@tishlang/tish-lsp 2.35.0 → 2.36.2

package/crates/tish/tests/fixtures/process_capture.tish

@@ -0,0 +1,16 @@
+// Issue #475: process.execCapture / execFileCapture return { code, stdout, stderr }.
+import { execFileCapture, execCapture } from "tish:process"
+
+let ok = execFileCapture("echo", ["hi"])
+console.log("ok=" + ok.code + "," + ok.stdout.trim() + "," + (ok.stderr === ""))
+
+let bad = execFileCapture("false", [])
+console.log("bad=" + bad.code)
+
+let miss = execFileCapture("/no/such/prog/xyz", [])
+console.log("miss=" + miss.code + "," + (miss.stderr !== ""))
+
+let shell = execCapture("echo a; echo b 1>&2")
+console.log("shell=" + shell.code + "," + shell.stdout.trim() + "," + shell.stderr.trim())
+
+console.log("done")

package/crates/tish/tests/process_capture.rs

@@ -0,0 +1,40 @@
+//! Issue #475: `process.execCapture` / `execFileCapture` return `{ code, stdout, stderr }` identically
+//! on every backend (interpreter, bytecode VM, native AOT).
+
+use std::path::PathBuf;
+use std::process::Command;
+
+fn run_on(backend: &str) -> String {
+    let tish = PathBuf::from(env!("CARGO_BIN_EXE_tish"));
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("tests")
+        .join("fixtures")
+        .join("process_capture.tish");
+    let out = Command::new(&tish)
+        .args([
+            "run",
+            "--backend",
+            backend,
+            "--feature",
+            "process",
+            path.to_str().unwrap(),
+        ])
+        .output()
+        .expect("spawn tish run");
+    assert!(
+        out.status.success(),
+        "tish run --backend {backend} process_capture.tish failed: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    String::from_utf8_lossy(&out.stdout).into_owned()
+}
+
+const EXPECTED: &str = "ok=0,hi,true\nbad=1\nmiss=-1,true\nshell=0,a,b\ndone\n";
+
+#[test]
+#[cfg(unix)]
+fn exec_capture_on_every_backend() {
+    for backend in ["vm", "interp", "native"] {
+        assert_eq!(run_on(backend), EXPECTED, "exec-capture mismatch on {backend}");
+    }
+}

