@eslint-sh/eslint-plugin 0.5.0 → 0.6.0

package/dist/rules/compat/no-case-modification.js

@@ -0,0 +1,86 @@
+/**
+ * `sh/compat/no-case-modification`: reports the case-modifying parameter
+ * expansions `${v^}`, `${v^^}`, `${v,}` and `${v,,}` (with or without a
+ * pattern) in files whose target shell lacks them, that is, Bash older than
+ * 4.0 (macOS's stock `/bin/bash` is 3.2) and POSIX sh.
+ *
+ * Bash 3.2 rejects the expansion with "bad substitution" at the moment the
+ * word is expanded. The message suggests the portable alternative: pipe the
+ * value through `tr`. The example it shows is for the operator written: all
+ * characters for `^^` and `,,`, the first character for `^` and `,`
+ * (`${v%"${v#?}"}` is the first character and `${v#?}` the rest).
+ *
+ * A pattern form (`${v^^a}`) changes only the characters the pattern matches,
+ * which a plain case-converting `tr` does not reproduce, so it gets a message
+ * that offers no `tr` equivalent.
+ *
+ * What is read: a `ParamExp` whose operator is one of the four case
+ * operators. The report is on the whole expansion.
+ */
+import { UpperAll, UpperFirst, LowerAll, LowerFirst } from 'sh-ast';
+import { createCompatRule } from './create-compat-rule.js';
+/** `tr` arguments that convert to upper case. @internal */
+export const TO_UPPER = "tr '[:lower:]' '[:upper:]'";
+/** `tr` arguments that convert to lower case. @internal */
+export const TO_LOWER = "tr '[:upper:]' '[:lower:]'";
+/** The four case operators, keyed by the parser's operator constant. */
+const CASE_OPERATORS = new Map([
+    [UpperAll, { operator: '^^', all: true, tr: TO_UPPER }],
+    [UpperFirst, { operator: '^', all: false, tr: TO_UPPER }],
+    [LowerAll, { operator: ',,', all: true, tr: TO_LOWER }],
+    [LowerFirst, { operator: ',', all: false, tr: TO_LOWER }],
+]);
+/**
+ * The `tr` replacement shown in the message for `name` under `spec`.
+ *
+ * @internal
+ */
+export function trExample(name, spec) {
+    const whole = `"$${name}"`;
+    return spec.all
+        ? `$(printf '%s' ${whole} | ${spec.tr})`
+        : `$(printf '%s' "\${${name}%"\${${name}#?}"}" | ${spec.tr})"\${${name}#?}"`;
+}
+/**
+ * The `sh/compat/no-case-modification` rule module.
+ *
+ * @internal
+ */
+export const noCaseModification = createCompatRule({
+    name: 'compat/no-case-modification',
+    feature: 'caseModification',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow case-modifying expansions (`${v^^}`, `${v,,}` and variants) when the target shell lacks them',
+        },
+        messages: {
+            caseModification: '`${…{{operator}}}` needs {{required}}, but this file targets {{target}}. Convert the case with `tr` instead, for example {{example}}.',
+            caseModificationPattern: '`${…{{operator}}pattern}` needs {{required}}, but this file targets {{target}}. It changes only the characters the pattern matches, so a plain case-converting `tr` is not equivalent; spell out the matching characters instead (for example `tr a A`).',
+        },
+    },
+    create(context, gate) {
+        return {
+            ParamExp(node) {
+                const { exp } = node;
+                const spec = exp === undefined ? undefined : CASE_OPERATORS.get(exp.op);
+                if (exp === undefined || spec === undefined)
+                    return;
+                const name = node.param?.value ?? 'v';
+                if (exp.word !== undefined) {
+                    context.report({
+                        node,
+                        messageId: 'caseModificationPattern',
+                        data: { ...gate, operator: spec.operator },
+                    });
+                    return;
+                }
+                context.report({
+                    node,
+                    messageId: 'caseModification',
+                    data: { ...gate, operator: spec.operator, example: trExample(name, spec) },
+                });
+            },
+        };
+    },
+});

package/dist/rules/compat/no-coproc.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoCoprocMessageId = 'coproc';
+/**
+ * The `sh/compat/no-coproc` rule module.
+ *
+ * @internal
+ */
+export declare const noCoproc: import("../define-shell-rule.js").ShellRule<[], "coproc">;

