rigortype 0.0.9 → 0.1.1

data/lib/rigor/inference/statement_evaluator.rb

@@ -85,6 +85,7 @@ module Rigor
         Prism::EnsureNode => :eval_ensure,
         Prism::WhileNode => :eval_loop,
         Prism::UntilNode => :eval_loop,
+        Prism::ForNode => :eval_for,
         Prism::AndNode => :eval_and_or,
         Prism::OrNode => :eval_and_or,
         Prism::ParenthesesNode => :eval_parentheses,
@@ -93,7 +94,8 @@ module Rigor
         Prism::ModuleNode => :eval_class_or_module,
         Prism::SingletonClassNode => :eval_singleton_class,
         Prism::CallNode => :eval_call,
-        Prism::BlockNode => :eval_block
+        Prism::BlockNode => :eval_block,
+        Prism::MatchWriteNode => :eval_match_write
       }.freeze
       private_constant :HANDLERS
 
@@ -452,13 +454,26 @@ module Rigor
         results = []
         falsey_scope = entry_scope
         conditions.each do |branch|
-          when_conditions = branch.respond_to?(:conditions) ? branch.conditions : []
-          body_scope, falsey_scope = Narrowing.case_when_scopes(subject, when_conditions, falsey_scope)
+          body_scope, falsey_scope = branch_body_and_falsey_scopes(subject, branch, falsey_scope)
           results << sub_eval(branch, body_scope)
         end
         [results, falsey_scope]
       end
 
+      # Returns `[body_scope, updated_falsey_scope]` for a single branch.
+      # `InNode` branches apply pattern bindings; `WhenNode` branches
+      # narrow through `Narrowing.case_when_scopes`. The falsey scope is
+      # unchanged for `in` branches (conservative: no exhaustiveness
+      # tracking yet).
+      def branch_body_and_falsey_scopes(subject, branch, falsey_scope)
+        if branch.is_a?(Prism::InNode)
+          [apply_in_pattern_bindings(subject, branch.pattern, falsey_scope), falsey_scope]
+        else
+          when_conditions = branch.respond_to?(:conditions) ? branch.conditions : []
+          Narrowing.case_when_scopes(subject, when_conditions, falsey_scope)
+        end
+      end
+
       def eval_case_else(else_clause, falsey_scope)
         return sub_eval(else_clause, falsey_scope) if else_clause
 
@@ -524,7 +539,8 @@ module Rigor
         results = []
         current = rescue_node
         while current
-          results << eval_branch_or_nil(current.statements, entry_scope)
+          rescue_scope = bind_rescue_reference(current, entry_scope)
+          results << eval_branch_or_nil(current.statements, rescue_scope)
           current = current.subsequent
         end
         results
@@ -554,6 +570,122 @@ module Rigor
         ]
       end
 
