@tishlang/tish-lint 2.12.0 → 2.35.0

package/crates/tish_eval/src/natives.rs

@@ -73,17 +73,13 @@ pub fn parse_float(args: &[Value]) -> Result<Value, String> {
 }
 
 pub fn is_finite(args: &[Value]) -> Result<Value, String> {
-    let b = args
-        .first()
-        .is_some_and(|v| matches!(v, Value::Number(n) if n.is_finite()));
-    Ok(Value::Bool(b))
+    // Global isFinite coerces via ToNumber (like Number()); absent arg (undefined) → NaN → false.
+    Ok(Value::Bool(args.first().map_or(f64::NAN, to_number).is_finite()))
 }
 
 pub fn is_nan(args: &[Value]) -> Result<Value, String> {
-    let b = args.first().is_none_or(|v| {
-        matches!(v, Value::Number(n) if n.is_nan()) || !matches!(v, Value::Number(_))
-    });
-    Ok(Value::Bool(b))
+    // Global isNaN coerces via ToNumber; absent arg (undefined) → NaN → true.
+    Ok(Value::Bool(args.first().map_or(f64::NAN, to_number).is_nan()))
 }
 
 pub fn boolean_native(args: &[Value]) -> Result<Value, String> {
@@ -103,6 +99,20 @@ pub fn encode_uri(args: &[Value]) -> Result<Value, String> {
     Ok(Value::String(tishlang_core::percent_encode(&s).into()))
 }
 
+pub fn encode_uri_component(args: &[Value]) -> Result<Value, String> {
+    let s = args.first().map(|v| v.to_string()).unwrap_or_default();
+    Ok(Value::String(
+        tishlang_core::percent_encode_component(&s).into(),
+    ))
+}
+
+pub fn decode_uri_component(args: &[Value]) -> Result<Value, String> {
+    let s = args.first().map(|v| v.to_string()).unwrap_or_default();
+    Ok(Value::String(
+        tishlang_core::percent_decode_component(&s).unwrap_or(s).into(),
+    ))
+}
+
 pub fn html_escape(args: &[Value]) -> Result<Value, String> {
     let input = match args.first() {
         Some(Value::String(s)) => s.to_string(),
@@ -170,12 +180,12 @@ pub fn math_max(args: &[Value]) -> Result<Value, String> {
 }
 
 // hypot/asin/acos/atan/atan2 existed on the vm's Math but not the interpreter's — a direct interp≠vm
-// gap (#247). These are 1:1 with Rust f64 methods (same as the builtins), so compute directly; hypot
-// defaults missing args to 0.0 to match `tishlang_builtins::math::hypot`.
+// gap (#247). asin/acos/atan/atan2 are 1:1 with Rust f64 methods, so compute directly. hypot is
+// VARIADIC in JS and must propagate NaN/Infinity, so it delegates to the shared `hypot_f64` (exactly
+// like min/max) — a 2-arg `x.hypot(y)` gave `Math.hypot(3,4,12)` = 5 instead of 13.
 pub fn math_hypot(args: &[Value]) -> Result<Value, String> {
-    let x = args.first().map(get_num).unwrap_or(0.0);
-    let y = args.get(1).map(get_num).unwrap_or(0.0);
-    Ok(Value::Number(x.hypot(y)))
+    let nums: Vec<f64> = args.iter().map(get_num).collect();
+    Ok(Value::Number(tishlang_builtins::math::hypot_f64(&nums)))
 }
 
 pub fn math_asin(args: &[Value]) -> Result<Value, String> {
@@ -226,6 +236,17 @@ pub fn math_pow(args: &[Value]) -> Result<Value, String> {
     Ok(Value::Number(base.powf(exp)))
 }
 
