@eslint-sh/eslint-plugin 0.5.0 → 0.7.0

package/dist/rules/compat/no-brace-sequence-padding-step.js

@@ -0,0 +1,287 @@
+/**
+ * `sh/compat/no-brace-sequence-padding-step`: reports a brace sequence that
+ * is zero-padded (`{01..10}`) or stepped (`{1..10..2}`, `{a..e..2}`) in
+ * files whose target shell lacks those forms, that is, Bash older than 4.0
+ * (macOS's stock `/bin/bash` is 3.2) and POSIX sh.
+ *
+ * Neither form is an error on Bash 3.2, which is what makes them easy to
+ * miss. Bash 3.2 expands `{01..03}` to `1 2 3`, dropping the padding, and
+ * leaves `{1..9..4}` as that literal word, so the script carries on with
+ * different words. POSIX does not specify brace expansion, so under a POSIX
+ * target what a shell does with the word depends on the shell (observed: dash
+ * leaves it literal, macOS's `/bin/sh` drops the padding as Bash 3.2 does,
+ * and `bash --posix` 5.3 pads); a plain `{1..3}` is as shell-dependent there,
+ * and this rule does not report it: only the Bash 4.0 additions are in its
+ * scope. The
+ * message suggests the portable alternative: count in a `while` loop and
+ * format with `printf`.
+ *
+ * What is read: the parser keeps a brace sequence as literal text inside a
+ * word, so the rule scans the literal parts of words that the shell
+ * brace-expands. A sequence is a `{` and `}` with nothing but the sequence
+ * between them (so `{01..03,x}`, a comma list, is not one), where:
+ *
+ * - the endpoints are both integers (an optional sign and digits) or both
+ *   single ASCII letters, with an optional third `..` field that is an
+ *   integer step: that makes it stepped, for either kind of endpoint;
+ * - integer endpoints are padded when either has more than one digit and
+ *   starts with `0` after an optional `-` (`01`, `00`, `-01`, `1..03`; `0`,
+ *   `-0` and `+01` are not).
+ *
+ * Anything that is not a sequence in Bash 4.0 and newer is left alone:
+ * `{a..c}` and `{1..3}` (no padding, no step, the same on every Bash),
+ * mixed endpoints (`{a..5..2}`), a variable endpoint (`{01..$n}`, which the
+ * shell never expands), an unterminated or malformed one (`{01..}`), and a
+ * `{` or `}` that is quoted or backslash-escaped, since quoted text is a
+ * separate part of the word and an escape is skipped when scanning.
+ *
+ * Numbers are bounded as Bash 5.3 bounds them, because past the bounds the
+ * word stays literal on every Bash and nothing differs: endpoints must fit a
+ * signed 64-bit integer, so must the distance between them, and so must the
+ * step's magnitude (a step of -9223372036854775808 or a value past 64 bits
+ * leaves the word literal;
+ * leading zeros do not count towards the value, so `{1..00000000000000000003}`
+ * is a sequence). Bash 3.2 reads the same words as literal or wraps them
+ * (its integers are narrower), and the older 4.x releases' bound was not
+ * measured, so a sequence inside the 64-bit range is reported and one outside
+ * it is not.
+ *
+ * Only words that are brace-expanded are read: command words and arguments,
+ * `for`/`select` lists, the elements of an array literal without an index,
+ * and the operands of `declare`, `local`, `export` and `readonly`. Not read,
+ * because the shell does no brace expansion there: a plain assignment
+ * (`a={01..03}`), a `case` subject or pattern, the operands of `[[ ]]`,
+ * here-strings and here-documents, and parameter-expansion words.
+ *
+ * A descriptor duplication target is not reported where it behaves the same
+ * on every Bash; see `isSameOnEveryBash`.
+ *
+ * Text inside a quoted string that the shell later runs as code (`eval
+ * '...'`, `trap '...'`) is not seen: the parser holds it as a string.
+ *
+ * A redirection target (`: > out{01..01}`) is read only when the sequence
+ * can be shown to yield exactly one word, since several words make it an
+ * "ambiguous redirect" error on Bash 4 and newer (on 3.2 too for a padded
+ * one), and the script is then wrong on every Bash that has the feature,
+ * not a portability gap. The word must hold that one sequence and no other
+ * brace group, whose product with it could not be counted here. A single-word
+ * result differs by target: `out{01..01}` names `out1` on Bash 3.2 and
+ * `out01` on 5.3, and `out{1..3..5}` names a file called `out{1..3..5}` on
+ * 3.2 and `out1` on 5.3. A sequence is always static text here (a variable
+ * endpoint is no sequence), so its length is always known. The report is on
+ * the whole word, once per word.
+ */
+import { createCompatRule } from './create-compat-rule.js';
+import { DashHdoc, DplIn, DplOut, Hdoc, WordHdoc } from 'sh-ast/analyze';
+/** The sequence between braces: two endpoints and an optional step. */
+const SEQUENCE = /^([+-]?\d+|[A-Za-z])\.\.([+-]?\d+|[A-Za-z])(?:\.\.([+-]?\d+))?$/u;
+/**
+ * An integer endpoint with leading zeros, which Bash 4.0 pads to. A `+` sign
