jerboa-treesitter

Minimal Jerboa bindings for Tree-sitter, built for the jerboa-semgrep port.

This repository is experimental Lane B parser/FFI infrastructure. It is designed to keep the parser boundary narrow:

• No dynamic grammar loading.
• Only statically compiled grammars are available.
• The grammar set is pinned and statically compiled from vendor/grammars.
• Parser APIs consume caller-provided strings; they do not read files.
• Native Tree-sitter handles are wrapped and must be closed by callers.

Build

make security
make test
make adversarial-corpus
make audit
make runtime-provenance-check
make reproducibility-report
make target-evidence
make release-evidence

The build uses a local ../tree-sitter checkout when present. Otherwise make fetches the pinned Tree-sitter runtime into .tree-sitter.

make release-evidence writes the local release artifact bundle under dist/release-evidence/, including the pinned Tree-sitter runtime commit and ABI, vendored grammar manifest, native linkage, a 512-case valid/malformed/bounded grammar corpus, source hashes, sanitized target evidence, and a hash-only two-clean-build reproducibility report. make target-evidence records target-only parser/FFI review blockers and fails closed when JTREESITTER_REQUIRE_TARGET_PROOF=1 is set without a marker-complete JTREESITTER_TARGET_PROOF_FILE; overlarge, host-private, or high-confidence secret proof files are rejected before copying.

Usage

(import (tree-sitter tree-sitter))

(define result (parse-string 'json "{\"a\": 1}"))
(node-type (parse-result-root result))

parse-string caps UTF-8 input at 8 MiB, enforces a five-second monotonic native parse deadline, and does not eagerly traverse the tree. Use parse-string/with-errors for bounded detailed diagnostics, or construct a parse-limits record and call parse-string/limits for tighter source, parse, node, depth, error-count, and traversal-time budgets. Check parse-result-errors-truncated? before treating a detailed error list as complete.

Dynamic builds must set JERBOA_TREE_SITTER_LIB to the absolute trusted directory containing the shim. Relative paths, CWD/bare-name searches, final symlinks, and missing shims are rejected. Statically registered builds do not need the variable.

Dynamic grammar loading is intentionally absent from this implementation. Additional Semgrep-required grammars should be added as pinned, static grammar sources first.

Security

Review SECURITY.md, docs/ffi-boundary.md, docs/runtime-provenance.md, docs/resource-limits.md, and docs/release-evidence.md before using these bindings in release candidates. Public release still requires full grammar provenance review, broader external malformed-input soak, downstream jerboa-semgrep integration evidence, and marker-complete target parser proof.