MINOR: yml: support inline maps and reject scalar exit-code-map

The parser only knew inline lists, so exit-code-map: {SIGTERM: 0}
parsed as a scalar string. StringMap() on a scalar returns an empty
map and parseProcess guards on len > 0, so the whole remap table was
silently dropped: the config loaded clean and on-failure fired on the
supposedly remapped exit code.

Teach parseScalar the flow-mapping form, recursively and under the
same maxParseDepth cap as block nesting. splitCSV now tracks []/{}
depth so commas inside nested structures or quotes do not split
entries, and inline maps get the same strictness as block maps:
missing colons and duplicate keys fail with line numbers. Sequence
items written as inline maps parse as mappings too.

Also validate exit-code-map at load: a scalar or list value is now a
config error naming the process and the expected form, instead of a
silent no-op. An absent or empty key stays legal. environment and
signal-rewrite gain the inline form for free via the shared parser.

Author: oktalz

documentation/exit-code-map/README.md

@@ -19,7 +19,9 @@ processes:
 ```
 
 - `exit-code-map: {17: 0}` — an exit code of 17 is remapped to 0. Keys may be
-  integers or signal names (e.g. `SIGTERM: 0` maps the shell's 143).
+  integers or signal names (e.g. `SIGTERM: 0` maps the shell's 143). The map
+  can be written indented (as above) or inline: `exit-code-map: {17: 0}`.
+  A value that is not a key-value map (e.g. a bare scalar) is a config error.
 - Because the remap happens first, the remapped 0 makes the exit a **success**,
   so `on-failure: shutdown` never fires.
 - `on-success: ignore` — the success exit does not shut gopherd down either;

internal/yml/config.go

@@ -437,6 +437,9 @@ func parseProcess(n *Node, env map[string]string) (service.Process, error) {
 	// "TERM"); signal names map to the shell convention 128+signum, matching
 	// what waitStatusCode reports for signal-terminated children. Mixed forms
 	// are fine.
+	if err := requireMapping(n, "exit-code-map", p.Name, p.Command); err != nil {
+		return p, err
+	}
 	if raw := n.Get("exit-code-map").StringMap(); len(raw) > 0 {
 		p.ExitCodeMap = make(map[int]int, len(raw))
 		for k, v := range raw {
@@ -540,6 +543,25 @@ func parseProcess(n *Node, env map[string]string) (service.Process, error) {
 // ({{file}}, {{.VAR}}). {{cpu}}/{{mem}} expand to integers, so excluded.
 var argSecretTemplateRe = regexp.MustCompile(`\{\{\s*(?:file\b|\.)`)
 
+// requireMapping rejects a value that cannot hold a key-value table. A scalar
+// or a list parses to an empty map, so without this the whole setting would be
+// silently ignored until a child exits. An absent key, or a bare "key:" with no
+// entries, stays legal.
+func requireMapping(n *Node, key, procName, command string) error {
+	v := n.Get(key)
+	if v == nil || v.kind == kindMapping {
+		return nil
+	}
+	if procName == "" {
+		procName = command
+	}
+	got := fmt.Sprintf("%q", v.String())
+	if v.kind == kindSequence {
+		got = "a list"
+	}
+	return fmt.Errorf("process %q: %s must be a key-value map, either indented or inline as {SIGTERM: 0}; got %s", procName, key, got)
+}
+
 // parseExitCode accepts a decimal exit code ("143") or a signal name
 // ("SIGTERM", "TERM"), returning the numeric exit status. Signal names use
 // the shell convention 128+signum, matching what waitStatusCode reports for

internal/yml/config_test.go

@@ -1210,3 +1210,69 @@ func TestArgSecretTemplateRe(t *testing.T) {
 		}
 	}
 }
+
+// The inline flow form must produce the same map as the block form, so a
+// one-line exit-code-map is not silently dropped.
