chore: release 0.1.9

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.9] - 2026-01-09
+
+### Changed
+
+- Updated pragmatica-lite dependency: 0.9.0 → 0.9.10
+
 ## [0.1.8] - 2025-12-31
 
 ### Changed

CLAUDE.md

@@ -2,6 +2,10 @@
 
 ## Project Status: FEATURE COMPLETE
 
+## Agent Usage
+
+**IMPORTANT:** Use ONLY `jbct-coder` agent for ALL coding and fixing tasks in this project.
+
 ## Overview
 
 Java implementation of PEG (Parsing Expression Grammar) parser inspired by [cpp-peglib](https://github.com/yhirose/cpp-peglib).
@@ -144,7 +148,7 @@ Sum <- Number '+' Number { return (Integer)$1 + (Integer)$2; }
 - [x] Advanced error recovery with Rust-style diagnostics
 - [x] Generated parser ErrorReporting (BASIC/ADVANCED) for optional Rust-style diagnostics
 - [x] Cut operator (^/↑) - commits to current choice, prevents backtracking
-- [x] 305 passing tests
+- [x] 308 passing tests
 
 ### Remaining Work
 - [ ] Performance optimization
@@ -285,7 +289,7 @@ error: unexpected input
 ### Recovery Points
 Parser recovers at: `,`, `;`, `}`, `)`, `]`, newline
 
-## Test Coverage (305 tests)
+## Test Coverage (308 tests)
 
 ### Grammar Parser Tests (17 tests)
 - Simple rules, actions, sequences, choices
@@ -415,6 +419,6 @@ The `Keyword` rule should only include hard keywords. Contextual keywords are ma
 
 ```bash
 mvn compile          # Compile
-mvn test             # Run tests (268 passing)
+mvn test             # Run tests (308 passing)
 mvn verify           # Full verification
 ```

