@eslint-sh/eslint-plugin 0.5.0 → 0.6.0

package/dist/rules/quote-expansions.js

@@ -0,0 +1,229 @@
+/**
+ * `sh/quote-expansions`: reports an unquoted parameter expansion (`$var`,
+ * `${var}`, `$@`) or command substitution (`$(…)`, `` `…` ``) in a word the
+ * shell word-splits and pathname-expands.
+ *
+ * An unquoted expansion in such a word is split on `IFS` and each piece is
+ * glob-matched against the filesystem, so `rm $file` with
+ * `file='my notes.txt'` removes two files. Quoting the expansion
+ * (`rm "$file"`) keeps its result one word, which is almost always the intent.
+ *
+ * The rule decides from the expansion's position alone:
+ *
+ * - **Reported positions** (the word list contexts): command words and
+ *   arguments of a simple command (including a declaration's bare operands
+ *   such as `local $x`), the words of a `for`/`select … in` list, unkeyed
+ *   array literal elements, and redirection targets other than here-documents
+ *   (here-strings included, since bash before 4.4 split them).
+ * - **Exempt positions**, by construction: every other place a word can occur
+ *   (`[[ ]]` operands, assignment values and keyed array elements
+ *   (`arr=([k]=$v)`), `case` subjects and patterns,
+ *   arithmetic, here-document delimiters and bodies), an expansion that is a
+ *   part inside double quotes, and an expansion nested inside another
+ *   parameter expansion (`${a:-$b}`, judged as the outer one).
+ * - **Exempt expansions**: the specials that always expand to one word with no
+ *   glob characters (`$#`, `$?`, `$$`, `$!`, `$-`), length expansions
+ *   (`${#var}`), and, under the `bash` and `bats` dialects, the Bash
+ *   variables that always hold an integer (`$RANDOM`, `$SECONDS`, `$LINENO`,
+ *   `$PPID`, `$OPTIND`, `$BASH_SUBSHELL`).
+ *
+ * - **zsh**: under `dialect: "zsh"`, parameter expansions are not reported,
+ *   because zsh neither splits nor globs an unquoted parameter by default.
+ *   Command substitutions still report there, since zsh does split them. A
+ *   zsh script that enables `SH_WORD_SPLIT` or `GLOB_SUBST` is not detected.
+ *
+ * Only the syntactic position counts: the rule does no dataflow, so
+ * `n=3; seq $n` reports even though `$n` cannot split. Each report carries a
+ * suggestion that wraps the one expansion in double quotes; it is never an
+ * autofix, because a script may rely on the splitting (for example
+ * `$CFLAGS` holding several flags), and only its author can say so.
+ */
+import { DashHdoc, Hdoc } from 'sh-ast/analyze';
+import { createRule } from './create-rule.js';
+import { messageExcerpt } from '../language/line-breaks.js';
+/** The registry name of this rule (`sh/quote-expansions` in a user's config). */
+const RULE_NAME = 'quote-expansions';
+/**
+ * Special parameters whose expansion is always a single word with no glob
+ * characters: the argument count, exit status, shell and background PIDs,
+ * and the option-flag letters. Positional and named parameters are not here:
+ * their values are arbitrary text.
+ */
+const SINGLE_WORD_SPECIALS = new Set(['#', '?', '$', '!', '-']);
+/**
+ * Bash variables that always expand to a decimal integer, so an unquoted
+ * reference is one word with no glob characters, like the specials above.
+ * Bash keeps them integers: assigning text to `RANDOM`, `SECONDS` or `OPTIND`
+ * evaluates it arithmetically, `LINENO` and `BASH_SUBSHELL` ignore
+ * assignments, and `PPID` is read-only; a hostile value in the environment is
+ * ignored for each of them. Each exists in every Bash from 3.2, the oldest
+ * target eslint-sh supports.
+ *
+ * Left out on purpose: `UID` and `EUID`, which Bash imports verbatim from the
+ * environment (`env UID='a *' bash -c 'echo "[$UID]"'` prints `[a *]`), so
+ * they can hold text that splits and globs; `BASHPID` (Bash 4.0), `EPOCHSECONDS` (5.0) and
+ * `SRANDOM` (5.1), which an older Bash leaves unset, so an unquoted reference
+ * there expands to no word at all; `EPOCHREALTIME`, whose decimal separator
+ * follows the locale; and variables a script or the environment may set to
+ * any text (`COLUMNS`, `SHLVL`). The list does not apply outside Bash: in a
+ * POSIX shell such as dash these are ordinary variables.