package/dist/rules/compat/no-coproc.js

@@ -0,0 +1,47 @@
+/**
+ * `sh/compat/no-coproc`: reports the `coproc` reserved word (a coprocess:
+ * a background command with a pipe pair to the shell) in files whose target
+ * shell lacks it, that is, Bash older than 4.0 (macOS's stock `/bin/bash` is
+ * 3.2) and POSIX sh.
+ *
+ * Bash 3.2 does not know the word, so `coproc cat` runs an external command
+ * named `coproc` and fails with `command not found`. The message suggests the
+ * portable alternative: a named pipe made with `mkfifo`, with the producer
+ * started in the background.
+ *
+ * What is read: Bash's `CoprocClause`. Under `dialect: "posix"` the parser
+ * has no such clause and reads `coproc cat` as an ordinary command, so a
+ * command whose name is `coproc` is reported too.
+ */
+import { createCompatRule } from './create-compat-rule.js';
+/**
+ * The `sh/compat/no-coproc` rule module.
+ *
+ * @internal
+ */
+export const noCoproc = createCompatRule({
+    name: 'compat/no-coproc',
+    feature: 'coproc',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow the `coproc` reserved word when the target shell lacks it',
+        },
+        messages: {
+            coproc: '`coproc` needs {{required}}, but this file targets {{target}}. Use a named pipe instead: create it with `mkfifo`, start the coprocess in the background reading or writing the pipe, and open the pipe from the script.',
+        },
+    },
+    create(context, gate) {
+        const { sourceCode } = context;
+        return {
+            CoprocClause(node) {
+                context.report({ node, messageId: 'coproc', data: { ...gate } });
+            },
+            CallExpr(node) {
+                if (sourceCode.getCommandName(node) === 'coproc') {
+                    context.report({ node, messageId: 'coproc', data: { ...gate } });
+                }
+            },
+        };
+    },
+});

package/dist/rules/compat/no-declare-g.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoDeclareGMessageId = 'declareGlobal' | 'declareGlobalWithAttributes';
+/**
+ * The `sh/compat/no-declare-g` rule module.
+ *
+ * @internal
+ */
+export declare const noDeclareG: import("../define-shell-rule.js").ShellRule<[], NoDeclareGMessageId>;

package/dist/rules/compat/no-declare-g.js

@@ -0,0 +1,59 @@
+/**
+ * `sh/compat/no-declare-g`: reports `declare -g` and `typeset -g` in files
+ * whose target shell lacks the `-g` option, that is, Bash older than 4.2
+ * (macOS's stock `/bin/bash` is 3.2) and POSIX sh.
+ *
+ * Bash 3.2 rejects `-g` as an invalid option, so the declaration fails and the
+ * variable is never created. The message suggests the portable alternative:
+ * in Bash before 4.2 a plain `name=value` assignment inside a function already
+ * sets the global, as long as the function has not declared the name `local`.
+ *
+ * What is read: `declare`/`typeset` option clusters containing `g` (`-g`,
+ * `-gx`, `-Ag`), found as `declarationFlagVisitor` defines. `local` and
+ * `export` are outside this rule's scope.
+ */
+import { createCompatRule } from './create-compat-rule.js';
+import { declarationFlagVisitor } from './declaration-options.js';
+/**
+ * Whether a plain assignment can stand in for a command's options, which
+ * contain `g`: only when every option word is a `-` cluster of `g` and `x`
+ * letters (`-g`, `-gx`, `-g -x`), since `export name=value` expresses `x`. Any
+ * other option sets an attribute (`-A`, `-i`, `-r`, …) that an assignment
+ * cannot, whether it is joined to the `g` (`-Ag`) or a word of its own
+ * (`-g -A`).
+ */
+function isPlainAssignmentEquivalent(options) {
+    return options.every((option) => /^-[gx]+$/u.test(option));
+}
+/**
+ * The `sh/compat/no-declare-g` rule module.
+ *
+ * @internal
+ */
+export const noDeclareG = createCompatRule({
+    name: 'compat/no-declare-g',
+    feature: 'declareGlobal',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow `declare -g` and `typeset -g` when the target shell lacks the option',
+        },
+        messages: {
+            declareGlobal: '`{{command}} -g` needs {{required}}, but this file targets {{target}}. Assign the global with a plain `name=value` (a variable not declared `local` is global), or `export name=value` to also export it.',
+            declareGlobalWithAttributes: '`{{command}} {{flags}}` needs {{required}}, but this file targets {{target}}. A plain `name=value` cannot express its other options, so dropping `g` is not enough: declare the variable outside any function, or raise the target.',
+        },
+    },
+    create(context, gate) {
+        return declarationFlagVisitor(context.sourceCode, 'g', (node, command, options) => {
+            if (!isPlainAssignmentEquivalent(options)) {
+                context.report({
+                    node,
+                    messageId: 'declareGlobalWithAttributes',
+                    data: { ...gate, command, flags: options.join(' ') },
+                });
+                return;
+            }
+            context.report({ node, messageId: 'declareGlobal', data: { ...gate, command } });
+        });
+    },
+});

