+                // Fresh per-iteration binding (ES6 `for (let k in …)`), like the for-of arm above.
+                let outer = Rc::clone(&self.scope);
+                let mut ret = Ok(Value::Null);
+                for key in keys {
+                    let iter_env = Scope::child(Rc::clone(&outer));
+                    iter_env.borrow_mut().set(Arc::clone(name), key, true);
+                    self.scope = Rc::clone(&iter_env);
+                    match self.eval_statement(body) {
+                        Ok(_) => {}
+                        Err(EvalError::Break) => break,
+                        Err(EvalError::Continue) => continue,
+                        Err(e) => {
+                            ret = Err(e);
+                            break;
+                        }
+                    }
+                }
+                self.scope = outer;
+                ret
+            }
             Statement::For {
                 init,
                 cond,
@@ -815,6 +1016,38 @@ impl Evaluator {
                         let v = self.eval_expr(e)?;
                         self.scope.borrow_mut().set(Arc::from("default"), v, false);
                     }
+                    // #305: re-export in the running program — load the dep and bind the names locally.
+                    ExportDeclaration::ReExport {
+                        specifiers,
+                        all,
+                        from: Some(from),
+                        ..
+                    } => {
+                        let dep_val = self.load_module(from.as_ref())?;
+                        let dep = match &dep_val {
+                            Value::Object(m) => m.borrow().clone(),
+                            _ => return Err(EvalError::Error("Module exports must be object".to_string())),
+                        };
+                        if *all {
+                            for (k, v) in dep.strings.iter() {
+                                self.scope.borrow_mut().set(Arc::from(k.as_ref()), v.clone(), false);
+                            }
+                        }
+                        for spec in specifiers {
+                            if let ImportSpecifier::Named { name, alias, .. } = spec {
+                                let v = dep.strings.get(name.as_ref()).ok_or_else(|| {
+                                    EvalError::Error(format!("Module does not export '{}'", name))
+                                })?;
+                                let bind = alias.as_deref().unwrap_or(name.as_ref());
+                                self.scope.borrow_mut().set(Arc::from(bind), v.clone(), false);
+                            }
+                        }
+                    }
+                    // #415 local named export (`export { a, b as c }`, no `from`): a no-op in the
+                    // running (entry) program — the bindings already exist, and an export alias is
+                    // visible only to importers, never as a local variable (JS semantics). The module
+                    // export table is populated by the module-evaluation path, not here.
+                    ExportDeclaration::ReExport { from: None, .. } => {}
                 }
                 Ok(Value::Null)
             }
@@ -880,6 +1113,54 @@ impl Evaluator {
                         self.scope.borrow_mut().set(Arc::from("default"), v, false);
                         export_names.push("default".to_string());
                     }
+                    // #305: re-export — load the dep, pull the requested (or all) exports into this
+                    // module's scope, and re-expose them in `export_names`.
+                    ExportDeclaration::ReExport {
+                        specifiers,
+                        all,
+                        from: Some(from),
+                        ..
+                    } => {
+                        let dep_val = self.load_module(from.as_ref())?;
+                        let dep = match &dep_val {
+                            Value::Object(m) => m.borrow().clone(),
+                            _ => return Err(EvalError::Error("Module exports must be object".to_string())),
+                        };
+                        if *all {
+                            for (k, v) in dep.strings.iter() {
+                                self.scope.borrow_mut().set(Arc::from(k.as_ref()), v.clone(), false);
+                                export_names.push(k.to_string());
+                            }
+                        }
+                        for spec in specifiers {
+                            if let ImportSpecifier::Named { name, alias, .. } = spec {
+                                let v = dep.strings.get(name.as_ref()).ok_or_else(|| {
+                                    EvalError::Error(format!("Module does not export '{}'", name))
+                                })?;
+                                let bind = alias.as_deref().unwrap_or(name.as_ref());
+                                self.scope.borrow_mut().set(Arc::from(bind), v.clone(), false);
+                                export_names.push(bind.to_string());
+                            }
+                        }
+                    }
+                    // #415 local named export (`export { a, b as c }`, no `from`): the bindings are
+                    // already declared in this module's scope; expose each under its export name.
+                    ExportDeclaration::ReExport {
+                        specifiers,
+                        from: None,
+                        ..
+                    } => {
+                        for spec in specifiers {
+                            if let ImportSpecifier::Named { name, alias, .. } = spec {
+                                let v = self.scope.borrow().get(name.as_ref()).ok_or_else(|| {
+                                    EvalError::Error(format!("Export '{}' is not defined", name))
+                                })?;
+                                let bind = alias.as_deref().unwrap_or(name.as_ref());
+                                self.scope.borrow_mut().set(Arc::from(bind), v.clone(), false);
+                                export_names.push(bind.to_string());
+                            }
+                        }
+                    }
                 }
             } else {
                 let _ = self.eval_statement(stmt);
@@ -946,6 +1227,44 @@ impl Evaluator {
                         Value::Native(natives::read_file_bytes),
                     );
                     exports.insert("mkdir".into(), Value::Native(natives::mkdir));
+                    // Node-compatible names + new methods (sync) — issue #122
+                    use natives::fsx;
+                    exports.insert("readFileSync".into(), Value::Native(fsx::read_file));
+                    exports.insert("readFileBytesSync".into(), Value::Native(fsx::read_file_bytes));
+                    exports.insert("writeFileSync".into(), Value::Native(fsx::write_file));
+                    exports.insert("appendFile".into(), Value::Native(fsx::append_file));
+                    exports.insert("appendFileSync".into(), Value::Native(fsx::append_file));
+                    exports.insert("existsSync".into(), Value::Native(fsx::exists));
+                    exports.insert("mkdirSync".into(), Value::Native(fsx::mkdir));
+                    exports.insert("readdir".into(), Value::Native(fsx::readdir));
+                    exports.insert("readdirSync".into(), Value::Native(fsx::readdir));
+                    exports.insert("stat".into(), Value::Native(fsx::stat));
+                    exports.insert("statSync".into(), Value::Native(fsx::stat));
+                    exports.insert("lstat".into(), Value::Native(fsx::lstat));
+                    exports.insert("lstatSync".into(), Value::Native(fsx::lstat));
+                    exports.insert("rm".into(), Value::Native(fsx::rm));
+                    exports.insert("rmSync".into(), Value::Native(fsx::rm));
+                    exports.insert("rmdir".into(), Value::Native(fsx::rmdir));
+                    exports.insert("rmdirSync".into(), Value::Native(fsx::rmdir));
+                    exports.insert("unlink".into(), Value::Native(fsx::unlink));
+                    exports.insert("unlinkSync".into(), Value::Native(fsx::unlink));
+                    exports.insert("rename".into(), Value::Native(fsx::rename));
+                    exports.insert("renameSync".into(), Value::Native(fsx::rename));
+                    exports.insert("copyFile".into(), Value::Native(fsx::copy_file));
+                    exports.insert("copyFileSync".into(), Value::Native(fsx::copy_file));
+                    exports.insert("realpath".into(), Value::Native(fsx::realpath));
+                    exports.insert("realpathSync".into(), Value::Native(fsx::realpath));
+                    exports.insert("readlink".into(), Value::Native(fsx::readlink));
+                    exports.insert("readlinkSync".into(), Value::Native(fsx::readlink));
+                    exports.insert("truncate".into(), Value::Native(fsx::truncate));
+                    exports.insert("truncateSync".into(), Value::Native(fsx::truncate));
+                    exports.insert("mkdtemp".into(), Value::Native(fsx::mkdtemp));
+                    exports.insert("mkdtempSync".into(), Value::Native(fsx::mkdtemp));
+                    exports.insert("cp".into(), Value::Native(fsx::cp));
+                    exports.insert("cpSync".into(), Value::Native(fsx::cp));
+                    exports.insert("access".into(), Value::Native(fsx::access));
+                    exports.insert("accessSync".into(), Value::Native(fsx::access));
+                    exports.insert("constants".into(), fsx::constants());
                     Ok(Value::object(exports))
                 }
                 #[cfg(not(feature = "fs"))]
@@ -955,6 +1274,41 @@ impl Evaluator {
                     ));
                 }
             }
+            "tish:fs/promises" => {
+                #[cfg(feature = "fs")]
+                {
+                    use natives::fsx;
+                    let mut exports: PropMap = PropMap::default();
+                    exports.insert("readFile".into(), Value::Native(fsx::read_file_p));
+                    exports.insert("readFileBytes".into(), Value::Native(fsx::read_file_bytes_p));
+                    exports.insert("writeFile".into(), Value::Native(fsx::write_file_p));
+                    exports.insert("appendFile".into(), Value::Native(fsx::append_file_p));
+                    exports.insert("exists".into(), Value::Native(fsx::exists_p));
+                    exports.insert("mkdir".into(), Value::Native(fsx::mkdir_p));
