fix: harden shipping-code unwrap() flags at source (Hypatia code_safety)

Resolve the unwrap_without_check findings in shipping crates at source rather
than exempting them (#34 burn-down):

- stdlib.rs char_at: real bug — `idx < s.len()` is a BYTE guard but indexing
  used `chars().nth(idx)` (char index), so a multi-byte UTF-8 string could reach
  None and panic (CWE-754). Now char-indexed with a clean IndexOutOfBounds and a
  regression test (tests/integration_test.rs).
- string.rs int_to_string_radix: `char::from_digit` is provably total here
  (radix validated 2..=36, digit = num % radix < radix); document with `.expect`.
- ai.rs: reword a comment that contained a literal `.unwrap()` token and use
  `.expect(reason)` in a unit test (both were scanner false positives).

https://claude.ai/code/session_014uKLLhZiAGNayhLjdxGXUx

Author: claude

CHANGELOG.md

@@ -34,6 +34,8 @@ this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- fix(stdlib): `char_at` indexes by character, not byte — the old `idx < s.len()` byte guard could panic on multi-byte UTF-8 (CWE-754); now returns a clean `IndexOutOfBounds` + regression test
+- fix(string): document the `char::from_digit` totality invariant with `.expect` instead of `.unwrap()` in `int_to_string_radix`
 - fix(parser): accept comma/trailing-comma separators in `ai_model` attribute blocks, matching struct-field syntax (#84)
 - fix(my-fmt): borrow-after-move in `fs::write` output path (crate did not compile) (#84)
 - fix(my-lsp): non-exhaustive `CheckError` match — handle `ExpressionTooDeep` (crate did not compile) (#84)

crates/my-lang/lib/common/string.rs

@@ -213,7 +213,10 @@ pub fn int_to_string_radix(n: i64, radix: u32) -> Option<String> {
 
     while num > 0 {
         let digit = (num % radix as u64) as u32;
-        let c = char::from_digit(digit, radix).unwrap();
+        // Total: `radix` is validated to 2..=36 above and `digit = num % radix`
+        // is therefore `< radix <= 36`, so `from_digit` always returns `Some`.
+        let c = char::from_digit(digit, radix)
+            .expect("digit = num % radix < radix <= 36, so from_digit is total");
         result.insert(0, c);
         num /= radix as u64;
     }

crates/my-lang/lib/mylang/ai.rs

@@ -26,7 +26,7 @@ impl AiModelType {
     // Deliberately not implementing `std::str::FromStr`: this classifier is
     // infallible (every string maps to *some* variant -- unknown names fall
     // through to `Local`), so the trait's `Result<Self, Self::Err>` shape
-    // would just force callers to `.unwrap()` an `Infallible` everywhere.
+    // would just force callers to discharge an `Infallible` result everywhere.
     #[allow(clippy::should_implement_trait)]
     pub fn from_str(s: &str) -> Self {
         if s.starts_with("gpt-") || s.starts_with("o1") {
@@ -381,7 +381,12 @@ mod tests {
         conv.add_assistant("Hi there!");
 
         assert_eq!(conv.message_count(), 3);
-        assert_eq!(conv.last_message().unwrap().content, "Hi there!");
+        assert_eq!(
+            conv.last_message()
+                .expect("conversation has messages after the adds above")
+                .content,
+            "Hi there!"
+        );
     }
 
     #[test]

crates/my-lang/src/stdlib.rs

@@ -374,14 +374,17 @@ fn register_string_functions(define: &mut impl FnMut(String, Value)) {
             arity: 2,
             func: |args| match (&args[0], &args[1]) {
                 (Value::String(s), Value::Int(idx)) => {
-                    let idx = *idx as usize;
-                    if idx < s.len() {
-                        Ok(Value::String(s.chars().nth(idx).unwrap().to_string()))
-                    } else {
-                        Err(RuntimeError::IndexOutOfBounds {
-                            index: idx as i64,
-                            length: s.len(),
-                        })
+                    // Index by *character*, not byte: `s.len()` is the byte
+                    // length, so the old `idx < s.len()` guard let a multi-byte
+                    // UTF-8 string reach `chars().nth(idx) == None` and panic.
+                    // `try_from` also rejects negative indices. Length is
+                    // reported as the char count to match char-indexing.
+                    match usize::try_from(*idx).ok().and_then(|i| s.chars().nth(i)) {
+                        Some(c) => Ok(Value::String(c.to_string())),
+                        None => Err(RuntimeError::IndexOutOfBounds {
+                            index: *idx,
+                            length: s.chars().count(),
+                        }),
                     }
                 }
                 _ => Err(RuntimeError::TypeError {

tests/integration_test.rs

@@ -351,3 +351,25 @@ cache = true
     assert!(manifest.dependencies.contains_key("std"));
     assert_eq!(manifest.ai.default_model, Some("claude-3-opus".to_string()));
 }
+
+// Regression: `char_at` must index by character, not byte. "aé" is 2 chars but
+// 3 bytes; the old `idx < s.len()` (byte) guard let an in-byte-range / out-of-
+// char-range index reach `chars().nth(idx) == None` and panic (CWE-754). Now it
+// returns the correct char in range and a clean runtime error out of range.
+#[test]
+fn test_eval_char_at_is_char_indexed_not_byte() {
+    // In range: char index 1 of "aé" is the multi-byte 'é', not a byte split.
+    let in_range = r#"fn main() -> String { return char_at("aé", 1); }"#;
+    match eval(in_range) {
+        Ok(Value::String(s)) => assert_eq!(s, "é"),
+        other => panic!("expected \"é\", got {:?}", other),
+    }
+
+    // Out of char range but within byte length (2 chars, 3 bytes): index 2 must
+    // be a recoverable error, NOT a panic.
+    let oob = r#"fn main() -> String { return char_at("aé", 2); }"#;
+    assert!(
+        eval(oob).is_err(),
+        "char_at past the char count must error, not panic"
+    );
+}