package/dist/rules/compat/no-double-bracket.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoDoubleBracketMessageId = 'doubleBracket';
+/**
+ * The `sh/compat/no-double-bracket` rule module.
+ *
+ * @internal
+ */
+export declare const noDoubleBracket: import("../define-shell-rule.js").ShellRule<[], "doubleBracket">;

package/dist/rules/compat/no-double-bracket.js

@@ -0,0 +1,52 @@
+/**
+ * `sh/compat/no-double-bracket`: reports `[[ … ]]` in files that target POSIX
+ * sh. Every Bash has it, so this is a POSIX-only gate.
+ *
+ * POSIX section 2.4 leaves the results of `[[` and `]]` unspecified. dash does
+ * not treat `[[` as a word of its grammar: it looks up a command by that name
+ * and fails with `[[: not found` and status 127. Under `set -e` a bare test
+ * stops the script, and in an `if` condition the failure is silent in effect:
+ * dash takes the `else` branch. `bash --posix` and BusyBox ash accept it, so
+ * only some POSIX shells show the problem.
+ *
+ * What is read: a command whose effective name is `[[`, because the POSIX
+ * parser has no conditional clause, outside a branch for one shell (see
+ * `./posix-absent-command.ts`). The expression is not interpreted, and
+ * the parser ends the command at `&&` or `||`, so one finding is reported per
+ * `[[`, on that word. A `[[` the parser cannot read as a command (`=~` with a
+ * parenthesis, `[[ ( a ) ]]`) is a parse error and never reaches this rule.
+ *
+ * No suggestion: `[` splits and globs its unquoted operands and `==` and `=~`
+ * have no `[` spelling, so no rewrite keeps the behaviour in general.
+ */
+import { createCompatRule } from './create-compat-rule.js';
+import { reachableCommandWord } from './posix-absent-command.js';
+/**
+ * The `sh/compat/no-double-bracket` rule module.
+ *
+ * @internal
+ */
+export const noDoubleBracket = createCompatRule({
+    name: 'compat/no-double-bracket',
+    feature: 'doubleBracket',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow `[[ … ]]` when the target shell is POSIX sh',
+        },
+        messages: {
+            doubleBracket: '`[[` is not part of {{target}}. dash fails with `[[: not found`, and an `if` on it takes its `else` branch. Use `[ … ]` for tests and `case` for pattern matching.',
+        },
+    },
+    create(context, gate) {
+        const { sourceCode } = context;
+        return {
+            CallExpr(node) {
+                const word = reachableCommandWord(sourceCode, node, '[[');
+                if (word === undefined)
+                    return;
+                context.report({ node: word, messageId: 'doubleBracket', data: { target: gate.target } });
+            },
+        };
+    },
+});

package/dist/rules/compat/no-epoch-variables.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoEpochVariablesMessageId = 'epochSeconds' | 'epochRealtime';
+/**
+ * The `sh/compat/no-epoch-variables` rule module.
+ *
+ * @internal
+ */
+export declare const noEpochVariables: import("../define-shell-rule.js").ShellRule<[], NoEpochVariablesMessageId>;

