@tishlang/tish 1.13.1 → 2.0.0

package/crates/tish_pg/src/lib.rs

@@ -203,13 +203,13 @@ fn row_to_value_direct(row: &Row) -> tishlang_runtime::Value {
                 .try_get::<_, Option<&str>>(i)
                 .ok()
                 .flatten()
-                .map(|s| RtValue::String(StdArcInner::from(s)))
+                .map(|s| RtValue::String(tishlang_runtime::ArcStr::from(s)))
                 .unwrap_or(RtValue::Null),
             _ => {
                 // Anything else goes through the JSON path for backwards
                 // compat. Hot TFB rows never hit this branch.
                 if let Ok(s) = row.try_get::<_, Option<String>>(i) {
-                    s.map(|s| RtValue::String(StdArcInner::from(s.as_str())))
+                    s.map(|s| RtValue::String(tishlang_runtime::ArcStr::from(s.as_str())))
                         .unwrap_or(RtValue::Null)
                 } else {
                     RtValue::Null
@@ -853,7 +853,7 @@ mod tish_sync {
             return tish_err("migrate: unknown client handle");
         };
 
-        let dir = std::path::PathBuf::from(dir.as_ref());
+        let dir = std::path::PathBuf::from(dir.as_str());
         let entries = match std::fs::read_dir(&dir) {
             Ok(e) => e,
             Err(e) => return tish_err(format!("migrate: read_dir({:?}): {e}", dir)),

package/crates/tish_resolve/src/lib.rs

@@ -151,6 +151,11 @@ fn collect_stmt(
                 collect_stmt(s, source, lsp_line, lsp_char, best);
             }
         }
+        Statement::Multi { statements, .. } => {
+            for s in statements {
+                collect_stmt(s, source, lsp_line, lsp_char, best);
+            }
+        }
         Statement::FunDecl {
             name,
             name_span,
@@ -306,18 +311,16 @@ fn collect_destruct_pattern(
 ) {
     match p {
         DestructPattern::Array(elements) => {
-            for el in elements {
-                if let Some(el) = el {
-                    match el {
-                        DestructElement::Ident(n, sp) => {
-                            consider(source, lsp_line, lsp_char, sp, n.clone(), best);
-                        }
-                        DestructElement::Pattern(inner) => {
-                            collect_destruct_pattern(inner, source, lsp_line, lsp_char, best);
-                        }
-                        DestructElement::Rest(n, sp) => {
-                            consider(source, lsp_line, lsp_char, sp, n.clone(), best);
-                        }
+            for el in elements.iter().flatten() {
+                match el {
+                    DestructElement::Ident(n, sp) => {
+                        consider(source, lsp_line, lsp_char, sp, n.clone(), best);
+                    }
+                    DestructElement::Pattern(inner) => {
+                        collect_destruct_pattern(inner, source, lsp_line, lsp_char, best);
+                    }
+                    DestructElement::Rest(n, sp) => {
+                        consider(source, lsp_line, lsp_char, sp, n.clone(), best);
                     }
                 }
             }
@@ -484,11 +487,8 @@ fn collect_expr(
         } => {
             for p in props {
                 match p {
-                    tishlang_ast::JsxProp::Attr { value, .. } => match value {
-                        tishlang_ast::JsxAttrValue::Expr(e) => {
-                            collect_expr(e, source, lsp_line, lsp_char, best)
-                        }
-                        _ => {}
+                    tishlang_ast::JsxProp::Attr { value, .. } => if let tishlang_ast::JsxAttrValue::Expr(e) = value {
+                        collect_expr(e, source, lsp_line, lsp_char, best)
                     },
                     tishlang_ast::JsxProp::Spread(e) => {
                         collect_expr(e, source, lsp_line, lsp_char, best)
@@ -784,6 +784,7 @@ fn member_chain_collect_fun_param(
     }
 }
 