+                    exports.insert("readdir".into(), Value::Native(fsx::readdir_p));
+                    exports.insert("stat".into(), Value::Native(fsx::stat_p));
+                    exports.insert("lstat".into(), Value::Native(fsx::lstat_p));
+                    exports.insert("rm".into(), Value::Native(fsx::rm_p));
+                    exports.insert("rmdir".into(), Value::Native(fsx::rmdir_p));
+                    exports.insert("unlink".into(), Value::Native(fsx::unlink_p));
+                    exports.insert("rename".into(), Value::Native(fsx::rename_p));
+                    exports.insert("copyFile".into(), Value::Native(fsx::copy_file_p));
+                    exports.insert("realpath".into(), Value::Native(fsx::realpath_p));
+                    exports.insert("readlink".into(), Value::Native(fsx::readlink_p));
+                    exports.insert("truncate".into(), Value::Native(fsx::truncate_p));
+                    exports.insert("mkdtemp".into(), Value::Native(fsx::mkdtemp_p));
+                    exports.insert("cp".into(), Value::Native(fsx::cp_p));
+                    exports.insert("access".into(), Value::Native(fsx::access_p));
+                    exports.insert("constants".into(), fsx::constants());
+                    Ok(Value::object(exports))
+                }
+                #[cfg(not(feature = "fs"))]
+                {
+                    return Err(EvalError::Error(
+                        "tish:fs/promises requires the fs feature. Rebuild with: cargo build -p tishlang --features fs".into(),
+                    ));
+                }
+            }
             "tish:http" => {
                 #[cfg(feature = "http")]
                 {
@@ -1057,6 +1411,7 @@ impl Evaluator {
                     exports.insert("exit".into(), Value::Native(natives::process_exit));
                     exports.insert("cwd".into(), Value::Native(natives::process_cwd));
                     exports.insert("exec".into(), Value::Native(natives::process_exec));
+                    exports.insert("execFile".into(), Value::Native(natives::process_exec_file));
                     let argv: Vec<Value> = tishlang_core::process_argv()
                         .into_iter()
                         .map(|s| Value::String(s.into()))
@@ -1076,6 +1431,7 @@ impl Evaluator {
                     process_obj.insert("exit".into(), Value::Native(natives::process_exit));
                     process_obj.insert("cwd".into(), Value::Native(natives::process_cwd));
                     process_obj.insert("exec".into(), Value::Native(natives::process_exec));
+                    process_obj.insert("execFile".into(), Value::Native(natives::process_exec_file));
                     process_obj.insert("argv".into(), Value::Array(Rc::new(RefCell::new(argv))));
                     process_obj.insert("env".into(), Value::object(env_obj));
                     exports.insert(
@@ -1115,6 +1471,177 @@ impl Evaluator {
             })
     }
 
+    // --- string-builder helpers (#186 / string_build): amortized O(1) `acc += x` ---
+
+    /// Append a value to a builder buffer using the exact JS coercion of `eval_binop`'s `+` (string
+    /// operands push their raw chars; everything else goes through `to_js_string`).
+    fn append_value_to_buf(buf: &mut String, v: &Value) {
+        match v {
+            Value::String(s) => buf.push_str(s),
+            other => buf.push_str(&other.to_js_string()),
+        }
+    }
+
+    /// Walk the scope chain from the current scope and return the exact scope that owns `name`.
+    fn find_var_scope(&self, name: &str) -> Option<Rc<std::cell::RefCell<Scope>>> {
+        let mut cur = Rc::clone(&self.scope);
+        loop {
+            if cur.borrow().vars.contains_key(name) {
+                return Some(cur);
+            }
+            let parent = cur.borrow().parent.clone();
+            match parent {
+                Some(p) => cur = p,
+                None => return None,
+            }
+        }
+    }
+
+    /// Flush the active builder (if any) back into its owning scope slot, restoring the invariant
+    /// that the slot holds the variable's true value. No-op when no builder is active.
+    fn flush_pending(&self) {
+        if !self.string_builder.active.get() {
+            return;
+        }
+        if let Some(p) = self.string_builder.pending.borrow_mut().take() {
+            p.scope
+                .borrow_mut()
+                .vars
+                .insert(Arc::clone(&p.name), Value::String(p.buf.into()));
+        }
+        self.string_builder.active.set(false);
+    }
+
+    /// Flush the builder iff it is buffering `name` (which is about to be read). The `active` guard
+    /// keeps this ~free on the hot identifier-read path when no builder exists.
+    #[inline]
+    fn flush_pending_for(&self, name: &str) {
+        if !self.string_builder.active.get() {
+            return;
+        }
+        let hit = self
+            .string_builder
+            .pending
+            .borrow()
+            .as_ref()
+            .is_some_and(|p| p.name.as_ref() == name);
+        if hit {
+            self.flush_pending();
+        }
+    }
+
+    /// Discard the builder iff it is buffering `name` (which is about to be overwritten by a plain
+    /// assignment) — avoids an unnecessary O(n) flush of a value that is about to be replaced.
+    #[inline]
+    fn discard_pending_for(&self, name: &str) {
+        if !self.string_builder.active.get() {
+            return;
+        }
+        let hit = self
+            .string_builder
+            .pending
+            .borrow()
+            .as_ref()
+            .is_some_and(|p| p.name.as_ref() == name);
+        if hit {
+            *self.string_builder.pending.borrow_mut() = None;
+            self.string_builder.active.set(false);
+        }
+    }
+
+    /// Try to handle `name += rhs` as an amortized-O(1) string append. Returns `true` if it was a
+    /// string append (buffer updated); `false` if `name` is not a (mutable) string accumulator, so
+    /// the caller falls back to the generic `+=`. Any builder for a DIFFERENT slot is flushed first;
+    /// keying by the exact owning scope means a shadowing inner `name` never appends onto an outer
+    /// `name`'s buffer.
+    fn try_string_append(&self, name: &Arc<str>, rhs: &Value) -> bool {
+        let owner = match self.find_var_scope(name) {
+            Some(s) => s,
+            None => return false, // undefined → let the generic path raise the error
+        };
+        // Continue an existing builder for this exact slot.
+        if self.string_builder.active.get() {
+            let same = self
+                .string_builder
+                .pending
+                .borrow()
+                .as_ref()
+                .is_some_and(|p| p.name == *name && Rc::ptr_eq(&p.scope, &owner));
+            if same {
+                if let Some(p) = self.string_builder.pending.borrow_mut().as_mut() {
+                    Self::append_value_to_buf(&mut p.buf, rhs);
+                }
+                return true;
+            }
+            // A different slot is buffered — flush it before starting a new one.
+            self.flush_pending();
+        }
+        // Start a new builder only if the accumulator currently holds a mutable string.
+        let start = {
+            let owner_ref = owner.borrow();
+            if owner_ref.consts.contains(name.as_ref()) {
+                return false; // `const acc += x` must raise the same error as the generic path
+            }
+            match owner_ref.vars.get(name.as_ref()) {
+                Some(Value::String(a)) => Some(a.clone()),
+                _ => None, // non-string accumulator → numeric/other `+=`
+            }
+        };
+        match start {
+            Some(a) => {
+                let mut buf = String::with_capacity(a.len() + 16);
+                buf.push_str(&a);
+                Self::append_value_to_buf(&mut buf, rhs);
+                *self.string_builder.pending.borrow_mut() = Some(PendingAppend {
+                    scope: owner,
+                    name: Arc::clone(name),
+                    buf,
+                });
+                self.string_builder.active.set(true);
+                true
+            }
+            None => false,
+        }
+    }
+
+    /// Evaluate `expr` in statement position. Special-cases `acc += rhs` so the string-builder never
+    /// has to materialize the assignment's result value — the key to keeping the append O(1). In that
+    /// one case the (discarded) statement value is `null`; every other expression returns its real
+    /// value, preserving block/program last-value semantics.
+    fn eval_expr_discard(&self, expr: &Expr) -> Result<Value, EvalError> {
+        if let Expr::CompoundAssign {
+            name,
+            op: tishlang_ast::CompoundOp::Add,
+            value,
+            ..
+        } = expr
+        {
+            // Evaluate rhs FIRST — it may read `name`, which flushes any active builder.
+            let rhs = self.eval_expr(value)?;
+            if self.try_string_append(name, &rhs) {
+                // Statement-position result is discarded; returning null avoids the O(n) flatten.
+                return Ok(Value::Null);
+            }
+            // Not a string accumulator: generic `+=` (numeric/other) — return its real value.
+            self.flush_pending_for(name);
+            let current = self
+                .scope
+                .borrow()
+                .get(name.as_ref())
+                .ok_or_else(|| EvalError::Error(format!("Undefined variable: {}", name)))?;
+            let result = self
+                .eval_binop(&current, BinOp::Add, &rhs)
+                .map_err(EvalError::Error)?;
+            match self.scope.borrow_mut().assign(name.as_ref(), result.clone()) {
+                Ok(true) => Ok(result),
+                Ok(false) => Err(EvalError::Error(format!("Undefined variable: {}", name))),
+                Err(e) => Err(EvalError::Error(e)),
+            }
+        } else {
+            self.eval_expr(expr)
+        }
+    }
+
     fn eval_expr(&self, expr: &Expr) -> Result<Value, EvalError> {
         match expr {
             Expr::Literal { value, .. } => Ok(match value {
@@ -1123,11 +1650,14 @@ impl Evaluator {
                 Literal::Bool(b) => Value::Bool(*b),
                 Literal::Null => Value::Null,
             }),
-            Expr::Ident { name, .. } => self
-                .scope
-                .borrow()
-                .get(name.as_ref())
-                .ok_or_else(|| EvalError::Error(format!("Undefined variable: {}", name))),
+            Expr::Ident { name, .. } => {
+                // Flush any string-builder buffering this variable so the read sees the full string.
