zexus 1.8.2 → 1.8.3

package/README.md

@@ -2,14 +2,14 @@
 
 <div align="center">
 
-![Zexus Logo](https://img.shields.io/badge/Zexus-v1.8.1-FF6B35?style=for-the-badge)
+![Zexus Logo](https://img.shields.io/badge/Zexus-v1.8.3-FF6B35?style=for-the-badge)
 [![License](https://img.shields.io/badge/License-MIT-blue.svg?style=for-the-badge)](LICENSE)
 [![Python](https://img.shields.io/badge/Python-3.8+-3776AB?style=for-the-badge&logo=python)](https://python.org)
 [![GitHub](https://img.shields.io/badge/GitHub-Zaidux/zexus--interpreter-181717?style=for-the-badge&logo=github)](https://github.com/Zaidux/zexus-interpreter)
 
 **A modern, security-first programming language with built-in blockchain support, VM-accelerated execution, advanced memory management, and policy-as-code**
 
-[What's New](#-whats-new-in-v171) • [Features](#-key-features) • [Installation](#-installation) • [Quick Start](#-quick-start) • [Keywords](#-complete-keyword-reference) • [Documentation](#-documentation) • [Examples](#-examples) • [Troubleshooting](#-getting-help--troubleshooting)
+[What's New](#-whats-new-in-v183) • [Features](#-key-features) • [Installation](#-installation) • [Quick Start](#-quick-start) • [Keywords](#-complete-keyword-reference) • [Documentation](#-documentation) • [Examples](#-examples) • [Troubleshooting](#-getting-help--troubleshooting)
 
 </div>
 
@@ -18,7 +18,7 @@
 ## 📋 Table of Contents
 
 - [What is Zexus?](#-what-is-zexus)
-- [What's New](#-whats-new-in-v171)
+- [What's New](#-whats-new-in-v183)
 - [Key Features](#-key-features)
   - [VM-Accelerated Performance](#-vm-accelerated-performance-new)
   - [Security & Policy-as-Code](#-security--policy-as-code--verify-enhanced)
@@ -67,71 +67,96 @@ Zexus is a next-generation, general-purpose programming language designed for se
 
