rigortype 0.4.5 → 0.4.6

data/lib/rigor/analysis/check_rules.rb

@@ -29,6 +29,7 @@ require_relative "check_rules/void_value_use_collector"
 require_relative "check_rules/self_closedness_scanner"
 require_relative "check_rules/source_arity"
 require_relative "check_rules/lexical_method_sites"
+require_relative "check_rules/rebinding_block_callees"
 require_relative "check_rules/rbs_receiver_surface"
 require_relative "check_rules/special_global_setters"
 require_relative "check_rules/ruby_deprecations"
@@ -450,11 +451,31 @@ module Rigor
           other_class = ivar_class_for(write[:type])
           next nil if other_class.nil? || other_class == "NilClass" || other_class == first_class
           next nil if declaration_admits?(write[:declared], canonical[:type], write[:type])
+          next nil if separate_invocations?(write, other_class, writes)
 
           build_ivar_write_mismatch_diagnostic(path, write[:node], class_name, ivar_name, first_class, other_class)
         end
       end
 
+      # ADR-125 — a divergent write is never live together with the writes it conflicts with when the class
+      # serves one entry point per instance (a plugin-declared per-invocation class, e.g. a Rails controller:
+      # one action per request) and every conflicting write — non-nil, of a concrete class other than this
+      # write's — sits in a DIFFERENT action of the same class. An action is a public method no declared
+      # non-action macro names (`before_action :x`, `helper_method :y`); {IvarWriteCollector} decides it. A
+      # conflicting write in a private or protected helper, a callback target, a `helper_method`,
+      # `initialize`, or the same method keeps the finding. Which helper each action reaches is not proved
+      # here.
+      def separate_invocations?(write, write_class, writes)
+        return false unless write[:action]
+
+        writes.all? do |other|
+          other_class = ivar_class_for(other[:type])
+          next true if other_class.nil? || other_class == "NilClass" || other_class == write_class
+
+          other[:action] && other[:method_name] != write[:method_name]
+        end
+      end
+
       def declaration_admits?(declared, *write_types)
         return false if declared.nil?
 
@@ -969,7 +990,8 @@ module Rigor
         # ({RbsReceiverSurface}). Last for {#ancestry_declares_method?}'s reason: it walks the class graph.
         def rbs_ancestor_may_answer?(class_name, method_name, scope, kind)
           if kind == :singleton
-            RbsReceiverSurface.singleton_hook?(scope, class_name)
+            RbsReceiverSurface.singleton_hook?(scope, class_name) ||
+              RbsReceiverSurface.singleton_mixin_may_answer?(scope, class_name, method_name)
           else
             RbsReceiverSurface.ancestor_may_answer?(scope, class_name, method_name)
           end
@@ -1225,12 +1247,22 @@ module Rigor
           # body is morally a class body, so ADR-34 stays silent there — including on a genuinely
           # undefined name inside the block. Ranges are computed once per file.
           return nil if call_inside_receiver_eval_ranges?(eval_ranges, call_node)
-          # ADR-121 WD7 — a refinement of `Object` (or one Rigor cannot read) in effect here may define the name.
-          return nil if refined_method_in_effect?("Object", call_node, scope, :instance, lexical_sites)
+          return nil if lexically_declined_toplevel_call?(call_node, scope, lexical_sites, scope_index)
 
