hecks 3.5.0 → 3.7.0

data/rust/host/src/fuzz_support.rs

@@ -0,0 +1,165 @@
+//! Shared pieces of the boundary fuzz tests that sit beside `api`, `server`, `web`, `auth`,
+//! `expr_json` and `ir`: a seeded generator, a guard that fails on a panic or a hang, and
+//! generators for hostile text and JSON. Std-only, so a failing case is named by its seed alone.
+//!
+//! Run more seeds with `HOST_FUZZ_SEEDS=2000 cargo test fuzz`.
+
+use serde_json::{json, Map, Value};
+use std::sync::mpsc;
+use std::time::Duration;
+
+/// xorshift64*: no dependency, and the seed is the whole reproduction.
+pub(crate) struct Rng(u64);
+
+impl Rng {
+    pub(crate) fn new(seed: u64) -> Self {
+        Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1)
+    }
+
+    pub(crate) fn next(&mut self) -> u64 {
+        self.0 ^= self.0 >> 12;
+        self.0 ^= self.0 << 25;
+        self.0 ^= self.0 >> 27;
+        self.0.wrapping_mul(0x2545_F491_4F6C_DD1D)
+    }
+
+    pub(crate) fn below(&mut self, n: usize) -> usize {
+        (self.next() % n.max(1) as u64) as usize
+    }
+
+    pub(crate) fn chance(&mut self, one_in: usize) -> bool {
+        self.below(one_in) == 0
+    }
+
+    pub(crate) fn pick<'a, T>(&mut self, items: &'a [T]) -> &'a T {
+        &items[self.below(items.len())]
+    }
+}
+
+/// How many seeds each fuzz test runs.
+pub(crate) fn seeds() -> u64 {
+    std::env::var("HOST_FUZZ_SEEDS").ok().and_then(|v| v.parse().ok()).unwrap_or(200)
+}
+
+/// The most a single guarded case may take before it counts as a hang.
+pub(crate) const LIMIT: Duration = Duration::from_secs(20);
+
+/// Runs `f` on a thread with a 2 MiB stack (a tokio worker's default) and returns its answer.
+/// A panic or a missed `LIMIT` fails the test and names `label`; a stack overflow aborts the
+/// whole binary, which fails it too.
+pub(crate) fn guarded<T: Send + 'static>(label: &str, f: impl FnOnce() -> T + Send + 'static) -> T {
+    let (tx, rx) = mpsc::channel();
+    let handle = std::thread::Builder::new()
+        .stack_size(2 * 1024 * 1024)
+        .spawn(move || {
+            let _ = tx.send(f());
+        })
+        .expect("spawn a guarded thread");
+    match rx.recv_timeout(LIMIT) {
+        Ok(value) => {
+            handle.join().expect("guarded thread joined");
+            value
+        }
+        Err(mpsc::RecvTimeoutError::Timeout) => panic!("{label}: no answer within {LIMIT:?} (hang)"),
+        Err(mpsc::RecvTimeoutError::Disconnected) => {
+            let panic = handle.join().expect_err("a guarded thread that sent nothing must have panicked");
+            let message = panic.downcast_ref::<String>().cloned().or_else(|| panic.downcast_ref::<&str>().map(|s| s.to_string()));
+            panic!("{label}: panicked: {}", message.unwrap_or_default())
+        }
+    }
+}
+
+/// Pieces that break naive text handling: multi-byte characters next to ASCII delimiters (the
+/// shape that slices through a char boundary), control characters, NUL, bidi marks, astral
+/// planes, combining marks, percent signs, and every JSON/URL/cookie delimiter.
+const PIECES: &[&str] = &[
+    "a", "Z", "0", "9", " ", "\"", "'", "\\", "/", "%", "%4", "%41", "%zz", "%+1", "+", "=", "&", ";", "?", "#", ".", "..", "-", "_", ":", ",", "{", "}", "[", "]",
