rigortype 0.3.6 → 0.3.8

data/lib/rigor/protection/mutator.rb

@@ -18,7 +18,7 @@ module Rigor
     # rendered receiver type) and `method_name` are filled in for reporting a surviving site; both may stay nil.
     Mutation = Struct.new(
       :operator, :expected_rule, :start, :stop, :replacement, :line, :label, :anchor,
-      :anchor_type, :method_name,
+      :anchor_type, :method_name, :call_node,
       keyword_init: true
     ) do
       def apply(source)
@@ -35,6 +35,103 @@ module Rigor
     # call-argument literal dropped to `nil` or type-swapped (→ `call.argument-type-mismatch`), or a call site
     # renamed to a missing method (→ `call.undefined-method`). Only call sites and bodies are mutated, never
     # `def` signatures, so a reused project scan stays valid.
+
+    # Signature-arity guard for `arity_extra` (ADR-62): verifies through `ScopeIndexer` and
+    # `Reflection` that a call site targets a known, fixed/bounded positional signature and that
+    # adding 1 argument exceeds `max_arity`. Drops variadic or untyped calls to eliminate noise.
+    module ArityGuard
+      CONSTANT_CLASSES = {
+        Integer => "Integer", Float => "Float", String => "String",
+        Symbol => "Symbol", Range => "Range",
+        TrueClass => "TrueClass", FalseClass => "FalseClass",
+        NilClass => "NilClass"
+      }.freeze
+
+      module_function
+
+      def fixed_arity_call?(mut, index)
+        scope = call_scope(mut, index)
+        return false if scope.nil? || !plain_positional_call?(mut.call_node)
+
+        receiver_type = scope.type_of(mut.call_node.receiver)
+        class_name = concrete_class_name(receiver_type)
+        return false if class_name.nil? || !Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
+
+        max_arity = method_max_arity(receiver_type, class_name, mut.call_node.name, scope)
+        return false if max_arity.nil? || max_arity == Float::INFINITY
+
+        actual_args_count(mut.call_node) + 1 > max_arity
+      rescue StandardError
+        false
+      end
+
+      def call_scope(mut, index)
+        call_node = mut.call_node
+        return nil if call_node.nil? || call_node.receiver.nil?
+
+        index[call_node] || index[mut.anchor]
+      end
+
+      def actual_args_count(call_node)
+        (call_node.arguments&.arguments || []).size
+      end
+
+      def method_max_arity(receiver_type, class_name, method_name, scope)
+        method_def =
+          if receiver_type.is_a?(Type::Singleton)
+            Rigor::Reflection.singleton_method_definition(class_name, method_name, scope: scope)
+          else
+            Rigor::Reflection.instance_method_definition(class_name, method_name, scope: scope)
+          end
+        return nil if method_def.nil? || method_def == true
+
+        max_positional_arity(method_def)
+      end
+
+      def plain_positional_call?(call_node)
+        arguments = call_node.arguments
+        return true if arguments.nil?
+
+        arguments.arguments.none? do |arg|
+          arg.is_a?(Prism::SplatNode) ||
+            arg.is_a?(Prism::KeywordHashNode) ||
+            arg.is_a?(Prism::BlockArgumentNode) ||
+            arg.is_a?(Prism::ForwardingArgumentsNode)
+        end
+      end
+
+      def max_positional_arity(method_def)
+        maxes = []
+        method_def.method_types.each do |mt|
+          function = mt.type
+          return nil unless function.respond_to?(:required_keywords)
+          return nil unless function.required_keywords.empty? && function.trailing_positionals.empty?
+
+          return Float::INFINITY if function.rest_positionals
+
+          min_arity = function.required_positionals.size
+          maxes << (min_arity + function.optional_positionals.size)
+        end
+        return nil if maxes.empty?
+
+        maxes.max
+      end
+
+      def concrete_class_name(type)
+        case type
+        when Type::Nominal, Type::Singleton, Type::DataClass, Type::DataInstance,
+             Type::StructClass, Type::StructInstance
+          type.class_name
+        when Type::Tuple then "Array"
+        when Type::HashShape then "Hash"
+        when Type::Constant then CONSTANT_CLASSES[type.value.class] || type.value.class.name
+        when Type::Refined, Type::Difference then concrete_class_name(type.base)
+        when Type::IntegerRange then "Integer"
+        when Type::App then concrete_class_name(type.bound)
+        end
+      end
+    end
+
     class Mutator
       IDENT = /\A[a-z_][A-Za-z0-9_]*\z/
       QUOTES = ['"', "'"].freeze
@@ -47,11 +144,9 @@ module Rigor
       # the mutated value/call sits in a context where Rigor has type knowledge.
       ALL_OPERATORS = %i[nil_inject type_swap undefined_method arity_extra].freeze
 