+                self.flush_pending_for(name.as_ref());
+                self.scope
+                    .borrow()
+                    .get(name.as_ref())
+                    .ok_or_else(|| EvalError::Error(format!("Undefined variable: {}", name)))
+            }
             Expr::Binary {
                 left,
                 op,
@@ -1176,7 +1706,58 @@ impl Evaluator {
                 {
                     let obj = self.eval_expr(object)?;
                     let arg_vals = self.eval_call_args(args)?;
-                    
+
+                    // `Array.from(source, mapFn?)` — handled inline so the mapFn callback runs with the
+                    // interpreter context (a plain native has no `self`). Covers array / string / Set /
+                    // Map / iterator (via `__drain__`) and array-like `{ length }`. (#440)
+                    if let Expr::Ident { name, .. } = object.as_ref() {
+                        if name.as_ref() == "Array" && method_name.as_ref() == "from" {
+                            let source = arg_vals.first().cloned().unwrap_or(Value::Null);
+                            let items: Vec<Value> = match &source {
+                                Value::Array(a) => a.borrow().clone(),
+                                Value::String(s) => s
+                                    .chars()
+                                    .map(|c| Value::String(std::sync::Arc::from(c.to_string())))
+                                    .collect(),
+                                _ => {
+                                    if let Some(d) = self.drain_eval_iterator(&source) {
+                                        d
+                                    } else if matches!(&source, Value::Object(_)) {
+                                        let len = self
+                                            .get_prop(&source, "length")
+                                            .ok()
+                                            .and_then(|v| match v {
+                                                Value::Number(n) if n.is_finite() && n >= 0.0 => {
+                                                    Some(n as usize)
+                                                }
+                                                _ => None,
+                                            })
+                                            .unwrap_or(0);
+                                        (0..len)
+                                            .map(|i| {
+                                                self.get_prop(&source, &i.to_string())
+                                                    .unwrap_or(Value::Null)
+                                            })
+                                            .collect()
+                                    } else {
+                                        Vec::new()
+                                    }
+                                }
+                            };
+                            let out = match arg_vals.get(1) {
+                                Some(f) if !matches!(f, Value::Null) => {
+                                    let mut o = Vec::with_capacity(items.len());
+                                    for (i, item) in items.into_iter().enumerate() {
+                                        o.push(self.call_func(f, &[item, Value::Number(i as f64)])?);
+                                    }
+                                    o
+                                }
+                                _ => items,
+                            };
+                            return Ok(Value::array(out));
+                        }
+                    }
+
                     // Array methods
                     if let Value::Array(arr) = &obj {
                         match method_name.as_ref() {
@@ -1207,13 +1788,66 @@ impl Evaluator {
                             "indexOf" => {
                                 let search = arg_vals.first().cloned().unwrap_or(Value::Null);
                                 let arr_borrow = arr.borrow();
-                                for (i, v) in arr_borrow.iter().enumerate() {
+                                // fromIndex: positive clamps to [0, len]; negative counts from the end.
+                                let len = arr_borrow.len() as i64;
+                                let start = match arg_vals.get(1) {
+                                    Some(Value::Number(n)) if *n >= 0.0 => (*n as i64).min(len).max(0) as usize,
+                                    Some(Value::Number(n)) if *n < 0.0 => ((len + *n as i64).max(0)) as usize,
+                                    _ => 0,
+                                };
+                                for (i, v) in arr_borrow.iter().enumerate().skip(start) {
                                     if v.strict_eq(&search) {
                                         return Ok(Value::Number(i as f64));
                                     }
                                 }
                                 return Ok(Value::Number(-1.0));
                             }
+                            "lastIndexOf" => {
+                                let search = arg_vals.first().cloned().unwrap_or(Value::Null);
+                                let arr_borrow = arr.borrow();
+                                let len = arr_borrow.len() as i64;
+                                let start = match arg_vals.get(1) {
+                                    Some(Value::Number(n)) if *n >= 0.0 => (*n as i64).min(len - 1),
+                                    Some(Value::Number(n)) => len + *n as i64,
+                                    _ => len - 1,
+                                };
+                                let mut i = start;
+                                while i >= 0 {
+                                    if let Some(v) = arr_borrow.get(i as usize) {
+                                        if v.strict_eq(&search) {
+                                            return Ok(Value::Number(i as f64));
+                                        }
+                                    }
+                                    i -= 1;
+                                }
+                                return Ok(Value::Number(-1.0));
+                            }
+                            "copyWithin" => {
+                                let mut v = arr.borrow_mut();
+                                let len = v.len() as i64;
+                                let norm = |x: Option<&Value>, dflt: i64| -> usize {
+                                    match x {
+                                        Some(Value::Number(n)) => {
+                                            let n = *n as i64;
+                                            (if n < 0 { len + n } else { n }).clamp(0, len) as usize
+                                        }
+                                        _ => dflt.clamp(0, len) as usize,
+                                    }
+                                };
+                                let t = norm(arg_vals.first(), 0);
+                                let s = norm(arg_vals.get(1), 0);
+                                let e = norm(arg_vals.get(2), len);
+                                let lu = len as usize;
+                                if s < e && t < lu {
+                                    let count = (e - s).min(lu - t);
+                                    let block: Vec<Value> = v[s..s + count].to_vec();
+                                    for (k, val) in block.into_iter().enumerate() {
+                                        v[t + k] = val;
+                                    }
+                                }
+                                drop(v);
+                                return Ok(Value::Array(arr.clone()));
+                            }
                             "includes" => {
                                 let search = arg_vals.first().cloned().unwrap_or(Value::Null);
                                 let arr_borrow = arr.borrow();
@@ -1255,6 +1889,91 @@ impl Evaluator {
                                 arr.borrow_mut().reverse();
                                 return Ok(obj.clone());
                             }
+                            "toReversed" => {
+                                // ES2023: a reversed COPY; the receiver is untouched.
+                                let mut v = arr.borrow().clone();
+                                v.reverse();
+                                return Ok(Value::Array(Rc::new(RefCell::new(v))));
+                            }
+                            "toSorted" => {
+                                // ES2023: a sorted COPY. Uses the general comparator/default path (the
+                                // numeric fast-paths in `sort` are speed-only and give identical order).
+                                let comparator = arg_vals.into_iter().next();
+                                let arr_values: Vec<Value> = arr.borrow().clone();
+                                let len = arr_values.len();
+                                let mut indices: Vec<usize> = (0..len).collect();
+                                if let Some(cmp_fn) = comparator {
+                                    let mut pending: Option<EvalError> = None;
+                                    indices.sort_by(|&i, &j| {
+                                        if pending.is_some() {
+                                            return std::cmp::Ordering::Equal;
+                                        }
+                                        match self.call_func(&cmp_fn, &[arr_values[i].clone(), arr_values[j].clone()]) {
+                                            Ok(Value::Number(n)) if n < 0.0 => std::cmp::Ordering::Less,
+                                            Ok(Value::Number(n)) if n > 0.0 => std::cmp::Ordering::Greater,
+                                            Ok(_) => std::cmp::Ordering::Equal,
+                                            Err(e) => { pending = Some(e); std::cmp::Ordering::Equal }
+                                        }
+                                    });
+                                    if let Some(e) = pending {
+                                        return Err(e);
+                                    }
+                                } else {
+                                    indices.sort_by(|&i, &j| {
+                                        arr_values[i].to_string().cmp(&arr_values[j].to_string())
+                                    });
+                                }
+                                let sorted: Vec<Value> =
+                                    indices.into_iter().map(|i| arr_values[i].clone()).collect();
+                                return Ok(Value::Array(Rc::new(RefCell::new(sorted))));
+                            }
+                            "with" => {
+                                // ES2023: a COPY with one index replaced; negative index counts from the
+                                // end; out-of-range throws a catchable RangeError (matches vm/native/node).
+                                let index = arg_vals.first().cloned().unwrap_or(Value::Null);
+                                let value = arg_vals.get(1).cloned().unwrap_or(Value::Null);
+                                let mut v = arr.borrow().clone();
+                                let len = v.len() as i64;
+                                let rel = match index {
+                                    Value::Number(n) if n.is_finite() => n as i64,
+                                    _ => 0,
+                                };
+                                let actual = if rel >= 0 { rel } else { len + rel };
+                                if actual < 0 || actual >= len {
+                                    let err = crate::natives::range_error_construct(&[Value::String(
+                                        format!("Invalid index : {}", rel).into(),
+                                    )])
+                                    .unwrap_or(Value::Null);
+                                    return Err(EvalError::Throw(err));
+                                }
+                                v[actual as usize] = value;
+                                return Ok(Value::Array(Rc::new(RefCell::new(v))));
+                            }
+                            "toSpliced" => {
+                                // ES2023: a COPY with the splice applied; returns the resulting array
+                                // (splice returns the removed elements). Same normalization as `splice`.
