@tishlang/tish-lint 3.12.1 → 3.14.0

package/crates/tish_native/src/build.rs

@@ -22,6 +22,7 @@ const RUNTIME_CARGO_FEATURES: &[&str] = &[
     "encoding",
     "crypto",
     "zip",
+    "ffi",
 ];
 
 /// Map CLI/compile features to flags passed to `tishlang_runtime` in the temp crate's Cargo.toml.
@@ -228,7 +229,18 @@ pub fn build_via_cargo_with_config(
     // statement; semantically transparent. `TISH_NATIVE_FAST_ALLOC=0` opts out.
     let use_fast_alloc = fast_alloc_enabled()
         && build_config.artifact != NativeArtifact::StaticLib
+        && build_config.artifact != NativeArtifact::FfiModule
         && build_config.cargo_target.is_none();
+    if build_config.artifact == NativeArtifact::FfiModule {
+        let guest_path = Path::new(&runtime_path)
+            .parent()
+            .map(|crates| crates.join("tish_ffi_guest"))
+            .ok_or_else(|| format!("Cannot locate tish_ffi_guest next to {}", runtime_path))?;
+        more_deps.push_str(&format!(
+            "\ntishlang_ffi_guest = {{ path = {:?} }}\n",
+            guest_path.display().to_string().replace('\\', "/")
+        ));
+    }
     if use_fast_alloc {
         more_deps.push_str("\nmimalloc = \"0.1\"\n");
     }
@@ -241,20 +253,25 @@ pub fn build_via_cargo_with_config(
     let ui_dep = ui_dep_toml(&runtime_path, rust_code);
 
     let profile = nested_release_profile_toml();
-    let src_file = if build_config.artifact == NativeArtifact::StaticLib {
-        "lib.rs"
-    } else {
-        "main.rs"
-    };
-    let crate_section = if build_config.artifact == NativeArtifact::StaticLib {
+    let is_lib_artifact = matches!(
+        build_config.artifact,
+        NativeArtifact::StaticLib | NativeArtifact::FfiModule
+    );
+    let src_file = if is_lib_artifact { "lib.rs" } else { "main.rs" };
+    let crate_section = if is_lib_artifact {
+        let crate_type = if build_config.artifact == NativeArtifact::FfiModule {
+            "cdylib"
+        } else {
+            "staticlib"
+        };
         format!(
             r#"[lib]
 name = "{}"
-crate-type = ["staticlib"]
+crate-type = ["{}"]
 path = "src/lib.rs"
 
 "#,
-            cargo_name
+            cargo_name, crate_type
         )
     } else {
         format!(
@@ -317,12 +334,16 @@ edition = "2021"
 
     tishlang_build_utils::run_cargo_build(&build_dir, target_dir.as_deref(), cross)?;
 
-    let artifact = if build_config.artifact == NativeArtifact::StaticLib {
-        tishlang_build_utils::find_release_staticlib(&binary_dir, &cargo_name)?
-    } else {
-        tishlang_build_utils::find_release_binary(&binary_dir, &cargo_name)?
+    let artifact = match build_config.artifact {
+        NativeArtifact::StaticLib => {
+            tishlang_build_utils::find_release_staticlib(&binary_dir, &cargo_name)?
+        }
+        NativeArtifact::FfiModule => find_release_cdylib(&binary_dir, &cargo_name)?,
+        _ => tishlang_build_utils::find_release_binary(&binary_dir, &cargo_name)?,
     };
-    let target = if build_config.artifact == NativeArtifact::StaticLib {
+    let target = if build_config.artifact == NativeArtifact::FfiModule {
+        output_path.to_path_buf()
+    } else if build_config.artifact == NativeArtifact::StaticLib {
         if output_path.extension().is_some_and(|e| e == "a") {
             output_path.to_path_buf()
         } else if output_path.to_string_lossy().ends_with('/') || output_path.is_dir() {
@@ -339,6 +360,20 @@ edition = "2021"
     Ok(())
 }
 
+/// The built `cdylib` for `cargo_name` under `dir` (`lib<name>.dylib` / `lib<name>.so` / `<name>.dll`).
+fn find_release_cdylib(dir: &Path, cargo_name: &str) -> Result<PathBuf, String> {
+    let candidates = [
+        format!("lib{cargo_name}.dylib"),
+        format!("lib{cargo_name}.so"),
+        format!("{cargo_name}.dll"),
+    ];
+    candidates
+        .iter()
+        .map(|c| dir.join(c))
+        .find(|p| p.is_file())
+        .ok_or_else(|| format!("Built cdylib not found in {} (looked for {:?})", dir.display(), candidates))
+}
+
 /// Read the agb version the facade pins, from `<facade>/Cargo.toml`. This keeps the generated ROM
 /// crate's agb in lockstep with the facade's (the single source of truth) — see [`build_gba_rom`].
 /// Matches an `agb = "X"` or `agb = { version = "X", … }` line; `None` if absent (caller falls back).

package/crates/tish_native/src/config.rs

@@ -15,6 +15,8 @@ pub enum NativeArtifact {
     /// module's `export fn`s. Unlike every other artifact, cargo is **not** run — the emitted
     /// crate directory is itself the output, for the consumer to add as a path/registry dependency.
     RustLib,
+    /// A dynamically loadable tish native module (`crate-type = ["cdylib"]`, FFI ABI v2).
+    FfiModule,
 }
 
 /// Options passed from the CLI into nested `cargo build`.
@@ -59,6 +61,14 @@ impl NativeBuildConfig {
         }
     }
 
+    pub fn ffi_module() -> Self {
+        Self {
+            artifact: NativeArtifact::FfiModule,
+            cargo_target: None,
+            emit_mode: NativeEmitMode::FfiModule,
+        }
+    }
+
     pub fn is_cross_compile(&self) -> bool {
         self.cargo_target.is_some()
     }

package/crates/tish_runtime/Cargo.toml

@@ -65,6 +65,9 @@ encoding = ["dep:base64"]
 crypto = ["dep:sha2", "dep:rand"]
 # Zip extraction (tish:zip) — VSIX / archive extract with `..`-traversal guard + unix-mode preserved.
 zip = ["dep:zip"]
+# Runtime loading of tish FFI cdylibs (tish:ffi `loadModule`), e.g. plugins built with
+# `tish build --crate-type cdylib`. Hosts need no linker flags: ABI v2 passes the accessor table.
+ffi = ["dep:tishlang_ffi"]
 # Interactive terminal I/O (issue #101): raw mode, key/resize events, size, alt screen.
 tty = ["dep:crossterm"]
 # Pseudoterminal hosting (issue #493): spawn a shell/program on a real PTY, read/write/resize/kill —
@@ -97,6 +100,7 @@ futures = { version = "0.3.32", optional = true }
 base64 = { version = "0.22", optional = true }
 sha2 = { version = "0.10", optional = true }
 zip = { version = "2", default-features = false, features = ["deflate"], optional = true }
+tishlang_ffi = { path = "../tish_ffi", version = ">=0.1", optional = true }
 bytes = { version = "1", optional = true }
 tiny_http = { version = "0.12.0", optional = true }
 # fs feature only: random suffix for `mkdtemp`.

package/crates/tish_runtime/src/http.rs

@@ -83,6 +83,37 @@ pub(crate) fn subscriber_runtime() -> &'static Runtime {
     })
 }
 
+/// Process-global runtime that drives every outbound `fetch` (send, body reads, text/json).
+///
+/// Outbound fetch used the thread-local [`RUNTIME`] of whichever thread issued the call. The
+/// reqwest client — and its keep-alive connection POOL — is process-global, but each pooled
+/// connection's driver task lives on the runtime that opened it. In a multi-threaded host
+/// (tish-desktop dispatches each invoke on a pool thread; `block_on_http` even runs on a scoped
+/// thread that dies with the call) the NEXT request could pick a pooled connection whose runtime
+/// was idle or gone: the body then failed mid-stream as "error decoding response body". It hit
+/// exactly the request after a completed stream, intermittently, and never in a single-threaded
+/// program. One immortal runtime for all fetch I/O makes pooled connections always driven.
+pub(crate) fn fetch_runtime() -> &'static Runtime {
+    static RT: OnceLock<Runtime> = OnceLock::new();
+    RT.get_or_init(|| {
+        tokio::runtime::Builder::new_multi_thread()
+            .worker_threads(4)
+            .thread_name("tish-fetch")
+            .enable_all()
+            .build()
+            .expect("Failed to create fetch runtime")
+    })
+}
+
+/// `RUNTIME.with(|rt| …)`-shaped handle onto [`fetch_runtime`], so call sites keep their shape.
+pub(crate) struct FetchRt;
+impl FetchRt {
+    pub(crate) fn with<R>(&self, f: impl FnOnce(&Runtime) -> R) -> R {
+        f(fetch_runtime())
+    }
+}
+pub(crate) static FETCH_RT: FetchRt = FetchRt;
+
 pub fn await_fetch(args: Vec<Value>) -> Value {
     crate::promise::await_promise(crate::native_promise::fetch_promise(args))
 }
@@ -130,6 +161,19 @@ pub(crate) fn extract_body(options: Option<&Value>) -> Option<String> {
     })
 }
 
