rubik 0.1.0

data/lib/rubik/adapter/generic.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require_relative "base"
+require_relative "../security/guard" unless defined?(Rubik::Security::Guard)
+
+module Rubik
+  module Adapter
+    class GenericAdapter < BaseAdapter
+      attr_accessor :custom_syntax_cmd
+
+      def initialize(name, binary_name: nil, test_cmd: nil, format_cmd: nil, syntax_cmd: nil, guard: nil, validation_shell: nil)
+        # Assigned BEFORE the validate_custom_command! calls below so ctor-time
+        # validation already consults the shared session guard (operator
+        # allowlist) instead of a fresh zero-policy one. validation_shell
+        # carries the caller's shell context (e.g. RunTestsTool classifies
+        # runner candidates with bash semantics).
+        @validation_guard = guard
+        @validation_shell = validation_shell
+        validate_custom_command!(test_cmd, shell: @validation_shell) if test_cmd
+        validate_custom_command!(format_cmd, shell: @validation_shell) if format_cmd
+        validate_custom_command!(syntax_cmd, shell: @validation_shell) if syntax_cmd
+
+        derived_bin = binary_name ||
+                      (test_cmd ? test_cmd.to_s.strip.split.first : nil) ||
+                      (format_cmd ? format_cmd.to_s.strip.split.first : nil) ||
+                      (syntax_cmd ? syntax_cmd.to_s.strip.split.first : nil) ||
+                      name
+        super(name, derived_bin)
+        @custom_test_cmd = test_cmd
+        @custom_format_cmd = format_cmd
+        @custom_syntax_cmd = syntax_cmd
+      end
+
+      # Validate a custom command string through the Security::Guard before it
+      # is ever executed. These commands are operator-supplied arbitrary shell
+      # commands; running them without classification is the exact RCE surface
+      # this adapter used to expose. Fail-closed: an unclassifiable or dangerous
+      # string raises BlockedWriteError rather than running. The injected
+      # session guard carries operator policy; the fresh fallback (silent
+      # audit, zero policy) serves standalone/test constructions only.
+      def validate_custom_command!(cmd_str, shell: nil)
+        return true if cmd_str.nil? || cmd_str.to_s.strip.empty?
+
+        (@validation_guard ||= Rubik::Security::Guard.new(audit_log_path: nil)).verify_command_safety!(cmd_str, shell: shell)
+        true
+      end
+
+      def available?
+        Runtime::Discovery.binary_available?(@binary_name)
+      end
+
+      def check_syntax(file_path)
+        return unavailable_result unless available?
+        return { ok: true, output: "Syntax check not configured for #{@name}", duration: 0.0, exit_code: 0 } unless @custom_syntax_cmd
+
+        # Classify + validate the operator-supplied syntax command through the
+        # Security::Guard before executing it (no bare process run).
+        validate_custom_command!(@custom_syntax_cmd, shell: nil)
+
+        cmd = if @custom_syntax_cmd.include?("%s")
+                format(@custom_syntax_cmd, Shellwords.escape(file_path))
+              else
+                "#{@custom_syntax_cmd} #{Shellwords.escape(file_path)}"
+              end
+        ProcessRunner.run(cmd)
+      end
+
+      protected
+
+      def default_test_cmd
+        @custom_test_cmd
+      end
+
+      def default_format_cmd(file_path)
+        return nil unless @custom_format_cmd
+
+        if @custom_format_cmd.include?("%s")
+          format(@custom_format_cmd, Shellwords.escape(file_path))
+        else
+          "#{@custom_format_cmd} #{Shellwords.escape(file_path)}"
+        end
+      end
+    end
+  end
+end

data/lib/rubik/adapter/go.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require_relative "base"
+
+module Rubik
+  module Adapter
+    class GoAdapter < BaseAdapter
+      def initialize
+        super("go", "go")
+      end
+
+      def check_syntax(file_path)
+        return unavailable_result unless available?
+
+        ProcessRunner.run("go vet #{Shellwords.escape(file_path)}")
+      end
+
+      def compile(root_dir)
+        return unavailable_result unless available?
+
+        ProcessRunner.run("go build ./...", chdir: root_dir)
+      end
+
+      protected
+
+      def default_test_cmd
+        "go test ./..."
+      end
+
+      def default_format_cmd(file_path)
+        "gofmt -w #{Shellwords.escape(file_path)}"
+      end
+    end
+  end
+end