+                                let mut result = arr.borrow().clone();
+                                let len = result.len() as i64;
+                                let start = match arg_vals.first() {
+                                    Some(Value::Number(n)) => {
+                                        let n = *n as i64;
+                                        if n < 0 { (len + n).max(0) as usize } else { n.min(len) as usize }
+                                    }
+                                    _ => 0,
+                                };
+                                let delete_count = match arg_vals.get(1) {
+                                    Some(Value::Number(n)) => (*n as i64).max(0) as usize,
+                                    _ => (len as usize).saturating_sub(start),
+                                };
+                                let actual_delete = delete_count.min(result.len().saturating_sub(start));
+                                result.drain(start..start + actual_delete);
+                                if arg_vals.len() > 2 {
+                                    for (i, item) in arg_vals[2..].iter().cloned().enumerate() {
+                                        result.insert(start + i, item);
+                                    }
+                                }
+                                return Ok(Value::Array(Rc::new(RefCell::new(result))));
+                            }
                             "fill" => {
                                 // Array.prototype.fill(value, start?, end?) — in place (issue #76).
                                 let value = arg_vals.first().cloned().unwrap_or(Value::Null);
@@ -1313,27 +2032,45 @@ impl Evaluator {
                                         let len = arr_mut.len();
                                         let mut indices: Vec<usize> = (0..len).collect();
                                         let arr_values: Vec<Value> = std::mem::take(&mut *arr_mut);
+                                        // A `throw` from the comparator must propagate (be catchable) and
+                                        // must NOT corrupt the array. Previously the `_ => Equal` arm
+                                        // swallowed the `Err` and wrote a bogus reordering back; now we
+                                        // capture the throw, stop comparing, and restore the original order
+                                        // — matching the vm/native backends and node.
+                                        let mut pending: Option<EvalError> = None;
 
                                         if let Some((scope, params, body)) = self.create_callback_scope(&cmp_fn) {
                                             indices.sort_by(|&i, &j| {
-                                                let result = self.call_with_scope(&scope, &params, &body, &[arr_values[i].clone(), arr_values[j].clone()]);
-                                                match result {
+                                                if pending.is_some() {
+                                                    return std::cmp::Ordering::Equal;
+                                                }
+                                                match self.call_with_scope(&scope, &params, &body, &[arr_values[i].clone(), arr_values[j].clone()]) {
                                                     Ok(Value::Number(n)) if n < 0.0 => std::cmp::Ordering::Less,
                                                     Ok(Value::Number(n)) if n > 0.0 => std::cmp::Ordering::Greater,
-                                                    _ => std::cmp::Ordering::Equal,
+                                                    Ok(_) => std::cmp::Ordering::Equal,
+                                                    Err(e) => { pending = Some(e); std::cmp::Ordering::Equal }
                                                 }
                                             });
                                         } else {
                                             indices.sort_by(|&i, &j| {
-                                                let result = self.call_func(&cmp_fn, &[arr_values[i].clone(), arr_values[j].clone()]);
-                                                match result {
+                                                if pending.is_some() {
+                                                    return std::cmp::Ordering::Equal;
+                                                }
+                                                match self.call_func(&cmp_fn, &[arr_values[i].clone(), arr_values[j].clone()]) {
                                                     Ok(Value::Number(n)) if n < 0.0 => std::cmp::Ordering::Less,
                                                     Ok(Value::Number(n)) if n > 0.0 => std::cmp::Ordering::Greater,
-                                                    _ => std::cmp::Ordering::Equal,
+                                                    Ok(_) => std::cmp::Ordering::Equal,
+                                                    Err(e) => { pending = Some(e); std::cmp::Ordering::Equal }
                                                 }
                                             });
                                         }
 
+                                        if let Some(e) = pending {
+                                            // Comparator threw: leave the array untouched and re-raise.
+                                            *arr_mut = arr_values;
+                                            drop(arr_mut);
+                                            return Err(e);
+                                        }
                                         *arr_mut = indices.into_iter().map(|i| arr_values[i].clone()).collect();
                                     }
                                 } else {
@@ -1416,7 +2153,11 @@ impl Evaluator {
                             }
                             "map" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                // #382-style snapshot: own the elements and DROP the array borrow before
+                                // any callback runs, so a callback that mutates the array (via the `array`
+                                // arg or a capture) can't RefCell-panic. `arr_value` is the JS 3rd arg.
+                                let arr_borrow = arr.borrow().clone();
+                                let arr_value = Value::Array(arr.clone());
                                 let mut result = Vec::with_capacity(arr_borrow.len());
                                 // Try fastest path: simple single-expression callbacks
                                 let first_result = self.eval_simple_callback(&callback, &[arr_borrow.first().cloned().unwrap_or(Value::Null)]);
@@ -1433,21 +2174,49 @@ impl Evaluator {
                                 } else if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     // Reusable scope path
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let mapped = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        let mapped = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         result.push(mapped);
                                     }
                                 } else {
                                     // Full call_func path
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let mapped = self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        let mapped = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         result.push(mapped);
                                     }
                                 }
                                 return Ok(Value::Array(Rc::new(RefCell::new(result))));
                             }
+                            "flatMap" => {
+                                // map + flatten one level (Array.prototype.flatMap). A callback `throw`
+                                // propagates via `?` (catchable), matching vm/native/node — previously
+                                // interp lacked flatMap entirely ("Not a function").
+                                let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
+                                let mut result: Vec<Value> = Vec::with_capacity(arr_borrow.len());
+                                if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
+                                    for (i, v) in arr_borrow.iter().enumerate() {
+                                        let mapped = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
+                                        match mapped {
+                                            Value::Array(inner) => result.extend(inner.borrow().iter().cloned()),
+                                            other => result.push(other),
+                                        }
+                                    }
+                                } else {
+                                    for (i, v) in arr_borrow.iter().enumerate() {
+                                        let mapped = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
+                                        match mapped {
+                                            Value::Array(inner) => result.extend(inner.borrow().iter().cloned()),
+                                            other => result.push(other),
+                                        }
+                                    }
+                                }
+                                return Ok(Value::Array(Rc::new(RefCell::new(result))));
+                            }
                             "filter" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 let mut result = Vec::new();
                                 // Try simple callback fast path
                                 let use_simple = arr_borrow.first().map(|v| {
@@ -1463,14 +2232,14 @@ impl Evaluator {
                                     }
                                 } else if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let keep = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        let keep = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if keep.is_truthy() {
                                             result.push(v.clone());
                                         }
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let keep = self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        let keep = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if keep.is_truthy() {
                                             result.push(v.clone());
                                         }
@@ -1480,7 +2249,8 @@ impl Evaluator {
                             }
                             "reduce" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 4th callback arg
                                 let (mut acc, start_idx) = if arg_vals.len() > 1 {
                                     (arg_vals[1].clone(), 0)
                                 } else if !arr_borrow.is_empty() {
@@ -1490,18 +2260,75 @@ impl Evaluator {
                                 };
                                 if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate().skip(start_idx) {
-                                        acc = self.call_with_scope(&scope, &params, &body, &[acc, v.clone(), Value::Number(i as f64)])?;
+                                        acc = self.call_with_scope(&scope, &params, &body, &[acc, v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate().skip(start_idx) {
-                                        acc = self.call_func(&callback, &[acc, v.clone(), Value::Number(i as f64)])?;
+                                        acc = self.call_func(&callback, &[acc, v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                     }
                                 }
                                 return Ok(acc);
                             }
+                            "reduceRight" => {
+                                let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
+                                let arr_borrow = arr.borrow().clone();
+                                let arr_value = Value::Array(arr.clone());
+                                let len = arr_borrow.len();
+                                // With an initial value, fold indices len-1..0; without, seed from the
+                                // last element and fold len-2..0. Empty + no init → TypeError.
