@eslint-sh/eslint-plugin 0.5.0 → 0.7.0

package/dist/rules/compat/no-source.js

@@ -0,0 +1,103 @@
+/**
+ * `sh/compat/no-source`: reports the `source` builtin in files that target
+ * POSIX sh, where the portable name is the `.` special built-in. Every Bash has
+ * `source`, so this is a POSIX-only gate.
+ *
+ * POSIX section 2.9.1.4 leaves the results of a command named `source`
+ * unspecified. dash has no such command: `source ./lib.sh` fails with `source:
+ * not found` and status 127, and the file is never read. `bash --posix` and
+ * BusyBox ash accept it, so only some POSIX shells show the problem.
+ *
+ * What is read: a command whose effective name is `source`, outside a branch
+ * for one shell (see `./posix-absent-command.ts`).
+ *
+ * A function named `source` anywhere in the file exempts a call that names it
+ * directly, since dash can then run that function; `bash --posix` refuses that
+ * definition, which this rule does not judge. This is a name check across the
+ * file and does not prove the function exists at the call: execution order, a
+ * definition in a branch or subshell, and `unset -f` are not read, so some exempt
+ * calls still fail on dash. A call through a wrapper is never exempt, because
+ * wrappers such as `command`, `env` and `exec` do not run functions.
+ *
+ * The suggestion replaces the word with `.` only where the two read the same
+ * file with the same effect, apart from a file that cannot be read: `.` then
+ * ends the script on a POSIX shell, so a `|| fallback` never runs, and the
+ * suggestion's text says so. The conditions are:
+ *
+ * - The command is written directly, with no wrapper.
+ * - It has no leading `VAR=value`. Such an assignment persists after `.` on a
+ *   POSIX shell, while Bash outside POSIX mode scopes it to the `source`
+ *   command.
+ * - It has exactly one operand. `.` takes one in POSIX, and dash ignores any
+ *   others where `source` would set the positional parameters.
+ * - The operand has a literal `/`. A name without one makes `.` search `PATH`.
+ */
+import { definedFunctionNames } from '../../command-harvest/harvest-commands.js';
+import { childNodes } from '../../language/syntax-view.js';
+import { createCompatRule } from './create-compat-rule.js';
+import { reachableCommandWord } from './posix-absent-command.js';
+/** The builtin this rule gates. */
+const SOURCE = 'source';
+/**
+ * Whether `word` holds a `/` that no expansion can remove: in unquoted or
+ * quoted literal text, whatever its other parts expand to. A `/` inside an
+ * expansion (`${x%/*}`, `$(pwd)`) does not count, so the walk stops at anything
+ * that is not literal text or a double-quoted group.
+ */
+function hasLiteralSlash(word) {
+    return childNodes(word).some((part) => {
+        if (part.type === 'Lit' || part.type === 'SglQuoted')
+            return part.value.includes('/');
+        return part.type === 'DblQuoted' && hasLiteralSlash(part);
+    });
+}
+/** Whether `.` is an exact replacement for this `source` command (see the module comment). */
+function dotIsEquivalent(sourceCode, node) {
+    if (sourceCode.getCommandName(node) !== SOURCE)
+        return false;
+    if (node.assigns.length > 0 || node.args.length !== 2)
+        return false;
+    return hasLiteralSlash(node.args[1]);
+}
+/**
+ * The `sh/compat/no-source` rule module.
+ *
+ * @internal
+ */
+export const noSource = createCompatRule({
+    name: 'compat/no-source',
+    feature: 'sourceCommand',
+    meta: {
+        type: 'problem',
+        hasSuggestions: true,
+        docs: {
+            description: 'Disallow the `source` builtin when the target shell is POSIX sh',
+        },
+        messages: {
+            source: '`source` is not part of {{target}}. dash fails with `source: not found` and the file is never read. Use the `.` special built-in with a path that contains a slash, for example `. ./lib.sh`.',
+            useDot: 'Replace `source` with `.`, which ends the script if the file is missing.',
+        },
+    },
+    create(context, gate) {
+        const { sourceCode } = context;
+        const fileDefinesSource = definedFunctionNames(sourceCode).has(SOURCE);
+        return {
+            CallExpr(node) {
+                const word = reachableCommandWord(sourceCode, node, SOURCE);
+                if (word === undefined)
+                    return;
+                // Only a name written directly can run a function: a wrapper skips it.
+                if (fileDefinesSource && sourceCode.getCommandName(node) === SOURCE)
+                    return;
+                context.report({
+                    node: word,
+                    messageId: 'source',
+                    data: { target: gate.target },
+                    suggest: dotIsEquivalent(sourceCode, node)
+                        ? [{ messageId: 'useDot', fix: (fixer) => fixer.replaceText(word, '.') }]
+                        : [],
+                });
+            },
+        };
+    },
+});

