v0.2.0

shell-lsp 0.2.0 adds a command line that drops in where shellcheck and
shfmt ran, Windows support, many more quick fixes, richer completion and
hover, and a round of robustness work: the server now stays within bounded
memory and time on any input, including hostile ones.

Highlights

• shell-lsp check and shell-lsp fmt: check takes ShellCheck's
  options, .shellcheckrc files, output formats (tty, gcc, json, json1,
  checkstyle, diff, quiet, plus SARIF for code scanning) and exit codes, and
  fmt takes shfmt's flags, so both drop into CI and pre-commit hooks and
  report exactly what the editor shows. The repository ships pre-commit
  hooks (docs/cli.md).
• Windows (#31):
  amd64 and arm64 .exe binaries, drive-letter and UNC URIs,
  case-insensitive paths, PATHEXT executable lookup, Bats through Git Bash
  or MSYS2, and a windows-latest CI job. The VS Code extension downloads
  the Windows binary too.
• Quick fixes: 55 check codes now carry fixes, up from 15. Every fix says
  what it does and is marked either safe (keeps the script's behaviour) or
  for review. Fix-all, shellLsp.fixAll and check -f diff apply only the
  safe ones through one pipeline. New actions: add a shebang, remove
  redundant quotes, $[ ] and expr to $(( )), and disable directives for
  SL codes. Edits that touch another file ask for confirmation.
• Completion and hover: test operators, set -o/shopt/setopt
  options, emulate modes, signals and trap conditions, parameter-expansion
  operators and zsh flags and glob qualifiers, array keys, printf
  conversions, case values taken from getopts or earlier comparisons,
  and the flags of builtins, all documented per shell. Idiom snippets at the
  start of a statement, and completions that replace the rest of a word.
• New native checks: SL1005 for downloaded code run unchecked
  (curl … | sh, sh -c "$(curl …)", source <(curl …)), SL2002 for @
  transformations the shell does not know, SL2003 for declarations that
  assign an invalid name
  (docs/rules.md).
• Closer to ShellCheck where ShellCheck is right: three parser bugs that
  cascaded into missed findings are fixed (unknown ${x@op} operators, a #
  after a word inside $(…), invalid declaration names), set, shopt and
  setopt are read as option changes, values inherited from the
  environment stay untrusted, and command -v $x is checked like type $x.

Robustness and security

• Scripts that source /dev/zero, /dev/stdin, a FIFO or a device no longer
  make the server read without bound or hang; sourced files, .editorconfig
  and Bats files are read only when they are regular files, up to a size
  limit, and manual pages decompress to at most 16 MiB.
• Memory leaks fixed in the snapshot, semantic token, diagnostics, workspace,
  editorconfig and manual-page caches, in pending client requests and in
  JSON-RPC buffers. A soak test proves the server returns to its baseline.
• Syntax nested more than 1000 levels deep is rejected instead of
  exhausting the stack, deep nesting lints in linear time and memory, and
  several quadratic paths are gone (a case with 10,000 branches, fix-all
  over tens of thousands of findings, thousands of here-documents).
• Brace sequences at the int64 limits terminate, and the forked parser's
  arithmetic no longer narrows integers (CodeQL clean). Thirteen new fuzz
  targets cover the parser, linter, edits, URIs and command-line parsing.

Install

Release binaries for Linux, macOS and Windows (amd64, arm64) with
SHA256SUMS are attached below. Alternatively
go install github.com/stubbedev/shell-lsp@v0.2.0 or
nix profile install github:stubbedev/shell-lsp. For VS Code, install the
Shell LSP extension, or shell-lsp-0.2.0.vsix below. Editor setup:
docs/editors.md.

Known limitations

• On Windows, stopping a running Bats suite ends bash but may leave its
  child processes running.
• A document using lone carriage returns (classic Mac line endings) can fall
  out of sync after an edit that inserts a line feed right after one.