harn-vm 0.10.136

use crate::value::VmDictExt;
use std::io::{Cursor, Read, Write};

use flate2::read::GzDecoder;
use flate2::write::GzEncoder;
use flate2::{Compression, GzBuilder};

use crate::stdlib::args::{ArgError, Args, ErrorKind};
use crate::stdlib::macros::{harn_builtin, VmBuiltinDef};
use crate::value::{VmError, VmValue};
use crate::vm::Vm;

const DEFAULT_GZIP_LEVEL: i64 = 6;
const DEFAULT_ZSTD_LEVEL: i64 = 3;
const DEFAULT_BROTLI_QUALITY: i64 = 11;
const DEFAULT_TAR_MODE: i64 = 0o644;
/// Default decompression bomb cap: refuse to expand any single archive
/// or stream past 100 MiB unless the caller explicitly opts in with
/// `max_decompressed_bytes`. Picked to comfortably cover normal
/// payloads (LLM responses, workflow bundles, screenshot tarballs) but
/// stay well under the smallest realistic memory budget.
pub(crate) const MAX_DECOMPRESSED_BYTES: u64 = 100 * 1024 * 1024;

/// Resolve a `max_decompressed_bytes` (alias `maxDecompressedBytes`)
/// option from the args dict at `index`, falling back to
/// [`MAX_DECOMPRESSED_BYTES`] when absent.
fn decompress_cap(args: &[VmValue], index: usize, builtin: &str) -> Result<u64, VmError> {
    let mut options = Args::runtime(builtin, args).options(index, "options")?;
    match options.opt_int_any(&["max_decompressed_bytes", "maxDecompressedBytes"])? {
        None => Ok(MAX_DECOMPRESSED_BYTES),
        Some(cap) if cap > 0 => Ok(cap as u64),
        Some(_) => Err(ArgError::constraint(
            builtin,
            ErrorKind::Runtime,
            "max_decompressed_bytes",
            "must be > 0",
        )),
    }
}

/// Decompress `source` into a `Vec<u8>`, refusing to grow past `cap`.
/// Returns a clean error message instead of OOMing when the stream
/// (gzip/zstd/brotli) expands past the configured limit.
fn read_with_cap<R: Read>(source: &mut R, cap: u64, builtin: &str) -> Result<Vec<u8>, VmError> {
    let mut limited = source.take(cap.saturating_add(1));
    let mut output = Vec::new();
    limited
        .read_to_end(&mut output)
        .map_err(|error| builtin_error(builtin, error))?;
    if output.len() as u64 > cap {
        return Err(builtin_error(
            builtin,
            format!(
                "decompressed output exceeded max_decompressed_bytes ({cap}); refusing to \
                 allocate further to avoid a decompression-bomb OOM"
            ),
        ));
    }
    Ok(output)
}

fn runtime_error(message: impl Into<String>) -> VmError {
    VmError::Runtime(message.into())
}

fn builtin_error(builtin: &str, message: impl std::fmt::Display) -> VmError {
    runtime_error(format!("{builtin}: {message}"))
}

fn expect_bytes<'a>(args: &'a [VmValue], index: usize, builtin: &str) -> Result<&'a [u8], VmError> {
    Args::runtime(builtin, args).bytes(index, "input")
}

fn expect_bytes_or_string(
    args: &[VmValue],
    index: usize,
    builtin: &str,
) -> Result<Vec<u8>, VmError> {
    Args::runtime(builtin, args)
        .bytes_or_string(index, "input")
        .map(<[u8]>::to_vec)
}

fn optional_int(
    args: &[VmValue],
    index: usize,
    default: i64,
    builtin: &str,
    param: &str,
) -> Result<i64, VmError> {
    Ok(Args::runtime(builtin, args)
        .opt_int(index, param)?
        .unwrap_or(default))
}