+                                let (mut acc, start) = if arg_vals.len() > 1 {
+                                    (arg_vals[1].clone(), len)
+                                } else if len > 0 {
+                                    (arr_borrow[len - 1].clone(), len - 1)
+                                } else {
+                                    return Err(EvalError::Error("Reduce of empty array with no initial value".to_string()));
+                                };
+                                let mut i = start;
+                                while i > 0 {
+                                    i -= 1;
+                                    acc = self.call_func(&callback, &[acc, arr_borrow[i].clone(), Value::Number(i as f64), arr_value.clone()])?;
+                                }
+                                return Ok(acc);
+                            }
+                            "keys" => {
+                                let len = arr.borrow().len();
+                                let it = tishlang_builtins::iterator::array_iterator(
+                                    (0..len).map(|i| tishlang_core::Value::Number(i as f64)).collect(),
+                                );
+                                return Ok(crate::value_convert::core_to_eval(it));
+                            }
+                            "values" => {
+                                let items: Vec<tishlang_core::Value> = arr
+                                    .borrow()
+                                    .iter()
+                                    .map(|v| {
+                                        crate::value_convert::eval_to_core(v)
+                                            .unwrap_or(tishlang_core::Value::Null)
+                                    })
+                                    .collect();
+                                let it = tishlang_builtins::iterator::array_iterator(items);
+                                return Ok(crate::value_convert::core_to_eval(it));
+                            }
+                            "entries" => {
+                                let items: Vec<tishlang_core::Value> = arr
+                                    .borrow()
+                                    .iter()
+                                    .enumerate()
+                                    .map(|(i, v)| {
+                                        tishlang_core::Value::Array(tishlang_core::VmRef::new(vec![
+                                            tishlang_core::Value::Number(i as f64),
+                                            crate::value_convert::eval_to_core(v)
+                                                .unwrap_or(tishlang_core::Value::Null),
+                                        ]))
+                                    })
+                                    .collect();
+                                let it = tishlang_builtins::iterator::array_iterator(items);
+                                return Ok(crate::value_convert::core_to_eval(it));
+                            }
                             "find" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 // Try simple callback fast path
                                 let use_simple = arr_borrow.first().map(|v| {
                                     self.eval_simple_callback(&callback, &[v.clone()]).is_some()
@@ -1516,14 +2343,14 @@ impl Evaluator {
                                     }
                                 } else if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let found = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        let found = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if found.is_truthy() {
                                             return Ok(v.clone());
                                         }
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let found = self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        let found = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if found.is_truthy() {
                                             return Ok(v.clone());
                                         }
@@ -1533,17 +2360,18 @@ impl Evaluator {
                             }
                             "findIndex" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let found = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        let found = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if found.is_truthy() {
                                             return Ok(Value::Number(i as f64));
                                         }
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let found = self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        let found = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if found.is_truthy() {
                                             return Ok(Value::Number(i as f64));
                                         }
@@ -1552,13 +2380,14 @@ impl Evaluator {
                                 return Ok(Value::Number(-1.0));
                             }
                             "findLast" => {
-                                // Like find, from the end (#247). Callback gets (value, original index).
+                                // Like find, from the end (#247). Callback gets (value, original index, array).
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 let scoped = self.create_callback_scope(&callback);
                                 for i in (0..arr_borrow.len()).rev() {
                                     let v = arr_borrow[i].clone();
-                                    let args = [v.clone(), Value::Number(i as f64)];
+                                    let args = [v.clone(), Value::Number(i as f64), arr_value.clone()];
                                     let found = match &scoped {
                                         Some((scope, params, body)) => self.call_with_scope(scope, params, body, &args)?,
                                         None => self.call_func(&callback, &args)?,
@@ -1571,10 +2400,11 @@ impl Evaluator {
                             }
                             "findLastIndex" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 let scoped = self.create_callback_scope(&callback);
                                 for i in (0..arr_borrow.len()).rev() {
-                                    let args = [arr_borrow[i].clone(), Value::Number(i as f64)];
+                                    let args = [arr_borrow[i].clone(), Value::Number(i as f64), arr_value.clone()];
                                     let found = match &scoped {
                                         Some((scope, params, body)) => self.call_with_scope(scope, params, body, &args)?,
                                         None => self.call_func(&callback, &args)?,
@@ -1601,21 +2431,23 @@ impl Evaluator {
                             }
                             "forEach" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                     }
                                 }
                                 return Ok(Value::Null);
                             }
                             "some" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 // Try simple callback fast path
                                 let use_simple = arr_borrow.first().map(|v| {
                                     self.eval_simple_callback(&callback, &[v.clone()]).is_some()
@@ -1630,14 +2462,14 @@ impl Evaluator {
                                     }
                                 } else if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let result = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        let result = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if result.is_truthy() {
                                             return Ok(Value::Bool(true));
                                         }
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let result = self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        let result = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if result.is_truthy() {
                                             return Ok(Value::Bool(true));
                                         }
@@ -1647,7 +2479,8 @@ impl Evaluator {
                             }
                             "every" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 // Try simple callback fast path
                                 let use_simple = arr_borrow.first().map(|v| {
                                     self.eval_simple_callback(&callback, &[v.clone()]).is_some()
@@ -1662,14 +2495,14 @@ impl Evaluator {
                                     }
                                 } else if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let result = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        let result = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if !result.is_truthy() {
                                             return Ok(Value::Bool(false));
                                         }
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let result = self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        let result = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if !result.is_truthy() {
                                             return Ok(Value::Bool(false));
                                         }
@@ -1807,6 +2640,32 @@ impl Evaluator {
                             "trim" => {
                                 return Ok(Value::String(s.trim().into()));
                             }
+                            "trimStart" => {
+                                return Ok(Value::String(s.trim_start().into()));
+                            }
+                            "trimEnd" => {
+                                return Ok(Value::String(s.trim_end().into()));
+                            }
+                            "normalize" => {
+                                let form = match arg_vals.first() {
+                                    None | Some(Value::Null) => "NFC".to_string(),
+                                    Some(Value::String(f)) => f.to_string(),
+                                    Some(v) => v.to_string(),
+                                };
+                                match tishlang_builtins::string::normalize_form(s, &form) {
+                                    Some(out) => return Ok(Value::String(out.into())),
+                                    None => {
+                                        let err = crate::natives::range_error_construct(&[
+                                            Value::String(
+                                                "The normalization form should be one of NFC, NFD, NFKC, NFKD."
+                                                    .into(),
+                                            ),
+                                        ])
+                                        .unwrap_or(Value::Null);
+                                        return Err(EvalError::Throw(err));
+                                    }
+                                }
+                            }
                             "toUpperCase" => {
                                 return Ok(Value::String(s.to_uppercase().into()));
                             }
@@ -1818,14 +2677,28 @@ impl Evaluator {
                                     Some(Value::String(ss)) => ss.as_ref(),
                                     _ => return Ok(Value::Bool(false)),
                                 };
-                                return Ok(Value::Bool(s.starts_with(search)));
+                                // position: test as if the string began at char `position`.
+                                let pos = match arg_vals.get(1) {
+                                    Some(Value::Number(n)) if *n > 0.0 => *n as usize,
+                                    _ => 0,
+                                };
+                                let byte_start = s.char_indices().nth(pos).map(|(b, _)| b).unwrap_or(s.len());
+                                return Ok(Value::Bool(s[byte_start..].starts_with(search)));
                             }
                             "endsWith" => {
                                 let search = match arg_vals.first() {
                                     Some(Value::String(ss)) => ss.as_ref(),
                                     _ => return Ok(Value::Bool(false)),
                                 };
-                                return Ok(Value::Bool(s.ends_with(search)));
+                                // endPosition: test as if the string ended at char `endPosition`.
+                                let char_count = s.chars().count();
+                                let end = match arg_vals.get(1) {
+                                    Some(Value::Number(n)) if *n >= 0.0 => (*n as usize).min(char_count),
+                                    Some(Value::Number(_)) => 0,
+                                    _ => char_count,
+                                };
+                                let byte_end = s.char_indices().nth(end).map(|(b, _)| b).unwrap_or(s.len());
+                                return Ok(Value::Bool(s[..byte_end].ends_with(search)));
                             }
                             "replace" => {
                                 #[cfg(feature = "regex")]
@@ -1865,6 +2738,17 @@ impl Evaluator {
                                         Some(Value::String(ss)) => ss.to_string(),
                                         _ => String::new(),
                                     };
+                                    if replacement.contains('$') && !search.is_empty() {
+                                        let sref = s.as_ref();
+                                        if let Some(m) = sref.find(&search) {
+                                            let mut out = String::with_capacity(sref.len());
+                                            out.push_str(&sref[..m]);
+                                            out.push_str(&tishlang_builtins::string::expand_replacement(
+                                                &replacement, &search, &sref[..m], &sref[m + search.len()..]));
+                                            out.push_str(&sref[m + search.len()..]);
+                                            return Ok(Value::String(out.into()));
+                                        }
+                                    }
                                     return Ok(Value::String(s.replacen(&search, &replacement, 1).into()));
                                 }
                                 #[cfg(feature = "regex")]
@@ -1879,15 +2763,30 @@ impl Evaluator {
                                     Some(Value::String(ss)) => ss.to_string(),
                                     _ => String::new(),
                                 };
+                                if replacement.contains('$') && !search.is_empty() {
+                                    let sref = s.as_ref();
+                                    let mut out = String::with_capacity(sref.len());
+                                    let (mut last, mut start) = (0usize, 0usize);
+                                    while let Some(pos) = sref[start..].find(&search) {
+                                        let m = start + pos;
+                                        out.push_str(&sref[last..m]);
+                                        out.push_str(&tishlang_builtins::string::expand_replacement(
+                                            &replacement, &search, &sref[..m], &sref[m + search.len()..]));
+                                        last = m + search.len();
+                                        start = last;
+                                    }
+                                    out.push_str(&sref[last..]);
+                                    return Ok(Value::String(out.into()));
+                                }
                                 return Ok(Value::String(s.replace(&search, &replacement).into()));
                             }
                             "charAt" => {
+                                // Cursor cache instead of collecting a fresh Vec<char> each call (#203).
