rigortype 0.3.8 → 0.4.0

data/lib/rigor/effects/visibility.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Effects
+    # The `private` / `protected` members a class body declared, read straight off its statement list in
+    # source order (#1048).
+    #
+    # One reader, and it only ever declines: a UNIT {CalleeRule} rule. Rails' `action_methods` is a
+    # controller's **public** instance methods, so a private helper is never implicitly rendered as
+    # `<controller>/<helper>` — while a project that happens to ship a template of that name would
+    # otherwise hand the template's effects to the helper. `private def card` beside
+    # `app/views/users/card.html.erb` is the measured shape.
+    #
+    # Deliberately shallow and deliberately syntactic. It reads the class body's own top level, which is
+    # where all three spellings appear in practice, and answers "public" for anything it cannot see —
+    # `send(:private, :card)`, a visibility change in a `class_eval`, a concern that privatises on
+    # include. Declining to decline leaves today's behaviour intact, which is the right direction for a
+    # bit whose only power is to remove an edge.
+    module Visibility
+      # The markers whose ARGUMENT form names members. `public` is one of them and **subtracts**:
+      # `private; def reopened; end; public :reopened` is a public action, and an answer that only ever
+      # grew would mark it private and silently drop its implicit-render edge.
+      HIDING = %i[private protected].freeze
+      SHOWING = :public
+
+      NONE = [].freeze
+      private_constant :NONE
+
+      module_function
+
+      # The method names `body` — a class or module body — declared non-public.
+      def non_public_names(body)
+        statements = body.respond_to?(:body) ? Array(body.body) : NONE
+        names = Set.new
+        region = false
+        statements.each do |statement|
+          case statement
+          # A `def self.x` is not the instance method a later `def x` defines, and the two share a name.
+          # Recording the singleton would mark the instance method private, which is the same false
+          # negative from the other side.
+          when Prism::DefNode then names << statement.name.to_s if region && statement.receiver.nil?
+          when Prism::CallNode
+            region = region_after(statement, region)
+            apply_targets(names, statement)
+          end
+        end
+        names
+      end
+
+      # Whether a **bare** `private` / `protected` / `public` opened or closed the region. A marker with
+      # arguments names specific members instead and leaves the region exactly as it was, which is what
+      # lets `private def a` sit above a `public` region without closing it.
+      def region_after(node, region)
+        return region unless bare?(node)
+
+        case node.name
+        when :private, :protected then true
+        when :public then false
+        else region
+        end
+      end
+
+      # `private def foo` / `private :foo, :bar`, and their inverse `public def foo` / `public :foo`.
+      def apply_targets(names, node)
+        return unless node.receiver.nil?
+        return names.merge(argument_names(node)) if HIDING.include?(node.name)
+        return unless node.name == SHOWING
+
+        argument_names(node).each { |name| names.delete(name) }
+      end
+
+      def argument_names(node)
+        arguments = node.arguments&.arguments
+        return NONE if arguments.nil? || arguments.empty?
+
+        arguments.flat_map { |argument| names_in(argument) }
+      end
+
+      # One argument's names. The array form (`private %i[a b]`, `private [:a, :b]`) is read because it
+      # is ordinary and costs a line; a **splat** (`private(*names)`) is not, because the names are a
+      # value rather than syntax, and such a member reads as public — the direction that leaves
+      # today's behaviour intact rather than guessing.
+      def names_in(argument)
+        case argument
+        when Prism::DefNode then [argument.name.to_s]
+        when Prism::SymbolNode, Prism::StringNode then [argument.unescaped]
+        when Prism::ArrayNode then argument.elements.flat_map { |element| names_in(element) }
+        else NONE
+        end
+      end
+
+      def bare?(node)
+        node.receiver.nil? && node.arguments.nil? && node.block.nil?
+      end
+
+      private_class_method :region_after, :apply_targets, :argument_names, :names_in, :bare?
+    end
+  end
+end

