@guilz-dev/belay 0.9.1 → 0.9.3

package/dist/core/shell-tokenizer.js

@@ -67,61 +67,143 @@ export function isRedirectOperator(token) {
 export function isFdDuplication(token) {
     return FD_DUPLICATION_PATTERN.test(token);
 }
-export function tokenizeShell(input) {
+export function lexShell(input) {
     const tokens = [];
-    let buffer = '';
+    let value = '';
+    let wordStart = null;
+    let parts = [];
     let quote = null;
-    let escaping = false;
-    const flush = () => {
-        if (buffer.length > 0) {
-            tokens.push(buffer);
-            buffer = '';
+    let quoteStart = -1;
+    let quoteHadContent = false;
+    let complete = true;
+    const startWord = (index) => {
+        wordStart ??= index;
+    };
+    const append = (decoded, start, end, mode, hasExpansion) => {
+        startWord(start);
+        value += decoded;
+        const previous = parts.at(-1);
+        if (previous &&
+            previous.quote === mode &&
+            previous.hasExpansion === hasExpansion &&
+            previous.end === start) {
+            previous.value += decoded;
+            previous.raw += input.slice(start, end);
+            previous.end = end;
+            return;
         }
+        parts.push({
+            value: decoded,
+            raw: input.slice(start, end),
+            start,
+            end,
+            quote: mode,
+            hasExpansion,
+        });
+    };
+    const flushWord = (end) => {
+        if (wordStart === null)
+            return;
+        tokens.push({
+            kind: 'word',
+            value,
+            raw: input.slice(wordStart, end),
+            start: wordStart,
+            end,
+            parts,
+        });
+        value = '';
+        wordStart = null;
+        parts = [];
+    };
+    const pushOperator = (token, start, end) => {
+        tokens.push({ kind: 'operator', value: token, raw: input.slice(start, end), start, end });
     };
     for (let index = 0; index < input.length; index += 1) {
-        const char = input[index];
-        if (escaping) {
-            buffer += char;
-            escaping = false;
-            continue;
-        }
-        if (char === '\\') {
-            escaping = true;
+        const char = input[index] ?? '';
+        if (quote === 'single') {
+            if (char === "'") {
+                if (!quoteHadContent)
+                    append('', quoteStart, index + 1, 'single', false);
+                quote = null;
+            }
+            else {
+                append(char, index, index + 1, 'single', false);
+                quoteHadContent = true;
+            }
             continue;
         }
-        if (quote) {
-            if (char === quote) {
+        if (quote === 'double') {
+            if (char === '"') {
+                if (!quoteHadContent)
+                    append('', quoteStart, index + 1, 'double', false);
                 quote = null;
+                continue;
             }
-            else {
-                buffer += char;
+            if (char === '\\') {
+                const next = input[index + 1];
+                if (next === undefined) {
+                    append('\\', index, index + 1, 'double', false);
+                    complete = false;
+                    continue;
+                }
+                if (next === '$' || next === '`' || next === '"' || next === '\\' || next === '\n') {
+                    append(next === '\n' ? '' : next, index, index + 2, 'double', false);
+                    quoteHadContent = true;
+                    index += 1;
+                    continue;
+                }
+                append('\\', index, index + 1, 'double', false);
+                quoteHadContent = true;
+                continue;
             }
+            append(char, index, index + 1, 'double', char === '$' || char === '`');
+            quoteHadContent = true;
             continue;
         }
-        if (char === '"' || char === "'") {
-            quote = char;
+        if (char === "'" || char === '"') {
+            startWord(index);
+            quote = char === "'" ? 'single' : 'double';
+            quoteStart = index;
+            quoteHadContent = false;
+            continue;
+        }
+        if (char === '\\') {
+            const next = input[index + 1];
+            if (next === undefined) {
+                append('\\', index, index + 1, 'unquoted', false);
+                complete = false;
+                continue;
+            }
+            append(next, index, index + 2, 'unquoted', false);
+            index += 1;
             continue;
         }
         const operator = readShellOperator(input, index);
         if (operator) {
-            flush();
-            tokens.push(operator.token);
+            flushWord(index);
+            pushOperator(operator.token, index, index + operator.length);
             index += operator.length - 1;
             continue;
         }
         if (char === '\n' || char === '\r') {
-            flush();
-            tokens.push(';');
+            flushWord(index);
+            pushOperator(';', index, index + 1);
             continue;
         }
         if (/\s/.test(char)) {
-            flush();
+            flushWord(index);
             continue;
         }
-        buffer += char;
+        append(char, index, index + 1, 'unquoted', char === '$' || char === '`');
     }
-    flush();
-    return tokens;
+    if (quote !== null)
+        complete = false;
+    flushWord(input.length);
+    return { tokens, complete };
+}
+export function tokenizeShell(input) {
+    return lexShell(input).tokens.map((token) => token.value);
 }
 export function normalizeShellCommand(command, repoRoot, normalizeToken) {
     const tokens = tokenizeShell(command);