fn expect_level(
    args: &[VmValue],
    index: usize,
    default: i64,
    range: std::ops::RangeInclusive<i64>,
    builtin: &str,
    param: &str,
) -> Result<i64, VmError> {
    let value = optional_int(args, index, default, builtin, param)?;
    if range.contains(&value) {
        Ok(value)
    } else {
        Err(builtin_error(
            builtin,
            format!(
                "{param} must be between {} and {}, got {value}",
                range.start(),
                range.end()
            ),
        ))
    }
}

fn entry_field<'a>(entry: &'a VmValue, field: &str) -> Option<&'a VmValue> {
    match entry {
        VmValue::Dict(map) => map.get(field),
        VmValue::StructInstance { .. } => entry.struct_field(field),
        _ => None,
    }
}

fn entry_path(entry: &VmValue, builtin: &str, index: usize) -> Result<String, VmError> {
    match entry_field(entry, "path") {
        Some(VmValue::String(path)) if !path.is_empty() => Ok(path.to_string()),
        Some(VmValue::String(_)) => Err(builtin_error(
            builtin,
            format!("entry {} path must not be empty", index + 1),
        )),
        Some(other) => Err(builtin_error(
            builtin,
            format!(
                "entry {} path must be a string, got {}",
                index + 1,
                other.type_name()
            ),
        )),
        None => Err(builtin_error(
            builtin,
            format!("entry {} is missing path", index + 1),
        )),
    }
}

fn entry_content(entry: &VmValue, builtin: &str, index: usize) -> Result<Vec<u8>, VmError> {
    match entry_field(entry, "content") {
        Some(VmValue::Bytes(bytes)) => Ok(bytes.as_ref().clone()),
        Some(VmValue::String(text)) => Ok(text.as_bytes().to_vec()),
        Some(other) => Err(builtin_error(
            builtin,
            format!(
                "entry {} content must be bytes or string, got {}",
                index + 1,
                other.type_name()
            ),
        )),
        None => Err(builtin_error(
            builtin,
            format!("entry {} is missing content", index + 1),
        )),
    }
}

fn entry_mode(entry: &VmValue, builtin: &str, index: usize) -> Result<u32, VmError> {
    let mode = match entry_field(entry, "mode") {
        Some(VmValue::Int(mode)) => *mode,
        Some(VmValue::Nil) | None => DEFAULT_TAR_MODE,
        Some(other) => {
            return Err(builtin_error(
                builtin,
                format!(
                    "entry {} mode must be an int, got {}",
                    index + 1,
                    other.type_name()
                ),
            ));
        }
    };

    if (0..=0o7777).contains(&mode) {
        Ok(mode as u32)
    } else {
        Err(builtin_error(
            builtin,
            format!("entry {} mode must be between 0 and 4095", index + 1),
        ))
    }
}

fn expect_entries<'a>(args: &'a [VmValue], builtin: &str) -> Result<&'a [VmValue], VmError> {
    match args.first() {
        Some(VmValue::List(entries)) => Ok(entries.as_slice()),
        Some(other) => Err(builtin_error(
            builtin,
            format!("entries must be a list, got {}", other.type_name()),
        )),
        None => Err(builtin_error(builtin, "missing argument 1")),
    }
}

fn bytes_value(bytes: Vec<u8>) -> VmValue {
    VmValue::Bytes(std::sync::Arc::new(bytes))
}

fn entry_value(fields: crate::value::DictMap) -> VmValue {
    VmValue::dict(fields)
}

#[harn_builtin(
    exposure = "pure",
    effects = [],
    sig = "gzip_encode(input: bytes | string, level?: int) -> bytes",
    category = "compression"
)]
fn gzip_encode_builtin(args: &[VmValue], _out: &mut String) -> Result<VmValue, VmError> {
    let input = expect_bytes_or_string(args, 0, "gzip_encode")?;
    let level = expect_level(args, 1, DEFAULT_GZIP_LEVEL, 0..=9, "gzip_encode", "level")?;
    let mut encoder: GzEncoder<Vec<u8>> = GzBuilder::new()
        .mtime(0)
        .write(Vec::new(), Compression::new(level as u32));
    encoder
        .write_all(&input)
        .map_err(|error| builtin_error("gzip_encode", error))?;
    encoder
        .finish()
        .map(bytes_value)
        .map_err(|error| builtin_error("gzip_encode", error))
}