data/lib/rubik/adapter/node.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require "json"
+require "shellwords"
+require_relative "base"
+
+module Rubik
+  module Adapter
+    class NodeAdapter < BaseAdapter
+      def initialize(name = "node", binary_name = "node")
+        super
+      end
+
+      def available?
+        !Rubik::Platform.which("node").nil? ||
+          !Rubik::Platform.which("npm").nil? ||
+          !Rubik::Platform.which("bun").nil?
+      end
+
+      def resolve_test_cmd(root_dir = Dir.pwd, path: nil)
+        base = if @custom_test_cmd && !@custom_test_cmd.strip.empty?
+                 @custom_test_cmd
+               else
+                 base_node_test_cmd(root_dir)
+               end
+        return base if path.nil? || path.to_s.strip.empty?
+
+        targeted_test_cmd(base, path.to_s.strip)
+      end
+
+      def base_node_test_cmd(root_dir)
+        runner = runner_for(root_dir)
+        pkg_file = File.join(root_dir, "package.json")
+
+        if File.exist?(pkg_file)
+          begin
+            parsed = JSON.parse(File.read(pkg_file))
+            scripts = parsed.is_a?(Hash) && parsed["scripts"].is_a?(Hash) ? parsed["scripts"] : {}
+
+            target_script = if scripts.key?("test:run")
+                              "test:run"
+                            elsif scripts.key?("test")
+                              "test"
+                            elsif scripts.key?("test:unit")
+                              "test:unit"
+                            end
+
+            if target_script
+              return target_script == "test" ? "#{runner} test" : "#{runner} run #{target_script}"
+            end
+          rescue JSON::ParserError, SystemCallError
+            # fallback to default
+          end
+        end
+
+        "#{runner} test"
+      end
+
+      def targeted_test_cmd(base_cmd, path)
+        clean_path = path.to_s.tr("\\", "/")
+        if base_cmd.include?("%s")
+          format(base_cmd, Shellwords.escape(clean_path))
+        elsif base_cmd =~ /(?:npm|pnpm|yarn)\s+(?:run\s+)?test/
+          "#{base_cmd} -- #{Shellwords.escape(clean_path)}"
+        else
+          "#{base_cmd} #{Shellwords.escape(clean_path)}"
+        end
+      end
+
+      def check_syntax(file_path)
+        return unavailable_result unless available?
+
+        ext = File.extname(file_path).downcase
+        escaped = Shellwords.escape(file_path)
+
+        cmd = case ext
+              when ".ts", ".tsx"
+                if Runtime::Discovery.binary_available?("tsc")
+                  "tsc --noEmit #{escaped}"
+                elsif Runtime::Discovery.binary_available?("npx")
+                  "npx tsc --noEmit #{escaped}"
+                else
+                  "node --check #{escaped}"
+                end
+              when ".vue"
+                if Runtime::Discovery.binary_available?("vue-tsc")
+                  "vue-tsc --noEmit"
+                elsif Runtime::Discovery.binary_available?("npx")
+                  "npx vue-tsc --noEmit"
+                else
+                  return unavailable_result(reason: "No syntax checker available for Vue files. Install vue-tsc.")
+                end
+              else
+                "node --check #{escaped}"
+              end
+
+        ProcessRunner.run(cmd)
+      end
+
+      def resolve_format_cmd(file_path)
+        if @custom_format_cmd && !@custom_format_cmd.strip.empty?
+          if @custom_format_cmd.include?("%s")
+            format(@custom_format_cmd, Shellwords.escape(file_path))
+          else
+            "#{@custom_format_cmd} #{Shellwords.escape(file_path)}"
+          end
+        else
+          escaped = Shellwords.escape(file_path)
+          dir = File.dirname(file_path)
+          discovered = Runtime::Discovery.discover_formatters(root_dir: dir, lang: @name)
+          if discovered.first
+            "#{discovered.first} #{escaped}"
+          elsif Runtime::Discovery.binary_available?("biome")
+            "biome format --write #{escaped}"
+          elsif Runtime::Discovery.binary_available?("prettier")
+            "prettier --write #{escaped}"
+          else
+            default_format_cmd(file_path)
+          end
+        end
+      end
+
+      protected
+
+      def runner_for(root_dir)
+        if File.exist?(File.join(root_dir, "pnpm-lock.yaml"))
+          "pnpm"
+        elsif File.exist?(File.join(root_dir, "yarn.lock"))
+          "yarn"
+        elsif File.exist?(File.join(root_dir, "bun.lockb"))
+          "bun"
+        else
+          "npm"
+        end
+      end
+
+      def default_test_cmd
+        "npm test"
+      end
+
+      def default_format_cmd(file_path)
+        "prettier --write #{Shellwords.escape(file_path)}"
+      end
+    end
+  end
+end