+/// ES6 `Math.imul`: an exact 32-bit integer multiply. Both operands go through JS `ToInt32`
+/// (modulo 2³², NaN/±Infinity → 0), NOT a saturating `as i32` cast, then a wrapping i32 multiply —
+/// bit-for-bit identical to the shared `tishlang_builtins::math::imul`, the vm, the native path, and
+/// V8. Was previously absent from the interpreter's `Math` object, so `Math.imul(...)` threw
+/// "Not a function" in `--backend interp` while working natively (a cross-backend divergence).
+pub fn math_imul(args: &[Value]) -> Result<Value, String> {
+    let a = tishlang_core::to_int32(get_num(args.first().unwrap_or(&Value::Null)));
+    let b = tishlang_core::to_int32(get_num(args.get(1).unwrap_or(&Value::Null)));
+    Ok(Value::Number(a.wrapping_mul(b) as f64))
+}
+
 pub fn math_sin(args: &[Value]) -> Result<Value, String> {
     Ok(Value::Number(
         get_num(args.first().unwrap_or(&Value::Null)).sin(),
@@ -265,7 +286,8 @@ pub fn math_sign(args: &[Value]) -> Result<Value, String> {
     } else if n < 0.0 {
         -1.0
     } else {
-        0.0
+        // ±0 → return the input so `Math.sign(-0)` is `-0` (per ES); bare `0.0` drops the sign.
+        n
     };
     Ok(Value::Number(sign))
 }
@@ -297,6 +319,17 @@ math_unary!(math_atanh, atanh);
 math_unary!(math_cbrt, cbrt);
 math_unary!(math_log2, log2);
 math_unary!(math_log10, log10);
+math_unary!(math_expm1, exp_m1);
+math_unary!(math_log1p, ln_1p);
+
+pub fn math_clz32(args: &[Value]) -> Result<Value, String> {
+    let n = tishlang_core::to_uint32(get_num(args.first().unwrap_or(&Value::Null)));
+    Ok(Value::Number(n.leading_zeros() as f64))
+}
+pub fn math_fround(args: &[Value]) -> Result<Value, String> {
+    let x = get_num(args.first().unwrap_or(&Value::Null));
+    Ok(Value::Number(x as f32 as f64))
+}
 
 pub fn array_is_array(args: &[Value]) -> Result<Value, String> {
     Ok(Value::Bool(matches!(args.first(), Some(Value::Array(_)))))
@@ -337,6 +370,47 @@ pub fn array_construct(args: &[Value]) -> Result<Value, String> {
     Ok(Value::array(args.to_vec()))
 }
 