#[harn_builtin(
    exposure = "pure",
    effects = [],
    sig = "gzip_decode(input: bytes, options?: dict) -> bytes",
    category = "compression"
)]
fn gzip_decode_builtin(args: &[VmValue], _out: &mut String) -> Result<VmValue, VmError> {
    let input = expect_bytes(args, 0, "gzip_decode")?;
    let cap = decompress_cap(args, 1, "gzip_decode")?;
    let mut decoder = GzDecoder::new(input);
    let output = read_with_cap(&mut decoder, cap, "gzip_decode")?;
    Ok(bytes_value(output))
}

#[harn_builtin(
    exposure = "pure",
    effects = [],
    sig = "zstd_encode(input: bytes | string, level?: int) -> bytes",
    category = "compression"
)]
fn zstd_encode_builtin(args: &[VmValue], _out: &mut String) -> Result<VmValue, VmError> {
    let input = expect_bytes_or_string(args, 0, "zstd_encode")?;
    let level_range = zstd::compression_level_range();
    let level = expect_level(
        args,
        1,
        DEFAULT_ZSTD_LEVEL,
        (*level_range.start() as i64)..=(*level_range.end() as i64),
        "zstd_encode",
        "level",
    )? as i32;
    zstd::stream::encode_all(Cursor::new(input), level)
        .map(bytes_value)
        .map_err(|error| builtin_error("zstd_encode", error))
}

#[harn_builtin(
    exposure = "pure",
    effects = [],
    sig = "zstd_decode(input: bytes, options?: dict) -> bytes",
    category = "compression"
)]
fn zstd_decode_builtin(args: &[VmValue], _out: &mut String) -> Result<VmValue, VmError> {
    let input = expect_bytes(args, 0, "zstd_decode")?;
    let cap = decompress_cap(args, 1, "zstd_decode")?;
    let mut decoder = zstd::stream::Decoder::new(Cursor::new(input))
        .map_err(|error| builtin_error("zstd_decode", error))?;
    let output = read_with_cap(&mut decoder, cap, "zstd_decode")?;
    Ok(bytes_value(output))
}

#[harn_builtin(
    exposure = "pure",
    effects = [],
    sig = "brotli_encode(input: bytes | string, quality?: int) -> bytes",
    category = "compression"
)]
fn brotli_encode_builtin(args: &[VmValue], _out: &mut String) -> Result<VmValue, VmError> {
    let input = expect_bytes_or_string(args, 0, "brotli_encode")?;
    let quality = expect_level(
        args,
        1,
        DEFAULT_BROTLI_QUALITY,
        0..=11,
        "brotli_encode",
        "quality",
    )? as u32;
    let mut reader = brotli::CompressorReader::new(Cursor::new(input), 4096, quality, 22);
    let mut output = Vec::new();
    reader
        .read_to_end(&mut output)
        .map_err(|error| builtin_error("brotli_encode", error))?;
    Ok(bytes_value(output))
}

#[harn_builtin(
    exposure = "pure",
    effects = [],
    sig = "brotli_decode(input: bytes, options?: dict) -> bytes",
    category = "compression"
)]
fn brotli_decode_builtin(args: &[VmValue], _out: &mut String) -> Result<VmValue, VmError> {
    let input = expect_bytes(args, 0, "brotli_decode")?;
    let cap = decompress_cap(args, 1, "brotli_decode")?;
    let mut reader = brotli::Decompressor::new(Cursor::new(input), 4096);
    let output = read_with_cap(&mut reader, cap, "brotli_decode")?;
    Ok(bytes_value(output))
}