+    "\n", "\t", "\r", "\u{0}", "\u{1f}", "\u{7f}", "é", "ü", "日本", "🍕", "\u{10FFFF}", "\u{200B}", "\u{FEFF}", "\u{202E}", "\u{FFFD}", "e\u{301}", "__", "::",
+    "<script>", "../", "%0d%0a", "id", "name", "value", "sort", "direction", "desc",
+];
+
+pub(crate) fn random_text(rng: &mut Rng) -> String {
+    (0..rng.below(10)).map(|_| *rng.pick(PIECES)).collect()
+}
+
+/// Edge-case numbers a JSON consumer is likely to mishandle, as JSON values.
+pub(crate) fn edge_number(rng: &mut Rng) -> Value {
+    let edges: Vec<Value> = vec![
+        json!(0),
+        json!(-1),
+        json!(1),
+        json!(i64::MAX),
+        json!(i64::MIN),
+        json!(u64::MAX),
+        json!(0.0),
+        json!(-0.0),
+        json!(0.1),
+        json!(1e308),
+        json!(-1e308),
+        json!(5e-324),
+        json!(1.7976931348623157e308),
+        json!(9007199254740993_i64),
+    ];
+    rng.pick(&edges).clone()
+}
+
+/// A JSON value of any shape, to a bounded depth, favoring the wrong type for whatever reads it.
+pub(crate) fn random_value(rng: &mut Rng, depth: usize) -> Value {
+    let leaf_only = depth >= 3;
+    match rng.below(if leaf_only { 6 } else { 8 }) {
+        0 => Value::Null,
+        1 => Value::Bool(rng.chance(2)),
+        2 => edge_number(rng),
+        3 | 4 => Value::String(random_text(rng)),
+        5 => json!(rng.next() as i64 >> rng.below(63)),
+        6 => Value::Array((0..rng.below(4)).map(|_| random_value(rng, depth + 1)).collect()),
+        _ => {
+            let mut map = Map::new();
+            for _ in 0..rng.below(4) {
+                map.insert(random_text(rng), random_value(rng, depth + 1));
+            }
+            Value::Object(map)
+        }
+    }
+}
+
+/// `text` with a few random edits, on char boundaries.
+pub(crate) fn mutate_text(rng: &mut Rng, text: &str) -> String {
+    let mut chars: Vec<char> = text.chars().collect();
+    const JUNK: &[char] = &['{', '}', '[', ']', '"', '\\', ',', ':', '-', '+', '.', 'e', '0', '9', 'n', 't', ' ', '\u{0}', '\n', '%', 'é', '🍕'];
+    for _ in 0..1 + rng.below(3) {
+        if chars.is_empty() {
+            chars.push(*rng.pick(JUNK));
+            continue;
+        }
+        let at = rng.below(chars.len());
+        match rng.below(4) {
+            0 => {
+                chars.remove(at);
+            }
+            1 => chars.insert(at, *rng.pick(JUNK)),
+            2 => chars[at] = *rng.pick(JUNK),
+            _ => chars.truncate(at),
+        }
+    }
+    chars.into_iter().collect()
+}
+
+/// Raw bytes, valid UTF-8 or not: random, mutated JSON, truncated mid-character, or hostile.
+pub(crate) fn random_bytes(rng: &mut Rng) -> Vec<u8> {
+    match rng.below(6) {
+        0 => (0..rng.below(64)).map(|_| rng.next() as u8).collect(),
+        1 => {
+            let valid = random_value(rng, 0).to_string();
+            mutate_text(rng, &valid).into_bytes()
+        }
+        2 => {
+            let mut bytes = random_value(rng, 0).to_string().into_bytes();
+            bytes.extend_from_slice(&[0xff, 0xfe, 0xc0, 0x80, 0xf0, 0x9f]);
+            bytes
+        }
+        3 => "{\"a\":\"🍕\"}".as_bytes()[..rng.below(10)].to_vec(),
+        4 => random_text(rng).into_bytes(),
+        _ => random_value(rng, 0).to_string().into_bytes(),
+    }
+}

