@eslint-sh/eslint-plugin 0.6.0 → 0.8.0

package/dist/rules/compat/version-gates.d.ts

@@ -4,7 +4,7 @@
  *
  * A gate is data: a feature name mapped to the oldest Bash release that has
  * it and whether POSIX sh has it. A new gate is a new row here, not new
- * decision logic in a rule. The semantics of `languageOptions.shellVersion`
+ * decision logic in a rule. The semantics of `languageOptions.minBashVersion`
  * and `languageOptions.dialect` for gating are defined once, by
  * {@link isFeatureAvailable}, and documented for users in `docs/compat.md`.
  *
@@ -27,7 +27,7 @@ import type { ShellLanguageOptions } from '../../language/shell-language-options
  *
  * @internal
  */
-export type CompatFeature = 'appendAllRedirect' | 'associativeArrays' | 'caseAttributes' | 'caseFallthrough' | 'caseModification' | 'coproc' | 'declareGlobal' | 'doubleBracket' | 'epochVariables' | 'fdVariable' | 'globstar' | 'lastpipe' | 'letCommand' | 'mapfile' | 'nameref' | 'negativeArrayIndex' | 'nounsetEmptyArray' | 'parameterTransformation' | 'parameterTransformationCase' | 'parameterTransformationKeys' | 'parameterTransformationQuotedKeys' | 'pipeAll' | 'printfTimeFormat' | 'sourceCommand' | 'testVariableSet' | 'unicodeEscape' | 'unicodeEscapeLatin1' | 'waitNext';
+export type CompatFeature = 'appendAllRedirect' | 'associativeArrays' | 'braceSequencePaddingStep' | 'caseAttributes' | 'caseFallthrough' | 'caseModification' | 'coproc' | 'declareGlobal' | 'doubleBracket' | 'epochVariables' | 'fdVariable' | 'globstar' | 'lastpipe' | 'letCommand' | 'mapfile' | 'nameref' | 'negativeArrayIndex' | 'nounsetEmptyArray' | 'parameterTransformation' | 'parameterTransformationCase' | 'parameterTransformationKeys' | 'parameterTransformationQuotedKeys' | 'pipeAll' | 'printfTimeFormat' | 'sourceCommand' | 'testVariableSet' | 'unicodeEscape' | 'unicodeEscapeLatin1' | 'waitNext';
 /**
  * The two `languageOptions` fields gating reads. Both the raw and the
  * normalized options satisfy it; an unset `dialect` means `"bash"`, as it
@@ -35,28 +35,28 @@ export type CompatFeature = 'appendAllRedirect' | 'associativeArrays' | 'caseAtt
  *
  * @internal
  */
-export type GateLanguageOptions = Pick<ShellLanguageOptions, 'dialect' | 'shellVersion'>;
+export type GateLanguageOptions = Pick<ShellLanguageOptions, 'dialect' | 'minBashVersion'>;
 /**
  * Whether `feature` is available to a file linted with `languageOptions`.
  *
  * - `dialect: "posix"`: available only when the gate's `posix` is `true`,
- *   at any `shellVersion` (a Bash-only feature is never available).
- * - `dialect: "bash"` (the default) or `"bats"`: an unset `shellVersion`
- *   means the newest Bash, so every Bash feature is available. A set
- *   `shellVersion` makes the feature available when it is the gate's `bash`
+ *   regardless of Bash releases (a Bash-only feature is never available).
+ * - `dialect: "bash"` (the default) or `"bats"`: an unset `minBashVersion`
+ *   means no Bash version constraint, so every Bash feature is available. A set
+ *   `minBashVersion` makes the feature available when it is the gate's `bash`
  *   minimum or newer, comparing major then minor numerically (`"4"` is
  *   `4.0`; `"3.10"` is newer than `"3.2"`). A `null` minimum is available at
  *   every version.
  * - `dialect: "mksh"` or `"zsh"`: the table carries no data for these
- *   shells, and their `shellVersion` numbers their own releases, not Bash's,
- *   so no gate applies and every feature is available.
+ *   shells. Config validation rejects `minBashVersion` for them; no Bash
+ *   gate applies and every feature is available.
  *
  * @internal
  */
 export declare function isFeatureAvailable(feature: CompatFeature, languageOptions: GateLanguageOptions): boolean;
 /**
  * Human-readable words for a gate's report: what the feature needs
- * (`required`, such as `bash 4.0 or newer`) and what the file targets
+ * (`required`, such as `bash 4.0 or newer`) and what the file must support
  * (`target`, such as `bash 3.2` or `POSIX sh`). Compat rule messages
  * interpolate both as `{{required}}` and `{{target}}`.
  *

package/dist/rules/compat/version-gates.js

@@ -11,6 +11,14 @@ const FEATURE_GATES = Object.freeze({
     appendAllRedirect: Object.freeze({ bash: '4.0', posix: false }),
     /** `declare -A` / `typeset -A`: Bash 4.0 NEWS, "associative arrays". */
     associativeArrays: Object.freeze({ bash: '4.0', posix: false }),
+    /**
+     * Zero-padded (`{01..10}`) and stepped (`{1..10..2}`, `{a..e..2}`) brace
+     * sequences: Bash 4.0 NEWS (brace expansion gained zero-padding and an
+     * increment). Bash 3.2 expands the padded form without the padding and
+     * leaves the stepped form as a literal word; POSIX sh has no brace
+     * expansion.
+     */
+    braceSequencePaddingStep: Object.freeze({ bash: '4.0', posix: false }),
     /**
      * The case-modifying expansions `${v^}`, `${v^^}`, `${v,}`, `${v,,}`: Bash
      * 4.0 NEWS, "new case-modifying word expansions".
@@ -143,7 +151,7 @@ function compareVersions(a, b) {
     return a[0] !== b[0] ? a[0] - b[0] : a[1] - b[1];
 }
 /**
- * The dialects whose `shellVersion` is a Bash version. `bats` test files run
+ * The dialects whose `minBashVersion` is a Bash version. `bats` test files run
  * under Bash, so they are gated exactly like `bash` files.
  */
 const BASH_DIALECTS = new Set(['bash', 'bats']);
@@ -151,16 +159,16 @@ const BASH_DIALECTS = new Set(['bash', 'bats']);
  * Whether `feature` is available to a file linted with `languageOptions`.
  *
  * - `dialect: "posix"`: available only when the gate's `posix` is `true`,
- *   at any `shellVersion` (a Bash-only feature is never available).
- * - `dialect: "bash"` (the default) or `"bats"`: an unset `shellVersion`
- *   means the newest Bash, so every Bash feature is available. A set
- *   `shellVersion` makes the feature available when it is the gate's `bash`
+ *   regardless of Bash releases (a Bash-only feature is never available).
+ * - `dialect: "bash"` (the default) or `"bats"`: an unset `minBashVersion`
+ *   means no Bash version constraint, so every Bash feature is available. A set
+ *   `minBashVersion` makes the feature available when it is the gate's `bash`
  *   minimum or newer, comparing major then minor numerically (`"4"` is
  *   `4.0`; `"3.10"` is newer than `"3.2"`). A `null` minimum is available at
  *   every version.
  * - `dialect: "mksh"` or `"zsh"`: the table carries no data for these
- *   shells, and their `shellVersion` numbers their own releases, not Bash's,
- *   so no gate applies and every feature is available.
+ *   shells. Config validation rejects `minBashVersion` for them; no Bash
+ *   gate applies and every feature is available.
  *
  * @internal
  */
@@ -171,14 +179,14 @@ export function isFeatureAvailable(feature, languageOptions) {
         return gate.posix;
     if (!BASH_DIALECTS.has(dialect))
         return true;
-    const { shellVersion } = languageOptions;
-    if (shellVersion === undefined || gate.bash === null)
+    const { minBashVersion } = languageOptions;
+    if (minBashVersion === undefined || gate.bash === null)
         return true;
-    const target = parseVersion(shellVersion);
+    const floor = parseVersion(minBashVersion);
     const minimum = parseVersion(gate.bash);
-    if (target === undefined || minimum === undefined)
+    if (floor === undefined || minimum === undefined)
         return true;
-    return compareVersions(target, minimum) >= 0;
+    return compareVersions(floor, minimum) >= 0;
 }
 /**
  * Describes why `feature` is unavailable under `languageOptions`, for a
@@ -192,6 +200,6 @@ export function describeGate(feature, languageOptions) {
     const required = gate.bash === null ? 'bash' : `bash ${gate.bash} or newer`;
     const target = (languageOptions.dialect ?? 'bash') === 'posix'
         ? 'POSIX sh'
-        : `bash ${languageOptions.shellVersion ?? ''}`.trim();
+        : `bash ${languageOptions.minBashVersion ?? ''}`.trim();
     return { required, target };
 }