#[harn_builtin(
    exposure = "pure",
    effects = [],
    sig = "tar_create(entries: list) -> bytes", category = "compression"
)]
fn tar_create_builtin(args: &[VmValue], _out: &mut String) -> Result<VmValue, VmError> {
    let entries = expect_entries(args, "tar_create")?;
    let mut output = Vec::new();
    {
        let mut builder = tar::Builder::new(&mut output);
        for (index, entry) in entries.iter().enumerate() {
            let path = entry_path(entry, "tar_create", index)?;
            let content = entry_content(entry, "tar_create", index)?;
            let mode = entry_mode(entry, "tar_create", index)?;

            let mut header = tar::Header::new_gnu();
            header.set_path(&path).map_err(|error| {
                builtin_error(
                    "tar_create",
                    format!("entry {} invalid path: {error}", index + 1),
                )
            })?;
            header.set_size(content.len() as u64);
            header.set_mode(mode);
            header.set_mtime(0);
            header.set_uid(0);
            header.set_gid(0);
            header.set_cksum();
            builder
                .append(&header, content.as_slice())
                .map_err(|error| builtin_error("tar_create", error))?;
        }
        builder
            .finish()
            .map_err(|error| builtin_error("tar_create", error))?;
    }
    Ok(bytes_value(output))
}

#[harn_builtin(
    exposure = "pure",
    effects = [],
    sig = "tar_extract(input: bytes, options?: dict) -> list",
    category = "compression"
)]
fn tar_extract_builtin(args: &[VmValue], _out: &mut String) -> Result<VmValue, VmError> {
    let input = expect_bytes(args, 0, "tar_extract")?;
    let cap = decompress_cap(args, 1, "tar_extract")?;
    let mut archive = tar::Archive::new(Cursor::new(input));
    let entries = archive
        .entries()
        .map_err(|error| builtin_error("tar_extract", error))?;
    let mut output = Vec::new();
    let mut total_extracted: u64 = 0;

    for entry in entries {
        let mut entry = entry.map_err(|error| builtin_error("tar_extract", error))?;
        if entry.header().entry_type().is_dir() {
            continue;
        }
        // tar headers carry the entry's declared size; reject obvious
        // attacker-shaped values (e.g. u64::MAX) BEFORE allocating, so
        // a maliciously-crafted header cannot trigger a Vec reservation
        // that triggers an allocator abort.
        let declared_size = entry
            .header()
            .size()
            .map_err(|error| builtin_error("tar_extract", error))?;
        if declared_size > cap || declared_size.saturating_add(total_extracted) > cap {
            return Err(builtin_error(
                "tar_extract",
                format!(
                    "tar entry declares size {declared_size} which exceeds \
                     max_decompressed_bytes ({cap}); refusing to extract"
                ),
            ));
        }
        let path = entry
            .path()
            .map_err(|error| builtin_error("tar_extract", error))?
            .to_str()
            .ok_or_else(|| builtin_error("tar_extract", "entry path is not valid UTF-8"))?
            .to_string();
        let mode = entry.header().mode().unwrap_or(DEFAULT_TAR_MODE as u32) as i64;
        // Even when the header says the entry is small, the actual
        // body could be larger (gnu tar quirk, corrupt archive). Guard
        // the read with the remaining cap so we never go past the
        // overall limit.
        let remaining = cap.saturating_sub(total_extracted);
        let content = read_with_cap(&mut entry, remaining, "tar_extract")?;
        total_extracted = total_extracted.saturating_add(content.len() as u64);

        let mut fields = crate::value::DictMap::new();
        fields.insert(crate::value::intern_key("content"), bytes_value(content));
        fields.insert(crate::value::intern_key("mode"), VmValue::Int(mode));
        fields.put_str("path", path);
        output.push(entry_value(fields));
    }