+/// `fetch(url, { timeout: ms })` — per-request TOTAL timeout in milliseconds. `None` when absent
+/// (the sender applies the default), `Some(0)` disables the total timeout for that request (a
+/// long-lived stream such as an SSE chat completion); the client's idle read timeout still bounds it.
+pub(crate) fn extract_timeout_ms(options: Option<&Value>) -> Option<u64> {
+    options.and_then(|v| match v {
+        Value::Object(obj) => obj.borrow().strings.get("timeout").and_then(|t| match t {
+            Value::Number(n) if n.is_finite() && *n >= 0.0 => Some(*n as u64),
+            _ => None,
+        }),
+        _ => None,
+    })
+}
+
 /// A single `multipart/form-data` part extracted from a `fetch` options object's `multipart` array.
 pub(crate) enum MultipartPart {
     /// A text field: `{ name, value }`.

package/crates/tish_runtime/src/http_fetch.rs

@@ -12,7 +12,7 @@ use tishlang_core::{NativeFn, ObjectMap, TishOpaque, TishPromise, Value};
 
 use crate::http::{
     build_error_response, extract_body, extract_headers, extract_method, extract_multipart,
-    MultipartPart,
+    extract_timeout_ms, MultipartPart,
 };
 
 // --- Promises (Send payloads only; Value built on awaiting/settling thread) ---
@@ -373,7 +373,7 @@ impl TishOpaque for HttpStreamReader {
             let inner = Arc::clone(&inner);
             let body = Arc::clone(&body);
             let (tx, rx) = tokio::sync::oneshot::channel();
-            crate::http::RUNTIME.with(|rt| {
+            crate::http::FETCH_RT.with(|rt| {
                 rt.spawn(async move {
                     let mut slot = inner.lock().await;
                     match slot.stream.next().await {
@@ -421,7 +421,7 @@ pub fn response_value_from_reqwest(response: reqwest::Response) -> Value {
     let text_fn: NativeFn = tishlang_core::native_fn(move |_args: &[Value]| {
         let bh = Arc::clone(&bh_text);
         let (tx, rx) = tokio::sync::oneshot::channel();
-        crate::http::RUNTIME.with(|rt| {
+        crate::http::FETCH_RT.with(|rt| {
             rt.spawn(async move {
                 let r = bh.take_text_async().await;
                 let _ = tx.send(r);
@@ -432,7 +432,7 @@ pub fn response_value_from_reqwest(response: reqwest::Response) -> Value {
     let json_fn: NativeFn = tishlang_core::native_fn(move |_args: &[Value]| {
         let bh = Arc::clone(&bh_json);
         let (tx, rx) = tokio::sync::oneshot::channel();
-        crate::http::RUNTIME.with(|rt| {
+        crate::http::FETCH_RT.with(|rt| {
             rt.spawn(async move {
                 let r = bh.take_text_async().await;
                 let _ = tx.send(r);
@@ -452,21 +452,56 @@ pub fn response_value_from_reqwest(response: reqwest::Response) -> Value {
     Value::object(obj)
 }
 