package/dist/rules/create-wrapper-rule.js

@@ -37,6 +37,7 @@
  * this analysis and are out of scope.
  */
 import { DEFAULT_TRANSPARENT_WRAPPERS } from 'sh-ast/analyze';
+import { resolveTransparentWrappers } from './resolve-transparent-wrappers.js';
 import { definedFunctionNames } from '../command-harvest/harvest-commands.js';
 import { createRule, packageDocsUrl } from './create-rule.js';
 /**
@@ -187,12 +188,13 @@ function staticText(word) {
  * Resolves `site`'s chain through `compiled`'s wrapper table, following a
  * wrapper invoked by path as the wrapper it names.
  *
- * `resolveArgv0` matches wrapper names exactly, so a path to a wrapper
- * (`/usr/local/bin/retry`) ends the chain as if it were the command run. When
- * the chain ends at a static word with a slash whose basename names a table
- * entry, the site is resolved again with that entry also recognized under the
+ * `resolveArgv0` follows absolute wrapper paths directly. Relative wrapper
+ * paths also count for this policy: when the chain ends at a static word
+ * with a slash whose basename names a table
+ * utility entry, the site is resolved again with that entry also recognized under the
  * exact path text, so its options and wrapped command are located by the
- * same analysis. Each pass adds one new name drawn from the site's own argv,
+ * same analysis. Shell builtin entries require exact names and never gain
+ * path spellings from this policy. Each pass adds one new name drawn from the site's own argv,
  * so the loop ends.
  */
 function resolveChain(compiled, site) {
@@ -202,7 +204,7 @@ function resolveChain(compiled, site) {
         const last = staticText(resolution.chain.at(-1));
         if (last === null || table.some((spec) => spec.names.includes(last)))
             return resolution;
-        const spec = compiled.transparentWrappers.find((entry) => matchName(last, new Set(entry.names)) !== null);
+        const spec = compiled.transparentWrappers.find((entry) => entry.shellBuiltin !== true && matchName(last, new Set(entry.names)) !== null);
         if (spec === undefined)
             return resolution;
         table = [{ ...spec, names: [last] }, ...table];
@@ -365,7 +367,10 @@ export function buildWrapperRule(config) {
             schema: [],
             messages: WRAPPER_RULE_MESSAGES,
         },
-        create: (context) => wrapperRuleListeners(compiled, context),
+        create: (context) => wrapperRuleListeners({
+            ...compiled,
+            transparentWrappers: resolveTransparentWrappers(context, compiled.transparentWrappers),
+        }, context),
     });
 }
 /**

package/dist/rules/index.js

@@ -1,5 +1,6 @@
 import { noAppendAllRedirect } from './compat/no-append-all-redirect.js';
 import { noAssociativeArrays } from './compat/no-associative-arrays.js';
+import { noBraceSequencePaddingStep } from './compat/no-brace-sequence-padding-step.js';
 import { noCaseAttributes } from './compat/no-case-attributes.js';
 import { noCaseFallthrough } from './compat/no-case-fallthrough.js';
 import { noCaseModification } from './compat/no-case-modification.js';
@@ -47,6 +48,7 @@ import { shebangMatchesDialect } from './shebang-matches-dialect.js';
 export const rules = {
     'compat/no-append-all-redirect': noAppendAllRedirect,
     'compat/no-associative-arrays': noAssociativeArrays,
+    'compat/no-brace-sequence-padding-step': noBraceSequencePaddingStep,
     'compat/no-case-attributes': noCaseAttributes,
     'compat/no-case-fallthrough': noCaseFallthrough,
     'compat/no-case-modification': noCaseModification,

package/dist/rules/no-dynamic-invocation.d.ts

@@ -18,14 +18,6 @@ export interface NoDynamicInvocationOptions {
      * `dynamicInvocation`. Embedded commands still report.
      */
     readonly allowInFunctions?: readonly string[];
-    /**
-     * Command names to treat as transparent wrappers, in addition to the
-     * built-in list: the word after one is the command that runs. Each is
-     * followed by name only, with no options of its own, so a flag after it
-     * makes the effective command unknown. A name already in the built-in list
-     * keeps its built-in option handling.
-     */
-    readonly allowWrappers?: readonly string[];
 }
 /**
  * The `sh/no-dynamic-invocation` rule module.