package/crates/tish_compile/src/codegen.rs

@@ -1690,9 +1690,11 @@ impl Codegen {
                     "cwd" => Some("Value::native(|args: &[Value]| tish_process_cwd(args))"),
                     "exec" => Some("Value::native(|args: &[Value]| tish_process_exec(args))"),
                     "execFile" => Some("Value::native(|args: &[Value]| tish_process_exec_file(args))"),
+                    "execCapture" => Some("Value::native(|args: &[Value]| tish_process_exec_capture(args))"),
+                    "execFileCapture" => Some("Value::native(|args: &[Value]| tish_process_exec_file_capture(args))"),
                     "argv" => Some("Value::Array(VmRef::new(std::env::args().map(|s| Value::String(s.into())).collect()))"),
                     "env" => Some("Value::object(std::env::vars().map(|(k,v)| (Arc::from(k.as_str()), Value::String(v.into()))).collect())"),
-                    "process" => Some("{ let mut m = ObjectMap::default(); m.insert(Arc::from(\"exit\"), Value::native(|args: &[Value]| tish_process_exit(args))); m.insert(Arc::from(\"cwd\"), Value::native(|args: &[Value]| tish_process_cwd(args))); m.insert(Arc::from(\"exec\"), Value::native(|args: &[Value]| tish_process_exec(args))); m.insert(Arc::from(\"execFile\"), Value::native(|args: &[Value]| tish_process_exec_file(args))); m.insert(Arc::from(\"argv\"), Value::Array(VmRef::new(std::env::args().map(|s| Value::String(s.into())).collect()))); m.insert(Arc::from(\"env\"), Value::object(std::env::vars().map(|(k,v)| (Arc::from(k.as_str()), Value::String(v.into()))).collect::<ObjectMap>())); Value::object(m) }"),
+                    "process" => Some("{ let mut m = ObjectMap::default(); m.insert(Arc::from(\"exit\"), Value::native(|args: &[Value]| tish_process_exit(args))); m.insert(Arc::from(\"cwd\"), Value::native(|args: &[Value]| tish_process_cwd(args))); m.insert(Arc::from(\"exec\"), Value::native(|args: &[Value]| tish_process_exec(args))); m.insert(Arc::from(\"execFile\"), Value::native(|args: &[Value]| tish_process_exec_file(args))); m.insert(Arc::from(\"execCapture\"), Value::native(|args: &[Value]| tish_process_exec_capture(args))); m.insert(Arc::from(\"execFileCapture\"), Value::native(|args: &[Value]| tish_process_exec_file_capture(args))); m.insert(Arc::from(\"argv\"), Value::Array(VmRef::new(std::env::args().map(|s| Value::String(s.into())).collect()))); m.insert(Arc::from(\"env\"), Value::object(std::env::vars().map(|(k,v)| (Arc::from(k.as_str()), Value::String(v.into()))).collect::<ObjectMap>())); Value::object(m) }"),
                     _ => None,
                 },
             "tish:ws" if self.has_feature("ws") => match export_name {
@@ -2246,7 +2248,7 @@ impl Codegen {
             self.write("use tishlang_ui::{fragment_value, install_thread_local_host, native_create_root, native_use_state, ui_h, ui_text, HeadlessHost};\n");
         }
         if self.has_feature("process") {
-            self.write("use tishlang_runtime::{process_exit as tish_process_exit, process_cwd as tish_process_cwd, process_exec as tish_process_exec, process_exec_file as tish_process_exec_file};\n");
+            self.write("use tishlang_runtime::{process_exit as tish_process_exit, process_cwd as tish_process_cwd, process_exec as tish_process_exec, process_exec_file as tish_process_exec_file, process_exec_capture as tish_process_exec_capture, process_exec_file_capture as tish_process_exec_file_capture};\n");
         }
         if self.has_feature("timers") {
             self.write("use tishlang_runtime::{timer_set_timeout as tish_timer_set_timeout, timer_clear_timeout as tish_timer_clear_timeout, timer_set_interval as tish_timer_set_interval, timer_clear_interval as tish_timer_clear_interval};\n");
@@ -2651,6 +2653,8 @@ impl Codegen {
             self.writeln("p.insert(Arc::from(\"cwd\"), Value::native(|args: &[Value]| tish_process_cwd(args)));");
             self.writeln("p.insert(Arc::from(\"exec\"), Value::native(|args: &[Value]| tish_process_exec(args)));");
             self.writeln("p.insert(Arc::from(\"execFile\"), Value::native(|args: &[Value]| tish_process_exec_file(args)));");
+            self.writeln("p.insert(Arc::from(\"execCapture\"), Value::native(|args: &[Value]| tish_process_exec_capture(args)));");
+            self.writeln("p.insert(Arc::from(\"execFileCapture\"), Value::native(|args: &[Value]| tish_process_exec_file_capture(args)));");
             self.writeln("let argv: Vec<Value> = std::env::args().map(|s| Value::String(s.into())).collect();");
             self.writeln("p.insert(Arc::from(\"argv\"), Value::Array(VmRef::new(argv)));");
             self.writeln("let mut env_obj = ObjectMap::default();");

