rubycc 1.0.0

data/lib/rubycc/doctor/fetcher.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+require "json"
+require "rubygems/package"
+
+module Rubycc
+  module Doctor
+    # Downloads a gem's package from rubygems.org and reads its real
+    # specification. This is the authoritative source of a gem's `extensions`
+    # list: neither the versions API nor the "quick" (light) gemspec carries the
+    # extensions field, so the only reliable way to know whether a gem has a C
+    # extension is to read the full .gem's embedded gemspec. That full package is
+    # also exactly what an on-the-fly build needs, so probe and build share it.
+    #
+    # Everything here touches the network; callers treat any failure (offline,
+    # 404, timeout) as "unknown" and degrade gracefully.
+    class Fetcher
+      HOST = "https://rubygems.org"
+      # A .gem is a few hundred KB at most for the extension gems we target; this
+      # only guards against a hung connection.
+      OPEN_TIMEOUT = 15
+      READ_TIMEOUT = 60
+
+      class FetchError < StandardError; end
+
+      def initialize(cache_dir)
+        @cache_dir = cache_dir
+      end
+
+      # Resolve the latest released (non-prerelease) version of +name+ via the v1
+      # API. Returns a version string, or nil when the lookup fails.
+      def latest_version(name)
+        body = get("#{HOST}/api/v1/gems/#{name}.json")
+        JSON.parse(body)["version"]
+      rescue StandardError
+        nil
+      end
+
+      # Download NAME-VERSION.gem into the cache and return its local path. Raises
+      # FetchError on any network failure so the caller can report "unknown".
+      def download(name, version)
+        dest = File.join(@cache_dir, "#{name}-#{version}.gem")
+        return dest if File.file?(dest) && File.size(dest).positive?
+
+        body = get("#{HOST}/gems/#{name}-#{version}.gem")
+        File.binwrite(dest, body)
+        dest
+      rescue StandardError => e
+        raise FetchError, e.message
+      end
+
+      # The Gem::Specification embedded in a downloaded .gem.
+      def spec(gem_path)
+        Gem::Package.new(gem_path).spec
+      end
+
+      private
+
+      # A GET that follows rubygems.org's CDN redirects and returns the body,
+      # raising on any non-success status.
+      def get(url, limit = 5)
+        raise FetchError, "too many redirects" if limit.zero?
+
+        uri = URI(url)
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = uri.scheme == "https"
+        http.open_timeout = OPEN_TIMEOUT
+        http.read_timeout = READ_TIMEOUT
+
+        res = http.get(uri.request_uri)
+        case res
+        when Net::HTTPSuccess
+          res.body
+        when Net::HTTPRedirection
+          get(URI.join(url, res["location"]).to_s, limit - 1)
+        else
+          raise FetchError, "#{url} -> HTTP #{res.code}"
+        end
+      end
+    end
+  end
+end

data/lib/rubycc/doctor/gemfile.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+module Rubycc
+  module Doctor
+    # Extracts the gems an application uses from its Gemfile.lock (preferred, for
+    # exact resolved versions) or, failing that, a bare Gemfile.
+    #
+    # Bundler's Gemfile is a Ruby DSL; evaluating it safely means sandboxing
+    # arbitrary code, which is heavy and a security hazard. The lock file, by
+    # contrast, is a fixed indented text format with no code in it, so parsing it
+    # is both safe and gives the *resolved* versions and the full transitive
+    # dependency closure (its `specs:` section is exactly that closure). rubycc
+    # doctor therefore prefers the lock and treats it as authoritative.
+    #
+    # When only a Gemfile is present it is parsed naively — `gem "name"` lines are
+    # read with a regexp, never `eval`'d. That yields direct dependencies only
+    # (no closure) and often no version; callers surface that as a limitation.
+    module Gemfile
+      # One resolved gem: its name, version (nil when unknown), the names of its
+      # direct runtime dependencies (from the lock; empty otherwise) and the
+      # source section it came from (:gem for rubygems.org, :path/:git for local
+      # or VCS gems that cannot be fetched from rubygems.org).
+      Entry = Struct.new(:name, :version, :dependencies, :source, keyword_init: true)
+
+      # The parsed picture the CLI drives off: the list of gem entries, the names
+      # of the directly-declared dependencies, and where the data came from
+      # (:lock exact versions, or :gemfile direct-only best effort).
