pureshellcheck 0.2.0__tar.gz → 0.2.2__tar.gz

{pureshellcheck-0.2.0/src/pureshellcheck.egg-info → pureshellcheck-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pureshellcheck
-Version: 0.2.0
+Version: 0.2.2
 Summary: A pure Python reimplementation of ShellCheck's most common checks
 Author: adam2go
 License: MIT
@@ -157,24 +157,25 @@ no process spawn, no binary. A one-line snippet checks in **~40 µs**
 (~25,000 checks/second); throughput on large scripts is ~57k lines/s. CLI
 time is dominated by CPython interpreter startup (~20 ms).
 
-**v0.2.0 vs v0.1.0** (controlled before/after,
+**v0.2.x vs v0.1.0** (controlled before/after,
 `python tools/bench_compare.py`: baseline wheel from PyPI vs this tree in
 the same interpreter, 25–200 in-process repeats, outputs verified
 identical on every workload):
 
-| workload | v0.1.0 | v0.2.0 | improvement |
+| workload | v0.1.0 | v0.2.1 | improvement |
 |---|---|---|---|
-| tiny (1 line) | 0.061 ms | 0.037 ms | 1.6× |
-| small (75 lines) | 2.62 ms | 1.30 ms | 2.0× |
-| medium (263 lines) | 9.46 ms | 4.81 ms | 2.0× |
-| large (1216 lines) | 48.6 ms | 21.3 ms | **2.3×** |
+| tiny (1 line) | 0.058 ms | 0.036 ms | 1.6× |
+| small (75 lines) | 2.44 ms | 1.21 ms | 2.0× |
+| medium (263 lines) | 8.76 ms | 4.48 ms | 2.0× |
+| large (1216 lines) | 46.2 ms | 20.0 ms | **2.3×** |
 
-The v0.2.0 speedups came from caching the AST child/parent structure and a
+The speedups came from caching the AST child/parent structure and a
 document-order node table (one traversal instead of dozens), making
 variable states immutable tuples so branch snapshots are plain dict
-copies, a banded Levenshtein for SC2153 (fuzz-tested against the
-reference implementation on 20,000 random pairs), and memoizing repeated
-word/command resolution.
+copies, a leaf-node fast path, a banded Levenshtein for SC2153
+(fuzz-tested against the reference implementation on 20,000 random
+pairs), and memoizing repeated word/command resolution. Package import is
+3.6 ms; remaining CLI latency is CPython interpreter startup.
 
 ## Compatibility notes
 

{pureshellcheck-0.2.0 → pureshellcheck-0.2.2}/README.md

@@ -130,24 +130,25 @@ no process spawn, no binary. A one-line snippet checks in **~40 µs**
 (~25,000 checks/second); throughput on large scripts is ~57k lines/s. CLI
 time is dominated by CPython interpreter startup (~20 ms).
 
-**v0.2.0 vs v0.1.0** (controlled before/after,
+**v0.2.x vs v0.1.0** (controlled before/after,
 `python tools/bench_compare.py`: baseline wheel from PyPI vs this tree in
 the same interpreter, 25–200 in-process repeats, outputs verified
 identical on every workload):
 
-| workload | v0.1.0 | v0.2.0 | improvement |
+| workload | v0.1.0 | v0.2.1 | improvement |
 |---|---|---|---|
-| tiny (1 line) | 0.061 ms | 0.037 ms | 1.6× |
-| small (75 lines) | 2.62 ms | 1.30 ms | 2.0× |
-| medium (263 lines) | 9.46 ms | 4.81 ms | 2.0× |
-| large (1216 lines) | 48.6 ms | 21.3 ms | **2.3×** |
+| tiny (1 line) | 0.058 ms | 0.036 ms | 1.6× |
+| small (75 lines) | 2.44 ms | 1.21 ms | 2.0× |
+| medium (263 lines) | 8.76 ms | 4.48 ms | 2.0× |
+| large (1216 lines) | 46.2 ms | 20.0 ms | **2.3×** |
 
-The v0.2.0 speedups came from caching the AST child/parent structure and a
+The speedups came from caching the AST child/parent structure and a
 document-order node table (one traversal instead of dozens), making
 variable states immutable tuples so branch snapshots are plain dict
-copies, a banded Levenshtein for SC2153 (fuzz-tested against the
-reference implementation on 20,000 random pairs), and memoizing repeated
-word/command resolution.
+copies, a leaf-node fast path, a banded Levenshtein for SC2153
+(fuzz-tested against the reference implementation on 20,000 random
+pairs), and memoizing repeated word/command resolution. Package import is
+3.6 ms; remaining CLI latency is CPython interpreter startup.
 