data/lib/rubik/adapter/process.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "open3"
+require "timeout"
+
+module Rubik
+  module Adapter
+    class ProcessRunner
+      def self.run(cmd, timeout: 15, chdir: Dir.pwd)
+        start_time = Time.now
+        stdout_str = ""
+        stderr_str = ""
+        exit_code = 127
+
+        pid = nil
+        begin
+          Timeout.timeout(timeout) do
+            Open3.popen3(cmd, chdir: chdir) do |stdin, stdout, stderr, wait_thr|
+              pid = wait_thr.pid
+              begin
+                stdin.close
+              rescue
+                nil
+              end
+              t_out = Thread.new do
+                stdout.read
+              rescue
+                ""
+              end
+              t_err = Thread.new do
+                stderr.read
+              rescue
+                ""
+              end
+              begin
+                stdout_str = t_out.value.to_s
+                stderr_str = t_err.value.to_s
+                status = wait_thr.value
+                exit_code = status.exitstatus || (status.signaled? ? (128 + (status.termsig || 1)) : 1)
+              ensure
+                begin
+                  t_out.kill
+                rescue
+                  nil
+                end
+                begin
+                  t_err.kill
+                rescue
+                  nil
+                end
+              end
+            end
+          end
+        rescue Timeout::Error
+          Rubik::Platform.kill_tree(pid) if pid
+          stderr_str = "Execution timed out after #{timeout} seconds"
+          exit_code = 124
+        rescue Errno::ENOENT => e
+          stderr_str = "Binary not found: #{e.message}"
+          exit_code = 127
+        rescue StandardError => e
+          stderr_str = "Execution error: #{e.message}"
+          exit_code = 1
+        end
+
+        duration = Time.now - start_time
+        {
+          ok: exit_code.zero?,
+          exit_code: exit_code,
+          stdout: stdout_str,
+          stderr: stderr_str,
+          output: [stdout_str, stderr_str].reject(&:empty?).join("\n"),
+          duration: duration.round(4)
+        }
+      end
+    end
+  end
+end

data/lib/rubik/adapter/python.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require_relative "base"
+
+module Rubik
+  module Adapter
+    class PythonAdapter < BaseAdapter
+      def initialize
+        super("python", "python3")
+      end
+
+      def check_syntax(file_path)
+        return unavailable_result unless available?
+
+        ProcessRunner.run("python3 -m py_compile #{Shellwords.escape(file_path)}")
+      end
+
+      protected
+
+      def default_test_cmd
+        "pytest"
+      end
+
+      def default_format_cmd(file_path)
+        "ruff format #{Shellwords.escape(file_path)}"
+      end
+    end
+  end
+end

data/lib/rubik/adapter/registry.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "monitor"
+require_relative "ruby"
+require_relative "python"
+require_relative "go"
+require_relative "rust"
+require_relative "c"
+require_relative "zig"
+require_relative "node"
+require_relative "crystal"
+require_relative "generic"
+
+module Rubik
+  module Adapter
+    class Registry
+      def initialize
+        @monitor = Monitor.new
+        node_adapter = NodeAdapter.new
+        @adapters = {
+          "ruby" => RubyAdapter.new,
+          "python" => PythonAdapter.new,
+          "go" => GoAdapter.new,
+          "rust" => RustAdapter.new,
+          "c" => CAdapter.new,
+          "zig" => ZigAdapter.new,
+          "crystal" => CrystalAdapter.new,
+          "node" => node_adapter,
+          "javascript" => node_adapter,
+          "typescript" => node_adapter,
+          "vue" => node_adapter
+        }
+      end
+
+      def get(lang_name)
+        @monitor.synchronize do
+          @adapters[lang_name.to_s.downcase]
+        end
+      end
+
+      def register(lang_name, adapter_instance, ctx: nil)
+        key = lang_name.to_s.downcase
+        restore = @monitor.synchronize do
+          prior = @adapters[key]
+          @adapters[key] = adapter_instance
+          lambda do
+            @monitor.synchronize do
+              next unless @adapters.key?(key) && @adapters[key].equal?(adapter_instance)
+
+              prior ? @adapters[key] = prior : @adapters.delete(key)
+            end
+          end
+        end
+        ctx&.on_dispose(&restore)
+        adapter_instance
+      end
+
+      def unregister(lang_name)
+        @monitor.synchronize do
+          @adapters.delete(lang_name.to_s.downcase)
+        end
+      end
+
+      # Atomic hot-swap of an adapter.
+      # Reentrant lock safety: Monitor#synchronize is explicitly reentrant (recursive),
+      # allowing safe unregister and register invocation within the same critical section.
+      def swap(lang_name, new_adapter)
+        @monitor.synchronize do
+          unregister(lang_name)
+          register(lang_name, new_adapter) if new_adapter
+        end
+      end
+
+      def list
+        @monitor.synchronize do
+          @adapters.keys.dup
+        end
+      end
+    end
+  end
+end