+      Result = Struct.new(:entries, :direct, :origin, :path, keyword_init: true)
+
+      module_function
+
+      # Load gem information from +dir+ (or an explicit --gemfile path). A
+      # Gemfile.lock next to the Gemfile is preferred; otherwise the Gemfile
+      # itself is parsed. Returns a Result, or nil when neither file exists.
+      def load(gemfile_path)
+        lock = "#{gemfile_path}.lock"
+        if File.file?(lock)
+          parse_lock(File.read(lock), path: lock)
+        elsif File.file?(gemfile_path)
+          parse_gemfile(File.read(gemfile_path), path: gemfile_path)
+        end
+      end
+
+      # Parse the text of a Gemfile.lock. The format is a sequence of sections
+      # introduced by an unindented header (GEM, PATH, GIT, DEPENDENCIES, ...).
+      # Inside GEM/PATH/GIT a `specs:` line is followed by the resolved gems at
+      # 4-space indent (`name (version)`), each optionally trailed by its own
+      # dependencies at 6-space indent (`dep (constraint)`). DEPENDENCIES lists
+      # the directly-declared gems at 2-space indent.
+      def parse_lock(text, path: nil)
+        entries = []
+        direct = []
+        section = nil       # current top-level section header
+        source = nil        # :gem / :path / :git for the current specs block
+        in_specs = false
+        current = nil       # the Entry whose dependency lines we are reading
+
+        text.each_line do |raw|
+          line = raw.chomp
+          next if line.strip.empty?
+
+          if line == line.lstrip # unindented -> a section header
+            section = line
+            source = { "GEM" => :gem, "PATH" => :path, "GIT" => :git }[section]
+            in_specs = false
+            current = nil
+            next
+          end
+
+          if section == "DEPENDENCIES"
+            direct << line.strip.sub(/[!<>=~ ].*\z/, "").strip
+            next
+          end
+
+          if source
+            if line.strip == "specs:"
+              in_specs = true
+              next
+            end
+            next unless in_specs
+
+            indent = line[/\A */].length
+            if indent == 4 && (m = line.strip.match(/\A(\S+) \(([^)]+)\)\z/))
+              current = Entry.new(name: m[1], version: m[2].split.first, dependencies: [], source: source)
+              entries << current
+            elsif indent >= 6 && current && (m = line.strip.match(/\A(\S+)/))
+              current.dependencies << m[1]
+            end
+          end
+        end
+
+        Result.new(entries: entries, direct: direct.uniq, origin: :lock, path: path)
+      end
+
+      # Parse a bare Gemfile naively: pick up every `gem "name"` (or 'name')
+      # declaration and an optional literal version argument. This never evaluates
+      # the file, so conditionals, variables and computed names are invisible —
+      # the caller reports the reduced fidelity. Group/platform blocks are not
+      # tracked; every declared gem is returned.
+      def parse_gemfile(text, path: nil)
+        entries = []
+        text.each_line do |raw|
+          line = raw.sub(/#.*/, "")
+          m = line.match(/\bgem\s*\(?\s*["']([^"']+)["']\s*(?:,\s*["']([^"']+)["'])?/)
+          next unless m
+
+          version = m[2]&.sub(/\A[~><=!\s]+/, "")&.strip
+          version = nil if version && version.empty?
+          entries << Entry.new(name: m[1], version: version, dependencies: [], source: :gem)
+        end
+        Result.new(entries: entries.uniq(&:name), direct: entries.map(&:name).uniq, origin: :gemfile, path: path)
+      end
+    end
+  end
+end

data/lib/rubycc/doctor/verified_gems.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Rubycc
+  module Doctor
+    # The build-verified gem database (data/verified_gems.json), the primary
+    # reference rubycc doctor consults before ever attempting a build. A gem whose
+    # resolved version satisfies one of the recorded `versions` entries is reported
+    # as verified with no network access and no build.