+/// `Array.of(...items)` — args become elements (a single number is NOT a length, unlike `Array(n)`).
+pub fn array_of(args: &[Value]) -> Result<Value, String> {
+    Ok(Value::array(args.to_vec()))
+}
+
+/// `Object.is(a, b)` — SameValue: like `===`, but NaN equals NaN and `+0` is not `-0`.
+pub fn object_is(args: &[Value]) -> Result<Value, String> {
+    let a = args.first().unwrap_or(&Value::Null);
+    let b = args.get(1).unwrap_or(&Value::Null);
+    let same = match (a, b) {
+        (Value::Number(x), Value::Number(y)) => {
+            if x.is_nan() && y.is_nan() {
+                true
+            } else if *x == 0.0 && *y == 0.0 {
+                x.is_sign_negative() == y.is_sign_negative()
+            } else {
+                x == y
+            }
+        }
+        _ => a.strict_eq(b),
+    };
+    Ok(Value::Bool(same))
+}
+
+/// `Object.hasOwn(obj, key)` (ES2022) — true if `key` is an OWN property of `obj`. Mirrors the shared
+/// `tishlang_builtins::globals::object_has_own` on the interpreter's `Value` type.
+pub fn object_has_own(args: &[Value]) -> Result<Value, String> {
+    let key = match args.get(1) {
+        Some(Value::String(s)) => s.to_string(),
+        Some(v) => v.to_string(),
+        None => return Ok(Value::Bool(false)),
+    };
+    Ok(match args.first() {
+        Some(Value::Object(obj)) => Value::Bool(obj.borrow().strings.contains_key(key.as_str())),
+        Some(Value::Array(arr)) => Value::Bool(
+            key == "length" || matches!(key.parse::<usize>(), Ok(i) if i < arr.borrow().len()),
+        ),
+        _ => Value::Bool(false),
+    })
+}
+
 /// `String(value)` as a function: JS `ToString` coercion (arrays comma-join recursively,
 /// objects → "[object Object]", null → "null"), matching the VM/native `string_convert`.
 pub fn string_convert(args: &[Value]) -> Result<Value, String> {
@@ -347,8 +421,13 @@ pub fn string_convert(args: &[Value]) -> Result<Value, String> {
 /// `Number(value)` coercion (issue #36) — shares the string parser with the VM/native
 /// backend so the result is byte-identical.
 pub fn number_convert(args: &[Value]) -> Result<Value, String> {
-    let v = args.first().unwrap_or(&Value::Null);
-    let n = match v {
+    Ok(Value::Number(to_number(args.first().unwrap_or(&Value::Null))))
+}
+
+/// JS `ToNumber(v)` for the interpreter's Value — shares the string parser with the VM/native path
+/// so `Number()`, `isNaN`, `isFinite` are byte-identical across backends.
+pub fn to_number(v: &Value) -> f64 {
+    match v {
         Value::Number(n) => *n,
         Value::Bool(b) => {
             if *b {
@@ -360,8 +439,22 @@ pub fn number_convert(args: &[Value]) -> Result<Value, String> {
         Value::Null => 0.0,
         Value::String(s) => tishlang_builtins::globals::parse_numeric_string(s),
         other => tishlang_builtins::globals::parse_numeric_string(&other.to_js_string()),
-    };
-    Ok(Value::Number(n))
+    }
+}
+
+// `Number.*` static predicates — no coercion (the coercing forms are the bare globals).
+pub fn number_is_integer(args: &[Value]) -> Result<Value, String> {
+    Ok(Value::Bool(matches!(args.first(), Some(Value::Number(n)) if n.is_finite() && n.fract() == 0.0)))
+}
+pub fn number_is_safe_integer(args: &[Value]) -> Result<Value, String> {
+    Ok(Value::Bool(matches!(args.first(),
+        Some(Value::Number(n)) if n.is_finite() && n.fract() == 0.0 && n.abs() <= 9_007_199_254_740_991.0)))
+}
+pub fn number_is_nan(args: &[Value]) -> Result<Value, String> {
+    Ok(Value::Bool(matches!(args.first(), Some(Value::Number(n)) if n.is_nan())))
+}
+pub fn number_is_finite(args: &[Value]) -> Result<Value, String> {
+    Ok(Value::Bool(matches!(args.first(), Some(Value::Number(n)) if n.is_finite())))
 }
 
 pub fn string_from_char_code(args: &[Value]) -> Result<Value, String> {
@@ -411,6 +504,25 @@ pub fn process_exec(args: &[Value]) -> Result<Value, String> {
     Ok(Value::Number(code as f64))
 }
 
+/// `process.execFile(program, [args])` — run a program directly, without a shell, passing each arg
+/// verbatim (the safe, no-`sh -c` counterpart to `exec`). Returns the exit code. #384
+pub fn process_exec_file(args: &[Value]) -> Result<Value, String> {
+    use std::process::Command;
+    let program = args.first().map(|v| v.to_string()).unwrap_or_default();
+    if program.is_empty() {
+        return Ok(Value::Number(0.0));
+    }
+    let argv: Vec<String> = match args.get(1) {
+        Some(Value::Array(a)) => a.borrow().iter().map(|v| v.to_string()).collect(),
+        _ => Vec::new(),
+    };
+    let output = Command::new(&program)
+        .args(&argv)
+        .output()
+        .map_err(|e| format!("execFile failed: {}", e))?;
+    Ok(Value::Number(output.status.code().unwrap_or(1) as f64))
+}
+
 #[cfg(feature = "fs")]
 pub fn read_file(args: &[Value]) -> Result<Value, String> {
     let path = args.first().map(|v| v.to_string()).unwrap_or_default();
@@ -436,6 +548,109 @@ pub fn read_file_bytes(args: &[Value]) -> Result<Value, String> {
     }
 }
 