-      # The default set. `arity_extra` is excluded: most Ruby methods accept an extra argument (splat / optional),
-      # so appending one is usually an equivalent mutant — it contributes almost only noise. Re-enable it
-      # explicitly via `operators:` to measure arity teeth. (A signature-arity guard would make it
-      # default-worthy — a follow-up.)
-      OPERATORS = %i[nil_inject type_swap undefined_method].freeze
+      # The default set. With the signature-arity guard in place (`filter_by_type`), `arity_extra` is
+      # default-worthy: it only mutates call sites whose callee has a known, fixed/bounded positional arity.
+      OPERATORS = ALL_OPERATORS
 
       def initialize(source, operators: OPERATORS)
         @source = source
@@ -85,7 +180,9 @@ module Rigor
         kept = mutations.select do |mut|
           keep, type = anchor_decision(mut.anchor, index, cache)
           mut.anchor_type = type if keep
-          keep
+          next false unless keep
+
+          mut.operator == :arity_extra ? ArityGuard.fixed_arity_call?(mut, index) : true
         end
         [kept, mutations.size - kept.size]
       end
@@ -105,7 +202,7 @@ module Rigor
 
           _keep, type = anchor_decision(mut.anchor, index, cache)
           mut.anchor_type = type
-          true
+          mut.operator == :arity_extra ? ArityGuard.fixed_arity_call?(mut, index) : true
         end
       end
 
@@ -243,22 +340,28 @@ module Rigor
       # Append a trailing argument inside explicit `(...)` parens to trip an arity diagnostic against a known
       # fixed-arity signature.
       def extend_arity(node, out)
-        open = node.opening_loc
-        close = node.closing_loc
-        return unless close && open&.slice == "("
-
-        args = node.arguments&.arguments
-        insertion = args && !args.empty? ? ", nil" : "nil"
-        add(out, :arity_extra, "call.wrong-arity", close.start_offset, close.start_offset,
-            insertion, node.location.start_line, "call ##{node.name} +1 arg", node.receiver, node.name.to_s)
+        if node.closing_loc && node.opening_loc&.slice == "("
+          offset = node.closing_loc.start_offset
+          args = node.arguments&.arguments
+          insertion = args && !args.empty? ? ", nil" : "nil"
+        elsif node.arguments && !node.arguments.arguments.empty?
+          offset = node.arguments.location.end_offset
+          insertion = ", nil"
+        else
+          return
+        end
+
+        add(out, :arity_extra, "call.wrong-arity", offset, offset,
+            insertion, node.location.start_line, "call #{node.name} +1 arg", node.receiver,
+            node.name.to_s, call_node: node)
       end
 
-      def add(out, operator, rule, start, stop, replacement, line, label, anchor, method_name) # rubocop:disable Metrics/ParameterLists
+      def add(out, operator, rule, start, stop, replacement, line, label, anchor, method_name, call_node: nil) # rubocop:disable Metrics/ParameterLists
         return unless @operators.include?(operator)
 
         out << Mutation.new(operator: operator, expected_rule: rule, start: start, stop: stop,
                             replacement: replacement, line: line, label: label, anchor: anchor,
-                            method_name: method_name)
+                            method_name: method_name, call_node: call_node)
       end
 
       def snippet(loc)