package/dist/rules/no-dynamic-invocation.js

@@ -22,7 +22,7 @@
  *   reports as `dynamicInvocation`.
  * - The wrappers followed are `sh-ast/analyze`'s defaults, Bash's `builtin`,
  *   shells invoked as commands (so `bash -c` is an embedded command and
- *   `bash script.sh` runs `script.sh`), and the names in `allowWrappers`.
+ *   `bash script.sh` runs `script.sh`), and the shared project wrapper facts.
  *
  * The analysis is syntactic by design: `cmd=ls; "$cmd"` reports, because
  * resolving it would need dataflow. Aliases need no handling: they are not
@@ -31,16 +31,12 @@
  * command is a human decision.
  */
 import { DEFAULT_TRANSPARENT_WRAPPERS } from 'sh-ast/analyze';
+import { resolveTransparentWrappers } from './resolve-transparent-wrappers.js';
 import { createRule } from './create-rule.js';
 import { BUILTIN_WRAPPER, SHELL_WRAPPER } from './transparent-wrappers.js';
 /** The registry name of this rule (`sh/no-dynamic-invocation` in a user's config). */
 const RULE_NAME = 'no-dynamic-invocation';
-/**
- * The wrappers every invocation is followed through before any configured in
- * `allowWrappers`: `sh-ast/analyze`'s defaults, then Bash's `builtin`, then
- * shells invoked as commands. `resolveArgv0` uses the first entry whose name
- * matches, so the built-in entries take precedence over a user's.
- */
+/** Default scope for dynamic invocations, including builtin and shell entrypoints. */
 const BUILT_IN_WRAPPERS = [
     ...DEFAULT_TRANSPARENT_WRAPPERS,
     BUILTIN_WRAPPER,
@@ -78,12 +74,11 @@ export const noDynamicInvocation = createRule({
                 type: 'object',
                 properties: {
                     allowInFunctions: NAME_LIST_SCHEMA,
-                    allowWrappers: NAME_LIST_SCHEMA,
                 },
                 additionalProperties: false,
             },
         ],
-        defaultOptions: [{ allowInFunctions: [], allowWrappers: [] }],
+        defaultOptions: [{ allowInFunctions: [] }],
         messages: {
             dynamicInvocation: 'The command this runs is not known until run time, so the script cannot be statically reviewed. Name the command with a literal word instead.',
             embeddedCommand: 'This runs shell code embedded in a string, which cannot be statically reviewed. Write the commands directly instead.',
@@ -91,13 +86,10 @@ export const noDynamicInvocation = createRule({
     },
     create(context) {
         const { sourceCode } = context;
-        // `defaultOptions` guarantees the options object; either list may still be omitted in it.
-        const [{ allowInFunctions = [], allowWrappers = [] }] = context.options;
+        // The options object exists by default; its dispatcher list may still be omitted.
+        const [{ allowInFunctions = [] }] = context.options;
         const dispatchers = new Set(allowInFunctions);
-        const transparentWrappers = [
-            ...BUILT_IN_WRAPPERS,
-            ...allowWrappers.map((name) => ({ names: [name] })),
-        ];
+        const transparentWrappers = resolveTransparentWrappers(context, BUILT_IN_WRAPPERS);
         return {
             File() {
                 for (const site of sourceCode.getCommandSites()) {

package/dist/rules/no-eval.js

@@ -25,6 +25,7 @@
  * suggestion, because no mechanical rewrite of `eval` preserves behavior.
  */
 import { DEFAULT_TRANSPARENT_WRAPPERS } from 'sh-ast/analyze';
+import { resolveTransparentWrappers } from './resolve-transparent-wrappers.js';
 import { createRule } from './create-rule.js';
 import { BUILTIN_WRAPPER } from './transparent-wrappers.js';
 /** The registry name of this rule (`sh/no-eval` in a user's config). */
@@ -60,10 +61,11 @@ export const noEval = createRule({
     },
     create(context) {
         const { sourceCode } = context;
+        const transparentWrappers = resolveTransparentWrappers(context, TRANSPARENT_WRAPPERS);
         return {
             CallExpr(node) {
                 const invoked = sourceCode.resolveInvokedCommand(node, {
-                    transparentWrappers: TRANSPARENT_WRAPPERS,
+                    transparentWrappers,
                 });
                 if (!invoked?.effective.static) {
                     return;