+#[allow(clippy::only_used_in_recursion)] // params threaded to recurse the pattern tree (mirrors sibling collectors)
 fn member_chain_collect_destruct_pattern(
     pattern: &DestructPattern,
     source: &str,
@@ -793,15 +794,13 @@ fn member_chain_collect_destruct_pattern(
 ) {
     match pattern {
         DestructPattern::Array(elements) => {
-            for el in elements {
-                if let Some(el) = el {
-                    match el {
-                        DestructElement::Ident(_, _) => {}
-                        DestructElement::Pattern(inner) => member_chain_collect_destruct_pattern(
-                            inner, source, lsp_line, lsp_char, best,
-                        ),
-                        DestructElement::Rest(_, _) => {}
-                    }
+            for el in elements.iter().flatten() {
+                match el {
+                    DestructElement::Ident(_, _) => {}
+                    DestructElement::Pattern(inner) => member_chain_collect_destruct_pattern(
+                        inner, source, lsp_line, lsp_char, best,
+                    ),
+                    DestructElement::Rest(_, _) => {}
                 }
             }
         }
@@ -887,6 +886,11 @@ fn member_chain_collect_stmt(
                 member_chain_collect_stmt(s, source, lsp_line, lsp_char, best);
             }
         }
+        Statement::Multi { statements, .. } => {
+            for s in statements {
+                member_chain_collect_stmt(s, source, lsp_line, lsp_char, best);
+            }
+        }
         Statement::FunDecl { params, body, .. } => {
             for p in params {
                 member_chain_collect_fun_param(p, source, lsp_line, lsp_char, best);
@@ -993,13 +997,11 @@ fn define_fun_param_stack(p: &FunParam, scopes: &mut ScopeStack) {
 fn define_pattern_stack(pattern: &DestructPattern, scopes: &mut ScopeStack) {
     match pattern {
         DestructPattern::Array(elements) => {
-            for el in elements {
-                if let Some(el) = el {
-                    match el {
-                        DestructElement::Ident(n, sp) => scopes.define(n.as_ref(), *sp),
-                        DestructElement::Pattern(inner) => define_pattern_stack(inner, scopes),
-                        DestructElement::Rest(n, sp) => scopes.define(n.as_ref(), *sp),
-                    }
+            for el in elements.iter().flatten() {
+                match el {
+                    DestructElement::Ident(n, sp) => scopes.define(n.as_ref(), *sp),
+                    DestructElement::Pattern(inner) => define_pattern_stack(inner, scopes),
+                    DestructElement::Rest(n, sp) => scopes.define(n.as_ref(), *sp),
                 }
             }
         }
@@ -1310,6 +1312,17 @@ fn walk_stmt_resolve(
             scopes.pop();
             out
         }
+        // Transparent group (comma-declarators): same scope, no push/pop.
+        Statement::Multi { statements, .. } => {
+            let mut out = None;
+            for s in statements {
+                if let Some(x) = walk_stmt_resolve(s, scopes, target) {
+                    out = Some(x);
+                    break;
+                }
+            }
+            out
+        }
         Statement::FunDecl {
             name,
             name_span,
@@ -1525,7 +1538,17 @@ pub fn is_runtime_global_ident(name: &str) -> bool {
             | "Array"
             | "String"
             | "Date"
+            | "Set"
+            | "Map"
+            | "Float64Array"
+            | "Float32Array"
+            | "Int8Array"
             | "Uint8Array"
+            | "Uint8ClampedArray"
+            | "Int16Array"
+            | "Uint16Array"
+            | "Int32Array"
+            | "Uint32Array"
             | "AudioContext"
             | "RegExp"
             | "setTimeout"
@@ -1804,6 +1827,12 @@ fn check_unresolved_stmt(
             }
             scopes.pop();
         }
+        // Transparent group (comma-declarators): same scope, no push/pop.
+        Statement::Multi { statements, .. } => {
+            for s in statements {
+                check_unresolved_stmt(s, scopes, out);
+            }