package/dist/rules/compat/no-epoch-variables.js

@@ -0,0 +1,57 @@
+import { createCompatRule } from './create-compat-rule.js';
+/** The two variables, and the message each reports with. */
+const EPOCH_VARIABLES = new Map([
+    ['EPOCHSECONDS', 'epochSeconds'],
+    ['EPOCHREALTIME', 'epochRealtime'],
+]);
+/** The arithmetic nodes whose `Word` operands name variables. */
+const ARITHMETIC_PARENTS = new Set([
+    'ArithmCmd',
+    'ArithmExp',
+    'BinaryArithm',
+    'UnaryArithm',
+    'ParenArithm',
+    'CStyleLoop',
+]);
+/**
+ * The `sh/compat/no-epoch-variables` rule module.
+ *
+ * @internal
+ */
+export const noEpochVariables = createCompatRule({
+    name: 'compat/no-epoch-variables',
+    feature: 'epochVariables',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow `$EPOCHSECONDS` and `$EPOCHREALTIME` when the target shell lacks them',
+        },
+        messages: {
+            epochSeconds: '`$EPOCHSECONDS` needs {{required}}, but this file targets {{target}}, where it is unset. Use `$(date +%s)` instead (GNU, BSD and BusyBox `date`; POSIX `date` has no `%s`).',
+            epochRealtime: '`$EPOCHREALTIME` needs {{required}}, but this file targets {{target}}, where it is unset. `$(date +%s)` gives whole seconds (GNU, BSD and BusyBox `date`); there is no portable source of the fraction.',
+        },
+    },
+    create(context, gate) {
+        const { sourceCode } = context;
+        /** Reports `node` if `name` is one of the two variables. */
+        function check(node, name) {
+            const messageId = name === undefined ? undefined : EPOCH_VARIABLES.get(name);
+            if (messageId !== undefined)
+                context.report({ node, messageId, data: { ...gate } });
+        }
+        return {
+            ParamExp(node) {
+                check(node, node.param?.value);
+            },
+            Word(node) {
+                const parent = sourceCode.getParent(node);
+                if (parent === undefined || !ARITHMETIC_PARENTS.has(parent.type))
+                    return;
+                const [part] = node.parts;
+                if (node.parts.length !== 1 || part.type !== 'Lit')
+                    return;
+                check(node, part.value);
+            },
+        };
+    },
+});

package/dist/rules/compat/no-fd-variable.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoFdVariableMessageId = 'fdVariable';
+/**
+ * The `sh/compat/no-fd-variable` rule module.
+ *
+ * @internal
+ */
+export declare const noFdVariable: import("../define-shell-rule.js").ShellRule<[], "fdVariable">;

package/dist/rules/compat/no-fd-variable.js

@@ -0,0 +1,48 @@
+/**
+ * `sh/compat/no-fd-variable`: reports a `{varname}` redirection, which has
+ * the shell pick a free file descriptor and store its number in the
+ * variable (`exec {fd}>file`), in files whose target shell lacks it, that is,
+ * Bash older than 4.1 (macOS's stock `/bin/bash` is 3.2) and POSIX sh.
+ *
+ * Bash 4.0 and older treat `{fd}` as an ordinary word: `exec {fd}>out` tries
+ * to run a command named `{fd}`, which fails. The message suggests the
+ * portable alternative: use a fixed descriptor number, such as
+ * `exec 3>file`, `>&3`, then `exec 3>&-`.
+ *
+ * What is read: a `Redirect` whose descriptor is written as `{name}`, which
+ * the parser records separately from the redirection's target; a numbered
+ * descriptor (`3>file`) and a `{…}` word anywhere else (an argument, a brace
+ * group, quoted text) are not reported. The report is on the whole
+ * redirection.
+ */
+import { createCompatRule } from './create-compat-rule.js';
+/** A `{varname}` descriptor as the parser records it. */
+const FD_VARIABLE = /^\{([A-Za-z_][A-Za-z0-9_]*)\}$/u;
+/**
+ * The `sh/compat/no-fd-variable` rule module.
+ *
+ * @internal
+ */
+export const noFdVariable = createCompatRule({
+    name: 'compat/no-fd-variable',
+    feature: 'fdVariable',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow `{varname}` file-descriptor redirections (`exec {fd}>file`) when the target shell lacks them',
+        },
+        messages: {
+            fdVariable: '`{{{name}}}` descriptor allocation needs {{required}}, but this file targets {{target}}. Use a fixed descriptor number instead, for example `exec 3>file`, then `>&3`, then `exec 3>&-`.',
+        },
+    },
+    create(context, gate) {
+        return {
+            Redirect(node) {
+                const match = node.n === undefined ? null : FD_VARIABLE.exec(node.n.value);
+                if (match === null)
+                    return;
+                context.report({ node, messageId: 'fdVariable', data: { ...gate, name: match[1] } });
+            },
+        };
+    },
+});