 ---
 
-## 🎉 What's New in v1.8.1
-
-### Latest Features (v1.8.1)
-
-✅ **FIND Keyword** - Declarative project search that resolves exact module paths with scope filtering and smart suggestions  
-✅ **LOAD Keyword & Manager** - Provider-aware configuration loader with built-in ENV, JSON, and YAML support plus caching  
-✅ **VM + Bytecode Support** - FIND/LOAD now compile to bytecode with helper bridges so scripts run identically in the VM and interpreter  
-✅ **Targeted Test Coverage** - Added regression tests that exercise both interpreter and VM paths for FIND/LOAD workflows  
-
-### Previous Features (v1.6.3)
-
-✅ **Complete Database Ecosystem** - Production-ready database drivers  
-✅ **4 Database Drivers** - SQLite, PostgreSQL, MySQL, MongoDB fully tested  
-✅ **HTTP Server** - Build web servers with routing (GET, POST, PUT, DELETE)  
-✅ **Socket/TCP Primitives** - Low-level network programming  
-✅ **Testing Framework** - Write and run tests with assertions  
-✅ **ZPM Package Manager** - Fully functional package management system  
-✅ **Comprehensive Documentation** - 900+ lines of ecosystem guides  
-
-### Previous Features (v1.5.0)
-
-✅ **World-Class Error Reporting** - Production-grade error messages rivaling Rust  
-✅ **Advanced DATA System** - Generic types, pattern matching, operator overloading  
-✅ **Stack Trace Formatter** - Beautiful, readable stack traces with source context  
-✅ **Smart Error Suggestions** - Actionable hints for fixing common errors  
-✅ **Pattern Matching** - Complete pattern matching with exhaustiveness checking  
-✅ **CONTINUE Keyword** - Error recovery mode for graceful degradation and batch processing  
-
-### Recent Enhancements (v0.1.3)
-
-✅ **130+ Keywords Fully Operational** - All core language features tested and verified  
-✅ **Dual-Mode DEBUG** - Function mode (`debug(x)`) and statement mode (`debug x;`)  
-✅ **Conditional Print** - `print(condition, message)` for dynamic output control  
-✅ **Multiple Syntax Styles** - `let x = 5`, `let x : 5`, `let x : int = 5` all supported  
-✅ **Enterprise Keywords** - MIDDLEWARE, AUTH, THROTTLE, CACHE, INJECT fully functional  
-✅ **Async/Await Runtime** - Complete Promise-based async system with context propagation  
-✅ **Main Entry Point** - 15+ builtins for program lifecycle management  
-✅ **UI Renderer** - SCREEN, COMPONENT, THEME keywords with 120+ tests  
-✅ **Enhanced VERIFY** - Email, URL, phone validation, pattern matching, database checks  
-✅ **Blockchain Keywords** - implements, pure, view, payable, modifier, this, emit  
-✅ **Loop Control** - BREAK keyword for early loop exit  
-✅ **Error Handling** - THROW keyword for explicit error raising, THIS for instance reference  
-✅ **100+ Built-in Functions** - Comprehensive standard library  
-✅ **LOG Keyword Enhancements** - `read_file()` and `eval_file()` for dynamic code generation  
-✅ **REQUIRE Tolerance Blocks** - Conditional bypasses for VIP/admin/emergency scenarios  
-✅ **Function-Level Scoping** - LET/CONST documented with scope behavior and shadowing rules  
-✅ **Advanced Error Patterns** - Retry, circuit breaker, error aggregation patterns
-
-### Bug Fixes & Improvements
-
-✅ Fixed array literal parsing (no more duplicate elements)  
-✅ Fixed ENUM value accessibility  
-✅ Fixed WHILE condition parsing without parentheses  
-✅ Fixed loop execution and variable reassignment  
-✅ Fixed DEFER cleanup execution  
-✅ Fixed SANDBOX return values  
-✅ Fixed dependency injection container creation  
-✅ Added tolerance blocks for REQUIRE  
-✅ Improved error messages and debugging output
+## 🎉 What's New in v1.8.3
+
+### v1.8.3 — Phase 0 Audit Fixes, Closure Scoping Overhaul & VM Hardening (2026-03-01)
+
+19 issues from the [Ziver-Chain Phase 0 rewrite audit](issues/ISSUE8.md) resolved — including 3 VM-specific critical fixes. Key changes:
+
+**VM Fixes & Hardening:**
+- **R-001:** Entity field access on VM now works — proper `EntityDefinition`/`EntityInstance` construction from bytecode
+- **R-002:** Contract `state` declarations now compile correctly (`_compile_StateStatement`)
+- **R-010:** Complex programs no longer silently fail — added `_vm_warn()` diagnostics, replaced 15 silent error handlers
+- Native fast-path (`_vm_native_call`) for `push`/`append`/`length`/`str`/`range` operations on VM-native types
+- `VMRuntimeError(Exception)` replaces non-raisable `ZEvaluationError(Object)` in 15 raise sites
+- Stack overflow protection, execution timeout (30s), opcode limit (100M), configurable VM pool sizing
+- **Rust VM status indicator** — CLI/runner show "Rust VM: active", "available but disabled", or "not compiled"
+
+**Closure & Scoping Fixes:**
+- Entity/`let` declarations before a contract no longer break contract visibility — declaration order is now flexible