    Ok(VmValue::List(std::sync::Arc::new(output)))
}

#[harn_builtin(
    exposure = "pure",
    effects = [],
    sig = "zip_create(entries: list) -> bytes", category = "compression"
)]
fn zip_create_builtin(args: &[VmValue], _out: &mut String) -> Result<VmValue, VmError> {
    let entries = expect_entries(args, "zip_create")?;
    let cursor = Cursor::new(Vec::new());
    let mut writer = zip::ZipWriter::new(cursor);
    let options = zip::write::SimpleFileOptions::default()
        .compression_method(zip::CompressionMethod::Deflated);

    for (index, entry) in entries.iter().enumerate() {
        let path = entry_path(entry, "zip_create", index)?;
        let content = entry_content(entry, "zip_create", index)?;
        writer
            .start_file(path, options)
            .map_err(|error| builtin_error("zip_create", error))?;
        writer
            .write_all(&content)
            .map_err(|error| builtin_error("zip_create", error))?;
    }

    let cursor = writer
        .finish()
        .map_err(|error| builtin_error("zip_create", error))?;
    Ok(bytes_value(cursor.into_inner()))
}

#[harn_builtin(
    exposure = "pure",
    effects = [],
    sig = "zip_extract(input: bytes, options?: dict) -> list",
    category = "compression"
)]
fn zip_extract_builtin(args: &[VmValue], _out: &mut String) -> Result<VmValue, VmError> {
    let input = expect_bytes(args, 0, "zip_extract")?;
    let cap = decompress_cap(args, 1, "zip_extract")?;
    let cursor = Cursor::new(input);
    let mut archive =
        zip::ZipArchive::new(cursor).map_err(|error| builtin_error("zip_extract", error))?;
    verify_zip_member_census(input, archive.central_directory_start(), archive.len())?;
    let mut output = Vec::new();
    let mut total_extracted: u64 = 0;

    for index in 0..archive.len() {
        let mut file = archive
            .by_index(index)
            .map_err(|error| builtin_error("zip_extract", error))?;
        if file.is_dir() {
            continue;
        }
        // Reject entries that claim more uncompressed bytes than the
        // configured cap up-front (and reject the cumulative-overflow
        // case as well), so a zip bomb can't drain memory.
        let declared_size = file.size();
        if declared_size > cap || declared_size.saturating_add(total_extracted) > cap {
            return Err(builtin_error(
                "zip_extract",
                format!(
                    "zip entry declares uncompressed size {declared_size} which exceeds \
                     max_decompressed_bytes ({cap}); refusing to extract"
                ),
            ));
        }
        let path = file.name().to_string();
        let remaining = cap.saturating_sub(total_extracted);
        let content = read_with_cap(&mut file, remaining, "zip_extract")?;
        total_extracted = total_extracted.saturating_add(content.len() as u64);

        let mut fields = crate::value::DictMap::new();
        fields.insert(crate::value::intern_key("content"), bytes_value(content));
        fields.put_str("path", path);
        output.push(entry_value(fields));
    }

    Ok(VmValue::List(std::sync::Arc::new(output)))
}

/// ZipArchive validates the directory but then indexes records by raw filename,
/// overwriting duplicates. Count the validated directory records before trusting
/// that lossy projection. This checks multiplicity only; ZIP parsing, offsets,
/// decompression, and CRC validation remain owned by the ZIP reader.
fn verify_zip_member_census(
    input: &[u8],
    directory_start: u64,
    unique_members: usize,
) -> Result<(), VmError> {
    let mismatch = || {
        builtin_error(
            "zip_extract",
            "ZIP central-directory member census disagrees with its unique names; \
             duplicate members are not supported",
        )
    };
    let start = usize::try_from(directory_start).map_err(|_| mismatch())?;
    let mut remaining = input.get(start..).ok_or_else(mismatch)?;
    let mut observed = 0;
    while remaining.starts_with(b"PK\x01\x02") {
        let header = remaining.get(..46).ok_or_else(mismatch)?;
        let variable_size: usize = [28, 30, 32]
            .into_iter()
            .map(|offset| u16::from_le_bytes([header[offset], header[offset + 1]]) as usize)
            .sum();
        remaining = remaining.get(46 + variable_size..).ok_or_else(mismatch)?;
        observed += 1;
        if observed > unique_members {
            return Err(mismatch());
        }
    }
    if observed != unique_members {
        return Err(mismatch());
    }
    Ok(())
}

