add --exclude-rules

Author: myfreess

SKILL.md

@@ -17,7 +17,7 @@ moon runwasm moonbit-community/moongrep -- scan --pattern '$(callee:id)()' --gua
 Synopsis:
 
 ```text
-moon runwasm moonbit-community/moongrep -- scan [--verbose] [--enable-builtin-rules] [--exclude-dir <dir>...] ((--rules <rules-root> | --rules=<rules-root> | -r <rules-root> | --rule <rule-file>) | --pattern <pattern> [--guard <guard>])... [scan-root]
+moon runwasm moonbit-community/moongrep -- scan [--verbose] [--enable-builtin-rules] [--exclude-dir <dir>...] [--exclude-rules <rule-id>...] ((--rules <rules-root> | --rules=<rules-root> | -r <rules-root> | --rule <rule-file>) | --pattern <pattern> [--guard <guard>])... [scan-root]
 ```
 
 The scanner is available through the `scan` subcommand. `--rules` / `-r` is
@@ -39,11 +39,18 @@ scanning the source tree. When passing multiple excluded directories after one
 flag, put `scan-root` before `--exclude-dir`; repeated `--exclude-dir <dir>` and
 `--exclude-dir=<dir>` forms are also accepted.
 
+Use `--exclude-rules <rule-id>...` to disable loaded rules by exact rule id.
+This applies to builtin, file, directory, and anonymous pattern rules. When
+passing multiple excluded rule ids after one flag, put `scan-root` before
+`--exclude-rules`; repeated `--exclude-rules <rule-id>` and
+`--exclude-rules=<rule-id>` forms are also accepted. Unknown excluded rule ids
+are usage errors.
+
 Usage errors print a message and exit with code 2: missing `scan` command,
 missing all rule sources (`--rules`, `--rule`, `--pattern`, and
 `--enable-builtin-rules`), missing option value, misplaced or malformed
-`--guard`, unknown options, or more than one scan root. Non-usage errors,
-including unreadable paths, an empty rules
+`--guard`, unknown options, unknown excluded rule ids, or more than one scan
+root. Non-usage errors, including unreadable paths, an empty rules
 directory, invalid YAML/schema/shape, or source read failures, abort the run;
 the CLI prints the error and exits with code 1.
 

cli_args.mbt

@@ -12,6 +12,7 @@ priv struct CliOptions {
   patterns : Array[@rule_model.RulePatternSpec]
   scan_root : String
   exclude_dirs : Array[String]
+  exclude_rules : Array[String]
   verbose : Bool
   enable_builtin_rules : Bool
   no_color : Bool
@@ -65,6 +66,11 @@ let scan_command : @argparse.Command = Command(
       action=Append,
       about="Directory name or path to skip while recursively scanning.",
     ),
+    OptionArg(
+      "exclude-rules",
+      action=Append,
+      about="Rule id to disable after loading rules.",
+    ),
   ],
   positionals=[PositionArg("scan-root", about="Directory to scan.")],
 )
@@ -229,6 +235,7 @@ fn scan_cli_options(
   let exclude_dirs = normalize_scan_exclude_dirs(
     all_cli_values(scan_matches.values, "exclude-dir"),
   )
+  let exclude_rules = all_cli_values(scan_matches.values, "exclude-rules")
   if rules_root is None &&
     rule_file is None &&
     patterns.is_empty() &&
@@ -250,6 +257,7 @@ fn scan_cli_options(
     patterns,
     scan_root,
     exclude_dirs,
+    exclude_rules,
     verbose,
     enable_builtin_rules,
     no_color,
@@ -366,28 +374,28 @@ fn parse_cli_guard_map(source : String) -> Map[String, String] raise {
 }
 
