Skip to content

Make the runtime boundary check count indirect Deno access - #15218

Merged
cderv merged 6 commits into
mainfrom
rt/02d-ratchet-counts-indirect-deno
Oct 28, 2026
Merged

cderv merged 6 commits into
mainfrom
rt/02d-ratchet-counts-indirect-deno

Conversation

@cderv

@cderv cderv commented Oct 28, 2026

Copy link
Copy Markdown
Member

Follow-up to #15153. The runtime boundary check counts Deno access with the regex \bDeno\., so the same access spelled differently goes uncounted: Deno?.errors, globalThis["Deno"]?.errors, or a bare globalThis.Deno assigned to a local binding.
A unit test drafted for the upcoming src/deno_ral/ filesystem layer read (globalThis as any)["Deno"]?.errors only so that the tests count stayed flat. Review caught it; the check could not.

Plan: 02d-ratchet-counts-indirect-deno.md

Fix

The counting regex now also matches three spellings, keyed like direct access so that the kRalDenoReplacements errors (a Deno.* API that src/deno_ral already replaces) apply to them too:

  • Optional chaining: Deno?.errors keys as errors, Deno?.errors?.NotFound as errors.NotFound.
  • Bracket access on globalThis, with any quote, globalThis?.[, or a cast receiver such as (globalThis as any). Requiring the globalThis receiver keeps ["Deno"] in an array or on another object uncounted.
  • A bare globalThis.Deno not followed by an access. globalThis.Deno.cwd() was already counted and still counts once.

typeof Deno, a "Deno" string, DenoKv and myDeno.x stay uncounted. Two unit tests pin the counted and the uncounted spellings.

Left uncounted on purpose: destructuring (const { Deno: d } = globalThis), an alias (const d = Deno), a cast of more than one word ((globalThis as Record<string, unknown>)["Deno"]), and self.Deno. None appears in a counted scope today.
Counting an alias means counting a bare Deno, which also appears in the prose comments the check counts, and a deliberate workaround always finds a spelling a regex misses. The plans' review checklist covers these instead.

Baseline

The stricter count finds three existing lines, each assigning globalThis.Deno to a local binding, so the baseline rises with --accept-increase:

  • src 991 → 992: src/core/lib/external/colors.ts:28
  • resources 10 → 12: the generated src/resources/editor/tools/vs-code.mjs:25954 and src/resources/editor/tools/yaml/web-worker.js:25968

The PR check counts the base branch with this PR's regex, so it reports two main is above tools/runtime-boundary-baseline.json ... not caused by this PR notices for src and resources. They are expected for this PR only: the baseline change here covers both, and the check exits 0 (replayed locally with --against the base commit).

Checklist

I have (if applicable):

  • referenced the GitHub issue this PR closes
  • updated the appropriate changelog in the PR
  • ensured the present test suite passes
  • added new tests
  • created a separate documentation PR in Quarto's website repo and linked it to this PR
AI-assisted PR
  • AI tool used: Claude Code (Sonnet 5.5 for the implementation, Opus 5.5 for the plan and review)
  • Codebase grounding: local clone
  • Human review: I have reviewed, tested, and verified the AI-generated content before submitting.

Note: autonomous AI agents submitting PRs without human oversight are not permitted — see the Code of Conduct.

cderv added 6 commits October 28, 2026 16:25
The ratchet's \bDeno\. pattern misses Deno?.x, globalThis["Deno"] and a bare
globalThis.Deno. PR 09's plan used (globalThis as any)["Deno"]?.errors in a
unit test only to keep the tests count flat, and review caught it; a
mechanical count closes that route for every later PR instead of relying on
review. Measured on main: src +1 (colors.ts) and resources +2 (two generated
editor bundles); no optional-chaining or bracket hit outside the exclusions.
The planned bracket alternative matched any `["Deno"]`, so an array element
(`const names = ["Deno"]`) or another object's property (`obj["Deno"]`) would
have raised a count with no Deno dependency added. The regex now requires a
globalThis receiver (plain, optional `?.[`, or cast `(globalThis as any)`),
and the negative test covers both cases. Checked with a scratch script: the
positive fixture's counts are unchanged, the negatives count nothing, and the
measured baseline impact on main is unaffected (no bracket hits before either).
Four spellings stay uncounted: a cast of more than one word, destructuring
from globalThis, an alias of the bare namespace, and self./window. receivers.
None appears in a counted scope on main. Counting an alias would mean
counting a bare `Deno`, which also appears in prose comments the tool counts,
and a deliberate dodge always finds a spelling a regex misses, so review is
the check for those. Also records the expected "main is above the baseline"
notice the PR check prints because it counts the base tree with the new
regex.
@posit-snyk-bot

posit-snyk-bot commented Oct 28, 2026 •

Copy link
Copy Markdown
Collaborator

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@cderv
cderv merged commit 623cd99 into main Oct 28, 2026
52 checks passed
@cderv
cderv deleted the rt/02d-ratchet-counts-indirect-deno branch October 28, 2026 17:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants