@intentius/chant 0.45.0 → 0.49.0

package/src/yaml.test.ts

@@ -226,6 +226,94 @@ describe("parseScalar", () => {
     expect(parseScalar("hello")).toBe("hello");
   });
 });
+// Quoted scalars (#1860) — stripping the delimiters is only half the job; the
+// escapes inside them have to be decoded too. A double-quoted `\n` that stayed
+// two literal characters is what sent a seven-line setup script to a shell as
+// one line.
+describe("parseScalar quoted scalars (#1860)", () => {
+  test("double-quoted escapes decode", () => {
+    expect(parseScalar(String.raw`"a\nb"`)).toBe("a\nb");
+    expect(parseScalar(String.raw`"a\tb"`)).toBe("a\tb");
+    expect(parseScalar(String.raw`"say \"hi\""`)).toBe('say "hi"');
+    expect(parseScalar(String.raw`"back\\slash"`)).toBe("back\\slash");
+    expect(parseScalar(String.raw`"a\/b"`)).toBe("a/b");
+  });
+
+  test("hex, unicode and 32-bit escapes", () => {
+    expect(parseScalar(String.raw`"\x41"`)).toBe("A");
+    expect(parseScalar(String.raw`"A"`)).toBe("A");
+    expect(parseScalar(String.raw`"\U0001F600"`)).toBe("\u{1F600}");
+  });
+
+  test("an escaped line break folds away with its indentation", () => {
+    expect(parseScalar('"a\\\n   b"')).toBe("ab");
+  });
+
+  test("single-quoted '' is one quote", () => {
+    expect(parseScalar("'it''s'")).toBe("it's");
+    expect(parseScalar("'''quoted'''")).toBe("'quoted'");
+  });
+
+  test("a lone quote character is not a quoted scalar", () => {
+    expect(parseScalar('"')).toBe('"');
+    expect(parseScalar("'")).toBe("'");
+  });
+
+  test("a body with a bare quote keeps the old strip-only behaviour", () => {
+    expect(parseScalar('"a" + "b"')).toBe('a" + "b');
+  });
+
+  test("an unknown or truncated escape keeps the old strip-only behaviour", () => {
+    expect(parseScalar(String.raw`"a\qb"`)).toBe(String.raw`a\qb`);
+    expect(parseScalar(String.raw`"\x4"`)).toBe(String.raw`\x4`);
+  });
+});
+
+// Round-trip parity for the scalars `emitYAML` quotes: what it writes,
+// `parseYAML` must read back unchanged. The single-quote half of #1860 was
+// invisible until this existed. Multiline strings are excluded on purpose —
+// the emitter sends those through a block scalar, which #910 already covers
+// and which does not preserve trailing newlines.
+describe("emitYAML/parseYAML round trip (#1860)", () => {
+  const values = [
+    "'quoted'",
+    "#hash's",
+    "it's a test",
+    "plain",
+    "yes",
+    "a: b",
+    "$VAR",
+    "",
+  ];
+
+  for (const v of values) {
+    test(`round-trips ${JSON.stringify(v)}`, () => {
+      expect(parseYAML(`k: ${emitYAML(v, 0)}\n`).k).toBe(v);
+    });
+  }
+});
+
+// The fountain lexicon emits multiline strings as `JSON.stringify(s)` — a
+// double-quoted scalar, not a block scalar — so this is the shape that
+// actually reached the applier (#1860).
+describe("double-quoted multiline manifest values (#1860)", () => {
+  test("a joined shell script keeps its newlines", () => {
+    const script = [
+      "set -e",
+      "sudo service postgresql start || true",
+      `sudo -u postgres psql -tc "ALTER USER postgres PASSWORD 'postgres'" || true`,
+      "cd /workspace/fountain",
+    ].join("\n");
+
+    const yaml = `spec:\n  setup_script: ${JSON.stringify(script)}\n`;
+    const parsed = parseYAML(yaml) as { spec: { setup_script: string } };
+
+    expect(parsed.spec.setup_script).toBe(script);
+    expect(parsed.spec.setup_script.split("\n")).toHaveLength(4);
+    expect(parsed.spec.setup_script).not.toContain(String.raw`\n`);
+  });
+});
+
 