+ * does not count: Bash 5.3 expands `{+01..3}` as `1 2 3`, as 3.2 does.
+ */
+const ZERO_PADDED = /^-?0\d+$/u;
+/** An integer endpoint. */
+const INTEGER = /^[+-]?\d+$/u;
+/** The signed 64-bit range Bash 5.3 accepts for an endpoint. */
+const INT64_MIN = -(2n ** 63n);
+const INT64_MAX = 2n ** 63n - 1n;
+/**
+ * `text` with every backslash escape (the backslash and the character it
+ * quotes) replaced by `\0`, which no sequence contains, so an escaped brace
+ * cannot open or close a sequence and an escape inside one disqualifies it.
+ */
+function maskEscapes(text) {
+    let masked = '';
+    for (let index = 0; index < text.length; index++) {
+        if (text[index] === '\\') {
+            masked += '\0\0';
+            index++;
+        }
+        else {
+            masked += text[index];
+        }
+    }
+    return masked;
+}
+/** The value of an endpoint: an integer's number, or a letter's code point. */
+function endpointValue(endpoint) {
+    return INTEGER.test(endpoint) ? BigInt(endpoint) : BigInt(endpoint.charCodeAt(0));
+}
+/**
+ * The number of words a valid sequence yields. A step of zero counts as 1,
+ * and a step's sign is ignored: the direction follows the endpoints.
+ */
+function resultCount(start, end, step) {
+    const size = step === undefined || step === 0n ? 1n : step < 0n ? -step : step;
+    return span(start, end) / size + 1n;
+}
+/** The distance between two endpoints. */
+function span(start, end) {
+    return end > start ? end - start : start - end;
+}
+/**
+ * The first brace sequence in the literal text `text` that needs Bash 4.0
+ * and that Bash 5.3 expands, or `undefined`. Innermost brace pairs are the
+ * only candidates, which is where Bash finds a sequence, including one
+ * nested in a comma list (`{x,{01..03}}`).
+ */
+function findSequence(text) {
+    const masked = maskEscapes(text);
+    for (const pair of masked.matchAll(/\{([^{}]*)\}/gu)) {
+        const match = SEQUENCE.exec(pair[1]);
+        if (match === null)
+            continue;
+        const [, start, end] = match;
+        const integers = INTEGER.test(start) && INTEGER.test(end);
+        const letters = !INTEGER.test(start) && !INTEGER.test(end);
+        if (!integers && !letters)
+            continue;
+        // A third `..` field is the step (SEQUENCE has already checked its form).
+        const stepText = match[0].split('..').length === 3 ? match[0].split('..')[2] : undefined;
+        const step = stepText === undefined ? undefined : BigInt(stepText);
+        const first = endpointValue(start);
+        const last = endpointValue(end);
+        const inRange = first >= INT64_MIN &&
+            first <= INT64_MAX &&
+            last >= INT64_MIN &&
+            last <= INT64_MAX &&
+            (step === undefined || (step > INT64_MIN && step <= INT64_MAX));
+        // The distance between the endpoints must fit too:
+        // `{-1..9223372036854775807..9223372036854775807}` stays literal on Bash
+        // 5.3 although every number in it is in range.
+        if (!inRange || span(first, last) > INT64_MAX)
+            continue;
+        const results = resultCount(first, last, step);
+        const written = text.slice(pair.index, pair.index + pair[0].length);
+        if (step !== undefined)
+            return { text: written, kind: 'stepped', results, first };
+        if (integers && (ZERO_PADDED.test(start) || ZERO_PADDED.test(end))) {
+            return { text: written, kind: 'padded', results, first };
+        }
+    }
+    return undefined;
+}
+/** How many unescaped `{` the literal parts of `word` hold. */
+function braceGroupCount(word) {
+    let count = 0;
+    for (const part of word.parts) {
+        if (part.type === 'Lit')
+            count += maskEscapes(part.value).split('{').length - 1;
+    }
+    return count;
+}
+/** Redirection operators whose word the shell does not brace-expand. */
+const NO_BRACE_REDIRECTS = new Set([Hdoc, DashHdoc, WordHdoc]);
+/** The `<&` and `>&` operators, whose lone-number word names a descriptor. */
+const DESCRIPTOR_DUPLICATES = new Set([DplIn, DplOut]);
+/**
+ * Whether a one-word sequence that is the whole target of `<&` or `>&`
+ * behaves the same on Bash 3.2 and newer (checked on 3.2.57 and 5.3.9):
+ *
+ * - a descriptor position (`<&`, or `>&` with a descriptor before it, as in
+ *   `2>&`) with a negative number is an "ambiguous redirect" error on both,
+ *   whatever the form, so there is nothing to port;
+ * - a padded non-negative number names the same descriptor on both (`>&{01..01}`
+ *   is descriptor 1), but a stepped one differs (`>&{1..3..5}` is literal on
+ *   3.2 and descriptor 1 on 5.3);
+ * - a bare `>&` with a word that is not a descriptor writes a file, so a
+ *   negative number is a file name that differs (`-1` on 3.2, `-01` on 5.3).
+ */
+function isSameOnEveryBash(redirect, sequence) {
+    if (sequence.results !== 1n)