+func TestLoadExitCodeMapInlineForm(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "em.yml")
+	os.WriteFile(cfgPath, []byte(`
+processes:
+  - name: app
+    command: /bin/app
+    exit-code-map: {SIGKILL: 0, SIGTERM: 0, 42: 7}
+`), 0o644)
+	cfg, err := Load(cfgPath)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	got := cfg.Processes[0].ExitCodeMap
+	if got[137] != 0 || got[143] != 0 || got[42] != 7 || len(got) != 3 {
+		t.Errorf("ExitCodeMap = %v", got)
+	}
+}
+
+// A scalar under exit-code-map cannot be a remap table. Rejecting it at load
+// keeps a typo from silently disabling the remap until a child exits.
+func TestLoadExitCodeMapRejectsScalar(t *testing.T) {
+	t.Parallel()
+	for _, val := range []string{"17", "yes", "[143, 137]"} {
+		dir := t.TempDir()
+		cfgPath := filepath.Join(dir, "em.yml")
+		os.WriteFile(cfgPath, []byte(`
+processes:
+  - name: app
+    command: /bin/app
+    exit-code-map: `+val+`
+`), 0o644)
+		_, err := Load(cfgPath)
+		if err == nil {
+			t.Errorf("exit-code-map: %s: expected error, got nil", val)
+			continue
+		}
+		if !strings.Contains(err.Error(), "exit-code-map") {
+			t.Errorf("exit-code-map: %s: error %q does not name the key", val, err.Error())
+		}
+	}
+}
+
+// An absent exit-code-map stays absent; the new validation must not turn a
+// missing key into an error.
+func TestLoadExitCodeMapAbsent(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "em.yml")
+	os.WriteFile(cfgPath, []byte(`
+processes:
+  - name: app
+    command: /bin/app
+`), 0o644)
+	cfg, err := Load(cfgPath)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Processes[0].ExitCodeMap != nil {
+		t.Errorf("ExitCodeMap = %v, want nil", cfg.Processes[0].ExitCodeMap)
+	}
+}

internal/yml/parser.go

@@ -204,7 +204,10 @@ func parseMapping(lines []rawLine, pos, minIndent, depth int) (*Node, int, error
 		rest := strings.TrimSpace(line.text[colonIdx+1:])
 
 		if rest != "" {
-			val := parseScalar(rest)
+			val, err := parseScalar(rest, depth)
+			if err != nil {
+				return nil, pos, fmt.Errorf("line %d: %w", line.num, err)
+			}
 			m.mapping = append(m.mapping, MapEntry{Key: key, Val: val})
 			pos++
 		} else {
@@ -248,8 +251,12 @@ func parseSequence(lines []rawLine, pos, seqIndent, depth int) (*Node, int, erro
 			pos++
 		}
 
-		if len(itemLines) == 1 && isScalarSeqItem(itemText) {
-			seq.sequence = append(seq.sequence, parseScalar(itemText))
+		if len(itemLines) == 1 && isInlineSeqItem(itemText) {
+			item, err := parseScalar(itemText, depth)
+			if err != nil {
+				return nil, pos, fmt.Errorf("line %d: %w", line.num, err)
+			}
+			seq.sequence = append(seq.sequence, item)
 			continue
 		}
 		item, _, err := parseBlock(itemLines, 0, itemIndent-1, depth+1)
@@ -262,20 +269,30 @@ func parseSequence(lines []rawLine, pos, seqIndent, depth int) (*Node, int, erro
 	return seq, pos, nil
 }
 
-// isScalarSeqItem reports whether a single-line sequence item is a scalar:
-// not a nested sequence, and either colon-free or fully quoted (so quoted
-// values containing ": ", e.g. JSON blobs, stay one scalar).
-func isScalarSeqItem(s string) bool {
+// isInlineSeqItem reports whether a single-line sequence item can be handled
+// by parseScalar: not a nested sequence, and either an inline map, colon-free,
+// or fully quoted (so quoted values containing ": ", e.g. JSON blobs, stay one
+// scalar).
+func isInlineSeqItem(s string) bool {
 	if strings.HasPrefix(s, "- ") {
 		return false
 	}
+	if strings.HasPrefix(s, "{") && strings.HasSuffix(s, "}") {
+		return true
+	}
 	if findColon(s) < 0 {
 		return true
 	}
 	return len(s) >= 2 && (s[0] == '\'' || s[0] == '"') && s[len(s)-1] == s[0]
 }
 
-func parseScalar(s string) *Node {
+// parseScalar parses an inline value: an inline list ("[a, b]"), an inline
+// map ("{a: 1, b: 2}"), or a plain scalar. depth bounds brace recursion so a
+// malformed config cannot exhaust the PID 1 stack.