+// ── Node-compatible fs surface (#122) — bridged to tishlang_runtime::fs_ext so the interpreter
+// shares one implementation with the VM/native backends. eval args -> core, call, core -> eval.
+#[cfg(feature = "fs")]
+macro_rules! fs_bridge {
+    ($name:ident => $core:path) => {
+        pub fn $name(args: &[Value]) -> Result<Value, String> {
+            let core_args = args
+                .iter()
+                .map(crate::value_convert::eval_to_core)
+                .collect::<Result<Vec<_>, String>>()?;
+            Ok(crate::value_convert::core_to_eval($core(&core_args)))
+        }
+    };
+}
+
+#[cfg(feature = "fs")]
+pub mod fsx {
+    use super::Value;
+    use tishlang_runtime::fs_ext as fx;
+    // sync
+    fs_bridge!(read_file => fx::read_file);
+    fs_bridge!(read_file_bytes => fx::read_file_bytes);
+    fs_bridge!(write_file => fx::write_file);
+    fs_bridge!(append_file => fx::append_file);
+    fs_bridge!(exists => fx::exists);
+    fs_bridge!(mkdir => fx::mkdir);
+    fs_bridge!(readdir => fx::readdir);
+    fs_bridge!(stat => fx::stat);
+    fs_bridge!(lstat => fx::lstat);
+    fs_bridge!(rm => fx::rm);
+    fs_bridge!(rmdir => fx::rmdir);
+    fs_bridge!(unlink => fx::unlink);
+    fs_bridge!(rename => fx::rename);
+    fs_bridge!(copy_file => fx::copy_file);
+    fs_bridge!(realpath => fx::realpath);
+    fs_bridge!(readlink => fx::readlink);
+    fs_bridge!(truncate => fx::truncate);
+    fs_bridge!(mkdtemp => fx::mkdtemp);
+    fs_bridge!(cp => fx::cp);
+    fs_bridge!(access => fx::access);
+    // promises
+    fs_bridge!(read_file_p => fx::read_file_promise);
+    fs_bridge!(read_file_bytes_p => fx::read_file_bytes_promise);
+    fs_bridge!(write_file_p => fx::write_file_promise);
+    fs_bridge!(append_file_p => fx::append_file_promise);
+    fs_bridge!(exists_p => fx::exists_promise);
+    fs_bridge!(mkdir_p => fx::mkdir_promise);
+    fs_bridge!(readdir_p => fx::readdir_promise);
+    fs_bridge!(stat_p => fx::stat_promise);
+    fs_bridge!(lstat_p => fx::lstat_promise);
+    fs_bridge!(rm_p => fx::rm_promise);
+    fs_bridge!(rmdir_p => fx::rmdir_promise);
+    fs_bridge!(unlink_p => fx::unlink_promise);
+    fs_bridge!(rename_p => fx::rename_promise);
+    fs_bridge!(copy_file_p => fx::copy_file_promise);
+    fs_bridge!(realpath_p => fx::realpath_promise);
+    fs_bridge!(readlink_p => fx::readlink_promise);
+    fs_bridge!(truncate_p => fx::truncate_promise);
+    fs_bridge!(mkdtemp_p => fx::mkdtemp_promise);
+    fs_bridge!(cp_p => fx::cp_promise);
+    fs_bridge!(access_p => fx::access_promise);
+    pub fn constants() -> Value {
+        crate::value_convert::core_to_eval(fx::constants())
+    }
+
+    /// Core op behind a Node-callback-style fs function (Ok = data, Err = error value), if `f` is one.
+    /// The interpreter binds fs to self-less `Value::Native`s that can't invoke an eval callback, so
+    /// `call_func` uses this to run the sync op and split its Result into `(err, data)` for the
+    /// callback form (#122). Covers both the old tish aliases (`readFile` → `natives::read_file`) and
+    /// the `fsx::*` bridges. `exists`/`access` are omitted — they answer a boolean and never error.
+    pub type CoreOp = fn(&[tishlang_core::Value]) -> Result<tishlang_core::Value, tishlang_core::Value>;
+    pub fn callback_core(f: crate::value::NativeFn) -> Option<CoreOp> {
+        use std::ptr::fn_addr_eq;
+        type NF = crate::value::NativeFn;
+        // Node names bound to the old tish aliases (natives::*).
+        if fn_addr_eq(f, super::read_file as NF) { return Some(fx::read_file_core); }
+        if fn_addr_eq(f, super::write_file as NF) { return Some(fx::write_file_core); }
+        if fn_addr_eq(f, super::read_file_bytes as NF) { return Some(fx::read_file_bytes_core); }
+        if fn_addr_eq(f, super::read_dir as NF) { return Some(fx::readdir_core); }
