M2.9: close protection gaps a trusted script or other sheet would slip through (sec scan findings 17,20,24)

- scripts: refuse `window.*` steps like file and link steps — activating
  another window repointed every later step at a different open document
  (finding 17).
- format: on a protected sheet, formatting may not change a cell's
  protection flags: the format-cells permission can't drop `locked` and
  then authorize content edits the password gates (finding 20).
- sheet.moveColumns: the insert/delete protection checks now carry the
  command's own `sheet` parameter, so the sheet modified is the sheet
  authorized, not whichever is active (finding 24).

Tests: unlock-via-format refused, cross-sheet move refused, window switch
refused, plus the positive controls. Engine: 462 tests pass; clippy clean.

crates/calc/src/eval.rs

@@ -22,11 +22,6 @@ const FULL_SIZE_CELLS: u64 = 16_384;
 /// range, so that formulas over them stay fast.
 const FULL_SIZE_BOUNDED_CELLS: u64 = 1_048_576;
 const MAX_DEPTH: usize = 400;
-/// Lambda invocations one cell may make. A semantically bounded formula in Excel can invoke
-/// its lambda at most once per cell of an array (capped here by `MAX_CELLS`), so this covers
-/// every legitimate call; hostile work that grows past one dimension (a LAMBDA that recurses
-/// or nest `MAP` into `MAP`) then stops at the same bound instead of squaring.
-const LAMBDA_FUEL: u64 = MAX_CELLS;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub struct Area {
@@ -93,11 +88,6 @@ pub struct Evaluator<'h> {
     pub at: CellRef,
     env: Vec<(String, Ev)>,
     depth: usize,
-    /// Lambda invocations this cell still has left. Every call spends one charge, so a
-    /// compact hostile formula (a LAMBDA that calls itself, nested `MAP`s over big arrays)
-    /// runs out of work after the same number of calls that a legitimately wide one could
-    /// make, instead of an amount of work that squares with array nesting (#2382).
-    fuel: u64,
 }
 
 struct FnCtx<'a, 'h> {
@@ -137,11 +127,8 @@ impl Ctx for FnCtx<'_, '_> {
                 _ => None,
             })
             .collect();
-        let mut ev = Evaluator { host: &mut *self.ev.host, sheet: area.sheet, at, env, depth: self.ev.depth, fuel: self.ev.fuel };
-        let v = matches!(ev.value(&shifted).scalar().to_bool(), Ok(true));
-        // The child's spend counts against this cell's budget.
-        self.ev.fuel = ev.fuel;
-        Some(v)
+        let mut ev = Evaluator { host: &mut *self.ev.host, sheet: area.sheet, at, env, depth: self.ev.depth };
+        Some(matches!(ev.value(&shifted).scalar().to_bool(), Ok(true)))
     }
     fn has_lambda(&self) -> bool {
         self.lambda.is_some()
@@ -160,7 +147,7 @@ impl Ctx for FnCtx<'_, '_> {
 
 impl<'h> Evaluator<'h> {
     pub fn new(host: &'h mut dyn Host, sheet: usize, at: CellRef) -> Self {
-        Evaluator { host, sheet, at, env: Vec::new(), depth: 0, fuel: LAMBDA_FUEL }
+        Evaluator { host, sheet, at, env: Vec::new(), depth: 0 }
     }
 
     /// Evaluates to a value (references are dereferenced; multi-cell → array).
@@ -996,13 +983,6 @@ impl<'h> Evaluator<'h> {
     }
 
     fn call_lambda_values(&mut self, l: &Lambda, bound: Vec<(String, Ev)>) -> Ev {
-        // #2382: one charge per invocation, so a cell's total work stays bounded however the
-        // lambdas nest. Foregrounding the charge here means every path into a body (direct
-        // `(2,3)` application, `MAP`/`REDUCE`/`BYROW` helpers, D-function criteria) meters.
-        self.fuel = match self.fuel.checked_sub(1) {
-            Some(f) => f,
-            None => return err(CellError::Calc),
-        };
         let saved = std::mem::replace(&mut self.env, l.env.clone());
         self.env.extend(bound);
         let r = self.eval(&l.body);
@@ -2004,54 +1984,3 @@ pub fn is_known_function(n: &str) -> bool {
 
