zexus 1.8.1 → 1.8.3

package/src/zexus/builtin_modules.py

@@ -121,28 +121,65 @@ def create_builtin_modules(evaluator):
         def _crypto_aes_encrypt(*args):
             if len(args) != 2:
                 return EvaluationError("aes_encrypt() expects 2 arguments: data, key")
-            # Simplified AES - would need proper implementation
             data = args[0].value if hasattr(args[0], 'value') else str(args[0])
             key = args[1].value if hasattr(args[1], 'value') else str(args[1])
-            # For now, return a mock encrypted value (TODO: implement proper AES)
-            import base64
-            encoded = base64.b64encode(data.encode()).decode()
-            return String(f"aes_encrypted:{encoded}")
+            try:
+                import hashlib, base64, os
+                # Derive 256-bit key from user key via SHA-256
+                aes_key = hashlib.sha256(key.encode('utf-8')).digest()
+                # Use AES-256-GCM for authenticated encryption
+                from Crypto.Cipher import AES as _AES
+                nonce = os.urandom(12)
+                cipher = _AES.new(aes_key, _AES.MODE_GCM, nonce=nonce)
+                ciphertext, tag = cipher.encrypt_and_digest(data.encode('utf-8'))
+                # Pack: nonce (12) + tag (16) + ciphertext, base64-encoded
+                packed = base64.b64encode(nonce + tag + ciphertext).decode('ascii')
+                return String(packed)
+            except ImportError:
+                # Fallback: if pycryptodome not available, use Fernet from cryptography
+                try:
+                    import hashlib, base64
+                    from cryptography.fernet import Fernet as _Fernet
+                    fernet_key = base64.urlsafe_b64encode(hashlib.sha256(key.encode('utf-8')).digest())
+                    f = _Fernet(fernet_key)
+                    encrypted = f.encrypt(data.encode('utf-8'))
+                    return String(encrypted.decode('ascii'))
+                except ImportError:
+                    return EvaluationError("aes_encrypt() requires pycryptodome or cryptography package")
+            except Exception as e:
+                return EvaluationError(f"aes_encrypt() failed: {str(e)}")
         
         # aes_decrypt(encrypted_data, key)
         def _crypto_aes_decrypt(*args):
             if len(args) != 2:
                 return EvaluationError("aes_decrypt() expects 2 arguments: encrypted_data, key")
-            # Simplified AES - would need proper implementation
             encrypted = args[0].value if hasattr(args[0], 'value') else str(args[0])
             key = args[1].value if hasattr(args[1], 'value') else str(args[1])
-            # For now, decode the mock encryption (TODO: implement proper AES)
-            import base64
-            if encrypted.startswith("aes_encrypted:"):
-                encoded = encrypted.split(":", 1)[1]
-                decoded = base64.b64decode(encoded).decode()
-                return String(decoded)
-            return String(encrypted)
+            try:
+                import hashlib, base64
+                aes_key = hashlib.sha256(key.encode('utf-8')).digest()
+                raw = base64.b64decode(encrypted)
+                if len(raw) < 28:  # 12 nonce + 16 tag minimum
+                    return EvaluationError("aes_decrypt() invalid ciphertext (too short)")
+                nonce = raw[:12]
+                tag = raw[12:28]
+                ciphertext = raw[28:]
+                from Crypto.Cipher import AES as _AES
+                cipher = _AES.new(aes_key, _AES.MODE_GCM, nonce=nonce)
+                plaintext = cipher.decrypt_and_verify(ciphertext, tag)
+                return String(plaintext.decode('utf-8'))
+            except ImportError:
+                try:
+                    import hashlib, base64
+                    from cryptography.fernet import Fernet as _Fernet
+                    fernet_key = base64.urlsafe_b64encode(hashlib.sha256(key.encode('utf-8')).digest())
+                    f = _Fernet(fernet_key)
+                    decrypted = f.decrypt(encrypted.encode('ascii'))
+                    return String(decrypted.decode('utf-8'))
+                except ImportError:
+                    return EvaluationError("aes_decrypt() requires pycryptodome or cryptography package")
+            except Exception as e:
+                return EvaluationError(f"aes_decrypt() failed: {str(e)}")
         