package/dist/rules/no-masked-exit-status.js

@@ -15,7 +15,8 @@
  * Real shells give a plain assignment the status of a substitution in any of
  * those places, so the declaration hides it from all of them. A process
  * substitution (`<(…)`) is not looked into: it expands to a path. The builtin
- * is also read behind the transparent wrappers `builtin` and `command`. One
+ * is also read behind the bare in-process wrappers `builtin` and `command`;
+ * paths to external executables are not declaration wrappers. One
  * report is made per operand, on the operand. An array value
  * (`local -a a=($(cmd))`) is not reported: shellcheck 0.11.0 does not report
  * it either, and a status-bearing scalar is the construct the rule exists for.
@@ -84,6 +85,7 @@
  * split into the declaration, the assignment, then `readonly <names>`.
  */
 import { DEFAULT_TRANSPARENT_WRAPPERS } from 'sh-ast/analyze';
+import { resolveTransparentWrappers } from './resolve-transparent-wrappers.js';
 import { childNodes } from '../language/syntax-view.js';
 import { lineBreakOf } from '../language/line-breaks.js';
 import { createRule } from './create-rule.js';
@@ -218,10 +220,13 @@ function collectFunctionNames(node, into) {
  * earlier, so such code can see a different variable afterwards. A function
  * defined in another file cannot be seen and is not detected.
  */
-function runsUnseenCode(node, functionNames, sourceCode) {
+function runsUnseenCode(node, functionNames, sourceCode, transparentWrappers) {
     if (node.type === 'CallExpr' && node.args.length > 0) {
+        // This check names the launched program; opaque child-interpreter text
+        // does not turn its program identity into dynamic lookup.
         const invoked = sourceCode.resolveInvokedCommand(node, {
-            transparentWrappers: TRANSPARENT_WRAPPERS,
+            transparentWrappers,
+            embeddedCommandInterpreters: [],
         });
         if (invoked?.effective.static !== true)
             return true;
@@ -229,7 +234,7 @@ function runsUnseenCode(node, functionNames, sourceCode) {
         if (CODE_RUNNING_BUILTINS.has(name) || functionNames.has(name))
             return true;
     }
-    return childNodes(node).some((child) => runsUnseenCode(child, functionNames, sourceCode));
+    return childNodes(node).some((child) => runsUnseenCode(child, functionNames, sourceCode, transparentWrappers));
 }
 /**
  * The state of `errexit` before each top-level statement of `file`, from the
@@ -446,7 +451,7 @@ function withoutReadonly(flag) {
  * The replacement text for a standalone declaration, or `null` where no
  * equivalent split exists. `separator` joins the statements.
  */
-function splitText(declaration, scoped, separator, functionNames, sourceCode) {
+function splitText(declaration, scoped, separator, functionNames, sourceCode, transparentWrappers) {
     const { variant, flags, operands, flagsKnown } = declaration;
     if (!flagsKnown || operands.some((operand) => operand.unsplittable))
         return null;
@@ -489,7 +494,7 @@ function splitText(declaration, scoped, separator, functionNames, sourceCode) {
     // operand declares nothing that code could observe differently.
     const mayObserveDeclaration = scoped || operands.length > 1 || flags.length > 0;
     if (mayObserveDeclaration &&
-        operands.some((operand) => operand.values.some((value) => runsUnseenCode(value, functionNames, sourceCode)))) {
+        operands.some((operand) => operand.values.some((value) => runsUnseenCode(value, functionNames, sourceCode, transparentWrappers)))) {
         return null;
     }
     const makesReadonly = isReadonlyBuiltin || flags.some(isReadonlyFlag);
@@ -567,6 +572,7 @@ export const noMaskedExitStatus = createRule({
     create(context) {
         const [options] = context.options;
         const { sourceCode } = context;
+        const transparentWrappers = resolveTransparentWrappers(context, TRANSPARENT_WRAPPERS);
         const checked = new Set(options.builtins ?? ALL_BUILTINS);
         const parentOf = (node) => sourceCode.getParent(node);
         let errexitBefore = new Map();
@@ -613,7 +619,7 @@ export const noMaskedExitStatus = createRule({
                 const indent = text.slice(lineStart + 1, start);
                 const separator = /^[ \t]*$/u.test(indent) ? lineBreakOf(text) + indent : '; ';
                 const scoped = SCOPED_BUILTINS.has(builtin) && inFunction;
-                suggestion = splitText(declaration, scoped, separator, functionNames, sourceCode);
+                suggestion = splitText(declaration, scoped, separator, functionNames, sourceCode, transparentWrappers);
             }
             for (const operand of substituted) {
                 context.report({
@@ -645,7 +651,8 @@ export const noMaskedExitStatus = createRule({
             },
             CallExpr(node) {
                 const invoked = sourceCode.resolveInvokedCommand(node, {
-                    transparentWrappers: TRANSPARENT_WRAPPERS,
+                    transparentWrappers,
+                    embeddedCommandInterpreters: [],
                 });
                 if (invoked?.effective.static !== true)
                     return;