+        }
         Statement::FunDecl {
             name,
             name_span,
@@ -1965,25 +1994,23 @@ fn enumerate_pattern_bindings(
 ) {
     match pattern {
         DestructPattern::Array(elements) => {
-            for el in elements {
-                if let Some(el) = el {
-                    match el {
-                        DestructElement::Ident(n, sp) => out.push(BindingSite {
-                            name: n.clone(),
-                            span: *sp,
-                            kind,
-                            exported,
-                        }),
-                        DestructElement::Pattern(inner) => {
-                            enumerate_pattern_bindings(inner, kind, exported, out);
-                        }
-                        DestructElement::Rest(n, sp) => out.push(BindingSite {
-                            name: n.clone(),
-                            span: *sp,
-                            kind,
-                            exported,
-                        }),
+            for el in elements.iter().flatten() {
+                match el {
+                    DestructElement::Ident(n, sp) => out.push(BindingSite {
+                        name: n.clone(),
+                        span: *sp,
+                        kind,
+                        exported,
+                    }),
+                    DestructElement::Pattern(inner) => {
+                        enumerate_pattern_bindings(inner, kind, exported, out);
                     }
+                    DestructElement::Rest(n, sp) => out.push(BindingSite {
+                        name: n.clone(),
+                        span: *sp,
+                        kind,
+                        exported,
+                    }),
                 }
             }
         }
@@ -2300,6 +2327,11 @@ fn enumerate_stmt(stmt: &Statement, exported: bool, out: &mut Vec<BindingSite>)
                 enumerate_stmt(s, exported, out);
             }
         }
+        Statement::Multi { statements, .. } => {
+            for s in statements {
+                enumerate_stmt(s, exported, out);
+            }
+        }
         Statement::FunDecl {
             name,
             name_span,
@@ -2617,15 +2649,13 @@ fn param_layer_names(params: &[FunParam], rest_param: &Option<TypedParam>) -> Ve
 fn collect_pattern_binding_names(pattern: &DestructPattern, out: &mut Vec<Arc<str>>) {
     match pattern {
         DestructPattern::Array(elements) => {
-            for el in elements {
-                if let Some(el) = el {
-                    match el {
-                        DestructElement::Ident(n, _) => out.push(n.clone()),
-                        DestructElement::Pattern(inner) => {
-                            collect_pattern_binding_names(inner, out)
-                        }
-                        DestructElement::Rest(n, _) => out.push(n.clone()),
+            for el in elements.iter().flatten() {
+                match el {
+                    DestructElement::Ident(n, _) => out.push(n.clone()),
+                    DestructElement::Pattern(inner) => {
+                        collect_pattern_binding_names(inner, out)
                     }
+                    DestructElement::Rest(n, _) => out.push(n.clone()),
                 }
             }
         }
@@ -2912,6 +2942,11 @@ fn walk_stmt_completion(
                 walk_stmt_completion(s, source, lsp_line, lsp_char, stack, best);
             }
         }
+        Statement::Multi { statements, .. } => {
+            for s in statements {
+                walk_stmt_completion(s, source, lsp_line, lsp_char, stack, best);
+            }
+        }
         Statement::FunDecl {
             params,
             rest_param,
@@ -3181,6 +3216,11 @@ fn refs_stmt(
                 refs_stmt(s, program, source, name, def_span, out);
             }
         }
+        Statement::Multi { statements, .. } => {
+            for s in statements {
+                refs_stmt(s, program, source, name, def_span, out);
+            }
+        }
         Statement::FunDecl { params, body, .. } => {
             for p in params {
                 if let FunParam::Simple(tp) = p {