data/lib/rigor/environment/bundle_sig_discovery.rb

@@ -46,14 +46,14 @@ module Rigor
         "bundler", "rubygems"
       ].freeze
 
-      # @param bundle_path [String, Pathname, nil] explicit path to the bundler install root. When `nil`,
+      # @param bundle_path — explicit path to the bundler install root. When `nil`,
       #   falls back to `auto_detect` if `auto_detect:` is true.
-      # @param project_root [String] resolution base for relative `bundle_path:` and the auto-detect search.
-      # @param auto_detect [Boolean] when true and `bundle_path:` is nil, try `.bundle/config`'s
+      # @param project_root — resolution base for relative `bundle_path:` and the auto-detect search.
+      # @param auto_detect — when true and `bundle_path:` is nil, try `.bundle/config`'s
       #   `BUNDLE_PATH:` and `vendor/bundle/` under `project_root`.
-      # @param skip_gems [Set<String>] gem names to exclude from discovery. Defaults to
+      # @param skip_gems — gem names to exclude from discovery. Defaults to
       #   {SKIPPED_GEMS_BY_DEFAULT}.
-      # @param locked_gems [Hash{String => LockfileResolver::LockedGem}, nil] Optional O4-Layer-3 filter.
+      # @param locked_gems — Optional O4-Layer-3 filter.
       #   When non-nil and non-empty, only `sig/` directories whose gem `(name, version, platform)` tuple
       #   matches a lockfile entry are returned. Bundle entries absent from the lockfile (or at a drifted
       #   version) are silently dropped — the lockfile is treated as the source of truth for "what gems this
@@ -63,7 +63,7 @@ module Rigor
       #   source keeps its stale `bundler/gems/` directory under the SAME name until a `bundle clean`. Pass
       #   `nil` (the default) to keep the pre-Layer-3 behaviour of returning every non-skipped `sig/` under
       #   the bundle.
-      # @return [Array<Pathname>] every `<gem-dir>/sig` directory under the resolved bundle path, minus any
+      # @return every `<gem-dir>/sig` directory under the resolved bundle path, minus any
       #   whose gem name is in `skip_gems` and (when `locked_gems` is supplied) minus any whose `(name,
       #   version, platform)` does not match a lockfile entry.
       def self.discover(bundle_path:, project_root: Dir.pwd, auto_detect: true,

data/lib/rigor/environment/class_registry.rb

@@ -136,8 +136,10 @@ module Rigor
 
       private
 
+      # Allocates only when there is a prefix to strip (see `Environment#normalize_class_name`).
       def normalize_name(name)
-        name.to_s.delete_prefix("::")
+        name = name.to_s
+        name.start_with?("::") ? name.delete_prefix("::") : name
       end
     end
   end

data/lib/rigor/environment/failure_slot.rb

@@ -16,12 +16,12 @@ module Rigor
         @value = nil
       end
 
-      # @param value [Array] a Marshal-clean tuple — the fork pool ships it back from the worker.
+      # @param value — a Marshal-clean tuple — the fork pool ships it back from the worker.
       def record(value)
         @value = value.freeze if @value.nil?
       end
 
-      # @return [Array, nil] the recorded tuple, or nil when the build never failed.
+      # @return the recorded tuple, or nil when the build never failed.
       attr_reader :value
     end
   end

data/lib/rigor/environment/installed_gem_set.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require_relative "lockfile_resolver"
+
+module Rigor
+  class Environment
+    # Issue #530 — the gem set for a project that has NO `Gemfile.lock`.
+    #
+    # ADR-82 WD9's constant-ownership index is driven by the LOCKED gem set, so a project without a
+    # lockfile (a plain library, a `gemspec`-only gem, an app vendored outside Bundler) handed the index
+    # nothing at all: every constant reaching into a real, installed, RBS-less gem recorded the generic
+    # cause, and the entire gem boundary reported as `engine_gap` — "report this to Rigor" — where the
+    # honest story is `add_rbs`. Measured on slim, whose whole Temple boundary lands that way while haml,
+    # which has a lockfile, attributes the same gem correctly.
+    #
+    # Degrading to the gems that are actually INSTALLED keeps ADR-82's honesty criterion intact. A name
+    # here is a gem that exists on disk; the index still has to READ its entry file before claiming any
+    # constant, and its lack of RBS is established by the same {RbsCoverageReport.classify} pass the
+    # lock-driven path uses. The version is the one on disk rather than a declared one — which is the
+    # version a lockfile-less project would load anyway.
+    #
+    # Only the missing-gem provenance index consumes this. The ADR-72 gem overlays stay Gemfile.lock-gated:
+    # an overlay changes what type-checks, so it needs the project's own declaration, while this
+    # side-channel only changes a label.
+    module InstalledGemSet
+      module_function
+
+      # @param bundle_path — the target's resolved bundler install root, or nil.
+      # @return frozen `gem name => LockfileResolver::LockedGem`, the shape
+      #   {RbsCoverageReport.classify} consumes. Empty when neither resolver sees anything, which leaves
+      #   today's generic cause in place.
+      def gems(bundle_path: nil)
+        found = from_bundle_tree(bundle_path)
+        found = from_installed_specs if found.empty?
+        found.freeze
+      end
+
+      # `<bundle>/ruby/X.Y.Z/gems/<name>-<version>/` — the same pure-filesystem layout
+      # {MissingGemConstantIndex.bundle_gem_dirs} walks, preferred over the host's gems so a project that
+      # vendored its bundle without committing the lockfile is read from its own tree. A platform-tagged
+      # directory (`ffi-1.17.4-aarch64-linux-gnu`) does not split into a name/version pair and is skipped:
+      # those gems ship native code, not the pure-Ruby constants this feeds.
+      def from_bundle_tree(bundle_path)
+        return {} if bundle_path.nil?
+
+        base = Pathname.new(bundle_path)
+        return {} unless base.directory?
+
+        Dir.glob(base.join("ruby", "*", "gems", "*")).each_with_object({}) do |dir, acc|
+          name, version = split_name_version(File.basename(dir))
+          next unless name
+
+          acc[name] ||= locked_gem(name, version)
+        end
+      end
+
+      # The gems the RUNNING Ruby can load. For the shipped `gem install rigortype` distribution that IS a
+      # lockfile-less project's gem environment — the same set its own `require` would reach. Under
+      # `bundle exec` it is the analyzer's own bundle instead (the `Gem.paths`-no-ops-under-Bundler
+      # mechanism ADR-90 documents), which yields fewer names, never wrong ones. Highest version per name,
+      # because `stubs` promises no ordering.
+      def from_installed_specs
+        Gem::Specification.stubs.each_with_object({}) do |stub, acc|
+          previous = acc[stub.name]
+          next if previous && Gem::Version.new(previous.version) >= stub.version
+
+          acc[stub.name] = locked_gem(stub.name, stub.version.to_s)
+        end
+      rescue StandardError
+        {}
+      end
+
+      def locked_gem(name, version)
+        LockfileResolver::LockedGem.new(name: name, version: version, platform: "ruby")
+      end
+
+      # Splits a gem install directory's basename. The version tail is anchored on a leading digit and must
+      # carry no further hyphen, which is what excludes the platform-tagged variants above.
+      def split_name_version(basename)
+        match = /\A(.+)-(\d[^-]*)\z/.match(basename)
+        match ? [match[1], match[2]] : nil
+      end
+    end
+  end
+end

data/lib/rigor/environment/lockfile_resolver.rb

@@ -39,13 +39,13 @@ module Rigor
         end
       end
 
-      # @param lockfile_path [String, Pathname, nil] explicit path to the Gemfile.lock. When `nil`, falls
+      # @param lockfile_path — explicit path to the Gemfile.lock. When `nil`, falls
       #   back to `auto_detect` if `auto_detect:` is true.
-      # @param project_root [String] resolution base for a relative `lockfile_path:` and the auto-detect
+      # @param project_root — resolution base for a relative `lockfile_path:` and the auto-detect
       #   search.
-      # @param auto_detect [Boolean] when true and `lockfile_path:` is nil, look for
+      # @param auto_detect — when true and `lockfile_path:` is nil, look for
       #   `<project_root>/Gemfile.lock`.
-      # @return [Hash{String => LockedGem}] frozen map of gem name → locked entry. Returns the empty frozen
+      # @return frozen map of gem name → locked entry. Returns the empty frozen
       #   hash when no lockfile is resolvable, when the file is unreadable, or when Bundler refuses to parse
       #   it.
       def self.locked_gems(lockfile_path:, project_root: Dir.pwd, auto_detect: true)
@@ -59,6 +59,56 @@ module Rigor
         parse(resolved)
       end
 