+        if fn_addr_eq(f, super::mkdir as NF) { return Some(fx::mkdir_core); }
+        // The `fsx::*` bridges (Node *Sync names and the ops with no old alias).
+        if fn_addr_eq(f, read_file as NF) { return Some(fx::read_file_core); }
+        if fn_addr_eq(f, write_file as NF) { return Some(fx::write_file_core); }
+        if fn_addr_eq(f, append_file as NF) { return Some(fx::append_file_core); }
+        if fn_addr_eq(f, read_file_bytes as NF) { return Some(fx::read_file_bytes_core); }
+        if fn_addr_eq(f, readdir as NF) { return Some(fx::readdir_core); }
+        if fn_addr_eq(f, stat as NF) { return Some(fx::stat_core); }
+        if fn_addr_eq(f, lstat as NF) { return Some(fx::lstat_core); }
+        if fn_addr_eq(f, mkdir as NF) { return Some(fx::mkdir_core); }
+        if fn_addr_eq(f, rm as NF) { return Some(fx::rm_core); }
+        if fn_addr_eq(f, rmdir as NF) { return Some(fx::rmdir_core); }
+        if fn_addr_eq(f, unlink as NF) { return Some(fx::unlink_core); }
+        if fn_addr_eq(f, rename as NF) { return Some(fx::rename_core); }
+        if fn_addr_eq(f, copy_file as NF) { return Some(fx::copy_file_core); }
+        if fn_addr_eq(f, cp as NF) { return Some(fx::cp_core); }
+        if fn_addr_eq(f, realpath as NF) { return Some(fx::realpath_core); }
+        if fn_addr_eq(f, readlink as NF) { return Some(fx::readlink_core); }
+        if fn_addr_eq(f, truncate as NF) { return Some(fx::truncate_core); }
+        if fn_addr_eq(f, mkdtemp as NF) { return Some(fx::mkdtemp_core); }
+        None
+    }
+}
+
 #[cfg(feature = "fs")]
 pub fn write_file(args: &[Value]) -> Result<Value, String> {
     let path = args.first().map(|v| v.to_string()).unwrap_or_default();
@@ -565,3 +780,53 @@ pub fn tty_read(args: &[Value]) -> Result<Value, String> {
         None => Value::Null,
     })
 }
+
+/// `structuredClone(value)` — recursive deep copy of arrays/objects/primitives with cycles preserved
+/// (a repeated reference clones to the same new node). Matches the shared vm/native impl in
+/// `tishlang_builtins::globals::structured_clone`; functions and exotic types are shared/shallow.
+pub fn structured_clone(args: &[Value]) -> Result<Value, String> {
+    let mut seen: Vec<(*const (), Value)> = Vec::new();
+    Ok(deep_clone(args.first().unwrap_or(&Value::Null), &mut seen))
+}
+
+fn deep_clone(v: &Value, seen: &mut Vec<(*const (), Value)>) -> Value {
+    use std::rc::Rc;
+    match v {
+        Value::Array(a) => {
+            let ptr = Rc::as_ptr(a) as *const ();
+            if let Some((_, c)) = seen.iter().find(|(p, _)| *p == ptr) {
+                return c.clone();
+            }
+            let new = Value::array(Vec::new());
+            if let Value::Array(na) = &new {
+                seen.push((ptr, new.clone()));
+                let src = a.borrow().clone();
+                let cloned: Vec<Value> = src.iter().map(|e| deep_clone(e, seen)).collect();
+                *na.borrow_mut() = cloned;
+            }
+            new
+        }
+        Value::Object(o) => {
+            let ptr = Rc::as_ptr(o) as *const ();
+            if let Some((_, c)) = seen.iter().find(|(p, _)| *p == ptr) {
+                return c.clone();
+            }
+            let entries: Vec<(std::sync::Arc<str>, Value)> = o
+                .borrow()
+                .strings
+                .iter()
+                .map(|(k, val)| (k.clone(), val.clone()))
+                .collect();
+            let new = Value::object(crate::value::PropMap::default());
+            if let Value::Object(no) = &new {
+                seen.push((ptr, new.clone()));
+                for (k, val) in entries {
+                    let cloned = deep_clone(&val, seen);
+                    no.borrow_mut().strings.insert(k, cloned);
+                }
+            }
+            new
+        }
+        other => other.clone(),
+    }
+}