README.md

@@ -22,7 +22,7 @@ A PEG (Parsing Expression Grammar) parser library for Java, inspired by [cpp-peg
 <dependency>
     <groupId>org.pragmatica-lite</groupId>
     <artifactId>peglib</artifactId>
-    <version>0.1.8</version>
+    <version>0.1.9</version>
 </dependency>
 ```
 

pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>org.pragmatica-lite</groupId>
     <artifactId>peglib</artifactId>
-    <version>0.1.8</version>
+    <version>0.1.9</version>
     <packaging>jar</packaging>
 
     <name>Peglib</name>
@@ -38,7 +38,7 @@
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <maven.compiler.release>25</maven.compiler.release>
-        <pragmatica-lite.version>0.9.0</pragmatica-lite.version>
+        <pragmatica-lite.version>0.9.10</pragmatica-lite.version>
     </properties>
 
     <dependencies>

src/main/java/org/pragmatica/peg/action/ActionCompiler.java

@@ -1,5 +1,6 @@
 package org.pragmatica.peg.action;
 
+import org.pragmatica.lang.Option;
 import org.pragmatica.lang.Result;
 import org.pragmatica.peg.error.ParseError;
 import org.pragmatica.peg.grammar.Grammar;
@@ -21,12 +22,20 @@
 /**
  * Compiles inline Java actions from grammar rules.
  * Uses the JDK Compiler API for runtime compilation.
+ *
+ * <p><strong>Security Note:</strong> This class compiles and executes arbitrary Java code
+ * provided in grammar action blocks. Only use with trusted grammar sources. Never compile
+ * actions from untrusted user input as this enables arbitrary code execution.
+ *
+ * <p>For sandboxed execution of untrusted grammars, use source generation mode
+ * ({@link org.pragmatica.peg.generator.ParserGenerator}) and review generated code
+ * before compilation.
  */
 public final class ActionCompiler {
-    private static final AtomicInteger COUNTER = new AtomicInteger(0);
     private static final String PACKAGE = "org.pragmatica.peg.action.generated";
 
     private final ClassLoader parentLoader;
+    private final AtomicInteger counter = new AtomicInteger(0);
 
     private ActionCompiler(ClassLoader parentLoader) {
         this.parentLoader = parentLoader;
@@ -50,8 +59,8 @@ public Result<Map<String, Action>> compileGrammar(Grammar grammar) {
         for (var rule : grammar.rules()) {
             if (rule.hasAction()) {
                 var result = compileAction(rule);
-                if (result.isFailure()) {
-                    return result.fold(Result::failure, _ -> null);
+                if (result instanceof Result.Failure< ? > f) {
+                    return Result.failure(f.cause());
                 }
                 actions.put(rule.name(), result.unwrap());
             }
@@ -82,7 +91,7 @@ public Result<Action> compileAction(Rule rule) {
      * Compile action code string.
      */
     public Result<Action> compileActionCode(String ruleName, String actionCode, SourceLocation location) {
-        var className = "Action_" + sanitize(ruleName) + "_" + COUNTER.incrementAndGet();
+        var className = "Action_" + sanitize(ruleName) + "_" + counter.incrementAndGet();
         var fullClassName = PACKAGE + "." + className;
         // Transform action code: $0 -> sv.token(), $1 -> sv.get(0), etc.
         var transformedCode = transformActionCode(actionCode);
@@ -146,17 +155,16 @@ private Result<Action> compileAndLoad(String className, String sourceCode, Sourc
             return Result.failure(new ParseError.SemanticError(
             location, "No Java compiler available. Run with JDK, not JRE."));
         }
-        var fileManager = new InMemoryFileManager(
-        compiler.getStandardFileManager(null, null, null));
-        var sourceFile = new StringJavaFileObject(className, sourceCode);
-        var diagnostics = new StringWriter();
-        var task = compiler.getTask(
-        diagnostics, fileManager, null, List.of("--release", "25"), null, List.of(sourceFile));
-        if (!task.call()) {
-            return Result.failure(new ParseError.SemanticError(
-            location, "Action compilation failed: " + diagnostics));
-        }
-        try{
+        try (var standardFileManager = compiler.getStandardFileManager(null, null, null)) {
+            var fileManager = new InMemoryFileManager(standardFileManager);
+            var sourceFile = new StringJavaFileObject(className, sourceCode);
+            var diagnostics = new StringWriter();
+            var task = compiler.getTask(
+            diagnostics, fileManager, null, List.of("--release", "25"), null, List.of(sourceFile));
+            if (!task.call()) {
+                return Result.failure(new ParseError.SemanticError(
+                location, "Action compilation failed: " + diagnostics));
+            }
             var classLoader = new InMemoryClassLoader(fileManager, parentLoader);
             var actionClass = classLoader.loadClass(className);
             var action = (Action) actionClass.getDeclaredConstructor()