package/dist/rules/no-secret-env-reads.d.ts

@@ -5,13 +5,14 @@
  */
 export interface NoSecretEnvReadsOptions {
     /**
-     * Regex sources tested against each expanded variable's name. Replaces
+     * Case-sensitive Unicode regex sources tested against each expanded
+     * variable's name. Replaces
      * {@link DEFAULT_PATTERNS} entirely.
      */
     readonly patterns?: readonly string[];
     /**
-     * Command names whose arguments may read a secret-shaped variable. A
-     * command run by path matches by basename.
+     * Command names whose own arguments may read a secret-shaped variable. Wrapper-owned operands are still checked normally. A command
+     * run by path matches by basename.
      */
     readonly allowedSinks?: readonly string[];
 }

package/dist/rules/no-secret-env-reads.js

@@ -22,12 +22,14 @@
  *   command that runs (`TOKEN=$GITHUB_TOKEN tool`) is the recommended
  *   pattern and is clean. A read nested deeper (a command substitution in
  *   that value) belongs to the inner command and is judged there.
- * - A read in the arguments of an allow-listed sink command is clean. The
- *   command is the nearest enclosing `CallExpr`, resolved through
- *   transparent wrappers by `ShellSourceCode#resolveInvokedCommand`.
+ * - A read in an argument after the final allow-listed sink command is clean.
+ *   Wrapper-owned flags and operands receive no sink exemption. The nearest
+ *   enclosing `CallExpr` supplies argv ownership, and its resolved final
+ *   command index separates wrapper operands from the sink's arguments.
  * - Matching is a name pattern, not secret detection.
  */
 import { AlternateUnset, AlternateUnsetOrNull } from 'sh-ast/analyze';
+import { resolveTransparentWrappers } from './resolve-transparent-wrappers.js';
 import { createRule } from './create-rule.js';
 import { compileUserPattern } from './user-pattern.js';
 /**
@@ -71,7 +73,9 @@ export const noSecretEnvReads = createRule({
                 properties: {
                     patterns: {
                         type: 'array',
-                        items: { type: 'string', format: 'regex' },
+                        // The shared compiler validates Unicode syntax and identifies
+                        // the option index and source; flagless schema checks cannot.
+                        items: { type: 'string' },
                         minItems: 1,
                     },
                     allowedSinks: {
@@ -89,33 +93,52 @@ export const noSecretEnvReads = createRule({
     },
     create(context) {
         const options = context.options[0];
-        const patterns = (options?.patterns ?? DEFAULT_PATTERNS).map((source, index) => compileUserPattern('sh/no-secret-env-reads', `patterns[${String(index)}]`, source, ''));
+        const patterns = (options?.patterns ?? DEFAULT_PATTERNS).map((source, index) => compileUserPattern('sh/no-secret-env-reads', `patterns[${String(index)}]`, source, 'u'));
         const allowedSinks = new Set(options?.allowedSinks ?? []);
         const { sourceCode } = context;
+        const transparentWrappers = resolveTransparentWrappers(context);
         const isSecretName = (name) => patterns.some((pattern) => pattern.test(name));
-        /** Whether the command that `callExpr` runs, wrappers followed, is an allowed sink. */
-        function isAllowedSink(callExpr) {
-            if (allowedSinks.size === 0)
+        /** Whether this direct argument word belongs to the final approved sink. */
+        function isAllowedSink(callExpr, argument) {
+            if (allowedSinks.size === 0 || argument.type !== 'Word') {
+                return false;
+            }
+            // Sink policy names the program receiving these arguments. An interpreter's
+            // command-string selector does not change that recipient; judging its code
+            // belongs to no-dynamic-invocation rather than this explicit allowance.
+            const invoked = sourceCode.resolveInvokedCommand(callExpr, {
+                transparentWrappers,
+                embeddedCommandInterpreters: [],
+            });