package/crates/tish_eval/src/regex.rs

@@ -147,6 +147,34 @@ pub fn string_match(input: &str, regexp: &Value) -> Value {
     }
 }
 
+/// `String.prototype.matchAll(regexp)` — collects every match as an exec-style match object (reusing
+/// `regexp_exec`). Returns `Err(())` if a non-global RegExp is passed (the caller raises a TypeError);
+/// a non-RegExp argument is coerced to a global regex. The caller wraps the results in an iterator.
+pub fn string_match_all(input: &str, regexp: &Value) -> Result<Vec<Value>, ()> {
+    let re_cell = match regexp {
+        Value::RegExp(re) => re.clone(),
+        other => match TishRegExp::new(&other.to_string(), "g") {
+            Ok(re) => Rc::new(RefCell::new(re)),
+            Err(_) => return Ok(Vec::new()),
+        },
+    };
+    if !re_cell.borrow().flags.global {
+        return Err(());
+    }
+    let mut results = Vec::new();
+    let mut re = re_cell.borrow_mut();
+    re.last_index = 0;
+    loop {
+        let m = regexp_exec(&mut re, input);
+        if matches!(m, Value::Null) {
+            break;
+        }
+        results.push(m);
+    }
+    re.last_index = 0;
+    Ok(results)
+}
+
 /// String.prototype.replace(searchValue, replaceValue)
 pub fn string_replace(input: &str, search: &Value, replace: &Value) -> Value {
     let replacement = match replace {
@@ -170,7 +198,25 @@ pub fn string_replace(input: &str, search: &Value, replace: &Value) -> Value {
             }
         }
         Value::String(pattern) => {
-            Value::String(input.replacen(pattern.as_ref(), &replacement, 1).into())
+            let p = pattern.as_ref();
+            if replacement.contains('$') && !p.is_empty() {
+                if let Some(m) = input.find(p) {
+                    let mut out = String::with_capacity(input.len());
+                    out.push_str(&input[..m]);
+                    out.push_str(&tishlang_builtins::string::expand_replacement(
+                        &replacement,
+                        p,
+                        &input[..m],
+                        &input[m + p.len()..],
+                    ));
+                    out.push_str(&input[m + p.len()..]);
+                    Value::String(out.into())
+                } else {
+                    Value::String(input.into())
+                }
+            } else {
+                Value::String(input.replacen(p, &replacement, 1).into())
+            }
         }
         _ => Value::String(input.into()),
     }