-/// Shared, hardened outbound HTTP client: request + connect timeouts (a no-timeout fetch is
+/// Default TOTAL request timeout (headers + whole body), applied per request unless the caller
+/// passes `{ timeout: ms }`. Override the default with `TISH_FETCH_TIMEOUT_MS`.
+const DEFAULT_TOTAL_TIMEOUT_MS: u64 = 30_000;
+/// Idle READ timeout: the longest the body may go without a single byte before the request is
+/// failed. This is what bounds a `{ timeout: 0 }` stream (an SSE chat completion that legitimately
+/// runs for minutes). Override with `TISH_FETCH_READ_TIMEOUT_MS`.
+const DEFAULT_READ_TIMEOUT_MS: u64 = 120_000;
+
+/// Pure env parse for a millisecond timeout knob: a valid non-negative integer, else the default.
+fn parse_timeout_ms(env: Option<String>, default: u64) -> u64 {
+    env.and_then(|v| v.trim().parse::<u64>().ok()).unwrap_or(default)
+}
+
+fn default_total_timeout_ms() -> u64 {
+    use std::sync::OnceLock;
+    static MS: OnceLock<u64> = OnceLock::new();
+    *MS.get_or_init(|| {
+        parse_timeout_ms(
+            std::env::var("TISH_FETCH_TIMEOUT_MS").ok(),
+            DEFAULT_TOTAL_TIMEOUT_MS,
+        )
+    })
+}
+
+/// Shared, hardened outbound HTTP client: connect + idle-read timeouts (a no-timeout fetch is
 /// an outbound resource-pinning / slowloris vector) and a bounded redirect chain. Cached so
 /// the connection pool is reused across requests.
+///
+/// The TOTAL timeout is deliberately NOT set on the client: `ClientBuilder::timeout` covers the
+/// entire body, so a streaming response that ran past it died as "error decoding response body"
+/// no matter how healthily bytes were flowing (an LLM tool-call stream at 30s+ was cut every
+/// time). It is applied per request in `send_request_parts` instead, where `{ timeout: ms }` can
+/// override it and `{ timeout: 0 }` can turn it off, leaving the idle read timeout as the guard.
 /// NOTE: this does NOT yet block internal/metadata IPs — full SSRF defense (deny loopback /
 /// link-local / RFC1918 after DNS resolution) is a follow-up that needs a policy decision.
 fn fetch_client() -> &'static reqwest::Client {
     use std::sync::OnceLock;
     static CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
     CLIENT.get_or_init(|| {
-        reqwest::Client::builder()
-            .timeout(std::time::Duration::from_secs(30))
+        let read_ms = parse_timeout_ms(
+            std::env::var("TISH_FETCH_READ_TIMEOUT_MS").ok(),
+            DEFAULT_READ_TIMEOUT_MS,
+        );
+        let mut b = reqwest::Client::builder()
             .connect_timeout(std::time::Duration::from_secs(10))
-            .redirect(reqwest::redirect::Policy::limited(5))
-            .build()
-            .unwrap_or_else(|_| reqwest::Client::new())
+            .redirect(reqwest::redirect::Policy::limited(5));
+        if read_ms > 0 {
+            b = b.read_timeout(std::time::Duration::from_millis(read_ms));
+        }
+        b.build().unwrap_or_else(|_| reqwest::Client::new())
     })
 }
 