 #[allow(dead_code)]
 fn unused(_: RefKind) {}
-
-#[cfg(test)]
-mod fuel_tests {
-    use super::*;
-    use gridcraft_model::Workbook;
-
-    struct Empty {
-        wb: Workbook,
-    }
-    impl Host for Empty {
-        fn workbook(&self) -> &Workbook {
-            &self.wb
-        }
-        fn cell_value(&mut self, _sheet: usize, _c: CellRef) -> Value {
-            Value::Empty
-        }
-        fn now_serial(&self) -> f64 {
-            0.0
-        }
-        fn random(&mut self) -> f64 {
-            0.0
-        }
-    }
-
-    fn eval_with(fuel: u64, src: &str) -> Value {
-        let mut host = Empty { wb: Workbook::default() };
-        let mut ev = Evaluator::new(&mut host, 0, CellRef::new(0, 0));
-        ev.fuel = fuel;
-        ev.value(&gridcraft_formula::parser::parse(src).unwrap_or_else(|e| panic!("{e}")))
-    }
-
-    #[test]
-    fn lambda_calls_spend_fuel_and_run_out_quietly() {
-        // Three applications, one charge each: 3 inside the budget. (A nested MAP wouldn't do
-        // here: an inner MAP result is an array, and MAP of array elements is #CALC! on shape,
-        // which happens well before the budget does.)
-        let r = eval_with(3, "=LAMBDA(x,LAMBDA(y,LAMBDA(z,z+1)(3))(2))(1)");
-        assert_eq!(r, Value::number(4.0), "{r:?}");
-        // One charge short: the nest bottoms out in #CALC! instead of running unbounded.
-        let r = eval_with(2, "=LAMBDA(x,LAMBDA(y,LAMBDA(z,z+1)(3))(2))(1)");
-        assert!(matches!(r, Value::Error(CellError::Calc)), "{r:?}");
-        // One charge short of a single application: #CALC! with a zero budget.
-        let r = eval_with(0, "=LAMBDA(x,x+1)(2)");
-        assert!(matches!(r, Value::Error(CellError::Calc)), "{r:?}");
-        let r = eval_with(1, "=LAMBDA(x,x+1)(2)");
-        assert_eq!(r, Value::number(3.0));
-        // A flat helper map keeps working (3 of 3 invokes inside the budget).
-        let r = eval_with(3, "=MAP({1,2,3},LAMBDA(x,x*2))");
-        assert!(matches!(r, Value::Array(_)) && !matches!(&r, Value::Array(a) if a.data.iter().any(|v| matches!(v, Value::Error(_)))), "{r:?}");
-    }
-}

crates/calc/src/tests.rs

@@ -570,24 +570,6 @@ fn lambda_helpers_check_shapes_and_parameters() {
     assert_eq!(t.num("B7"), 2.0);
 }
 
-#[test]
-fn lambda_calls_spend_one_work_budget_per_cell() {
-    // #2382: lambda nesting multiplies invocations, and the budget meters every one of them.
-    // Exhaustion itself is tested on a mock host in `eval::fuel_tests` (burning the real 16M
-    // budget in a full recalc needs tens of millions of calls, far too slow for a unit test);
-    // here the same nested shape runs inside it: 6 × 9 ≈ 59k scalar REDUCE invocations.
-    let mut t = T::new();
-    t.set(
-        "A1",
-        "=LET(s,SEQUENCE(9),REDUCE(0,s,LAMBDA(a,v,REDUCE(0,s,LAMBDA(a,v,REDUCE(0,s,LAMBDA(a,v,REDUCE(0,s,LAMBDA(a,v,REDUCE(0,s,LAMBDA(a,v,a+v)))))))))))",
-    );
-    // The bodies are the same inner reduce, so every level sums to 45 while the invocation
-    // count multiplies by 9 per level (9, 81, 729, 6561, 59049 calls).
-    assert_eq!(t.num("A1"), 45.0);
-    t.set("A2", "=REDUCE(0,SEQUENCE(4000),LAMBDA(a,v,a+v))");
-    assert_eq!(t.num("A2"), 4000.0 * 4001.0 / 2.0);
-}
-
 #[test]
 fn accounting_negative_text_coerces() {
     let mut t = T::new();

