fix: 全局构造器与内置对象属性改非枚举与规范对齐

crates/oxide_vm/src/bindings/bind_bigint.rs

@@ -1,6 +1,8 @@
 use std::sync::Arc;
 
-use crate::bindings::{apply_binding_table, bind_global_value, bind_well_known_data_property, configure_native_constructor};
+use crate::bindings::{
+    apply_binding_table, bind_global_value, bind_well_known_data_property, configure_native_constructor,
+};
 use oxide_kernel::kernel::{KernelCore, KernelSession};
 use oxide_types::object::{JsObject, PropAttributes};
 use oxide_types::value::JsValue;
@@ -58,9 +60,4 @@ pub fn bind_bigint(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
     bind_well_known_data_property(core, proto, 9, tag_value, PropAttributes::new(false, false, true));
 
     bind_global_value(core, global, "BigInt", JsValue::from_js_object(ctor_ptr));
-    // 全局 BigInt 属性描述符：{ writable: true, enumerable: false, configurable: true }。
-    let bigint_si = core.perm_interner().intern("BigInt").0;
-    if let Some(pos) = core.shape_forge().lookup_position(global.shape_id(), bigint_si) {
-        global.set_data_meta(pos, PropAttributes::new(true, false, true));
-    }
 }

crates/oxide_vm/src/bindings/bind_error.rs

@@ -50,6 +50,9 @@ fn bind_error_subtype_constructor(
     let global_shape = sh.make_shape(global.shape_id(), name_si);
     global.set_shape_id(global_shape);
     global.ensure_hash_props().push(JsValue::from_js_object(ctor_ptr));
+    // 全局子类型构造器槽位非枚举（规范全局构造器描述符约定）。
+    let global_pos = global.prop_vec_len().saturating_sub(1) as u32;
+    global.set_data_meta(global_pos, PropAttributes::new(true, false, true));
     global.bump_generation();
 }
 
@@ -77,6 +80,9 @@ pub fn bind_error(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
     let err_val = JsValue::from_js_object(session.builtin_world().error_constructor.as_ptr() as *mut JsObject);
     global.set_shape_id(err_shape);
     global.ensure_hash_props().push(err_val);
+    // 全局 Error 构造器槽位非枚举（规范 { writable:true, enumerable:false, configurable:true }）。
+    let err_pos = global.prop_vec_len().saturating_sub(1) as u32;
+    global.set_data_meta(err_pos, PropAttributes::new(true, false, true));
     global.bump_generation();
 
     bind_error_subtype_constructor(

crates/oxide_vm/src/bindings/bind_math.rs

@@ -2,7 +2,7 @@ use std::sync::Arc;
 
 use oxide_kernel::bind_methods;
 use oxide_kernel::kernel::{KernelCore, KernelSession};
-use oxide_types::object::JsObject;
+use oxide_types::object::{JsObject, PropAttributes};
 use oxide_types::value::JsValue;
 
 /// 把 Math 单例对象及其方法（abs/floor/max/random 等）绑定到 global。
@@ -70,6 +70,10 @@ pub fn bind_math(core: &Arc<KernelCore>, session: &KernelSession, global: &mut J
         let sh_c = core.shape_forge().as_ref().make_shape(math.shape_id(), si);
         math.set_shape_id(sh_c);
         math.ensure_hash_props().push(JsValue::float(val));
+        // Math 常量描述符：{ writable:false, enumerable:false, configurable:false }，
+        // 保证 Object.keys(Math) 为空（与 Number 常量同款收口）。
+        let pos = math.prop_vec_len().saturating_sub(1) as u32;
+        math.set_data_meta(pos, PropAttributes::new(false, false, false));
     }
 
     let si_m = core.perm_interner().intern("Math").0;
@@ -77,5 +81,8 @@ pub fn bind_math(core: &Arc<KernelCore>, session: &KernelSession, global: &mut J
     let m_val = JsValue::from_js_object(session.builtin_world().math_object.as_ptr() as *mut JsObject);
     global.set_shape_id(m_shape);
     global.ensure_hash_props().push(m_val);
+    // 全局 Math 槽位非枚举（规范全局命名空间对象属性均 enumerable:false）。
+    let pos = global.prop_vec_len().saturating_sub(1) as u32;
+    global.set_data_meta(pos, PropAttributes::new(true, false, true));
     global.bump_generation();
 }

crates/oxide_vm/src/bindings/bind_string.rs

@@ -3,7 +3,7 @@ use std::sync::Arc;
 use crate::bindings::{apply_binding_table, configure_native_constructor};
 use oxide_kernel::builtin::StringMethods;
 use oxide_kernel::kernel::{KernelCore, KernelSession};
-use oxide_types::object::JsObject;
+use oxide_types::object::{JsObject, PropAttributes};
 use oxide_types::value::JsValue;
 
 /// 把 String 构造器与原型方法绑定到 global。
@@ -77,5 +77,8 @@ pub fn bind_string(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
     let str_val = JsValue::from_js_object(session.builtin_world().string_constructor.as_ptr() as *mut JsObject);
     global.set_shape_id(str_shape);
     global.ensure_hash_props().push(str_val);
+    // 全局构造器槽位非枚举（规范 { writable:true, enumerable:false, configurable:true }）。
+    let pos = global.prop_vec_len().saturating_sub(1) as u32;
+    global.set_data_meta(pos, PropAttributes::new(true, false, true));
     global.bump_generation();
 }

crates/oxide_vm/src/bindings/mod.rs

@@ -74,6 +74,10 @@ macro_rules! bind_constructor {
         } else {
             $global.push_prop(val);
         }
+        // 全局构造器槽位：规范描述符 { writable:true, enumerable:false, configurable:true }，
+        // 不设 meta 时默认全枚举会泄漏进 Object.keys(globalThis) / for-in。
+        let global_pos = $global.prop_vec_len().saturating_sub(1) as u32;
+        $global.set_data_meta(global_pos, oxide_types::object::PropAttributes::new(true, false, true));
         let ctor = unsafe { &mut *$ctor_ptr };
         let ptr: *const () = ($ctor_fn as fn(&mut $crate::vm::Vm, &[u8]) -> oxide_runtime_api::NativeResult) as *const ();
         ctor.set_native_fn(Some(unsafe { oxide_types::object::NativeFnPtr::from_raw(ptr) }));
@@ -346,6 +350,10 @@ pub(crate) fn bind_global_value(core: &Arc<KernelCore>, global: &mut JsObject, n
     let shape = core.shape_forge().make_shape(global.shape_id(), si);
     global.set_shape_id(shape);
     global.ensure_hash_props().push(value);
+    // 内置全局值统一非枚举：描述符 { writable:true, enumerable:false, configurable:true }，
+    // 与构造器/命名空间对象（Math/JSON/Reflect/Temporal 等）规范一致。
+    let pos = global.prop_vec_len().saturating_sub(1) as u32;
+    global.set_data_meta(pos, PropAttributes::new(true, false, true));
     global.bump_generation();
 }