package/crates/tish_runtime/Cargo.toml

@@ -56,6 +56,8 @@ http-hyper = [
 ]
 fs = []
 process = []
+# Interactive terminal I/O (issue #101): raw mode, key/resize events, size, alt screen.
+tty = ["dep:crossterm"]
 regex = ["tishlang_core/regex"]
 # WebSocket (JS-like API). Modular: import { WebSocket, Server } from 'tish:ws'.
 # Requires `send-values` because the WS server keeps an `Arc<dyn Fn + Send +
@@ -84,6 +86,8 @@ tiny_http = { version = "0.12.0", optional = true }
 socket2 = { version = "0.5", features = ["all"], optional = true }
 libc = { version = "0.2", optional = true }
 arc-swap = { version = "1", optional = true }
+# Interactive terminal I/O (feature = tty): cross-platform raw mode, key/resize events, size.
+crossterm = { version = "0.28", optional = true }
 # hyper backend (feature = http-hyper)
 hyper = { version = "1", default-features = false, features = ["server", "http1", "http2"], optional = true }
 hyper-util = { version = "0.1", features = ["server", "tokio"], optional = true }

package/crates/tish_runtime/src/http.rs

@@ -226,7 +226,27 @@ impl RequestPrimitive {
             && req.body_length().map(|n| n > 0).unwrap_or(true);
         let mut body = String::new();
         if has_body {
-            let _ = req.as_reader().read_to_string(&mut body);
+            // Bounded read: cap at max_request_body so a huge advertised/chunked body can't
+            // exhaust memory. (`take` is unavailable on `&mut dyn Read`; read in chunks via
+            // the object-safe `read`, then decode once to keep UTF-8 boundaries intact.)
+            let max = max_request_body();
+            let reader = req.as_reader();
+            let mut buf: Vec<u8> = Vec::new();
+            let mut chunk = [0u8; 8192];
+            while buf.len() < max {
+                match reader.read(&mut chunk) {
+                    Ok(0) => break,
+                    Ok(n) => {
+                        let take = n.min(max - buf.len());
+                        buf.extend_from_slice(&chunk[..take]);
+                        if take < n {
+                            break; // hit the cap mid-chunk
+                        }
+                    }
+                    Err(_) => break,
+                }
+            }
+            body = String::from_utf8_lossy(&buf).into_owned();
         }
         let headers = req
             .headers()
@@ -355,7 +375,7 @@ impl ResponsePrimitive {
                     }
                 } else if let Some(b) = obj_ref.strings.get("body") {
                     match b {
-                        Value::String(s) => ResponseBody::Text(Arc::clone(&s)),
+                        Value::String(s) => ResponseBody::Text(Arc::from(s.as_str())),
                         Value::Array(a) => {
                             let borrow = a.borrow();
                             if !borrow.is_empty()
@@ -418,7 +438,7 @@ impl ResponsePrimitive {
             Value::String(s) => Self {
                 status: default_status,
                 headers: vec![],
-                body: ResponseBody::Text(Arc::clone(s)),
+                body: ResponseBody::Text(Arc::from(s.as_str())),
             },
             _ => Self {
                 status: default_status,
@@ -447,7 +467,10 @@ pub fn value_to_response(value: &Value) -> (u16, Vec<(String, String)>, String)
     (r.status, r.headers, body)
 }
 
-fn extract_file_from_response(value: &Value) -> Option<(u16, Vec<(String, String)>, String)> {
+/// `(status, headers, file path)` extracted from a response object's `file` key.
+type FileResponse = (u16, Vec<(String, String)>, String);
+
+fn extract_file_from_response(value: &Value) -> Option<FileResponse> {
     let Value::Object(obj) = value else {
         return None;
     };
@@ -504,7 +527,7 @@ pub fn send_response(
     mut headers: Vec<(String, String)>,
     body: String,
 ) {
-    send_response_arc(request, status, headers.drain(..).collect(), Arc::from(body));
+    send_response_arc(request, status, std::mem::take(&mut headers), Arc::from(body));
 }
 
 pub fn send_response_arc(
@@ -525,13 +548,39 @@ pub fn send_response_arc(
         None,
     );
     for (key, value) in headers {
-        if let Ok(header) = tiny_http::Header::from_bytes(key.as_bytes(), value.as_bytes()) {
+        if let Some(header) = safe_response_header(key.as_bytes(), value.as_bytes()) {
             response = response.with_header(header);
         }
     }
     let _ = request.respond(response);
 }
 