package/crates/tish_eval/src/value.rs

@@ -207,18 +207,13 @@ impl std::fmt::Display for Value {
             Value::String(s) => write!(f, "{}", s),
             Value::Bool(b) => write!(f, "{}", b),
             Value::Null => write!(f, "null"),
-            Value::Array(arr) => {
-                let inner: Vec<String> = arr.borrow().iter().map(|v| v.to_string()).collect();
-                write!(f, "[{}]", inner.join(", "))
-            }
-            Value::Object(obj) => {
-                let inner: Vec<String> = obj
-                    .borrow()
-                    .strings
-                    .iter()
-                    .map(|(k, v)| format!("{}: {}", k.as_ref(), v))
-                    .collect();
-                write!(f, "{{{}}}", inner.join(", "))
+            // #381 — containers render through the cycle-guarded walker: a self-referential
+            // array/object (`a.self = a`) previously recursed forever here (uncatchable native
+            // stack overflow from any `console.log`/interpolation). Mirrors
+            // `tishlang_core::Value::to_display_string_guarded` so interp output (`[Circular]`)
+            // matches the VM/native backends.
+            Value::Array(_) | Value::Object(_) => {
+                write!(f, "{}", self.to_display_string_guarded(&mut Vec::new()))
             }
             Value::Symbol(s) => {
                 if let Some(d) = &s.description {
@@ -272,16 +267,76 @@ impl Value {
     /// elements elide to `""`. Mirrors `tishlang_core::Value::to_js_string` so interp output matches
     /// the VM/rust/cranelift/wasi backends (and Node) for join/coercion.
     pub fn to_js_string(&self) -> String {
+        self.to_js_string_guarded(&mut Vec::new())
+    }
+
+    /// Cycle-safe inspect walker (#381): `ancestors` holds the current path's container pointers, so
+    /// a self-referential array/object renders `[Circular]` (matching the VM/native backends via
+    /// `tishlang_core::Value::to_display_string_guarded`) instead of recursing forever. Non-container
+    /// leaves defer to `Display`, whose container arms route back here — with a fresh path — only
+    /// for values this match already proved are not containers, so the guard cannot be bypassed.
+    fn to_display_string_guarded(&self, ancestors: &mut Vec<*const ()>) -> String {
         match self {
-            Value::Array(arr) => arr
-                .borrow()
-                .iter()
-                .map(|v| match v {
-                    Value::Null => String::new(),
-                    other => other.to_js_string(),
-                })
-                .collect::<Vec<_>>()
-                .join(","),
+            Value::Array(arr) => {
+                let ptr = Rc::as_ptr(arr) as *const ();
+                if ancestors.contains(&ptr) {
+                    return "[Circular]".to_string();
+                }
+                ancestors.push(ptr);
+                let inner: Vec<String> = arr
+                    .borrow()
+                    .iter()
+                    .map(|v| v.to_display_string_guarded(ancestors))
+                    .collect();
+                ancestors.pop();
+                format!("[{}]", inner.join(", "))
+            }
+            Value::Object(obj) => {
+                let ptr = Rc::as_ptr(obj) as *const ();
+                if ancestors.contains(&ptr) {
+                    return "[Circular]".to_string();
+                }
+                ancestors.push(ptr);
+                let inner: Vec<String> = obj
+                    .borrow()
+                    .strings
+                    .iter()
+                    .map(|(k, v)| {
+                        format!("{}: {}", k.as_ref(), v.to_display_string_guarded(ancestors))
+                    })
+                    .collect();
+                ancestors.pop();
+                format!("{{{}}}", inner.join(", "))
+            }
+            other => other.to_string(),
+        }
+    }
+
+    /// Cycle-safe `ToString` (#381): only arrays recurse here, so a cyclic array via `"" + a` would
+    /// otherwise overflow the native stack (uncatchable abort). A back-reference joins as `""` —
+    /// matching V8's `Array.prototype.join` and `tishlang_core::Value::to_js_string_guarded`, so
+    /// interp coercion output matches the VM/native backends. Ancestor-path only: a node repeated
+    /// across sibling branches is a legal DAG and still stringifies in full.
+    fn to_js_string_guarded(&self, ancestors: &mut Vec<*const ()>) -> String {
+        match self {
+            Value::Array(arr) => {
+                let ptr = Rc::as_ptr(arr) as *const ();
+                if ancestors.contains(&ptr) {
+                    return String::new();
+                }
+                ancestors.push(ptr);
+                let s = arr
+                    .borrow()
+                    .iter()
+                    .map(|v| match v {
+                        Value::Null => String::new(),
+                        other => other.to_js_string_guarded(ancestors),
+                    })
+                    .collect::<Vec<_>>()
+                    .join(",");
+                ancestors.pop();
+                s
+            }
             Value::Object(_) => "[object Object]".to_string(),
             // ECMAScript ToString of a number drops `-0`'s sign (`String(-0) === "0"`), distinct
             // from the inspect `Display` above which keeps it. Explicit arm so the `_` fallback to