+ */
+const BASH_INTEGER_VARIABLES = new Set([
+    'RANDOM',
+    'SECONDS',
+    'LINENO',
+    'PPID',
+    'OPTIND',
+    'BASH_SUBSHELL',
+]);
+/** The dialects whose scripts run under Bash, where {@link BASH_INTEGER_VARIABLES} holds. */
+const BASH_DIALECTS = new Set(['bash', 'bats']);
+/** Redirection operators that introduce a here-document (`<<`, `<<-`). */
+const HEREDOC_OPERATORS = new Set([Hdoc, DashHdoc]);
+/**
+ * Whether the parameter expansion `node` always yields one word: a length
+ * expansion (`${#var}`, `${#arr[@]}`), or a bare reference with no operator
+ * that could substitute other text to a single-word special (`$?`, `${#}`)
+ * or, when `bashIntegers` is set, to a Bash integer variable (`$RANDOM`).
+ * Indirection disqualifies a reference: `${!#}` expands the last positional
+ * parameter, whose value is arbitrary text, not the argument count.
+ */
+function isSingleWordParamExp(node, bashIntegers) {
+    if (node.length) {
+        return true;
+    }
+    const name = node.param?.value;
+    return (name !== undefined &&
+        (SINGLE_WORD_SPECIALS.has(name) || (bashIntegers && BASH_INTEGER_VARIABLES.has(name))) &&
+        !node.excl &&
+        node.exp === undefined &&
+        node.repl === undefined &&
+        node.slice === undefined &&
+        node.index === undefined);
+}
+/**
+ * The declaration utilities whose `NAME=value` operands are assignments. Under
+ * `dialect: "bash"` the parser gives them a declaration node with `Assign`
+ * children; under `dialect: "posix"` it leaves them as ordinary commands, so
+ * the same operand arrives as a plain argument word and is recognized by
+ * {@link isAssignmentOperand} instead.
+ */
+const DECLARATION_UTILITIES = new Set([
+    'export',
+    'readonly',
+    'local',
+    'declare',
+    'typeset',
+]);
+/** The literal start of an assignment operand: a variable name and `=`. */
+const ASSIGNMENT_PREFIX = /^[A-Za-z_][A-Za-z0-9_]*=/u;
+/**
+ * Whether `word`, an argument of the plain command `callExpr`, is the
+ * `NAME=value` operand of a declaration utility written directly as the
+ * command (`local x=$y` parsed as a plain command). Its value is assigned, not
+ * split, exactly as in the declaration node the bash dialect produces; a bare
+ * operand (`local $names`) is not an assignment and still reports.
+ */
+function isAssignmentOperand(word, callExpr) {
+    const { args } = callExpr;
+    if (word.type !== 'Word' || args.indexOf(word) < 1) {
+        return false;
+    }
+    const commandParts = args[0].parts;
+    const command = commandParts[0];
+    const first = word.parts[0];
+    return (commandParts.length === 1 &&
+        command.type === 'Lit' &&
+        DECLARATION_UTILITIES.has(command.value) &&
+        first.type === 'Lit' &&
+        ASSIGNMENT_PREFIX.test(first.value));
+}
+/**
+ * Whether `word`, a `Word` node whose parent is `parent`, is in a position the
+ * shell word-splits and pathname-expands. This is the complete list of such
+ * positions; anything not named here is exempt.
+ */
+function isSplitWord(word, parent) {
+    switch (parent?.type) {
+        // Command words and arguments, except a declaration utility's assignment
+        // operand; also each element of a `for`/`select` list.
+        case 'CallExpr':
+            return !isAssignmentOperand(word, parent);
+        case 'WordIter':
+            return true;
+        // A plain array literal element (`arr=($x)`). A keyed element
+        // (`arr=([k]=$x)`) is assigned like a variable, without splitting.
+        case 'ArrayElem':
+            return parent.index === undefined && parent.value === word;
+        // A bare declaration operand (`local $x`, `export $names`) is an ordinary
+        // argument to the builtin; an assignment value (`local x=$y`) is not split.
+        case 'Assign':
+            return parent.naked && parent.value === word;
+        // A redirection target, except a here-document's delimiter and body.
+        case 'Redirect':
+            return !HEREDOC_OPERATORS.has(parent.op) && parent.word === word;
+        default:
+            return false;
+    }
+}
+/**
+ * The `sh/quote-expansions` rule module.