+- Module-level helper functions called from contract methods now correctly propagate side-effects (`list.push()`, `map[k]=v`)
+- `action protect` now works at module level (policy enforcement added to function call path)
+- Storage sync-back in contract methods improved — `list.push()` after `map[key]=val` no longer silently ignored
+- Exported entities can now be used as constructors in importing files
+
+**Contract & Language Fixes:**
+- `self` keyword works as alias for `this` inside contracts
+- `init()` auto-called on `Contract()` construction
+- `state { field1: val, field2: val }` multi-field blocks work correctly
+- `for each i, item in list` (indexed) and `for each key, val in map` now supported
+- `INTEGER * FLOAT` implicit coercion and `%` modulo on floats now work
+- Added `range()`, `typeof()`, `abs()`, `str()`, `length()` builtins; 8 parser edge-case fixes
+
+**Stats:** 1852 tests pass, 0 regressions. 5 new extreme test suites (83 tests across speed, stability, security, features, VM). See [CHANGELOG](CHANGELOG.md) for full details.
+
+### v1.8.2 — Concurrency & Channel Support (2026-02-25)
+
+- `watch =>` arrow-lambda fallback no longer hijacks the strategy parser
+- Channel support in VM compiler (`_compile_ChannelStatement`, `_compile_SendStatement`, `_compile_ReceiveStatement`)
+- SPAWN/AWAIT opcodes in sync path using `threading.Thread(daemon=True)`
+- Strategy parser channel/async handlers added
+- Fixed 10+ missing VM node types; zero VM fallbacks achieved
+- All versions bumped to 1.8.2; Rust VM builds with `maturin develop --release`
+
+### v1.8.1 — ISSUE7 Audit & Security Remediation (2026-02-23)
+
+All 21 issues from the Phase 0 audit resolved:
+- `emit`, `protocol`, `implements` keywords fully operational in all parsers
+- Entity compilation crash in VM fixed; imported functions no longer return raw Action objects
+- `map.has()` / `map.get()` key normalization fixed
+- ExportStatement supported in VM; entity constructor arity validation relaxed
+- `persistent storage` now wires to SQLite backend with `set_persistent`/`get_persistent`
+- 5 new builtins: `track_memory()`, `cache()`, `throttle()`, `audit()`, `verify()`
+- Complete security remediation Phases 0–5 (sandboxing, ReDoS, import sandboxing, compiler parity, dead-code removal, bounded logs)
+- 1852 tests pass
+
+### v1.8.0 — Rust VM Pipeline & Major Features (2026-02-23)
+
+**Language Features:** Compound assignment (`+=`, `-=`, etc.), string interpolation (`"Hello ${name}"`), block comments (`/* */`), multiline strings, single-quoted strings, exponentiation (`**`), `finally` clause, destructuring assignment.
+
+**Developer Tooling:** Circular import detection, LSP go-to-definition, remote ZPM registry, static type checker.
+
+**Major Capabilities:** Debug Adapter Protocol (DAP) server, GUI backend (Tk + Web), true concurrent EventLoop, WASM compilation target.
+
+**Rust-First Execution (Phases 0–6):** Complete migration achieving **102,000+ TPS** with zero Python fallbacks. Includes binary `.zxc` format, Rust bytecode interpreter (22 MIPS, 20.7x speedup), adaptive VM routing, `RustContractVM` orchestration, GIL-free batch execution (221,593 TPS peak), and 40+ Rust builtins.
+
+### v1.7.x — FIND/LOAD Keywords & Performance (2026-01)
+
+- **v1.7.2:** Major interpreter speed improvements, smart storage for lists, optimized stack traces, blockchain perf fix
+- **v1.7.1:** FIND keyword (declarative module search), LOAD keyword (provider-aware config loader), VM bytecode support for both, regression tests
+
+### v1.6.x — Database Ecosystem & Security (2025-12 – 2026-01)
+
+- **v1.6.8:** Parser fix for indexed assignments on new lines; contract DATA member declarations
+- **v1.6.7:** Semicolon handling fix, context-aware keyword recognition, standalone block statements
+- **v1.6.6:** Repeated contract action calls, multiple indexed assignments
+- **v1.6.5:** Entity property access, keyword restrictions (`from`/`to` as params), multiple map assignments
+- **v1.6.3:** Comprehensive security remediation (10 OWASP categories), RBAC, bcrypt, input sanitization, resource limits, path traversal prevention
+- **v1.6.2:** 4 database drivers (SQLite, PostgreSQL, MySQL, MongoDB), HTTP server, socket/TCP, testing framework, ZPM
+
+### v1.5.0 — Error Reporting & Type System (2025-12)
+
+World-class error messages (rivaling Rust), generic types, pattern matching, operator overloading, stack trace formatter, smart suggestions, CONTINUE keyword.
+
+### v0.1.3 — Foundation (2025-11)
+
+130+ keywords, dual-mode DEBUG, conditional print, multiple syntax styles, enterprise keywords, async/await, UI renderer, enhanced VERIFY, blockchain keywords, 100+ builtins.
 