+/// Max request body bytes read before truncating — bounds per-request memory so a huge
+/// `Content-Length` / chunked stream can't OOM the worker. Override with `TISH_HTTP_MAX_BODY`
+/// (bytes); default 16 MiB. (A future refinement: reply 413 instead of truncating.)
+fn max_request_body() -> usize {
+    use std::sync::OnceLock;
+    static MAX: OnceLock<usize> = OnceLock::new();
+    *MAX.get_or_init(|| {
+        std::env::var("TISH_HTTP_MAX_BODY")
+            .ok()
+            .and_then(|v| v.parse().ok())
+            .unwrap_or(16 * 1024 * 1024)
+    })
+}
+
+/// Build a response header, rejecting any key/value with control bytes (CR/LF/NUL).
+/// Prevents response-splitting / header injection when a handler reflects untrusted input
+/// into a header — `tiny_http::Header::from_bytes` only checks ASCII, and CR/LF are ASCII,
+/// so it would otherwise accept them.
+fn safe_response_header(key: &[u8], value: &[u8]) -> Option<tiny_http::Header> {
+    let bad = |b: &u8| matches!(*b, b'\r' | b'\n' | 0);
+    if key.iter().any(bad) || value.iter().any(bad) {
+        return None;
+    }
+    tiny_http::Header::from_bytes(key, value).ok()
+}
+
 struct ArcBytesReader {
     bytes: Arc<[u8]>,
     pos: usize,
@@ -573,7 +622,7 @@ pub fn send_response_bytes(
         None,
     );
     for (key, value) in headers {
-        if let Ok(header) = tiny_http::Header::from_bytes(key.as_bytes(), value.as_bytes()) {
+        if let Some(header) = safe_response_header(key.as_bytes(), value.as_bytes()) {
             response = response.with_header(header);
         }
     }
@@ -601,7 +650,7 @@ fn send_file_response(
     let status_code = tiny_http::StatusCode(status);
     let mut response = tiny_http::Response::from_file(file).with_status_code(status_code);
     for (key, value) in headers {
-        if let Ok(header) = tiny_http::Header::from_bytes(key.as_bytes(), value.as_bytes()) {
+        if let Some(header) = safe_response_header(key.as_bytes(), value.as_bytes()) {
             response = response.with_header(header);
         }
     }
@@ -791,7 +840,7 @@ pub fn serve<F>(args: &[Value], handler: F) -> Value
 where
     F: Fn(&[Value]) -> Value + Send + Sync + 'static,
 {
-    serve_impl_with_factory(args, None, Some(Arc::new(handler)))
+    serve_impl_with_factory(args, None, Some(tishlang_core::native_fn(handler)))
 }
 
 /// `serve(port, { onWorker, workers? })` — each accept thread calls the
@@ -804,12 +853,12 @@ where
 #[cfg(feature = "send-values")]
 pub fn serve_per_worker<FF>(args: &[Value], factory: FF) -> Value
 where
-    FF: Fn(usize) -> Arc<dyn Fn(&[Value]) -> Value + Send + Sync> + Send + Sync + 'static,
+    FF: Fn(usize) -> tishlang_core::NativeFn + Send + Sync + 'static,
 {
     serve_impl_with_factory(
         args,
         Some(Arc::new(factory)
-            as Arc<dyn Fn(usize) -> Arc<dyn Fn(&[Value]) -> Value + Send + Sync> + Send + Sync>),
+            as Arc<dyn Fn(usize) -> tishlang_core::NativeFn + Send + Sync>),
         None,
     )
 }
@@ -829,9 +878,9 @@ where
 fn serve_impl_with_factory(
     args: &[Value],
     factory: Option<
-        Arc<dyn Fn(usize) -> Arc<dyn Fn(&[Value]) -> Value + Send + Sync> + Send + Sync>,
+        Arc<dyn Fn(usize) -> tishlang_core::NativeFn + Send + Sync>,
     >,
-    shared_handler: Option<Arc<dyn Fn(&[Value]) -> Value + Send + Sync>>,
+    shared_handler: Option<tishlang_core::NativeFn>,
 ) -> Value {
     debug_assert!(factory.is_some() ^ shared_handler.is_some());
     let port = match args.first() {
@@ -958,7 +1007,7 @@ fn serve_impl_with_factory(
         let stop = Arc::clone(&stop);
         let processed = Arc::clone(&processed);
         let max = max_requests;
-        let worker_handler: Arc<dyn Fn(&[Value]) -> Value + Send + Sync> =
+        let worker_handler: tishlang_core::NativeFn =
             if let Some(f) = &factory {
                 f(global_worker_base + idx)
             } else {
@@ -1063,7 +1112,7 @@ where
     let mut count = 0usize;
     while let Ok((req_prim, resp_tx)) = rx.recv() {
         let req_value = req_prim.into_value();
-        let response_value = handler(&[req_value]);
+        let response_value = handler.call(&[req_value]);
         let resp_prim = ResponsePrimitive::from_value(&response_value);
         let _ = resp_tx.send(resp_prim);
 