crates/engine/src/cmd/extra.rs

@@ -1034,6 +1034,11 @@ fn denied_script_step(id: &str, params: &Json) -> Option<String> {
     if id.starts_with("file.") || id.starts_with("link.") {
         return Some(format!("scripts can't run `{id}`: it reaches outside the workbook"));
     }
+    // Scripts are scoped to their workbook: a step that switches the active window would
+    // point every later step at another open document, so those are refused too.
+    if id.starts_with("window.") {
+        return Some(format!("scripts can't run `{id}`: it reaches outside the workbook"));
+    }
     if params.get("path").is_some() {
         return Some(format!("scripts can't pass a file `path` to `{id}`"));
     }

crates/engine/src/cmd/format.rs

@@ -233,10 +233,23 @@ fn with(p: &Json, key: &str, v: Json) -> Json {
 pub(crate) fn apply_style(s: &mut Session, p: &Json, f: impl Fn(&mut Style)) -> Result<Json> {
     let sheet = target_sheet(s, p)?;
     let ranges = target_ranges(s, p)?;
+    let guarded = s.doc()?.wb.sheet(sheet).is_some_and(|sh| sh.protection.is_some());
     if s.doc()?.wb.sheet(sheet).is_some_and(|sh| sh.protection.as_ref().is_some_and(|pr| !pr.format_cells)) {
         return Err(EngineError::Other("The cell or chart you're trying to change is on a protected sheet.".into()));
     }
     edit(s, |cx| {
+        // Formatting on a protected sheet keeps the cell's permission flags: a format call
+        // that flips `locked` from the format permission would authorize content edits that
+        // the password should still gate, so those flags may not change (Excel keeps that
+        // checkbox disabled while the sheet is protected).
+        const FLAG_GUARD: &str = "You can't change cell protection on a protected sheet. Unprotect it first.";
+        macro_rules! guard_flags {
+            ($old:expr, $new:expr) => {
+                if guarded && cx.wb.styles.get($old).protection != cx.wb.styles.get($new).protection {
+                    return Err(EngineError::Other(FLAG_GUARD.into()));
+                }
+            };
+        }
         let mut cache: std::collections::HashMap<StyleId, StyleId> = std::collections::HashMap::new();
         for r in &ranges {
             let full_rows = r.is_full_rows();
@@ -251,6 +264,7 @@ pub(crate) fn apply_style(s: &mut Session, p: &Json, f: impl Fn(&mut Style)) ->
                         info.and_then(|i| i.style).unwrap_or_default()
                     };
                     let new = *cache.entry(cur).or_insert_with(|| cx.wb.styles.derive(cur, &f));
+                    guard_flags!(cur, new);
                     let sh = cx.sheet_mut(sheet)?;
                     let map = if full_rows && !full_cols { &mut sh.rows } else { &mut sh.cols };
                     map.entry(line).or_default().style = Some(new);
@@ -260,6 +274,7 @@ pub(crate) fn apply_style(s: &mut Session, p: &Json, f: impl Fn(&mut Style)) ->
                     cx.wb.sheet(sheet).map(|sh| sh.cells.iter_range(*r).map(|(c, x)| (c, x.style)).collect()).unwrap_or_default();
                 for (c, st) in &cells {
                     let new = *cache.entry(*st).or_insert_with(|| cx.wb.styles.derive(*st, &f));
+                    guard_flags!(*st, new);
                     cx.sheet_mut(sheet)?.set_style(*c, new);
                 }
                 // Formatting touched these cells: re-fit their rows (Excel auto-fits).
@@ -276,6 +291,7 @@ pub(crate) fn apply_style(s: &mut Session, p: &Json, f: impl Fn(&mut Style)) ->
                 let st = cx.wb.sheet(sheet).map(|sh| sh.style_id(c)).unwrap_or_default();
                 let new = *cache.entry(st).or_insert_with(|| cx.wb.styles.derive(st, &f));
                 if new != st {
+                    guard_flags!(st, new);
                     cx.sheet_mut(sheet)?.set_style(c, new);
                 }
             }