         # Register all crypto functions
         crypto_env.set("keccak256", Builtin(_crypto_keccak256, "keccak256"))

package/src/zexus/cli/main.py

@@ -81,6 +81,15 @@ from ..error_reporter import get_error_reporter, ZexusError, print_error
 from ..vm.vm import VM, VMMode
 from ..vm.compiler import compile_ast_to_bytecode, UnsupportedNodeError
 
+# Kernel extension layer (opt-in, non-breaking)
+try:
+    from ..kernel import get_kernel as _get_kernel
+    _kernel = _get_kernel().boot()
+    KERNEL_AVAILABLE = True
+except Exception:
+    _kernel = None
+    KERNEL_AVAILABLE = False
+
 console = Console()
 
 def show_all_commands():
@@ -156,7 +165,7 @@ def show_all_commands():
     console.print("\n[bold green]💡 Tip:[/bold green] Use 'zx <command> --help' for detailed command options\n")
 
 @click.group(invoke_without_command=True)
-@click.version_option(version="1.8.1", prog_name="Zexus")
+@click.version_option(version="1.8.3", prog_name="Zexus")
 @click.option('--syntax-style', type=click.Choice(['universal', 'tolerable', 'auto']),
               default='auto', help='Syntax style to use (universal=strict, tolerable=flexible)')
 @click.option('--advanced-parsing', is_flag=True, default=True,
@@ -556,6 +565,14 @@ def run(ctx, file, args, use_vm, vm_mode, no_optimize, precompile_modules):
             vm.env["__PACKAGE__"] = package_name.value if hasattr(package_name, "value") else package_name
             console.print(" [green]done[/green]")
 
+            # --- Rust VM status indicator ---
+            if getattr(vm, '_rust_vm_available', False) and getattr(vm, '_rust_vm_enabled', False):
+                console.print("[bold cyan]⚡ Rust VM:[/bold cyan] [green]active[/green] — native acceleration enabled")
+            elif getattr(vm, '_rust_vm_available', False):
+                console.print("[bold cyan]⚡ Rust VM:[/bold cyan] [yellow]available but disabled[/yellow]")
+            else:
+                console.print("[bold yellow]⚠️  Rust VM:[/bold yellow] [dim]not compiled — using Python VM (install zexus_core for native speed)[/dim]")
+
             console.print("[dim]Executing on VM...[/dim]")
             try:
                 result = vm.execute(bytecode, debug=ctx.obj.get('DEBUG', False))
@@ -1105,5 +1122,33 @@ def profile(ctx, file, memory, top, json_output):
             traceback.print_exc()
         sys.exit(1)
 
+
+@cli.command(name="kernel")
+@click.pass_context
+def kernel_status(ctx):
+    """Show Zexus kernel status and registered domains"""
+    if not KERNEL_AVAILABLE or _kernel is None:
+        console.print("[yellow]Kernel not available[/yellow]")
+        sys.exit(1)
+
+    status = _kernel.status()
+    console.print("\n[bold cyan]⚙️  Zexus Kernel Status[/bold cyan]\n")
+    console.print(f"  Booted:    [green]{status['booted']}[/green]")
+    console.print(f"  Domains:   [green]{status['domain_count']}[/green]")
+    console.print(f"  Opcodes:   [green]{status['opcode_handlers']}[/green] handlers")
+    console.print(f"  Middleware: [green]{status['middleware']}[/green]\n")
+
+    if status['domains']:
+        table = Table(show_header=True, header_style="bold magenta")
+        table.add_column("Domain", style="cyan")
+        table.add_column("Version", style="white")
+        table.add_column("Status", style="green")
+        for name, version in status['domains'].items():
+            domain = _kernel.registry.get_domain(name)
+            n_ops = len(domain.opcodes) if domain else 0
+            table.add_row(name, version, f"{n_ops} opcodes")
+        console.print(table)
+
+
 if __name__ == "__main__":
     cli()

package/src/zexus/cli/zpm.py

@@ -18,7 +18,7 @@ console = Console()
 