data/lib/rigor/rbs_extended/envelope_scanner.rb

@@ -22,14 +22,15 @@ module Rigor
     #
     # ## Why it parses rather than reading the built environment
     #
-    # {ConformanceChecker}, the obvious model, walks `RbsLoader`'s built env. An envelope cannot: the
+    # {ConformanceChecker}, the obvious model, walks `RbsLoader`'s built env. An envelope did not: the
     # diagnostic has to name **where the bound was written** (`sig/foo.rbs:12`), and the ADR-54 env
-    # cache dumps every `RBS::Location` to a zero-range `<cached>` sentinel, so a warm run would lose
-    # both the position and the only evidence of which file a declaration came from. Parsing the
-    # project's own signature sources is a few milliseconds over a tree Rigor already globs, it is
-    # identical warm and cold, and it enforces ADR-103 WD6's trust rule structurally: a `%a{pure}` in
-    # rbs core or in a gem's shipped RBS is never read, so it cannot bound a project method that
-    # happens to share its key.
+    # cache reduced every `RBS::Location` to a zero-range `<cached>` sentinel, so a warm run lost both
+    # the position and the only evidence of which file a declaration came from. That particular loss is
+    # closed now — #696 restored the buffer name, #799 an annotation's position — so what still decides
+    # it is the rest: parsing the project's own signature sources is a few milliseconds over a tree
+    # Rigor already globs, it is identical warm and cold, and it enforces ADR-103 WD6's trust rule
+    # structurally: a `%a{pure}` in rbs core or in a gem's shipped RBS is never read, so it cannot bound
+    # a project method that happens to share its key.
     #
     # Malformed payloads and `pure`-versus-`effect` contradictions are recorded on a {Reporter} the
     # scanner owns and ride out on {Result#unresolved}. They surface no diagnostic in this slice:

data/lib/rigor/rbs_extended/hkt_directives.rb

@@ -2,6 +2,7 @@
 
 require_relative "../inference/hkt_registry"
 require_relative "../inference/hkt_body_parser"
+require_relative "reporter"
 
 module Rigor
   module RbsExtended
@@ -286,10 +287,24 @@ module Rigor
         source_location.respond_to?(:start_line) ? source_location.start_line : nil
       end
 
+      # Issue #785 — routes a declined directive to the per-run reporter. The FIRST arm is the one that
+      # matters: the production reporter is {RbsExtended::Reporter}, whose surface is `record_unresolved` /
+      # `record_lossy_projection` / `record_hkt_error` — it has neither `#record` nor `#<<`, so before this
+      # arm existed every call here fell off the end of the `if` and every malformed HKT directive was
+      # dropped in every real run, while the doc comments claimed an `:info` entry was recorded. The
+      # position is flattened at record time through {RbsExtended::Reporter.position_of}, the one place
+      # every stream flattens through since #805, because the entry has to reach the pool drain channel as
+      # primitives (see {RbsExtended::Reporter}).
+      #
+      # The `#record` / `#<<` arms stay for the collecting doubles the directive specs and plugin authors
+      # use, which is the contract `scan_rbs_loader`'s `@param reporter [#record, nil]` documents.
       def record_hkt_error(reporter, message, source_location)
         return if reporter.nil?
 
-        if reporter.respond_to?(:record)
+        if reporter.respond_to?(:record_hkt_error)
+          path, line, column = Reporter.position_of(source_location)
+          reporter.record_hkt_error(message: message, path: path, line: line, column: column)
+        elsif reporter.respond_to?(:record)
           reporter.record(directive: "hkt", message: message, source_location: source_location)
         elsif reporter.respond_to?(:<<)
           reporter << { directive: "hkt", message: message, source_location: source_location }