 // Block scalars (#910) — round-trip parity with js-yaml for literal/folded/chomping,
 // including block scalars nested inside array items (the case that mis-parsed).

package/src/yaml.ts

@@ -559,15 +559,85 @@ export function parseScalar(value: string): unknown {
   if (value === "" || value === "~" || value === "null") return null;
   if (value === "true" || value === "yes") return true;
   if (value === "false" || value === "no") return false;
-  // Strip quotes
-  if (
-    (value.startsWith("'") && value.endsWith("'")) ||
-    (value.startsWith('"') && value.endsWith('"'))
-  ) {
-    return value.slice(1, -1);
+  // Quoted scalars carry escapes, and stripping the quotes is only half the
+  // job: a double-quoted `\n` is a newline, a single-quoted `''` is one
+  // quote. Dropping that step leaves the escape sequence in the value as
+  // literal characters, which is how a multiline `setup_script` reached a
+  // shell as one line of `set -e\nsudo ...` (#1860).
+  if (value.length >= 2) {
+    if (value.startsWith('"') && value.endsWith('"')) {
+      const unescaped = unescapeDoubleQuoted(value.slice(1, -1));
+      // `null` means the body held a bare `"`, so this was never a single
+      // well-formed scalar (`"a" + "b"`). Keep the old behaviour there.
+      return unescaped ?? value.slice(1, -1);
+    }
+    if (value.startsWith("'") && value.endsWith("'")) {
+      return value.slice(1, -1).replace(/''/g, "'");
+    }
   }
   // Number
   const num = Number(value);
   if (!isNaN(num) && value !== "") return num;
   return value;
 }
+
+/** YAML double-quoted escapes, per the spec's escape table. */
+const DQ_ESCAPES: Record<string, string> = {
+  "0": "\0",
+  a: "\x07",
+  b: "\b",
+  t: "\t",
+  "\t": "\t",
+  n: "\n",
+  v: "\v",
+  f: "\f",
+  r: "\r",
+  e: "\x1b",
+  " ": " ",
+  '"': '"',
+  "/": "/",
+  "\\": "\\",
+  N: "\x85",
+  _: "\xa0",
+  L: "\u2028",
+  P: "\u2029",
+};
+
+/**
+ * Decode the body of a double-quoted YAML scalar.
+ *
+ * Returns `null` when the body holds an unescaped `"`, which means the caller
+ * was not looking at one quoted scalar after all.
+ */
+function unescapeDoubleQuoted(body: string): string | null {
+  let out = "";
+  for (let i = 0; i < body.length; i++) {
+    const ch = body[i];
+    if (ch === '"') return null;
+    if (ch !== "\\") {
+      out += ch;
+      continue;
+    }
+    const esc = body[++i];
+    if (esc === undefined) return null;
+    // \xXX, \uXXXX, \UXXXXXXXX
+    const width = esc === "x" ? 2 : esc === "u" ? 4 : esc === "U" ? 8 : 0;
+    if (width > 0) {
+      const hex = body.slice(i + 1, i + 1 + width);
+      if (hex.length < width || !/^[0-9a-fA-F]+$/.test(hex)) return null;
+      out += String.fromCodePoint(parseInt(hex, 16));
+      i += width;
+      continue;
+    }
+    // An escaped line break is a line continuation: it and the following
+    // indentation fold away to nothing.
+    if (esc === "\n") {
+      while (body[i + 1] === " " || body[i + 1] === "\t") i++;
+      continue;
+    }
+    const mapped = DQ_ESCAPES[esc];
+    if (mapped === undefined) return null;
+    out += mapped;
+  }
+  return out;
+}