package/crates/tish_compile/src/infer.rs

@@ -284,16 +284,45 @@ fn param_infer_program(program: Program) -> Program {
     // panic on / turn to NaN where JS keeps the value. Skip those fns (they stay fully boxed). Same
     // set `collect_native_fns` uses to refuse the M5 native form.
     let nonnumeric = crate::codegen::Codegen::fns_called_with_nonnumeric_arg(&program.statements);
+    // Soundness (#477): a fn referenced as a first-class VALUE — passed as a call ARGUMENT
+    // (`serve(port, handler)`), assigned, returned, or stored, i.e. any use that is NOT a direct
+    // `f(...)` call — escapes into the boxed `Value::Function` path and is later invoked via
+    // `.call(&[Value])` with arbitrary runtime Values (a `serve` handler is called with the request
+    // OBJECT). Such a fn's params CANNOT be soundly `: number`-shadowed: the escaping boxed closure
+    // unboxes arg0 as `match … Value::Number(n) => *n, _ => panic!("expected number")` and would panic
+    // on the first non-numeric call. `fns_called_with_nonnumeric_arg` only catches SYNTACTIC
+    // non-numeric call args — it can't see this value-escape — so exclude escaping fns explicitly.
+    // Over-approximation is safe: an escaping fn just stays fully boxed (correct, at worst slower).
+    let escaping = escaping_fn_names(&program.statements);
     Program {
         statements: program
             .statements
             .into_iter()
-            .map(|s| pi_stmt(s, &nonnumeric))
+            .map(|s| pi_stmt(s, &nonnumeric, &escaping))
             .collect(),
     }
 }
 
-fn pi_stmt(s: Statement, nonnumeric: &HashSet<String>) -> Statement {
+/// Names of fns referenced as a first-class VALUE anywhere in the program — any use of the name that
+/// is NOT a direct `f(...)` call (a bare-ident call argument like `serve(port, handler)`, an
+/// assignment, a return, storage in an object/array). Such a fn is reachable via the boxed
+/// `Value::Function` `.call(&[Value])` path with arbitrary runtime Values, so its params must stay
+/// boxed and are never `: number`-shadowed. Backed by the same `fn_name_uses` escape counter the
+/// inliner uses. See `param_infer_program`. (#477)
+fn escaping_fn_names(statements: &[Statement]) -> HashSet<String> {
+    let mut out = HashSet::new();
+    for s in statements {
+        if let Statement::FunDecl { name, .. } = s {
+            let (_, others) = fn_name_uses(statements, name.as_ref());
+            if others > 0 {
+                out.insert(name.to_string());
+            }
+        }
+    }
+    out
+}
+
+fn pi_stmt(s: Statement, nonnumeric: &HashSet<String>, escaping: &HashSet<String>) -> Statement {
     if let Statement::FunDecl {
         async_,
         name,
@@ -305,8 +334,10 @@ fn pi_stmt(s: Statement, nonnumeric: &HashSet<String>) -> Statement {
         span,
     } = s
     {
-        // A fn reached with a non-numeric arg somewhere: leave its params dynamic (boxed).
-        if nonnumeric.contains(name.as_ref()) {
+        // A fn reached with a non-numeric arg somewhere, OR escaping as a first-class value
+        // (#477 — a `serve` handler / stored callback invoked via the boxed path with arbitrary
+        // Values): leave its params dynamic (boxed).
+        if nonnumeric.contains(name.as_ref()) || escaping.contains(name.as_ref()) {
             return Statement::FunDecl {
                 async_,
                 name,
@@ -3680,6 +3711,12 @@ pub fn analyze_aggregate(program: &Program) -> AggregateAnalysis {
     // would otherwise emit a `match … panic!("expected number")` coercion on the String. Same set the
     // M4 `param_infer` path uses (infer.rs:273).
     let nonnumeric = crate::codegen::Codegen::fns_called_with_nonnumeric_arg(&program.statements);
+    // Soundness (#477): a fn referenced as a first-class VALUE (a `serve` handler / stored callback)
+    // is invoked via the boxed `Value::Function` path with arbitrary runtime Values, so — exactly as
+    // in `param_infer_program` — its params must NOT get an S-0 `: number` shadow either. Without this
+    // an UNUSED param (vacuously "numeric" under `pus_stmt`) would be stamped `: number` and the
+    // escaping boxed closure would `panic!("expected number")` on the request object.
+    let escaping = escaping_fn_names(&program.statements);
 