 ---
 
-## 🔒 Latest Security Patches & Features (v1.6.3)
+## 🔒 Security Features
 
-Zexus v1.6.3 introduces **comprehensive security enhancements** and developer-friendly safety features. These improvements make Zexus one of the most secure interpreted languages available, with enterprise-grade protection built into the language itself.
+Zexus includes **comprehensive security enhancements** and developer-friendly safety features, making it one of the most secure interpreted languages available with enterprise-grade protection built into the language itself.
 
 ### 🛡️ Security Features Added
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zexus",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "description": "A modern, security-first programming language with blockchain support",
   "main": "index.js",
   "bin": {

package/rust_core/Cargo.lock

@@ -578,7 +578,7 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "zeroize"
-version = "1.8.2"
+version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
 

package/src/zexus/__init__.py

@@ -4,7 +4,7 @@ Zexus Programming Language
 A declarative, intent-based programming language for modern applications.
 """
 
-__version__ = "1.8.2"
+__version__ = "1.8.3"
 __author__ = "Ziver Labs"
 __email__ = "ziverofficial567@gmail.com"
 

package/src/zexus/builtin_modules.py

@@ -121,28 +121,65 @@ def create_builtin_modules(evaluator):
         def _crypto_aes_encrypt(*args):
             if len(args) != 2:
                 return EvaluationError("aes_encrypt() expects 2 arguments: data, key")
-            # Simplified AES - would need proper implementation
             data = args[0].value if hasattr(args[0], 'value') else str(args[0])
             key = args[1].value if hasattr(args[1], 'value') else str(args[1])
-            # For now, return a mock encrypted value (TODO: implement proper AES)
-            import base64
-            encoded = base64.b64encode(data.encode()).decode()
-            return String(f"aes_encrypted:{encoded}")
+            try:
+                import hashlib, base64, os
+                # Derive 256-bit key from user key via SHA-256
+                aes_key = hashlib.sha256(key.encode('utf-8')).digest()
+                # Use AES-256-GCM for authenticated encryption
+                from Crypto.Cipher import AES as _AES
+                nonce = os.urandom(12)
+                cipher = _AES.new(aes_key, _AES.MODE_GCM, nonce=nonce)
+                ciphertext, tag = cipher.encrypt_and_digest(data.encode('utf-8'))
+                # Pack: nonce (12) + tag (16) + ciphertext, base64-encoded
+                packed = base64.b64encode(nonce + tag + ciphertext).decode('ascii')
+                return String(packed)
+            except ImportError:
+                # Fallback: if pycryptodome not available, use Fernet from cryptography
+                try:
+                    import hashlib, base64
+                    from cryptography.fernet import Fernet as _Fernet
+                    fernet_key = base64.urlsafe_b64encode(hashlib.sha256(key.encode('utf-8')).digest())
+                    f = _Fernet(fernet_key)
+                    encrypted = f.encrypt(data.encode('utf-8'))
+                    return String(encrypted.decode('ascii'))
+                except ImportError:
+                    return EvaluationError("aes_encrypt() requires pycryptodome or cryptography package")
+            except Exception as e:
+                return EvaluationError(f"aes_encrypt() failed: {str(e)}")
         