data/lib/rubik/adapter/ruby.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require_relative "base"
+
+module Rubik
+  module Adapter
+    class RubyAdapter < BaseAdapter
+      def initialize
+        super("ruby", "ruby")
+      end
+
+      def check_syntax(file_path)
+        return unavailable_result unless available?
+
+        ProcessRunner.run("ruby -c #{Shellwords.escape(file_path)}")
+      end
+
+      protected
+
+      def default_test_cmd
+        "rake test"
+      end
+
+      def default_format_cmd(file_path)
+        "rubocop -a #{Shellwords.escape(file_path)}"
+      end
+    end
+  end
+end

data/lib/rubik/adapter/rust.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require_relative "base"
+
+module Rubik
+  module Adapter
+    class RustAdapter < BaseAdapter
+      def initialize
+        super("rust", "cargo")
+      end
+
+      def check_syntax(_file_path)
+        return unavailable_result unless available?
+
+        ProcessRunner.run("cargo check")
+      end
+
+      def compile(root_dir)
+        return unavailable_result unless available?
+
+        ProcessRunner.run("cargo build", chdir: root_dir)
+      end
+
+      protected
+
+      def default_test_cmd
+        "cargo test"
+      end
+
+      def default_format_cmd(file_path)
+        "rustfmt #{Shellwords.escape(file_path)}"
+      end
+    end
+  end
+end

data/lib/rubik/adapter/zig.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require_relative "base"
+
+module Rubik
+  module Adapter
+    class ZigAdapter < BaseAdapter
+      def initialize
+        super("zig", "zig")
+      end
+
+      def check_syntax(file_path)
+        return unavailable_result unless available?
+
+        ProcessRunner.run("zig build-exe -fno-emit-bin #{Shellwords.escape(file_path)}")
+      end
+
+      def compile(root_dir)
+        return unavailable_result unless available?
+
+        ProcessRunner.run("zig build", chdir: root_dir)
+      end
+
+      protected
+
+      def default_test_cmd
+        "zig test"
+      end
+
+      def default_format_cmd(file_path)
+        "zig fmt #{Shellwords.escape(file_path)}"
+      end
+    end
+  end
+end

data/lib/rubik/adapter.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require_relative "adapter/process"
+require_relative "adapter/base"
+require_relative "adapter/ruby"
+require_relative "adapter/python"
+require_relative "adapter/go"
+require_relative "adapter/rust"
+require_relative "adapter/c"
+require_relative "adapter/zig"
+require_relative "adapter/crystal"
+require_relative "adapter/generic"
+require_relative "adapter/registry"
+
+module Rubik
+  module Adapter
+  end
+end

data/lib/rubik/ast/body_loader.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Rubik
+  module AST
+    # Shared helper for extractors that defer a symbol's body slice.
+    #
+    # The factory MUST be a method: invoking it creates a fresh binding, so
+    # the returned lambda captures THIS call's argument values forever. A
+    # `->(s = line_num) {}` written inline in a `while` loop does NOT work —
+    # lambda default args are evaluated at CALL time, and a while body has no
+    # scope of its own, so every loader would resolve the loop's LAST
+    # line_num/end_line (regression: test_lazy_hash_and_lazy_body.rb).
+    module BodyLoader
+      def body_loader_for(start_line, end_line)
+        -> { extract_lines(start_line, end_line) }
+      end
+    end
+  end
+end