+    #
+    # The schema is documented in data/README.md. One gem is one entry, and an
+    # entry holds a list of verifications -- one per environment it was confirmed
+    # in, in insertion (oldest-first) order:
+    #
+    #   { "json": { "verifications": [ { "versions": ["2.21.1"],
+    #                                    "environment": "glibc x86_64 / ruby 3.4.5",
+    #                                    "verified_at": "2026-07-17",
+    #                                    "evidence": "..." } ],
+    #               "notes": "..." } }
+    #
+    # `versions` sits inside each record rather than once at the entry level
+    # because the versions actually exercised may differ per environment; hoisting
+    # them would claim more than was measured. The absence of a record is itself
+    # the statement that the gem is unverified in that environment.
+    #
+    # Version entries are matched with Gem::Requirement, so both exact pins
+    # ("2.21.1") and ranges (">= 1.8, < 2") work.
+    class VerifiedGems
+      # data/verified_gems.json relative to this file (lib/rubycc/doctor/).
+      DEFAULT_PATH = File.expand_path("../../../data/verified_gems.json", __dir__)
+
+      # One environment's verification of a gem, mirroring the JSON schema.
+      Verification = Struct.new(:versions, :environment, :verified_at, :evidence, keyword_init: true)
+
+      # A verified-gem entry: the gem's name, every verification recorded for it,
+      # and the human-owned notes.
+      Record = Struct.new(:name, :verifications, :notes, keyword_init: true) do
+        # Every version any environment verified, de-duplicated and in the order
+        # the records list them. Callers that only ask "which versions are known
+        # good at all?" (the schema test, listings) want this rather than a
+        # per-environment breakdown.
+        def versions
+          verifications.flat_map(&:versions).uniq
+        end
+      end
+
+      # Load the database from +path+ (defaults to the shipped file).
+      def self.load(path = DEFAULT_PATH)
+        new(JSON.parse(File.read(path)))
+      end
+
+      def initialize(raw)
+        @records = {}
+        raw.each do |name, attrs|
+          verifications = Array(attrs["verifications"]).map do |v|
+            Verification.new(
+              versions: Array(v["versions"]),
+              environment: v["environment"],
+              verified_at: v["verified_at"],
+              evidence: v["evidence"]
+            )
+          end
+          @records[name] = Record.new(name: name, verifications: verifications, notes: attrs["notes"])
+        end
+      end
+
+      # All records (used by the schema test and for listing).
+      attr_reader :records
+
+      # The record for +name+, or nil.
+      def [](name)
+        @records[name]
+      end
+
+      # Whether +name+ at +version+ is verified. A nil version can never match an
+      # exact pin, so an unknown version is treated as not verified.
+      def verified?(name, version)
+        !match(name, version).nil?
+      end
+
+      # The Record that verifies +name+ at +version+, or nil. A version satisfies
+      # an entry when at least one of its verifications covers it -- being
+      # verified in any one environment is what "verified" has always meant here,
+      # and splitting the schema per environment must not narrow it.
+      def match(name, version)
+        record = @records[name]
+        return nil if record.nil? || matching_verifications(name, version).empty?
+
+        record
+      end
+
+      # Every Verification of +name+ whose `versions` cover +version+, in the
+      # order they are recorded; empty when nothing matches. This is what a caller
+      # asks when it needs to say *where* the version was verified, not just
+      # whether it was.
+      def matching_verifications(name, version)
+        record = @records[name]
+        return [] unless record && version
+
+        gem_version = Gem::Version.new(version)
+        record.verifications.select do |verification|
+          verification.versions.any? do |req|
+            # A range entry may be comma-joined (">= 1.8, < 2"); split it into the
+            # individual constraints Gem::Requirement expects as separate arguments.
+            Gem::Requirement.new(*req.split(",").map(&:strip)).satisfied_by?(gem_version)
+          rescue ArgumentError
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubycc/doctor.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require_relative "doctor/gemfile"
+require_relative "doctor/verified_gems"
+require_relative "doctor/fetcher"
+require_relative "doctor/builder"
+require_relative "doctor/cli"
+
+module Rubycc
+  # rubycc doctor: the adoption-check command (ROADMAP §6 "M3 完了後のツール").
+  # Given an application's Gemfile.lock/Gemfile it reports, per gem, whether
+  # rubycc can build its C extension — first from the shipped build-verified
+  # database, then by an on-the-spot build for anything unverified.
+  module Doctor
+  end
+end