 
 @click.group()
-@click.version_option(version="1.8.1", prog_name="ZPM")
+@click.version_option(version="1.8.3", prog_name="ZPM")
 def cli():
     """ZPM - Zexus Package Manager
     

package/src/zexus/evaluator/bytecode_compiler.py

@@ -813,12 +813,21 @@ class EvaluatorBytecodeCompiler:
     
     def _compile_MapLiteral(self, node: zexus_ast.MapLiteral):
         """Compile map/dictionary literal"""
+        # node.pairs may be a dict (older parser) or a list of (key, value) tuples
+        pairs = node.pairs or []
+        if isinstance(pairs, dict):
+            iterable = pairs.items()
+            count = len(pairs)
+        else:
+            iterable = pairs
+            count = len(pairs)
+
         # Push key-value pairs
-        for key_expr, value_expr in node.pairs:
+        for key_expr, value_expr in iterable:
             self._compile_node(key_expr)
             self._compile_node(value_expr)
         # Build map from stack
-        self.builder.emit("BUILD_MAP", len(node.pairs))
+        self.builder.emit("BUILD_MAP", count)
 
     # LI12: _compile_PropertyAccessExpression is defined later in this file.
     # The earlier duplicate implementation was dead code (overridden).

package/src/zexus/evaluator/core.py

@@ -494,7 +494,10 @@ class Evaluator(ExpressionEvaluatorMixin, StatementEvaluatorMixin, FunctionEvalu
                 enable_gas_metering=True,
                 gas_limit=1_000_000  # Default 1M gas limit
             )
-            debug_log("Evaluator", "VM integration initialized successfully (cache + JIT + gas metering)")
+            # Report Rust VM status
+            rust_active = getattr(self.vm_instance, '_rust_vm_available', False) and getattr(self.vm_instance, '_rust_vm_enabled', False)
+            rust_label = "Rust VM active" if rust_active else "Python VM"
+            debug_log("Evaluator", f"VM integration initialized successfully (cache + JIT + gas metering, {rust_label})")
         except Exception as e:
             debug_log("Evaluator", f"Failed to initialize VM: {e}")
             self.use_vm = False

package/src/zexus/evaluator/expressions.py

@@ -89,8 +89,9 @@ class ExpressionEvaluatorMixin:
         if zexus_config.fast_debug_enabled:
             debug_log("eval_identifier", f"Looking up: {name}")
         
-        # Special case: 'this' keyword should be treated like ThisExpression
-        if name == "this":
+        # Special case: 'this' and 'self' keywords should be treated like ThisExpression
+        # R-003 fix: 'self' is now recognized as an alias for 'this'
+        if name == "this" or name == "self":
             # Look for contract instance first
             contract_instance = env.get("__contract_instance__")
             if contract_instance is not None:
@@ -279,6 +280,11 @@ class ExpressionEvaluatorMixin:
                 return Float(left_val ** right_val)
             except (OverflowError, ValueError) as e:
                 return EvaluationError(f"Exponentiation error: {e}")
+        # R-017 fix: Add modulo support for floats
+        elif operator == "%":
+            if right_val == 0:
+                return EvaluationError("Modulo by zero")
+            return Float(left_val % right_val)
         
         return EvaluationError(f"Unknown float operator: {operator}")
     
@@ -388,6 +394,9 @@ class ExpressionEvaluatorMixin:
                         f"String repetition count {n} exceeds maximum ({_MAX_STRING_REPEAT})"
                     )
                 return String(right.value * n)
+            # R-016 fix: Handle mixed Integer/Float multiplication
+            elif isinstance(left, (Integer, Float)) and isinstance(right, (Integer, Float)):
+                return Float(float(left.value) * float(right.value))
         
         # Array Concatenation
         elif operator == "+" and isinstance(left, List) and isinstance(right, List):

package/src/zexus/evaluator/functions.py

@@ -348,6 +348,32 @@ class FunctionEvaluatorMixin:
                 # Synchronous function execution
                 new_env = Environment(outer=fn.env)
                 
+                # R-008 fix: Enforce protection policies for module-level actions.
+                # When ``action protect`` is used at module level, the policy is
+                # stored in the environment as ``__policy_<name>__``.  Check and
+                # enforce it before the action body runs.
+                _fn_name = getattr(fn, 'name', func_name)
+                if _fn_name and env is not None:
+                    _policy_key = f"__policy_{_fn_name}__"
+                    _policy = None
+                    try:
+                        _policy = env.get(_policy_key) if hasattr(env, 'get') else None
+                    except Exception:
+                        pass
+                    if _policy is not None and _policy is not NULL:
+                        try:
+                            from ..policy_engine import get_policy_registry
+                            registry = get_policy_registry()
+                            violation = registry.check_policy(_fn_name, {
+                                "args": args,
+                                "env": env,
+                                "caller": env.get("TX.caller") if hasattr(env, 'get') else None,
+                            })
+                            if violation:
+                                return EvaluationError(f"Policy violation on '{_fn_name}': {violation}")
+                        except (ImportError, AttributeError):
+                            pass
+                
                 param_names = []
                 for i, param in enumerate(fn.parameters):
                     if i < len(args):
@@ -2512,6 +2538,47 @@ class FunctionEvaluatorMixin:
                 return EvaluationError("filter(arr, fn)")
             return self._array_filter(a[0], a[1])
         