package/dist/rules/compat/no-test-v.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoTestVMessageId = 'testV';
+/**
+ * The `sh/compat/no-test-v` rule module.
+ *
+ * @internal
+ */
+export declare const noTestV: import("../define-shell-rule.js").ShellRule<[], "testV">;

package/dist/rules/compat/no-test-v.js

@@ -0,0 +1,280 @@
+/**
+ * `sh/compat/no-test-v`: reports the `-v name` test (`[[ -v x ]]`,
+ * `test -v x`, `[ -v x ]`) in files whose target shell lacks it, that is,
+ * Bash older than 4.2 (macOS's stock `/bin/bash` is 3.2) and POSIX sh.
+ *
+ * In Bash 4.1 and older, `[[ -v x ]]` is a syntax error, so the whole script
+ * fails to parse, and `test -v x` fails with "unary operator expected". The
+ * message suggests the portable alternative, `[ -n "${x+set}" ]`, which is
+ * true exactly when `x` is set (even to the empty string) and is safe under
+ * `set -u`.
+ *
+ * What is read:
+ *
+ * - inside `[[ … ]]`, the parser's `-v` unary test node;
+ * - for `test` and `[` (after transparent wrappers such as `builtin`), the
+ *   arguments, read the way Bash's `test` reads them: with two arguments a
+ *   leading `-v` is the operator; with three, the middle one is a binary
+ *   operator if it can be one, and `! -v name` negates the test; with four,
+ *   `! …` and `( … )` peel off; anything longer goes through `test`'s own
+ *   precedence parser, where `-v` is the operator only where a primary is
+ *   expected and another argument follows it. So `[ "$x" = -v ]` and
+ *   `[ -n -v ]` do not report. A double-quoted expansion (`"$name"`) is one
+ *   operand whatever its value. Any other argument that is not a static word
+ *   ends the reading, because it may expand to several arguments or none.
+ *
+ * The report is on the `[[` test, or on the `-v` word.
+ */
+import { TsVarSet } from 'sh-ast';
+import { DEFAULT_TRANSPARENT_WRAPPERS } from 'sh-ast/analyze';
+import { BUILTIN_WRAPPER } from '../transparent-wrappers.js';
+import { createCompatRule } from './create-compat-rule.js';
+/**
+ * The wrappers followed to find the `test` command: `sh-ast/analyze`'s
+ * defaults (which include `command`) plus Bash's `builtin`.
+ */
+const TRANSPARENT_WRAPPERS = [
+    ...DEFAULT_TRANSPARENT_WRAPPERS,
+    BUILTIN_WRAPPER,
+];
+/** The commands that are Bash's `test` builtin. */
+const TEST_COMMANDS = new Set(['test', '[']);
+/** Bash's `test` binary operators (`test_binop`), without `-a` and `-o`. */
+const BINARY_OPERATORS = new Set([
+    '=',
+    '==',
+    '!=',
+    '<',
+    '>',
+    '-eq',
+    '-ne',
+    '-lt',
+    '-le',
+    '-gt',
+    '-ge',
+    '-nt',
+    '-ot',
+    '-ef',
+]);
+/** Bash's `test` unary operators (`test_unop`). */
+const UNARY_OPERATORS = new Set([
+    '-a',
+    '-b',
+    '-c',
+    '-d',
+    '-e',
+    '-f',
+    '-g',
+    '-h',
+    '-k',
+    '-n',
+    '-o',
+    '-p',
+    '-r',
+    '-s',
+    '-t',
+    '-u',
+    '-v',
+    '-w',
+    '-x',
+    '-z',
+    '-G',
+    '-L',
+    '-O',
+    '-S',
+    '-N',
+    '-R',
+]);
+/**
+ * What a double-quoted, non-static argument stands for while reading `test`'s
+ * arguments: an operand that is never an operator. A NUL cannot occur in a
+ * shell word, so no real argument equals it.
+ */
+const QUOTED_OPERAND = '\0operand';
+/** A shell variable name, optionally with an array subscript. */
+const VARIABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]*(?:\[[^\]]*\])?$/u;
+/**
+ * The indices of the arguments in `args` that Bash's `test` reads as the
+ * `-v` operator. `args` are the static texts after the command name (and
+ * without a closing `]`); reading stops at the first `null`.
+ */
+function variableTestIndices(args) {
+    const end = args.indexOf(null);
+    const argv = (end === -1 ? args : args.slice(0, end));
+    const found = [];
+    /** `test`'s two-argument rule, at offset `at`. */
+    function twoArguments(at) {
+        if (argv[at] === '-v')
+            found.push(at);
+    }
+    /** `test`'s three-argument rule, at offset `at`. */
+    function threeArguments(at) {
+        const middle = argv[at + 1];
+        if (BINARY_OPERATORS.has(middle) || middle === '-a' || middle === '-o')
+            return true;
+        if (argv[at] === '!') {
+            twoArguments(at + 1);
+            return true;
+        }
+        return argv[at] === '(' && argv[at + 2] === ')';
+    }
+    /** `test`'s precedence parser over every argument (`expr` in Bash's test.c). */
+    function expression() {
+        let pos = 0;
+        const term = () => {
+            if (pos >= argv.length)
+                return;
+            const word = argv[pos];
+            if (word === '!') {
+                pos++;
+                term();
+                return;
+            }
+            if (word === '(') {
+                pos++;
+                or();
+                if (argv[pos] === ')')