data/rust/host/src/ir.rs

@@ -731,3 +731,7 @@ mod tests {
         assert!(refuse_unsupported_persistence_adapters(&ir).is_ok());
     }
 }
+
+#[cfg(test)]
+#[path = "boundary_fuzz/ir.rs"]
+mod boundary_fuzz;

data/rust/host/src/main.rs

@@ -8,6 +8,11 @@ mod checkout;
 mod dispatch;
 mod expr_json;
 mod field_hints;
+#[cfg(test)]
+mod fuzz_support;
+#[cfg(test)]
+#[path = "boundary_fuzz/expr_json.rs"]
+mod expr_json_fuzz;
 mod ir;
 mod journal;
 mod lambda_client;
@@ -69,10 +74,10 @@ async fn main() -> Result<(), Error> {
                 .fetch_secret_string(&secret_arn)
                 .await
                 .map_err(|e| format!("fetching DB_SECRET_ARN from Secrets Manager: {e:#}"))?;
-            let password = secrets::extract_field(&secret_json, "password")?;
-            // Literal, unescaped, no percent-encoding -- parse_database_url
-            // below never percent-decodes the password segment either way.
-            format!("postgres://postgres:{password}@{db_host}:5432/{db_name}")
+            // The user and port come from the secret too (a client sharing an instance logs in as
+            // its own role); the password goes in literal, since parse_database_url below never
+            // percent-decodes it.
+            secrets::database_url(&secret_json, &db_host, &db_name)?
         }
         Err(_) => std::env::var("DATABASE_URL")
             .map_err(|_| "either DB_SECRET_ARN (+ DB_HOST/DB_NAME) or DATABASE_URL is required")?,

data/rust/host/src/secrets.rs

@@ -75,10 +75,54 @@ pub fn extract_field(secret_json: &str, field: &str) -> Result<String, String> {
         .ok_or_else(|| format!("secret's SecretString has no string {field:?} field"))
 }
 
+/// The `postgres://` URL for a database secret.
+///
+/// The user is the secret's `username`, which is `postgres` for RDS's managed master secret and a
+/// client's own role for a database shared with other clients; a secret without one is read as
+/// `postgres`. The port is the secret's `port` when it has one, else 5432. The password goes in
+/// literal, as before: the URL parser downstream never percent-decodes it, so a client's generated
+/// password is letters and digits only.
+pub fn database_url(secret_json: &str, host: &str, database: &str) -> Result<String, String> {
+    let password = extract_field(secret_json, "password")?;
+    let user = extract_field(secret_json, "username").unwrap_or_else(|_| "postgres".to_string());
+    let port = serde_json::from_str::<serde_json::Value>(secret_json)
+        .ok()
+        .and_then(|v| v.get("port").and_then(|p| p.as_u64().or_else(|| p.as_str().and_then(|s| s.parse().ok()))))
+        .unwrap_or(5432);
+    Ok(format!("postgres://{user}:{password}@{host}:{port}/{database}"))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_master_secret_logs_in_as_postgres_on_the_default_port() {
+        let json = r#"{"username":"postgres","password":"abc123"}"#;
+        assert_eq!(database_url(json, "db.example", "app").unwrap(), "postgres://postgres:abc123@db.example:5432/app");
+    }
+
+    #[test]
+    fn a_clients_own_secret_logs_in_as_its_role() {
+        let json = r#"{"username":"acme","password":"s3cr3t","host":"db.example","port":5433,"dbname":"acme"}"#;
+        assert_eq!(database_url(json, "db.example", "acme").unwrap(), "postgres://acme:s3cr3t@db.example:5433/acme");
+    }
+
+    #[test]
+    fn a_secret_with_no_username_is_read_as_postgres() {
+        assert_eq!(database_url(r#"{"password":"pw"}"#, "h", "d").unwrap(), "postgres://postgres:pw@h:5432/d");
+    }
+
+    #[test]
+    fn a_port_written_as_text_is_read() {
+        assert_eq!(database_url(r#"{"password":"pw","port":"6000"}"#, "h", "d").unwrap(), "postgres://postgres:pw@h:6000/d");
+    }
+
+    #[test]
+    fn a_secret_with_no_password_is_refused() {
+        assert!(database_url(r#"{"username":"acme"}"#, "h", "d").is_err());
+    }
+
     #[test]
     fn extracts_the_named_field_from_the_generated_secret_shape() {
         assert_eq!(