data/lib/rigor/rbs_extended/reporter.rb

@@ -6,7 +6,7 @@ module Rigor
     # cannot surface at the point of failure (the parsers are fail-soft, returning `nil` so call sites fall back
     # to the RBS-declared type).
     #
-    # Owns two event streams:
+    # Owns three event streams:
     #
     # - `#unresolved_payloads` — `rigor:v1:*` directive payloads the resolver could not turn into a
     #   {Rigor::Type}. Surface as `dynamic.rbs-extended.unresolved` `:info` diagnostics.
@@ -14,21 +14,60 @@ module Rigor
     #   `required_of` / `readonly_of`) applied to a carrier that does not preserve shape information (anything
     #   other than `Type::HashShape` / `Type::Tuple`). Surface as `dynamic.shape.lossy-projection` `:info`
     #   diagnostics.
+    # - `#hkt_directive_errors` — malformed `rigor:v1:hkt_register` / `rigor:v1:hkt_define` directives the
+    #   ADR-20 parser declined. Surface as `dynamic.rbs-extended.hkt-directive-invalid` `:info` diagnostics.
     #
     # Mutable through the run; consumed once by {Rigor::Analysis::Runner} at end-of-run. Each event is
-    # deduplicated by `(payload, source_location)` for unresolved and `(head, source_location)` for
-    # lossy-projection so a single annotation read from many call sites yields one diagnostic.
+    # deduplicated by its whole entry — `(payload, path, line, column)` for unresolved, `(head, path, line,
+    # column)` for lossy-projection, `(message, path, line, column)` for an hkt directive — so a single
+    # annotation read from many call sites yields one diagnostic.
     #
     # The reporter is intentionally thread-safe via a coarse `Mutex` because the inference engine may read the
     # same method definition from multiple files in parallel; the critical sections are short (Array#include? +
     # Array#<<) so the lock contention is negligible.
     class Reporter
-      UnresolvedEntry = Data.define(:payload, :source_location)
-      LossyProjectionEntry = Data.define(:head, :source_location)
+      # Every entry carries its position as `(path, line, column)` primitives, flattened from the parser's
+      # `RBS::Location` by {.position_of} at record time. Issues #785 (hkt) and #805 (the two older streams).
+      # Two reasons, and either alone decides it. All three streams are drained out of every fork-pool worker
+      # ({Rigor::Analysis::WorkerSession#drain_reporters}), and an `RBS::Location` is a C-extension object with
+      # no `_dump`, so a `Marshal.dump` of the drain payload raises `TypeError` — which kills the worker at
+      # drain time and degrades the run to in-process re-analysis. And an `RBS::Location` compares equal only
+      # against a location over the SAME `RBS::Buffer` object, so two workers that each read the same `.rbs`
+      # would hand the coordinator two entries the dedup cannot collapse — `--workers=N` would then print N
+      # copies of a row `--workers=0` prints once.
+      #
+      # The record methods take the triple rather than the location for the same reason: a door that accepts
+      # an `RBS::Location` is a door a future caller reintroduces the bug through.
+      UnresolvedEntry = Data.define(:payload, :path, :line, :column)
+      LossyProjectionEntry = Data.define(:head, :path, :line, :column)
+      HktDirectiveEntry = Data.define(:message, :path, :line, :column)
+
+      # Flattens an `RBS::Location` (or anything answering the same readers) to the `(path, line, column)`
+      # triple every entry carries. `column` is 1-based, since `RBS::Location#start_column` is 0-based and
+      # diagnostics are not. Each component is `nil` when the location cannot supply it, and the diagnostic
+      # then falls back to `.rigor.yml:1:1`.
+      #
+      # Fail-soft by construction, like every parser that calls it: a location that raises while being read
+      # costs the entry its position, never the run.
+      #
+      # @param source_location [RBS::Location, nil]
+      # @return [Array(String, nil, Integer, nil, Integer, nil)]
+      def self.position_of(source_location)
+        return [nil, nil, nil] if source_location.nil?
+
+        buffer = source_location.respond_to?(:buffer) ? source_location.buffer : nil
+        name = buffer.respond_to?(:name) ? buffer.name.to_s : ""
+        line = source_location.respond_to?(:start_line) ? source_location.start_line : nil
+        column = source_location.respond_to?(:start_column) ? source_location.start_column + 1 : nil
+        [name.empty? ? nil : name, line, column]
+      rescue StandardError
+        [nil, nil, nil]
+      end
 
       def initialize
         @unresolved_payloads = []
         @lossy_projections = []
+        @hkt_directive_errors = []
         @mutex = Mutex.new
       end
 
@@ -42,11 +81,13 @@ module Rigor
         @mutex.synchronize { @lossy_projections.dup.freeze }
       end
 
-      # Records a `dynamic.rbs-extended.unresolved` event. The `source_location` argument is the {RBS::Location}
-      # attached to the source annotation (or `nil` when the caller doesn't have one — the diagnostic falls back
-      # to a generic location in that case).
-      def record_unresolved(payload:, source_location: nil)
-        entry = UnresolvedEntry.new(payload: payload.to_s, source_location: source_location)
+      # Records a `dynamic.rbs-extended.unresolved` event. The position triple is the source annotation's
+      # `.rbs` file / line / 1-based column — {.position_of} flattens the caller's `RBS::Location` into it —
+      # each `nil` when the caller had no location (the diagnostic then falls back to `.rigor.yml:1:1`).
+      def record_unresolved(payload:, path: nil, line: nil, column: nil)
+        entry = UnresolvedEntry.new(
+          payload: frozen_text(payload), path: frozen_text(path), line: line, column: column
+        )
         @mutex.synchronize do
           return if @unresolved_payloads.include?(entry)
 