+                    pos++;
+                return;
+            }
+            if (pos + 3 <= argv.length && BINARY_OPERATORS.has(argv[pos + 1])) {
+                pos += 3;
+                return;
+            }
+            if (UNARY_OPERATORS.has(word) && pos + 1 < argv.length) {
+                if (word === '-v')
+                    found.push(pos);
+                pos += 2;
+                return;
+            }
+            pos++;
+        };
+        const and = () => {
+            term();
+            while (argv[pos] === '-a') {
+                pos++;
+                term();
+            }
+        };
+        const or = () => {
+            and();
+            while (argv[pos] === '-o') {
+                pos++;
+                and();
+            }
+        };
+        while (pos < argv.length) {
+            const before = pos;
+            or();
+            if (pos === before)
+                pos++;
+        }
+    }
+    switch (argv.length) {
+        case 0:
+        case 1:
+            break;
+        case 2:
+            if (argv[0] !== '!')
+                twoArguments(0);
+            break;
+        case 3:
+            if (!threeArguments(0))
+                expression();
+            break;
+        case 4:
+            if (argv[0] === '!') {
+                if (!threeArguments(1))
+                    expression();
+            }
+            else if (argv[0] === '(' && argv[3] === ')') {
+                if (argv[1] !== '!')
+                    twoArguments(1);
+            }
+            else {
+                expression();
+            }
+            break;
+        default:
+            expression();
+    }
+    return found;
+}
+/**
+ * The `sh/compat/no-test-v` rule module.
+ *
+ * @internal
+ */
+export const noTestV = createCompatRule({
+    name: 'compat/no-test-v',
+    feature: 'testVariableSet',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow the `-v name` test (`[[ -v x ]]`, `test -v x`) when the target shell lacks it',
+        },
+        messages: {
+            testV: '`-v {{name}}` needs {{required}}, but this file targets {{target}}. Test whether the variable is set with `[ -n "${{{name}}+set}" ]` instead.',
+        },
+    },
+    create(context, gate) {
+        const { sourceCode } = context;
+        /** The variable name shown in the message for `operand`. */
+        function nameOf(operand) {
+            const text = operand?.type === 'Word' ? sourceCode.resolveWordText(operand) : null;
+            return text !== null && VARIABLE_NAME.test(text) ? text : 'name';
+        }
+        /**
+         * The argument `word` gives `test`: its static text; a stand-in operand
+         * for a word that is one double-quoted string, which always makes exactly
+         * one argument whatever it expands to; or `null` for any other word, which
+         * may split into several arguments or none.
+         */
+        function argumentText(word) {
+            const text = sourceCode.resolveWordText(word);
+            if (text !== null)
+                return text;
+            if (word.parts.length === 1 && word.parts[0].type === 'DblQuoted') {
+                return QUOTED_OPERAND;
+            }
+            return null;
+        }
+        return {
+            UnaryTest(node) {
+                if (node.op !== TsVarSet)
+                    return;
+                context.report({
+                    node,
+                    messageId: 'testV',
+                    data: { ...gate, name: nameOf(node.x) },
+                });
+            },
+            CallExpr(node) {
+                const invoked = sourceCode.resolveInvokedCommand(node, {
+                    transparentWrappers: TRANSPARENT_WRAPPERS,
+                });
+                if (invoked?.effective.static !== true)
+                    return;
+                const command = invoked.effective.text;
+                if (!TEST_COMMANDS.has(command))
+                    return;
+                // `chainIndices` index `node.args` directly, so slice before filtering.
+                let words = node.args.slice((invoked.chainIndices.at(-1) ?? 0) + 1);
+                if (command === '[') {
+                    const last = words.at(-1);
+                    if (last === undefined || sourceCode.resolveWordText(last) !== ']')
+                        return;
+                    words = words.slice(0, -1);
+                }
+                const texts = words.map((word) => argumentText(word));
+                for (const index of variableTestIndices(texts)) {
+                    context.report({
+                        node: words[index],
+                        messageId: 'testV',
+                        data: { ...gate, name: nameOf(words[index + 1]) },
+                    });
+                }
+            },
+        };
+    },
+});

