cobolwork 0.4.0

cobolwork 0.4.0: a remediation gate a drafting tool can call, and findings a run can witness.

Install: npm install -g @portll/cobolwork or pip install cobolwork; either gives the command cobolwork. The PyPI package runs the same files with the Node.js on your PATH, which must be Node 22 or later. The npm package is attached here as cobolwork-0.4.0.tgz to pin, and as cobolwork.tgz.

What 0.4.0 adds over 0.3.0:

• The remediation gate has a caller. commitwork's cobolwork-remediate drafts a fix, commits it, gates it with cobolwork gate --head, and stops after three attempts. It was proven end to end on a real corpus finding: the passing draft was lodged for review and not applied. A patch that deletes the flagged statement or its source now fails the gate, because a fix keeps what the program does. explain quotes a statement's every line, and a patch that stops a program compiling gives the gate up to three of the compiler's error lines.
• Fewer paths no run can take. A value a CALL writes back through a parameter now returns only to the call it came in through. Path findings fell from 3,659 to 1,950 on 500 random repositories and from 1,506 to 1,214 on 500 recently active ones. Every removed path that was sampled sent input from one caller out through another caller's argument.
• A COPY of a mapset the tree holds only as BMS source reads the symbolic map BMS would generate. The map's input fields are then declared items, and RECEIVE MAP is a terminal source on them.
• fixAt names the input field a STRING folded into the statement an operation runs, such as an SQL statement or a command, so the check goes where the value enters.
• Findings from runs, under a new evidence kind, execution. Abends that ironwork's fuzzing kept (S0C7, S0C4 and SSRANGE's subscript and reference-modification failures) are findings with the input that caused them, read from COBOLWORK_ABENDS. A COBOLWORK_WITNESS result may cite the ironwork run that reproduced it, and confirms a finding only where that run's verified journal shows it at the finding's file and line.
• Crafted input cannot slow a scan. A long line of trailing blanks, a padded directive, and a >>DEFINE body with a stray line break are each read in linear time. One 150 KB line held a scan for 63 s before.

Source from git and PDS exports, on the roadmap for 0.4.0, shipped early in 0.2.150.

The package's lib/revision.json names the commit it was built from, 371041f.

Summary

A fixing tool can call the gate, and findings can come from runs.

• commitwork’s cobolwork-remediate drafts a fix, gates it with cobolwork gate --head, and stops after three attempts.
• A patch that deletes the flagged statement or its source fails the gate, because a fix keeps what the program does.
• explain quotes every line of a statement, and a patch that stops a program compiling gives the gate up to three of the compiler’s error lines.
• A value a CALL writes back returns only to the call it came in by, so path findings fell from 3,659 to 1,950 on 500 random repositories.
• Abends ironwork’s fuzzing kept are findings, with the input that caused them.
• A COPY of a mapset held only as BMS source reads the symbolic map.
• Crafted input cannot slow a scan.