+      # `for index in collection; body; end`. Unlike `each {}` blocks,
+      # `for` does NOT create a new variable scope: the index variable
+      # AND every local written in the body leak to the surrounding
+      # scope. The collection is evaluated once; the body runs zero or
+      # more times, so the post-loop scope is the join of the
+      # no-iteration scope (just `post_collection`) and the body scope,
+      # with half-bound names degraded to `T | nil` via nil-injection.
+      # The loop expression itself types as `Constant[nil]` (the common
+      # case where no `break VALUE` is observed), matching the policy
+      # `eval_loop` uses for `while` / `until`.
+      def eval_for(node)
+        coll_type, post_coll = sub_eval(node.collection, scope)
+        element_type = for_iteration_element_type(coll_type)
+        body_entry = bind_for_index(node.index, element_type, post_coll)
+
+        body_scope = node.statements ? sub_eval(node.statements, body_entry).last : body_entry
+        [
+          Type::Combinator.constant_of(nil),
+          join_with_nil_injection(post_coll, body_scope)
+        ]
+      end
+
+      # `for x in coll` is semantically `coll.each { |x| ... }`. We
+      # ask the method dispatcher for `coll.each`'s expected block
+      # parameter types — that path consults RBS and the iterator
+      # dispatch table, which is more precise than the structural
+      # `collection_element_type` fallback (it knows, e.g., that
+      # `Hash[K, V]#each` yields `[K, V]` even when the receiver is
+      # not a literal Hash carrier in our local lattice). When the
+      # dispatcher returns nothing (no signature, unknown receiver)
+      # we fall back to the structural extractor.
+      def for_iteration_element_type(coll_type)
+        structural = collection_element_type(coll_type)
+        return structural unless structural.equal?(Type::Combinator.untyped)
+
+        block_params = MethodDispatcher.expected_block_param_types(
+          receiver_type: coll_type,
+          method_name: :each,
+          arg_types: [],
+          environment: scope.environment
+        )
+        return structural if block_params.nil? || block_params.empty?
+
+        block_params.size == 1 ? block_params.first : Type::Combinator.tuple_of(*block_params)
+      rescue StandardError
+        Type::Combinator.untyped
+      end
+
+      # Binds the `for` index variable(s) into `scope`. A single
+      # `LocalVariableTargetNode` is bound to `element_type` (the
+      # per-iteration value the collection yields). A `MultiTargetNode`
+      # (`for a, b in pairs`) delegates to {MultiTargetBinder}, which
+      # decomposes a tuple-shaped element into the inner slots.
+      def bind_for_index(index_node, element_type, scope)
+        case index_node
+        when Prism::LocalVariableTargetNode
+          scope.with_local(index_node.name, element_type)
+        when Prism::MultiTargetNode
+          MultiTargetBinder.bind(index_node, element_type)
+                           .reduce(scope) { |s, (name, type)| s.with_local(name, type) }
+        else
+          scope
+        end
+      end
+
+      # Extracts the per-iteration element type from a collection
+      # carrier. `Tuple[T1..Tn]` yields the union of its elements;
+      # `Nominal[Array, [T]]` and `Nominal[Range, [T]]` yield `T`;
+      # `Nominal[Hash, [K, V]]` yields `Tuple[K, V]` (Hash#each yields
+      # `[key, value]` pairs); `IntegerRange` yields `Integer`;
+      # `Constant<Range>` reads the literal range's element class.
+      # Anything else falls back to `untyped`.
+      def collection_element_type(type)
+        case type
+        when Type::Tuple
+          type.elements.empty? ? Type::Combinator.untyped : Type::Combinator.union(*type.elements)
+        when Type::Nominal
+          nominal_element_type(type)
+        when Type::IntegerRange
+          Type::Combinator.nominal_of("Integer")
+        when Type::Constant
+          constant_element_type(type)
+        else
+          Type::Combinator.untyped
+        end
+      end
+
+      def constant_element_type(constant)
+        value = constant.value
+        case value
+        when Range
+          first = value.first
+          first.nil? ? Type::Combinator.untyped : Type::Combinator.nominal_of(first.class.name)
+        when Array
+          return Type::Combinator.untyped if value.empty?
+
+          Type::Combinator.union(*value.map { |v| Type::Combinator.constant_of(v) })
+        else
+          Type::Combinator.untyped
+        end
+      rescue StandardError
+        Type::Combinator.untyped
+      end
+
+      def nominal_element_type(nominal)
+        args = nominal.type_args
+        case nominal.class_name
+        when "Array", "Range", "Set", "Enumerator" then args[0] || Type::Combinator.untyped
+        when "Hash"
+          k = args[0] || Type::Combinator.untyped
+          v = args[1] || Type::Combinator.untyped
+          Type::Combinator.tuple_of(k, v)
+        else Type::Combinator.untyped
+        end
+      end
+
       # `a && b` / `a || b`. The LHS always runs, the RHS only
       # sometimes runs. Slice 6 phase 1 narrows the RHS evaluation:
       # `a && b` evaluates `b` under the truthy edge of `a`, and
@@ -819,23 +951,30 @@ module Rigor
         parts.join("::")
       end
 