@@ -577,6 +612,7 @@ async fn send_request_parts(
     headers: Vec<(String, String)>,
     body: Option<String>,
     multipart: Option<Vec<MultipartPart>>,
+    timeout_ms: Option<u64>,
 ) -> Result<reqwest::Response, String> {
     if fetch_block_private() {
         ssrf_preflight(&url).await?;
@@ -591,6 +627,11 @@ async fn send_request_parts(
         "HEAD" => client.head(&url),
         _ => client.get(&url),
     };
+    // Total timeout: the request's own `{ timeout }` (0 = none) else the process default.
+    let total_ms = timeout_ms.unwrap_or_else(default_total_timeout_ms);
+    if total_ms > 0 {
+        req = req.timeout(std::time::Duration::from_millis(total_ms));
+    }
     for (key, value) in headers {
         req = req.header(key, value);
     }
@@ -648,10 +689,11 @@ pub fn fetch_promise_from_args(args: Vec<Value>) -> Value {
     let headers = extract_headers(args.get(1));
     let body = extract_body(args.get(1));
     let multipart = extract_multipart(args.get(1));
+    let timeout_ms = extract_timeout_ms(args.get(1));
     let (tx, rx) = tokio::sync::oneshot::channel();
-    crate::http::RUNTIME.with(|rt| {
+    crate::http::FETCH_RT.with(|rt| {
         rt.spawn(async move {
-            let r = send_request_parts(url, method, headers, body, multipart).await;
+            let r = send_request_parts(url, method, headers, body, multipart, timeout_ms).await;
             let _ = tx.send(r);
         });
     });
@@ -678,6 +720,7 @@ pub fn fetch_all_promise_from_args(args: Vec<Value>) -> Value {
         Vec<(String, String)>,
         Option<String>,
         Option<Vec<MultipartPart>>,
+        Option<u64>,
     )> = Vec::new();
     for req in requests {
         let (url, opt) = match &req {
@@ -714,14 +757,15 @@ pub fn fetch_all_promise_from_args(args: Vec<Value>) -> Value {
         let headers = extract_headers(opt.as_ref());
         let body = extract_body(opt.as_ref());
         let multipart = extract_multipart(opt.as_ref());
-        parts.push((url, method, headers, body, multipart));
+        let timeout_ms = extract_timeout_ms(opt.as_ref());
+        parts.push((url, method, headers, body, multipart, timeout_ms));
     }
     let (tx, rx) = tokio::sync::oneshot::channel();
-    crate::http::RUNTIME.with(|rt| {
+    crate::http::FETCH_RT.with(|rt| {
         rt.spawn(async move {
             let futs: Vec<_> = parts
                 .into_iter()
-                .map(|(url, m, h, b, mp)| send_request_parts(url, m, h, b, mp))
+                .map(|(url, m, h, b, mp, t)| send_request_parts(url, m, h, b, mp, t))
                 .collect();
             let results = futures::future::join_all(futs).await;
             let mapped: Vec<Result<reqwest::Response, String>> = results.into_iter().collect();
@@ -735,7 +779,36 @@ pub fn fetch_all_promise_from_args(args: Vec<Value>) -> Value {
 
 #[cfg(test)]
 mod fetch_cap_tests_383 {
-    use super::{is_blocked_ip, parse_max_body};
+    use super::{is_blocked_ip, parse_max_body, parse_timeout_ms, DEFAULT_READ_TIMEOUT_MS, DEFAULT_TOTAL_TIMEOUT_MS};
+
+    #[test]
+    fn timeout_env_defaults_when_unset_or_invalid() {
+        assert_eq!(parse_timeout_ms(None, DEFAULT_TOTAL_TIMEOUT_MS), 30_000);
+        assert_eq!(parse_timeout_ms(Some("nope".into()), DEFAULT_READ_TIMEOUT_MS), 120_000);
+        assert_eq!(parse_timeout_ms(Some("-5".into()), DEFAULT_TOTAL_TIMEOUT_MS), 30_000);
+    }
+
+    #[test]
+    fn timeout_env_parses_including_zero_meaning_off() {
+        assert_eq!(parse_timeout_ms(Some(" 45000 ".into()), DEFAULT_TOTAL_TIMEOUT_MS), 45_000);
+        assert_eq!(parse_timeout_ms(Some("0".into()), DEFAULT_TOTAL_TIMEOUT_MS), 0);
+    }
+
+    #[test]
+    fn per_request_timeout_option_extraction() {
+        use crate::http::extract_timeout_ms;
+        use tishlang_core::{ObjectMap, Value};
+        let mut m = ObjectMap::default();
+        m.insert(std::sync::Arc::from("timeout"), Value::Number(0.0));
+        assert_eq!(extract_timeout_ms(Some(&Value::object(m))), Some(0));
+        let mut m2 = ObjectMap::default();
+        m2.insert(std::sync::Arc::from("timeout"), Value::Number(90_000.0));
+        assert_eq!(extract_timeout_ms(Some(&Value::object(m2))), Some(90_000));
+        let mut m3 = ObjectMap::default();
+        m3.insert(std::sync::Arc::from("timeout"), Value::String("soon".into()));
+        assert_eq!(extract_timeout_ms(Some(&Value::object(m3))), None);
+        assert_eq!(extract_timeout_ms(None), None);
+    }
     use std::net::IpAddr;
 
     #[test]

package/crates/tish_runtime/src/lib.rs

@@ -1828,6 +1828,27 @@ pub mod zip;
 #[cfg(feature = "zip")]
 pub use zip::{zip_entries, zip_extract};
 