 ///|
-fn normalize_scan_exclude_dir_args(argv : Array[String]) -> Array[String] raise {
+fn normalize_scan_multi_value_option_args(
+  argv : Array[String],
+  option_names : Array[String],
+) -> Array[String] raise {
   if argv.length() == 0 || argv[0] != "scan" {
     return argv
   }
   let normalized : Array[String] = [argv[0]]
   let mut index = 1
   while index < argv.length() {
     let arg = argv[index]
-    if arg == "--exclude-dir" {
+    if option_names.contains(arg) {
       let mut value_count = 0
       index += 1
       while index < argv.length() && !argv[index].has_prefix("-") {
-        normalized.push("--exclude-dir")
+        normalized.push(arg)
         normalized.push(argv[index])
         value_count += 1
         index += 1
       }
       if value_count == 0 {
-        raise CliError::Usage(
-          message="missing value for --exclude-dir",
-          exit_code=2,
-        )
+        raise CliError::Usage(message="missing value for \{arg}", exit_code=2)
       }
     } else {
       normalized.push(arg)
@@ -405,18 +413,22 @@ fn normalize_scan_exclude_dir_args(argv : Array[String]) -> Array[String] raise
 /// `--rule <rule-file>`, at least one `--pattern <pattern>`, or
 /// `--enable-builtin-rules` is required, and `--verbose` is optional.
 /// `--exclude-dir <dir>...` skips matching child directory names or paths
-/// during recursive source scanning.
+/// during recursive source scanning. `--exclude-rules <rule-id>...` disables
+/// loaded rules by exact rule id before matching.
 /// One optional scan-root positional may appear in the argument list. If the
 /// rules option or single rule option appears multiple times, the last value
-/// wins. Repeated patterns and exclude directories are appended in order.
+/// wins. Repeated patterns, exclude directories, and excluded rules are
+/// appended in order.
 /// Missing subcommands, required arguments, unknown options, or more than one
 /// scan root raise `CliError::Usage` with exit code 2.
 #moongrep.skip
 fn parse_cli_command(
   argv : Array[String],
   env? : Map[String, String] = {},
 ) -> (String, CliOptions?, String?) raise {
-  let normalized_argv = normalize_scan_exclude_dir_args(argv)
+  let normalized_argv = normalize_scan_multi_value_option_args(argv, [
+    "--exclude-dir", "--exclude-rules",
+  ])
   let matches = moongrep_command.parse(argv=normalized_argv, env~) catch {
     err => {
       let message = "\{err}"

cli_wbtest.mbt

@@ -210,6 +210,27 @@ test "cli args parse scan exclude dirs" {
   }
 }
 
+///|
+test "cli args parse scan exclude rules" {
+  match
+    parse_cli_command([
+      "scan", "--rules", "custom-rules", "src", "--exclude-rules", "target", "other",
+      "--exclude-rules=third", "--exclude-rules", "last",
+    ]) {
+    ("scan", Some(options), None) => {
+      expect_rules_root(options, "custom-rules")
+      inspect(options.scan_root, content="src")
+      debug_inspect(
+        options.exclude_rules,
+        content="[\"target\", \"other\", \"third\", \"last\"]",
+      )
+      assert_false(options.verbose)
+      assert_false(options.enable_builtin_rules)
+    }
+    _ => fail("unexpected command")
+  }
+}
+
 ///|
 test "cli args reject json matcher flag" {
   expect_cli_usage(
@@ -353,6 +374,11 @@ test "cli args reject missing rules value" {
   expect_cli_usage(["scan", "--rules"], 2)
 }
 
+///|
+test "cli args reject missing exclude rules value" {
+  expect_cli_usage(["scan", "--rules", "custom-rules", "--exclude-rules"], 2)
+}
+
 ///|
 test "cli args parse builtin rules flag without rules root" {
   match parse_cli_command(["scan", "--enable-builtin-rules", "src"]) {

e2etests/BASIC.md

@@ -28,14 +28,15 @@ Arguments:
   scan-root  Directory to scan.
 
 Options:
-  -h, --help                   Show help information.
-  --verbose                    Print loaded rule ids and directory traversal progress.
-  --enable-builtin-rules       Enable embedded builtin rules.
-  -r, --rules <rules>          Directory containing YAML rules.
-  --rule <rule>                Single YAML rule file.
-  --pattern <pattern>          Anonymous structural pattern to match.
-  --guard <guard>              YAML guard map for the preceding anonymous pattern.
-  --exclude-dir <exclude-dir>  Directory name or path to skip while recursively scanning.
+  -h, --help                       Show help information.
+  --verbose                        Print loaded rule ids and directory traversal progress.
+  --enable-builtin-rules           Enable embedded builtin rules.
+  -r, --rules <rules>              Directory containing YAML rules.
+  --rule <rule>                    Single YAML rule file.
+  --pattern <pattern>              Anonymous structural pattern to match.
+  --guard <guard>                  YAML guard map for the preceding anonymous pattern.
+  --exclude-dir <exclude-dir>      Directory name or path to skip while recursively scanning.
+  --exclude-rules <exclude-rules>  Rule id to disable after loading rules.
 ```
 
 ## moongrep scan --enable-builtin-rules

e2etests/SCAN.md

@@ -138,6 +138,25 @@ source:
 7 | }
 ```
 
+```mooncram
+$ cd "$TESTDIR"/.. && moonrun "$TESTDIR"/moongrep.wasm -- scan --rules e2etests/rules/prefilter testdata/prefilter-impl --exclude-rules target
+testdata/prefilter-impl/hits.mbt:6:3-6:10
+rule: other
+description:
+  Other call.
+source:
+4 | 
+5 | fn second {
+6 >   other()
+7 | }
+```
+
+```mooncram
+$ cd "$TESTDIR"/.. && moonrun "$TESTDIR"/moongrep.wasm -- scan --rules e2etests/rules/prefilter testdata/prefilter-impl --exclude-rules missing
+unknown rule id in --exclude-rules: missing
+[2]
+```
+
 ```mooncram
 $ cd "$TESTDIR"/.. && moonrun "$TESTDIR"/moongrep.wasm -- scan --rules e2etests/rules/structural testdata/custom-rules
 testdata/custom-rules/hit.mbt:1:13-1:21

main.mbt

@@ -1,3 +1,11 @@
+///|
+#cfg(target="wasm")
+fn runtime_exit(code : Int) -> Unit = "wasi_snapshot_preview1" "proc_exit"
+
+///|
+#cfg(target="wasm-gc")
+fn runtime_exit(code : Int) -> Unit = "__moonbit_sys_unstable" "exit"
+
 ///|
 fn write_cli_output(output : String) -> Unit {
   match output.strip_suffix("\n") {
@@ -27,9 +35,9 @@ async fn main {
       _ => fail("invalid CLI command")
     }
   } catch {
-    CliError::Usage(message~, ..) as err => {
+    CliError::Usage(message~, exit_code~) => {
       write_cli_output(message)
-      raise err
+      runtime_exit(exit_code)
     }
     err => raise err
   }

scan.mbt

@@ -34,7 +34,8 @@ priv struct SourceContextLine {
 ///|
 async fn collect_directory_hits(options : CliOptions) -> DirectoryScanResult {
   let raw_rules = load_scan_rules(options)
-  let compiled_rules = @rule_compile.compile_rules(raw_rules)
+  let enabled_rules = exclude_scan_rules(raw_rules, options.exclude_rules)
+  let compiled_rules = @rule_compile.compile_rules(enabled_rules)
   let scan_plan = @rule_apply.ScanPlan::from_rules(compiled_rules)
   let files : Array[String] = []
   let scan_trace : Array[String] = []
@@ -161,6 +162,47 @@ async fn load_scan_rules(
   raw_rules
 }
 
+///|
+fn exclude_scan_rules(
+  raw_rules : Array[@rule_model.RawRuleSpec],
+  exclude_rules : Array[String],
+) -> Array[@rule_model.RawRuleSpec] raise {
+  if exclude_rules.is_empty() {
+    return raw_rules
+  }
+  ensure_exclude_rule_ids_exist(raw_rules, exclude_rules)
+  let excluded : Map[String, Bool] = {}
+  for rule_id in exclude_rules {
+    excluded[rule_id] = true
+  }
+  let enabled : Array[@rule_model.RawRuleSpec] = []
+  for raw in raw_rules {
+    if !excluded.contains(raw.rule_id) {
+      enabled.push(raw)
+    }
+  }
+  enabled
+}
+
+///|
+fn ensure_exclude_rule_ids_exist(
+  raw_rules : Array[@rule_model.RawRuleSpec],
+  exclude_rules : Array[String],
+) -> Unit raise {
+  let loaded : Map[String, Bool] = {}
+  for raw in raw_rules {
+    loaded[raw.rule_id] = true
+  }
+  for rule_id in exclude_rules {
+    if !loaded.contains(rule_id) {
+      raise CliError::Usage(
+        message="unknown rule id in --exclude-rules: \{rule_id}",
+        exit_code=2,
+      )
+    }
+  }
+}
+
 ///|
 fn anonymous_pattern_rule(
   pattern : @rule_model.RulePatternSpec,