         # aes_decrypt(encrypted_data, key)
         def _crypto_aes_decrypt(*args):
             if len(args) != 2:
                 return EvaluationError("aes_decrypt() expects 2 arguments: encrypted_data, key")
-            # Simplified AES - would need proper implementation
             encrypted = args[0].value if hasattr(args[0], 'value') else str(args[0])
             key = args[1].value if hasattr(args[1], 'value') else str(args[1])
-            # For now, decode the mock encryption (TODO: implement proper AES)
-            import base64
-            if encrypted.startswith("aes_encrypted:"):
-                encoded = encrypted.split(":", 1)[1]
-                decoded = base64.b64decode(encoded).decode()
-                return String(decoded)
-            return String(encrypted)
+            try:
+                import hashlib, base64
+                aes_key = hashlib.sha256(key.encode('utf-8')).digest()
+                raw = base64.b64decode(encrypted)
+                if len(raw) < 28:  # 12 nonce + 16 tag minimum
+                    return EvaluationError("aes_decrypt() invalid ciphertext (too short)")
+                nonce = raw[:12]
+                tag = raw[12:28]
+                ciphertext = raw[28:]
+                from Crypto.Cipher import AES as _AES
+                cipher = _AES.new(aes_key, _AES.MODE_GCM, nonce=nonce)
+                plaintext = cipher.decrypt_and_verify(ciphertext, tag)
+                return String(plaintext.decode('utf-8'))
+            except ImportError:
+                try:
+                    import hashlib, base64
+                    from cryptography.fernet import Fernet as _Fernet
+                    fernet_key = base64.urlsafe_b64encode(hashlib.sha256(key.encode('utf-8')).digest())
+                    f = _Fernet(fernet_key)
+                    decrypted = f.decrypt(encrypted.encode('ascii'))
+                    return String(decrypted.decode('utf-8'))
+                except ImportError:
+                    return EvaluationError("aes_decrypt() requires pycryptodome or cryptography package")
+            except Exception as e:
+                return EvaluationError(f"aes_decrypt() failed: {str(e)}")
         
         # Register all crypto functions
         crypto_env.set("keccak256", Builtin(_crypto_keccak256, "keccak256"))

package/src/zexus/cli/main.py

@@ -81,6 +81,15 @@ from ..error_reporter import get_error_reporter, ZexusError, print_error
 from ..vm.vm import VM, VMMode
 from ..vm.compiler import compile_ast_to_bytecode, UnsupportedNodeError
 
+# Kernel extension layer (opt-in, non-breaking)
+try:
+    from ..kernel import get_kernel as _get_kernel
+    _kernel = _get_kernel().boot()
+    KERNEL_AVAILABLE = True
+except Exception:
+    _kernel = None
+    KERNEL_AVAILABLE = False
+
 console = Console()
 
 def show_all_commands():
@@ -156,7 +165,7 @@ def show_all_commands():
     console.print("\n[bold green]💡 Tip:[/bold green] Use 'zx <command> --help' for detailed command options\n")
 
 @click.group(invoke_without_command=True)
-@click.version_option(version="1.8.2", prog_name="Zexus")
+@click.version_option(version="1.8.3", prog_name="Zexus")
 @click.option('--syntax-style', type=click.Choice(['universal', 'tolerable', 'auto']),
               default='auto', help='Syntax style to use (universal=strict, tolerable=flexible)')
 @click.option('--advanced-parsing', is_flag=True, default=True,
@@ -556,6 +565,14 @@ def run(ctx, file, args, use_vm, vm_mode, no_optimize, precompile_modules):
             vm.env["__PACKAGE__"] = package_name.value if hasattr(package_name, "value") else package_name
             console.print(" [green]done[/green]")
 