package/dist/rules/compat/no-globstar.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoGlobstarMessageId = 'globstar';
+/**
+ * The `sh/compat/no-globstar` rule module.
+ *
+ * @internal
+ */
+export declare const noGlobstar: import("../define-shell-rule.js").ShellRule<[], "globstar">;

package/dist/rules/compat/no-globstar.js

@@ -0,0 +1,39 @@
+/**
+ * `sh/compat/no-globstar`: reports `shopt -s globstar` in files whose target
+ * shell lacks the option, that is, Bash older than 4.0 (macOS's stock
+ * `/bin/bash` is 3.2) and POSIX sh.
+ *
+ * Bash 3.2 has no such option: `shopt` prints "invalid shell option name"
+ * and the script carries on, and `**` then matches like `*`, so a recursive
+ * glob silently matches fewer files (often none). The message suggests the
+ * portable alternative: search the tree with `find`.
+ *
+ * What is read: a `shopt -s` command naming `globstar`, as
+ * `shoptEnableVisitor` defines (`shopt -u`, `shopt -o` and a name that is not
+ * a static word do not count). The report is on the `globstar` word.
+ */
+import { createCompatRule } from './create-compat-rule.js';
+import { shoptEnableVisitor } from './shopt-options.js';
+/**
+ * The `sh/compat/no-globstar` rule module.
+ *
+ * @internal
+ */
+export const noGlobstar = createCompatRule({
+    name: 'compat/no-globstar',
+    feature: 'globstar',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow `shopt -s globstar` when the target shell lacks the option',
+        },
+        messages: {
+            globstar: "`shopt -s globstar` needs {{required}}, but this file targets {{target}}, where `**` matches like `*`. Search the tree with `find` instead, for example `find dir -name '*.txt'`.",
+        },
+    },
+    create(context, gate) {
+        return shoptEnableVisitor(context, 'globstar', (word) => {
+            context.report({ node: word, messageId: 'globstar', data: { ...gate } });
+        });
+    },
+});

package/dist/rules/compat/no-lastpipe-semantics.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoLastpipeSemanticsMessageId = 'lastpipe' | 'lastpipePosix';
+/**
+ * The `sh/compat/no-lastpipe-semantics` rule module.
+ *
+ * @internal
+ */
+export declare const noLastpipeSemantics: import("../define-shell-rule.js").ShellRule<[], NoLastpipeSemanticsMessageId>;

package/dist/rules/compat/no-lastpipe-semantics.js

@@ -0,0 +1,53 @@
+/**
+ * `sh/compat/no-lastpipe-semantics`: reports `shopt -s lastpipe` in files
+ * whose target shell lacks the `lastpipe` option, that is, Bash older than 4.2
+ * (macOS's stock `/bin/bash` is 3.2) and POSIX sh.
+ *
+ * Bash 3.2 has no such option: `shopt` fails with "invalid shell option name"
+ * and the last command of every pipeline keeps running in a subshell, so a
+ * script that relied on `cmd | while read …; do total=…; done` leaving
+ * `total` set in the current shell silently loses the assignment. The message
+ * suggests the portable alternative: feed the loop with process substitution
+ * (`done < <(cmd)`), which keeps the loop in the current shell on every Bash
+ * that has it. A POSIX target has no process substitution, so its message
+ * suggests a temporary file or here-document instead.
+ *
+ * What is read: a `shopt` command (after transparent wrappers such as
+ * `builtin`) whose option words, up to the first operand, include `-s`
+ * (possibly inside a cluster such as `-sq`) and which names `lastpipe` as an
+ * operand. `shopt -u lastpipe` turns the option off (so does a `-u` beside the
+ * `-s`), `shopt -o` names `set -o` options, and a `lastpipe` that is not a static word cannot be read, so none
+ * of those reports.
+ */
+import { createCompatRule } from './create-compat-rule.js';
+import { shoptEnableVisitor } from './shopt-options.js';
+/** The `shopt` option this rule gates. */
+const LASTPIPE = 'lastpipe';
+/**
+ * The `sh/compat/no-lastpipe-semantics` rule module.
+ *
+ * @internal
+ */
+export const noLastpipeSemantics = createCompatRule({
+    name: 'compat/no-lastpipe-semantics',
+    feature: 'lastpipe',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow `shopt -s lastpipe` when the target shell lacks the option',
+        },
+        messages: {
+            lastpipe: '`shopt -s lastpipe` needs {{required}}, but this file targets {{target}}. Keep the loop in the current shell by feeding it with process substitution instead, for example `while read -r line; do …; done < <(cmd)`.',
+            lastpipePosix: '`shopt -s lastpipe` needs {{required}}, but this file targets {{target}}. Process substitution is not POSIX either; keep the loop in the current shell by writing the output to a temporary file and reading that, for example `cmd > "$tmp"` then `while read -r line; do …; done < "$tmp"`, or by feeding the loop a here-document.',
+        },
+    },
+    create(context, gate) {
+        const { sourceCode } = context;
+        // Process substitution is a Bash feature, so a POSIX target gets advice
+        // that uses only POSIX constructs.
+        const messageId = sourceCode.dialect === 'posix' ? 'lastpipePosix' : 'lastpipe';
+        return shoptEnableVisitor(context, LASTPIPE, (word) => {
+            context.report({ node: word, messageId, data: { ...gate } });
+        });
+    },
+});