data/rust/host/src/server.rs

@@ -276,7 +276,8 @@ fn value_to_response(value: Value) -> Response {
     let Some(status_code) = value.get("statusCode").and_then(|v| v.as_u64()) else {
         return (StatusCode::OK, axum::Json(value)).into_response();
     };
-    let status = StatusCode::from_u16(status_code as u16).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
+    // `try_from`, not `as u16`: 65736 would wrap to 200 and turn a handler's garbage into a success.
+    let status = u16::try_from(status_code).ok().and_then(|code| StatusCode::from_u16(code).ok()).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
 
     let mut headers = HeaderMap::new();
     if let Some(header_obj) = value.get("headers").and_then(|h| h.as_object()) {
@@ -665,3 +666,7 @@ mod tests {
         assert_eq!(version_body("e", "h", Some(""))["build"], env!("CARGO_PKG_VERSION"));
     }
 }
+
+#[cfg(test)]
+#[path = "boundary_fuzz/server.rs"]
+mod boundary_fuzz;

data/rust/host/src/web.rs

@@ -744,12 +744,11 @@ async fn google_callback(
     // The site's admin authenticates on the account cookie, not this
     // host's own session cookie. Cross-origin, a cookie here would never
     // reach the site, so the token is handed across via /api/google-handoff.
-    const SESSION_TTL_SECS: u64 = 60 * 60 * 24 * 14;
     let site = std::env::var("SITE_URL").unwrap_or_else(|_| "http://localhost:4321".to_string());
     let site = site.trim_end_matches('/');
-    let token = auth::account_token(secret, &session.email, SESSION_TTL_SECS);
+    let token = auth::account_token(secret, &session.email, auth::SESSION_TTL_SECS);
     if same_origin(site, &redirect_uri()) {
-        let cookie = format!("{}={token}{}; Max-Age={SESSION_TTL_SECS}", auth::account_cookie_name(), cookie_flags());
+        let cookie = format!("{}={token}{}; Max-Age={}", auth::account_cookie_name(), cookie_flags(), auth::SESSION_TTL_SECS);
         redirect_with_cookie("/admin.html", &cookie)
     } else {
         // One-redirect URL onto the Astro origin (local rust/host :4567 vs site :4321).
@@ -1608,8 +1607,10 @@ fn percent_decode_impl(s: &str, plus_as_space: bool) -> String {
                 i += 1;
             }
             b'%' if i + 2 < bytes.len() => {
-                if let Ok(byte) = u8::from_str_radix(&s[i + 1..i + 3], 16) {
-                    out.push(byte);
+                // Byte-wise, not `s[i + 1..i + 3]`: that slice panics when it lands inside a
+                // multi-byte character (`%a🍕`), and `from_str_radix` would read a `+` sign as a digit.
+                if let (Some(high), Some(low)) = (hex_digit(bytes[i + 1]), hex_digit(bytes[i + 2])) {
+                    out.push(high << 4 | low);
                     i += 3;
                 } else {
                     out.push(bytes[i]);
@@ -1625,6 +1626,10 @@ fn percent_decode_impl(s: &str, plus_as_space: bool) -> String {
     String::from_utf8_lossy(&out).into_owned()
 }
 
+fn hex_digit(byte: u8) -> Option<u8> {
+    (byte as char).to_digit(16).map(|digit| digit as u8)
+}
+
 const B64: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 
 // pub(crate) so server.rs's own Function URL response handling can
@@ -2983,3 +2988,7 @@ mod tests {
     }
 