-      # v0.0.2 — applies `RBS::Extended` `assert <target> is T`
-      # directives to the post-call scope. The conditional
-      # variants (`assert-if-true` / `assert-if-false`) are
-      # NOT applied here — they refine the scope only when the
-      # call is observed as a truthy / falsey predicate, which
-      # `Narrowing.predicate_scopes` handles separately.
+      # Slice 4b-2 (ADR-7 § "Slice 4-A/4-B") — applies the
+      # post-return facts the merger produces for an
+      # `RBS::Extended`-annotated call. Reads through
+      # `RbsExtended.read_flow_contribution` so the bundle
+      # carries the canonical `Rigor::FlowContribution::Fact`
+      # rows for `:always` assert directives (the slice-4a
+      # routing places conditional asserts on `truthy_facts` /
+      # `falsey_facts`, which `Narrowing.predicate_scopes`
+      # consumes). Future plugin contributions that add
+      # `:always` assertions at the same call site flow through
+      # the same merger and land here.
       def apply_rbs_extended_assertions(call_node, current_scope)
         method_def = resolve_call_method(call_node, current_scope)
         return current_scope if method_def.nil?
 
-        effects = RbsExtended.read_assert_effects(method_def)
-        return current_scope if effects.empty?
+        contribution = RbsExtended.read_flow_contribution(method_def)
+        return current_scope if contribution.nil?
 
-        effects.reduce(current_scope) do |scope_acc, effect|
-          next scope_acc unless effect.always?
+        result = Rigor::FlowContribution::Merger.merge([contribution])
+        post_return = result.post_return_facts
+        return current_scope if post_return.empty?
 
-          apply_assert_effect(effect, call_node, scope_acc, method_def)
+        post_return.reduce(current_scope) do |scope_acc, fact|
+          apply_post_return_fact(fact, call_node, scope_acc, method_def)
         end
       end
 
@@ -868,44 +1007,64 @@ module Rigor
         end
       end
 
-      def apply_assert_effect(effect, call_node, current_scope, method_def)
-        target_node = assert_effect_target_node(effect, call_node, method_def)
+      # Slice 4b-2 — applies a single post-return Fact to the
+      # scope. Mirrors `Narrowing#apply_fact_to_scope` (Fact
+      # variant of the v0.0.2 `apply_assert_effect`); shares the
+      # narrowing logic via `Narrowing.narrow_for_fact` so the
+      # predicate / assert / plugin paths all converge on the
+      # same hierarchy-aware narrowing rules.
+      def apply_post_return_fact(fact, call_node, current_scope, method_def)
+        target_node = fact_target_node(fact, call_node, method_def)
+        return apply_self_post_return_fact(fact, target_node, current_scope) if fact.target_kind == :self
         return current_scope unless target_node.is_a?(Prism::LocalVariableReadNode)
 
         local_name = target_node.name
         current_type = current_scope.local(local_name)
         return current_scope if current_type.nil?
 
-        narrowed = narrow_for_assert_effect(current_type, effect, current_scope.environment)
+        narrowed = Narrowing.narrow_for_fact(current_type, fact, current_scope.environment)
         current_scope.with_local(local_name, narrowed)
       end
 
-      # v0.0.2 #3 — same `target: self` accommodation as
-      # `Narrowing.effect_target_node`: the call's receiver
-      # serves as the target for self-targeted directives.
-      def assert_effect_target_node(effect, call_node, method_def)
-        if effect.target_kind == :self
-          call_node.receiver
+      # v0.1.1 Track 1 slice 3 — `assert self is T` post-return
+      # narrowing for the four supported receiver shapes (mirrors
+      # `Narrowing#apply_self_fact`).
+      def apply_self_post_return_fact(fact, receiver_node, current_scope)
+        case receiver_node
+        when nil, Prism::SelfNode
+          current = current_scope.self_type
+          return current_scope if current.nil?
+
+          narrowed = Narrowing.narrow_for_fact(current, fact, current_scope.environment)
+          current_scope.with_self_type(narrowed)
+        when Prism::LocalVariableReadNode
+          current = current_scope.local(receiver_node.name)
+          return current_scope if current.nil?
+
+          narrowed = Narrowing.narrow_for_fact(current, fact, current_scope.environment)
+          current_scope.with_local(receiver_node.name, narrowed)
+        when Prism::InstanceVariableReadNode
+          current = current_scope.ivar(receiver_node.name)
+          return current_scope if current.nil?
+
+          narrowed = Narrowing.narrow_for_fact(current, fact, current_scope.environment)
+          current_scope.with_ivar(receiver_node.name, narrowed)
         else
-          lookup_assert_arg(call_node, method_def, effect.target_name)
+          current_scope
         end
       end
 
