fix(parser): track bracket/brace depth in array subscript reader

The parser's subscript reader stopped at the first ] character without
tracking nesting. Expressions like ${arr[$RANDOM % ${#arr[@]}]} had
their subscript truncated at the ] inside ${#arr[@]}.

Now track [] bracket depth and ${} brace depth so nested expressions
are fully consumed before closing the subscript.

Closes #600

Author: chaliy

crates/bashkit/src/parser/mod.rs

@@ -2388,11 +2388,36 @@ impl<'a> Parser<'a> {
                         if chars.peek() == Some(&'[') {
                             chars.next(); // consume '['
                             let mut index = String::new();
+                            // Track nesting so nested ${...} containing
+                            // brackets (e.g. ${#arr[@]}) don't prematurely
+                            // close the subscript.
+                            let mut bracket_depth: i32 = 0;
+                            let mut brace_depth: i32 = 0;
                             while let Some(&c) = chars.peek() {
-                                if c == ']' {
+                                if c == ']' && bracket_depth == 0 && brace_depth == 0 {
                                     chars.next();
                                     break;
                                 }
+                                match c {
+                                    '[' => bracket_depth += 1,
+                                    ']' => bracket_depth -= 1,
+                                    '$' => {
+                                        index.push(chars.next().unwrap());
+                                        if chars.peek() == Some(&'{') {
+                                            brace_depth += 1;
+                                            index.push(chars.next().unwrap());
+                                            continue;
+                                        }
+                                        continue;
+                                    }
+                                    '{' => brace_depth += 1,
+                                    '}' => {
+                                        if brace_depth > 0 {
+                                            brace_depth -= 1;
+                                        }
+                                    }
+                                    _ => {}
+                                }
                                 index.push(chars.next().unwrap());
                             }
                             // Strip surrounding quotes from index (e.g. "foo" -> foo)
@@ -3045,4 +3070,44 @@ mod tests {
             "non-empty while body should be accepted"
         );
     }
+
+    /// Issue #600: Subscript reader must handle nested ${...} containing brackets.
+    #[test]
+    fn test_nested_expansion_in_array_subscript() {
+        // ${arr[$RANDOM % ${#arr[@]}]} must parse without error.
+        // The subscript contains ${#arr[@]} which has its own [ and ].
+        let parser = Parser::new("echo ${arr[$RANDOM % ${#arr[@]}]}");
+        let script = parser.parse().unwrap();
+        assert_eq!(script.commands.len(), 1);
+        if let Command::Simple(cmd) = &script.commands[0] {
+            assert_eq!(cmd.name.to_string(), "echo");
+            assert_eq!(cmd.args.len(), 1);
+            // The arg should contain an ArrayAccess with the full nested index
+            let arg = &cmd.args[0];
+            let has_array_access = arg.parts.iter().any(|p| {
+                matches!(
+                    p,
+                    WordPart::ArrayAccess { name, index }
+                    if name == "arr" && index.contains("${#arr[@]}")
+                )
+            });
+            assert!(
+                has_array_access,
+                "expected ArrayAccess with nested index, got: {:?}",
+                arg.parts
+            );
+        } else {
+            panic!("expected simple command");
+        }
+    }
+
+    /// Assignment with nested subscript must parse (previously caused fuel exhaustion).
+    #[test]
+    fn test_assignment_nested_subscript_parses() {
+        let parser = Parser::new("x=${arr[$RANDOM % ${#arr[@]}]}");
+        assert!(
+            parser.parse().is_ok(),
+            "assignment with nested subscript should parse"
+        );
+    }
 }