+        return false;
+    const descriptorPosition = redirect.op === DplIn || redirect.n !== undefined;
+    if (sequence.first < 0n)
+        return descriptorPosition;
+    return sequence.kind === 'padded';
+}
+/**
+ * Whether the shell brace-expands `word`, a `Word` node whose parent is
+ * `parent`. This is the complete list of such positions; anything not named
+ * here is exempt.
+ */
+function isBraceExpanded(word, parent, grandparent) {
+    switch (parent?.type) {
+        case 'CallExpr':
+        case 'WordIter':
+            return true;
+        // An array literal element; a keyed element (`[k]=v`) is assigned like a
+        // variable and is not expanded.
+        case 'ArrayElem':
+            return parent.index === undefined && parent.value === word;
+        // A declaration's operands are arguments to the builtin, so both a bare
+        // one and the value of `NAME=value` are expanded; a plain assignment is
+        // not.
+        case 'Assign':
+            return grandparent?.type === 'DeclClause';
+        // The target of an ordinary redirection; a here-document's delimiter and
+        // a here-string's word are not brace-expanded.
+        case 'Redirect':
+            return parent.word === word && !NO_BRACE_REDIRECTS.has(parent.op);
+        default:
+            return false;
+    }
+}
+/**
+ * The `sh/compat/no-brace-sequence-padding-step` rule module.
+ *
+ * @internal
+ */
+export const noBraceSequencePaddingStep = createCompatRule({
+    name: 'compat/no-brace-sequence-padding-step',
+    feature: 'braceSequencePaddingStep',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow zero-padded (`{01..10}`) and stepped (`{1..10..2}`) brace sequences when the target shell lacks them',
+        },
+        messages: {
+            padded: '`{{sequence}}` needs {{required}}, but this file targets {{target}}, which expands it without the zero padding. Count in a loop and format with `printf` instead, for example `i=1; while [ "$i" -le 3 ]; do printf \'%02d\\n\' "$i"; i=$((i + 1)); done`.',
+            stepped: '`{{sequence}}` needs {{required}}, but this file targets {{target}}, which leaves it as that literal word. Count in a loop instead, for example `i=1; while [ "$i" -le 9 ]; do echo "$i"; i=$((i + 4)); done`.',
+            posixPadded: '`{{sequence}}` needs {{required}}, but this file targets {{target}}, which does not specify brace expansion, so what a shell does with this word depends on the shell. Count in a loop and format with `printf` instead, for example `i=1; while [ "$i" -le 3 ]; do printf \'%02d\\n\' "$i"; i=$((i + 1)); done`.',
+            posixStepped: '`{{sequence}}` needs {{required}}, but this file targets {{target}}, which does not specify brace expansion, so what a shell does with this word depends on the shell. Count in a loop instead, for example `i=1; while [ "$i" -le 9 ]; do echo "$i"; i=$((i + 4)); done`.',
+        },
+    },
+    create(context, gate) {
+        const { sourceCode } = context;
+        const posix = sourceCode.dialect === 'posix';
+        return {
+            Word(node) {
+                const parent = sourceCode.getParent(node);
+                const grandparent = parent === undefined ? undefined : sourceCode.getParent(parent);
+                if (!isBraceExpanded(node, parent, grandparent))
+                    return;
+                const redirectTarget = parent?.type === 'Redirect';
+                for (const part of node.parts) {
+                    if (part.type !== 'Lit')
+                        continue;
+                    const sequence = findSequence(part.value);
+                    if (sequence === undefined)
+                        continue;
+                    // A redirection target is an ambiguous-redirect error unless it is
+                    // exactly one word, which is only certain for a lone sequence.
+                    if (redirectTarget && (sequence.results !== 1n || braceGroupCount(node) !== 1))
+                        return;
+                    if (!posix &&
+                        parent?.type === 'Redirect' &&
+                        DESCRIPTOR_DUPLICATES.has(parent.op) &&
+                        node.parts.length === 1 &&
+                        part.value === sequence.text &&
+                        isSameOnEveryBash(parent, sequence)) {
+                        return;
+                    }
+                    context.report({
+                        node,
+                        messageId: posix
+                            ? sequence.kind === 'padded'
+                                ? 'posixPadded'
+                                : 'posixStepped'
+                            : sequence.kind,
+                        data: { ...gate, sequence: sequence.text },
+                    });
+                    return;
+                }
+            },
+        };
+    },
+});