package/dist/rules/compat/no-unicode-escape.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Message ids this rule reports with: `unicodeEscape` when the target leaves
+ * the escape undecoded, `unicodeEscapeLatin1` when it decodes it to a
+ * Latin-1 byte.
+ *
+ * @internal
+ */
+export type NoUnicodeEscapeMessageId = 'unicodeEscape' | 'unicodeEscapeLatin1';
+/**
+ * The `sh/compat/no-unicode-escape` rule module.
+ *
+ * @internal
+ */
+export declare const noUnicodeEscape: import("../define-shell-rule.js").ShellRule<[], NoUnicodeEscapeMessageId>;

package/dist/rules/compat/no-unicode-escape.js

@@ -0,0 +1,120 @@
+/**
+ * `sh/compat/no-unicode-escape`: reports the `\uXXXX` and `\UXXXXXXXX`
+ * escapes in a `$'…'` string in files whose target shell does not decode
+ * them to UTF-8. The minimum Bash depends on the code point:
+ *
+ * - Bash 4.1 and older leave every such escape as literal text, with no
+ *   error: Bash 4.2 is the first release that decodes them;
+ * - the Bash 4.2 release writes a code point from U+0080 to U+00FF as a
+ *   single Latin-1 byte even in a UTF-8 locale (observed: `e9` for U+00E9,
+ *   where UTF-8 is `c3 a9`), while every other code point is UTF-8. Bash 4.3
+ *   is the first release that writes them all as UTF-8.
+ *
+ * The message suggests the portable alternative: write the character's
+ * UTF-8 bytes as octal escapes, which every Bash decodes in `$'…'` (for
+ * example `$'\303\251'` for U+00E9). Under `dialect: "posix"` the parser
+ * reads `$'…'` as a literal `$` followed by an ordinary single-quoted string,
+ * as dash does, so there is no `$'…'` string to report; the gate's
+ * `posix: false` records that POSIX sh does not decode these escapes.
+ *
+ * What is read: a `$'…'` string's text, scanned as Bash decodes it: `\\` is a
+ * backslash, `\cX` is one control character (so in `\cu00e9` the `u`
+ * belongs to `\c`), and `\u` takes one to four hex digits, `\U` one to
+ * eight. A `\u` with no hex digit after it is literal text. Plain `'…'`
+ * and `"…"` strings do not decode escapes and are not read. The report is on
+ * the whole string, once per string.
+ */
+import { createMultiFeatureCompatRule } from './create-compat-rule.js';
+/** The backslash that starts every escape. */
+const BACKSLASH = '\\';
+/** The unicode escapes of a `$'…'` string's text, in order. */
+function unicodeEscapes(text) {
+    const found = [];
+    let index = 0;
+    while (index < text.length) {
+        if (text[index] !== BACKSLASH) {
+            index++;
+            continue;
+        }
+        const letter = text[index + 1];
+        if (letter === 'c') {
+            index += 3;
+            continue;
+        }
+        const maxDigits = letter === 'u' ? 4 : letter === 'U' ? 8 : 0;
+        if (maxDigits === 0) {
+            index += 2;
+            continue;
+        }
+        const digits = /^[0-9A-Fa-f]+/u.exec(text.slice(index + 2, index + 2 + maxDigits))?.[0];
+        if (digits === undefined) {
+            index += 2;
+            continue;
+        }
+        const length = 2 + digits.length;
+        found.push({ text: text.slice(index, index + length), codePoint: parseInt(digits, 16) });
+        index += length;
+    }