+/// `tish:ffi` `loadModule(path)`: load a tish FFI cdylib (ABI v2, falling back to v1) and return
+/// its exports as an object. Loading the same path again returns the cached module. Throws a
+/// `TypeError` if the path is not a string or the library cannot be loaded.
+#[cfg(all(feature = "ffi", not(target_arch = "wasm32")))]
+pub fn ffi_load_module(args: &[Value]) -> Value {
+    let path = match args.first() {
+        Some(Value::String(s)) => s.to_string(),
+        _ => {
+            set_pending_throw(tishlang_core::type_error("loadModule: expected a library path string"));
+            return Value::Null;
+        }
+    };
+    match tishlang_ffi::load_module(&path) {
+        Ok(exports) => Value::object(exports),
+        Err(e) => {
+            set_pending_throw(tishlang_core::type_error(format!("loadModule: {e}")));
+            Value::Null
+        }
+    }
+}
+
 #[cfg(feature = "ws")]
 pub use ws::{
     web_socket_client, web_socket_server_accept, web_socket_server_construct,

package/crates/tish_vm/Cargo.toml

@@ -32,6 +32,8 @@ http = ["dep:tishlang_runtime", "tishlang_runtime/http", "send-values", "timers"
 # Promise + `tish:http.await` / `Promise` export without the full HTTP client stack (e.g. wasm32-wasip1).
 promise = ["dep:tishlang_runtime", "tishlang_runtime/promise", "send-values"]
 ws = ["dep:tishlang_runtime", "tishlang_runtime/ws"]
+# `tish:ffi` loadModule: runtime loading of tish FFI cdylibs.
+ffi = ["dep:tishlang_runtime", "tishlang_runtime/ffi"]
 
 [dependencies]
 tishlang_ast = { path = "../tish_ast", version = ">=0.1" }

package/crates/tish_vm/src/vm.rs

@@ -134,7 +134,9 @@ fn value_object_from_map(m: ObjectMap) -> Value {
     feature = "promise",
     feature = "timers",
     feature = "process",
-    feature = "ws"
+    feature = "ws",
+    feature = "tty",
+    feature = "ffi"
 ))]
 #[inline]
 fn cap_allows(enabled: &HashSet<String>, name: &str) -> bool {
@@ -161,6 +163,8 @@ pub fn all_compiled_capabilities() -> HashSet<String> {
     s.insert("ws".to_string());
     #[cfg(feature = "tty")]
     s.insert("tty".to_string());
+    #[cfg(feature = "ffi")]
+    s.insert("ffi".to_string());
     s
 }
 
@@ -173,7 +177,8 @@ pub fn all_compiled_capabilities() -> HashSet<String> {
         feature = "timers",
         feature = "process",
         feature = "ws",
-        feature = "tty"
+        feature = "tty",
+        feature = "ffi"
     )),
     allow(unused_variables)
 )]
@@ -455,6 +460,15 @@ fn get_builtin_export(enabled: &HashSet<String>, spec: &str, export_name: &str)
             _ => None,
         };
     }
+    #[cfg(feature = "ffi")]
+    if spec == "tish:ffi" && cap_allows(enabled, "ffi") {
+        return match export_name {
+            "loadModule" => Some(Value::native(|args: &[Value]| {
+                tishlang_runtime::ffi_load_module(args)
+            })),
+            _ => None,
+        };
+    }
     None
 }
 
@@ -1169,6 +1183,13 @@ pub struct Vm {
     /// [`register_native_module`]). Phase-2 item 11: unblocks `cargo:`
     /// imports on the cranelift and llvm backends which run this VM.
     native_modules: VmRef<HashMap<String, VmRef<ObjectMap>>>,
+    /// Numeric JIT + OSR for code this VM runs (default on). The JIT's code caches and callee
+    /// registry are process-global and the registry is keyed by bare global name, so two VMs in one
+    /// process that both JIT can resolve each other's same-named functions. An embedder hosting
+    /// mutually untrusted programs turns this off ([`Vm::set_jit_enabled`]): such a VM never
+    /// compiles, never OSRs (so every loop polls the execution deadline), and never touches the
+    /// shared registry. Inherited by every closure the VM creates.
+    jit: bool,
 }
 