pub(crate) fn register_compression_builtins(vm: &mut Vm) {
    for def in MODULE_BUILTINS {
        vm.register_builtin_def(def);
    }
}

pub(crate) const MODULE_BUILTINS: &[&VmBuiltinDef] = &[
    &GZIP_ENCODE_BUILTIN_DEF,
    &GZIP_DECODE_BUILTIN_DEF,
    &ZSTD_ENCODE_BUILTIN_DEF,
    &ZSTD_DECODE_BUILTIN_DEF,
    &BROTLI_ENCODE_BUILTIN_DEF,
    &BROTLI_DECODE_BUILTIN_DEF,
    &TAR_CREATE_BUILTIN_DEF,
    &TAR_EXTRACT_BUILTIN_DEF,
    &ZIP_CREATE_BUILTIN_DEF,
    &ZIP_EXTRACT_BUILTIN_DEF,
];

#[cfg(test)]
mod tests {
    use super::*;

    fn vm() -> Vm {
        let mut vm = Vm::new();
        register_compression_builtins(&mut vm);
        vm
    }

    fn call(vm: &mut Vm, name: &str, args: Vec<VmValue>) -> Result<VmValue, VmError> {
        let f = vm.builtins.get(name).unwrap().clone();
        let mut out = String::new();
        f(&args, &mut out)
    }

    fn text(value: &str) -> VmValue {
        VmValue::String(arcstr::ArcStr::from(value))
    }

    fn zip_fixture(large_file: bool) -> Vec<u8> {
        let mut writer = zip::ZipWriter::new(Cursor::new(Vec::new()));
        let options = zip::write::SimpleFileOptions::default().large_file(large_file);
        writer
            .set_comment("member census fixture")
            .expect("set ZIP fixture comment");
        writer.add_directory("nested/", options).unwrap();
        for (name, body) in [
            ("evidence.json", b"first".as_slice()),
            ("evidencf.json", b"second"),
        ] {
            writer.start_file(name, options).unwrap();
            writer.write_all(body).unwrap();
        }
        writer.finish().unwrap().into_inner()
    }

    #[test]
    fn zip_extract_rejects_duplicate_names_before_extracting() {
        let mut archive = zip_fixture(false);
        let old = b"evidencf.json";
        let mut changed = 0;
        for offset in 0..=archive.len() - old.len() {
            if &archive[offset..offset + old.len()] == old {
                archive[offset..offset + old.len()].copy_from_slice(b"evidence.json");
                changed += 1;
            }
        }
        assert_eq!(changed, 2, "mutate the local and central directory names");
        let decoded = zip::ZipArchive::new(Cursor::new(&archive)).unwrap();
        assert_eq!(
            decoded.len(),
            2,
            "the dependency collapsed two files plus a directory"
        );
        let error = call(&mut vm(), "zip_extract", vec![bytes_value(archive)])
            .expect_err("ambiguous member names must be refused");
        assert!(error.to_string().contains("duplicate members"), "{error}");
    }

    #[test]
    fn zip_extract_preserves_ordinary_prefixed_and_zip64_archives() {
        for large_file in [false, true] {
            for prefix in [b"".as_slice(), b"self-extracting stub"] {
                let mut archive = prefix.to_vec();
                archive.extend(zip_fixture(large_file));
                let result = call(&mut vm(), "zip_extract", vec![bytes_value(archive)]).unwrap();
                let VmValue::List(entries) = result else {
                    panic!("expected entries")
                };
                assert_eq!(
                    entries.len(),
                    2,
                    "directory records are counted but not extracted"
                );
                assert_eq!(
                    entries[0].as_dict().unwrap()["content"].as_bytes().unwrap(),
                    b"first"
                );
                assert_eq!(
                    entries[1].as_dict().unwrap()["content"].as_bytes().unwrap(),
                    b"second"
                );
            }
        }
        let empty = zip::ZipWriter::new(Cursor::new(Vec::new()))
            .finish()
            .unwrap()
            .into_inner();
        let result = call(&mut vm(), "zip_extract", vec![bytes_value(empty)]).unwrap();
        let VmValue::List(entries) = result else {
            panic!("expected empty entries")
        };
        assert!(entries.is_empty());
    }