+            if (!invoked?.effective.static) {
                 return false;
-            const effective = sourceCode.resolveInvokedCommand(callExpr)?.effective;
-            if (!effective?.static)
+            }
+            const effectiveIndex = invoked.chainIndices.at(-1);
+            if (effectiveIndex === undefined || callExpr.args.indexOf(argument) <= effectiveIndex) {
                 return false;
+            }
+            const { effective } = invoked;
             return allowedSinks.has(effective.text) || allowedSinks.has(basename(effective.text));
         }
         /**
-         * Whether the read at `node` is permitted: it sits in the arguments of an
-         * allowed sink, or directly in an assignment prefix of a command that runs.
+         * Whether the read at `node` is permitted: it sits in an actual argument of
+         * the final allowed sink, or in an assignment prefix of a command that runs.
          * The nearest enclosing `Assign` or `CallExpr` decides, so a read inside a
          * command substitution is judged by the inner command, not the outer one.
          */
         function isPermittedRead(node) {
+            // Keep the direct child by identity: argument ownership needs no range
+            // arithmetic and nested commands retain their own nearest call boundary.
+            let child = node;
             for (let up = sourceCode.getParent(node); up !== undefined; up = sourceCode.getParent(up)) {
-                if (up.type === 'CallExpr')
-                    return isAllowedSink(up);
+                if (up.type === 'CallExpr') {
+                    return isAllowedSink(up, child);
+                }
                 if (up.type === 'Assign') {
                     const owner = sourceCode.getParent(up);
                     return owner?.type === 'CallExpr' && owner.args.length > 0;
                 }
+                child = up;
             }
             return false;
         }

package/dist/rules/no-secret-flags.d.ts

@@ -7,7 +7,8 @@ import type { ShellNode } from '../language/syntax-view.js';
 export interface NoSecretFlagsOptions {
     /**
      * Regex sources tested against each flag's name (the word up to, not
-     * including, its first `=`). Replaces {@link DEFAULT_PATTERNS} entirely.
+     * including, its first `=`), with Unicode case-insensitive matching.
+     * Replaces {@link DEFAULT_PATTERNS} entirely.
      */
     readonly patterns?: readonly string[];
 }

package/dist/rules/no-secret-flags.js

@@ -55,14 +55,11 @@ const DEFAULT_PATTERNS = [
     '^(?!.*-(?:stdin|file)$)--?(?:access-|auth-?)?(?:password|passwd|token|secret|api-?key|auth(?:key|orization)?)(?![a-z])',
 ];
 /**
- * The flags every pattern is compiled with. Case-insensitive, matching the
- * default pattern's `/i`. No `u` flag: config validation checks each source
- * with ESLint's JSON-schema `regex` format, which compiles without flags, and
- * a few sources valid there are syntax errors under `u`. Adding `i` never
- * turns a valid source into an invalid one, so a pattern that passed
- * validation always compiles here.
+ * Unicode matching that ignores case for both default and custom sources.
+ * Keep the original flag name and pattern intact: lower-casing the subject
+ * would make a custom pattern containing capitals silently stop matching.
  */
-const PATTERN_FLAGS = 'i';
+const PATTERN_FLAGS = 'iu';
 /**
  * Splits a static argument word into the flag name the patterns are tested
  * against and the value written in the same word, if any. `--token=abc` is
@@ -100,7 +97,9 @@ export const noSecretFlags = createRule({
                 properties: {
                     patterns: {
                         type: 'array',
-                        items: { type: 'string', format: 'regex' },
+                        // Syntax is checked with the actual flags by compileUserPattern,
+                        // which also names the option index and source in errors.
+                        items: { type: 'string' },
                         minItems: 1,
                     },
                 },