+ *
+ * @internal
+ */
+export const quoteExpansions = createRule({
+    name: RULE_NAME,
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Require double quotes around parameter expansions and command substitutions in words the shell splits and globs',
+        },
+        hasSuggestions: true,
+        schema: [],
+        messages: {
+            unquotedExpansion: 'Unquoted `{{expansion}}` undergoes field splitting on `IFS` and pathname expansion. Quote it unless the splitting is intended.',
+            wrapInQuotes: 'Wrap `{{expansion}}` in double quotes.',
+        },
+    },
+    create(context) {
+        const { sourceCode } = context;
+        // zsh splits command substitutions but not parameters (absent
+        // `SH_WORD_SPLIT`/`GLOB_SUBST`), so only `CmdSubst` is checked there.
+        const checkParamExp = sourceCode.dialect !== 'zsh';
+        const bashIntegers = BASH_DIALECTS.has(sourceCode.dialect);
+        /**
+         * Reports `node` (a `ParamExp` or `CmdSubst`) when it is a direct,
+         * unquoted part of a word in a split position. A part inside `"…"` has a
+         * `DblQuoted` parent instead of the `Word`, so it never matches here.
+         */
+        function check(node) {
+            const word = sourceCode.getParent(node);
+            if (word?.type !== 'Word' || !isSplitWord(word, sourceCode.getParent(word))) {
+                return;
+            }
+            if (node.type === 'ParamExp' && isSingleWordParamExp(node, bashIntegers)) {
+                return;
+            }
+            const expansion = sourceCode.text.slice(node.range[0], node.range[1]);
+            // Inside double quotes, POSIX leaves a backquoted substitution containing
+            // `"` undefined, and `\` changes meaning; such a substitution is reported
+            // without a suggestion rather than with one that may change behavior.
+            const quotable = !(node.type === 'CmdSubst' && node.backquotes && /["\\]/.test(expansion));
+            context.report({
+                node,
+                messageId: 'unquotedExpansion',
+                data: { expansion: messageExcerpt(expansion) },
+                suggest: quotable
+                    ? [
+                        {
+                            messageId: 'wrapInQuotes',
+                            data: { expansion: messageExcerpt(expansion) },
+                            fix: (fixer) => fixer.replaceText(node, `"${expansion}"`),
+                        },
+                    ]
+                    : [],
+            });
+        }
+        return checkParamExp ? { ParamExp: check, CmdSubst: check } : { CmdSubst: check };
+    },
+});

package/dist/rules/require-network-wrapper.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `sh/require-network-wrapper`: every network command must be run through the
+ * project's configured wrapper (a retry, audit, or proxy helper).
+ *
+ * This is the built-in instance of `createWrapperRule`: the commands
+ * default to common network clients, and the wrapper comes from the user's
+ * rule's `wrapper` option, or else from the shared `settings.sh.networkWrapper`
+ * (which the declaration rules also read). The wrapper has **no default**.
+ * Which wrapper guards network calls is a project's policy, and a generic
+ * linter must not invent it, so with neither set the rule is inert: it
+ * registers no listeners, reports nothing, and never analyzes the file.
+ *
+ * `git` counts only for the subcommands that talk to a remote (`fetch`,
+ * `clone`, `pull`, `push`), found after git's own global options
+ * (`git -C dir fetch`).
+ */
+import type { WrapperSpec } from 'sh-ast/analyze';
+/**
+ * The options of `sh/require-network-wrapper`.
+ *
+ * @internal
+ */
+export interface RequireNetworkWrapperOptions {
+    /** Replaces the default network commands. */
+    readonly commands?: readonly string[];
+    /**
+     * The wrapper network commands must be run through: a name, or a
+     * `WrapperSpec` declaring the wrapper's option shape. Unset falls back to
+     * `settings.sh.networkWrapper`; with neither, the rule is inert.
+     */
+    readonly wrapper?: string | WrapperSpec;
+    /** Commands checked in addition to `commands` (or its default). */
+    readonly alsoTreatAsNetwork?: readonly string[];
+}
+/**
+ * The `sh/require-network-wrapper` rule module.
+ *
+ * @internal
+ */
+export declare const requireNetworkWrapper: import("./define-shell-rule.js").ShellRule<[RequireNetworkWrapperOptions?], "unwrappedCommand">;

package/dist/rules/require-network-wrapper.js

@@ -0,0 +1,244 @@
+import { createRule } from './create-rule.js';
+import { WRAPPER_RULE_MESSAGES, buildWrapperRule } from './create-wrapper-rule.js';
+import { readNetworkWrapperSetting } from './resolve-network-wrapper.js';
+/** The registry name of this rule (`sh/require-network-wrapper` in a user's config). */
+const RULE_NAME = 'require-network-wrapper';
+/**
+ * The commands checked when the `commands` option is not set: clients whose
+ * normal job is to talk to another host.