package/dist/core/verdict/docker-compose-run.d.ts

@@ -0,0 +1,18 @@
+import type { ShellToken } from '../shell-tokenizer.js';
+export type DockerComposeRunInvocation = {
+    kind: 'recursive';
+    service: string;
+    interpreter: string;
+    script: string;
+} | {
+    kind: 'dynamic';
+    service: string;
+    signal: string;
+} | {
+    kind: 'none';
+} | {
+    kind: 'indeterminate';
+    signal: 'shell.compose_argv_indeterminate';
+};
+export declare function decodeDockerComposeRun(tokens: readonly ShellToken[]): DockerComposeRunInvocation;
+export declare function decodeDockerComposeRunValues(values: readonly string[]): DockerComposeRunInvocation;

package/dist/core/verdict/docker-compose-run.js

@@ -0,0 +1,136 @@
+import path from 'node:path';
+import { decodeRecursiveInvocation, shellTokensFromValues } from './recursive-invocation.js';
+const COMPOSE_GLOBAL_OPTIONS = new Map([
+    ['--all-resources', 0],
+    ['--ansi', 1],
+    ['--compatibility', 0],
+    ['--dry-run', 0],
+    ['--env-file', 1],
+    ['-f', 1],
+    ['--file', 1],
+    ['--parallel', 1],
+    ['--profile', 1],
+    ['--progress', 1],
+    ['--project-directory', 1],
+    ['-p', 1],
+    ['--project-name', 1],
+]);
+const COMPOSE_RUN_OPTIONS = new Map([
+    ['--build', 0],
+    ['--cap-add', 1],
+    ['--cap-drop', 1],
+    ['-d', 0],
+    ['--detach', 0],
+    ['--entrypoint', 1],
+    ['-e', 1],
+    ['--env', 1],
+    ['--env-from-file', 1],
+    ['-i', 0],
+    ['--interactive', 0],
+    ['-l', 1],
+    ['--label', 1],
+    ['--name', 1],
+    ['--no-deps', 0],
+    ['-T', 0],
+    ['--no-tty', 0],
+    ['-p', 1],
+    ['--publish', 1],
+    ['--pull', 1],
+    ['-q', 0],
+    ['--quiet', 0],
+    ['--quiet-build', 0],
+    ['--quiet-pull', 0],
+    ['--remove-orphans', 0],
+    ['--rm', 0],
+    ['-P', 0],
+    ['--service-ports', 0],
+    ['--use-aliases', 0],
+    ['-u', 1],
+    ['--user', 1],
+    ['-v', 1],
+    ['--volume', 1],
+    ['-w', 1],
+    ['--workdir', 1],
+]);
+function parseOptions(words, start, options) {
+    let index = start;
+    while (index < words.length) {
+        const value = words[index]?.value ?? '';
+        if (value === '--')
+            return { kind: 'ok', index: index + 1 };
+        if (!value.startsWith('-') || value === '-')
+            return { kind: 'ok', index };
+        const equalsIndex = value.indexOf('=');
+        const name = equalsIndex === -1 ? value : value.slice(0, equalsIndex);
+        const arity = options.get(name);
+        if (arity === undefined)
+            return { kind: 'indeterminate' };
+        if (equalsIndex !== -1) {
+            if (!value.startsWith('--') || arity !== 1 || equalsIndex === value.length - 1) {
+                return { kind: 'indeterminate' };
+            }
+            index += 1;
+            continue;
+        }
+        if (arity === 1) {
+            if (!words[index + 1])
+                return { kind: 'indeterminate' };
+            index += 2;
+            continue;
+        }
+        index += 1;
+    }
+    return { kind: 'ok', index };
+}
+export function decodeDockerComposeRun(tokens) {
+    if (tokens.some((token) => token.kind === 'operator'))
+        return { kind: 'none' };
+    const words = tokens.filter((token) => token.kind === 'word');
+    const head = path.basename(words[0]?.value ?? '');
+    let index;
+    if (head === 'docker-compose') {
+        index = 1;
+    }
+    else if (head === 'docker' && words[1]?.value === 'compose') {
+        index = 2;
+    }
+    else {
+        return { kind: 'none' };
+    }
+    const globalOptions = parseOptions(words, index, COMPOSE_GLOBAL_OPTIONS);
+    if (globalOptions.kind === 'indeterminate') {
+        return { kind: 'indeterminate', signal: 'shell.compose_argv_indeterminate' };
+    }
+    index = globalOptions.index;
+    if (words[index]?.value !== 'run')
+        return { kind: 'none' };
+    const runOptions = parseOptions(words, index + 1, COMPOSE_RUN_OPTIONS);
+    if (runOptions.kind === 'indeterminate') {
+        return { kind: 'indeterminate', signal: 'shell.compose_argv_indeterminate' };
+    }
+    index = runOptions.index;
+    const service = words[index]?.value;
+    if (!service)
+        return { kind: 'indeterminate', signal: 'shell.compose_argv_indeterminate' };
+    const command = words.slice(index + 1);
+    if (command.length === 0)
+        return { kind: 'none' };
+    const recursive = decodeRecursiveInvocation(command);
+    if (recursive.kind === 'static') {
+        return {
+            kind: 'recursive',
+            service,
+            interpreter: recursive.interpreter,
+            script: recursive.script,
+        };
+    }
+    if (recursive.kind === 'dynamic')
+        return { kind: 'dynamic', service, signal: recursive.signal };
+    if (recursive.kind === 'indeterminate') {
+        return { kind: 'indeterminate', signal: 'shell.compose_argv_indeterminate' };
+    }
+    return { kind: 'none' };
+}
+export function decodeDockerComposeRunValues(values) {
+    return decodeDockerComposeRun(shellTokensFromValues(values, { detectExpansion: false }));
+}

package/dist/core/verdict/launcher-resolve.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
+import { expandMakeExpression, normalizeMakeRecipeLine, parseMakefileVariables, } from './makefile-expand.js';
 const MAX_RESOLVE_DEPTH = 8;
 const PNPM_BUILTIN_COMMANDS = new Set([
     'add',
@@ -145,10 +146,9 @@ function resolveNpmRecipe(cwd, repoRoot, scriptName, extraArgs) {
         reason: 'npm_script_resolved',
     };
 }
-function parseMakefileRecipes(makefilePath) {
+function parseMakefileRecipeContent(content) {
     const targets = new Map();
     try {
-        const content = readFileSync(makefilePath, 'utf8');
         const lines = content.split('\n');
         let currentTarget = null;
         let recipeLines = [];
@@ -206,7 +206,7 @@ function parseMakefileRecipes(makefilePath) {
     }
     return targets;
 }
-function resolveMakeRecipe(cwd, repoRoot, target) {
+function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
     const candidates = ['Makefile', 'makefile', 'GNUmakefile'];
     let makefilePath = null;
     let searchDir = path.resolve(cwd);
@@ -227,57 +227,75 @@ function resolveMakeRecipe(cwd, repoRoot, target) {
     if (!makefilePath) {
         return { recipes: [], opaque: true, reason: 'unknown_local_effect' };
     }
-    const targets = parseMakefileRecipes(makefilePath);
+    const makefileContent = readFileSync(makefilePath, 'utf8');
+    const makefileVars = parseMakefileVariables(makefileContent);
+    const targets = parseMakefileRecipeContent(makefileContent);
     if (!targets.has(target)) {
         return { recipes: [], opaque: true, reason: 'make_target_undefined' };
     }
     const recipeLines = [];
     const visiting = new Set();
     const visited = new Set();
-    let opaquePrerequisites = false;
+    let hasDynamicPrerequisite = false;
+    let hasUndefinedPrerequisite = false;
+    let hasDependencyCycle = false;
     const collect = (name) => {
         if (visited.has(name)) {
-            return true;
+            return;
         }
         if (visiting.has(name)) {
-            return false;
+            hasDependencyCycle = true;
+            return;
         }
         const entry = targets.get(name);
         if (!entry) {
-            return true;
+            if (!existsSync(path.resolve(path.dirname(makefilePath), name))) {
+                hasUndefinedPrerequisite = true;
+            }
+            return;
         }
         visiting.add(name);
-        opaquePrerequisites ||= entry.opaquePrerequisites;
+        hasDynamicPrerequisite ||= entry.opaquePrerequisites;
         for (const prerequisite of entry.prerequisites) {
-            if (targets.has(prerequisite) && !collect(prerequisite)) {
-                return false;
-            }
+            collect(prerequisite);
         }
         recipeLines.push(...entry.recipes);
         visiting.delete(name);
         visited.add(name);
-        return true;
     };
-    if (!collect(target)) {
-        return { recipes: recipeLines, opaque: true, reason: 'make_dependency_cycle' };
-    }
+    collect(target);
+    const expandedRecipes = [];
     for (const line of recipeLines) {