           build_unresolved_toplevel_diagnostic(path, call_node)
         end
 
+        # The `call.unresolved-toplevel` declines that read the file's syntax, asked last because they walk it.
+        def lexically_declined_toplevel_call?(call_node, scope, lexical_sites, scope_index = nil)
+          # ADR-121 WD7 — a refinement of `Object` (or one Rigor cannot read) in effect here may define the name.
+          return true if refined_method_in_effect?("Object", call_node, scope, :instance, lexical_sites)
+          return false if lexical_sites.nil?
+
+          # Issue #1817 — a block handed to a project method that may `module_eval` / `instance_exec` it runs under
+          # another `self`, so a call in it is not a top-level one ({RebindingBlockCallees}).
+          RebindingBlockCallees.inside_rebound_block?(call_node, scope, lexical_sites.block_calls, scope_index)
+        end
+
         # Issue #1383 — RBS core declares `main`'s private singleton methods on
         # `RBS::Unnamed::TopLevelSelfClass`, so the set follows RBS rather than a hand-kept
         # list. CRuby 4.0's `main` also has `ruby2_keywords`, which RBS does not declare.
@@ -1487,12 +1519,27 @@ module Rigor
         # overlay open receiver ({GEM_OVERLAY_OPEN_RECEIVERS}) whose
         # bundled directory this run actually loaded, a core-overlay
         # open receiver ({CORE_OVERLAY_OPEN_RECEIVERS}), or a
-        # Rigor-synthesized stub type (see `RbsLoader#synthesized_type_names`).
+        # Rigor-synthesized stub type (see `RbsLoader#synthesized_type_names`),
+        # or a project-only reopen of a Ruby library class whose own RBS
+        # did not load ({#ruby_library_reopen?}).
         def unbounded_receiver_surface?(class_name, scope)
           bare_name = class_name.to_s.sub(/\A::/, "")
           open_receiver?(class_name, scope) || synthesized_stub_receiver?(class_name, scope) ||
             CORE_OVERLAY_OPEN_RECEIVERS.include?(bare_name) ||
-            (GEM_OVERLAY_OPEN_RECEIVERS.include?(bare_name) && gem_overlay_loaded?(scope))
+            (GEM_OVERLAY_OPEN_RECEIVERS.include?(bare_name) && gem_overlay_loaded?(scope)) ||
+            ruby_library_reopen?(class_name, scope)
+        end
+
+        # Issue #2174 — `class Matrix` reopened with one `#:`-annotated method, and no `matrix` signatures
+        # loaded, gives Matrix a declaration holding only that method ({RbsLoader#ruby_library_reopen?}).
+        # `Matrix.identity(2)` is correct Ruby, so the class's surface is treated as open: `call.undefined-method`
+        # declines on it, and a signature it only inherits (`Object#initialize` for `Matrix.new(rows)`) stops
+        # deciding arity and argument types. Methods the project's own declaration lists stay checked.
+        def ruby_library_reopen?(class_name, scope)
+          loader = scope.environment&.rbs_loader
+          return false if loader.nil? || !loader.respond_to?(:ruby_library_reopen?)
+
+          loader.ruby_library_reopen?(class_name)
         end
 
         def open_receiver?(class_name, scope)
@@ -2780,9 +2827,37 @@ module Rigor
 
         # Whether any project or `pre_eval:` file aliases `name`, on either side, which can make it another variable.
         def global_aliased?(scope, name)
+          record_global_census(Inference::GlobalWriteCensus.alias_entry(name))
           Inference::GlobalWriteCensus.aliased?(global_write_census(scope), name)
         end
 
+        # Issue #2158 — a read of the whole-program census records the `global_census:` key of each entry it asks
+        # about ({Inference::GlobalWriteCensus.dependency_key}): a file that starts or stops writing the entry (a `def
+        # write`, an `alias $stdout $x`, a computed `define_method`) re-checks the write. A `pre_eval:` file moves the
+        # snapshot's own fingerprint.
+        def record_global_census(*entries)
+          return unless DependencyRecorder.active?
+
+          entries.each do |entry|
+            DependencyRecorder.read_name(:global_census, Inference::GlobalWriteCensus.dependency_key(entry))
+          end
+        end
+
+        # Whether the census holds any of `entries`, recording only what can flip the answer: the entries present
+        # when it holds one (the answer stays true until every one of them vanishes, and another appearing changes
+        # nothing), every entry when it holds none.
+        #
+        # This rests on an invariant: every census entry can only move a write toward being silenced, and a reported
+        # write is always re-checked through `IncrementalSession#global_write_reporters`, so recording only the
+        # present entries on a yes is sound. A future census entry that makes a write reported would break it, and
+        # its reader would have to record every entry. Recording every entry on a no is defence in depth, since the
+        # write that answer leaves reported re-checks through `global_write_reporters` anyway.
+        def census_holds_any?(census, entries)
+          present = entries.select { |entry| census.include?(entry) }
+          record_global_census(*(present.empty? ? entries : present))
+          !present.empty?
+        end
+
         # A literal is rejected when its class is none the setter takes and, for a setter that also converts
         # (`to_str`, `to_int`) or asks for `write`, the literal's object cannot answer that method.
         def literal_rejected?(class_name, contract, node, scope, lexical_sites)
@@ -2830,11 +2905,15 @@ module Rigor
         end
 
         def program_may_answer?(ancestors, names, census, scope)
-          return true if Inference::GlobalWriteCensus.defines_any_of?(census, names)
+          defines = [Inference::GlobalWriteCensus::DEFINES_ANY, *names.map { |name| [:defines, name] }]
+          return true if census_holds_any?(census, defines)
 
           dynamic_mark = Scope::DiscoveryIndex::ENVELOPE_DYNAMIC_MARK
           return true if ancestors.any? { |owner| scope.parameter_envelopes_of(owner).key?(dynamic_mark) }
 