 }
+
+#[cfg(test)]
+#[path = "boundary_fuzz/web.rs"]
+mod boundary_fuzz;

data/rust/parser/fuzz/.gitignore

@@ -0,0 +1,4 @@
+target/
+corpus/
+artifacts/
+coverage/

data/rust/parser/fuzz/Cargo.lock

@@ -0,0 +1,89 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+
+[[package]]
+name = "cc"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f74872d07caf508b30a21f6836e7d7016a2eaf7d9ff4f48deaa58cd8a0407630"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+]
+
+[[package]]
+name = "hecks_parse_fuzz"
+version = "0.0.0"
+dependencies = [
+ "libfuzzer-sys",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom",
+ "libc",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9fd2f41a1cba099f79a0b6b6c35656cf7c03351a7bae8ff0f28f25270f929d2"
+dependencies = [
+ "arbitrary",
+ "cc",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"

data/rust/parser/fuzz/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+name = "hecks_parse_fuzz"
+version = "0.0.0"
+edition = "2021"
+publish = false
+
+# Own workspace root, so neither `rust/parser` nor `rust` adopts this crate and its dependency.
+[workspace]
+
+# The one dependency in the parser tree, and it lives only here: coverage-guided fuzzing needs
+# libFuzzer's instrumentation, and nothing ships from this crate (ADR 0012).
+[dependencies]
+libfuzzer-sys = "0.4"
+
+[[bin]]
+name = "chapter"
+path = "fuzz_targets/chapter.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "resolve"
+path = "fuzz_targets/resolve.rs"
+test = false
+doc = false
+bench = false

data/rust/parser/fuzz/README.md

@@ -0,0 +1,19 @@
+# Coverage-guided fuzzing for hecks-parse
+
+Opt-in. The parser stays dependency-free (ADR 0012); `libfuzzer-sys` lives only in this crate,
+which is its own workspace and is never built by `cargo build` or `cargo test` in `rust/parser`.
+
+```sh
+rustup toolchain install nightly
+cargo install cargo-fuzz
+cd rust/parser
+cargo +nightly fuzz run chapter -- -max_total_time=60   # bluebook parse + determinism
+cargo +nightly fuzz run resolve -- -max_total_time=60   # hecksagon `attaches` resolution
+```
+
+Seed a run from the fixtures: `cargo +nightly fuzz run chapter ../tests/fixtures`. A crash lands
+in `fuzz/artifacts/`; copy it to a `.bluebook` and run `hecks-parse chapter --chapter Fuzzed
+<file>` to reproduce it.
+
+The seeded harness in `tests/fuzz.rs` is what CI runs; this directory is for longer
+coverage-guided hunts.

data/rust/parser/fuzz/fuzz_targets/chapter.rs

@@ -0,0 +1,50 @@
+//! Coverage-guided target for `parse::chapter::parse_chapter`.
+//!
+//! The parser is a binary crate, so this target includes its modules by path and declares them at
+//! its own crate root, which is where their `crate::` references resolve.
+//!
+//! Run from `rust/parser` with a nightly toolchain: `cargo +nightly fuzz run chapter`.
+#![no_main]
+#![allow(dead_code)]
+
+#[path = "../../src/build/mod.rs"]
+mod build;
+#[path = "../../src/canonical.rs"]
+mod canonical;
+#[path = "../../src/diag.rs"]
+mod diag;
+#[path = "../../src/emit.rs"]
+mod emit;
+#[path = "../../src/expr/mod.rs"]
+mod expr;
+#[path = "../../src/ir.rs"]
+mod ir;
+#[path = "../../src/keywords.rs"]
+mod keywords;
+#[path = "../../src/lex.rs"]
+mod lex;
+#[path = "../../src/parse/mod.rs"]
+mod parse;
+#[path = "../../src/ruby_value.rs"]
+mod ruby_value;
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    // Invalid UTF-8 never reaches the parser: the binary rejects it when it reads the file.
+    let Ok(source) = std::str::from_utf8(data) else {
+        return;
+    };
+    let files = [("fuzz.bluebook".to_string(), source.to_string())];
+    // A refusal is a normal answer; only a panic or a hang is a finding.
+    if let Ok(bluebook) = parse::chapter::parse_chapter("Fuzzed", &files) {
+        let first = emit::write(&emit::bluebook_json(&bluebook));
+        let again = parse::chapter::parse_chapter("Fuzzed", &files)
+            .map(|b| emit::write(&emit::bluebook_json(&b)));
+        assert_eq!(
+            Ok(first),
+            again.map_err(|_| ()),
+            "parse is not deterministic"
+        );
+    }
+});