@@ -1092,7 +1141,7 @@ where
 #[cfg(feature = "send-values")]
 fn worker_loop_direct(
     listener: std::net::TcpListener,
-    handler: Arc<dyn Fn(&[Value]) -> Value + Send + Sync>,
+    handler: tishlang_core::NativeFn,
     stop: Arc<AtomicBool>,
     processed: Arc<AtomicUsize>,
     max_requests: Option<usize>,
@@ -1117,7 +1166,7 @@ fn worker_loop_direct(
                 } else {
                     let req_prim = RequestPrimitive::from_tiny_http(&mut request);
                     let req_value = req_prim.into_value();
-                    let response_value = handler(&[req_value]);
+                    let response_value = handler.call(&[req_value]);
                     let resp_prim = ResponsePrimitive::from_value(&response_value);
                     respond_from_primitive(request, resp_prim);
                 }

package/crates/tish_runtime/src/http_fetch.rs

@@ -35,6 +35,7 @@ impl TishPromise for FetchResponsePromise {
 }
 
 struct FetchAllResponsesPromise {
+    #[allow(clippy::type_complexity)]
     rx: Mutex<
         Option<
             tokio::sync::oneshot::Receiver<Result<Vec<Result<reqwest::Response, String>>, String>>,
@@ -158,6 +159,7 @@ impl HttpBody {
         }
     }
 
+    #[allow(clippy::type_complexity)]
     fn take_stream(
         &self,
     ) -> Result<Pin<Box<dyn Stream<Item = Result<Bytes, reqwest::Error>> + Send>>, String> {
@@ -229,7 +231,7 @@ impl TishOpaque for HttpReadableStream {
             return None;
         }
         let body = Arc::clone(&self.body);
-        Some(Arc::new(move |_args: &[Value]| match body.take_stream() {
+        Some(tishlang_core::native_fn(move |_args: &[Value]| match body.take_stream() {
             Ok(stream) => {
                 let inner = Arc::new(tokio::sync::Mutex::new(StreamSlot { stream }));
                 Value::Opaque(Arc::new(HttpStreamReader {
@@ -270,7 +272,7 @@ impl TishOpaque for HttpStreamReader {
         }
         let inner = Arc::clone(&self.inner);
         let body = Arc::clone(&self.body);
-        Some(Arc::new(move |_args: &[Value]| {
+        Some(tishlang_core::native_fn(move |_args: &[Value]| {
             let inner = Arc::clone(&inner);
             let body = Arc::clone(&body);
             let (tx, rx) = tokio::sync::oneshot::channel();
@@ -313,13 +315,13 @@ pub fn response_value_from_reqwest(response: reqwest::Response) -> Value {
     let ok = response.status().is_success();
     let headers_val = headers_to_value(response.headers());
     let body_holder = Arc::new(HttpBody::new(response));
-    let stream = Arc::new(HttpReadableStream {
+    let stream = HttpReadableStream {
         body: Arc::clone(&body_holder),
-    });
-    let body_stream_val = Value::Opaque(stream);
+    };
+    let body_stream_val = Value::Opaque(Arc::new(stream));
     let bh_text = Arc::clone(&body_holder);
     let bh_json = Arc::clone(&body_holder);
-    let text_fn: NativeFn = Arc::new(move |_args: &[Value]| {
+    let text_fn: NativeFn = tishlang_core::native_fn(move |_args: &[Value]| {
         let bh = Arc::clone(&bh_text);
         let (tx, rx) = tokio::sync::oneshot::channel();
         crate::http::RUNTIME.with(|rt| {
@@ -330,7 +332,7 @@ pub fn response_value_from_reqwest(response: reqwest::Response) -> Value {
         });
         crate::promise_io::string_result_promise(rx)
     });
-    let json_fn: NativeFn = Arc::new(move |_args: &[Value]| {
+    let json_fn: NativeFn = tishlang_core::native_fn(move |_args: &[Value]| {
         let bh = Arc::clone(&bh_json);
         let (tx, rx) = tokio::sync::oneshot::channel();
         crate::http::RUNTIME.with(|rt| {
@@ -353,13 +355,31 @@ pub fn response_value_from_reqwest(response: reqwest::Response) -> Value {
     Value::object(obj)
 }
 