-      def narrow_for_assert_effect(current_type, effect, environment)
-        if effect.refinement?
-          return Narrowing.narrow_not_refinement(current_type, effect.refinement_type) if effect.negative?
-
-          return effect.refinement_type
-        end
-
-        if effect.negative?
-          Narrowing.narrow_not_class(current_type, effect.class_name, exact: false, environment: environment)
+      # `:self` routes to the call receiver; otherwise we look
+      # up the matching positional argument by parameter name.
+      def fact_target_node(fact, call_node, method_def)
+        if fact.target_kind == :self
+          call_node.receiver
         else
-          Narrowing.narrow_class(current_type, effect.class_name, exact: false, environment: environment)
+          lookup_post_return_arg(call_node, method_def, fact.target_name)
         end
       end
 
-      def lookup_assert_arg(call_node, method_def, target_name)
+      def lookup_post_return_arg(call_node, method_def, target_name)
         arguments = call_node.arguments&.arguments || []
         method_def.method_types.each do |mt|
           params = mt.type.required_positionals + mt.type.optional_positionals
@@ -1031,10 +1190,29 @@ module Rigor
       # bindings for every named block parameter on top. Parameter
       # types come from the receiving method's RBS signature when
       # one is available; the rest default to `Dynamic[Top]`.
+      #
+      # `;`-prefixed block-locals (`do |i; x|`) are bound to
+      # `Constant[nil]` so the inner read shadows any outer
+      # `x` per Ruby's semantics — at runtime the block-local is
+      # a fresh nil-valued variable on every block invocation.
+      # Without this shadow, an inner `x.even?` before the first
+      # write would type-check against the OUTER `x` (e.g.
+      # `Integer`) when the runtime would actually `NoMethodError`
+      # on `nil`.
       def build_block_entry_scope(call_node, block_node)
         expected = expected_block_param_types_for(call_node)
         bindings = BlockParameterBinder.new(expected_param_types: expected).bind(block_node)
-        bindings.reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
+        scope_with_params = bindings.reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
+        block_local_names(block_node).reduce(scope_with_params) do |acc, name|
+          acc.with_local(name, Type::Combinator.constant_of(nil))
+        end
+      end
+
+      def block_local_names(block_node)
+        params_root = block_node.parameters
+        return [] unless params_root.is_a?(Prism::BlockParametersNode)
+
+        params_root.locals.map(&:name)
       end
 