 /// A bytecode-VM closure: a compiled chunk plus its captured lexical chain and shared VM state.
@@ -1584,6 +1605,8 @@ struct VmClosure {
     globals: VmRef<ObjectMap>,
     capabilities: Arc<HashSet<String>>,
     native_modules: VmRef<HashMap<String, VmRef<ObjectMap>>>,
+    /// The creating VM's [`Vm::jit`] setting, carried into every `Vm` built to run this closure.
+    jit: bool,
 }
 
 impl tishlang_core::Callable for VmClosure {
@@ -1681,6 +1704,11 @@ impl tishlang_core::Callable for VmClosure {
         // than overflowing the native stack (this recursive re-entry is the DEFAULT `tish run` path).
         // The counter is thread-local because each closure call builds a fresh `Vm`; the parked throw
         // is picked up by the caller's `take_pending_throw()` check (Call/SelfCall post-call).
+        // Loop-free recursion (e.g. naive `fib`) never reaches a back-edge, so calls poll too.
+        if tishlang_core::execution_deadline_exceeded() {
+            set_pending_throw(construct_builtin::error_object("Error", tishlang_core::DEADLINE_ERROR));
+            return Value::Null;
+        }
         let depth = tishlang_core::inc_call_depth();
         if depth > max_call_depth() {
             tishlang_core::dec_call_depth();
@@ -1694,6 +1722,7 @@ impl tishlang_core::Callable for VmClosure {
             globals: self.globals.clone(),
             capabilities: Arc::clone(&self.capabilities),
             native_modules: self.native_modules.clone(),
+            jit: self.jit,
         };
         #[cfg(not(target_arch = "wasm32"))]
         let run = stacker::maybe_grow(128 * 1024, 2 * 1024 * 1024, || {
@@ -1742,9 +1771,21 @@ impl Vm {
             globals: VmRef::new(init_globals(capabilities.as_ref())),
             capabilities,
             native_modules: VmRef::new(HashMap::new()),
+            jit: true,
         }
     }
 