+/// Shared, hardened outbound HTTP client: request + connect timeouts (a no-timeout fetch is
+/// an outbound resource-pinning / slowloris vector) and a bounded redirect chain. Cached so
+/// the connection pool is reused across requests.
+/// NOTE: this does NOT yet block internal/metadata IPs — full SSRF defense (deny loopback /
+/// link-local / RFC1918 after DNS resolution) is a follow-up that needs a policy decision.
+fn fetch_client() -> &'static reqwest::Client {
+    use std::sync::OnceLock;
+    static CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
+    CLIENT.get_or_init(|| {
+        reqwest::Client::builder()
+            .timeout(std::time::Duration::from_secs(30))
+            .connect_timeout(std::time::Duration::from_secs(10))
+            .redirect(reqwest::redirect::Policy::limited(5))
+            .build()
+            .unwrap_or_else(|_| reqwest::Client::new())
+    })
+}
+
 async fn send_request_parts(
     url: String,
     method: String,
     headers: Vec<(String, String)>,
     body: Option<String>,
 ) -> Result<reqwest::Response, String> {
-    let client = reqwest::Client::new();
+    let client = fetch_client();
     let mut req = match method.as_str() {
         "GET" => client.get(&url),
         "POST" => client.post(&url),
@@ -416,6 +436,7 @@ pub fn fetch_all_promise_from_args(args: Vec<Value>) -> Value {
             }));
         }
     };
+    #[allow(clippy::type_complexity)]
     let mut parts: Vec<(String, String, Vec<(String, String)>, Option<String>)> = Vec::new();
     for req in requests {
         let (url, opt) = match &req {

package/crates/tish_runtime/src/http_hyper.rs

@@ -186,6 +186,8 @@ where
     let mut count = 0usize;
     while let Ok((req_prim, resp_tx)) = rx.recv() {
         let req_value = req_prim.into_value_pub();
+        // `handler` is the generic `F: Fn(&[Value]) -> Value` — call it directly. (`.call(..)` here
+        // would bind the *unstable* `Fn::call` trait method, which takes a tuple, not `&[Value]`.)
         let response_value = handler(&[req_value]);
         let resp_prim = ResponsePrimitive::from_value_pub(&response_value);
         let _ = resp_tx.send(resp_prim);
@@ -259,6 +261,12 @@ fn worker_thread(
                 });
                 if let Err(e) = http1::Builder::new()
                     .keep_alive(true)
+                    // A `Timer` MUST be installed whenever a timeout is set, or hyper 1.x panics
+                    // ("header_read_timeout set, but no timer set") on the first connection.
+                    .timer(hyper_util::rt::TokioTimer::new())
+                    // Slowloris guard: drop a connection that dribbles its request
+                    // headers slower than this instead of pinning the worker task.
+                    .header_read_timeout(std::time::Duration::from_secs(30))
                     .serve_connection(io, svc)
                     .await
                 {
@@ -338,13 +346,28 @@ async fn extract_request(
         .iter()
         .map(|(k, v)| (k.as_str().to_string(), v.to_str().unwrap_or("").to_string()))
         .collect();
-    let body_bytes = match http_body_util::BodyExt::collect(req.into_body()).await {
+    // Cap the collected body so a huge/chunked request can't exhaust memory.
+    let limited = http_body_util::Limited::new(req.into_body(), hyper_max_body());
+    let body_bytes = match http_body_util::BodyExt::collect(limited).await {
         Ok(c) => c.to_bytes().to_vec(),
-        Err(_) => Vec::new(),
+        Err(_) => Vec::new(), // includes "length limit exceeded"
     };
     (method, url, path, query, headers, body_bytes)
 }
 
+/// Max request body bytes for the hyper backend (mirrors the tiny_http cap).
+/// Override with `TISH_HTTP_MAX_BODY` (bytes); default 16 MiB.
+fn hyper_max_body() -> usize {
+    use std::sync::OnceLock;
+    static MAX: OnceLock<usize> = OnceLock::new();
+    *MAX.get_or_init(|| {
+        std::env::var("TISH_HTTP_MAX_BODY")
+            .ok()
+            .and_then(|v| v.parse().ok())
+            .unwrap_or(16 * 1024 * 1024)
+    })
+}
+
 fn primitive_to_hyper(resp: ResponsePrimitive) -> Response<Full<Bytes>> {
     let (body_bytes, default_ct): (Bytes, Option<&str>) = match resp.body {
         ResponseBody::Text(s) => (Bytes::copy_from_slice(s.as_bytes()), Some("text/plain")),