New The compiler runs today: check, explain, manifest, build, run →

Less than you asked for, on purpose.

A language for scripts that agents write and people run. Every program starts with a needs list of what it may touch, and the compiler and a WebAssembly sandbox hold it to that list.

Get started

fix.sub

// Test, report, push, announce.
needs [
  read  [./src],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  write [./src],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  run   ["npm test"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  write [./src],
  run   ["npm test"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  run   ["git push"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  write [./src],
  run   ["git push"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  run   ["npm test", "git push"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  write [./src],
  run   ["npm test", "git push"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  net   ["api.github.com:443"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  write [./src],
  net   ["api.github.com:443"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  run   ["npm test"],
  net   ["api.github.com:443"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  write [./src],
  run   ["npm test"],
  net   ["api.github.com:443"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  run   ["git push"],
  net   ["api.github.com:443"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  write [./src],
  run   ["git push"],
  net   ["api.github.com:443"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  run   ["npm test", "git push"],
  net   ["api.github.com:443"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

// Test, report, push, announce.
needs [
  read  [./src],
  write [./src],
  run   ["npm test", "git push"],
  net   ["api.github.com:443"],
]

let last = read(./src/report.txt) or ""
let t = run("npm test")
if (t.failed) {
  write(./src/report.txt, t.output)
  run("git push")
  fetch("https://api.github.com/status")
}

Edit the needs block on the left, the real compiler answers

write [./src]run ["npm test"]run ["git push"]net ["api.github.com:443"]

4 errors: beyond its needs

error[E0201]: `run("npm test")` is not allowed by `needs`
 --> fix.sub:7:9
  |
7 | let t = run("npm test")
  |         ^^^^^^^^^^^^^^^ this command is not in the run list
  = help: add `run ["npm test"]` to the `needs` block at the top of the file, or remove the call

error[E0201]: `write(./src/report.txt, t.output)` is not allowed by `needs`
 --> fix.sub:9:3
  |
9 |   write(./src/report.txt, t.output)
  |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ./src/report.txt is not covered by `needs`
  = help: add `write [./src/report.txt]` to the `needs` block at the top of the file, or remove the call (`write` does not include `read`, and `read` does not include `write`)

error[E0201]: `run("git push")` is not allowed by `needs`
  --> fix.sub:10:3
   |
10 |   run("git push")
   |   ^^^^^^^^^^^^^^^ this command is not in the run list
   = help: add `run ["git push"]` to the `needs` block at the top of the file, or remove the call

error[E0201]: `fetch("https://api.github.com/status")` is not allowed by `needs`
  --> fix.sub:11:3
   |
11 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ api.github.com:443 is not covered by `needs`
   = help: add `net ["api.github.com:443"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
 --> fix.sub:9:3
  |
9 |   write(./src/report.txt, t.output)
  |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:11:3
   |
11 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 4 errors found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

3 errors: beyond its needs

error[E0201]: `run("npm test")` is not allowed by `needs`
 --> fix.sub:8:9
  |
8 | let t = run("npm test")
  |         ^^^^^^^^^^^^^^^ this command is not in the run list
  = help: add `run ["npm test"]` to the `needs` block at the top of the file, or remove the call

error[E0201]: `run("git push")` is not allowed by `needs`
  --> fix.sub:11:3
   |
11 |   run("git push")
   |   ^^^^^^^^^^^^^^^ this command is not in the run list
   = help: add `run ["git push"]` to the `needs` block at the top of the file, or remove the call

error[E0201]: `fetch("https://api.github.com/status")` is not allowed by `needs`
  --> fix.sub:12:3
   |
12 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ api.github.com:443 is not covered by `needs`
   = help: add `net ["api.github.com:443"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:10:3
   |
10 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:12:3
   |
12 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 3 errors found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