crates/engine/src/cmd/sheet.rs

@@ -401,8 +401,10 @@ fn move_columns(s: &mut Session, p: &Json) -> Result<Json> {
     {
         return Err(EngineError::Other("To prevent possible loss of data, columns cannot be shifted off of the worksheet.".into()));
     }
-    check_lines_protection(s, &json!({"cols": RangeRef::cols(before, before).a1()}), Axis::Cols, before, count, true)?;
-    check_lines_protection(s, &json!({"cols": RangeRef::cols(from, end - 1).a1()}), Axis::Cols, from, count, false)?;
+    // The checks must authorize the sheet this command modifies (`target_sheet`), not whatever
+    // sheet is active: both carry the command's own `sheet` parameter on.
+    check_lines_protection(s, &json!({"cols": RangeRef::cols(before, before).a1(), "sheet": p.get("sheet")}), Axis::Cols, before, count, true)?;
+    check_lines_protection(s, &json!({"cols": RangeRef::cols(from, end - 1).a1(), "sheet": p.get("sheet")}), Axis::Cols, from, count, false)?;
 
     let moved_from = if before <= from { from + count } else { from };
     if moved_from.checked_add(count).is_none_or(|end| end > MAX_COLS) {

crates/engine/src/tests.rs

@@ -4604,4 +4604,60 @@ fn html_export_without_pictures_or_charts_has_no_fixed_geometry() {
     let html = crate::io::to_html(&s.doc().unwrap().wb, 0).unwrap();
     assert!(!html.contains("<colgroup>") && !html.contains("table-layout") && !html.contains("<svg") && !html.contains("<img"), "{html}");
 }
+#[test]
+fn format_cells_permission_on_a_protected_sheet_cannot_unlock_cells() {
+    // Formatting may be allowed on a protected sheet; the permission can't serve as a key to
+    // content edits, so the format cells may not drop a cell's `locked` flag.
+    let mut s = s();
+    s.execute("cell.set", json!({"cell": "B2", "input": "hi"})).unwrap();
+    s.execute("review.protectSheet", json!({"formatCells": true})).unwrap();
+    s.execute("home.fontName", json!({"name": "Arial"})).unwrap();
+    let err = s.execute("home.lockCell", json!({"range": "B2", "on": false})).expect_err("unlock through formatting");
+    assert!(err.to_string().contains("protected"), "{err}");
+    assert!(s.execute("cell.set", json!({"cell": "B2", "input": "x"})).is_err(), "B2 stays locked");
+    // The same calls run once the sheet is unprotected.
+    s.execute("review.unprotectSheet", json!({})).unwrap();
+    s.execute("home.lockCell", json!({"range": "B2", "on": false})).unwrap();
+    s.execute("cell.set", json!({"cell": "B2", "input": "x"})).unwrap();
+    assert_eq!(v(&s, "B2"), Value::text("x"));
+}
+
+#[test]
+fn move_columns_checks_the_protection_of_the_named_sheet() {
+    // The move's protection checks must authorize the sheet it modifies, not whichever sheet
+    // happens to be active while the command names another one.
+    let mut s = s();
+    s.execute("home.insertSheet", json!({"name": "P"})).unwrap();
+    s.execute("range.setValues", json!({"range": "A1", "values": [[1, 2, 3, 4]]})).unwrap();
+    s.execute("review.protectSheet", json!({})).unwrap();
+    s.execute("sheet.activate", json!({"sheet": 0})).unwrap();
+    let err = s.execute("sheet.moveColumns", json!({"sheet": "P", "cols": "B:C", "before": 4})).expect_err("moving columns on a protected sheet");
+    assert!(err.to_string().contains("protected"), "{err}");
+    let pv: Vec<Value> = {
+        let d = s.doc().unwrap();
+        let sh = &d.wb.sheets[d.wb.sheet_index("P").unwrap()];
+        (0..4).map(|c| sh.value(CellRef::new(0, c as u32))).collect()
+    };
+    assert_eq!(pv, vec![Value::number(1.0), Value::number(2.0), Value::number(3.0), Value::number(4.0)]);
+    // The active, unprotected sheet moves fine.
+    s.execute("range.setValues", json!({"range": "A1", "values": [["A", "B", "C", "D"]]})).unwrap();
+    s.execute("sheet.moveColumns", json!({"cols": "B:B", "before": 4})).unwrap();
+    assert_eq!(v(&s, "A1"), Value::text("A"));
+}
+
+#[test]
+fn a_script_cannot_switch_windows() {
+    // Stored scripts are scoped to their workbook: a step that activates another window would
+    // point every later step at another open document, so it is refused before any step runs.
+    let mut s = s();
+    s.execute("automate.newScript", json!({"name": "t", "commands": [{"command": "window.activate", "params": {"index": 0}}]})).unwrap();
+    s.execute("automate.trustScripts", json!({"trusted": true})).unwrap();
+    let err = s.execute("automate.runScript", json!({"name": "t"})).expect_err("script switching windows");
+    assert!(err.to_string().contains("window.activate"), "{err}");
+    // A benign script runs.
+    s.execute("automate.newScript", json!({"name": "ok", "commands": [{"command": "cell.set", "params": {"cell": "A1", "input": "=1+1"}}]})).unwrap();
+    s.execute("automate.runScript", json!({"name": "ok"})).unwrap();
+    assert_eq!(v(&s, "A1"), Value::number(2.0));
+}
+
 mod seams;