+            # --- Rust VM status indicator ---
+            if getattr(vm, '_rust_vm_available', False) and getattr(vm, '_rust_vm_enabled', False):
+                console.print("[bold cyan]⚡ Rust VM:[/bold cyan] [green]active[/green] — native acceleration enabled")
+            elif getattr(vm, '_rust_vm_available', False):
+                console.print("[bold cyan]⚡ Rust VM:[/bold cyan] [yellow]available but disabled[/yellow]")
+            else:
+                console.print("[bold yellow]⚠️  Rust VM:[/bold yellow] [dim]not compiled — using Python VM (install zexus_core for native speed)[/dim]")
+
             console.print("[dim]Executing on VM...[/dim]")
             try:
                 result = vm.execute(bytecode, debug=ctx.obj.get('DEBUG', False))
@@ -1105,5 +1122,33 @@ def profile(ctx, file, memory, top, json_output):
             traceback.print_exc()
         sys.exit(1)
 
+
+@cli.command(name="kernel")
+@click.pass_context
+def kernel_status(ctx):
+    """Show Zexus kernel status and registered domains"""
+    if not KERNEL_AVAILABLE or _kernel is None:
+        console.print("[yellow]Kernel not available[/yellow]")
+        sys.exit(1)
+
+    status = _kernel.status()
+    console.print("\n[bold cyan]⚙️  Zexus Kernel Status[/bold cyan]\n")
+    console.print(f"  Booted:    [green]{status['booted']}[/green]")
+    console.print(f"  Domains:   [green]{status['domain_count']}[/green]")
+    console.print(f"  Opcodes:   [green]{status['opcode_handlers']}[/green] handlers")
+    console.print(f"  Middleware: [green]{status['middleware']}[/green]\n")
+
+    if status['domains']:
+        table = Table(show_header=True, header_style="bold magenta")
+        table.add_column("Domain", style="cyan")
+        table.add_column("Version", style="white")
+        table.add_column("Status", style="green")
+        for name, version in status['domains'].items():
+            domain = _kernel.registry.get_domain(name)
+            n_ops = len(domain.opcodes) if domain else 0
+            table.add_row(name, version, f"{n_ops} opcodes")
+        console.print(table)
+
+
 if __name__ == "__main__":
     cli()

package/src/zexus/cli/zpm.py

@@ -18,7 +18,7 @@ console = Console()
 
 
 @click.group()
-@click.version_option(version="1.8.2", prog_name="ZPM")
+@click.version_option(version="1.8.3", prog_name="ZPM")
 def cli():
     """ZPM - Zexus Package Manager
     

package/src/zexus/evaluator/bytecode_compiler.py

@@ -813,12 +813,21 @@ class EvaluatorBytecodeCompiler:
     
     def _compile_MapLiteral(self, node: zexus_ast.MapLiteral):
         """Compile map/dictionary literal"""
+        # node.pairs may be a dict (older parser) or a list of (key, value) tuples
+        pairs = node.pairs or []
+        if isinstance(pairs, dict):
+            iterable = pairs.items()
+            count = len(pairs)
+        else:
+            iterable = pairs
+            count = len(pairs)
+
         # Push key-value pairs
-        for key_expr, value_expr in node.pairs:
+        for key_expr, value_expr in iterable:
             self._compile_node(key_expr)
             self._compile_node(value_expr)
         # Build map from stack
-        self.builder.emit("BUILD_MAP", len(node.pairs))
+        self.builder.emit("BUILD_MAP", count)
 
     # LI12: _compile_PropertyAccessExpression is defined later in this file.
     # The earlier duplicate implementation was dead code (overridden).