+ */
+const DEFAULT_NETWORK_COMMANDS = [
+    'curl',
+    'wget',
+    'nc',
+    'ssh',
+    'scp',
+    'rsync',
+    'git',
+];
+/**
+ * `git`'s network subcommands, and the global options that may precede a
+ * subcommand, so that `git -C dir fetch` is found as `fetch`.
+ *
+ * The option lists follow git(1)'s synopsis and OPTIONS. Options git treats
+ * as "print something and exit" (`--version`, `--help`, the `--*-path`
+ * queries, and `--exec-path` without a value) run no subcommand. An option not
+ * listed here leaves the subcommand unknown, so the invocation is not
+ * reported rather than guessed.
+ *
+ * @see https://git-scm.com/docs/git#_options
+ */
+const GIT_NETWORK_SUBCOMMANDS = {
+    names: ['fetch', 'clone', 'pull', 'push'],
+    noArgFlags: [
+        '-p',
+        '--paginate',
+        '-P',
+        '--no-pager',
+        '--no-replace-objects',
+        '--no-lazy-fetch',
+        '--no-optional-locks',
+        '--no-advice',
+        '--bare',
+        '--literal-pathspecs',
+        '--glob-pathspecs',
+        '--noglob-pathspecs',
+        '--icase-pathspecs',
+    ],
+    argFlags: [
+        '-C',
+        '-c',
+        '--git-dir',
+        '--work-tree',
+        '--namespace',
+        '--config-env',
+        '--attr-source',
+        // Only `--exec-path=<path>` reaches here: the bare flag is in
+        // `stopsChainFlags`, which is checked first.
+        '--exec-path',
+    ],
+    stopsChainFlags: [
+        '-v',
+        '--version',
+        '-h',
+        '--help',
+        '--html-path',
+        '--man-path',
+        '--info-path',
+        '--exec-path',
+    ],
+};
+/**
+ * The subcommand restrictions this rule always applies: `git` counts only for
+ * its network subcommands, whether it comes from the default `commands`, a
+ * configured `commands`, or `alsoTreatAsNetwork`.
+ */
+const NETWORK_SUBCOMMANDS = {
+    git: GIT_NETWORK_SUBCOMMANDS,
+};
+/**
+ * The invocations of the default network commands that touch no network:
+ * their version and help output, and `git clone` from a local path. These
+ * are the rule's own binding of the factory's `localInvocations`; the factory
+ * names no command.
+ *
+ * `curl --help all` is curl's full help listing, and `-V` and `-h` are the
+ * short forms of `--version` and `--help`. The argument lists match exactly,
+ * so `curl --version https://example.com`, which still makes the request, is
+ * reported. A clone source is local when it is a path (`./x`, `../x`, `/x`) or
+ * a `file://` URL; a dynamic source or a remote URL is not, and only the
+ * source decides, so a dynamic destination does not matter. The `git clone`
+ * option lists follow git-clone(1), minus the options that can reach a
+ * remote whatever the source is: `--recurse-submodules`, `--recursive` and
+ * `--remote-submodules` (a local repository's `.gitmodules` may point at a
+ * remote URL) and `--bundle-uri` (which fetches the bundle from its URL). Such
+ * a clone is not provably local and is reported. `--no-recurse-submodules`
+ * only turns recursion off, so it is skipped.