     // ---- S-0 + S-A: per top-level function, find numeric params and a return shape.
     for s in &program.statements {
@@ -3731,7 +3768,10 @@ pub fn analyze_aggregate(program: &Program) -> AggregateAnalysis {
                     }
                 }
             }
-            if !numeric_params.is_empty() && !nonnumeric.contains(name.as_ref()) {
+            if !numeric_params.is_empty()
+                && !nonnumeric.contains(name.as_ref())
+                && !escaping.contains(name.as_ref())
+            {
                 analysis.fn_numeric_params.insert(name.to_string(), numeric_params);
             }
             // S-A: a single all-f64 object-literal return shape ⇒ a struct alias.
@@ -4677,6 +4717,54 @@ mod param_infer_tests {
         let src = "fn g(x) { let r = x; return r + \"!\" }";
         assert_eq!(inferred_param(src, "g", "x"), None);
     }
+
+    /// Final annotation name (if any) for `fn <fn_name>`'s `<param>` after the FULL pipeline
+    /// (`infer_program`: M4 `param_infer` + local/struct + S-0 aggregate).
+    fn end_to_end_param_ann(src: &str, fn_name: &str, param: &str) -> Option<String> {
+        let prog = infer_program(&parse(src).unwrap());
+        for s in &prog.statements {
+            if let Statement::FunDecl { name, params, .. } = s {
+                if name.as_ref() == fn_name {
+                    for p in params {
+                        if let FunParam::Simple(tp) = p {
+                            if tp.name.as_ref() == param {
+                                return tp.type_ann.as_ref().map(|a| match a {
+                                    TypeAnnotation::Simple(s, _) => s.to_string(),
+                                    _ => "<complex>".to_string(),
+                                });
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        None
+    }
+
+    #[test]
+    fn escaping_value_fn_param_stays_boxed_477() {
+        // #477: `handler` is passed as a call ARGUMENT (escapes as a first-class value, exactly like a
+        // `serve` handler). Its `req` param is UNUSED and the body is all-numeric — so BOTH the M4
+        // `param_infer` and the S-0 aggregate paths would otherwise stamp it `: number`. Because the
+        // fn is invoked via the boxed `Value::Function` path with arbitrary runtime Values, `req` MUST
+        // stay dynamic across the WHOLE pipeline (else the boxed closure panics "expected number" on
+        // the request object). Locks both promotion sites.
+        let src = "fn handler(req) { let s = 200; return s } \
+                   fn callWith(f, a) { return f(a) } \
+                   console.log(callWith(handler, { method: \"GET\" }))";
+        assert_eq!(end_to_end_param_ann(src, "handler", "req"), None);
+    }
+
+    #[test]
+    fn non_escaping_numeric_fn_keeps_native_fast_path_477() {
+        // CONTROL (no over-broad regression): a fn only ever called DIRECTLY with numbers still gets
+        // its `: number` native fast path — the #477 fix narrows promotion to escaping fns only.
+        let src = "fn square(n) { return n * n } console.log(square(7))";
+        assert_eq!(
+            end_to_end_param_ann(src, "square", "n").as_deref(),
+            Some("number")
+        );
+    }
 }
 
 #[cfg(test)]

package/crates/tish_eval/src/eval.rs

@@ -320,6 +320,8 @@ impl Evaluator {
                 process_obj.insert("cwd".into(), Value::Native(natives::process_cwd));
                 process_obj.insert("exec".into(), Value::Native(natives::process_exec));
                 process_obj.insert("execFile".into(), Value::Native(natives::process_exec_file));
+                process_obj.insert("execCapture".into(), Value::Native(natives::process_exec_capture));
+                process_obj.insert("execFileCapture".into(), Value::Native(natives::process_exec_file_capture));
                 let argv: Vec<Value> = tishlang_core::process_argv()
                     .into_iter()
                     .map(|s| Value::String(s.into()))
@@ -1412,6 +1414,8 @@ impl Evaluator {
                     exports.insert("cwd".into(), Value::Native(natives::process_cwd));
                     exports.insert("exec".into(), Value::Native(natives::process_exec));
                     exports.insert("execFile".into(), Value::Native(natives::process_exec_file));
+                    exports.insert("execCapture".into(), Value::Native(natives::process_exec_capture));
+                    exports.insert("execFileCapture".into(), Value::Native(natives::process_exec_file_capture));
                     let argv: Vec<Value> = tishlang_core::process_argv()
                         .into_iter()
                         .map(|s| Value::String(s.into()))
@@ -1432,6 +1436,8 @@ impl Evaluator {
                     process_obj.insert("cwd".into(), Value::Native(natives::process_cwd));
                     process_obj.insert("exec".into(), Value::Native(natives::process_exec));
                     process_obj.insert("execFile".into(), Value::Native(natives::process_exec_file));
+                    process_obj.insert("execCapture".into(), Value::Native(natives::process_exec_capture));
+                    process_obj.insert("execFileCapture".into(), Value::Native(natives::process_exec_file_capture));
                     process_obj.insert("argv".into(), Value::Array(Rc::new(RefCell::new(argv))));
                     process_obj.insert("env".into(), Value::object(env_obj));
                     exports.insert(