package/dist/rules/compat/no-case-attributes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoCaseAttributesMessageId = 'caseAttribute' | 'caseAttributesBoth';
+/**
+ * The `sh/compat/no-case-attributes` rule module.
+ *
+ * @internal
+ */
+export declare const noCaseAttributes: import("../define-shell-rule.js").ShellRule<[], NoCaseAttributesMessageId>;

package/dist/rules/compat/no-case-attributes.js

@@ -0,0 +1,63 @@
+/**
+ * `sh/compat/no-case-attributes`: reports the case-converting attributes
+ * `declare -l` and `declare -u` (also through `typeset` and `local`) in files
+ * whose target shell lacks them, that is, Bash older than 4.0 (macOS's stock
+ * `/bin/bash` is 3.2) and POSIX sh.
+ *
+ * Bash 3.2 rejects the option, so the declaration fails and the variable is
+ * left unset. The message suggests the portable alternative: convert the
+ * value with `tr` when assigning it.
+ *
+ * What is read: `declare`/`typeset`/`local` option clusters containing `l`
+ * or `u` (`-l`, `-u`, `-lx`), found as `declarationFlagVisitor` defines. The
+ * report is on the option word. A cluster with both letters (`-lu`) reports
+ * once, with its own message: on every Bash that has the attributes, `-l`
+ * and `-u` together cancel out and leave the value as written (observed on
+ * Bash 4.0 and 5.3), so no `tr` conversion matches it.
+ */
+import { createCompatRule } from './create-compat-rule.js';
+import { DECLARATION_AND_LOCAL_COMMANDS, declarationFlagVisitor } from './declaration-options.js';
+/** The `tr` conversion that gives each attribute's result. */
+const TR_FOR = {
+    l: "tr '[:upper:]' '[:lower:]'",
+    u: "tr '[:lower:]' '[:upper:]'",
+};
+/**
+ * The `sh/compat/no-case-attributes` rule module.
+ *
+ * @internal
+ */
+export const noCaseAttributes = createCompatRule({
+    name: 'compat/no-case-attributes',
+    feature: 'caseAttributes',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow the case attributes `declare -l` and `declare -u` when the target shell lacks them',
+        },
+        messages: {
+            caseAttribute: '`{{command}} -{{flag}}` needs {{required}}, but this file targets {{target}}. Convert the value when you assign it instead, for example `v=$(printf \'%s\' "$v" | {{tr}})`.',
+            caseAttributesBoth: '`{{command}} {{option}}` needs {{required}}, but this file targets {{target}}. Where it is supported, `-l` and `-u` together cancel out and leave the value as written, so drop both letters.',
+        },
+    },
+    create(context, gate) {
+        const { sourceCode } = context;
+        return declarationFlagVisitor(sourceCode, '[lu]', (node, command) => {
+            const option = (node.type === 'Word' ? sourceCode.resolveWordText(node) : null) ?? '';
+            if (option.includes('l') && option.includes('u')) {
+                context.report({
+                    node,
+                    messageId: 'caseAttributesBoth',
+                    data: { ...gate, command, option },
+                });
+                return;
+            }
+            const flag = option.includes('l') ? 'l' : 'u';
+            context.report({
+                node,
+                messageId: 'caseAttribute',
+                data: { ...gate, command, flag, tr: TR_FOR[flag] },
+            });
+        }, DECLARATION_AND_LOCAL_COMMANDS);
+    },
+});