+func parseScalar(s string, depth int) (*Node, error) {
+	if depth > maxParseDepth {
+		return nil, fmt.Errorf("YAML nesting exceeds maximum depth of %d", maxParseDepth)
+	}
 	if strings.HasPrefix(s, "[") && strings.HasSuffix(s, "]") {
 		inner := s[1 : len(s)-1]
 		items := splitCSV(inner)
@@ -285,9 +302,41 @@ func parseScalar(s string) *Node {
 			item = unquote(item)
 			seq.sequence = append(seq.sequence, &Node{kind: kindScalar, scalar: item})
 		}
-		return seq
+		return seq, nil
+	}
+	if strings.HasPrefix(s, "{") && strings.HasSuffix(s, "}") {
+		return parseInlineMap(s[1:len(s)-1], depth)
+	}
+	return &Node{kind: kindScalar, scalar: unquote(strings.TrimSpace(s))}, nil
+}
+
+// parseInlineMap parses the body of a flow mapping ("a: 1, b: 2"). Entries are
+// validated like block keys, so a malformed entry or a duplicate key fails at
+// load instead of silently yielding an empty map.
+func parseInlineMap(inner string, depth int) (*Node, error) {
+	m := &Node{kind: kindMapping}
+	seen := make(map[string]bool)
+	for _, entry := range splitCSV(inner) {
+		entry = strings.TrimSpace(entry)
+		if entry == "" {
+			continue
+		}
+		colonIdx := findColon(entry)
+		if colonIdx < 0 {
+			return nil, fmt.Errorf("expected 'key: value' in inline map, got %q", entry)
+		}
+		key := unquote(strings.TrimSpace(entry[:colonIdx]))
+		if seen[key] {
+			return nil, fmt.Errorf("duplicate key %q in inline map", key)
+		}
+		seen[key] = true
+		val, err := parseScalar(strings.TrimSpace(entry[colonIdx+1:]), depth+1)
+		if err != nil {
+			return nil, err
+		}
+		m.mapping = append(m.mapping, MapEntry{Key: key, Val: val})
 	}
-	return &Node{kind: kindScalar, scalar: unquote(strings.TrimSpace(s))}
+	return m, nil
 }
 
 func splitCSV(s string) []string {
@@ -296,6 +345,7 @@ func splitCSV(s string) []string {
 	inQuote := false
 	quoteChar := byte(0)
 	escaped := false
+	depth := 0 // nesting of [] and {}; commas only split at depth 0
 	for i := range len(s) {
 		c := s[i]
 		if escaped {
@@ -323,7 +373,13 @@ func splitCSV(s string) []string {
 			current.WriteByte(c)
 			continue
 		}
-		if c == ',' {
+		switch c {
+		case '[', '{':
+			depth++
+		case ']', '}':
+			depth--
+		}
+		if c == ',' && depth == 0 {
 			parts = append(parts, current.String())
 			current.Reset()
 			continue

internal/yml/parser_test.go

@@ -484,3 +484,132 @@ func TestParseRejectsDeepNesting(t *testing.T) {
 		t.Errorf("error %q does not mention nesting depth limit", err.Error())
 	}
 }
+
+func TestParseInlineMap(t *testing.T) {
+	t.Parallel()
+	n, err := Parse([]byte(`exit-code-map: {SIGKILL: 0, SIGTERM: 0}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := n.Get("exit-code-map").StringMap()
+	if got["SIGKILL"] != "0" || got["SIGTERM"] != "0" || len(got) != 2 {
+		t.Errorf("StringMap() = %v", got)
+	}
+}
+
+func TestParseInlineMapEmpty(t *testing.T) {
+	t.Parallel()
+	n, err := Parse([]byte(`env: {}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := n.Get("env").StringMap()
+	if got == nil || len(got) != 0 {
+		t.Errorf("StringMap() = %v, want empty non-nil map", got)
+	}
+}
+
+// Values may contain commas and colons when quoted; splitting must respect
+// quotes so a URL or comma-bearing value stays one entry.