@@ -228,11 +236,9 @@ public JavaFileObject getJavaFileForOutput(Location location,
             return fileObject;
         }
 
-        byte[] getClassBytes(String className) {
-            var file = classFiles.get(className);
-            return file != null
-                   ? file.getBytes()
-                   : null;
+        Option<byte[] > getClassBytes(String className) {
+            return Option.option(classFiles.get(className))
+                         .map(ByteArrayJavaFileObject::getBytes);
         }
     }
 
@@ -246,10 +252,11 @@ private static class InMemoryClassLoader extends ClassLoader {
 
         @Override
         protected Class< ? > findClass(String name) throws ClassNotFoundException {
-            var bytes = fileManager.getClassBytes(name);
-            if (bytes == null) {
+            var bytesOpt = fileManager.getClassBytes(name);
+            if (bytesOpt.isEmpty()) {
                 throw new ClassNotFoundException(name);
             }
+            var bytes = bytesOpt.unwrap();
             return defineClass(name, bytes, 0, bytes.length);
         }
     }

src/main/java/org/pragmatica/peg/action/SemanticValues.java

@@ -1,6 +1,8 @@
 package org.pragmatica.peg.action;
 
 import org.pragmatica.lang.Option;
+import org.pragmatica.lang.Result;
+import org.pragmatica.lang.parse.Number;
 import org.pragmatica.peg.tree.SourceSpan;
 
 import java.util.List;
@@ -60,6 +62,30 @@ public double toDouble() {
         return Double.parseDouble(matchedText.trim());
     }
 
+    /**
+     * Parse matched text as integer safely.
+     * Returns Result with parsed value or parsing error.
+     */
+    public Result<Integer> toIntSafe() {
+        return Number.parseInt(matchedText.trim());
+    }
+
+    /**
+     * Parse matched text as long safely.
+     * Returns Result with parsed value or parsing error.
+     */
+    public Result<Long> toLongSafe() {
+        return Number.parseLong(matchedText.trim());
+    }
+
+    /**
+     * Parse matched text as double safely.
+     * Returns Result with parsed value or parsing error.
+     */
+    public Result<Double> toDoubleSafe() {
+        return Number.parseDouble(matchedText.trim());
+    }
+
     /**
      * Get source span of the match.
      */
@@ -141,9 +167,10 @@ public <T> Option<T> getOpt(int index) {
 
     /**
      * Get all child values.
+     * Returns a defensive copy to preserve immutability.
      */
     public List<Object> values() {
-        return values;
+        return List.copyOf(values);
     }
 
     /**

src/main/java/org/pragmatica/peg/generator/ParserGenerator.java

@@ -9,6 +9,9 @@
  * The generated parser depends only on pragmatica-lite:core.
  */
 public final class ParserGenerator {
+    private static final int INITIAL_BUFFER_SIZE = 32_000;
+    private static final int MAX_RECURSION_DEPTH = 100;
+
     // Shared generated code fragments
     private static final String MATCHES_WORD_METHOD = """
             private boolean matchesWord(String word, boolean caseInsensitive) {
@@ -113,7 +116,7 @@ public static ParserGenerator create(Grammar grammar,
     }
 
     public String generate() {
-        var sb = new StringBuilder();
+        var sb = new StringBuilder(INITIAL_BUFFER_SIZE);
         generatePackage(sb);
         generateImports(sb);
         generateClassStart(sb);
@@ -130,7 +133,7 @@ public String generate() {
      * The generated parser preserves all source information including whitespace and comments.
      */
     public String generateCst() {
-        var sb = new StringBuilder();
+        var sb = new StringBuilder(INITIAL_BUFFER_SIZE);
         generatePackage(sb);
         generateCstImports(sb);
         generateCstClassStart(sb);
@@ -380,6 +383,9 @@ private void generateExpressionCode(StringBuilder sb,
                                         String resultVar,
                                         int indent,
                                         int[] counter) {
+        if (indent > MAX_RECURSION_DEPTH) {
+            throw new IllegalStateException("Grammar expression nesting exceeds maximum depth of " + MAX_RECURSION_DEPTH);
+        }
         var pad = "    ".repeat(indent);
         int id = counter[0]++ ;
         // Get unique ID for this expression
@@ -2111,6 +2117,9 @@ private void generateCstExpressionCode(StringBuilder sb,
                                            boolean addToChildren,
                                            int[] counter,
                                            boolean inWhitespaceRule) {
+        if (indent > MAX_RECURSION_DEPTH) {
+            throw new IllegalStateException("Grammar expression nesting exceeds maximum depth of " + MAX_RECURSION_DEPTH);
+        }
         var pad = "    ".repeat(indent);
         var id = counter[0]++ ;
         // Get unique ID for this expression