package/src/zexus/evaluator/core.py

@@ -494,7 +494,10 @@ class Evaluator(ExpressionEvaluatorMixin, StatementEvaluatorMixin, FunctionEvalu
                 enable_gas_metering=True,
                 gas_limit=1_000_000  # Default 1M gas limit
             )
-            debug_log("Evaluator", "VM integration initialized successfully (cache + JIT + gas metering)")
+            # Report Rust VM status
+            rust_active = getattr(self.vm_instance, '_rust_vm_available', False) and getattr(self.vm_instance, '_rust_vm_enabled', False)
+            rust_label = "Rust VM active" if rust_active else "Python VM"
+            debug_log("Evaluator", f"VM integration initialized successfully (cache + JIT + gas metering, {rust_label})")
         except Exception as e:
             debug_log("Evaluator", f"Failed to initialize VM: {e}")
             self.use_vm = False

package/src/zexus/evaluator/expressions.py

@@ -89,8 +89,9 @@ class ExpressionEvaluatorMixin:
         if zexus_config.fast_debug_enabled:
             debug_log("eval_identifier", f"Looking up: {name}")
         
-        # Special case: 'this' keyword should be treated like ThisExpression
-        if name == "this":
+        # Special case: 'this' and 'self' keywords should be treated like ThisExpression
+        # R-003 fix: 'self' is now recognized as an alias for 'this'
+        if name == "this" or name == "self":
             # Look for contract instance first
             contract_instance = env.get("__contract_instance__")
             if contract_instance is not None:
@@ -279,6 +280,11 @@ class ExpressionEvaluatorMixin:
                 return Float(left_val ** right_val)
             except (OverflowError, ValueError) as e:
                 return EvaluationError(f"Exponentiation error: {e}")
+        # R-017 fix: Add modulo support for floats
+        elif operator == "%":
+            if right_val == 0:
+                return EvaluationError("Modulo by zero")
+            return Float(left_val % right_val)
         
         return EvaluationError(f"Unknown float operator: {operator}")
     
@@ -388,6 +394,9 @@ class ExpressionEvaluatorMixin:
                         f"String repetition count {n} exceeds maximum ({_MAX_STRING_REPEAT})"
                     )
                 return String(right.value * n)
+            # R-016 fix: Handle mixed Integer/Float multiplication
+            elif isinstance(left, (Integer, Float)) and isinstance(right, (Integer, Float)):
+                return Float(float(left.value) * float(right.value))
         
         # Array Concatenation
         elif operator == "+" and isinstance(left, List) and isinstance(right, List):

package/src/zexus/evaluator/functions.py

@@ -348,6 +348,32 @@ class FunctionEvaluatorMixin:
                 # Synchronous function execution
                 new_env = Environment(outer=fn.env)
                 
+                # R-008 fix: Enforce protection policies for module-level actions.
+                # When ``action protect`` is used at module level, the policy is
+                # stored in the environment as ``__policy_<name>__``.  Check and
+                # enforce it before the action body runs.
+                _fn_name = getattr(fn, 'name', func_name)
+                if _fn_name and env is not None:
+                    _policy_key = f"__policy_{_fn_name}__"
+                    _policy = None
+                    try:
+                        _policy = env.get(_policy_key) if hasattr(env, 'get') else None
+                    except Exception:
+                        pass
+                    if _policy is not None and _policy is not NULL:
+                        try:
+                            from ..policy_engine import get_policy_registry
+                            registry = get_policy_registry()
+                            violation = registry.check_policy(_fn_name, {
+                                "args": args,
+                                "env": env,
+                                "caller": env.get("TX.caller") if hasattr(env, 'get') else None,
+                            })
+                            if violation:
+                                return EvaluationError(f"Policy violation on '{_fn_name}': {violation}")
+                        except (ImportError, AttributeError):
+                            pass
+                
                 param_names = []
                 for i, param in enumerate(fn.parameters):
                     if i < len(args):
@@ -2512,6 +2538,47 @@ class FunctionEvaluatorMixin:
                 return EvaluationError("filter(arr, fn)")
             return self._array_filter(a[0], a[1])
         