       def expected_block_param_types_for(call_node)
@@ -1318,6 +1496,197 @@ module Rigor
       def reduce_scopes_with_nil_injection(scopes)
         scopes.reduce { |a, b| join_with_nil_injection(a, b) }
       end
+
+      # ---------------------------------------------------------------
+      # rescue variable binding helpers
+      # ---------------------------------------------------------------
+
+      # Returns `scope` extended with the rescue reference variable bound
+      # to the exception instance type. Leaves scope unchanged when the
+      # node carries no reference (bare `rescue` without `=> var`).
+      def bind_rescue_reference(rescue_node, scope)
+        ref = rescue_node.reference
+        return scope unless ref.is_a?(Prism::LocalVariableTargetNode)
+
+        scope.with_local(ref.name, rescue_exception_type(rescue_node, scope))
+      end
+
+      # Derives the exception instance type for a `RescueNode`. When the
+      # exceptions list is empty (bare `rescue`) the type is
+      # `StandardError`. When one or more exception classes are named the
+      # types are unioned. Falls back to `StandardError` for any class
+      # that cannot be resolved to a `Singleton` type.
+      def rescue_exception_type(rescue_node, scope)
+        exceptions = rescue_node.exceptions
+        if exceptions.empty?
+          Type::Combinator.nominal_of("StandardError")
+        else
+          types = exceptions.map do |exc_node|
+            singleton_type, = sub_eval(exc_node, scope)
+            singleton_to_nominal(singleton_type)
+          end
+          Type::Combinator.union(*types)
+        end
+      end
+
+      # ---------------------------------------------------------------
+      # `case/in` pattern variable binding helpers
+      # ---------------------------------------------------------------
+
+      # Builds the entry scope for an `in` branch by injecting every
+      # variable captured by the pattern as a local binding.
+      def apply_in_pattern_bindings(subject, pattern, scope)
+        bindings = collect_in_pattern_bindings(subject, pattern, scope)
+        bindings.reduce(scope) { |s, (name, type)| s.with_local(name, type) }
+      end
+
+      # Returns an array of `[Symbol, Rigor::Type]` pairs for every
+      # variable captured by `pattern`. Unrecognised pattern nodes
+      # contribute no bindings (fail-soft).
+      # rubocop:disable Metrics/CyclomaticComplexity
+      def collect_in_pattern_bindings(subject, pattern, scope)
+        case pattern
+        when Prism::CapturePatternNode
+          [[pattern.target.name, pattern_capture_type(pattern.value, scope)]]
+        when Prism::LocalVariableTargetNode
+          subject_type = subject.is_a?(Prism::LocalVariableReadNode) ? scope.local(subject.name) : nil
+          [[pattern.name, subject_type || Type::Combinator.untyped]]
+        when Prism::ImplicitNode
+          collect_in_pattern_bindings(subject, pattern.value, scope)
+        when Prism::ArrayPatternNode
+          collect_array_pattern_bindings(pattern, scope)
+        when Prism::FindPatternNode
+          collect_find_pattern_bindings(pattern, scope)
+        when Prism::HashPatternNode
+          collect_hash_pattern_bindings(pattern, scope)
+        when Prism::AlternationPatternNode
+          collect_alternation_pattern_bindings(subject, pattern, scope)
+        else
+          []
+        end
+      end
+      # rubocop:enable Metrics/CyclomaticComplexity
+
+      def collect_array_pattern_bindings(pattern, scope)
+        bindings = [*pattern.requireds, *pattern.posts].flat_map do |elem|
+          collect_in_pattern_bindings(nil, elem, scope)
+        end
+        append_array_splat_binding(bindings, pattern.rest)
+        bindings
+      end
+
+      def collect_hash_pattern_bindings(pattern, scope)
+        bindings = pattern.elements.flat_map do |assoc|
+          next [] unless assoc.is_a?(Prism::AssocNode) && assoc.value
+
+          collect_in_pattern_bindings(nil, assoc.value, scope)
+        end
+        rest = pattern.rest
+        if rest.is_a?(Prism::AssocSplatNode)
+          val = rest.value
+          bindings << [val.name, hash_pattern_rest_type] if val.is_a?(Prism::LocalVariableTargetNode)
+        end
+        bindings
+      end
+
+      def collect_find_pattern_bindings(pattern, scope)
+        bindings = pattern.requireds.flat_map do |elem|
+          collect_in_pattern_bindings(nil, elem, scope)
+        end
+        [pattern.left, pattern.right].each { |splat| append_array_splat_binding(bindings, splat) }
+        bindings
+      end
+
+      # `[..., *rest, ...]` / `[*pre, x, *post]` capture an Array of
+      # the unmatched elements; bind `rest` to `Array[untyped]` rather
+      # than the previous bare `untyped`. Per-element typing waits on
+      # subject-aware element-type extraction (the binder doesn't see
+      # the case subject).
+      def append_array_splat_binding(bindings, splat)
+        return unless splat.is_a?(Prism::SplatNode)
+
+        target = splat.expression
+        return unless target.is_a?(Prism::LocalVariableTargetNode)
+
+        bindings << [target.name, Type::Combinator.nominal_of("Array", type_args: [Type::Combinator.untyped])]
+      end
+
+      # `{ key:, **rest }` binds `rest` to a Hash whose keys are
+      # Symbols (the only legal key shape for a hash pattern) and
+      # whose values are untyped (the binder can't see the subject's
+      # value type).
+      def hash_pattern_rest_type
+        Type::Combinator.nominal_of(
+          "Hash",
+          type_args: [Type::Combinator.nominal_of("Symbol"), Type::Combinator.untyped]
+        )
+      end
+
+      # ---------------------------------------------------------------
+      # named-capture regex binding (`MatchWriteNode`)
+      # ---------------------------------------------------------------
+
+      # `/(?<year>\d+)/ =~ str` — Prism emits a `MatchWriteNode` that
+      # wraps the `=~` call and lists the named-capture targets. Each
+      # target is bound to `String | nil` (the capture is absent as nil
+      # when the pattern doesn't match or the group didn't participate).
+      def eval_match_write(node)
+        match_type, post_scope = sub_eval(node.call, scope)
+        string_or_nil = Type::Combinator.union(
+          Type::Combinator.nominal_of("String"),
+          Type::Combinator.constant_of(nil)
+        )
+        bound_scope = node.targets.reduce(post_scope) do |s, target|
+          next s unless target.is_a?(Prism::LocalVariableTargetNode)
+
+          s.with_local(target.name, string_or_nil)
+        end
+        [match_type, bound_scope]
+      end
+
+      # ---------------------------------------------------------------
+      # shared type conversion helper
+      # ---------------------------------------------------------------
+
+      # Converts a `Singleton[ClassName]` (the class object) to the
+      # corresponding `Nominal[ClassName]` (an instance). Falls back to
+      # `untyped` for carriers that are not Singleton (e.g. Dynamic[Top]
+      # when the class could not be resolved).
+      def singleton_to_nominal(type)
+        type.is_a?(Type::Singleton) ? Type::Combinator.nominal_of(type.class_name) : Type::Combinator.untyped
+      end
+
+      # Returns the type to bind for a `CapturePatternNode`'s target.
+      # Plain class references collapse to the matching `Nominal[T]`;
+      # `AlternationPatternNode` (`Integer | String => x`) unions every
+      # alternate's resolved type. Anything else falls back to
+      # `untyped` (the conservative legacy behaviour).
+      def pattern_capture_type(value_node, scope)
+        if value_node.is_a?(Prism::AlternationPatternNode)
+          left = pattern_capture_type(value_node.left, scope)
+          right = pattern_capture_type(value_node.right, scope)
+          Type::Combinator.union(left, right)
+        else
+          singleton_to_nominal(sub_eval(value_node, scope).first)
+        end
+      end
+
+      # `in PatternA | PatternB` — Ruby requires both alternates to
+      # bind the same names, but the binder runs against the AST and
+      # cannot enforce that. We collect bindings from each side and
+      # merge by name, unioning types when both alternates contribute.
+      # Names that only one alternate contributes still surface (the
+      # parser would have rejected the case at compile time, so by the
+      # time we see it the user's intent is the merged set).
+      def collect_alternation_pattern_bindings(subject, pattern, scope)
+        left = collect_in_pattern_bindings(subject, pattern.left, scope)
+        right = collect_in_pattern_bindings(subject, pattern.right, scope)
+        merged = {}
+        (left + right).each do |name, type|
+          merged[name] = merged.key?(name) ? Type::Combinator.union(merged[name], type) : type
+        end
+        merged.to_a
+      end
     end
     # rubocop:enable Metrics/ClassLength
   end

data/lib/rigor/plugin/access_denied_error.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Plugin
+    # Raised when a plugin's I/O attempt fails the active
+    # {TrustPolicy}. Surfaced through {IoBoundary} so the analyzer
+    # can convert the exception into a `:plugin_loader` diagnostic
+    # without crashing `rigor check`.
+    #
+    # The policy is documented in [ADR-2 § "Plugin Trust and I/O
+    # Policy"](../../../docs/adr/2-extension-api.md). Slice 2's
+    # surface lists `:read_outside_scope` and `:network_disabled`
+    # as the two reason codes; future slices may extend the set.
+    class AccessDeniedError < StandardError
+      attr_reader :reason, :resource
+
+      def initialize(message, reason:, resource: nil)
+        super(message)
+        @reason = reason
+        @resource = resource
+      end
+    end
+  end
+end