package/dist/rules/compat/no-case-fallthrough.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoCaseFallthroughMessageId = 'fallthrough' | 'resume';
+/**
+ * The `sh/compat/no-case-fallthrough` rule module.
+ *
+ * @internal
+ */
+export declare const noCaseFallthrough: import("../define-shell-rule.js").ShellRule<[], NoCaseFallthroughMessageId>;

package/dist/rules/compat/no-case-fallthrough.js

@@ -0,0 +1,67 @@
+/**
+ * `sh/compat/no-case-fallthrough`: reports the `case` terminators `;&` (run
+ * the next branch without testing its pattern) and `;;&` (go on testing the
+ * next patterns) in files whose target shell lacks them, that is, Bash older
+ * than 4.0 (macOS's stock `/bin/bash` is 3.2) and POSIX sh.
+ *
+ * Bash 3.2 rejects both as a syntax error, so the whole script fails to run.
+ * POSIX.1-2024 adds `;&`, but dash 0.5.12 still rejects it, so a POSIX
+ * target is treated as lacking it. The message suggests the portable
+ * rewrite: for `;&`, repeat the next branch's commands at the end of this
+ * one and end it with `;;`; for `;;&`, move the patterns after this branch
+ * into a second `case` statement.
+ *
+ * What is read: a `case` branch (`CaseItem`) whose terminator is `;&` or
+ * `;;&`. The usual `;;`, and these characters inside quotes or a pattern,
+ * are not reported. The report is on the terminator.
+ */
+import { Fallthrough, Resume } from 'sh-ast';
+import { createCompatRule } from './create-compat-rule.js';
+import { operatorRange } from './operator-range.js';
+/** Each terminator's message and spelling. */
+const TERMINATORS = new Map([
+    [Fallthrough, { messageId: 'fallthrough', text: ';&' }],
+    [Resume, { messageId: 'resume', text: ';;&' }],
+]);
+/**
+ * The `sh/compat/no-case-fallthrough` rule module.
+ *
+ * @internal
+ */
+export const noCaseFallthrough = createCompatRule({
+    name: 'compat/no-case-fallthrough',
+    feature: 'caseFallthrough',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow the `case` terminators `;&` and `;;&` when the target shell lacks them',
+        },
+        messages: {
+            fallthrough: "`;&` needs {{required}}, but this file targets {{target}}. Repeat the next branch's commands at the end of this branch and end it with `;;` instead.",
+            resume: '`;;&` needs {{required}}, but this file targets {{target}}. End this branch with `;;` and test the patterns that follow it in a second `case` statement instead.',
+        },
+    },
+    create(context, gate) {
+        const { sourceCode } = context;
+        return {
+            CaseItem(node) {
+                const terminator = TERMINATORS.get(node.op);
+                if (terminator === undefined)
+                    return;
+                const range = operatorRange(sourceCode, node, terminator.text);
+                if (range === undefined) {
+                    context.report({ node, messageId: terminator.messageId, data: { ...gate } });
+                    return;
+                }
+                context.report({
+                    loc: {
+                        start: sourceCode.getLocFromIndex(range[0]),
+                        end: sourceCode.getLocFromIndex(range[1]),
+                    },
+                    messageId: terminator.messageId,
+                    data: { ...gate },
+                });
+            },
+        };
+    },
+});