3 errors: beyond its needs

error[E0201]: `write(./src/report.txt, t.output)` is not allowed by `needs`
  --> fix.sub:10:3
   |
10 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ./src/report.txt is not covered by `needs`
   = help: add `write [./src/report.txt]` to the `needs` block at the top of the file, or remove the call (`write` does not include `read`, and `read` does not include `write`)

error[E0201]: `run("git push")` is not allowed by `needs`
  --> fix.sub:11:3
   |
11 |   run("git push")
   |   ^^^^^^^^^^^^^^^ this command is not in the run list
   = help: add `run ["git push"]` to the `needs` block at the top of the file, or remove the call

error[E0201]: `fetch("https://api.github.com/status")` is not allowed by `needs`
  --> fix.sub:12:3
   |
12 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ api.github.com:443 is not covered by `needs`
   = help: add `net ["api.github.com:443"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:10:3
   |
10 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:12:3
   |
12 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 3 errors found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

2 errors: beyond its needs

error[E0201]: `run("git push")` is not allowed by `needs`
  --> fix.sub:12:3
   |
12 |   run("git push")
   |   ^^^^^^^^^^^^^^^ this command is not in the run list
   = help: add `run ["git push"]` to the `needs` block at the top of the file, or remove the call

error[E0201]: `fetch("https://api.github.com/status")` is not allowed by `needs`
  --> fix.sub:13:3
   |
13 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ api.github.com:443 is not covered by `needs`
   = help: add `net ["api.github.com:443"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:11:3
   |
11 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:13:3
   |
13 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 2 errors found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

3 errors: beyond its needs

error[E0201]: `run("npm test")` is not allowed by `needs`
 --> fix.sub:8:9
  |
8 | let t = run("npm test")
  |         ^^^^^^^^^^^^^^^ this command is not in the run list
  = help: add `run ["npm test"]` to the `needs` block at the top of the file, or remove the call

error[E0201]: `write(./src/report.txt, t.output)` is not allowed by `needs`
  --> fix.sub:10:3
   |
10 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ./src/report.txt is not covered by `needs`
   = help: add `write [./src/report.txt]` to the `needs` block at the top of the file, or remove the call (`write` does not include `read`, and `read` does not include `write`)

error[E0201]: `fetch("https://api.github.com/status")` is not allowed by `needs`
  --> fix.sub:12:3
   |
12 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ api.github.com:443 is not covered by `needs`
   = help: add `net ["api.github.com:443"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:10:3
   |
10 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:12:3
   |
12 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 3 errors found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

2 errors: beyond its needs

error[E0201]: `run("npm test")` is not allowed by `needs`
 --> fix.sub:9:9
  |
9 | let t = run("npm test")
  |         ^^^^^^^^^^^^^^^ this command is not in the run list
  = help: add `run ["npm test"]` to the `needs` block at the top of the file, or remove the call

error[E0201]: `fetch("https://api.github.com/status")` is not allowed by `needs`
  --> fix.sub:13:3
   |
13 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ api.github.com:443 is not covered by `needs`
   = help: add `net ["api.github.com:443"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:11:3
   |
11 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:13:3
   |
13 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 2 errors found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

2 errors: beyond its needs

error[E0201]: `write(./src/report.txt, t.output)` is not allowed by `needs`
  --> fix.sub:10:3
   |
10 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ./src/report.txt is not covered by `needs`
   = help: add `write [./src/report.txt]` to the `needs` block at the top of the file, or remove the call (`write` does not include `read`, and `read` does not include `write`)

error[E0201]: `fetch("https://api.github.com/status")` is not allowed by `needs`
  --> fix.sub:12:3
   |
12 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ api.github.com:443 is not covered by `needs`
   = help: add `net ["api.github.com:443"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:10:3
   |
10 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:12:3
   |
12 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 2 errors found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

1 error: beyond its needs

error[E0201]: `fetch("https://api.github.com/status")` is not allowed by `needs`
  --> fix.sub:13:3
   |
13 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ api.github.com:443 is not covered by `needs`
   = help: add `net ["api.github.com:443"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:11:3
   |
11 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:13:3
   |
13 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 1 error found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