@@ -56,8 +97,11 @@ module Rigor
 
       # Records a `dynamic.shape.lossy-projection` event for one of the five shape-projection heads. `head` MUST
       # be a String (`"pick_of"`, `"omit_of"`, …); the diagnostic message identifies which projection degraded.
-      def record_lossy_projection(head:, source_location: nil)
-        entry = LossyProjectionEntry.new(head: head.to_s, source_location: source_location)
+      # The position triple is read exactly as {#record_unresolved}'s is.
+      def record_lossy_projection(head:, path: nil, line: nil, column: nil)
+        entry = LossyProjectionEntry.new(
+          head: frozen_text(head), path: frozen_text(path), line: line, column: column
+        )
         @mutex.synchronize do
           return if @lossy_projections.include?(entry)
 
@@ -65,10 +109,46 @@ module Rigor
         end
       end
 
+      # @return [Array<HktDirectiveEntry>] frozen snapshot of the accumulated hkt-directive failures.
+      def hkt_directive_errors
+        @mutex.synchronize { @hkt_directive_errors.dup.freeze }
+      end
+
+      # Records a `dynamic.rbs-extended.hkt-directive-invalid` event: one malformed ADR-20 HKT directive the
+      # {Rigor::RbsExtended::HktDirectives} parser declined. `message` names what the parser objected to; the
+      # position triple is the annotation's `.rbs` file / line / 1-based column, each `nil` when the caller had
+      # no location (the diagnostic then falls back to `.rigor.yml:1:1`).
+      #
+      # Every String is frozen individually, not just the enclosing `Data`: the entry crosses the pool drain
+      # channel, whose stated invariant is that its payload is `Ractor.shareable?` as well as Marshal-clean.
+      def record_hkt_error(message:, path: nil, line: nil, column: nil)
+        entry = HktDirectiveEntry.new(
+          message: frozen_text(message), path: frozen_text(path), line: line, column: column
+        )
+        @mutex.synchronize do
+          return if @hkt_directive_errors.include?(entry)
+
+          @hkt_directive_errors << entry
+        end
+      end
+
       # True when no events have accumulated. Used by callers that want to skip the diagnostic-emission pass
       # entirely on the common no-event path.
       def empty?
-        @mutex.synchronize { @unresolved_payloads.empty? && @lossy_projections.empty? }
+        @mutex.synchronize do
+          @unresolved_payloads.empty? && @lossy_projections.empty? && @hkt_directive_errors.empty?
+        end
+      end
+
+      private
+
+      # `nil` stays `nil` — the diagnostic falls back to `.rigor.yml:1:1` on a missing path. Anything else
+      # becomes an individually frozen String: the `Data` wrapper is frozen on its own, but the pool drain's
+      # stated invariant is that its payload is `Ractor.shareable?`, which is a DEEP freeze. Coercing here also
+      # means a caller that hands the door an `RBS::Location` by mistake stores its `#to_s`, not the object —
+      # the entry cannot become un-Marshalable from the outside.
+      def frozen_text(value)
+        value.nil? ? nil : value.to_s.dup.freeze
       end
     end
   end

data/lib/rigor/rbs_extended.rb

@@ -812,10 +812,15 @@ module Rigor
     # ADR-13 slice 3b — guards every reporter call so the in-RbsExtended-module call sites can record events
     # uniformly without nil-checking each time. When the reporter is nil (the v0.1.0 → v0.1.3 default for call
     # sites that do not yet thread `environment:`), the call is a no-op and the parser stays fail-soft.
+    #
+    # Issue #805 — the location is flattened to `(path, line, column)` here, at record time, because the
+    # entry is drained out of every fork-pool worker and an `RBS::Location` neither survives `Marshal.dump`
+    # nor compares equal across two workers' buffers (see {Rigor::RbsExtended::Reporter}).
     def record_unresolved(reporter, payload, source_location)
       return if reporter.nil?
 
-      reporter.record_unresolved(payload: payload, source_location: source_location)
+      path, line, column = Reporter.position_of(source_location)
+      reporter.record_unresolved(payload: payload, path: path, line: line, column: column)
     end
   end
 end