                                 let idx = match arg_vals.first() {
                                     Some(Value::Number(n)) => *n as usize,
                                     _ => 0,
                                 };
-                                let chars: Vec<char> = s.chars().collect();
-                                return Ok(chars.get(idx)
+                                return Ok(nth_char_cached(s, idx)
                                     .map(|c| Value::String(c.to_string().into()))
                                     .unwrap_or(Value::String("".into())));
                             }
@@ -1897,11 +2796,11 @@ impl Evaluator {
                                     Some(Value::Number(n)) => *n as i64,
                                     _ => 0,
                                 };
-                                let chars: Vec<char> = s.chars().collect();
-                                let len = chars.len() as i64;
-                                let idx = if i < 0 { len + i } else { i };
-                                if idx >= 0 && idx < len {
-                                    return Ok(Value::String(chars[idx as usize].to_string().into()));
+                                let idx = if i < 0 { s.chars().count() as i64 + i } else { i };
+                                if idx >= 0 {
+                                    if let Some(c) = nth_char_cached(s, idx as usize) {
+                                        return Ok(Value::String(c.to_string().into()));
+                                    }
                                 }
                                 return Ok(Value::Null);
                             }
@@ -1910,11 +2809,39 @@ impl Evaluator {
                                     Some(Value::Number(n)) => *n as usize,
                                     _ => 0,
                                 };
-                                let chars: Vec<char> = s.chars().collect();
-                                return Ok(chars.get(idx)
-                                    .map(|c| Value::Number(*c as u32 as f64))
+                                return Ok(nth_char_cached(s, idx)
+                                    .map(|c| Value::Number(c as u32 as f64))
                                     .unwrap_or(Value::Number(f64::NAN)));
                             }
+                            "codePointAt" => {
+                                let idx = match arg_vals.first() {
+                                    Some(Value::Number(n)) if *n >= 0.0 => *n as usize,
+                                    _ => return Ok(Value::Null),
+                                };
+                                return Ok(nth_char_cached(s, idx)
+                                    .map(|c| Value::Number(c as u32 as f64))
+                                    .unwrap_or(Value::Null));
+                            }
+                            "substr" => {
+                                // (interp lacked substr; vm/native had it — this closes the gap.)
+                                let chars: Vec<char> = s.chars().collect();
+                                let len = chars.len() as i64;
+                                let mut start = match arg_vals.first() {
+                                    Some(Value::Number(n)) => *n as i64,
+                                    _ => 0,
+                                };
+                                if start < 0 {
+                                    start = (len + start).max(0);
+                                }
+                                let start = (start as usize).min(chars.len());
+                                let count = match arg_vals.get(1) {
+                                    Some(Value::Number(n)) => (*n as i64).max(0) as usize,
+                                    _ => chars.len() - start,
+                                };
+                                let out: String =
+                                    chars[start..(start + count).min(chars.len())].iter().collect();
+                                return Ok(Value::String(out.into()));
+                            }
                             "repeat" => {
                                 let count = match arg_vals.first() {
                                     Some(Value::Number(n)) if *n >= 0.0 => *n as usize,
@@ -1964,6 +2891,35 @@ impl Evaluator {
                                 return Ok(Value::Null);
                             }
                             #[cfg(feature = "regex")]
+                            "matchAll" => {
+                                let regexp = arg_vals.first().cloned().unwrap_or(Value::Null);
+                                match crate::regex::string_match_all(s, &regexp) {
+                                    Ok(matches) => {
+                                        let core_matches: Vec<tishlang_core::Value> = matches
+                                            .iter()
+                                            .map(|m| {
+                                                crate::value_convert::eval_to_core(m)
+                                                    .unwrap_or(tishlang_core::Value::Null)
+                                            })
+                                            .collect();
+                                        let it = tishlang_builtins::iterator::array_iterator(
+                                            core_matches,
+                                        );
+                                        return Ok(crate::value_convert::core_to_eval(it));
+                                    }
+                                    Err(()) => {
+                                        let err = crate::natives::type_error_construct(&[
+                                            Value::String(
+                                                "String.prototype.matchAll called with a non-global RegExp argument"
+                                                    .into(),
+                                            ),
+                                        ])
+                                        .unwrap_or(Value::Null);
+                                        return Err(EvalError::Throw(err));
+                                    }
+                                }
+                            }
+                            #[cfg(feature = "regex")]
                             "search" => {
                                 if let Some(regexp) = arg_vals.first() {
                                     return Ok(crate::regex::string_search(s, regexp));
@@ -1989,6 +2945,40 @@ impl Evaluator {
                             let formatted = tishlang_builtins::number::to_fixed_str(*n, digits as usize);
                             return Ok(Value::String(formatted.into()));
                         }
+                        if method_name.as_ref() == "toExponential" {
+                            let digits = arg_vals.first().and_then(|v| match v {
+                                Value::Number(d) => Some((*d as i32).clamp(0, 100) as usize),
+                                _ => None,
+                            });
+                            return Ok(Value::String(
+                                tishlang_builtins::number::to_exponential_str(*n, digits).into(),
+                            ));
+                        }
+                        if method_name.as_ref() == "toPrecision" {
+                            match arg_vals.first() {
+                                Some(Value::Number(p)) => {
+                                    let pi = *p as i32;
+                                    if !(1..=100).contains(&pi) && n.is_finite() {
+                                        let err = crate::natives::range_error_construct(&[
+                                            Value::String(
+                                                "toPrecision() argument must be between 1 and 100"
+                                                    .into(),
+                                            ),
+                                        ])
+                                        .unwrap_or(Value::Null);
+                                        return Err(EvalError::Throw(err));
+                                    }
+                                    return Ok(Value::String(
+                                        tishlang_builtins::number::to_precision_str(*n, pi).into(),
+                                    ));
+                                }
+                                _ => {
+                                    return Ok(Value::String(
+                                        tishlang_core::js_number_to_string(*n).into(),
+                                    ))
+                                }
+                            }
+                        }
                         if method_name.as_ref() == "toString" {
                             // Shares the VM/native formatting via the backend-agnostic helper
                             // (issue #59). Radix defaults to 10; 2–36 supported, else RangeError.
@@ -2158,6 +3148,9 @@ impl Evaluator {
             }
             Expr::Assign { name, value, .. } => {
                 let v = self.eval_expr(value)?;
+                // A plain assignment overwrites the variable, so drop any builder buffering it (the
+                // buffered value is about to be replaced). `value` may itself have read+flushed it.
+                self.discard_pending_for(name.as_ref());
                 match self.scope.borrow_mut().assign(name.as_ref(), v.clone()) {
                     Ok(true) => Ok(v),
                     Ok(false) => Err(EvalError::Error(format!("Undefined variable: {}", name))),
@@ -2306,6 +3299,10 @@ impl Evaluator {
                 }
             }
             Expr::CompoundAssign { name, op, value, .. } => {
+                // Expression-position `+=` (result is used): flush any builder so `current` is the
+                // full string, then take the generic path. The O(1) builder fast path is reserved
+                // for statement position (see `eval_expr_discard`).
+                self.flush_pending_for(name.as_ref());
                 let current = self.scope.borrow().get(name.as_ref())
                     .ok_or_else(|| EvalError::Error(format!("Undefined variable: {}", name)))?;
                 let rhs = self.eval_expr(value)?;
@@ -2324,6 +3321,7 @@ impl Evaluator {
                 }
             }
             Expr::LogicalAssign { name, op, value, .. } => {
+                self.flush_pending_for(name.as_ref());
                 let current = self.scope.borrow().get(name.as_ref())
                     .ok_or_else(|| EvalError::Error(format!("Undefined variable: {}", name)))?;
                 let result = match op {
@@ -2394,6 +3392,12 @@ impl Evaluator {
                     Value::Array(arr) => {
                         let idx = match &idx_val {
                             Value::Number(n) => *n as usize,
+                            // Canonical integer string key → index (#432); a non-index string key
+                            // can't live in a Vec-backed array, so the write is a no-op.
+                            Value::String(s) => match tishlang_core::str_to_array_index(s) {
+                                Some(i) => i,
+                                None => return Ok(val),
+                            },
                             _ => return Err(EvalError::Error(format!(
                                 "Array index must be a number, got {:?}",
                                 idx_val
@@ -2750,6 +3754,9 @@ impl Evaluator {
             module_cache: Rc::clone(&self.module_cache),
             current_dir: RefCell::new(self.current_dir.borrow().clone()),
             virtual_builtins: Rc::clone(&self.virtual_builtins),
+            string_builder: Rc::clone(&self.string_builder),
+            call_depth: Rc::clone(&self.call_depth),
+            max_call_depth: self.max_call_depth,
         };
         match eval.eval_statement(body) {
             Ok(v) => Ok(v),
@@ -2901,7 +3908,31 @@ impl Evaluator {
                 }
                 Err(EvalError::Error("Not a function".to_string()))
             }
-            Value::Native(native_fn) => native_fn(args).map_err(EvalError::Error),
+            Value::Native(native_fn) => {
+                // #122: Node fs callback form — `readFile(path, (err, data) => …)`. The self-less
+                // `Value::Native` bridge can't invoke an eval callback (a core `Callable` can't
+                // re-enter the interpreter), so handle it here where `&self` is available: run the
+                // op's core on the non-callback args, split its Result into `(err, data)`, and call
+                // the callback. Matches the VM/native backends (fs_ext runs the callback in-core).