+          # One key for every top-level mixin, a deliberate trade-off: the reader asks about each, so a mixin
+          # appearing or vanishing anywhere re-checks every write that reached this step.
+          record_global_census(%i[main_mixin *])
           main_mixins = Inference::GlobalWriteCensus.main_mixins(census)
           main_mixins.any? { |mixin| rbs_mixin_may_answer?(mixin, names, scope) } ||
             mixin_may_answer?(ancestors, names, scope)
@@ -2876,7 +2955,7 @@ module Rigor
         # active refinement on Ruby 4.0.5; a refined `respond_to_missing?` or `respond_to?`, and every implicit
         # conversion, do not, so a refinement that adds only those leaves the write reported.
         def refined_writer_in_effect?(census, node, scope, lexical_sites)
-          Inference::GlobalWriteCensus.refines_write?(census) &&
+          census_holds_any?(census, [Inference::GlobalWriteCensus::REFINES_ANY, %i[refines write]]) &&
             (lexical_sites.nil? || !scope.declared_refinements.empty? ||
               lexical_sites.refinements.any_at?(node.location.start_offset))
         end
@@ -3032,6 +3111,7 @@ module Rigor
         # `Widget.new` would read, and file the dependency edges of, the whole singleton chain. The set is memoised per
         # discovery index.
         def private_singleton_candidate?(scope, name)
+          DependencyRecorder.read_visibility("*", name) if DependencyRecorder.active?
           discovery = scope.discovery
           slot = Thread.current[PRIVATE_NAMES_MEMO]
           unless slot && slot[0].equal?(discovery)
@@ -3058,7 +3138,8 @@ module Rigor
           return true if rows.nil?
 
           offset = call_node.location.start_offset
-          rows.none? { |(start, finish, name, _kind, _owner)| !name.nil? && start <= offset && offset < finish }
+          # A row with no side (a `def` in a block, a `define_method` name) is a block's range or no range at all.
+          rows.none? { |(start, finish, _name, kind, _owner)| !kind.nil? && start <= offset && offset < finish }
         end
 
         SINGLETON_WILDCARD_SLOT = %i[singleton *].freeze
@@ -3070,6 +3151,7 @@ module Rigor
           discovery = scope.discovery
           chain = Scope::ResolutionChain.for(scope, class_name.to_s, :singleton, :methods)
           chain.entries.any? do |entry|
+            DependencyRecorder.read_visibility(entry.name, SINGLETON_WILDCARD_SLOT.last) unless entry.external?
             !entry.external? && discovery.contested?(:discovered_method_visibilities,
                                                      [entry.name, SINGLETON_WILDCARD_SLOT])
           end
@@ -4202,6 +4284,9 @@ module Rigor
 
           override_visibility = scope.discovered_method_visibility(class_name, method_name)
           return nil if override_visibility.nil?
+          # Issue #2013 — a contested slot (a later `define_method` or alias gave the name another visibility, or a
+          # write the walk cannot place) proves no reduction.
+          return nil if scope.discovery.contested?(:discovered_method_visibilities, [class_name, method_name])
 
           parent = nearest_ancestor_visibility(scope, class_name, method_name)
           return nil if parent.nil?

data/lib/rigor/analysis/dependency_recorder.rb

@@ -406,6 +406,17 @@ module Rigor
         end
       end
 
+      # Issue #2134 — {read_name} for a read of `class_name`'s visibility slots for `method_name`, on either side, or
+      # of their contest: `visibility:<class>#<method>`. `IncrementalSession#visibility_name_affected` fires the key
+      # when a file's visibility entry or contest for the slot moves. A reader that asks whether ANY class records
+      # the name private passes `"*"` as the class; the key fires when any entry of the name moves. A wildcard
+      # slot (`[:singleton, :*]`) is `*` as the method name.
+      def read_visibility(class_name, method_name)
+        return if Thread.current[KEY].nil?
+
+        read_name(:visibility, "#{class_name}##{method_name}")
+      end
+
       # The miss-only spelling of {read_name}: a cross-file lookup of `name` (kind `:method` / `:class` /
       # `:toplevel` / …) that resolved to nothing. Kept as the name the internal spec's negative-edge
       # contract uses.