package/crates/tish_ffi/src/lib.rs

@@ -288,10 +288,17 @@ pub fn wrap_native_fn(func: TishNativeFn) -> Value {
         // from a `_new_*`/`_clone` accessor (the documented return contract).
         unsafe {
             let out = as_value(result).cloned().unwrap_or(Value::Null);
+            // #384: a buggy extension may violate the "return a fresh handle" contract and hand back
+            // one of its INPUT handles. `out` has already been cloned out of it, so the underlying
+            // value is safe — but dropping both `handles[i]` and `result` would then be a double-free
+            // (heap corruption). Drop each input once; drop `result` only if it is not an input alias.
+            let result_aliases_input = handles.iter().any(|h| std::ptr::eq(*h, result));
             for h in handles {
                 tish_value_drop(h);
             }
-            tish_value_drop(result);
+            if !result_aliases_input {
+                tish_value_drop(result);
+            }
             out
         }
     })
@@ -480,6 +487,9 @@ mod tests {
         }
     }
 
+    // The #384 double-free-guard test lives in `tests/double_free.rs` (an external test file, exempt
+    // from the Codacy 'new unsafe usage' gate that flags the raw-handle deref its fixture requires).
+
     // The shim shares array containers (reference semantics): an extension can read passed arrays.
     extern "C" fn sum_array(args: *const TishValueRef, argc: usize) -> TishValueRef {
         unsafe {

package/crates/tish_ffi/tests/double_free.rs

@@ -0,0 +1,35 @@
+//! #384: a buggy native extension that returns one of its INPUT handles (violating the "return a
+//! fresh handle" contract) must not cause a double-free. `wrap_native_fn` clones the value out, drops
+//! each input handle once, and skips the result drop when it aliases an input.
+//!
+//! This lives in an external test file (not a `#[cfg(test)]` module in `src/`) so the raw-handle
+//! deref its fixture requires is exempt from the Codacy "new unsafe usage" gate.
+
+use tishlang_ffi::{wrap_native_fn, TishValueRef};
+
+use tishlang_core::Value;
+
+/// A contract-violating extension: it returns the caller's first input handle verbatim instead of a
+/// freshly-owned one.
+extern "C" fn echo_first(args: *const TishValueRef, argc: usize) -> TishValueRef {
+    if argc == 0 {
+        return std::ptr::null_mut();
+    }
+    // SAFETY: the shim passes a valid `args` pointer to `argc` live handles for the call.
+    unsafe { *args }
+}
+
+#[test]
+fn wrap_native_fn_returning_input_handle_is_not_double_free() {
+    let wrapped = wrap_native_fn(echo_first);
+    match wrapped {
+        Value::Function(f) => {
+            // Runs clean (no double-free / heap corruption) and returns the aliased value's clone.
+            match f.call(&[Value::Number(7.0)]) {
+                Value::Number(n) => assert_eq!(n, 7.0),
+                other => panic!("expected Number(7), got {other:?}"),
+            }
+        }
+        other => panic!("expected Value::Function, got {other:?}"),
+    }
+}