3 errors: beyond its needs

error[E0201]: `run("npm test")` is not allowed by `needs`
 --> fix.sub:8:9
  |
8 | let t = run("npm test")
  |         ^^^^^^^^^^^^^^^ this command is not in the run list
  = help: add `run ["npm test"]` to the `needs` block at the top of the file, or remove the call

error[E0201]: `write(./src/report.txt, t.output)` is not allowed by `needs`
  --> fix.sub:10:3
   |
10 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ./src/report.txt is not covered by `needs`
   = help: add `write [./src/report.txt]` to the `needs` block at the top of the file, or remove the call (`write` does not include `read`, and `read` does not include `write`)

error[E0201]: `run("git push")` is not allowed by `needs`
  --> fix.sub:11:3
   |
11 |   run("git push")
   |   ^^^^^^^^^^^^^^^ this command is not in the run list
   = help: add `run ["git push"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:10:3
   |
10 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:12:3
   |
12 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 3 errors found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

2 errors: beyond its needs

error[E0201]: `run("npm test")` is not allowed by `needs`
 --> fix.sub:9:9
  |
9 | let t = run("npm test")
  |         ^^^^^^^^^^^^^^^ this command is not in the run list
  = help: add `run ["npm test"]` to the `needs` block at the top of the file, or remove the call

error[E0201]: `run("git push")` is not allowed by `needs`
  --> fix.sub:12:3
   |
12 |   run("git push")
   |   ^^^^^^^^^^^^^^^ this command is not in the run list
   = help: add `run ["git push"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:11:3
   |
11 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:13:3
   |
13 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 2 errors found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

2 errors: beyond its needs

error[E0201]: `write(./src/report.txt, t.output)` is not allowed by `needs`
  --> fix.sub:11:3
   |
11 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ./src/report.txt is not covered by `needs`
   = help: add `write [./src/report.txt]` to the `needs` block at the top of the file, or remove the call (`write` does not include `read`, and `read` does not include `write`)

error[E0201]: `run("git push")` is not allowed by `needs`
  --> fix.sub:12:3
   |
12 |   run("git push")
   |   ^^^^^^^^^^^^^^^ this command is not in the run list
   = help: add `run ["git push"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:11:3
   |
11 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:13:3
   |
13 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 2 errors found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

1 error: beyond its needs

error[E0201]: `run("git push")` is not allowed by `needs`
  --> fix.sub:13:3
   |
13 |   run("git push")
   |   ^^^^^^^^^^^^^^^ this command is not in the run list
   = help: add `run ["git push"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:12:3
   |
12 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:14:3
   |
14 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 1 error found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

2 errors: beyond its needs

error[E0201]: `run("npm test")` is not allowed by `needs`
 --> fix.sub:9:9
  |
9 | let t = run("npm test")
  |         ^^^^^^^^^^^^^^^ this command is not in the run list
  = help: add `run ["npm test"]` to the `needs` block at the top of the file, or remove the call

error[E0201]: `write(./src/report.txt, t.output)` is not allowed by `needs`
  --> fix.sub:11:3
   |
11 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ./src/report.txt is not covered by `needs`
   = help: add `write [./src/report.txt]` to the `needs` block at the top of the file, or remove the call (`write` does not include `read`, and `read` does not include `write`)

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:11:3
   |
11 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:13:3
   |
13 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 2 errors found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

1 error: beyond its needs

error[E0201]: `run("npm test")` is not allowed by `needs`
  --> fix.sub:10:9
   |
10 | let t = run("npm test")
   |         ^^^^^^^^^^^^^^^ this command is not in the run list
   = help: add `run ["npm test"]` to the `needs` block at the top of the file, or remove the call

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:12:3
   |
12 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:14:3
   |
14 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 1 error found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

1 error: beyond its needs

error[E0201]: `write(./src/report.txt, t.output)` is not allowed by `needs`
  --> fix.sub:11:3
   |
11 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ./src/report.txt is not covered by `needs`
   = help: add `write [./src/report.txt]` to the `needs` block at the top of the file, or remove the call (`write` does not include `read`, and `read` does not include `write`)

warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:11:3
   |
11 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:13:3
   |
13 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

error: 1 error found and 2 warnings

sub explain needs a script that checks. Fix the errors first.

