fix(codemode): harden Object.assign cycle checks

packages/codemode/src/interpreter/references.ts

@@ -45,19 +45,10 @@ export const isRuntimeReference = (value: unknown): boolean =>
   isCodeModeValue(value)
 
 function* childValues(value: object): Generator {
-  if (Array.isArray(value)) {
-    const length = value.length
-    for (let index = 0; index < length; index++) yield value[index]
-  } else {
-    yield* Object.values(value)
-  }
-  for (const symbol of Object.getOwnPropertySymbols(value)) {
-    if (
-      (symbol === AsyncIteratorSymbol || symbol === IteratorSymbol) &&
-      Object.prototype.propertyIsEnumerable.call(value, symbol)
-    ) {
-      yield Reflect.get(value, symbol)
-    }
+  for (const key of Reflect.ownKeys(value)) {
+    if (!Object.prototype.propertyIsEnumerable.call(value, key)) continue
+    if (typeof key === "symbol" && key !== AsyncIteratorSymbol && key !== IteratorSymbol) continue
+    yield Reflect.get(value, key)
   }
 }
 
@@ -100,9 +91,14 @@ export const containsOpaqueReference = (value: unknown): boolean => {
 }
 
 // Reject cycles before mutation so later boundary walks remain safe.
-export const rejectCircularInsertion = (container: object, value: unknown, label: string, node: AstNode): void => {
+export const rejectCircularInsertion = (
+  container: object,
+  value: unknown,
+  label: string,
+  node: AstNode,
+  seen = new Set<object>(),
+): void => {
   const pending: Array<Iterator<unknown>> = [[value].values()]
-  const seen = new Set<object>()
   while (pending.length > 0) {
     const next = pending.at(-1)!.next()
     if (next.done) {

packages/codemode/src/stdlib/object.ts

@@ -31,11 +31,6 @@ export const invokeObjectMethod = (name: string, args: Array<unknown>, node: Ast
     }
     return input as Record<string, unknown>
   }
-  const guardedSet = (out: Record<string, unknown>, key: string, item: unknown): void => {
-    if (isBlockedMember(key)) throw new InterpreterRuntimeError(`Property '${key}' is not available.`, node)
-    rejectCircularInsertion(out, item, "Object.assign result", node)
-    out[key] = item
-  }
   switch (name) {
     case "keys":
       return Object.keys(requireObject())
@@ -59,6 +54,16 @@ export const invokeObjectMethod = (name: string, args: Array<unknown>, node: Ast
         throw new InterpreterRuntimeError("Object.assign expects a data object target.", node)
       }
       const out = target as Record<string, unknown>
+      const seen = new Set<object>()
+      const guardedSet = (key: PropertyKey, item: unknown): void => {
+        if (typeof key === "string" && isBlockedMember(key))
+          throw new InterpreterRuntimeError(`Property '${key}' is not available.`, node)
+        rejectCircularInsertion(out, item, "Object.assign result", node, seen)
+        if (!Reflect.set(out, key, item))
+          throw new InterpreterRuntimeError(`Object.assign could not assign property '${String(key)}'.`, node).as(
+            "TypeError",
+          )
+      }
       for (const source of args.slice(1)) {
         if (source === null || source === undefined || isCodeModeValue(source)) continue
         if (typeof source !== "object" || Array.isArray(source)) {
@@ -66,14 +71,12 @@ export const invokeObjectMethod = (name: string, args: Array<unknown>, node: Ast
         }
         for (const key of Reflect.ownKeys(source)) {
           if (typeof key === "string") {
-            if (Object.prototype.propertyIsEnumerable.call(source, key)) guardedSet(out, key, Reflect.get(source, key))
+            if (Object.prototype.propertyIsEnumerable.call(source, key)) guardedSet(key, Reflect.get(source, key))
             continue
           }
           if (key !== AsyncIteratorSymbol && key !== IteratorSymbol) continue
           if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue
-          const item = Reflect.get(source, key)
-          rejectCircularInsertion(out, item, "Object.assign result", node)
-          Reflect.set(out, key, item)
+          guardedSet(key, Reflect.get(source, key))
         }
       }
       return out

packages/codemode/test/stdlib.test.ts

@@ -17,7 +17,7 @@
 import { describe, expect, test } from "bun:test"
 import { Effect, Schema } from "effect"
 import { CodeMode, Tool } from "../src/index.js"
-import { IteratorSymbol } from "../src/interpreter/model.js"
+import { AsyncIteratorSymbol, IteratorSymbol } from "../src/interpreter/model.js"
 import { invokeObjectMethod } from "../src/stdlib/object.js"
 
 // Standard-library value types: Date, RegExp, Map, Set. Programs use them as ordinary JS;
@@ -863,6 +863,49 @@ describe("stdlib integration", () => {
     expect(Object.hasOwn(target, "nested")).toBe(false)
   })
 
+  test("Object.assign cycle checks traverse sparse keys lazily", () => {
+    const target = {}
+    const reads: Array<boolean> = []
+    const nested = Object.defineProperties([], {
+      4294967294: { enumerable: true, value: target },
+      later: {
+        enumerable: true,
+        get() {
+          reads.push(true)
+          return null
+        },
+      },
+    })
+    expect(() => invokeObjectMethod("assign", [target, { nested }], { type: "CallExpression" })).toThrow(
+      "Object.assign result contains a circular value.",
+    )
+    expect(reads).toEqual([])
+  })
+
+  test("Object.assign stops after a supported symbol write fails", () => {
+    const previous = () => ({ done: true })
+    const target = Object.defineProperty({}, IteratorSymbol, { value: previous })
+    const reads: Array<boolean> = []
+    const source = Object.defineProperties(
+      {},
+      {
+        [IteratorSymbol]: { enumerable: true, value: () => ({ done: false }) },
+        [AsyncIteratorSymbol]: {
+          enumerable: true,
+          get() {
+            reads.push(true)
+            return () => ({ done: true })
+          },
+        },
+      },
+    )
+    expect(() => invokeObjectMethod("assign", [target, source], { type: "CallExpression" })).toThrow(
+      "Object.assign could not assign property",
+    )
+    expect(Reflect.get(target, IteratorSymbol)).toBe(previous)
+    expect(reads).toEqual([])
+  })
+
   test("Object.assign rejects direct and nested cycles", async () => {
     expect(
       await value(`
@@ -934,6 +977,23 @@ describe("stdlib integration", () => {
     ).toEqual([true, true, true, 2])
   })
 
+  test("Object.assign traverses shared aliases once", () => {
+    const reads: Array<boolean> = []
+    const shared = Object.defineProperty({}, "value", {
+      enumerable: true,
+      get() {
+        reads.push(true)
+        return 1
+      },
+    })
+    const target = {}
+    expect(invokeObjectMethod("assign", [target, { left: shared, right: shared }], { type: "CallExpression" })).toBe(
+      target,
+    )
+    expect(target).toEqual({ left: shared, right: shared })
+    expect(reads).toEqual([true])
+  })
+
   test("assignment resolves and reads its left side before evaluating the right side", async () => {
     expect(await value(`let x = 1; x += (x = 5); return x`)).toBe(6)
     expect(await value(`let i = 0; const values = [9]; values[i++] = i; return [values, i]`)).toEqual([[1], 1])