 ## Compatibility notes
 

{pureshellcheck-0.2.0 → pureshellcheck-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pureshellcheck"
-version = "0.2.0"
+version = "0.2.2"
 description = "A pure Python reimplementation of ShellCheck's most common checks"
 readme = "README.md"
 requires-python = ">=3.9"

{pureshellcheck-0.2.0 → pureshellcheck-0.2.2}/src/pureshellcheck/__init__.py

@@ -6,7 +6,7 @@ common checks.
 ...     print(finding.line, finding.column, finding.code, finding.message)
 """
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"
 
 from .analyzer import Finding, run_checks  # noqa: F401
 from .parser import ParseError, parse  # noqa: F401

{pureshellcheck-0.2.0 → pureshellcheck-0.2.2}/src/pureshellcheck/analyzer.py

@@ -382,6 +382,8 @@ def apply_directives(findings, directives, nodes, source, positions):
 def run_checks(source, shell=None, include_optional=False,
                filename="<stdin>"):
     """Parse and analyze a script. Returns (findings, parse_error|None)."""
+    if source and source[0] == chr(0xFEFF):
+        source = source[1:]  # tolerate a UTF-8 BOM
     parser = Parser(source)
     try:
         root = parser.parse()

{pureshellcheck-0.2.0 → pureshellcheck-0.2.2}/src/pureshellcheck/cli.py

@@ -1,7 +1,6 @@
 """Command line interface, modeled on shellcheck's."""
 
 import argparse
-import json
 import sys
 
 from . import __version__, run_checks
@@ -19,6 +18,38 @@ COLORS = {
 }
 
 
+_TAKES_ONE = {"-s", "--shell", "-f", "--format", "-e", "--exclude",
+              "-S", "--severity", "-o", "--enable"}
+_COLOR_VALUES = {"auto", "always", "never"}
+
+
+def _reorder(argv):
+    """Let options appear after files, like shellcheck: before Python 3.12,
+    argparse stops recognizing options once positionals begin, so
+    `pureshellcheck foo.sh -f gcc` would fail there. Deterministically sort
+    options to the front."""
+    opts, pos = [], []
+    i, n = 0, len(argv)
+    while i < n:
+        a = argv[i]
+        if a == "--":
+            pos.extend(argv[i + 1:])
+            break
+        if a.startswith("-") and a != "-":
+            take = 2 if a in _TAKES_ONE and i + 1 < n else 1
+            if a in ("-C", "--color") and i + 1 < n \
+                    and argv[i + 1] in _COLOR_VALUES:
+                take = 2
+            opts.extend(argv[i:i + take])
+            i += take
+        else:
+            pos.append(a)
+            i += 1
+    if any(p.startswith("-") and p != "-" for p in pos):
+        pos.insert(0, "--")
+    return opts + pos
+
+
 def parse_args(argv):
     p = argparse.ArgumentParser(
         prog="pureshellcheck",
@@ -45,7 +76,7 @@ def parse_args(argv):
                    help="use color (default: auto)")
     p.add_argument("--version", action="version",
                    version="pureshellcheck %s" % __version__)
-    return p.parse_args(argv)
+    return p.parse_args(_reorder(argv))
 
 
 def parse_excludes(items):
@@ -65,7 +96,9 @@ def check_file(path, args, excluded, min_rank):
         source = sys.stdin.read()
         name = "-"
     else:
-        with open(path, encoding="utf-8", errors="replace") as f:
+        # utf-8-sig: tolerate a UTF-8 BOM, which would otherwise break
+        # shebang detection
+        with open(path, encoding="utf-8-sig", errors="replace") as f:
             source = f.read()
         name = path
     shell = args.shell if args.shell != "busybox" else "ash"
@@ -148,9 +181,11 @@ def main(argv=None):
         else:
             json_items.extend(finding_json(name, f) for f in findings)
     if args.format == "json":
+        import json
         json.dump(json_items, out)
         out.write("\n")
     elif args.format == "json1":
+        import json
         json.dump({"comments": json_items}, out)
         out.write("\n")
     if had_error:

{pureshellcheck-0.2.0 → pureshellcheck-0.2.2}/src/pureshellcheck/parser.py

@@ -22,6 +22,15 @@ END_KEYWORDS = {
 # Characters that terminate an unquoted word.
 METACHARS = " \t\n;&|<>()"
 
+# Cap on nested constructs - subshells "(", command substitutions "$(",
+# brace/arithmetic groups - which re-enter read_command or read_arith_primary.
+# Arithmetic nesting is the most frame-hungry (its precedence chain adds ~15
+# interpreter frames per level), so 40 trips at ~600 frames: comfortably under
+# CPython's default 1000 limit on every platform (including Windows' ~1 MB
+# stack) even from a deep call site, yet far above any real script. Deeply
+# nested input like "$( $( $(" or "(((((" raises a clean ParseError.
+MAX_NESTING = 40
+
 UNQUOTED_RUN = re.compile(r"""[^\\'"$`*?\[\](){}<>|&;\s!#~]+""")
 DQUOTE_RUN = re.compile(r'[^"\\$`]+')
 SQUOTE_END = re.compile(r"'")
@@ -81,6 +90,17 @@ class ParseError(Exception):
         self.code = code
 
 
+class _NestingLimit(Exception):
+    """Raised when input nests deeper than MAX_NESTING. Deliberately NOT a
+    ParseError so the parser's backtracking (which catches ParseError to try
+    alternatives) cannot swallow it; parse() turns it into a ParseError."""
+
+    def __init__(self, message, pos):
+        super().__init__(message)
+        self.message = message
+        self.pos = pos
+
+
 class Directive:
     """A `# shellcheck key=value` comment."""
 
@@ -104,6 +124,11 @@ class Parser:
         self.pending_heredocs = []
         self.directives = []
         self.line_had_command = False
+        # Smallest index from which a glob-class scan reached EOF with no
+        # closing ']' or metachar; from there on every '[' is a literal.
+        # Caps the otherwise O(n^2) rescan on input like "[1,[1,[1,...".
+        self._glob_eof_from = self.n + 1
+        self._nesting = 0  # current compound-command nesting depth
 
     # ------------------------------------------------------------------
     # Low-level helpers
@@ -192,6 +217,13 @@ class Parser:
     # Script / lists
 
     def parse(self):
+        try:
+            return self._parse()
+        except _NestingLimit as e:
+            # Surface the internal depth-limit signal as the public error type.
+            raise ParseError(e.message, e.pos) from None
+
+    def _parse(self):
         shebang = None
         if self.src.startswith("#!"):
             end = self.src.find("\n")
@@ -340,6 +372,20 @@ class Parser:
     # Commands
 
     def read_command(self):
+        # Every nested compound command - subshell, command substitution,
+        # brace/arithmetic group - re-enters here, so this bounds parser
+        # recursion and keeps adversarial input from overflowing the stack.
+        self._nesting += 1
+        if self._nesting > MAX_NESTING:
+            self._nesting -= 1
+            raise _NestingLimit("commands nested too deeply (over %d levels)"
+                                % MAX_NESTING, self.i)
+        try:
+            return self._read_command()
+        finally:
+            self._nesting -= 1
+
+    def _read_command(self):
         self.skip_inline_ws()
         if self.at_end():
             return None
@@ -1366,11 +1412,17 @@ class Parser:
         """Parse [...] as a glob character class, else literal '['."""
         src, n = self.src, self.n
         start = self.i
+        # We already proved the rest of the input has no closing ']' (nor a
+        # metachar) from an earlier '['; this one can't open a class either.
+        if start >= self._glob_eof_from:
+            self.i = start + 1
+            return Node("T_Literal", start, self.i, text="[")
         j = self.i + 1
         if j < n and src[j] in "!^":
             j += 1
         if j < n and src[j] == "]":
             j += 1
+        jumped = False
         while j < n:
             c = src[j]
             if c == "]":
@@ -1384,8 +1436,15 @@ class Parser:
                 if end == -1:
                     break
                 j = end + 2
+                jumped = True
                 continue
             j += 1
+        else:
+            # Reached EOF with no ']' or metachar. Unless a [:class:] jump
+            # skipped over text, no later '[' can find one either - remember
+            # it so the next '[' bails in O(1).
+            if not jumped:
+                self._glob_eof_from = start
         self.i = start + 1
         return Node("T_Literal", start, self.i, text="[")
 