package/crates/tish_eval/src/natives.rs

@@ -523,6 +523,60 @@ pub fn process_exec_file(args: &[Value]) -> Result<Value, String> {
     Ok(Value::Number(output.status.code().unwrap_or(1) as f64))
 }
 
+/// `{ code, stdout, stderr }` capture object (#475) — lossy-UTF-8 streams (fs convention). Insertion
+/// order (code, stdout, stderr) matches the vm/native builders so JSON.stringify agrees cross-backend.
+#[cfg(feature = "process")]
+fn process_capture_obj(code: i32, stdout: String, stderr: String) -> Value {
+    let mut m = crate::value::PropMap::default();
+    m.insert("code".into(), Value::Number(code as f64));
+    m.insert("stdout".into(), Value::String(stdout.into()));
+    m.insert("stderr".into(), Value::String(stderr.into()));
+    Value::object(m)
+}
+
+#[cfg(feature = "process")]
+fn process_capture_result(out: std::io::Result<std::process::Output>) -> Value {
+    match out {
+        Ok(o) => process_capture_obj(
+            o.status.code().unwrap_or(-1),
+            String::from_utf8_lossy(&o.stdout).into_owned(),
+            String::from_utf8_lossy(&o.stderr).into_owned(),
+        ),
+        Err(e) => process_capture_obj(-1, String::new(), e.to_string()),
+    }
+}
+
+/// `process.execCapture(cmd)` — `sh -c cmd`, capturing `{ code, stdout, stderr }` (#475).
+#[cfg(feature = "process")]
+pub fn process_exec_capture(args: &[Value]) -> Result<Value, String> {
+    use std::process::Command;
+    let cmd = args.first().map(|v| v.to_string()).unwrap_or_default();
+    if cmd.is_empty() {
+        return Ok(process_capture_obj(0, String::new(), String::new()));
+    }
+    Ok(process_capture_result(
+        Command::new("sh").arg("-c").arg(&cmd).output(),
+    ))
+}
+
+/// `process.execFileCapture(program, [args])` — no-shell run with output capture (safe for untrusted
+/// args, #384/#475). Returns `{ code, stdout, stderr }`.
+#[cfg(feature = "process")]
+pub fn process_exec_file_capture(args: &[Value]) -> Result<Value, String> {
+    use std::process::Command;
+    let program = args.first().map(|v| v.to_string()).unwrap_or_default();
+    if program.is_empty() {
+        return Ok(process_capture_obj(0, String::new(), String::new()));
+    }
+    let argv: Vec<String> = match args.get(1) {
+        Some(Value::Array(a)) => a.borrow().iter().map(|v| v.to_string()).collect(),
+        _ => Vec::new(),
+    };
+    Ok(process_capture_result(
+        Command::new(&program).args(&argv).output(),
+    ))
+}
+
 #[cfg(feature = "fs")]
 pub fn read_file(args: &[Value]) -> Result<Value, String> {
     let path = args.first().map(|v| v.to_string()).unwrap_or_default();

package/crates/tish_lsp/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tishlang_lsp"
-version = "2.35.0"
+version = "2.36.2"
 edition = "2021"
 description = "Language Server Protocol implementation for Tish"
 license-file = { workspace = true }

package/crates/tish_runtime/src/lib.rs

@@ -1049,9 +1049,75 @@ pub fn process_exec_file(args: &[Value]) -> Value {
     }
 }
 