data/rust/parser/fuzz/fuzz_targets/resolve.rs

@@ -0,0 +1,35 @@
+//! Coverage-guided target for `parse::chapter::resolve_hecksagon_dependencies`.
+//!
+//! Run from `rust/parser` with a nightly toolchain: `cargo +nightly fuzz run resolve`.
+#![no_main]
+#![allow(dead_code)]
+
+#[path = "../../src/build/mod.rs"]
+mod build;
+#[path = "../../src/canonical.rs"]
+mod canonical;
+#[path = "../../src/diag.rs"]
+mod diag;
+#[path = "../../src/emit.rs"]
+mod emit;
+#[path = "../../src/expr/mod.rs"]
+mod expr;
+#[path = "../../src/ir.rs"]
+mod ir;
+#[path = "../../src/keywords.rs"]
+mod keywords;
+#[path = "../../src/lex.rs"]
+mod lex;
+#[path = "../../src/parse/mod.rs"]
+mod parse;
+#[path = "../../src/ruby_value.rs"]
+mod ruby_value;
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(source) = std::str::from_utf8(data) else {
+        return;
+    };
+    let _ = parse::chapter::resolve_hecksagon_dependencies("Fuzzed", "fuzz.hecksagon", source);
+});

data/rust/parser/src/parse/command.rs

@@ -171,10 +171,22 @@ pub fn parse_body(
 
         match gated.row.word {
             "role" => {
-                command.role = Some(super::positional_text(file, line, "role", &gated.args, 1)?)
+                command.role = Some(super::positional_literal_text(
+                    file,
+                    line,
+                    "role",
+                    &gated.args,
+                    1,
+                )?)
             }
             "goal" => {
-                command.goal = Some(super::positional_text(file, line, "goal", &gated.args, 1)?)
+                command.goal = Some(super::positional_literal_text(
+                    file,
+                    line,
+                    "goal",
+                    &gated.args,
+                    1,
+                )?)
             }
             // A synthesized inline `one_of(...)` closed set is dropped; `CommandBuilder#build`
             // ignores it.

data/rust/parser/src/parse/mod.rs

@@ -743,6 +743,31 @@ pub(crate) fn positional_text(
     })
 }
 
+/// Like `positional_text`, but the argument must be a literal. Ruby evaluates what follows
+/// `role` or `goal`, so a bare word or a call there (`role sets :name`) is an expression this
+/// parser cannot evaluate, and reading its source text as the value would invent one.
+pub(crate) fn positional_literal_text(
+    file: &str,
+    line: usize,
+    word: &str,
+    args: &ArgumentGateResult,
+    at: usize,
+) -> ParseResult<String> {
+    let raw = positional_raw(file, line, word, args, at)?;
+    match ruby_value::read(raw) {
+        ruby_value::Value::Bare(_) => Err(Diagnostic::new(
+            file,
+            line,
+            format!(
+                "'{word}'s positional argument {at} ('{}') is not a literal",
+                raw.trim()
+            ),
+        )),
+        ruby_value::Value::Str(s) => Ok(s),
+        literal => Ok(ruby_value::to_s(&literal)),
+    }
+}
+
 /// A required symbol positional without its colon (`attribute :name`), bare or quoted (`:"a.b"`).
 /// The quoted form spells dotted paths, e.g. `correlates_by :"reference.value"`.
 pub(crate) fn positional_symbol(