package/dist/rules/compat/no-case-modification.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoCaseModificationMessageId = 'caseModification' | 'caseModificationPattern';
+/**
+ * What `tr` is given to convert, and to which case, for one operator.
+ *
+ * @internal
+ */
+export interface CaseOperator {
+    /** The operator as written after the name. */
+    readonly operator: string;
+    /** Whether the operator converts every character (`^^`, `,,`) or the first. */
+    readonly all: boolean;
+    /** `tr` arguments that perform the conversion. */
+    readonly tr: string;
+}
+/** `tr` arguments that convert to upper case. @internal */
+export declare const TO_UPPER = "tr '[:lower:]' '[:upper:]'";
+/** `tr` arguments that convert to lower case. @internal */
+export declare const TO_LOWER = "tr '[:upper:]' '[:lower:]'";
+/**
+ * The `tr` replacement shown in the message for `name` under `spec`.
+ *
+ * @internal
+ */
+export declare function trExample(name: string, spec: CaseOperator): string;
+/**
+ * The `sh/compat/no-case-modification` rule module.
+ *
+ * @internal
+ */
+export declare const noCaseModification: import("../define-shell-rule.js").ShellRule<[], NoCaseModificationMessageId>;

package/dist/rules/compat/no-case-modification.js

@@ -0,0 +1,86 @@
+/**
+ * `sh/compat/no-case-modification`: reports the case-modifying parameter
+ * expansions `${v^}`, `${v^^}`, `${v,}` and `${v,,}` (with or without a
+ * pattern) in files whose target shell lacks them, that is, Bash older than
+ * 4.0 (macOS's stock `/bin/bash` is 3.2) and POSIX sh.
+ *
+ * Bash 3.2 rejects the expansion with "bad substitution" at the moment the
+ * word is expanded. The message suggests the portable alternative: pipe the
+ * value through `tr`. The example it shows is for the operator written: all
+ * characters for `^^` and `,,`, the first character for `^` and `,`
+ * (`${v%"${v#?}"}` is the first character and `${v#?}` the rest).
+ *
+ * A pattern form (`${v^^a}`) changes only the characters the pattern matches,
+ * which a plain case-converting `tr` does not reproduce, so it gets a message
+ * that offers no `tr` equivalent.
+ *
+ * What is read: a `ParamExp` whose operator is one of the four case
+ * operators. The report is on the whole expansion.
+ */
+import { UpperAll, UpperFirst, LowerAll, LowerFirst } from 'sh-ast';
+import { createCompatRule } from './create-compat-rule.js';
+/** `tr` arguments that convert to upper case. @internal */
+export const TO_UPPER = "tr '[:lower:]' '[:upper:]'";
+/** `tr` arguments that convert to lower case. @internal */
+export const TO_LOWER = "tr '[:upper:]' '[:lower:]'";
+/** The four case operators, keyed by the parser's operator constant. */
+const CASE_OPERATORS = new Map([
+    [UpperAll, { operator: '^^', all: true, tr: TO_UPPER }],
+    [UpperFirst, { operator: '^', all: false, tr: TO_UPPER }],
+    [LowerAll, { operator: ',,', all: true, tr: TO_LOWER }],
+    [LowerFirst, { operator: ',', all: false, tr: TO_LOWER }],
+]);
+/**
+ * The `tr` replacement shown in the message for `name` under `spec`.
+ *
+ * @internal
+ */
+export function trExample(name, spec) {
+    const whole = `"$${name}"`;
+    return spec.all
+        ? `$(printf '%s' ${whole} | ${spec.tr})`
+        : `$(printf '%s' "\${${name}%"\${${name}#?}"}" | ${spec.tr})"\${${name}#?}"`;
+}
+/**
+ * The `sh/compat/no-case-modification` rule module.
+ *
+ * @internal
+ */
+export const noCaseModification = createCompatRule({
+    name: 'compat/no-case-modification',
+    feature: 'caseModification',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow case-modifying expansions (`${v^^}`, `${v,,}` and variants) when the target shell lacks them',
+        },
+        messages: {
+            caseModification: '`${…{{operator}}}` needs {{required}}, but this file targets {{target}}. Convert the case with `tr` instead, for example {{example}}.',
+            caseModificationPattern: '`${…{{operator}}pattern}` needs {{required}}, but this file targets {{target}}. It changes only the characters the pattern matches, so a plain case-converting `tr` is not equivalent; spell out the matching characters instead (for example `tr a A`).',
+        },
+    },
+    create(context, gate) {
+        return {
+            ParamExp(node) {
+                const { exp } = node;
+                const spec = exp === undefined ? undefined : CASE_OPERATORS.get(exp.op);
+                if (exp === undefined || spec === undefined)
+                    return;
+                const name = node.param?.value ?? 'v';
+                if (exp.word !== undefined) {
+                    context.report({
+                        node,
+                        messageId: 'caseModificationPattern',
+                        data: { ...gate, operator: spec.operator },
+                    });
+                    return;
+                }
+                context.report({
+                    node,
+                    messageId: 'caseModification',
+                    data: { ...gate, operator: spec.operator, example: trExample(name, spec) },
+                });
+            },
+        };
+    },
+});