+/// Build the `{ code: number, stdout: string, stderr: string }` capture object (#475). stdout/stderr
+/// are lossy-UTF-8 decoded, matching the `fs` string convention (invalid bytes → replacement chars,
+/// never dropped output).
+#[cfg(feature = "process")]
+fn process_capture_obj(code: i32, stdout: String, stderr: String) -> Value {
+    let mut m = tishlang_core::ObjectMap::default();
+    m.insert("code".into(), Value::Number(code as f64));
+    m.insert("stdout".into(), Value::String(stdout.into()));
+    m.insert("stderr".into(), Value::String(stderr.into()));
+    Value::object(m)
+}
+
+/// Build the capture object from a `Command::output()` result. `code` is the exit status, or `-1`
+/// when the process was killed by a signal or failed to spawn (spawn failure puts the OS error in
+/// `stderr`).
+#[cfg(feature = "process")]
+fn process_capture_result(out: std::io::Result<std::process::Output>) -> Value {
+    match out {
+        Ok(o) => process_capture_obj(
+            o.status.code().unwrap_or(-1),
+            String::from_utf8_lossy(&o.stdout).into_owned(),
+            String::from_utf8_lossy(&o.stderr).into_owned(),
+        ),
+        Err(e) => process_capture_obj(-1, String::new(), e.to_string()),
+    }
+}
+
+/// `process.execCapture(cmd)` — run `sh -c cmd` and CAPTURE its output as
+/// `{ code: number, stdout: string, stderr: string }` (Rust `Command::output`; Node
+/// `execSync`/`spawnSync({ encoding })`). Use `execFileCapture` for untrusted arguments — this shell
+/// form interprets metacharacters.
+#[cfg(feature = "process")]
+pub fn process_exec_capture(args: &[Value]) -> Value {
+    use std::process::Command;
+    let cmd = args
+        .first()
+        .map(|v| v.to_display_string())
+        .unwrap_or_default();
+    if cmd.is_empty() {
+        return process_capture_obj(0, String::new(), String::new());
+    }
+    process_capture_result(Command::new("sh").arg("-c").arg(&cmd).output())
+}
+
+/// `process.execFileCapture(program, [args])` — run a program directly, WITHOUT a shell, capturing
+/// output as `{ code, stdout, stderr }`. Arguments are passed verbatim, so shell metacharacters in
+/// untrusted data are never interpreted — the safe capturing counterpart for input-derived args
+/// (#384, #475). This is the primitive for shelling out to a CLI and reading its output (e.g.
+/// `git status --porcelain`).
+#[cfg(feature = "process")]
+pub fn process_exec_file_capture(args: &[Value]) -> Value {
+    use std::process::Command;
+    let program = args
+        .first()
+        .map(|v| v.to_display_string())
+        .unwrap_or_default();
+    if program.is_empty() {
+        return process_capture_obj(0, String::new(), String::new());
+    }
+    let argv: Vec<String> = match args.get(1) {
+        Some(Value::Array(a)) => a.borrow().iter().map(|v| v.to_display_string()).collect(),
+        _ => Vec::new(),
+    };
+    process_capture_result(Command::new(&program).args(&argv).output())
+}
+
 #[cfg(all(test, feature = "process", unix))]
 mod execfile_tests_384 {
-    use super::process_exec_file;
+    use super::{process_exec_file, process_exec_file_capture};
     use tishlang_core::{Value, VmRef};
 