+ *
+ * @see https://git-scm.com/docs/git-clone
+ */
+const NETWORK_LOCAL_INVOCATIONS = {
+    curl: {
+        argLists: [['--version'], ['-V'], ['--help'], ['-h'], ['--help', 'all'], ['-h', 'all']],
+    },
+    wget: { argLists: [['--version'], ['-V'], ['--help'], ['-h']] },
+    'git clone': {
+        localOperand: {
+            localPrefixes: ['./', '../', '/', 'file://'],
+            noArgFlags: [
+                '-l',
+                '--local',
+                '--no-hardlinks',
+                '-s',
+                '--shared',
+                '--dissociate',
+                '-q',
+                '--quiet',
+                '-v',
+                '--verbose',
+                '--progress',
+                '-n',
+                '--no-checkout',
+                '--bare',
+                '--mirror',
+                '--single-branch',
+                '--no-single-branch',
+                '--no-tags',
+                '--shallow-submodules',
+                '--no-shallow-submodules',
+                '--sparse',
+                '--reject-shallow',
+                '--no-reject-shallow',
+                '--no-recurse-submodules',
+                '--also-filter-submodules',
+                '-4',
+                '--ipv4',
+                '-6',
+                '--ipv6',
+            ],
+            argFlags: [
+                '-o',
+                '--origin',
+                '-b',
+                '--branch',
+                '-u',
+                '--upload-pack',
+                '--reference',
+                '--reference-if-able',
+                '--separate-git-dir',
+                '--depth',
+                '--shallow-since',
+                '--shallow-exclude',
+                '-c',
+                '--config',
+                '--template',
+                '--filter',
+                '-j',
+                '--jobs',
+                '--server-option',
+                '--ref-format',
+            ],
+        },
+    },
+};
+/** A JSON-schema array of non-empty strings. */
+const STRING_LIST_SCHEMA = {
+    type: 'array',
+    items: { type: 'string', minLength: 1 },
+};
+/**
+ * The JSON-expressible form of a `WrapperSpec`, for the `wrapper` option.
+ * `noArgFlagPattern` (a `RegExp`) and the legacy `skipAssignmentOperands` are
+ * left out; a rule pack that needs them binds its wrapper with
+ * `createWrapperRule` instead.
+ */
+const WRAPPER_SPEC_SCHEMA = {
+    type: 'object',
+    properties: {
+        names: { ...STRING_LIST_SCHEMA, minItems: 1 },
+        noArgFlags: STRING_LIST_SCHEMA,
+        argFlags: STRING_LIST_SCHEMA,
+        unresolvableFlags: STRING_LIST_SCHEMA,
+        stopsChainFlags: STRING_LIST_SCHEMA,
+        positionalOperandsBeforeCommand: { type: 'integer', minimum: 0 },
+        assignmentOperands: { enum: ['shell-identifier', 'env', 'sudo'] },
+    },
+    required: ['names'],
+    additionalProperties: false,
+};
+/**
+ * Resolves the factory config this rule enforces for one set of options, or
+ * `null` when no wrapper is configured.
+ */
+function wrapperRuleConfig(options, settings) {
+    // The rule option wins; otherwise the shared setting, which the
+    // declaration rules read too (see `./resolve-network-wrapper.ts`).
+    const wrapper = options?.wrapper ?? readNetworkWrapperSetting(settings);
+    if (wrapper === undefined)
+        return null;
+    return {
+        commands: [
+            ...(options?.commands ?? DEFAULT_NETWORK_COMMANDS),
+            ...(options?.alsoTreatAsNetwork ?? []),
+        ],
+        wrapper,
+        subcommands: NETWORK_SUBCOMMANDS,
+        localInvocations: NETWORK_LOCAL_INVOCATIONS,
+    };
+}
+/**
+ * The `sh/require-network-wrapper` rule module.
+ *
+ * @internal
+ */
+export const requireNetworkWrapper = createRule({
+    name: RULE_NAME,
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require network commands to be run through the configured wrapper',
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    commands: STRING_LIST_SCHEMA,
+                    wrapper: { oneOf: [{ type: 'string', minLength: 1 }, WRAPPER_SPEC_SCHEMA] },
+                    alsoTreatAsNetwork: STRING_LIST_SCHEMA,
+                },
+                additionalProperties: false,
+            },
+        ],
+        messages: WRAPPER_RULE_MESSAGES,
+    },
+    create(context) {
+        const config = wrapperRuleConfig(context.options[0], context.settings);
+        if (config === null)
+            return {};
+        // The check itself is the rule `createWrapperRule` makes for this config
+        // (`buildWrapperRule` is that factory, typed for built-in rules); this
+        // rule only derives the config from the user's options and reports
+        // through its own context.
+        return buildWrapperRule(config).create(context);
+    },
+});

package/dist/rules/require-shebang.d.ts

@@ -0,0 +1,29 @@
+/**
+ * How the fix spells the interpreter it inserts: `env` resolves the shell
+ * through `PATH` (`#!/usr/bin/env bash`), `absolute` names a fixed location
+ * (`#!/bin/bash`).
+ *
+ * @internal
+ */
+export type ShebangStyle = 'env' | 'absolute';
+/**
+ * The rule's single options object, as written in a config.