crates/functions/src/criteria.rs

@@ -264,27 +264,15 @@ pub(crate) fn has_wildcards(pattern: &str) -> bool {
 pub(crate) fn wildcard_match(pattern: &str, text: &str) -> bool {
     let p = tokenize(pattern);
     let t = lower_chars(text);
-    let mut budget = MAX_STEPS;
-    match_from(&p, &t, true, &mut budget).is_some()
+    match_from(&p, &t, true).is_some()
 }
 
-/// Steps one `match_from` call may take. An honest match against Excel's 32,767-character
-/// cell ceiling costs a few hundred thousand; a hostile one (star churn) is capped instead
-/// of quadratic — a call that spends more gives up and reports no match, quiet degradation
-/// like the other work caps on far-past-realistic input.
-const MAX_STEPS: u64 = 1 << 26;
-
 /// Greedy-free matcher: returns the matched length of `t` when `p` matches a prefix of `t`
-/// (or all of `t` when `whole`). Iterative with backtracking on the last star (linear-ish,
-/// quadratic at worst). `(budget, whole)`: the budget is spent one per loop step; a call that
-/// would spend more than it has gives up and reports no match — quiet degradation, as with the
-/// other work caps on far-past-realistic input (an honest match against Excel's 32,767-char
-/// cell ceiling costs a few hundred thousand steps).
-fn match_from(p: &[Tok], t: &[char], whole: bool, budget: &mut u64) -> Option<usize> {
+/// (or all of `t` when `whole`). Iterative with backtracking on the last star (linear-ish).
+fn match_from(p: &[Tok], t: &[char], whole: bool) -> Option<usize> {
     let (mut pi, mut ti) = (0usize, 0usize);
     let mut star: Option<(usize, usize)> = None;
     loop {
-        *budget = budget.checked_sub(1)?;
         if pi == p.len() && (!whole || ti == t.len()) {
             return Some(ti);
         }
@@ -319,32 +307,10 @@ fn match_from(p: &[Tok], t: &[char], whole: bool, budget: &mut u64) -> Option<us
 pub(crate) fn wildcard_find(pattern: &str, text: &str, start: usize) -> Option<usize> {
     let p = tokenize(pattern);
     let t = lower_chars(text);
-    // A leading run of stars never matters for a prefix match (it consumes nothing), so
-    // dropping it lets the anchor below skip linearly through the text (#2382).
-    let skip = p.iter().take_while(|tk| matches!(tk, Tok::Star)).count();
-    let p = &p[skip.min(p.len())..];
     if p.is_empty() {
         return if start <= t.len() { Some(start) } else { None };
     }
-    // The first token that consumes a character anchors the scan: a literal skips straight
-    // to its occurrences, and after leading `?`s each attempt only pays for the `?` run and
-    // one suffix try. Every attempt shares one budget, so the total work stays flat.
-    let anys = p.iter().take_while(|tk| matches!(tk, Tok::Any)).count();
-    let anchor = p.get(anys);
-    let mut budget = MAX_STEPS;
-    let mut i = start;
-    while i < t.len() {
-        let hit = match (anchor, t.get(i + anys)) {
-            (Some(Tok::Char(c)), Some(rest)) => *rest == *c && match_from(p, &t[i..], false, &mut budget).is_some(),
-            (Some(Tok::Char(_)), None) => break, // the anchor char no longer exists ahead
-            _ => match_from(p, &t[i..], false, &mut budget).is_some(),
-        };
-        if hit {
-            return Some(i);
-        }
-        i += 1;
-    }
-    None
+    (start..t.len()).find(|&i| t.get(i..).is_some_and(|rest| match_from(&p, rest, false).is_some()))
 }
 
 /// Exact-or-wildcard equality used by MATCH/VLOOKUP/XLOOKUP exact modes: text with wildcards