     #[test]
@@ -1065,6 +1131,47 @@ mod execfile_tests_384 {
         // empty program is a no-op returning 0, matching `exec`.
         assert!(matches!(process_exec_file(&[]), Value::Number(n) if n == 0.0));
     }
+
+    // #475: `{ code, stdout, stderr }` capture.
+    fn fields(v: &Value) -> (f64, String, String) {
+        let Value::Object(o) = v else {
+            panic!("execFileCapture must return an object, got {v:?}")
+        };
+        let b = o.borrow();
+        let num = |k: &str| match b.strings.get(k) {
+            Some(Value::Number(n)) => *n,
+            _ => f64::NAN,
+        };
+        let string = |k: &str| match b.strings.get(k) {
+            Some(Value::String(s)) => s.to_string(),
+            _ => String::new(),
+        };
+        (num("code"), string("stdout"), string("stderr"))
+    }
+
+    #[test]
+    fn execfile_capture_returns_code_stdout_stderr() {
+        // Success: stdout captured, code 0, stderr empty.
+        let args = Value::Array(VmRef::new(vec![Value::String("captured".into())]));
+        let (code, out, err) =
+            fields(&process_exec_file_capture(&[Value::String("echo".into()), args]));
+        assert_eq!(code, 0.0);
+        assert_eq!(out.trim(), "captured");
+        assert_eq!(err, "");
+        // Non-zero exit is reported, not an error.
+        let (code, _, _) = fields(&process_exec_file_capture(&[Value::String("false".into())]));
+        assert_eq!(code, 1.0);
+        // Spawn failure → code -1 with the OS error in stderr (never panics).
+        let (code, out, err) =
+            fields(&process_exec_file_capture(&[Value::String("/no/such/prog/xyz".into())]));
+        assert_eq!(code, -1.0);
+        assert!(out.is_empty());
+        assert!(!err.is_empty());
+        // Empty program → 0 / empty (mirrors execFile).
+        let (code, out, err) = fields(&process_exec_file_capture(&[]));
+        assert_eq!(code, 0.0);
+        assert!(out.is_empty() && err.is_empty());
+    }
 }
 
 #[cfg(feature = "fs")]

package/crates/tish_vm/src/vm.rs

@@ -337,6 +337,12 @@ fn get_builtin_export(enabled: &HashSet<String>, spec: &str, export_name: &str)
             "execFile" => Some(Value::native(|args: &[Value]| {
                 tishlang_runtime::process_exec_file(args)
             })),
+            "execCapture" => Some(Value::native(|args: &[Value]| {
+                tishlang_runtime::process_exec_capture(args)
+            })),
+            "execFileCapture" => Some(Value::native(|args: &[Value]| {
+                tishlang_runtime::process_exec_file_capture(args)
+            })),
             "argv" => Some(Value::Array(VmRef::new(
                 tishlang_core::process_argv()
                     .into_iter()
@@ -366,6 +372,16 @@ fn get_builtin_export(enabled: &HashSet<String>, spec: &str, export_name: &str)
                     "execFile".into(),
                     Value::native(|args: &[Value]| tishlang_runtime::process_exec_file(args)),
                 );
+                m.insert(
+                    "execCapture".into(),
+                    Value::native(|args: &[Value]| tishlang_runtime::process_exec_capture(args)),
+                );
+                m.insert(
+                    "execFileCapture".into(),
+                    Value::native(|args: &[Value]| {
+                        tishlang_runtime::process_exec_file_capture(args)
+                    }),
+                );
                 m.insert(
                     "argv".into(),
                     Value::Array(VmRef::new(
@@ -959,6 +975,14 @@ fn init_globals(enabled: &HashSet<String>) -> ObjectMap {
             "execFile".into(),
             Value::native(|args: &[Value]| tishlang_runtime::process_exec_file(args)),
         );
+        process_obj.insert(
+            "execCapture".into(),
+            Value::native(|args: &[Value]| tishlang_runtime::process_exec_capture(args)),
+        );
+        process_obj.insert(
+            "execFileCapture".into(),
+            Value::native(|args: &[Value]| tishlang_runtime::process_exec_file_capture(args)),
+        );
         process_obj.insert(
             "argv".into(),
             Value::Array(VmRef::new(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tishlang/tish-lsp",
-  "version": "2.35.0",
+  "version": "2.36.2",
   "description": "Tish language server — diagnostics, completion, formatting, hover, go-to-definition (LSP over stdio)",
   "license": "PIF",
   "repository": {