+                #[cfg(feature = "fs")]
+                if let Some(cb @ Value::Function { .. }) = args.last() {
+                    if let Some(core_op) = natives::fsx::callback_core(*native_fn) {
+                        let cb = cb.clone();
+                        let core_args = args[..args.len() - 1]
+                            .iter()
+                            .map(crate::value_convert::eval_to_core)
+                            .collect::<Result<Vec<_>, String>>()
+                            .map_err(EvalError::Error)?;
+                        let (err, data) = match core_op(&core_args) {
+                            Ok(v) => (Value::Null, crate::value_convert::core_to_eval(v)),
+                            Err(e) => (crate::value_convert::core_to_eval(e), Value::Null),
+                        };
+                        self.call_func(&cb, &[err, data])?;
+                        return Ok(Value::Null);
+                    }
+                }
+                native_fn(args).map_err(EvalError::Error)
+            }
             #[cfg(feature = "http")]
             Value::PromiseResolver(r) => {
                 let value = args.first().cloned().unwrap_or(Value::Null);
@@ -3018,6 +4049,9 @@ impl Evaluator {
                     module_cache: Rc::clone(&self.module_cache),
                     current_dir: RefCell::new(self.current_dir.borrow().clone()),
                     virtual_builtins: Rc::clone(&self.virtual_builtins),
+            string_builder: Rc::clone(&self.string_builder),
+                    call_depth: Rc::clone(&self.call_depth),
+                    max_call_depth: self.max_call_depth,
                 };
                 {
                     let mut s = scope.borrow_mut();
@@ -3074,6 +4108,20 @@ impl Evaluator {
                 // VM's single `run_chunk` re-entry. 128 KiB is smaller than one level's chain, so the
                 // stack overflows BETWEEN checks; 1 MiB comfortably covers a level (verified to depth
                 // 20000 in both debug and release). 16 MiB segments keep grow frequency low.
+                // #381: bound recursion with a catchable `RangeError` instead of letting `stacker`
+                // grow the stack toward OOM/abort. The counter is shared (`Rc`) across every call
+                // frame, so it measures true nesting depth; it is decremented on the way out (both
+                // the Ok and Err paths) via the explicit `set` below so a caught throw doesn't leak
+                // depth.
+                let depth = eval.call_depth.get() + 1;
+                if depth > eval.max_call_depth {
+                    let err = crate::natives::range_error_construct(&[Value::String(
+                        "Maximum call stack size exceeded".into(),
+                    )])
+                    .unwrap_or(Value::Null);
+                    return Err(EvalError::Throw(err));
+                }
+                eval.call_depth.set(depth);
                 let body_result = {
                     #[cfg(not(target_arch = "wasm32"))]
                     {
@@ -3086,6 +4134,7 @@ impl Evaluator {
                         eval.eval_statement(body)
                     }
                 };
+                eval.call_depth.set(depth - 1);
                 match body_result {
                     Ok(v) => Ok(v),
                     Err(EvalError::Return(v)) => Ok(v),
@@ -3511,6 +4560,15 @@ impl Evaluator {
     /// `.entries()` — into a `Vec` by calling `next()` until `done`. Returns `None` when `v`
     /// is not such an object. Shared by `for…of` and spread so both treat iterators like JS.
     fn drain_eval_iterator(&self, v: &Value) -> Option<Vec<Value>> {
+        // A string spreads as its characters (`[...s]`, `f(...s)`); for-of over a string is handled
+        // separately at the loop site, but spread routes through here. (#440)
+        if let Value::String(s) = v {
+            return Some(
+                s.chars()
+                    .map(|c| Value::String(std::sync::Arc::from(c.to_string())))
+                    .collect(),
+            );
+        }
         if !matches!(v, Value::Object(_)) {
             return None;
         }
@@ -3566,7 +4624,7 @@ impl Evaluator {
             }
             Value::String(s) => {
                 if key == "length" {
-                    Ok(Value::Number(s.chars().count() as f64))
+                    Ok(Value::Number(char_count_cached(s) as f64))
                 } else {
                     Ok(Value::Null)
                 }
@@ -3623,6 +4681,11 @@ impl Evaluator {
                     _ => Ok(Value::Null),
                 }
             }
+            // Reading a property of the nullish value throws a catchable `TypeError`, matching the
+            // bytecode VM (`get_member`'s `_` arm), cranelift/wasi, and node — not a silent `null`.
+            // The tree-walker used to fall through to `_ => Ok(Value::Null)`, so `null.length` read
+            // back as `null` on interp while every other backend threw (a pure interp≠vm bug).
+            Value::Null => Err(format!("Cannot read property '{}' of null", key)),
             _ => Ok(Value::Null),
         }
     }
@@ -3632,6 +4695,12 @@ impl Evaluator {
             Value::Array(arr) => {
                 let idx = match index {
                     Value::Number(n) => *n as usize,
+                    // A canonical integer string key ("0","1",…) indexes the array (#432), so
+                    // `arr["0"] === arr[0]`; any other key reads Null.
+                    Value::String(s) => match tishlang_core::str_to_array_index(s) {
+                        Some(i) => i,
+                        None => return Ok(Value::Null),
+                    },
                     _ => return Ok(Value::Null),
                 };
                 Ok(arr.borrow().get(idx).cloned().unwrap_or(Value::Null))
@@ -3644,9 +4713,7 @@ impl Evaluator {
                     Value::Number(n) if *n >= 0.0 && n.fract() == 0.0 => *n as usize,
                     _ => return Ok(Value::Null),
                 };
-                Ok(s
-                    .chars()
-                    .nth(idx)
+                Ok(nth_char_cached(s, idx)
                     .map(|c| Value::String(c.to_string().into()))
                     .unwrap_or(Value::Null))
             }
@@ -3659,6 +4726,9 @@ impl Evaluator {
                 };
                 self.get_prop(obj, key)
             }
+            // Indexing the nullish value throws a catchable `TypeError` (like `get_prop` above and
+            // the VM/cranelift/wasi/node) rather than silently reading back `null`.
+            Value::Null => Err(format!("Cannot read property '{}' of null", index)),
             _ => Ok(Value::Null),
         }
     }
@@ -3677,8 +4747,13 @@ impl Evaluator {
         }
     }
 
-    fn json_stringify_value(v: &Value) -> String {
-        match v {
+    /// #381 — ancestor-guarded like `tishlang_core::json_stringify_into_guarded`: a back-edge to an
+    /// ancestor (`a.self = a`) is a cycle and returns `Err(())` instead of recursing forever (this
+    /// was an unguarded native-stack overflow → uncatchable abort; core's guard from #389 never
+    /// covered the interpreter's own stringifier). Ancestor-path only, not all-visited: a node
+    /// repeated across sibling branches is a legal DAG and must serialize twice.
+    fn json_stringify_value(v: &Value, ancestors: &mut Vec<*const ()>) -> Result<String, ()> {
+        Ok(match v {
             Value::Null => "null".to_string(),
             Value::Bool(b) => b.to_string(),
             Value::Number(n) => {
@@ -3689,37 +4764,50 @@ impl Evaluator {
                 tishlang_core::write_json_number(&mut s, *n);
                 s
             }
-            Value::String(s) => format!(
-                "\"{}\"",
-                s.replace('\\', "\\\\")
-                    .replace('"', "\\\"")
-                    .replace('\n', "\\n")
-                    .replace('\r', "\\r")
-                    .replace('\t', "\\t")
-            ),
+            Value::String(s) => {
+                // Use the shared core escaper so control chars (`\b`, `\f`, `\u00xx`) are escaped
+                // exactly like the vm/native path — the old hand-rolled `.replace()` chain missed
+                // them and produced invalid JSON (raw control bytes). #437
+                let mut out = String::with_capacity(s.len() + 2);
+                out.push('"');
+                tishlang_core::escape_json_string_into(&mut out, s);
+                out.push('"');
+                out
+            }
             Value::Array(arr) => {
-                let inner: Vec<String> = arr
-                    .borrow()
-                    .iter()
-                    .map(Self::json_stringify_value)
-                    .collect();
+                let ptr = Rc::as_ptr(arr) as *const ();
+                if ancestors.contains(&ptr) {
+                    return Err(());
+                }
+                ancestors.push(ptr);
+                let borrowed = arr.borrow();
+                let mut inner: Vec<String> = Vec::with_capacity(borrowed.len());
+                for item in borrowed.iter() {
+                    inner.push(Self::json_stringify_value(item, ancestors)?);
+                }
+                drop(borrowed);
+                ancestors.pop();
                 format!("[{}]", inner.join(","))
             }
             Value::Object(map) => {
+                let ptr = Rc::as_ptr(map) as *const ();
+                if ancestors.contains(&ptr) {
+                    return Err(());
+                }
+                ancestors.push(ptr);
                 // Insertion order (PropMap is an IndexMap) — matches JS/Node and the
                 // VM/rust backends. No key sort.