package/dist/rules/compat/no-coproc.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoCoprocMessageId = 'coproc';
+/**
+ * The `sh/compat/no-coproc` rule module.
+ *
+ * @internal
+ */
+export declare const noCoproc: import("../define-shell-rule.js").ShellRule<[], "coproc">;

package/dist/rules/compat/no-coproc.js

@@ -0,0 +1,47 @@
+/**
+ * `sh/compat/no-coproc`: reports the `coproc` reserved word (a coprocess:
+ * a background command with a pipe pair to the shell) in files whose target
+ * shell lacks it, that is, Bash older than 4.0 (macOS's stock `/bin/bash` is
+ * 3.2) and POSIX sh.
+ *
+ * Bash 3.2 does not know the word, so `coproc cat` runs an external command
+ * named `coproc` and fails with `command not found`. The message suggests the
+ * portable alternative: a named pipe made with `mkfifo`, with the producer
+ * started in the background.
+ *
+ * What is read: Bash's `CoprocClause`. Under `dialect: "posix"` the parser
+ * has no such clause and reads `coproc cat` as an ordinary command, so a
+ * command whose name is `coproc` is reported too.
+ */
+import { createCompatRule } from './create-compat-rule.js';
+/**
+ * The `sh/compat/no-coproc` rule module.
+ *
+ * @internal
+ */
+export const noCoproc = createCompatRule({
+    name: 'compat/no-coproc',
+    feature: 'coproc',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow the `coproc` reserved word when the target shell lacks it',
+        },
+        messages: {
+            coproc: '`coproc` needs {{required}}, but this file targets {{target}}. Use a named pipe instead: create it with `mkfifo`, start the coprocess in the background reading or writing the pipe, and open the pipe from the script.',
+        },
+    },
+    create(context, gate) {
+        const { sourceCode } = context;
+        return {
+            CoprocClause(node) {
+                context.report({ node, messageId: 'coproc', data: { ...gate } });
+            },
+            CallExpr(node) {
+                if (sourceCode.getCommandName(node) === 'coproc') {
+                    context.report({ node, messageId: 'coproc', data: { ...gate } });
+                }
+            },
+        };
+    },
+});

package/dist/rules/compat/no-declare-g.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoDeclareGMessageId = 'declareGlobal' | 'declareGlobalWithAttributes';
+/**
+ * The `sh/compat/no-declare-g` rule module.
+ *
+ * @internal
+ */
+export declare const noDeclareG: import("../define-shell-rule.js").ShellRule<[], NoDeclareGMessageId>;