+func TestParseInlineMapQuotedValue(t *testing.T) {
+	t.Parallel()
+	n, err := Parse([]byte(`env: {LIST: "a, b", URL: "http://h:80"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := n.Get("env").StringMap()
+	if got["LIST"] != "a, b" {
+		t.Errorf("LIST = %q, want %q", got["LIST"], "a, b")
+	}
+	if got["URL"] != "http://h:80" {
+		t.Errorf("URL = %q", got["URL"])
+	}
+}
+
+// A nested inline map must not be split at the commas inside its braces.
+func TestParseInlineMapNested(t *testing.T) {
+	t.Parallel()
+	n, err := Parse([]byte(`a: {b: {c: 1, d: 2}, e: 3}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	inner := n.Get("a").Get("b").StringMap()
+	if inner["c"] != "1" || inner["d"] != "2" || len(inner) != 2 {
+		t.Errorf("inner = %v", inner)
+	}
+	if n.Get("a").Get("e").String() != "3" {
+		t.Errorf("e = %q", n.Get("a").Get("e").String())
+	}
+}
+
+// An inline list nested in an inline map must survive comma splitting too.
+func TestParseInlineMapWithInlineList(t *testing.T) {
+	t.Parallel()
+	n, err := Parse([]byte(`a: {args: [x, y], n: 1}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := n.Get("a").Get("args").Strings(); len(got) != 2 || got[0] != "x" || got[1] != "y" {
+		t.Errorf("args = %v", got)
+	}
+	if n.Get("a").Get("n").String() != "1" {
+		t.Errorf("n = %q", n.Get("a").Get("n").String())
+	}
+}
+
+func TestParseInlineMapMissingColon(t *testing.T) {
+	t.Parallel()
+	_, err := Parse([]byte(`a: {foo, bar}`))
+	if err == nil {
+		t.Fatal("expected error for inline map entry without a colon")
+	}
+	if !strings.Contains(err.Error(), "key: value") {
+		t.Errorf("error %q does not explain the expected form", err.Error())
+	}
+}
+
+func TestParseInlineMapDuplicateKey(t *testing.T) {
+	t.Parallel()
+	_, err := Parse([]byte(`a: {x: 1, x: 2}`))
+	if err == nil {
+		t.Fatal("expected error for duplicate key in inline map")
+	}
+	if !strings.Contains(err.Error(), "duplicate key") {
+		t.Errorf("error %q does not mention a duplicate key", err.Error())
+	}
+}
+
+// A PID 1 process must not blow its stack on an adversarial config, so
+// inline-map recursion is capped like block nesting is.
+func TestParseInlineMapRejectsDeepNesting(t *testing.T) {
+	t.Parallel()
+	const depth = 500 // well beyond maxParseDepth
+	payload := "a: " + strings.Repeat("{b: ", depth) + "1" + strings.Repeat("}", depth)
+	_, err := Parse([]byte(payload))
+	if err == nil {
+		t.Fatal("expected error for deeply nested inline map, got nil")
+	}
+	if !strings.Contains(err.Error(), "nesting exceeds maximum depth") {
+		t.Errorf("error %q does not mention nesting depth limit", err.Error())
+	}
+}
+
+// A sequence item that is itself an inline map must parse as a mapping, not
+// be mangled by the block-mapping path.
+func TestParseInlineMapAsSequenceItem(t *testing.T) {
+	t.Parallel()
+	n, err := Parse([]byte("list:\n  - {name: a, cmd: x}\n  - {name: b, cmd: y}\n"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	items := n.Get("list").Items()
+	if len(items) != 2 {
+		t.Fatalf("got %d items, want 2", len(items))
+	}
+	if items[0].Get("name").String() != "a" || items[0].Get("cmd").String() != "x" {
+		t.Errorf("item 0 = %v", items[0].StringMap())
+	}
+	if items[1].Get("name").String() != "b" {
+		t.Errorf("item 1 = %v", items[1].StringMap())
+	}
+}