    #[test]
    fn gzip_round_trips_strings_to_bytes() {
        let mut vm = vm();
        let encoded = call(&mut vm, "gzip_encode", vec![text("hello"), VmValue::Int(1)]).unwrap();
        let decoded = call(&mut vm, "gzip_decode", vec![encoded]).unwrap();
        assert_eq!(decoded.as_bytes().unwrap(), b"hello");
    }

    #[test]
    fn gzip_decode_rejects_output_past_cap() {
        let mut vm = vm();
        // 64 KiB of zeros compresses to a few hundred bytes (~64x); cap
        // it at 1 KiB and confirm the decoder refuses, rather than
        // happily returning the full output.
        let payload = vec![0u8; 64 * 1024];
        let encoded = call(
            &mut vm,
            "gzip_encode",
            vec![
                VmValue::Bytes(std::sync::Arc::new(payload)),
                VmValue::Int(6),
            ],
        )
        .unwrap();
        let mut options = crate::value::DictMap::new();
        options.insert(
            crate::value::intern_key("max_decompressed_bytes"),
            VmValue::Int(1024),
        );
        let result = call(
            &mut vm,
            "gzip_decode",
            vec![encoded, VmValue::dict(options)],
        );
        let err = result.expect_err("gzip_decode should reject output past cap");
        let message = match err {
            VmError::Runtime(message) => message,
            other => panic!("expected Runtime error, got {other:?}"),
        };
        assert!(
            message.contains("max_decompressed_bytes"),
            "unexpected error: {message}"
        );
    }

    #[test]
    fn zstd_decode_rejects_output_past_cap() {
        let mut vm = vm();
        let payload = vec![0u8; 64 * 1024];
        let encoded = call(
            &mut vm,
            "zstd_encode",
            vec![
                VmValue::Bytes(std::sync::Arc::new(payload)),
                VmValue::Int(3),
            ],
        )
        .unwrap();
        let mut options = crate::value::DictMap::new();
        options.insert(
            crate::value::intern_key("max_decompressed_bytes"),
            VmValue::Int(1024),
        );
        let result = call(
            &mut vm,
            "zstd_decode",
            vec![encoded, VmValue::dict(options)],
        );
        assert!(result.is_err(), "zstd_decode should reject output past cap");
    }

    #[test]
    fn tar_round_trip_preserves_mode() {
        let mut fields = crate::value::DictMap::new();
        fields.insert(crate::value::intern_key("path"), text("bin/run"));
        fields.insert(crate::value::intern_key("content"), text("echo hi"));
        fields.insert(crate::value::intern_key("mode"), VmValue::Int(0o755));

        let mut vm = vm();
        let archive = call(
            &mut vm,
            "tar_create",
            vec![VmValue::List(std::sync::Arc::new(vec![entry_value(
                fields,
            )]))],
        )
        .unwrap();
        let extracted = call(&mut vm, "tar_extract", vec![archive]).unwrap();
        let VmValue::List(entries) = extracted else {
            panic!("expected list");
        };
        assert_eq!(entries.len(), 1);
        let entry = entries[0].as_dict().unwrap();
        assert_eq!(entry["path"].display(), "bin/run");
        assert_eq!(entry["content"].as_bytes().unwrap(), b"echo hi");
        assert_eq!(entry["mode"].as_int(), Some(0o755));
    }
}