+    return found;
+}
+/** Whether a code point is one the Bash 4.2 release writes as a Latin-1 byte. */
+function isLatin1Upper(codePoint) {
+    return codePoint >= 0x80 && codePoint <= 0xff;
+}
+/**
+ * The UTF-8 bytes of `codePoint` as octal escapes (`\303\251`), or
+ * `undefined` for a value that is not a Unicode scalar value.
+ */
+function octalBytes(codePoint) {
+    if (codePoint > 0x10ffff || (codePoint >= 0xd800 && codePoint <= 0xdfff))
+        return undefined;
+    const bytes = new TextEncoder().encode(String.fromCodePoint(codePoint));
+    return [...bytes].map((byte) => BACKSLASH + byte.toString(8).padStart(3, '0')).join('');
+}
+/**
+ * The `sh/compat/no-unicode-escape` rule module.
+ *
+ * @internal
+ */
+export const noUnicodeEscape = createMultiFeatureCompatRule({
+    name: 'compat/no-unicode-escape',
+    features: ['unicodeEscape', 'unicodeEscapeLatin1'],
+    meta: {
+        type: 'problem',
+        docs: {
+            description: "Disallow `\\u`/`\\U` escapes in `$'…'` strings when the target shell does not decode them to UTF-8",
+        },
+        messages: {
+            unicodeEscape: "`{{escape}}` in `$'…'` needs {{required}}, but this file targets {{target}}, which leaves it as literal text. Write the UTF-8 bytes as octal escapes instead, for example `$'{{octal}}'`.",
+            unicodeEscapeLatin1: "`{{escape}}` in `$'…'` needs {{required}}, but this file targets {{target}}, which writes U+0080 to U+00FF as a single Latin-1 byte, not UTF-8. Write the UTF-8 bytes as octal escapes instead, for example `$'{{octal}}'`.",
+        },
+    },
+    create(context, gates) {
+        const escapeGate = gates.get('unicodeEscape');
+        const latin1Gate = gates.get('unicodeEscapeLatin1');
+        return {
+            SglQuoted(node) {
+                if (!node.dollar)
+                    return;
+                const escapes = unicodeEscapes(node.value);
+                const latin1 = escapes.find((escape) => isLatin1Upper(escape.codePoint));
+                // The escape the message names, and the gate it needs: a Latin-1
+                // escape needs the newer release, so it decides when present.
+                const shown = latin1 ?? escapes.at(0);
+                const gate = latin1 === undefined ? escapeGate : latin1Gate;
+                if (shown === undefined || gate === undefined)
+                    return;
+                const messageId = escapeGate === undefined ? 'unicodeEscapeLatin1' : 'unicodeEscape';
+                context.report({
+                    node,
+                    messageId,
+                    data: {
+                        ...gate,
+                        escape: shown.text,
+                        octal: octalBytes(shown.codePoint) ?? '\\NNN',
+                    },
+                });
+            },
+        };
+    },
+});

package/dist/rules/compat/no-wait-n.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Message ids this rule reports with.
+ *
+ * @internal
+ */
+export type NoWaitNMessageId = 'waitNext';
+/**
+ * The `sh/compat/no-wait-n` rule module.
+ *
+ * @internal
+ */
+export declare const noWaitN: import("../define-shell-rule.js").ShellRule<[], "waitNext">;