package/dist/rules/compat/no-let.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoLetMessageId = 'let';
+/**
+ * The `sh/compat/no-let` rule module.
+ *
+ * @internal
+ */
+export declare const noLet: import("../define-shell-rule.js").ShellRule<[], "let">;

package/dist/rules/compat/no-let.js

@@ -0,0 +1,62 @@
+/**
+ * `sh/compat/no-let`: reports the `let` builtin in files that target POSIX sh.
+ * Every Bash has it, so this is a POSIX-only gate.
+ *
+ * POSIX section 2.9.1.4 leaves the results of a command named `let`
+ * unspecified. dash has no such command: `let n=1+2` fails with `let: not
+ * found` and status 127, and `n` stays unset. `bash --posix` and BusyBox ash
+ * accept it, so only some POSIX shells show the problem.
+ *
+ * What is read: a command whose effective name is `let`, because the POSIX
+ * parser has no `let` clause, outside a branch for one shell (see
+ * `./posix-absent-command.ts`).
+ *
+ * A function named `let` anywhere in the file exempts a call that names it
+ * directly, since dash can then run that function. This is a name check across
+ * the file and does not prove the function exists at the call: execution order,
+ * a definition in a branch or subshell, and `unset -f` are not read, so some
+ * exempt calls still fail on dash. A call through a wrapper is never exempt,
+ * because wrappers such as `command`, `env` and `exec` do not run functions.
+ *
+ * No suggestion: `let` sets its exit status from the value of its last
+ * expression, which `n=$((1 + 2))` does not, so the rewrite can change what
+ * `set -e` or an `if` sees.
+ */
+import { definedFunctionNames } from '../../command-harvest/harvest-commands.js';
+import { createCompatRule } from './create-compat-rule.js';
+import { reachableCommandWord } from './posix-absent-command.js';
+/** The builtin this rule gates. */
+const LET = 'let';
+/**
+ * The `sh/compat/no-let` rule module.
+ *
+ * @internal
+ */
+export const noLet = createCompatRule({
+    name: 'compat/no-let',
+    feature: 'letCommand',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow the `let` builtin when the target shell is POSIX sh',
+        },
+        messages: {
+            let: '`let` is not part of {{target}}. dash fails with `let: not found` and the assignment never happens. Use arithmetic expansion instead, for example `n=$((1 + 2))`.',
+        },
+    },
+    create(context, gate) {
+        const { sourceCode } = context;
+        const fileDefinesLet = definedFunctionNames(sourceCode).has(LET);
+        return {
+            CallExpr(node) {
+                const word = reachableCommandWord(sourceCode, node, LET);
+                if (word === undefined)
+                    return;
+                // Only a name written directly can run a function: a wrapper skips it.
+                if (fileDefinesLet && sourceCode.getCommandName(node) === LET)
+                    return;
+                context.report({ node: word, messageId: 'let', data: { target: gate.target } });
+            },
+        };
+    },
+});

package/dist/rules/compat/no-mapfile.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Message ids this rule reports with: `mapfile` for the report and
+ * `useReadLoop` for its suggestion.
+ *
+ * @internal
+ */
+export type NoMapfileMessageId = 'mapfile' | 'useReadLoop';
+/**
+ * The `sh/compat/no-mapfile` rule module.
+ *
+ * @internal
+ */
+export declare const noMapfile: import("../define-shell-rule.js").ShellRule<[], NoMapfileMessageId>;