+      # The gems the project declares for itself — the lockfile's `DEPENDENCIES` section, which is what a
+      # `Gemfile` actually asked for, as opposed to {locked_gems}'s full resolved graph. A consumer that
+      # advises the user about their own stack has to read this one: `minitest`, `i18n`, `activesupport` and
+      # `ffi` sit in nearly every Rails lock as somebody else's dependency, so matching against the resolved
+      # graph advises about gems the project never chose.
+      #
+      # @param lockfile_path — explicit path to the Gemfile.lock; `nil` falls back to `auto_detect`.
+      # @param project_root — resolution base for a relative `lockfile_path:` and the auto-detect search.
+      # @param auto_detect — when true and `lockfile_path:` is nil, look for `<project_root>/Gemfile.lock`.
+      # @return frozen set of gem names. Empty when no lockfile is resolvable, when it is unreadable, when
+      #   Bundler refuses to parse it, or when the lockfile has no `DEPENDENCIES` section at all.
+      def self.direct_dependency_names(lockfile_path:, project_root: Dir.pwd, auto_detect: true)
+        resolved = resolve_lockfile_path(
+          lockfile_path: lockfile_path,
+          project_root: project_root,
+          auto_detect: auto_detect
+        )
+        return EMPTY_NAMES unless resolved
+
+        parse_dependency_names(resolved)
+      end
+
+      EMPTY_NAMES = Set.new.freeze
+      private_constant :EMPTY_NAMES
+
+      def self.parse_dependency_names(path)
+        require "bundler"
+      rescue LoadError => e
+        warn "rigor: cannot read #{path}: bundler is not available (#{e.message})"
+        EMPTY_NAMES
+      else
+        do_parse_dependency_names(path)
+      end
+      private_class_method :parse_dependency_names
+
+      def self.do_parse_dependency_names(path)
+        parser = Bundler::LockfileParser.new(File.read(path.to_s))
+        # `#dependencies` is the parsed `DEPENDENCIES` section keyed by gem name, so the version constraint
+        # and the pinned-source `!` suffix are already stripped for us. The upstream bundler RBS shim does
+        # not declare it.
+        parser.dependencies.keys.to_set { |name| -name.to_s }.freeze # rigor:disable undefined-method
+      rescue ::Ractor::IsolationError => e
+        warn_isolated(path, e)
+        EMPTY_NAMES
+      rescue StandardError => e
+        warn "rigor: ignoring malformed #{path} (#{e.class}: #{e.message})"
+        EMPTY_NAMES
+      end
+      private_class_method :do_parse_dependency_names
+
       # Returns the resolved lockfile path (`Pathname`) or `nil` when neither explicit nor auto-detect
       # produces one. Public so the stats banner can show what rigor picked up.
       def self.resolve_lockfile_path(lockfile_path:, project_root: Dir.pwd, auto_detect: true)
@@ -109,11 +159,25 @@ module Rigor
           )
         end
         locked.freeze
+      rescue ::Ractor::IsolationError => e
+        warn_isolated(path, e)
+        EMPTY
       rescue StandardError => e
         warn "rigor: ignoring malformed #{path} (#{e.class}: #{e.message})"
         EMPTY
       end
       private_class_method :do_parse
+
+      # #1064 — Bundler's lockfile parser reads RubyGems module state a non-main Ractor may not touch, so the
+      # parse raises `Ractor::IsolationError` there whatever the lockfile says. That is an engine constraint, not
+      # a malformed lockfile, and the warning must not send the user to fix a file that is fine. The Ractor pool
+      # does not reach this: its coordinator resolves the lockfile on the main Ractor and hands every worker the
+      # result (`WorkerSession.new(locked_gems:)`). The rescue stays for any future caller that forgets to.
+      def self.warn_isolated(path, error)
+        warn "rigor: cannot read #{path} inside a Ractor worker, so gem dependency discovery is off for it " \
+             "(#{error.class}: #{error.message})"
+      end
+      private_class_method :warn_isolated
     end
   end
 end