data/lib/rigor/analysis/edit_replay.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Analysis
+    # Issue #1967 — the edits `rigor check --verify-incremental-edits` replays on each sampled file, as the text an
+    # editor buffer stands in for it with ({IncrementalSession#replay_edit}).
+    #
+    # - `emptied` — the file with nothing in it. Every declaration and definition it makes disappears, so the replay
+    #   exercises the edges a removed declaration fires.
+    # - `skeleton` — the file's `class` / `module` declarations, nested as written, with every body statement dropped
+    #   (methods, `refine` blocks, visibility calls, mixins, constants). The declarations stay, so the class-level keys
+    #   a removed declaration fires stay quiet, and a finer edge such as #2163's `refinement:` is what puts a reader
+    #   into the closure. Emptying alone does not exercise that one: the broader key it fires re-checks the reader
+    #   anyway. Not every finer edge is reached: dropping a body still moves a broader key for some of them. A
+    #   `visibility:` edge is one (#2161's `module_function :two` to `private :two` swap passes both edits with the
+    #   edge removed), and only an edit that changes a body while keeping it (#2277) would test it.
+    #
+    # Neither replays an addition or a body-changing edit. A skeleton identical to the file, or with no declaration
+    # (the emptied file again, or a file that does not parse), is not replayed.
+    module EditReplay
+      Edit = Data.define(:label, :source)
+
+      module_function
+
+      # The edits to replay for `source`, in order.
+      def edits(source)
+        emptied = Edit.new(label: "emptying", source: "")
+        reduced = skeleton(source)
+        return [emptied] if reduced.empty? || reduced == source
+
+        [emptied, Edit.new(label: "reducing to its class/module skeleton", source: reduced)]
+      end
+
+      # `source`'s `class` / `module` declarations, nested, with their bodies dropped; "" when it does not parse or
+      # declares nothing.
+      def skeleton(source)
+        result = Prism.parse(source)
+        return "" unless result.success?
+
+        lines = declarations(result.value.statements, 0)
+        lines.empty? ? "" : "#{lines.join("\n")}\n"
+      end
+
+      # The skeleton lines of the declarations directly in `statements`, indented `depth` levels.
+      def declarations(statements, depth)
+        return [] unless statements.is_a?(Prism::StatementsNode)
+
+        statements.body.flat_map do |node|
+          next [] unless node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode)
+
+          indent = "  " * depth
+          ["#{indent}#{header_of(node)}", *declarations(node.body, depth + 1), "#{indent}end"]
+        end
+      end
+
+      def header_of(node)
+        return "module #{node.constant_path.slice}" if node.is_a?(Prism::ModuleNode)
+
+        superclass = node.superclass
+        superclass ? "class #{node.constant_path.slice} < #{superclass.slice}" : "class #{node.constant_path.slice}"
+      end
+      private_class_method :declarations, :header_of
+    end
+  end
+end

data/lib/rigor/analysis/incremental.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../inference/global_write_census"
+
 module Rigor
   module Analysis
     # ADR-46 slice 2 — the pure set-algebra core of the incremental step, kept side-effect-free and
@@ -132,6 +134,41 @@ module Rigor
         moved.freeze
       end
 
+      # Issue #2158 — the `global_census:` keys whose entries moved in this edit: one for every entry that appeared in
+      # or vanished from a file's `global_write_census` ({Inference::GlobalWriteCensus.dependency_key}). `paths` MUST
+      # include removed files, whose whole census vanished. `before` / `after` map a path to that file's census Set (nil
+      # when it records nothing).
+      def changed_global_census_keys(paths, before, after)
+        moved = Set.new
+        paths.each do |path|
+          ((before[path] || Set.new) ^ (after[path] || Set.new)).each do |entry|
+            moved << "global_census:#{Inference::GlobalWriteCensus.dependency_key(entry)}"
+          end
+        end
+        moved.freeze
+      end
+
+      # The {Inference::ScopeIndexer.visibility_entries} entries that carry a leading marker before `class, slot`.
+      MARKED_VISIBILITY_ENTRIES = %i[contested module_function].freeze
+
+      # Issue #2134 — the `<class>#<method>` slots whose visibility entries or contests moved in this edit: one for
+      # every entry that appeared in or vanished from a file's {Inference::ScopeIndexer.visibility_entries}, a
+      # singleton slot's `[:singleton, name]` read as `name` (the wildcard slot as `*`), plus `*#<method>`, which the
+      # "is the name private anywhere" readers record. That key fires for an entry of any visibility: the merge is
+      # last-writer-wins, so dropping a `public :foo` can uncover another file's `private :foo`. `paths` MUST include
+      # removed files. Issue #2161 — a `[:module_function, owner, name]` entry fires `<owner>#<name>` the same way.
+      def changed_visibility_slots(paths, before, after)
+        moved = Set.new
+        paths.each do |path|
+          ((before[path] || Set.new) ^ (after[path] || Set.new)).each do |entry|
+            class_name, slot = MARKED_VISIBILITY_ENTRIES.include?(entry.first) ? entry.drop(1) : entry
+            name = slot.is_a?(Array) ? slot.last : slot
+            moved << "#{class_name}##{name}" << "*##{name}"
+          end
+        end
+        moved.freeze
+      end
+
       # Issue #1120 — the method names whose refinements moved in this edit. A consumer whose answer consulted the
       # refinement table recorded a `refinement:<method>` edge whichever way it answered, because the answer is a
       # function of the whole project's refinements of that name. `paths` MUST include removed files, whose whole