package/dist/rules/no-unchecked-cd.js

@@ -48,6 +48,7 @@
  * statement is the document body, not shell code).
  */
 import { DEFAULT_TRANSPARENT_WRAPPERS } from 'sh-ast/analyze';
+import { resolveTransparentWrappers } from './resolve-transparent-wrappers.js';
 import { createRule } from './create-rule.js';
 import { prologueEnabledOptions, setStatementChanges } from './require-strict-mode.js';
 import { BUILTIN_WRAPPER } from './transparent-wrappers.js';
@@ -202,6 +203,7 @@ export const noUncheckedCd = createRule({
     create(context) {
         const [options] = context.options;
         const { sourceCode } = context;
+        const transparentWrappers = resolveTransparentWrappers(context, TRANSPARENT_WRAPPERS);
         let errexitInForce = false;
         return {
             File(node) {
@@ -213,7 +215,7 @@ export const noUncheckedCd = createRule({
                 if (errexitInForce)
                     return;
                 const invoked = sourceCode.resolveInvokedCommand(node, {
-                    transparentWrappers: TRANSPARENT_WRAPPERS,
+                    transparentWrappers,
                 });
                 if (invoked?.effective.static !== true || !DIRECTORY_COMMANDS.has(invoked.effective.text)) {
                     return;

package/dist/rules/no-undeclared-commands.d.ts

@@ -1,20 +1,6 @@
-/**
- * The rule's single options object.
- *
- * @internal
- */
-export interface NoUndeclaredCommandsOptions {
-    /**
-     * Names of project-specific transparent wrappers (`with-retry`), added to
-     * the default wrapper table (see `harvestWrapperTable`). The word after a listed
-     * wrapper is the command it runs, so `with-retry curl` uses `curl` as well
-     * as `with-retry`.
-     */
-    readonly transparentWrappers?: readonly string[];
-}
 /**
  * The `sh/no-undeclared-commands` rule module.
  *
  * @internal
  */
-export declare const noUndeclaredCommands: import("./define-shell-rule.js").ShellRule<[NoUndeclaredCommandsOptions?], "undeclaredCommand">;
+export declare const noUndeclaredCommands: import("./define-shell-rule.js").ShellRule<[], "undeclaredCommand">;

package/dist/rules/no-undeclared-commands.js

@@ -33,7 +33,7 @@ import { harvestWrapperTable } from '../command-harvest/wrapper-table.js';
 import { createRule } from './create-rule.js';
 import { readDeclaredCommands, toLintedFile, } from '../declaration-conventions/read-declared-commands.js';
 import { resolveDeclarationConvention } from './resolve-declaration-convention.js';
-import { networkWrapperSpec } from './resolve-network-wrapper.js';
+import { resolveTransparentWrappers } from './resolve-transparent-wrappers.js';
 /** The registry name of this rule (`sh/no-undeclared-commands` in a user's config). */
 const RULE_NAME = 'no-undeclared-commands';
 /** The report's second sentence when the convention offers no hint for a command. */
@@ -67,19 +67,7 @@ export const noUndeclaredCommands = createRule({
         docs: {
             description: 'Require every external command a script uses to be declared by the configured declaration convention',
         },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    transparentWrappers: {
-                        type: 'array',
-                        items: { type: 'string', minLength: 1 },
-                        uniqueItems: true,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
+        schema: [],
         messages: {
             undeclaredCommand: "'{{command}}' is used but not declared. {{howToDeclare}}",
         },
@@ -90,7 +78,7 @@ export const noUndeclaredCommands = createRule({
             return {};
         }
         const { sourceCode } = context;
-        const transparentWrappers = harvestWrapperTable(sourceCode.dialect, context.options[0]?.transparentWrappers ?? [], networkWrapperSpec(context.settings));
+        const transparentWrappers = resolveTransparentWrappers(context, harvestWrapperTable(sourceCode.dialect));
         return {
             File() {
                 // Only names matter here, so every kind of declaration counts the same.