Every call is allowed

ok: fix.sub: 5 permission uses (5 allowed, 0 checked when it runs), 2 warnings
warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:12:3
   |
12 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:14:3
   |
14 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

2 warnings (no errors)

fix.sub

It can:
├─ can read files
│     ./src   and everything below it
├─ can write files
│     ./src   and everything below it
├─ can run programs
│     git push   and any arguments after it
│     npm test   and any arguments after it
├─ can reach the network
│     api.github.com   port 443 only
└─ cannot
      read environment variables, read the clock, or use random numbers

The calls it makes:
  line  9   read(./src/report.txt)                   allowed by `./src`
  line 10   run("npm test")                          allowed by `npm test`
  line 12   write(./src/report.txt, t.output)        allowed by `./src`
  line 13   run("git push")                          allowed by `git push`
  line 14   fetch("https://api.github.com/status")   allowed by `api.github.com:443`
warning[W0603]: the failure of this call is ignored (IoError): if it fails, nothing says so
  --> fix.sub:12:3
   |
12 |   write(./src/report.txt, t.output)
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

warning[W0603]: the failure of this call is ignored (NetworkError): if it fails, nothing says so
  --> fix.sub:14:3
   |
14 |   fetch("https://api.github.com/status")
   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: add `?` to stop here when it fails, or `or { ... }` to say what to do

2 warnings (no errors)

Output of sub check and sub explain, computed for all 16 combinations when this page was built.

Everything a script may do, on one screen.

The pieces below are the compiler's real output for examples/fix_tests.sub, not mock-ups.

A plain list of permissions

Missing means none. Reviewable in five seconds.

needs [
  read  [./src],
  write [./src],
  run   ["npm test", "git commit -m *"],
]

The error says the fix

Go past the list and the compiler stops, with the line and the change to make.

error[E0201]: `run("git push")` is not allowed by `needs`
  --> fix.sub:12:3
   |
12 |   run("git push")
   |   ^^^^^^^^^^^^^^^ this command is not in the run list
   = help: add `run ["git push"]` to the `needs` block at the top of the file, or remove the call

What it can and cannot do

sub explain in plain words, for the person who approves.

It can:
├─ can read files
│     ./src   and everything below it
├─ can write files
│     ./src   and everything below it
├─ can run programs
│     git add ./src     and any arguments after it
│     git commit -m *   exactly these arguments (a * is any one word)
│     npm test          and any arguments after it
└─ cannot
      use the network, read environment variables, read the clock, or use random numbers

One question, asked once

The run prompt shows the list. "Always" saves its hash, so an edited script asks again.

fix_tests.sub wants to

read and write ./src
run npm test, git add, git commit

Allow onceAlwaysDeny

A manifest tools can read

sub manifest: JSON with a hash. Centcom can approve it without parsing code.

{
  "format": "subtype-manifest/1",
  "needs": {
    "read": [
      "./src"
    ],
    "write": [
      "./src"
    ],
    "run": [
      "git add ./src",
      "git commit -m *",
      "npm test"
    ],
    "net": [],
    "env": [],
    "clock": false,
    "random": false
  },
  "hash": "sha256:a0e428abda7f95f…"
}

Less is a subtype

A function may ask for less than its caller holds. Never more.

write [.]⊃ write [./src]⊃ write [./src/lib]run ["git"]⊃ run ["git status"]

Two walls, one list.

The same needs block is checked by two different programs, so a mistake in one does not become a hole.

Start with one script.

$ git clone <the repository> && cd subtype
$ cargo build
$ target/debug/sub explain examples/fix_tests.sub
$ target/debug/sub run examples/todo_report.sub

Read the quickstart See the roadmap