1package shell
2
3import (
4 "bytes"
5 "context"
6 "fmt"
7 "io"
8 "os"
9 "strings"
10 "sync/atomic"
11
12 "mvdan.cc/sh/v3/expand"
13 "mvdan.cc/sh/v3/interp"
14 "mvdan.cc/sh/v3/syntax"
15)
16
17// maxInnerStderrBytes bounds how much stderr from a failing $(...) is
18// surfaced in the returned error, to avoid leaking a secret that happened
19// to be embedded in a failing inner command.
20const maxInnerStderrBytes = 512
21
22// NoUnset controls whether ExpandValue treats unset variables as an
23// error. Default false matches bash: $UNSET expands to "". Store true
24// to re-enable strict mode globally. Not exposed in crush.json; this is
25// an internal escape hatch in case the lenient default turns out to be
26// the wrong call.
27//
28// Declared atomic because ExpandValue is invoked concurrently (multiple
29// MCP / LSP / provider loads in flight at startup, hook execution, etc.)
30// and an unsynchronised read/write pair is a data race under the Go
31// memory model regardless of test-level happens-before reasoning. The
32// atomic load on the hot path is negligible against the cost of parsing
33// and running through mvdan.
34var NoUnset atomic.Bool
35
36// ExpandValue expands shell-style substitutions in a single config value.
37//
38// Supported constructs match the bash tool:
39//
40// - $VAR and ${VAR}.
41// - ${VAR:-default} / ${VAR:+alt} / ${VAR:?msg}.
42// - $(command) with full quoting and nesting.
43// - escaped and quoted strings ("...", '...').
44//
45// Contract:
46//
47// - Returns exactly one string. No field splitting, no globbing, no
48// pathname generation. Multi-word command output is preserved
49// verbatim; it is never split into multiple values.
50// - Nounset is off by default, matching bash: unset variables expand
51// to "". Opt in to strict behaviour per-reference with
52// ${VAR:?msg}, which errors loudly when VAR is unset regardless of
53// the global toggle. Flip the global default via
54// shell.NoUnset.Store(true) as an internal escape hatch.
55// - Embedded whitespace and newlines in the input are preserved
56// verbatim. Command substitution strips trailing newlines only
57// (POSIX), never leading or internal whitespace.
58// - Errors wrap the failing inner command's exit code and a bounded
59// prefix of its stderr. Callers that surface the error to users
60// should additionally scrub it for the original template text.
61func ExpandValue(ctx context.Context, value string, env []string) (string, error) {
62 // Parse the value as a here-doc style word: no word splitting, no
63 // globbing, but full support for $VAR, ${VAR...}, $(...), and
64 // quoted/escaped strings.
65 word, err := syntax.NewParser().Document(strings.NewReader(value))
66 if err != nil {
67 return "", fmt.Errorf("parse: %w", err)
68 }
69
70 // Build a minimal Shell value purely to reuse its handler chain
71 // (builtins, block funcs, optional Go coreutils) inside $(...).
72 // We deliberately skip NewShell so the passed-in env is used
73 // verbatim, with no CRUSH/AGENT/AI_AGENT injection: callers of
74 // ExpandValue control the env, and nounset must treat any name
75 // not in env as unset.
76 cwd, _ := os.Getwd()
77 s := &Shell{
78 cwd: cwd,
79 env: env,
80 logger: noopLogger{},
81 }
82
83 strict := NoUnset.Load()
84
85 var stderrBuf bytes.Buffer
86 cfg := &expand.Config{
87 Env: expand.ListEnviron(env...),
88 NoUnset: strict,
89 CmdSubst: func(w io.Writer, cs *syntax.CmdSubst) error {
90 stderrBuf.Reset()
91 runnerOpts := []interp.RunnerOption{
92 interp.StdIO(nil, w, &stderrBuf),
93 interp.Interactive(false),
94 interp.Env(expand.ListEnviron(env...)),
95 interp.Dir(s.cwd),
96 interp.ExecHandlers(standardHandlers(s.blockFuncs)...),
97 }
98 if strict {
99 // Match the outer NoUnset: an unset $VAR inside
100 // $(...) is also an error, not a silent empty.
101 runnerOpts = append(runnerOpts, interp.Params("-u"))
102 }
103 runner, rerr := interp.New(runnerOpts...)
104 if rerr != nil {
105 return rerr
106 }
107 if rerr := runner.Run(ctx, &syntax.File{Stmts: cs.Stmts}); rerr != nil {
108 return wrapCmdSubstErr(rerr, stderrBuf.Bytes())
109 }
110 return nil
111 },
112 // ReadDir / ReadDir2 left nil: globbing is disabled.
113 }
114
115 return expand.Document(cfg, word)
116}
117
118// wrapCmdSubstErr attaches a bounded prefix of the inner command's stderr
119// to the original error, if any.
120func wrapCmdSubstErr(err error, stderrBytes []byte) error {
121 msg := sanitizeStderr(stderrBytes)
122 if msg == "" {
123 return err
124 }
125 return fmt.Errorf("%w: %s", err, msg)
126}
127
128// sanitizeStderr trims, bounds, and scrubs non-printable bytes from the
129// stderr of a failing command so the result is safe to include in an
130// error message shown to the user.
131func sanitizeStderr(b []byte) string {
132 b = bytes.TrimRight(b, "\n")
133 if len(b) > maxInnerStderrBytes {
134 b = b[:maxInnerStderrBytes]
135 }
136 out := make([]byte, len(b))
137 for i, c := range b {
138 if c == '\t' || c == '\n' || (c >= 0x20 && c < 0x7f) {
139 out[i] = c
140 } else {
141 out[i] = '?'
142 }
143 }
144 return string(out)
145}