package/dist/rules/compat/no-wait-n.js

@@ -0,0 +1,73 @@
+/**
+ * `sh/compat/no-wait-n`: reports `wait -n` in files whose target shell lacks
+ * it, that is, Bash older than 4.3 (macOS's stock `/bin/bash` is 3.2) and
+ * POSIX sh.
+ *
+ * Bash 4.2 and older reject `-n` as an invalid option and return 2 at once,
+ * so a job pool that throttles itself with `wait -n` stops waiting and runs
+ * every job together. The message suggests the portable alternative: keep
+ * each job's `$!` and wait for one job at a time with `wait "$pid"`, which
+ * returns that job's exit status.
+ *
+ * What is read: a `wait` command (after transparent wrappers such as
+ * `builtin`) whose option words, up to the first operand or `--`, include a
+ * cluster containing `n` (`-n`, `-fn`). The value after a `-p` cluster
+ * (Bash 5.1's `wait -p var`) is its operand, not an option. The report is on
+ * the option word.
+ */
+import { DEFAULT_TRANSPARENT_WRAPPERS } from 'sh-ast/analyze';
+import { BUILTIN_WRAPPER } from '../transparent-wrappers.js';
+import { createCompatRule } from './create-compat-rule.js';
+/**
+ * The wrappers followed to find the `wait` command: `sh-ast/analyze`'s
+ * defaults (which include `command`) plus Bash's `builtin`.
+ */
+const TRANSPARENT_WRAPPERS = [
+    ...DEFAULT_TRANSPARENT_WRAPPERS,
+    BUILTIN_WRAPPER,
+];
+/** An option cluster of `wait`: letters after a single `-`. */
+const OPTION_CLUSTER = /^-[A-Za-z]+$/u;
+/**
+ * The `sh/compat/no-wait-n` rule module.
+ *
+ * @internal
+ */
+export const noWaitN = createCompatRule({
+    name: 'compat/no-wait-n',
+    feature: 'waitNext',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow `wait -n` when the target shell lacks it',
+        },
+        messages: {
+            waitNext: '`wait -n` needs {{required}}, but this file targets {{target}}. Wait for one job at a time instead: keep each job\'s `$!` and run `wait "$pid"`, which returns that job\'s exit status.',
+        },
+    },
+    create(context, gate) {
+        const { sourceCode } = context;
+        return {
+            CallExpr(node) {
+                const invoked = sourceCode.resolveInvokedCommand(node, {
+                    transparentWrappers: TRANSPARENT_WRAPPERS,
+                });
+                if (invoked?.effective.static !== true || invoked.effective.text !== 'wait')
+                    return;
+                // `chainIndices` index `node.args` directly, so slice before filtering.
+                const words = node.args.slice((invoked.chainIndices.at(-1) ?? 0) + 1);
+                for (let index = 0; index < words.length; index++) {
+                    const text = sourceCode.resolveWordText(words[index]);
+                    if (text === null || !OPTION_CLUSTER.test(text))
+                        return;
+                    if (text.includes('n')) {
+                        context.report({ node: words[index], messageId: 'waitNext', data: { ...gate } });
+                        return;
+                    }
+                    if (text.includes('p'))
+                        index++;
+                }
+            },
+        };
+    },
+});

package/dist/rules/compat/operator-range.d.ts

@@ -0,0 +1,10 @@
+import type { ShellSourceCode } from '../../language/shell-source-code.js';
+import type { ShellNode } from '../../language/syntax-view.js';
+/**
+ * The `[start, end)` UTF-16 range of `operator` at `node`'s `OpPos`, or
+ * `undefined` when the record has no valid `OpPos` or the text there is not
+ * `operator`.
+ *
+ * @internal
+ */
+export declare function operatorRange(sourceCode: ShellSourceCode, node: ShellNode, operator: string): [number, number] | undefined;

package/dist/rules/compat/operator-range.js

@@ -0,0 +1,15 @@
+/**
+ * The `[start, end)` UTF-16 range of `operator` at `node`'s `OpPos`, or
+ * `undefined` when the record has no valid `OpPos` or the text there is not
+ * `operator`.
+ *
+ * @internal
+ */
+export function operatorRange(sourceCode, node, operator) {
+    const syntax = sourceCode.getSyntax(node);
+    const pos = syntax?.OpPos;
+    if (pos?.IsValid !== true)
+        return undefined;
+    const start = sourceCode.getIndexFromSyntaxPos(pos);
+    return sourceCode.text.startsWith(operator, start) ? [start, start + operator.length] : undefined;
+}

package/dist/rules/compat/posix-absent-command.d.ts

@@ -0,0 +1,12 @@
+import type { ShellSourceCode } from '../../language/shell-source-code.js';
+import type { ShellNode, ShellNodeOf } from '../../language/syntax-view.js';
+/**
+ * The word that names `command` in `node`, when `command` is what `node`
+ * effectively runs and a shell without it can reach `node` (see the module
+ * comment), or `undefined` otherwise. Reporting this word rather than the whole
+ * command matters for `[[`: the parser ends that command at the first `&&` or
+ * `||`, so the node would cover an arbitrary part of the expression.
+ *
+ * @internal
+ */
+export declare function reachableCommandWord(sourceCode: ShellSourceCode, node: ShellNodeOf<'CallExpr'>, command: string): ShellNode | undefined;