+        def _range(*a):
+            """range(end) or range(start, end) or range(start, end, step)"""
+            if len(a) == 0:
+                return EvaluationError("range() requires 1-3 arguments, got 0")
+            if len(a) == 1:
+                end_val = a[0].value if hasattr(a[0], 'value') else int(a[0])
+                return List([Integer(i) for i in range(end_val)])
+            elif len(a) >= 2:
+                start_val = a[0].value if hasattr(a[0], 'value') else int(a[0])
+                end_val = a[1].value if hasattr(a[1], 'value') else int(a[1])
+                step_val = 1
+                if len(a) >= 3:
+                    step_val = a[2].value if hasattr(a[2], 'value') else int(a[2])
+                return List([Integer(i) for i in range(start_val, end_val, step_val)])
+        
+        def _typeof(*a):
+            """typeof(value) - returns the type name as a string"""
+            if len(a) != 1:
+                return EvaluationError("typeof() requires exactly 1 argument")
+            obj = a[0]
+            if isinstance(obj, Integer): return String("integer")
+            if isinstance(obj, Float): return String("float")
+            if isinstance(obj, String): return String("string")
+            if isinstance(obj, BooleanObj): return String("boolean")
+            if obj is NULL or obj is None: return String("null")
+            if isinstance(obj, List): return String("list")
+            if isinstance(obj, Map): return String("map")
+            if isinstance(obj, Action) or isinstance(obj, LambdaFunction): return String("function")
+            from ..security import SmartContract
+            if isinstance(obj, SmartContract): return String("contract")
+            return String(type(obj).__name__.lower())
+        
+        def _abs(*a):
+            """abs(number) - returns absolute value"""
+            if len(a) != 1:
+                return EvaluationError("abs() requires exactly 1 argument")
+            val = a[0]
+            if isinstance(val, Integer): return Integer(abs(val.value))
+            if isinstance(val, Float): return Float(abs(val.value))
+            return EvaluationError("abs() requires a number argument")
+        
         def _vfs_stats(*a):
             """Return VFS file cache statistics as a Map: vfs_stats()"""
             mgr = _get_vfs_manager()
@@ -2762,6 +2829,7 @@ class FunctionEvaluatorMixin:
             "debug_log": Builtin(_debug_log, "debug_log"),
             "debug_trace": Builtin(_debug_trace, "debug_trace"),
             "string": Builtin(_string, "string"),
+            "str": Builtin(_string, "str"),           # alias for string()
             "int": Builtin(_int, "int"),
             "float": Builtin(_float, "float"),
             "uppercase": Builtin(_uppercase, "uppercase"),
@@ -2770,6 +2838,7 @@ class FunctionEvaluatorMixin:
             "persist_set": Builtin(_persist_set, "persist_set"),
             "persist_get": Builtin(_persist_get, "persist_get"),
             "len": Builtin(_len, "len"),
+            "length": Builtin(_len, "length"),        # alias for len()
             "type": Builtin(_type, "type"),
             "first": Builtin(_first, "first"),
             "rest": Builtin(_rest, "rest"),
@@ -2785,6 +2854,9 @@ class FunctionEvaluatorMixin:
             "values": Builtin(_values, "values"),
             "entries": Builtin(_entries, "entries"),
             "size": Builtin(_size, "size"),
+            "range": Builtin(_range, "range"),
+            "typeof": Builtin(_typeof, "typeof"),
+            "abs": Builtin(_abs, "abs"),
         })
         
         # Register access control builtins

package/src/zexus/evaluator/resource_limiter.py

@@ -250,7 +250,7 @@ class ResourceLimiter:
                 stats['memory_mb'] = memory_mb
                 stats['max_memory_mb'] = self.max_memory_mb
                 stats['memory_percent'] = (memory_mb / self.max_memory_mb) * 100
-            except:
+            except (OSError, AttributeError, ZeroDivisionError):
                 pass
         
         return stats