+ *
+ * @internal
+ */
+export interface RequireShebangOptions {
+    readonly style?: ShebangStyle;
+}
+/**
+ * The rule's report kinds: no shebang on line 1, or a shebang that does not run
+ * a recognized shell.
+ *
+ * @internal
+ */
+export type RequireShebangMessageIds = 'missingShebang' | 'unrecognizedInterpreter';
+/**
+ * The rule module registered as `require-shebang`.
+ *
+ * @internal
+ */
+export declare const requireShebang: import("./define-shell-rule.js").ShellRule<[RequireShebangOptions], RequireShebangMessageIds>;

package/dist/rules/require-shebang.js

@@ -0,0 +1,101 @@
+import { createRule } from './create-rule.js';
+import { shebangShell } from './shebang-interpreter.js';
+/**
+ * Interpreter basenames this rule accepts in a shebang. Any of them makes the
+ * file's interpreter explicit; which one is right for the configured dialect
+ * is a separate rule's question.
+ */
+const RECOGNIZED_SHELLS = new Set([
+    'bash',
+    'sh',
+    'dash',
+    'ksh',
+    'mksh',
+    'zsh',
+    'bats',
+]);
+/**
+ * The interpreter the autofix names for each configured dialect. `posix` has
+ * no shell of its own name, so it maps to `sh`.
+ */
+const SHELL_FOR_DIALECT = {
+    bash: 'bash',
+    posix: 'sh',
+    mksh: 'mksh',
+    zsh: 'zsh',
+    bats: 'bats',
+};
+/** The UTF-8 byte order mark as it appears in a decoded string. */
+const BOM = '\uFEFF';
+/** The shebang line the fix inserts for `dialect`, in the configured `style`. */
+function shebangFor(dialect, style) {
+    const shell = SHELL_FOR_DIALECT[dialect];
+    return style === 'env' ? `#!/usr/bin/env ${shell}` : `#!/bin/${shell}`;
+}
+/**
+ * The rule module registered as `require-shebang`.
+ *
+ * @internal
+ */
+export const requireShebang = createRule({
+    name: 'require-shebang',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require a shebang on line 1 that runs a recognized shell',
+        },
+        fixable: 'code',
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    style: { enum: ['env', 'absolute'] },
+                },
+                additionalProperties: false,
+            },
+        ],
+        defaultOptions: [{ style: 'env' }],
+        messages: {
+            missingShebang: "This file has no shebang, so it runs under whichever shell invokes it. Add one on line 1, such as '{{shebang}}'.",
+            unrecognizedInterpreter: "The shebang '{{shebang}}' does not run a recognized shell. Name bash, sh, dash, ksh, mksh, zsh or bats by absolute path, or through env (such as /usr/bin/env).",
+        },
+    },
+    create(context) {
+        const { sourceCode } = context;
+        // `defaultOptions` guarantees the options object; `style` may still be omitted in it.
+        const [{ style = 'env' }] = context.options;
+        return {
+            File() {
+                const text = sourceCode.text.startsWith(BOM) ? sourceCode.text.slice(1) : sourceCode.text;
+                const firstLine = sourceCode.lines[0] ?? '';
+                // Line 1 in full. The shell language numbers lines and columns from 1
+                // (`ShellLanguage.lineStart`/`columnStart`).
+                const loc = {
+                    start: { line: 1, column: 1 },
+                    end: { line: 1, column: firstLine.length + 1 },
+                };
+                if (text.startsWith('#!')) {
+                    const shebangLine = firstLine.startsWith(BOM) ? firstLine.slice(1) : firstLine;
+                    const shell = shebangShell(shebangLine.slice('#!'.length));
+                    if (shell === undefined || !RECOGNIZED_SHELLS.has(shell)) {
+                        context.report({
+                            loc,
+                            messageId: 'unrecognizedInterpreter',
+                            data: { shebang: shebangLine.trimEnd() },
+                        });
+                    }
+                    return;
+                }
+                const shebang = shebangFor(sourceCode.dialect, style);
+                // Keep the file's own line-ending style: a CRLF file gets a CRLF shebang.
+                const lineBreak = /^[^\n]*\r\n/u.test(sourceCode.text) ? '\r\n' : '\n';
+                context.report({
+                    loc,
+                    messageId: 'missingShebang',
+                    data: { shebang },
+                    fix: (fixer) => fixer.insertTextBeforeRange([0, 0], `${shebang}${lineBreak}`),
+                });
+            },
+        };
+    },
+});