+        def _range(*a):
+            """range(end) or range(start, end) or range(start, end, step)"""
+            if len(a) == 0:
+                return EvaluationError("range() requires 1-3 arguments, got 0")
+            if len(a) == 1:
+                end_val = a[0].value if hasattr(a[0], 'value') else int(a[0])
+                return List([Integer(i) for i in range(end_val)])
+            elif len(a) >= 2:
+                start_val = a[0].value if hasattr(a[0], 'value') else int(a[0])
+                end_val = a[1].value if hasattr(a[1], 'value') else int(a[1])
+                step_val = 1
+                if len(a) >= 3:
+                    step_val = a[2].value if hasattr(a[2], 'value') else int(a[2])
+                return List([Integer(i) for i in range(start_val, end_val, step_val)])
+        
+        def _typeof(*a):
+            """typeof(value) - returns the type name as a string"""
+            if len(a) != 1:
+                return EvaluationError("typeof() requires exactly 1 argument")
+            obj = a[0]
+            if isinstance(obj, Integer): return String("integer")
+            if isinstance(obj, Float): return String("float")
+            if isinstance(obj, String): return String("string")
+            if isinstance(obj, BooleanObj): return String("boolean")
+            if obj is NULL or obj is None: return String("null")
+            if isinstance(obj, List): return String("list")
+            if isinstance(obj, Map): return String("map")
+            if isinstance(obj, Action) or isinstance(obj, LambdaFunction): return String("function")
+            from ..security import SmartContract
+            if isinstance(obj, SmartContract): return String("contract")
+            return String(type(obj).__name__.lower())
+        
+        def _abs(*a):
+            """abs(number) - returns absolute value"""
+            if len(a) != 1:
+                return EvaluationError("abs() requires exactly 1 argument")
+            val = a[0]
+            if isinstance(val, Integer): return Integer(abs(val.value))
+            if isinstance(val, Float): return Float(abs(val.value))
+            return EvaluationError("abs() requires a number argument")
+        
         def _vfs_stats(*a):
             """Return VFS file cache statistics as a Map: vfs_stats()"""
             mgr = _get_vfs_manager()
@@ -2762,6 +2829,7 @@ class FunctionEvaluatorMixin:
             "debug_log": Builtin(_debug_log, "debug_log"),
             "debug_trace": Builtin(_debug_trace, "debug_trace"),
             "string": Builtin(_string, "string"),
+            "str": Builtin(_string, "str"),           # alias for string()
             "int": Builtin(_int, "int"),
             "float": Builtin(_float, "float"),
             "uppercase": Builtin(_uppercase, "uppercase"),
@@ -2770,6 +2838,7 @@ class FunctionEvaluatorMixin:
             "persist_set": Builtin(_persist_set, "persist_set"),
             "persist_get": Builtin(_persist_get, "persist_get"),
             "len": Builtin(_len, "len"),
+            "length": Builtin(_len, "length"),        # alias for len()
             "type": Builtin(_type, "type"),
             "first": Builtin(_first, "first"),
             "rest": Builtin(_rest, "rest"),
@@ -2785,6 +2854,9 @@ class FunctionEvaluatorMixin:
             "values": Builtin(_values, "values"),
             "entries": Builtin(_entries, "entries"),
             "size": Builtin(_size, "size"),
+            "range": Builtin(_range, "range"),
+            "typeof": Builtin(_typeof, "typeof"),
+            "abs": Builtin(_abs, "abs"),
         })
         
         # Register access control builtins

package/src/zexus/evaluator/resource_limiter.py

@@ -250,7 +250,7 @@ class ResourceLimiter:
                 stats['memory_mb'] = memory_mb
                 stats['max_memory_mb'] = self.max_memory_mb
                 stats['memory_percent'] = (memory_mb / self.max_memory_mb) * 100
-            except:
+            except (OSError, AttributeError, ZeroDivisionError):
                 pass
         
         return stats

package/src/zexus/evaluator/statements.py

@@ -1228,11 +1228,45 @@ class StatementEvaluatorMixin:
         if is_error(iterable): 
             return iterable
         