-                let entries: Vec<String> = map
-                    .borrow()
-                    .strings
-                    .iter()
-                    .map(|(k, v)| {
-                        format!(
-                            "\"{}\":{}",
-                            k.replace('\\', "\\\\").replace('"', "\\\""),
-                            Self::json_stringify_value(v)
-                        )
-                    })
-                    .collect();
+                let borrowed = map.borrow();
+                let mut entries: Vec<String> = Vec::with_capacity(borrowed.strings.len());
+                for (k, v) in borrowed.strings.iter() {
+                    entries.push(format!(
+                        "\"{}\":{}",
+                        k.replace('\\', "\\\\").replace('"', "\\\""),
+                        Self::json_stringify_value(v, ancestors)?
+                    ));
+                }
+                drop(borrowed);
+                ancestors.pop();
                 format!("{{{}}}", entries.join(","))
             }
             Value::Symbol(_) => "null".to_string(),
@@ -3738,7 +4826,7 @@ impl Evaluator {
             #[cfg(feature = "regex")]
             Value::RegExp(_) => "null".to_string(),
             Value::Opaque(_) | Value::OpaqueMethod(_, _) => "null".to_string(),
-        }
+        })
     }
 
     // Static native wrapper functions (these need to be fn pointers, not closures with &self)
@@ -3749,20 +4837,36 @@ impl Evaluator {
 
     fn json_stringify_native(args: &[Value]) -> Result<Value, String> {
         let v = args.first().cloned().unwrap_or(Value::Null);
-        Ok(Value::String(Self::json_stringify_value(&v).into()))
+        let mut ancestors: Vec<*const ()> = Vec::new();
+        match Self::json_stringify_value(&v, &mut ancestors) {
+            Ok(s) => Ok(Value::String(s.into())),
+            // Surfaced by `call_func` as `EvalError::Error`, which the Try handler boxes as
+            // `{ name: "TypeError", message }` — node-identical for the circular case (#381).
+            Err(()) => Err("Converting circular structure to JSON".to_string()),
+        }
     }
 
     fn object_keys(args: &[Value]) -> Result<Value, String> {
-        if let Some(Value::Object(obj)) = args.first() {
-            let keys: Vec<Value> = obj
-                .borrow()
-                .strings
-                .keys()
-                .map(|k| Value::String(Arc::clone(k)))
-                .collect();
-            Ok(Value::Array(Rc::new(RefCell::new(keys))))
-        } else {
-            Ok(Value::Array(Rc::new(RefCell::new(Vec::new()))))
+        match args.first() {
+            Some(Value::Object(obj)) => {
+                let keys: Vec<Value> = obj
+                    .borrow()
+                    .strings
+                    .keys()
+                    .map(|k| Value::String(Arc::clone(k)))
+                    .collect();
+                Ok(Value::Array(Rc::new(RefCell::new(keys))))
+            }
+            // `Object.keys(array)` → index strings "0".."len-1" (own enumerable keys are the indices),
+            // matching node and the shared builtin.
+            Some(Value::Array(arr)) => {
+                let len = arr.borrow().len();
+                let keys: Vec<Value> = (0..len)
+                    .map(|i| Value::String(Arc::from(i.to_string())))
+                    .collect();
+                Ok(Value::Array(Rc::new(RefCell::new(keys))))
+            }
+            _ => Ok(Value::Array(Rc::new(RefCell::new(Vec::new())))),
         }
     }
 
@@ -4214,3 +5318,126 @@ impl std::fmt::Display for EvalError {
 }
 
 impl std::error::Error for EvalError {}
+
+#[cfg(test)]
+mod recursion_limit_tests_381 {
+    use super::Evaluator;
+    use tishlang_parser::parse;
+
+    fn run_with_depth(src: &str, max_depth: usize) -> String {
+        let program = parse(src).unwrap();
+        let mut eval = Evaluator::new();
+        eval.max_call_depth = max_depth;
+        eval.eval_program(&program).unwrap().to_string()
+    }
+
+    #[test]
+    fn deep_recursion_throws_catchable_range_error() {
+        // Infinite (non-tail) recursion past the limit must throw a CATCHABLE RangeError, not abort:
+        // try/catch recovers and the program keeps running.
+        let src = "fn rec(n) { return 1 + rec(n + 1) }\n\
+                   let name = 'none'\n\
+                   try { rec(0) } catch (e) { name = e.name }\n\
+                   name";
+        assert_eq!(run_with_depth(src, 200), "RangeError");
+    }
+
+    #[test]
+    fn normal_recursion_is_unaffected() {
+        let src = "fn fib(n) { if (n < 2) { return n } return fib(n - 1) + fib(n - 2) }\nfib(12)";
+        assert_eq!(run_with_depth(src, 20000), "144");
+    }
+}
+
+#[cfg(test)]
+mod null_member_access_tests {
+    // Reading a property or index of the nullish value throws a catchable `TypeError`, matching the
+    // bytecode VM / cranelift / wasi / node. The tree-walker used to fall through to `Ok(Null)`, so
+    // `null.length` read back as `null` on interp while every other backend threw (a pure interp≠vm
+    // divergence). These lock the interpreter to the throwing behavior.
+    use super::Evaluator;
+    use tishlang_parser::parse;
+
+    fn run(src: &str) -> String {
+        let program = parse(src).unwrap();
+        let mut eval = Evaluator::new();
+        eval.eval_program(&program).unwrap().to_string()
+    }
+
+    #[test]
+    fn null_property_read_throws_type_error() {
+        let src = "let name = 'none'\n\
+                   try { let z = null; z.length } catch (e) { name = e.name }\n\
+                   name";
+        assert_eq!(run(src), "TypeError");
+    }
+
+    #[test]
+    fn null_index_read_throws_type_error() {
+        let src = "let name = 'none'\n\
+                   try { let z = null; z[0] } catch (e) { name = e.name }\n\
+                   name";
+        assert_eq!(run(src), "TypeError");
+    }
+
+    #[test]
+    fn object_missing_property_still_reads_null() {
+        // Guard against over-reach: a MISSING property of a real object is `null`, not a throw.
+        let src = "let o = { a: 1 }\nString(o.b === null)";
+        assert_eq!(run(src), "true");
+    }
+
+    #[test]
+    fn array_oob_index_still_reads_null() {
+        // Out-of-bounds array index stays nullish (only a null/undefined *receiver* throws).
+        let src = "let a = [1, 2, 3]\nString(a[9] === null)";
+        assert_eq!(run(src), "true");
+    }
+}
+
+#[cfg(test)]
+mod array_hof_callback_arg_tests {
+    // Array HOFs pass the source array as the trailing callback arg (JS `(element, index, array)`,
+    // reduce `(acc, element, index, array)`). The inline interp loops snapshot the backing store and
+    // drop the borrow before any callback, so a callback that MUTATES the array via the `array` arg
+    // (or a capture) can't RefCell-panic — it iterates the pre-call snapshot, matching JS + the shared
+    // #382 builtins path.
+    use super::Evaluator;
+    use tishlang_parser::parse;
+
+    fn run(src: &str) -> String {
+        let program = parse(src).unwrap();
+        let mut eval = Evaluator::new();
+        eval.eval_program(&program).unwrap().to_string()
+    }
+
+    #[test]
+    fn map_receives_array_as_third_arg() {
+        assert_eq!(run("[5, 3, 8].map((x, i, arr) => arr.length).join(',')"), "3,3,3");
+    }
+
+    #[test]
+    fn reduce_receives_array_as_fourth_arg() {
+        assert_eq!(run("[1, 2, 3].reduce((a, x, i, arr) => a + arr.length, 0)"), "9");
+    }
+
+    #[test]
+    fn callback_may_index_the_array_arg() {
+        assert_eq!(run("[10, 20, 30].map((x, i, arr) => arr[i] * 2).join(',')"), "20,40,60");
+    }
+
+    #[test]
+    fn callback_mutating_the_array_arg_does_not_panic() {
+        // Pre-snapshot this RefCell-panicked (map held the borrow across the loop). Now iteration is
+        // over the snapshot (3 elements); the 3 pushes land on the live array → final length 6, matching
+        // JS forEach semantics (does not visit elements appended during iteration).
+        let src = "let a = [1, 2, 3]\na.forEach((x, i, arr) => { arr.push(x) })\na.length";
+        assert_eq!(run(src), "6");
+    }
+
+    #[test]
+    fn one_and_two_arg_callbacks_unchanged() {
+        assert_eq!(run("[5, 3, 8].map(x => x * 2).join(',')"), "10,6,16");
+        assert_eq!(run("[5, 3, 8].map((x, i) => x + i).join(',')"), "5,4,10");
+    }
+}