+    /// Turn the numeric JIT and OSR on or off for this VM and every closure it creates from now on
+    /// (see [`Vm::jit`]). Set before [`Vm::run`]. Off isolates a VM from other VMs' JIT state in the
+    /// same process and guarantees every loop polls the execution deadline; it never changes results.
+    pub fn set_jit_enabled(&mut self, on: bool) {
+        self.jit = on;
+    }
+
+    pub fn jit_enabled(&self) -> bool {
+        self.jit
+    }
+
     /// Register an externally-supplied native module under a `cargo:`-style
     /// spec (e.g. `"cargo:tish_pg"`). The `exports` map is what
     /// `LoadNativeExport` will index into when user code imports from this
@@ -1811,8 +1852,11 @@ impl Vm {
         // here (the outermost entry — closures run via `run_chunk`, not this) so a long-lived process
         // (REPL / embedder) running a NEW program never resolves a stale callee registered by a prior
         // one. A cross-caller and its callee always compile within the same run, so this is sufficient.
+        // A JIT-off VM registers no callees, so it must not clear other VMs' registrations either.
         #[cfg(not(target_arch = "wasm32"))]
-        crate::jit::reset_callees();
+        if self.jit {
+            crate::jit::reset_callees();
+        }
         let result = self.run_chunk(chunk, &chunk.nested, &[], repl_mode);
         // A throw that escaped every `catch` reaches here as the pending-throw sentinel; turn the
         // parked value into the conventional uncaught-error message (issue #60).
@@ -2188,7 +2232,7 @@ impl Vm {
                     // `region_end - dist`. Once a loop is hot, try to run its remaining iterations in
                     // native code (numeric slot loops only; anything else falls straight through).
                     #[cfg(not(target_arch = "wasm32"))]
-                    if Self::osr_enabled() {
+                    if self.jit && Self::osr_enabled() {
                         let region_end = ip;
                         let header_ip = ip.saturating_sub(dist);
                         let key = (Arc::as_ptr(&cur) as usize, header_ip);
@@ -2237,6 +2281,9 @@ impl Vm {
                         set_pending_throw(stack_overflow_error());
                         return Some(Err(PENDING_THROW_SENTINEL.to_string()));
                     }
+                    if tishlang_core::execution_deadline_exceeded() {
+                        return Some(Err(tishlang_core::DEADLINE_ERROR.to_string()));
+                    }
                     frames.push((cur.clone(), ip, slot_base, stack_base, enclosing.clone()));
                     let new_base = slots.len();
                     slots.resize(new_base + cur.num_slots as usize, Value::Null);
@@ -2276,6 +2323,9 @@ impl Vm {
                                     set_pending_throw(stack_overflow_error());
                                     return Some(Err(PENDING_THROW_SENTINEL.to_string()));
                                 }
+                                if tishlang_core::execution_deadline_exceeded() {
+                                    return Some(Err(tishlang_core::DEADLINE_ERROR.to_string()));
+                                }
                                 frames.push((cur, ip, slot_base, stack_base, enclosing));
                                 cur = next_chunk;
                                 enclosing = next_enc;
@@ -2617,7 +2667,7 @@ impl Vm {
                             // and call native code when all args are numbers; else fall back to
                             // the interpreter below. Purely additive — can't change behaviour.
                             #[cfg(not(target_arch = "wasm32"))]
-                            let jit_fn = crate::jit::try_compile_numeric(inner);
+                            let jit_fn = if self.jit { crate::jit::try_compile_numeric(inner) } else { None };
                             let inner_clone = inner.clone();
                             let globals = self.globals.clone();
                             // The closure captures its defining frame's scope PLUS that frame's own
@@ -2674,6 +2724,7 @@ impl Vm {
                                 globals,
                                 capabilities,
                                 native_modules,
+                                jit: self.jit,
                             };
                             #[cfg(feature = "send-values")]
                             {
@@ -2957,6 +3008,9 @@ impl Vm {
                     // #381: SelfCall is a second native recursive re-entry (a self-recursive function
                     // re-enters run_chunk directly). Bound it with the same shared counter; `raise!` is
                     // in scope here, so throw the catchable RangeError directly.
+                    if tishlang_core::execution_deadline_exceeded() {
+                        return Err(tishlang_core::DEADLINE_ERROR.to_string());
+                    }
                     let depth = tishlang_core::inc_call_depth();
                     if depth > max_call_depth() {
                         tishlang_core::dec_call_depth();
@@ -2969,6 +3023,7 @@ impl Vm {
                         globals: self.globals.clone(),
                         capabilities: Arc::clone(&self.capabilities),
                         native_modules: self.native_modules.clone(),
+                        jit: self.jit,
                     };
                     #[cfg(not(target_arch = "wasm32"))]
                     let result = stacker::maybe_grow(128 * 1024, 2 * 1024 * 1024, || {
@@ -3109,7 +3164,7 @@ impl Vm {
                     // only (`slot_locals` is the live frame); non-slot / non-numeric loops fail the
                     // whitelist or the live-in check and fall straight through to the interpreter.
                     #[cfg(not(target_arch = "wasm32"))]
-                    if chunk.slot_based && Self::osr_enabled() {
+                    if self.jit && chunk.slot_based && Self::osr_enabled() {
                         let region_end = ip;
                         let header_ip = ip.saturating_sub(dist);
                         // Count on the RAW header via the single-entry fast slot — byte-identical to the

package/crates/tish_vm/tests/ffi_load_module.rs

@@ -0,0 +1,32 @@
+//! `tish:ffi` `loadModule` on the bytecode VM. Loading real modules is covered by
+//! `crates/tish_ffi/tests/loader_v2.rs`; this pins the builtin wiring and its error contract.
+#![cfg(feature = "ffi")]
+
+use tishlang_bytecode::compile;
+use tishlang_vm::run;
+
+fn run_src(src: &str) {
+    let cwd = std::env::current_dir().expect("cwd");
+    let modules = tishlang_compile::resolve_project_from_stdin(src, &cwd).expect("resolve");
+    let program = tishlang_compile::merge_modules(modules).expect("merge").program;
+    let chunk = compile(&program).expect("compile");
+    run(&chunk).expect("run");
+}
+
+#[test]
+fn load_failures_throw_catchable_type_errors() {
+    run_src(
+        r#"
+import { loadModule } from "tish:ffi"
+if (typeof loadModule !== "function") { throw "loadModule is not wired" }
+
+let missing = ""
+try { loadModule("/nonexistent/nimble-test.lib") } catch (e) { missing = e.name + " " + e.message }
+if (missing.indexOf("TypeError loadModule:") !== 0) { throw "missing library: " + missing }
+
+let badArg = ""
+try { loadModule(42) } catch (e) { badArg = e.name }
+if (badArg !== "TypeError") { throw "non-string path: " + badArg }
+"#,
+    );
+}