-        if (/\$\(/.test(line) || /\$\{/.test(line)) {
+        const normalized = normalizeMakeRecipeLine(line);
+        const expanded = expandMakeExpression(normalized, cliVars, makefileVars);
+        if (expanded === null) {
             return { recipes: recipeLines, opaque: true, reason: 'make_recipe_dynamic' };
         }
+        expandedRecipes.push(expanded);
+    }
+    for (const line of expandedRecipes) {
+        if (/\$\(/.test(line) || /\$\{/.test(line)) {
+            return { recipes: expandedRecipes, opaque: true, reason: 'make_recipe_dynamic' };
+        }
+    }
+    if (hasDependencyCycle) {
+        return { recipes: expandedRecipes, opaque: true, reason: 'make_dependency_cycle' };
     }
-    if (opaquePrerequisites) {
-        return { recipes: recipeLines, opaque: true, reason: 'make_prerequisite_dynamic' };
+    if (hasDynamicPrerequisite) {
+        return { recipes: expandedRecipes, opaque: true, reason: 'make_prerequisite_dynamic' };
     }
-    return { recipes: recipeLines, opaque: false, reason: 'make_recipe_resolved' };
+    if (hasUndefinedPrerequisite) {
+        return { recipes: expandedRecipes, opaque: true, reason: 'make_prerequisite_undefined' };
+    }
+    return { recipes: expandedRecipes, opaque: false, reason: 'make_recipe_resolved' };
 }
 export function resolveLauncherRecipe(params) {
-    if (params.depth >= MAX_RESOLVE_DEPTH) {
-        return { recipes: [], opaque: true, reason: 'launcher_depth_exceeded' };
-    }
     const tokens = params.tokens;
     const scriptName = npmScriptName(tokens);
     if (scriptName) {
+        if (params.depth >= MAX_RESOLVE_DEPTH) {
+            return { recipes: [], opaque: true, reason: 'launcher_depth_exceeded' };
+        }
         const resolution = resolveNpmRecipe(params.cwd, params.repoRoot, scriptName, forwardedArgs(tokens));
         if (tokens[0] === 'pnpm' &&
             tokens[1] &&
@@ -291,8 +309,31 @@ export function resolveLauncherRecipe(params) {
         }
         return resolution;
     }
-    if (tokens[0] === 'make' && tokens[1] && !tokens[1].startsWith('-')) {
-        return resolveMakeRecipe(params.cwd, params.repoRoot, tokens[1]);
+    if (tokens[0] === 'make') {
+        if (params.depth >= MAX_RESOLVE_DEPTH) {
+            return { recipes: [], opaque: true, reason: 'launcher_depth_exceeded' };
+        }
+        if (tokens.includes('-n') || tokens.includes('--dry-run')) {
+            return null;
+        }
+        let target = null;
+        const cliVars = {};
+        for (const token of tokens.slice(1)) {
+            if (token.startsWith('-')) {
+                continue;
+            }
+            const assignment = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(token);
+            if (assignment) {
+                cliVars[assignment[1] ?? ''] = assignment[2] ?? '';
+                continue;
+            }
+            if (!target) {
+                target = token;
+            }
+        }
+        if (target) {
+            return resolveMakeRecipe(params.cwd, params.repoRoot, target, cliVars);
+        }
     }
     if (tokens[0] === 'pnpm' && tokens[1] === 'exec' && tokens[2]) {
         return {

package/dist/core/verdict/makefile-expand.d.ts

@@ -0,0 +1,4 @@
+export declare function parseMakefileVariables(content: string): Map<string, string>;
+export declare function parsePhonyTargets(content: string): Set<string>;
+export declare function normalizeMakeRecipeLine(line: string): string;
+export declare function expandMakeExpression(expression: string, cliVars: Readonly<Record<string, string>>, makefileVars: ReadonlyMap<string, string>): string | null;

package/dist/core/verdict/makefile-expand.js

@@ -0,0 +1,151 @@
+const MAX_EXPAND_DEPTH = 16;
+export function parseMakefileVariables(content) {
+    const variables = new Map();
+    for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) {
+            continue;
+        }
+        const match = /^([A-Za-z_][A-Za-z0-9_]*)\s*[:?]?=\s*(.+)$/.exec(trimmed);
+        if (!match) {
+            continue;
+        }
+        variables.set(match[1] ?? '', (match[2] ?? '').trim());
+    }
+    return variables;
+}
+export function parsePhonyTargets(content) {
+    const phony = new Set();
+    for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        const match = /^\.PHONY:\s*(.+)$/.exec(trimmed);
+        if (!match) {
+            continue;
+        }
+        for (const token of (match[1] ?? '').split(/\s+/)) {
+            if (token) {
+                phony.add(token);
+            }
+        }
+    }
+    return phony;
+}
+export function normalizeMakeRecipeLine(line) {
+    let normalized = line.trim();
+    while (normalized.startsWith('@') || normalized.startsWith('-') || normalized.startsWith('+')) {
+        normalized = normalized.slice(1).trimStart();
+    }
+    return normalized;
+}
+export function expandMakeExpression(expression, cliVars, makefileVars) {
+    if (/\$\(\s*shell\b/i.test(expression) || expression.includes('$$')) {
+        return null;
+    }
+    try {
+        const expanded = expandMakeValue(expression, cliVars, makefileVars, 0);
+        if (expanded === null || /\$\(/.test(expanded) || /\$\{/.test(expanded)) {
+            return null;
+        }
+        return expanded;
+    }
+    catch {
+        return null;
+    }
+}
+function expandMakeValue(expression, cliVars, makefileVars, depth) {
+    if (depth > MAX_EXPAND_DEPTH) {
+        return null;
+    }
+    let value = expression.trim();
+    let changed = true;
+    let iterations = 0;
+    while (changed && iterations < MAX_EXPAND_DEPTH) {
+        changed = false;
+        iterations += 1;
+        const orMatch = value.match(/\$\(\s*or\s+([^()]*(?:\([^)]*\)[^()]*)*)\)/);
+        if (orMatch) {
+            const [fullMatch, inner] = orMatch;
+            const parts = splitMakeFunctionArgs(inner ?? '');
+            let selected = null;
+            for (const part of parts) {
+                const expanded = expandMakeValue(part.trim(), cliVars, makefileVars, depth + 1);
+                if (expanded !== null && expanded.trim() !== '') {
+                    selected = expanded;
+                    break;
+                }
+            }
+            if (selected === null) {
+                const fallback = parts.at(-1)?.trim();
+                selected =