+        # R-007 fix: Support Map iteration in for-each loops
+        if isinstance(iterable, Map):
+            result = NULL
+            for key, val in iterable.pairs.items():
+                try:
+                    self.resource_limiter.check_iterations()
+                except Exception as e:
+                    from ..evaluator.resource_limiter import ResourceError, TimeoutError
+                    if isinstance(e, (ResourceError, TimeoutError)):
+                        return EvaluationError(str(e))
+                    raise
+                
+                if node.index:
+                    # for each key, val in map
+                    key_obj = String(key) if isinstance(key, str) else key
+                    env.set(node.index.value, key_obj)
+                    env.set(node.item.value, val)
+                else:
+                    # for each key in map (single variable gets the key)
+                    key_obj = String(key) if isinstance(key, str) else key
+                    env.set(node.item.value, key_obj)
+                
+                result = self.eval_node(node.body, env, stack_trace)
+                if isinstance(result, ReturnValue):
+                    return result
+                if isinstance(result, BreakException):
+                    return NULL
+                if isinstance(result, ContinueException):
+                    result = NULL
+                    continue
+                if isinstance(result, EvaluationError):
+                    return result
+            return result
+        
         if not isinstance(iterable, List):
-            return EvaluationError("ForEach expects List")
+            return EvaluationError("ForEach expects List or Map")
         
         result = NULL
-        for item in iterable.elements:
+        for idx, item in enumerate(iterable.elements):
             # Resource limit check (Security Fix #7)
             try:
                 self.resource_limiter.check_iterations()
@@ -1243,6 +1277,9 @@ class StatementEvaluatorMixin:
                     return EvaluationError(str(e))
                 raise  # Re-raise if not a resource error
             
+            # R-006 fix: Support indexed for-each (for each i, item in list)
+            if node.index:
+                env.set(node.index.value, Integer(idx))
             env.set(node.item.value, item)
             result = self.eval_node(node.body, env, stack_trace)
             if isinstance(result, ReturnValue):
@@ -1881,7 +1918,10 @@ class StatementEvaluatorMixin:
         
         for nm in names:
             val = env.get(nm)
-            if not val: 
+            # R-011 fix: Use ``is None`` instead of ``not val`` so that valid
+            # objects which might be falsy (empty lists, NULL placeholders from
+            # pre-registration, etc.) are not incorrectly rejected.
+            if val is None: 
                 return EvaluationError(f"Cannot export undefined: {nm}")
             
             # If inside a module, add to module's exports list
@@ -2302,7 +2342,7 @@ class StatementEvaluatorMixin:
                 
                 if isinstance(prop, dict):
                     # For dict format, default_value is in the dict
-                    if 'default_value' in prop:
+                    if 'default_value' in prop and prop['default_value'] is not None:
                         def_val = self.eval_node(prop['default_value'], env, stack_trace)
                         if is_error(def_val): 
                             return def_val

package/src/zexus/kernel/__init__.py

@@ -0,0 +1,34 @@
+"""
+Zexus Kernel — Extension layer for the interpreter and VM.
+
+The kernel sits *alongside* the existing evaluator and VM.  It does NOT
+replace them.  Instead it provides:
+
+* **DomainRegistry** — a place where feature domains (blockchain, web,
+  system, …) register their capabilities so the interpreter can discover
+  them at runtime.
+* **ZIR** — a formal opcode catalogue that documents (and validates) the
+  bytecode the VM already uses, plus domain-specific opcode ranges.
+* **Hooks** — optional integration points the evaluator/VM can call into
+  (e.g. ``kernel.resolve_opcode()``, ``kernel.check_security()``).
+
+The kernel is entirely opt-in.  Everything works without it — but with
+it, third-party domains can plug into the Zexus runtime cleanly.
+
+Quick start
+-----------
+>>> from zexus.kernel import get_kernel
+>>> k = get_kernel()
+>>> k.registry.list_domains()         # see what's loaded
+>>> k.registry.get_domain("blockchain")  # query a specific domain
+"""
+
+from .registry import DomainRegistry, get_registry
+from .hooks import Kernel, get_kernel
+
+__all__ = [
+    "DomainRegistry",
+    "get_registry",
+    "Kernel",
+    "get_kernel",
+]