@@ -1842,6 +1901,20 @@ class Parser:
                 return operand
 
     def read_arith_primary(self):
+        # Nested "(...)" in arithmetic re-enters here, a separate recursion
+        # from read_command, so it shares the same nesting guard to keep
+        # "(((((..." / "$((((..." from overflowing the stack.
+        self._nesting += 1
+        if self._nesting > MAX_NESTING:
+            self._nesting -= 1
+            raise _NestingLimit("arithmetic nested too deeply (over %d levels)"
+                                % MAX_NESTING, self.i)
+        try:
+            return self._read_arith_primary()
+        finally:
+            self._nesting -= 1
+
+    def _read_arith_primary(self):
         self.skip_arith_ws()
         start = self.i
         src, n = self.src, self.n

{pureshellcheck-0.2.0 → pureshellcheck-0.2.2}/src/pureshellcheck/shast.py

@@ -82,15 +82,28 @@ def walk(node):
             stack.extend(reversed(children))
 
 
+# Node kinds whose fields can never contain child nodes.
+LEAF_KINDS = frozenset({
+    "T_Literal", "T_SingleQuoted", "T_DollarSingleQuoted", "T_Glob",
+    "TA_Literal", "TA_Empty", "T_IoDuplicate", "TC_Empty",
+})
+
+_EMPTY = ()
+
+
 def set_parents(root):
     """Link parents, cache children, and return all nodes in doc order."""
     nodes = []
     append = nodes.append
     stack = [root]
     pop = stack.pop
+    leaf = LEAF_KINDS
     while stack:
         n = pop()
         append(n)
+        if n.kind in leaf:
+            n.children = _EMPTY
+            continue
         children = []
         add = children.append
         for value in n.fields.values():

{pureshellcheck-0.2.0 → pureshellcheck-0.2.2/src/pureshellcheck.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pureshellcheck
-Version: 0.2.0
+Version: 0.2.2
 Summary: A pure Python reimplementation of ShellCheck's most common checks
 Author: adam2go
 License: MIT
@@ -157,24 +157,25 @@ no process spawn, no binary. A one-line snippet checks in **~40 µs**
 (~25,000 checks/second); throughput on large scripts is ~57k lines/s. CLI
 time is dominated by CPython interpreter startup (~20 ms).
 
-**v0.2.0 vs v0.1.0** (controlled before/after,
+**v0.2.x vs v0.1.0** (controlled before/after,
 `python tools/bench_compare.py`: baseline wheel from PyPI vs this tree in
 the same interpreter, 25–200 in-process repeats, outputs verified
 identical on every workload):
 
-| workload | v0.1.0 | v0.2.0 | improvement |
+| workload | v0.1.0 | v0.2.1 | improvement |
 |---|---|---|---|
-| tiny (1 line) | 0.061 ms | 0.037 ms | 1.6× |
-| small (75 lines) | 2.62 ms | 1.30 ms | 2.0× |
-| medium (263 lines) | 9.46 ms | 4.81 ms | 2.0× |
-| large (1216 lines) | 48.6 ms | 21.3 ms | **2.3×** |
+| tiny (1 line) | 0.058 ms | 0.036 ms | 1.6× |
+| small (75 lines) | 2.44 ms | 1.21 ms | 2.0× |
+| medium (263 lines) | 8.76 ms | 4.48 ms | 2.0× |
+| large (1216 lines) | 46.2 ms | 20.0 ms | **2.3×** |
 
-The v0.2.0 speedups came from caching the AST child/parent structure and a
+The speedups came from caching the AST child/parent structure and a
 document-order node table (one traversal instead of dozens), making
 variable states immutable tuples so branch snapshots are plain dict
-copies, a banded Levenshtein for SC2153 (fuzz-tested against the
-reference implementation on 20,000 random pairs), and memoizing repeated
-word/command resolution.
+copies, a leaf-node fast path, a banded Levenshtein for SC2153
+(fuzz-tested against the reference implementation on 20,000 random
+pairs), and memoizing repeated word/command resolution. Package import is
+3.6 ms; remaining CLI latency is CPython interpreter startup.
 
 ## Compatibility notes