+                    fallback === undefined ? '' : expandMakeValue(fallback, cliVars, makefileVars, depth + 1);
+            }
+            if (selected === null) {
+                return null;
+            }
+            value = value.replace(fullMatch, selected);
+            changed = true;
+            continue;
+        }
+        const varMatch = value.match(/\$\(([A-Za-z_][A-Za-z0-9_]*)\)/);
+        if (varMatch) {
+            const [fullMatch, name] = varMatch;
+            const resolved = resolveMakeVariable(name ?? '', cliVars, makefileVars, depth + 1);
+            if (resolved === null) {
+                return null;
+            }
+            value = value.replace(fullMatch, resolved);
+            changed = true;
+            continue;
+        }
+        const bracedMatch = value.match(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/);
+        if (bracedMatch) {
+            const [fullMatch, name] = bracedMatch;
+            const resolved = name === 'PWD' ? '.' : resolveMakeVariable(name ?? '', cliVars, makefileVars, depth + 1);
+            if (resolved === null) {
+                return null;
+            }
+            value = value.replace(fullMatch, resolved);
+            changed = true;
+            continue;
+        }
+        break;
+    }
+    return value;
+}
+function resolveMakeVariable(name, cliVars, makefileVars, depth) {
+    if (Object.hasOwn(cliVars, name)) {
+        return cliVars[name] ?? '';
+    }
+    const definition = makefileVars.get(name);
+    if (definition === undefined) {
+        return null;
+    }
+    return expandMakeValue(definition, cliVars, makefileVars, depth);
+}
+function splitMakeFunctionArgs(input) {
+    const parts = [];
+    let current = '';
+    let depth = 0;
+    for (const char of input) {
+        if (char === '(') {
+            depth += 1;
+            current += char;
+            continue;
+        }
+        if (char === ')') {
+            depth -= 1;
+            current += char;
+            continue;
+        }
+        if (char === ',' && depth === 0) {
+            parts.push(current.trim());
+            current = '';
+            continue;
+        }
+        current += char;
+    }
+    if (current.trim()) {
+        parts.push(current.trim());
+    }
+    return parts;
+}

package/dist/core/verdict/parser.d.ts

@@ -1,3 +1,5 @@
+import { type ShellToken } from '../shell-tokenizer.js';
+import { type RecursiveInvocation } from './recursive-invocation.js';
 import type { VerdictOpacity } from './types.js';
 export interface ParsedSegment {
     tokens: string[];
@@ -16,6 +18,8 @@ export declare function peelTransparentWrappers(tokens: string[]): {
 export declare function isVariableIndirectHead(head: string): boolean;
 export declare function extractEvalBody(tokens: string[]): string | null;
 export declare function extractRecursiveScript(tokens: string[]): string | null;
+export declare function decodeRecursiveInvocationTokens(tokens: readonly ShellToken[]): RecursiveInvocation;
+export declare function extractDockerComposeRunScript(tokens: string[]): string | null;
 /**
  * True when a recursive script is evaluated from a command argument rather
  * than expanded from a static launcher recipe. Callers use this semantic fact