src/main/java/org/pragmatica/peg/grammar/GrammarLexer.java

@@ -10,6 +10,9 @@
  * Lexer for PEG grammar syntax.
  */
 public final class GrammarLexer {
+    private static final int MAX_INPUT_SIZE = 1_000_000;
+    private static final int DEFAULT_TOKEN_CAPACITY = 32;
+
     private final String input;
     private int pos;
     private int line;
@@ -23,6 +26,10 @@ private GrammarLexer(String input) {
     }
 
     public static List<GrammarToken> tokenize(String input) {
+        if (input.length() > MAX_INPUT_SIZE) {
+            throw new IllegalArgumentException(
+            "Grammar input exceeds maximum size of " + MAX_INPUT_SIZE + " characters");
+        }
         return new GrammarLexer(input).tokenizeAll();
     }
 
@@ -75,7 +82,7 @@ private GrammarToken nextToken() {
     }
 
     private GrammarToken scanIdentifier(SourceLocation start) {
-        var sb = new StringBuilder();
+        var sb = new StringBuilder(DEFAULT_TOKEN_CAPACITY);
         while (!isAtEnd() && isIdentifierPart(peek())) {
             sb.append(advance());
         }
@@ -85,7 +92,7 @@ private GrammarToken scanIdentifier(SourceLocation start) {
     private GrammarToken scanDirective(SourceLocation start) {
         advance();
         // skip %
-        var sb = new StringBuilder();
+        var sb = new StringBuilder(DEFAULT_TOKEN_CAPACITY);
         while (!isAtEnd() && isIdentifierPart(peek())) {
             sb.append(advance());
         }
@@ -94,7 +101,7 @@ private GrammarToken scanDirective(SourceLocation start) {
 
     private GrammarToken scanStringLiteral(SourceLocation start) {
         char quote = advance();
-        var sb = new StringBuilder();
+        var sb = new StringBuilder(DEFAULT_TOKEN_CAPACITY);
         while (!isAtEnd() && peek() != quote) {
             if (peek() == '\\' && pos + 1 < input.length()) {
                 advance();
@@ -125,7 +132,7 @@ private GrammarToken scanCharClass(SourceLocation start) {
             negated = true;
             advance();
         }
-        var sb = new StringBuilder();
+        var sb = new StringBuilder(DEFAULT_TOKEN_CAPACITY);
         while (!isAtEnd() && peek() != ']') {
             if (peek() == '\\' && pos + 1 < input.length()) {
                 advance();
@@ -163,7 +170,7 @@ private GrammarToken scanCharClass(SourceLocation start) {
     private GrammarToken scanActionCode(SourceLocation start) {
         advance();
         // skip {
-        var sb = new StringBuilder();
+        var sb = new StringBuilder(DEFAULT_TOKEN_CAPACITY);
         int braceDepth = 1;
         while (!isAtEnd() && braceDepth > 0) {
             char c = peek();
@@ -192,7 +199,7 @@ private GrammarToken scanActionCode(SourceLocation start) {
     }
 
     private String scanJavaString() {
-        var sb = new StringBuilder();
+        var sb = new StringBuilder(DEFAULT_TOKEN_CAPACITY);
         char quote = advance();
         sb.append(quote);
         while (!isAtEnd() && peek() != quote) {
@@ -208,7 +215,7 @@ private String scanJavaString() {
     }
 
     private GrammarToken scanNumber(SourceLocation start) {
-        var sb = new StringBuilder();
+        var sb = new StringBuilder(DEFAULT_TOKEN_CAPACITY);
         while (!isAtEnd() && isDigit(peek())) {
             sb.append(advance());
         }

src/main/java/org/pragmatica/peg/grammar/GrammarParser.java

@@ -49,8 +49,8 @@ private Result<Grammar> parseGrammar() {
             if (token instanceof GrammarToken.Directive directive) {
                 advance();
                 var result = parseDirective(directive);
-                if (result.isFailure()) {
-                    return result.fold(Result::failure, _ -> null);
+                if (result instanceof Result.Failure< ? > f) {
+                    return Result.failure(f.cause());
                 }
                 var expr = result.unwrap();
                 switch (directive.name()) {
@@ -59,8 +59,8 @@ private Result<Grammar> parseGrammar() {
                 }
             }else if (token instanceof GrammarToken.Identifier) {
                 var result = parseRule();
-                if (result.isFailure()) {
-                    return result.fold(Result::failure, _ -> null);
+                if (result instanceof Result.Failure< ? > f) {
+                    return Result.failure(f.cause());
                 }
                 rules.add(result.unwrap());
             }else if (token instanceof GrammarToken.Eof) {
@@ -110,8 +110,8 @@ private Result<Rule> parseRule() {
             "'<-'"));
         }
         var exprResult = parseExpression();
-        if (exprResult.isFailure()) {
-            return exprResult.fold(Result::failure, _ -> null);
+        if (exprResult instanceof Result.Failure< ? > f) {
+            return Result.failure(f.cause());
         }
         var expression = exprResult.unwrap();
         // Check for action and/or error_message