dispatch: add HGPLAIN=+strictflags to restrict early parsing of global options

If this feature is enabled, early options are parsed using the global options
table. As the parser stops processing options when non/unknown option is
encountered, it won't mistakenly take an option value as a new early option.
Still "--" can be injected to terminate the parsing (e.g. "hg -R -- log"), I
think it's unlikely to lead to an RCE.

To minimize a risk of this change, new fancyopts.earlygetopt() path is enabled
only when +strictflags is set. Also the strict parser doesn't support '--repo',
a short for '--repository' yet. This limitation will be removed later.

As this feature is backward incompatible, I decided to add a new opt-in
mechanism to HGPLAIN. I'm not pretty sure if this is the right choice, but
I'm thinking of adding +feature/-feature syntax to HGPLAIN. Alternatively,
we could add a new environment variable. Any bikeshedding is welcome.

Note that HGPLAIN=+strictflags doesn't work correctly in chg session since
command arguments are pre-processed in C. This wouldn't be easily fixed.

mercurial/chgserver.py

@@ -1,593 +1,601
 # chgserver.py - command server extension for cHg
 #
 # Copyright 2011 Yuya Nishihara <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 """command server extension for cHg
 
 'S' channel (read/write)
     propagate ui.system() request to client
 
 'attachio' command
     attach client's stdio passed by sendmsg()
 
 'chdir' command
     change current directory
 
 'setenv' command
     replace os.environ completely
 
 'setumask' command
     set umask
 
 'validate' command
     reload the config and check if the server is up to date
 
 Config
 ------
 
 ::
 
   [chgserver]
   # how long (in seconds) should an idle chg server exit
   idletimeout = 3600
 
   # whether to skip config or env change checks
   skiphash = False
 """
 
 from __future__ import absolute_import
 
 import hashlib
 import inspect
 import os
 import re
 import socket
 import struct
 import time
 
 from .i18n import _
 
 from . import (
     commandserver,
     encoding,
     error,
     extensions,
     pycompat,
     util,
 )
 
 _log = commandserver.log
 
 def _hashlist(items):
     """return sha1 hexdigest for a list"""
     return hashlib.sha1(str(items)).hexdigest()
 
 # sensitive config sections affecting confighash
 _configsections = [
     'alias',  # affects global state commands.table
     'eol',    # uses setconfig('eol', ...)
     'extdiff',  # uisetup will register new commands
     'extensions',
 ]
 
 _configsectionitems = [
     ('commands', 'show.aliasprefix'), # show.py reads it in extsetup
 ]
 
 # sensitive environment variables affecting confighash
 _envre = re.compile(r'''\A(?:
                     CHGHG
                     |HG(?:DEMANDIMPORT|EMITWARNINGS|MODULEPOLICY|PROF|RCPATH)?
                     |HG(?:ENCODING|PLAIN).*
                     |LANG(?:UAGE)?
                     |LC_.*
                     |LD_.*
                     |PATH
                     |PYTHON.*
                     |TERM(?:INFO)?
                     |TZ
                     )\Z''', re.X)
 
 def _confighash(ui):
     """return a quick hash for detecting config/env changes
 
     confighash is the hash of sensitive config items and environment variables.
 
     for chgserver, it is designed that once confighash changes, the server is
     not qualified to serve its client and should redirect the client to a new
     server. different from mtimehash, confighash change will not mark the
     server outdated and exit since the user can have different configs at the
     same time.
     """
     sectionitems = []
     for section in _configsections:
         sectionitems.append(ui.configitems(section))
     for section, item in _configsectionitems:
         sectionitems.append(ui.config(section, item))
     sectionhash = _hashlist(sectionitems)
     # If $CHGHG is set, the change to $HG should not trigger a new chg server
     if 'CHGHG' in encoding.environ:
         ignored = {'HG'}
     else:
         ignored = set()
     envitems = [(k, v) for k, v in encoding.environ.iteritems()
                 if _envre.match(k) and k not in ignored]
     envhash = _hashlist(sorted(envitems))
     return sectionhash[:6] + envhash[:6]
 
 def _getmtimepaths(ui):
     """get a list of paths that should be checked to detect change
 
     The list will include:
     - extensions (will not cover all files for complex extensions)
     - mercurial/__version__.py
     - python binary
     """
     modules = [m for n, m in extensions.extensions(ui)]
     try:
         from . import __version__
         modules.append(__version__)
     except ImportError:
         pass
     files = [pycompat.sysexecutable]
     for m in modules:
         try:
             files.append(inspect.getabsfile(m))
         except TypeError:
             pass
     return sorted(set(files))
 
 def _mtimehash(paths):
     """return a quick hash for detecting file changes
 
     mtimehash calls stat on given paths and calculate a hash based on size and
     mtime of each file. mtimehash does not read file content because reading is
     expensive. therefore it's not 100% reliable for detecting content changes.
     it's possible to return different hashes for same file contents.
     it's also possible to return a same hash for different file contents for
     some carefully crafted situation.
 
     for chgserver, it is designed that once mtimehash changes, the server is
     considered outdated immediately and should no longer provide service.
 
     mtimehash is not included in confighash because we only know the paths of
     extensions after importing them (there is imp.find_module but that faces
     race conditions). We need to calculate confighash without importing.
     """
     def trystat(path):
         try:
             st = os.stat(path)
             return (st.st_mtime, st.st_size)
         except OSError:
             # could be ENOENT, EPERM etc. not fatal in any case
             pass
     return _hashlist(map(trystat, paths))[:12]
 
 class hashstate(object):
     """a structure storing confighash, mtimehash, paths used for mtimehash"""
     def __init__(self, confighash, mtimehash, mtimepaths):
         self.confighash = confighash
         self.mtimehash = mtimehash
         self.mtimepaths = mtimepaths
 
     @staticmethod
     def fromui(ui, mtimepaths=None):
         if mtimepaths is None:
             mtimepaths = _getmtimepaths(ui)
         confighash = _confighash(ui)
         mtimehash = _mtimehash(mtimepaths)
         _log('confighash = %s mtimehash = %s\n' % (confighash, mtimehash))
         return hashstate(confighash, mtimehash, mtimepaths)
 
 def _newchgui(srcui, csystem, attachio):
     class chgui(srcui.__class__):
         def __init__(self, src=None):
             super(chgui, self).__init__(src)
             if src:
                 self._csystem = getattr(src, '_csystem', csystem)
             else:
                 self._csystem = csystem
 
         def _runsystem(self, cmd, environ, cwd, out):
             # fallback to the original system method if the output needs to be
             # captured (to self._buffers), or the output stream is not stdout
             # (e.g. stderr, cStringIO), because the chg client is not aware of
             # these situations and will behave differently (write to stdout).
             if (out is not self.fout
                 or not util.safehasattr(self.fout, 'fileno')
                 or self.fout.fileno() != util.stdout.fileno()):
                 return util.system(cmd, environ=environ, cwd=cwd, out=out)
             self.flush()
             return self._csystem(cmd, util.shellenviron(environ), cwd)
 
         def _runpager(self, cmd, env=None):
             self._csystem(cmd, util.shellenviron(env), type='pager',
                           cmdtable={'attachio': attachio})
             return True
 
     return chgui(srcui)
 
 def _loadnewui(srcui, args):
     from . import dispatch  # avoid cycle
 
     newui = srcui.__class__.load()
     for a in ['fin', 'fout', 'ferr', 'environ']:
         setattr(newui, a, getattr(srcui, a))
     if util.safehasattr(srcui, '_csystem'):
         newui._csystem = srcui._csystem
 
     # command line args
-    args = args[:]
-    dispatch._parseconfig(newui, dispatch._earlygetopt(['--config'], args))
+    options = {}
+    if srcui.plain('strictflags'):
+        options.update(dispatch._earlyparseopts(args))
+    else:
+        args = args[:]
+        options['config'] = dispatch._earlygetopt(['--config'], args)
+        cwds = dispatch._earlygetopt(['--cwd'], args)
+        options['cwd'] = cwds and cwds[-1] or ''
+        rpath = dispatch._earlygetopt(["-R", "--repository", "--repo"], args)
+        options['repository'] = rpath and rpath[-1] or ''
+    dispatch._parseconfig(newui, options['config'])
 
     # stolen from tortoisehg.util.copydynamicconfig()
     for section, name, value in srcui.walkconfig():
         source = srcui.configsource(section, name)
         if ':' in source or source == '--config' or source.startswith('$'):
             # path:line or command line, or environ
             continue
         newui.setconfig(section, name, value, source)
 
     # load wd and repo config, copied from dispatch.py
-    cwds = dispatch._earlygetopt(['--cwd'], args)
-    cwd = cwds and os.path.realpath(cwds[-1]) or None
-    rpath = dispatch._earlygetopt(["-R", "--repository", "--repo"], args)
-    rpath = rpath and rpath[-1] or ''
+    cwd = options['cwd']
+    cwd = cwd and os.path.realpath(cwd) or None
+    rpath = options['repository']
     path, newlui = dispatch._getlocal(newui, rpath, wd=cwd)
 
     return (newui, newlui)
 
 class channeledsystem(object):
     """Propagate ui.system() request in the following format:
 
     payload length (unsigned int),
     type, '\0',
     cmd, '\0',
     cwd, '\0',
     envkey, '=', val, '\0',
     ...
     envkey, '=', val
 
     if type == 'system', waits for:
 
     exitcode length (unsigned int),
     exitcode (int)
 
     if type == 'pager', repetitively waits for a command name ending with '\n'
     and executes it defined by cmdtable, or exits the loop if the command name
     is empty.
     """
     def __init__(self, in_, out, channel):
         self.in_ = in_
         self.out = out
         self.channel = channel
 
     def __call__(self, cmd, environ, cwd=None, type='system', cmdtable=None):
         args = [type, util.quotecommand(cmd), os.path.abspath(cwd or '.')]
         args.extend('%s=%s' % (k, v) for k, v in environ.iteritems())
         data = '\0'.join(args)
         self.out.write(struct.pack('>cI', self.channel, len(data)))
         self.out.write(data)
         self.out.flush()
 
         if type == 'system':
             length = self.in_.read(4)
             length, = struct.unpack('>I', length)
             if length != 4:
                 raise error.Abort(_('invalid response'))
             rc, = struct.unpack('>i', self.in_.read(4))
             return rc
         elif type == 'pager':
             while True:
                 cmd = self.in_.readline()[:-1]
                 if not cmd:
                     break
                 if cmdtable and cmd in cmdtable:
                     _log('pager subcommand: %s' % cmd)
                     cmdtable[cmd]()
                 else:
                     raise error.Abort(_('unexpected command: %s') % cmd)
         else:
             raise error.ProgrammingError('invalid S channel type: %s' % type)
 
 _iochannels = [
     # server.ch, ui.fp, mode
     ('cin', 'fin', pycompat.sysstr('rb')),
     ('cout', 'fout', pycompat.sysstr('wb')),
     ('cerr', 'ferr', pycompat.sysstr('wb')),
 ]
 
 class chgcmdserver(commandserver.server):
     def __init__(self, ui, repo, fin, fout, sock, hashstate, baseaddress):
         super(chgcmdserver, self).__init__(
             _newchgui(ui, channeledsystem(fin, fout, 'S'), self.attachio),
             repo, fin, fout)
         self.clientsock = sock
         self._oldios = []  # original (self.ch, ui.fp, fd) before "attachio"
         self.hashstate = hashstate
         self.baseaddress = baseaddress
         if hashstate is not None:
             self.capabilities = self.capabilities.copy()
             self.capabilities['validate'] = chgcmdserver.validate
 
     def cleanup(self):
         super(chgcmdserver, self).cleanup()
         # dispatch._runcatch() does not flush outputs if exception is not
         # handled by dispatch._dispatch()
         self.ui.flush()
         self._restoreio()
 
     def attachio(self):
         """Attach to client's stdio passed via unix domain socket; all
         channels except cresult will no longer be used
         """
         # tell client to sendmsg() with 1-byte payload, which makes it
         # distinctive from "attachio\n" command consumed by client.read()
         self.clientsock.sendall(struct.pack('>cI', 'I', 1))
         clientfds = util.recvfds(self.clientsock.fileno())
         _log('received fds: %r\n' % clientfds)
 
         ui = self.ui
         ui.flush()
         first = self._saveio()
         for fd, (cn, fn, mode) in zip(clientfds, _iochannels):
             assert fd > 0
             fp = getattr(ui, fn)
             os.dup2(fd, fp.fileno())
             os.close(fd)
             if not first:
                 continue
             # reset buffering mode when client is first attached. as we want
             # to see output immediately on pager, the mode stays unchanged
             # when client re-attached. ferr is unchanged because it should
             # be unbuffered no matter if it is a tty or not.
             if fn == 'ferr':
                 newfp = fp
             else:
                 # make it line buffered explicitly because the default is
                 # decided on first write(), where fout could be a pager.
                 if fp.isatty():
                     bufsize = 1  # line buffered
                 else:
                     bufsize = -1  # system default
                 newfp = os.fdopen(fp.fileno(), mode, bufsize)
                 setattr(ui, fn, newfp)
             setattr(self, cn, newfp)
 
         self.cresult.write(struct.pack('>i', len(clientfds)))
 
     def _saveio(self):
         if self._oldios:
             return False
         ui = self.ui
         for cn, fn, _mode in _iochannels:
             ch = getattr(self, cn)
             fp = getattr(ui, fn)
             fd = os.dup(fp.fileno())
             self._oldios.append((ch, fp, fd))
         return True
 
     def _restoreio(self):
         ui = self.ui
         for (ch, fp, fd), (cn, fn, _mode) in zip(self._oldios, _iochannels):
             newfp = getattr(ui, fn)
             # close newfp while it's associated with client; otherwise it
             # would be closed when newfp is deleted
             if newfp is not fp:
                 newfp.close()
             # restore original fd: fp is open again
             os.dup2(fd, fp.fileno())
             os.close(fd)
             setattr(self, cn, ch)
             setattr(ui, fn, fp)
         del self._oldios[:]
 
     def validate(self):
         """Reload the config and check if the server is up to date
 
         Read a list of '\0' separated arguments.
         Write a non-empty list of '\0' separated instruction strings or '\0'
         if the list is empty.
         An instruction string could be either:
             - "unlink $path", the client should unlink the path to stop the
               outdated server.
             - "redirect $path", the client should attempt to connect to $path
               first. If it does not work, start a new server. It implies
               "reconnect".
             - "exit $n", the client should exit directly with code n.
               This may happen if we cannot parse the config.
             - "reconnect", the client should close the connection and
               reconnect.
         If neither "reconnect" nor "redirect" is included in the instruction
         list, the client can continue with this server after completing all
         the instructions.
         """
         from . import dispatch  # avoid cycle
 
         args = self._readlist()
         try:
             self.ui, lui = _loadnewui(self.ui, args)
         except error.ParseError as inst:
             dispatch._formatparse(self.ui.warn, inst)
             self.ui.flush()
             self.cresult.write('exit 255')
             return
         newhash = hashstate.fromui(lui, self.hashstate.mtimepaths)
         insts = []
         if newhash.mtimehash != self.hashstate.mtimehash:
             addr = _hashaddress(self.baseaddress, self.hashstate.confighash)
             insts.append('unlink %s' % addr)
             # mtimehash is empty if one or more extensions fail to load.
             # to be compatible with hg, still serve the client this time.
             if self.hashstate.mtimehash:
                 insts.append('reconnect')
         if newhash.confighash != self.hashstate.confighash:
             addr = _hashaddress(self.baseaddress, newhash.confighash)
             insts.append('redirect %s' % addr)
         _log('validate: %s\n' % insts)
         self.cresult.write('\0'.join(insts) or '\0')
 
     def chdir(self):
         """Change current directory
 
         Note that the behavior of --cwd option is bit different from this.
         It does not affect --config parameter.
         """
         path = self._readstr()
         if not path:
             return
         _log('chdir to %r\n' % path)
         os.chdir(path)
 
     def setumask(self):
         """Change umask"""
         mask = struct.unpack('>I', self._read(4))[0]
         _log('setumask %r\n' % mask)
         os.umask(mask)
 
     def runcommand(self):
         return super(chgcmdserver, self).runcommand()
 
     def setenv(self):
         """Clear and update os.environ
 
         Note that not all variables can make an effect on the running process.
         """
         l = self._readlist()
         try:
             newenv = dict(s.split('=', 1) for s in l)
         except ValueError:
             raise ValueError('unexpected value in setenv request')
         _log('setenv: %r\n' % sorted(newenv.keys()))
         encoding.environ.clear()
         encoding.environ.update(newenv)
 
     capabilities = commandserver.server.capabilities.copy()
     capabilities.update({'attachio': attachio,
                          'chdir': chdir,
                          'runcommand': runcommand,
                          'setenv': setenv,
                          'setumask': setumask})
 
     if util.safehasattr(util, 'setprocname'):
         def setprocname(self):
             """Change process title"""
             name = self._readstr()
             _log('setprocname: %r\n' % name)
             util.setprocname(name)
         capabilities['setprocname'] = setprocname
 
 def _tempaddress(address):
     return '%s.%d.tmp' % (address, os.getpid())
 
 def _hashaddress(address, hashstr):
     # if the basename of address contains '.', use only the left part. this
     # makes it possible for the client to pass 'server.tmp$PID' and follow by
     # an atomic rename to avoid locking when spawning new servers.
     dirname, basename = os.path.split(address)
     basename = basename.split('.', 1)[0]
     return '%s-%s' % (os.path.join(dirname, basename), hashstr)
 
 class chgunixservicehandler(object):
     """Set of operations for chg services"""
 
     pollinterval = 1  # [sec]
 
     def __init__(self, ui):
         self.ui = ui
         self._idletimeout = ui.configint('chgserver', 'idletimeout')
         self._lastactive = time.time()
 
     def bindsocket(self, sock, address):
         self._inithashstate(address)
         self._checkextensions()
         self._bind(sock)
         self._createsymlink()
         # no "listening at" message should be printed to simulate hg behavior
 
     def _inithashstate(self, address):
         self._baseaddress = address
         if self.ui.configbool('chgserver', 'skiphash'):
             self._hashstate = None
             self._realaddress = address
             return
         self._hashstate = hashstate.fromui(self.ui)
         self._realaddress = _hashaddress(address, self._hashstate.confighash)
 
     def _checkextensions(self):
         if not self._hashstate:
             return
         if extensions.notloaded():
             # one or more extensions failed to load. mtimehash becomes
             # meaningless because we do not know the paths of those extensions.
             # set mtimehash to an illegal hash value to invalidate the server.
             self._hashstate.mtimehash = ''
 
     def _bind(self, sock):
         # use a unique temp address so we can stat the file and do ownership
         # check later
         tempaddress = _tempaddress(self._realaddress)
         util.bindunixsocket(sock, tempaddress)
         self._socketstat = os.stat(tempaddress)
         sock.listen(socket.SOMAXCONN)
         # rename will replace the old socket file if exists atomically. the
         # old server will detect ownership change and exit.
         util.rename(tempaddress, self._realaddress)
 
     def _createsymlink(self):
         if self._baseaddress == self._realaddress:
             return
         tempaddress = _tempaddress(self._baseaddress)
         os.symlink(os.path.basename(self._realaddress), tempaddress)
         util.rename(tempaddress, self._baseaddress)
 
     def _issocketowner(self):
         try:
             stat = os.stat(self._realaddress)
             return (stat.st_ino == self._socketstat.st_ino and
                     stat.st_mtime == self._socketstat.st_mtime)
         except OSError:
             return False
 
     def unlinksocket(self, address):
         if not self._issocketowner():
             return
         # it is possible to have a race condition here that we may
         # remove another server's socket file. but that's okay
         # since that server will detect and exit automatically and
         # the client will start a new server on demand.
         util.tryunlink(self._realaddress)
 
     def shouldexit(self):
         if not self._issocketowner():
             self.ui.debug('%s is not owned, exiting.\n' % self._realaddress)
             return True
         if time.time() - self._lastactive > self._idletimeout:
             self.ui.debug('being idle too long. exiting.\n')
             return True
         return False
 
     def newconnection(self):
         self._lastactive = time.time()
 
     def createcmdserver(self, repo, conn, fin, fout):
         return chgcmdserver(self.ui, repo, fin, fout, conn,
                             self._hashstate, self._baseaddress)
 
 def chgunixservice(ui, repo, opts):
     # CHGINTERNALMARK is set by chg client. It is an indication of things are
     # started by chg so other code can do things accordingly, like disabling
     # demandimport or detecting chg client started by chg client. When executed
     # here, CHGINTERNALMARK is no longer useful and hence dropped to make
     # environ cleaner.
     if 'CHGINTERNALMARK' in encoding.environ:
         del encoding.environ['CHGINTERNALMARK']
 
     if repo:
         # one chgserver can serve multiple repos. drop repo information
         ui.setconfig('bundle', 'mainreporoot', '', 'repo')
     h = chgunixservicehandler(ui)
     return commandserver.unixforkingservice(ui, repo=None, opts=opts, handler=h)

mercurial/dispatch.py

@@ -1,1103 +1,1117
 # dispatch.py - command dispatching for mercurial
 #
 # Copyright 2005-2007 Matt Mackall <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 from __future__ import absolute_import, print_function
 
 import difflib
 import errno
 import getopt
 import os
 import pdb
 import re
 import signal
 import sys
 import time
 import traceback
 
 
 from .i18n import _
 
 from . import (
     cmdutil,
     color,
     commands,
     demandimport,
     encoding,
     error,
     extensions,
     fancyopts,
     help,
     hg,
     hook,
     profiling,
     pycompat,
     registrar,
     scmutil,
     ui as uimod,
     util,
 )
 
 unrecoverablewrite = registrar.command.unrecoverablewrite
 
 class request(object):
     def __init__(self, args, ui=None, repo=None, fin=None, fout=None,
                  ferr=None, prereposetups=None):
         self.args = args
         self.ui = ui
         self.repo = repo
 
         # input/output/error streams
         self.fin = fin
         self.fout = fout
         self.ferr = ferr
 
         # remember options pre-parsed by _earlyreqopt*()
         self.earlyoptions = {}
 
         # reposetups which run before extensions, useful for chg to pre-fill
         # low-level repo state (for example, changelog) before extensions.
         self.prereposetups = prereposetups or []
 
     def _runexithandlers(self):
         exc = None
         handlers = self.ui._exithandlers
         try:
             while handlers:
                 func, args, kwargs = handlers.pop()
                 try:
                     func(*args, **kwargs)
                 except: # re-raises below
                     if exc is None:
                         exc = sys.exc_info()[1]
                     self.ui.warn(('error in exit handlers:\n'))
                     self.ui.traceback(force=True)
         finally:
             if exc is not None:
                 raise exc
 
 def run():
     "run the command in sys.argv"
     _initstdio()
     req = request(pycompat.sysargv[1:])
     err = None
     try:
         status = (dispatch(req) or 0) & 255
     except error.StdioError as e:
         err = e
         status = -1
     if util.safehasattr(req.ui, 'fout'):
         try:
             req.ui.fout.flush()
         except IOError as e:
             err = e
             status = -1
     if util.safehasattr(req.ui, 'ferr'):
         if err is not None and err.errno != errno.EPIPE:
             req.ui.ferr.write('abort: %s\n' %
                               encoding.strtolocal(err.strerror))
         req.ui.ferr.flush()
     sys.exit(status & 255)
 
 def _initstdio():
     for fp in (sys.stdin, sys.stdout, sys.stderr):
         util.setbinary(fp)
 
 def _getsimilar(symbols, value):
     sim = lambda x: difflib.SequenceMatcher(None, value, x).ratio()
     # The cutoff for similarity here is pretty arbitrary. It should
     # probably be investigated and tweaked.
     return [s for s in symbols if sim(s) > 0.6]
 
 def _reportsimilar(write, similar):
     if len(similar) == 1:
         write(_("(did you mean %s?)\n") % similar[0])
     elif similar:
         ss = ", ".join(sorted(similar))
         write(_("(did you mean one of %s?)\n") % ss)
 
 def _formatparse(write, inst):
     similar = []
     if isinstance(inst, error.UnknownIdentifier):
         # make sure to check fileset first, as revset can invoke fileset
         similar = _getsimilar(inst.symbols, inst.function)
     if len(inst.args) > 1:
         write(_("hg: parse error at %s: %s\n") %
                          (inst.args[1], inst.args[0]))
         if (inst.args[0][0] == ' '):
             write(_("unexpected leading whitespace\n"))
     else:
         write(_("hg: parse error: %s\n") % inst.args[0])
         _reportsimilar(write, similar)
     if inst.hint:
         write(_("(%s)\n") % inst.hint)
 
 def _formatargs(args):
     return ' '.join(util.shellquote(a) for a in args)
 
 def dispatch(req):
     "run the command specified in req.args"
     if req.ferr:
         ferr = req.ferr
     elif req.ui:
         ferr = req.ui.ferr
     else:
         ferr = util.stderr
 
     try:
         if not req.ui:
             req.ui = uimod.ui.load()
+        if req.ui.plain('strictflags'):
+            req.earlyoptions.update(_earlyparseopts(req.args))
         if _earlyreqoptbool(req, 'traceback', ['--traceback']):
             req.ui.setconfig('ui', 'traceback', 'on', '--traceback')
 
         # set ui streams from the request
         if req.fin:
             req.ui.fin = req.fin
         if req.fout:
             req.ui.fout = req.fout
         if req.ferr:
             req.ui.ferr = req.ferr
     except error.Abort as inst:
         ferr.write(_("abort: %s\n") % inst)
         if inst.hint:
             ferr.write(_("(%s)\n") % inst.hint)
         return -1
     except error.ParseError as inst:
         _formatparse(ferr.write, inst)
         return -1
 
     msg = _formatargs(req.args)
     starttime = util.timer()
     ret = None
     try:
         ret = _runcatch(req)
     except error.ProgrammingError as inst:
         req.ui.warn(_('** ProgrammingError: %s\n') % inst)
         if inst.hint:
             req.ui.warn(_('** (%s)\n') % inst.hint)
         raise
     except KeyboardInterrupt as inst:
         try:
             if isinstance(inst, error.SignalInterrupt):
                 msg = _("killed!\n")
             else:
                 msg = _("interrupted!\n")
             req.ui.warn(msg)
         except error.SignalInterrupt:
             # maybe pager would quit without consuming all the output, and
             # SIGPIPE was raised. we cannot print anything in this case.
             pass
         except IOError as inst:
             if inst.errno != errno.EPIPE:
                 raise
         ret = -1
     finally:
         duration = util.timer() - starttime
         req.ui.flush()
         if req.ui.logblockedtimes:
             req.ui._blockedtimes['command_duration'] = duration * 1000
             req.ui.log('uiblocked', 'ui blocked ms', **req.ui._blockedtimes)
         req.ui.log("commandfinish", "%s exited %d after %0.2f seconds\n",
                    msg, ret or 0, duration)
         try:
             req._runexithandlers()
         except: # exiting, so no re-raises
             ret = ret or -1
     return ret
 
 def _runcatch(req):
     def catchterm(*args):
         raise error.SignalInterrupt
 
     ui = req.ui
     try:
         for name in 'SIGBREAK', 'SIGHUP', 'SIGTERM':
             num = getattr(signal, name, None)
             if num:
                 signal.signal(num, catchterm)
     except ValueError:
         pass # happens if called in a thread
 
     def _runcatchfunc():
         realcmd = None
         try:
             cmdargs = fancyopts.fancyopts(req.args[:], commands.globalopts, {})
             cmd = cmdargs[0]
             aliases, entry = cmdutil.findcmd(cmd, commands.table, False)
             realcmd = aliases[0]
         except (error.UnknownCommand, error.AmbiguousCommand,
                 IndexError, getopt.GetoptError):
             # Don't handle this here. We know the command is
             # invalid, but all we're worried about for now is that
             # it's not a command that server operators expect to
             # be safe to offer to users in a sandbox.
             pass
         if realcmd == 'serve' and '--stdio' in cmdargs:
             # We want to constrain 'hg serve --stdio' instances pretty
             # closely, as many shared-ssh access tools want to grant
             # access to run *only* 'hg -R $repo serve --stdio'. We
             # restrict to exactly that set of arguments, and prohibit
             # any repo name that starts with '--' to prevent
             # shenanigans wherein a user does something like pass
             # --debugger or --config=ui.debugger=1 as a repo
             # name. This used to actually run the debugger.
             if (len(req.args) != 4 or
                 req.args[0] != '-R' or
                 req.args[1].startswith('--') or
                 req.args[2] != 'serve' or
                 req.args[3] != '--stdio'):
                 raise error.Abort(
                     _('potentially unsafe serve --stdio invocation: %r') %
                     (req.args,))
 
         try:
             debugger = 'pdb'
             debugtrace = {
                 'pdb': pdb.set_trace
             }
             debugmortem = {
                 'pdb': pdb.post_mortem
             }
 
             # read --config before doing anything else
             # (e.g. to change trust settings for reading .hg/hgrc)
             cfgs = _parseconfig(req.ui,
                                 _earlyreqopt(req, 'config', ['--config']))
 
             if req.repo:
                 # copy configs that were passed on the cmdline (--config) to
                 # the repo ui
                 for sec, name, val in cfgs:
                     req.repo.ui.setconfig(sec, name, val, source='--config')
 
             # developer config: ui.debugger
             debugger = ui.config("ui", "debugger")
             debugmod = pdb
             if not debugger or ui.plain():
                 # if we are in HGPLAIN mode, then disable custom debugging
                 debugger = 'pdb'
             elif _earlyreqoptbool(req, 'debugger', ['--debugger']):
                 # This import can be slow for fancy debuggers, so only
                 # do it when absolutely necessary, i.e. when actual
                 # debugging has been requested
                 with demandimport.deactivated():
                     try:
                         debugmod = __import__(debugger)
                     except ImportError:
                         pass # Leave debugmod = pdb
 
             debugtrace[debugger] = debugmod.set_trace
             debugmortem[debugger] = debugmod.post_mortem
 
             # enter the debugger before command execution
             if _earlyreqoptbool(req, 'debugger', ['--debugger']):
                 ui.warn(_("entering debugger - "
                         "type c to continue starting hg or h for help\n"))
 
                 if (debugger != 'pdb' and
                     debugtrace[debugger] == debugtrace['pdb']):
                     ui.warn(_("%s debugger specified "
                               "but its module was not found\n") % debugger)
                 with demandimport.deactivated():
                     debugtrace[debugger]()
             try:
                 return _dispatch(req)
             finally:
                 ui.flush()
         except: # re-raises
             # enter the debugger when we hit an exception
             if _earlyreqoptbool(req, 'debugger', ['--debugger']):
                 traceback.print_exc()
                 debugmortem[debugger](sys.exc_info()[2])
             raise
 
     return _callcatch(ui, _runcatchfunc)
 
 def _callcatch(ui, func):
     """like scmutil.callcatch but handles more high-level exceptions about
     config parsing and commands. besides, use handlecommandexception to handle
     uncaught exceptions.
     """
     try:
         return scmutil.callcatch(ui, func)
     except error.AmbiguousCommand as inst:
         ui.warn(_("hg: command '%s' is ambiguous:\n    %s\n") %
                 (inst.args[0], " ".join(inst.args[1])))
     except error.CommandError as inst:
         if inst.args[0]:
             ui.pager('help')
             msgbytes = pycompat.bytestr(inst.args[1])
             ui.warn(_("hg %s: %s\n") % (inst.args[0], msgbytes))
             commands.help_(ui, inst.args[0], full=False, command=True)
         else:
             ui.pager('help')
             ui.warn(_("hg: %s\n") % inst.args[1])
             commands.help_(ui, 'shortlist')
     except error.ParseError as inst:
         _formatparse(ui.warn, inst)
         return -1
     except error.UnknownCommand as inst:
         nocmdmsg = _("hg: unknown command '%s'\n") % inst.args[0]
         try:
             # check if the command is in a disabled extension
             # (but don't check for extensions themselves)
             formatted = help.formattedhelp(ui, commands, inst.args[0],
                                            unknowncmd=True)
             ui.warn(nocmdmsg)
             ui.write(formatted)
         except (error.UnknownCommand, error.Abort):
             suggested = False
             if len(inst.args) == 2:
                 sim = _getsimilar(inst.args[1], inst.args[0])
                 if sim:
                     ui.warn(nocmdmsg)
                     _reportsimilar(ui.warn, sim)
                     suggested = True
             if not suggested:
                 ui.pager('help')
                 ui.warn(nocmdmsg)
                 commands.help_(ui, 'shortlist')
     except IOError:
         raise
     except KeyboardInterrupt:
         raise
     except:  # probably re-raises
         if not handlecommandexception(ui):
             raise
 
     return -1
 
 def aliasargs(fn, givenargs):
     args = []
     # only care about alias 'args', ignore 'args' set by extensions.wrapfunction
     if not util.safehasattr(fn, '_origfunc'):
         args = getattr(fn, 'args', args)
     if args:
         cmd = ' '.join(map(util.shellquote, args))
 
         nums = []
         def replacer(m):
             num = int(m.group(1)) - 1
             nums.append(num)
             if num < len(givenargs):
                 return givenargs[num]
             raise error.Abort(_('too few arguments for command alias'))
         cmd = re.sub(br'\$(\d+|\$)', replacer, cmd)
         givenargs = [x for i, x in enumerate(givenargs)
                      if i not in nums]
         args = pycompat.shlexsplit(cmd)
     return args + givenargs
 
 def aliasinterpolate(name, args, cmd):
     '''interpolate args into cmd for shell aliases
 
     This also handles $0, $@ and "$@".
     '''
     # util.interpolate can't deal with "$@" (with quotes) because it's only
     # built to match prefix + patterns.
     replacemap = dict(('$%d' % (i + 1), arg) for i, arg in enumerate(args))
     replacemap['$0'] = name
     replacemap['$$'] = '$'
     replacemap['$@'] = ' '.join(args)
     # Typical Unix shells interpolate "$@" (with quotes) as all the positional
     # parameters, separated out into words. Emulate the same behavior here by
     # quoting the arguments individually. POSIX shells will then typically
     # tokenize each argument into exactly one word.
     replacemap['"$@"'] = ' '.join(util.shellquote(arg) for arg in args)
     # escape '\$' for regex
     regex = '|'.join(replacemap.keys()).replace('$', r'\$')
     r = re.compile(regex)
     return r.sub(lambda x: replacemap[x.group()], cmd)
 
 class cmdalias(object):
     def __init__(self, name, definition, cmdtable, source):
         self.name = self.cmd = name
         self.cmdname = ''
         self.definition = definition
         self.fn = None
         self.givenargs = []
         self.opts = []
         self.help = ''
         self.badalias = None
         self.unknowncmd = False
         self.source = source
 
         try:
             aliases, entry = cmdutil.findcmd(self.name, cmdtable)
             for alias, e in cmdtable.iteritems():
                 if e is entry:
                     self.cmd = alias
                     break
             self.shadows = True
         except error.UnknownCommand:
             self.shadows = False
 
         if not self.definition:
             self.badalias = _("no definition for alias '%s'") % self.name
             return
 
         if self.definition.startswith('!'):
             self.shell = True
             def fn(ui, *args):
                 env = {'HG_ARGS': ' '.join((self.name,) + args)}
                 def _checkvar(m):
                     if m.groups()[0] == '$':
                         return m.group()
                     elif int(m.groups()[0]) <= len(args):
                         return m.group()
                     else:
                         ui.debug("No argument found for substitution "
                                  "of %i variable in alias '%s' definition."
                                  % (int(m.groups()[0]), self.name))
                         return ''
                 cmd = re.sub(r'\$(\d+|\$)', _checkvar, self.definition[1:])
                 cmd = aliasinterpolate(self.name, args, cmd)
                 return ui.system(cmd, environ=env,
                                  blockedtag='alias_%s' % self.name)
             self.fn = fn
             return
 
         try:
             args = pycompat.shlexsplit(self.definition)
         except ValueError as inst:
             self.badalias = (_("error in definition for alias '%s': %s")
                              % (self.name, inst))
             return
         self.cmdname = cmd = args.pop(0)
         self.givenargs = args
 
         for invalidarg in commands.earlyoptflags:
             if _earlygetopt([invalidarg], args):
                 self.badalias = (_("error in definition for alias '%s': %s may "
                                    "only be given on the command line")
                                  % (self.name, invalidarg))
                 return
 
         try:
             tableentry = cmdutil.findcmd(cmd, cmdtable, False)[1]
             if len(tableentry) > 2:
                 self.fn, self.opts, self.help = tableentry
             else:
                 self.fn, self.opts = tableentry
 
             if self.help.startswith("hg " + cmd):
                 # drop prefix in old-style help lines so hg shows the alias
                 self.help = self.help[4 + len(cmd):]
             self.__doc__ = self.fn.__doc__
 
         except error.UnknownCommand:
             self.badalias = (_("alias '%s' resolves to unknown command '%s'")
                              % (self.name, cmd))
             self.unknowncmd = True
         except error.AmbiguousCommand:
             self.badalias = (_("alias '%s' resolves to ambiguous command '%s'")
                              % (self.name, cmd))
 
     @property
     def args(self):
         args = pycompat.maplist(util.expandpath, self.givenargs)
         return aliasargs(self.fn, args)
 
     def __getattr__(self, name):
         adefaults = {r'norepo': True, r'cmdtype': unrecoverablewrite,
                      r'optionalrepo': False, r'inferrepo': False}
         if name not in adefaults:
             raise AttributeError(name)
         if self.badalias or util.safehasattr(self, 'shell'):
             return adefaults[name]
         return getattr(self.fn, name)
 
     def __call__(self, ui, *args, **opts):
         if self.badalias:
             hint = None
             if self.unknowncmd:
                 try:
                     # check if the command is in a disabled extension
                     cmd, ext = extensions.disabledcmd(ui, self.cmdname)[:2]
                     hint = _("'%s' is provided by '%s' extension") % (cmd, ext)
                 except error.UnknownCommand:
                     pass
             raise error.Abort(self.badalias, hint=hint)
         if self.shadows:
             ui.debug("alias '%s' shadows command '%s'\n" %
                      (self.name, self.cmdname))
 
         ui.log('commandalias', "alias '%s' expands to '%s'\n",
                self.name, self.definition)
         if util.safehasattr(self, 'shell'):
             return self.fn(ui, *args, **opts)
         else:
             try:
                 return util.checksignature(self.fn)(ui, *args, **opts)
             except error.SignatureError:
                 args = ' '.join([self.cmdname] + self.args)
                 ui.debug("alias '%s' expands to '%s'\n" % (self.name, args))
                 raise
 
 class lazyaliasentry(object):
     """like a typical command entry (func, opts, help), but is lazy"""
 
     def __init__(self, name, definition, cmdtable, source):
         self.name = name
         self.definition = definition
         self.cmdtable = cmdtable.copy()
         self.source = source
 
     @util.propertycache
     def _aliasdef(self):
         return cmdalias(self.name, self.definition, self.cmdtable, self.source)
 
     def __getitem__(self, n):
         aliasdef = self._aliasdef
         if n == 0:
             return aliasdef
         elif n == 1:
             return aliasdef.opts
         elif n == 2:
             return aliasdef.help
         else:
             raise IndexError
 
     def __iter__(self):
         for i in range(3):
             yield self[i]
 
     def __len__(self):
         return 3
 
 def addaliases(ui, cmdtable):
     # aliases are processed after extensions have been loaded, so they
     # may use extension commands. Aliases can also use other alias definitions,
     # but only if they have been defined prior to the current definition.
     for alias, definition in ui.configitems('alias'):
         try:
             if cmdtable[alias].definition == definition:
                 continue
         except (KeyError, AttributeError):
             # definition might not exist or it might not be a cmdalias
             pass
 
         source = ui.configsource('alias', alias)
         entry = lazyaliasentry(alias, definition, cmdtable, source)
         cmdtable[alias] = entry
 
 def _parse(ui, args):
     options = {}
     cmdoptions = {}
 
     try:
         args = fancyopts.fancyopts(args, commands.globalopts, options)
     except getopt.GetoptError as inst:
         raise error.CommandError(None, inst)
 
     if args:
         cmd, args = args[0], args[1:]
         aliases, entry = cmdutil.findcmd(cmd, commands.table,
                                          ui.configbool("ui", "strict"))
         cmd = aliases[0]
         args = aliasargs(entry[0], args)
         defaults = ui.config("defaults", cmd)
         if defaults:
             args = pycompat.maplist(
                 util.expandpath, pycompat.shlexsplit(defaults)) + args
         c = list(entry[1])
     else:
         cmd = None
         c = []
 
     # combine global options into local
     for o in commands.globalopts:
         c.append((o[0], o[1], options[o[1]], o[3]))
 
     try:
         args = fancyopts.fancyopts(args, c, cmdoptions, gnu=True)
     except getopt.GetoptError as inst:
         raise error.CommandError(cmd, inst)
 
     # separate global options back out
     for o in commands.globalopts:
         n = o[1]
         options[n] = cmdoptions[n]
         del cmdoptions[n]
 
     return (cmd, cmd and entry[0] or None, args, options, cmdoptions)
 
 def _parseconfig(ui, config):
     """parse the --config options from the command line"""
     configs = []
 
     for cfg in config:
         try:
             name, value = [cfgelem.strip()
                            for cfgelem in cfg.split('=', 1)]
             section, name = name.split('.', 1)
             if not section or not name:
                 raise IndexError
             ui.setconfig(section, name, value, '--config')
             configs.append((section, name, value))
         except (IndexError, ValueError):
             raise error.Abort(_('malformed --config option: %r '
                                '(use --config section.name=value)') % cfg)
 
     return configs
 
+def _earlyparseopts(args):
+    options = {}
+    fancyopts.fancyopts(args, commands.globalopts, options,
+                        gnu=False, early=True)
+    return options
+
 def _earlygetopt(aliases, args, strip=True):
     """Return list of values for an option (or aliases).
 
     The values are listed in the order they appear in args.
     The options and values are removed from args if strip=True.
 
     >>> args = [b'x', b'--cwd', b'foo', b'y']
     >>> _earlygetopt([b'--cwd'], args), args
     (['foo'], ['x', 'y'])
 
     >>> args = [b'x', b'--cwd=bar', b'y']
     >>> _earlygetopt([b'--cwd'], args), args
     (['bar'], ['x', 'y'])
 
     >>> args = [b'x', b'--cwd=bar', b'y']
     >>> _earlygetopt([b'--cwd'], args, strip=False), args
     (['bar'], ['x', '--cwd=bar', 'y'])
 
     >>> args = [b'x', b'-R', b'foo', b'y']
     >>> _earlygetopt([b'-R'], args), args
     (['foo'], ['x', 'y'])
 
     >>> args = [b'x', b'-R', b'foo', b'y']
     >>> _earlygetopt([b'-R'], args, strip=False), args
     (['foo'], ['x', '-R', 'foo', 'y'])
 
     >>> args = [b'x', b'-Rbar', b'y']
     >>> _earlygetopt([b'-R'], args), args
     (['bar'], ['x', 'y'])
 
     >>> args = [b'x', b'-Rbar', b'y']
     >>> _earlygetopt([b'-R'], args, strip=False), args
     (['bar'], ['x', '-Rbar', 'y'])
 
     >>> args = [b'x', b'-R=bar', b'y']
     >>> _earlygetopt([b'-R'], args), args
     (['=bar'], ['x', 'y'])
 
     >>> args = [b'x', b'-R', b'--', b'y']
     >>> _earlygetopt([b'-R'], args), args
     ([], ['x', '-R', '--', 'y'])
     """
     try:
         argcount = args.index("--")
     except ValueError:
         argcount = len(args)
     shortopts = [opt for opt in aliases if len(opt) == 2]
     values = []
     pos = 0
     while pos < argcount:
         fullarg = arg = args[pos]
         equals = -1
         if arg.startswith('--'):
             equals = arg.find('=')
         if equals > -1:
             arg = arg[:equals]
         if arg in aliases:
             if equals > -1:
                 values.append(fullarg[equals + 1:])
                 if strip:
                     del args[pos]
                     argcount -= 1
                 else:
                     pos += 1
             else:
                 if pos + 1 >= argcount:
                     # ignore and let getopt report an error if there is no value
                     break
                 values.append(args[pos + 1])
                 if strip:
                     del args[pos:pos + 2]
                     argcount -= 2
                 else:
                     pos += 2
         elif arg[:2] in shortopts:
             # short option can have no following space, e.g. hg log -Rfoo
             values.append(args[pos][2:])
             if strip:
                 del args[pos]
                 argcount -= 1
             else:
                 pos += 1
         else:
             pos += 1
     return values
 
 def _earlyreqopt(req, name, aliases):
     """Peek a list option without using a full options table"""
+    if req.ui.plain('strictflags'):
+        return req.earlyoptions[name]
     values = _earlygetopt(aliases, req.args, strip=False)
     req.earlyoptions[name] = values
     return values
 
 def _earlyreqoptstr(req, name, aliases):
     """Peek a string option without using a full options table"""
+    if req.ui.plain('strictflags'):
+        return req.earlyoptions[name]
     value = (_earlygetopt(aliases, req.args, strip=False) or [''])[-1]
     req.earlyoptions[name] = value
     return value
 
 def _earlyreqoptbool(req, name, aliases):
     """Peek a boolean option without using a full options table
 
-    >>> req = request([b'x', b'--debugger'])
+    >>> req = request([b'x', b'--debugger'], uimod.ui())
     >>> _earlyreqoptbool(req, b'debugger', [b'--debugger'])
     True
 
-    >>> req = request([b'x', b'--', b'--debugger'])
+    >>> req = request([b'x', b'--', b'--debugger'], uimod.ui())
     >>> _earlyreqoptbool(req, b'debugger', [b'--debugger'])
     """
+    if req.ui.plain('strictflags'):
+        return req.earlyoptions[name]
     try:
         argcount = req.args.index("--")
     except ValueError:
         argcount = len(req.args)
     value = None
     pos = 0
     while pos < argcount:
         arg = req.args[pos]
         if arg in aliases:
             value = True
         pos += 1
     req.earlyoptions[name] = value
     return value
 
 def runcommand(lui, repo, cmd, fullargs, ui, options, d, cmdpats, cmdoptions):
     # run pre-hook, and abort if it fails
     hook.hook(lui, repo, "pre-%s" % cmd, True, args=" ".join(fullargs),
               pats=cmdpats, opts=cmdoptions)
     try:
         ret = _runcommand(ui, options, cmd, d)
         # run post-hook, passing command result
         hook.hook(lui, repo, "post-%s" % cmd, False, args=" ".join(fullargs),
                   result=ret, pats=cmdpats, opts=cmdoptions)
     except Exception:
         # run failure hook and re-raise
         hook.hook(lui, repo, "fail-%s" % cmd, False, args=" ".join(fullargs),
                   pats=cmdpats, opts=cmdoptions)
         raise
     return ret
 
 def _getlocal(ui, rpath, wd=None):
     """Return (path, local ui object) for the given target path.
 
     Takes paths in [cwd]/.hg/hgrc into account."
     """
     if wd is None:
         try:
             wd = pycompat.getcwd()
         except OSError as e:
             raise error.Abort(_("error getting current working directory: %s") %
                               encoding.strtolocal(e.strerror))
     path = cmdutil.findrepo(wd) or ""
     if not path:
         lui = ui
     else:
         lui = ui.copy()
         lui.readconfig(os.path.join(path, ".hg", "hgrc"), path)
 
     if rpath:
         path = lui.expandpath(rpath)
         lui = ui.copy()
         lui.readconfig(os.path.join(path, ".hg", "hgrc"), path)
 
     return path, lui
 
 def _checkshellalias(lui, ui, args):
     """Return the function to run the shell alias, if it is required"""
     options = {}
 
     try:
         args = fancyopts.fancyopts(args, commands.globalopts, options)
     except getopt.GetoptError:
         return
 
     if not args:
         return
 
     cmdtable = commands.table
 
     cmd = args[0]
     try:
         strict = ui.configbool("ui", "strict")
         aliases, entry = cmdutil.findcmd(cmd, cmdtable, strict)
     except (error.AmbiguousCommand, error.UnknownCommand):
         return
 
     cmd = aliases[0]
     fn = entry[0]
 
     if cmd and util.safehasattr(fn, 'shell'):
         # shell alias shouldn't receive early options which are consumed by hg
         args = args[:]
         _earlygetopt(commands.earlyoptflags, args, strip=True)
         d = lambda: fn(ui, *args[1:])
         return lambda: runcommand(lui, None, cmd, args[:1], ui, options, d,
                                   [], {})
 
 def _dispatch(req):
     args = req.args
     ui = req.ui
 
     # check for cwd
     cwd = _earlyreqoptstr(req, 'cwd', ['--cwd'])
     if cwd:
         os.chdir(cwd)
 
     rpath = _earlyreqoptstr(req, 'repository', ["-R", "--repository", "--repo"])
     path, lui = _getlocal(ui, rpath)
 
     uis = {ui, lui}
 
     if req.repo:
         uis.add(req.repo.ui)
 
     if _earlyreqoptbool(req, 'profile', ['--profile']):
         for ui_ in uis:
             ui_.setconfig('profiling', 'enabled', 'true', '--profile')
 
     profile = lui.configbool('profiling', 'enabled')
     with profiling.profile(lui, enabled=profile) as profiler:
         # Configure extensions in phases: uisetup, extsetup, cmdtable, and
         # reposetup
         extensions.loadall(lui)
         # Propagate any changes to lui.__class__ by extensions
         ui.__class__ = lui.__class__
 
         # (uisetup and extsetup are handled in extensions.loadall)
 
         # (reposetup is handled in hg.repository)
 
         addaliases(lui, commands.table)
 
         # All aliases and commands are completely defined, now.
         # Check abbreviation/ambiguity of shell alias.
         shellaliasfn = _checkshellalias(lui, ui, args)
         if shellaliasfn:
             return shellaliasfn()
 
         # check for fallback encoding
         fallback = lui.config('ui', 'fallbackencoding')
         if fallback:
             encoding.fallbackencoding = fallback
 
         fullargs = args
         cmd, func, args, options, cmdoptions = _parse(lui, args)
 
         if options["config"] != req.earlyoptions["config"]:
             raise error.Abort(_("option --config may not be abbreviated!"))
         if options["cwd"] != req.earlyoptions["cwd"]:
             raise error.Abort(_("option --cwd may not be abbreviated!"))
         if options["repository"] != req.earlyoptions["repository"]:
             raise error.Abort(_(
                 "option -R has to be separated from other options (e.g. not "
                 "-qR) and --repository may only be abbreviated as --repo!"))
         if options["debugger"] != req.earlyoptions["debugger"]:
             raise error.Abort(_("option --debugger may not be abbreviated!"))
         # don't validate --profile/--traceback, which can be enabled from now
 
         if options["encoding"]:
             encoding.encoding = options["encoding"]
         if options["encodingmode"]:
             encoding.encodingmode = options["encodingmode"]
         if options["time"]:
             def get_times():
                 t = os.times()
                 if t[4] == 0.0:
                     # Windows leaves this as zero, so use time.clock()
                     t = (t[0], t[1], t[2], t[3], time.clock())
                 return t
             s = get_times()
             def print_time():
                 t = get_times()
                 ui.warn(
                     _("time: real %.3f secs (user %.3f+%.3f sys %.3f+%.3f)\n") %
                     (t[4]-s[4], t[0]-s[0], t[2]-s[2], t[1]-s[1], t[3]-s[3]))
             ui.atexit(print_time)
         if options["profile"]:
             profiler.start()
 
         if options['verbose'] or options['debug'] or options['quiet']:
             for opt in ('verbose', 'debug', 'quiet'):
                 val = str(bool(options[opt]))
                 if pycompat.ispy3:
                     val = val.encode('ascii')
                 for ui_ in uis:
                     ui_.setconfig('ui', opt, val, '--' + opt)
 
         if options['traceback']:
             for ui_ in uis:
                 ui_.setconfig('ui', 'traceback', 'on', '--traceback')
 
         if options['noninteractive']:
             for ui_ in uis:
                 ui_.setconfig('ui', 'interactive', 'off', '-y')
 
         if cmdoptions.get('insecure', False):
             for ui_ in uis:
                 ui_.insecureconnections = True
 
         # setup color handling before pager, because setting up pager
         # might cause incorrect console information
         coloropt = options['color']
         for ui_ in uis:
             if coloropt:
                 ui_.setconfig('ui', 'color', coloropt, '--color')
             color.setup(ui_)
 
         if util.parsebool(options['pager']):
             # ui.pager() expects 'internal-always-' prefix in this case
             ui.pager('internal-always-' + cmd)
         elif options['pager'] != 'auto':
             for ui_ in uis:
                 ui_.disablepager()
 
         if options['version']:
             return commands.version_(ui)
         if options['help']:
             return commands.help_(ui, cmd, command=cmd is not None)
         elif not cmd:
             return commands.help_(ui, 'shortlist')
 
         repo = None
         cmdpats = args[:]
         if not func.norepo:
             # use the repo from the request only if we don't have -R
             if not rpath and not cwd:
                 repo = req.repo
 
             if repo:
                 # set the descriptors of the repo ui to those of ui
                 repo.ui.fin = ui.fin
                 repo.ui.fout = ui.fout
                 repo.ui.ferr = ui.ferr
             else:
                 try:
                     repo = hg.repository(ui, path=path,
                                          presetupfuncs=req.prereposetups)
                     if not repo.local():
                         raise error.Abort(_("repository '%s' is not local")
                                           % path)
                     repo.ui.setconfig("bundle", "mainreporoot", repo.root,
                                       'repo')
                 except error.RequirementError:
                     raise
                 except error.RepoError:
                     if rpath: # invalid -R path
                         raise
                     if not func.optionalrepo:
                         if func.inferrepo and args and not path:
                             # try to infer -R from command args
                             repos = map(cmdutil.findrepo, args)
                             guess = repos[0]
                             if guess and repos.count(guess) == len(repos):
                                 req.args = ['--repository', guess] + fullargs
                                 return _dispatch(req)
                         if not path:
                             raise error.RepoError(_("no repository found in"
                                                     " '%s' (.hg not found)")
                                                   % pycompat.getcwd())
                         raise
             if repo:
                 ui = repo.ui
                 if options['hidden']:
                     repo = repo.unfiltered()
             args.insert(0, repo)
         elif rpath:
             ui.warn(_("warning: --repository ignored\n"))
 
         msg = _formatargs(fullargs)
         ui.log("command", '%s\n', msg)
         strcmdopt = pycompat.strkwargs(cmdoptions)
         d = lambda: util.checksignature(func)(ui, *args, **strcmdopt)
         try:
             return runcommand(lui, repo, cmd, fullargs, ui, options, d,
                               cmdpats, cmdoptions)
         finally:
             if repo and repo != req.repo:
                 repo.close()
 
 def _runcommand(ui, options, cmd, cmdfunc):
     """Run a command function, possibly with profiling enabled."""
     try:
         return cmdfunc()
     except error.SignatureError:
         raise error.CommandError(cmd, _('invalid arguments'))
 
 def _exceptionwarning(ui):
     """Produce a warning message for the current active exception"""
 
     # For compatibility checking, we discard the portion of the hg
     # version after the + on the assumption that if a "normal
     # user" is running a build with a + in it the packager
     # probably built from fairly close to a tag and anyone with a
     # 'make local' copy of hg (where the version number can be out
     # of date) will be clueful enough to notice the implausible
     # version number and try updating.
     ct = util.versiontuple(n=2)
     worst = None, ct, ''
     if ui.config('ui', 'supportcontact') is None:
         for name, mod in extensions.extensions():
             testedwith = getattr(mod, 'testedwith', '')
             if pycompat.ispy3 and isinstance(testedwith, str):
                 testedwith = testedwith.encode(u'utf-8')
             report = getattr(mod, 'buglink', _('the extension author.'))
             if not testedwith.strip():
                 # We found an untested extension. It's likely the culprit.
                 worst = name, 'unknown', report
                 break
 
             # Never blame on extensions bundled with Mercurial.
             if extensions.ismoduleinternal(mod):
                 continue
 
             tested = [util.versiontuple(t, 2) for t in testedwith.split()]
             if ct in tested:
                 continue
 
             lower = [t for t in tested if t < ct]
             nearest = max(lower or tested)
             if worst[0] is None or nearest < worst[1]:
                 worst = name, nearest, report
     if worst[0] is not None:
         name, testedwith, report = worst
         if not isinstance(testedwith, (bytes, str)):
             testedwith = '.'.join([str(c) for c in testedwith])
         warning = (_('** Unknown exception encountered with '
                      'possibly-broken third-party extension %s\n'
                      '** which supports versions %s of Mercurial.\n'
                      '** Please disable %s and try your action again.\n'
                      '** If that fixes the bug please report it to %s\n')
                    % (name, testedwith, name, report))
     else:
         bugtracker = ui.config('ui', 'supportcontact')
         if bugtracker is None:
             bugtracker = _("https://mercurial-scm.org/wiki/BugTracker")
         warning = (_("** unknown exception encountered, "
                      "please report by visiting\n** ") + bugtracker + '\n')
     if pycompat.ispy3:
         sysversion = sys.version.encode(u'utf-8')
     else:
         sysversion = sys.version
     sysversion = sysversion.replace('\n', '')
     warning += ((_("** Python %s\n") % sysversion) +
                 (_("** Mercurial Distributed SCM (version %s)\n") %
                  util.version()) +
                 (_("** Extensions loaded: %s\n") %
                  ", ".join([x[0] for x in extensions.extensions()])))
     return warning
 
 def handlecommandexception(ui):
     """Produce a warning message for broken commands
 
     Called when handling an exception; the exception is reraised if
     this function returns False, ignored otherwise.
     """
     warning = _exceptionwarning(ui)
     ui.log("commandexception", "%s\n%s\n", warning, traceback.format_exc())
     ui.warn(warning)
     return False  # re-raise the exception

mercurial/help/environment.txt

@@ -1,111 +1,119
 HG
     Path to the 'hg' executable, automatically passed when running
     hooks, extensions or external tools. If unset or empty, this is
     the hg executable's name if it's frozen, or an executable named
     'hg' (with %PATHEXT% [defaulting to COM/EXE/BAT/CMD] extensions on
     Windows) is searched.
 
 HGEDITOR
     This is the name of the editor to run when committing. See EDITOR.
 
     (deprecated, see :hg:`help config.ui.editor`)
 
 HGENCODING
     This overrides the default locale setting detected by Mercurial.
     This setting is used to convert data including usernames,
     changeset descriptions, tag names, and branches. This setting can
     be overridden with the --encoding command-line option.
 
 HGENCODINGMODE
     This sets Mercurial's behavior for handling unknown characters
     while transcoding user input. The default is "strict", which
     causes Mercurial to abort if it can't map a character. Other
     settings include "replace", which replaces unknown characters, and
     "ignore", which drops them. This setting can be overridden with
     the --encodingmode command-line option.
 
 HGENCODINGAMBIGUOUS
     This sets Mercurial's behavior for handling characters with
     "ambiguous" widths like accented Latin characters with East Asian
     fonts. By default, Mercurial assumes ambiguous characters are
     narrow, set this variable to "wide" if such characters cause
     formatting problems.
 
 HGMERGE
     An executable to use for resolving merge conflicts. The program
     will be executed with three arguments: local file, remote file,
     ancestor file.
 
     (deprecated, see :hg:`help config.ui.merge`)
 
 HGRCPATH
     A list of files or directories to search for configuration
     files. Item separator is ":" on Unix, ";" on Windows. If HGRCPATH
     is not set, platform default search path is used. If empty, only
     the .hg/hgrc from the current repository is read.
 
     For each element in HGRCPATH:
 
     - if it's a directory, all files ending with .rc are added
     - otherwise, the file itself will be added
 
 HGPLAIN
     When set, this disables any configuration settings that might
     change Mercurial's default output. This includes encoding,
     defaults, verbose mode, debug mode, quiet mode, tracebacks, and
     localization. This can be useful when scripting against Mercurial
     in the face of existing user configuration.
 
+    In addition to the features disabled by ``HGPLAIN=``, the following
+    values can be specified to adjust behavior:
+
+    ``+strictflags``
+        Restrict parsing of command line flags.
+
     Equivalent options set via command line flags or environment
     variables are not overridden.
 
+    See :hg:`help scripting` for details.
+
 HGPLAINEXCEPT
     This is a comma-separated list of features to preserve when
     HGPLAIN is enabled. Currently the following values are supported:
 
     ``alias``
         Don't remove aliases.
     ``i18n``
         Preserve internationalization.
     ``revsetalias``
         Don't remove revset aliases.
     ``templatealias``
         Don't remove template aliases.
     ``progress``
         Don't hide progress output.
 
     Setting HGPLAINEXCEPT to anything (even an empty string) will
     enable plain mode.
 
 HGUSER
     This is the string used as the author of a commit. If not set,
     available values will be considered in this order:
 
     - HGUSER (deprecated)
     - configuration files from the HGRCPATH
     - EMAIL
     - interactive prompt
     - LOGNAME (with ``@hostname`` appended)
 
     (deprecated, see :hg:`help config.ui.username`)
 
 EMAIL
     May be used as the author of a commit; see HGUSER.
 
 LOGNAME
     May be used as the author of a commit; see HGUSER.
 
 VISUAL
     This is the name of the editor to use when committing. See EDITOR.
 
 EDITOR
     Sometimes Mercurial needs to open a text file in an editor for a
     user to modify, for example when writing commit messages. The
     editor it uses is determined by looking at the environment
     variables HGEDITOR, VISUAL and EDITOR, in that order. The first
     non-empty one is chosen. If all of them are empty, the editor
     defaults to 'vi'.
 
 PYTHONPATH
     This is used by Python to find imported modules and may need to be
     set appropriately if this Mercurial is not installed system-wide.

mercurial/help/scripting.txt

@@ -1,174 +1,200
 It is common for machines (as opposed to humans) to consume Mercurial.
 This help topic describes some of the considerations for interfacing
 machines with Mercurial.
 
 Choosing an Interface
 =====================
 
 Machines have a choice of several methods to interface with Mercurial.
 These include:
 
 - Executing the ``hg`` process
 - Querying a HTTP server
 - Calling out to a command server
 
 Executing ``hg`` processes is very similar to how humans interact with
 Mercurial in the shell. It should already be familiar to you.
 
 :hg:`serve` can be used to start a server. By default, this will start
 a "hgweb" HTTP server. This HTTP server has support for machine-readable
 output, such as JSON. For more, see :hg:`help hgweb`.
 
 :hg:`serve` can also start a "command server." Clients can connect
 to this server and issue Mercurial commands over a special protocol.
 For more details on the command server, including links to client
 libraries, see https://www.mercurial-scm.org/wiki/CommandServer.
 
 :hg:`serve` based interfaces (the hgweb and command servers) have the
 advantage over simple ``hg`` process invocations in that they are
 likely more efficient. This is because there is significant overhead
 to spawn new Python processes.
 
 .. tip::
 
    If you need to invoke several ``hg`` processes in short order and/or
    performance is important to you, use of a server-based interface
    is highly recommended.
 
 Environment Variables
 =====================
 
 As documented in :hg:`help environment`, various environment variables
 influence the operation of Mercurial. The following are particularly
 relevant for machines consuming Mercurial:
 
 HGPLAIN
     If not set, Mercurial's output could be influenced by configuration
     settings that impact its encoding, verbose mode, localization, etc.
 
     It is highly recommended for machines to set this variable when
     invoking ``hg`` processes.
 
 HGENCODING
     If not set, the locale used by Mercurial will be detected from the
     environment. If the determined locale does not support display of
     certain characters, Mercurial may render these character sequences
     incorrectly (often by using "?" as a placeholder for invalid
     characters in the current locale).
 
     Explicitly setting this environment variable is a good practice to
     guarantee consistent results. "utf-8" is a good choice on UNIX-like
     environments.
 
 HGRCPATH
     If not set, Mercurial will inherit config options from config files
     using the process described in :hg:`help config`. This includes
     inheriting user or system-wide config files.
 
     When utmost control over the Mercurial configuration is desired, the
     value of ``HGRCPATH`` can be set to an explicit file with known good
     configs. In rare cases, the value can be set to an empty file or the
     null device (often ``/dev/null``) to bypass loading of any user or
     system config files. Note that these approaches can have unintended
     consequences, as the user and system config files often define things
     like the username and extensions that may be required to interface
     with a repository.
 
+Command-line Flags
+==================
+
+Mercurial's default command-line parser is designed for humans, and is not
+robust against malicious input. For instance, you can start a debugger by
+passing ``--debugger`` as an option value::
+
+    $ REV=--debugger sh -c 'hg log -r "$REV"'
+
+This happens because several command-line flags need to be scanned without
+using a concrete command table, which may be modified while loading repository
+settings and extensions.
+
+Since Mercurial 4.4.2, the parsing of such flags may be restricted by setting
+``HGPLAIN=+strictflags``. When this feature is enabled, all early options
+(e.g. ``-R/--repository``, ``--cwd``, ``--config``) must be specified first
+amongst the other global options, and cannot be injected to an arbitrary
+location::
+
+    $ HGPLAIN=+strictflags hg -R "$REPO" log -r "$REV"
+
+In earlier Mercurial versions where ``+strictflags`` isn't available, you
+can mitigate the issue by concatenating an option value with its flag::
+
+    $ hg log -r"$REV" --keyword="$KEYWORD"
+
 Consuming Command Output
 ========================
 
 It is common for machines to need to parse the output of Mercurial
 commands for relevant data. This section describes the various
 techniques for doing so.
 
 Parsing Raw Command Output
 --------------------------
 
 Likely the simplest and most effective solution for consuming command
 output is to simply invoke ``hg`` commands as you would as a user and
 parse their output.
 
 The output of many commands can easily be parsed with tools like
 ``grep``, ``sed``, and ``awk``.
 
 A potential downside with parsing command output is that the output
 of commands can change when Mercurial is upgraded. While Mercurial
 does generally strive for strong backwards compatibility, command
 output does occasionally change. Having tests for your automated
 interactions with ``hg`` commands is generally recommended, but is
 even more important when raw command output parsing is involved.
 
 Using Templates to Control Output
 ---------------------------------
 
 Many ``hg`` commands support templatized output via the
 ``-T/--template`` argument. For more, see :hg:`help templates`.
 
 Templates are useful for explicitly controlling output so that
 you get exactly the data you want formatted how you want it. For
 example, ``log -T {node}\n`` can be used to print a newline
 delimited list of changeset nodes instead of a human-tailored
 output containing authors, dates, descriptions, etc.
 
 .. tip::
 
    If parsing raw command output is too complicated, consider
    using templates to make your life easier.
 
 The ``-T/--template`` argument allows specifying pre-defined styles.
 Mercurial ships with the machine-readable styles ``json`` and ``xml``,
 which provide JSON and XML output, respectively. These are useful for
 producing output that is machine readable as-is.
 
 .. important::
 
    The ``json`` and ``xml`` styles are considered experimental. While
    they may be attractive to use for easily obtaining machine-readable
    output, their behavior may change in subsequent versions.
 
    These styles may also exhibit unexpected results when dealing with
    certain encodings. Mercurial treats things like filenames as a
    series of bytes and normalizing certain byte sequences to JSON
    or XML with certain encoding settings can lead to surprises.
 
 Command Server Output
 ---------------------
 
 If using the command server to interact with Mercurial, you are likely
 using an existing library/API that abstracts implementation details of
 the command server. If so, this interface layer may perform parsing for
 you, saving you the work of implementing it yourself.
 
 Output Verbosity
 ----------------
 
 Commands often have varying output verbosity, even when machine
 readable styles are being used (e.g. ``-T json``). Adding
 ``-v/--verbose`` and ``--debug`` to the command's arguments can
 increase the amount of data exposed by Mercurial.
 
 An alternate way to get the data you need is by explicitly specifying
 a template.
 
 Other Topics
 ============
 
 revsets
    Revisions sets is a functional query language for selecting a set
    of revisions. Think of it as SQL for Mercurial repositories. Revsets
    are useful for querying repositories for specific data.
 
    See :hg:`help revsets` for more.
 
 share extension
    The ``share`` extension provides functionality for sharing
    repository data across several working copies. It can even
    automatically "pool" storage for logically related repositories when
    cloning.
 
    Configuring the ``share`` extension can lead to significant resource
    utilization reduction, particularly around disk space and the
    network. This is especially true for continuous integration (CI)
    environments.
 
    See :hg:`help -e share` for more.

mercurial/ui.py

@@ -1,1836 +1,1840
 # ui.py - user interface bits for mercurial
 #
 # Copyright 2005-2007 Matt Mackall <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 from __future__ import absolute_import
 
 import collections
 import contextlib
 import errno
 import getpass
 import inspect
 import os
 import re
 import signal
 import socket
 import subprocess
 import sys
 import tempfile
 import traceback
 
 from .i18n import _
 from .node import hex
 
 from . import (
     color,
     config,
     configitems,
     encoding,
     error,
     formatter,
     progress,
     pycompat,
     rcutil,
     scmutil,
     util,
 )
 
 urlreq = util.urlreq
 
 # for use with str.translate(None, _keepalnum), to keep just alphanumerics
 _keepalnum = ''.join(c for c in map(pycompat.bytechr, range(256))
                      if not c.isalnum())
 
 # The config knobs that will be altered (if unset) by ui.tweakdefaults.
 tweakrc = """
 [ui]
 # The rollback command is dangerous. As a rule, don't use it.
 rollback = False
 
 [commands]
 # Make `hg status` emit cwd-relative paths by default.
 status.relative = yes
 # Refuse to perform an `hg update` that would cause a file content merge
 update.check = noconflict
 
 [diff]
 git = 1
 """
 
 samplehgrcs = {
     'user':
 b"""# example user config (see 'hg help config' for more info)
 [ui]
 # name and email, e.g.
 # username = Jane Doe <[e-mail]>
 username =
 
 # We recommend enabling tweakdefaults to get slight improvements to
 # the UI over time. Make sure to set HGPLAIN in the environment when
 # writing scripts!
 # tweakdefaults = True
 
 # uncomment to disable color in command output
 # (see 'hg help color' for details)
 # color = never
 
 # uncomment to disable command output pagination
 # (see 'hg help pager' for details)
 # paginate = never
 
 [extensions]
 # uncomment these lines to enable some popular extensions
 # (see 'hg help extensions' for more info)
 #
 # churn =
 """,
 
     'cloned':
 b"""# example repository config (see 'hg help config' for more info)
 [paths]
 default = %s
 
 # path aliases to other clones of this repo in URLs or filesystem paths
 # (see 'hg help config.paths' for more info)
 #
 # default:pushurl = ssh://[e-mail]/hg/jdoes-fork
 # my-fork         = ssh://[e-mail]/hg/jdoes-fork
 # my-clone        = /home/jdoe/jdoes-clone
 
 [ui]
 # name and email (local to this repository, optional), e.g.
 # username = Jane Doe <[e-mail]>
 """,
 
     'local':
 b"""# example repository config (see 'hg help config' for more info)
 [paths]
 # path aliases to other clones of this repo in URLs or filesystem paths
 # (see 'hg help config.paths' for more info)
 #
 # default         = http://example.com/hg/example-repo
 # default:pushurl = ssh://[e-mail]/hg/jdoes-fork
 # my-fork         = ssh://[e-mail]/hg/jdoes-fork
 # my-clone        = /home/jdoe/jdoes-clone
 
 [ui]
 # name and email (local to this repository, optional), e.g.
 # username = Jane Doe <[e-mail]>
 """,
 
     'global':
 b"""# example system-wide hg config (see 'hg help config' for more info)
 
 [ui]
 # uncomment to disable color in command output
 # (see 'hg help color' for details)
 # color = never
 
 # uncomment to disable command output pagination
 # (see 'hg help pager' for details)
 # paginate = never
 
 [extensions]
 # uncomment these lines to enable some popular extensions
 # (see 'hg help extensions' for more info)
 #
 # blackbox =
 # churn =
 """,
 }
 
 def _maybestrurl(maybebytes):
     if maybebytes is None:
         return None
     return pycompat.strurl(maybebytes)
 
 def _maybebytesurl(maybestr):
     if maybestr is None:
         return None
     return pycompat.bytesurl(maybestr)
 
 class httppasswordmgrdbproxy(object):
     """Delays loading urllib2 until it's needed."""
     def __init__(self):
         self._mgr = None
 
     def _get_mgr(self):
         if self._mgr is None:
             self._mgr = urlreq.httppasswordmgrwithdefaultrealm()
         return self._mgr
 
     def add_password(self, realm, uris, user, passwd):
         if isinstance(uris, tuple):
             uris = tuple(_maybestrurl(u) for u in uris)
         else:
             uris = _maybestrurl(uris)
         return self._get_mgr().add_password(
             _maybestrurl(realm), uris,
             _maybestrurl(user), _maybestrurl(passwd))
 
     def find_user_password(self, realm, uri):
         return tuple(_maybebytesurl(v) for v in
                      self._get_mgr().find_user_password(_maybestrurl(realm),
                                                         _maybestrurl(uri)))
 
 def _catchterm(*args):
     raise error.SignalInterrupt
 
 # unique object used to detect no default value has been provided when
 # retrieving configuration value.
 _unset = object()
 
 # _reqexithandlers: callbacks run at the end of a request
 _reqexithandlers = []
 
 class ui(object):
     def __init__(self, src=None):
         """Create a fresh new ui object if no src given
 
         Use uimod.ui.load() to create a ui which knows global and user configs.
         In most cases, you should use ui.copy() to create a copy of an existing
         ui object.
         """
         # _buffers: used for temporary capture of output
         self._buffers = []
         # 3-tuple describing how each buffer in the stack behaves.
         # Values are (capture stderr, capture subprocesses, apply labels).
         self._bufferstates = []
         # When a buffer is active, defines whether we are expanding labels.
         # This exists to prevent an extra list lookup.
         self._bufferapplylabels = None
         self.quiet = self.verbose = self.debugflag = self.tracebackflag = False
         self._reportuntrusted = True
         self._knownconfig = configitems.coreitems
         self._ocfg = config.config() # overlay
         self._tcfg = config.config() # trusted
         self._ucfg = config.config() # untrusted
         self._trustusers = set()
         self._trustgroups = set()
         self.callhooks = True
         # Insecure server connections requested.
         self.insecureconnections = False
         # Blocked time
         self.logblockedtimes = False
         # color mode: see mercurial/color.py for possible value
         self._colormode = None
         self._terminfoparams = {}
         self._styles = {}
 
         if src:
             self.fout = src.fout
             self.ferr = src.ferr
             self.fin = src.fin
             self.pageractive = src.pageractive
             self._disablepager = src._disablepager
             self._tweaked = src._tweaked
 
             self._tcfg = src._tcfg.copy()
             self._ucfg = src._ucfg.copy()
             self._ocfg = src._ocfg.copy()
             self._trustusers = src._trustusers.copy()
             self._trustgroups = src._trustgroups.copy()
             self.environ = src.environ
             self.callhooks = src.callhooks
             self.insecureconnections = src.insecureconnections
             self._colormode = src._colormode
             self._terminfoparams = src._terminfoparams.copy()
             self._styles = src._styles.copy()
 
             self.fixconfig()
 
             self.httppasswordmgrdb = src.httppasswordmgrdb
             self._blockedtimes = src._blockedtimes
         else:
             self.fout = util.stdout
             self.ferr = util.stderr
             self.fin = util.stdin
             self.pageractive = False
             self._disablepager = False
             self._tweaked = False
 
             # shared read-only environment
             self.environ = encoding.environ
 
             self.httppasswordmgrdb = httppasswordmgrdbproxy()
             self._blockedtimes = collections.defaultdict(int)
 
         allowed = self.configlist('experimental', 'exportableenviron')
         if '*' in allowed:
             self._exportableenviron = self.environ
         else:
             self._exportableenviron = {}
             for k in allowed:
                 if k in self.environ:
                     self._exportableenviron[k] = self.environ[k]
 
     @classmethod
     def load(cls):
         """Create a ui and load global and user configs"""
         u = cls()
         # we always trust global config files and environment variables
         for t, f in rcutil.rccomponents():
             if t == 'path':
                 u.readconfig(f, trust=True)
             elif t == 'items':
                 sections = set()
                 for section, name, value, source in f:
                     # do not set u._ocfg
                     # XXX clean this up once immutable config object is a thing
                     u._tcfg.set(section, name, value, source)
                     u._ucfg.set(section, name, value, source)
                     sections.add(section)
                 for section in sections:
                     u.fixconfig(section=section)
             else:
                 raise error.ProgrammingError('unknown rctype: %s' % t)
         u._maybetweakdefaults()
         return u
 
     def _maybetweakdefaults(self):
         if not self.configbool('ui', 'tweakdefaults'):
             return
         if self._tweaked or self.plain('tweakdefaults'):
             return
 
         # Note: it is SUPER IMPORTANT that you set self._tweaked to
         # True *before* any calls to setconfig(), otherwise you'll get
         # infinite recursion between setconfig and this method.
         #
         # TODO: We should extract an inner method in setconfig() to
         # avoid this weirdness.
         self._tweaked = True
         tmpcfg = config.config()
         tmpcfg.parse('<tweakdefaults>', tweakrc)
         for section in tmpcfg:
             for name, value in tmpcfg.items(section):
                 if not self.hasconfig(section, name):
                     self.setconfig(section, name, value, "<tweakdefaults>")
 
     def copy(self):
         return self.__class__(self)
 
     def resetstate(self):
         """Clear internal state that shouldn't persist across commands"""
         if self._progbar:
             self._progbar.resetstate()  # reset last-print time of progress bar
         self.httppasswordmgrdb = httppasswordmgrdbproxy()
 
     @contextlib.contextmanager
     def timeblockedsection(self, key):
         # this is open-coded below - search for timeblockedsection to find them
         starttime = util.timer()
         try:
             yield
         finally:
             self._blockedtimes[key + '_blocked'] += \
                 (util.timer() - starttime) * 1000
 
     def formatter(self, topic, opts):
         return formatter.formatter(self, self, topic, opts)
 
     def _trusted(self, fp, f):
         st = util.fstat(fp)
         if util.isowner(st):
             return True
 
         tusers, tgroups = self._trustusers, self._trustgroups
         if '*' in tusers or '*' in tgroups:
             return True
 
         user = util.username(st.st_uid)
         group = util.groupname(st.st_gid)
         if user in tusers or group in tgroups or user == util.username():
             return True
 
         if self._reportuntrusted:
             self.warn(_('not trusting file %s from untrusted '
                         'user %s, group %s\n') % (f, user, group))
         return False
 
     def readconfig(self, filename, root=None, trust=False,
                    sections=None, remap=None):
         try:
             fp = open(filename, u'rb')
         except IOError:
             if not sections: # ignore unless we were looking for something
                 return
             raise
 
         cfg = config.config()
         trusted = sections or trust or self._trusted(fp, filename)
 
         try:
             cfg.read(filename, fp, sections=sections, remap=remap)
             fp.close()
         except error.ConfigError as inst:
             if trusted:
                 raise
             self.warn(_("ignored: %s\n") % str(inst))
 
         if self.plain():
             for k in ('debug', 'fallbackencoding', 'quiet', 'slash',
                       'logtemplate', 'statuscopies', 'style',
                       'traceback', 'verbose'):
                 if k in cfg['ui']:
                     del cfg['ui'][k]
             for k, v in cfg.items('defaults'):
                 del cfg['defaults'][k]
             for k, v in cfg.items('commands'):
                 del cfg['commands'][k]
         # Don't remove aliases from the configuration if in the exceptionlist
         if self.plain('alias'):
             for k, v in cfg.items('alias'):
                 del cfg['alias'][k]
         if self.plain('revsetalias'):
             for k, v in cfg.items('revsetalias'):
                 del cfg['revsetalias'][k]
         if self.plain('templatealias'):
             for k, v in cfg.items('templatealias'):
                 del cfg['templatealias'][k]
 
         if trusted:
             self._tcfg.update(cfg)
             self._tcfg.update(self._ocfg)
         self._ucfg.update(cfg)
         self._ucfg.update(self._ocfg)
 
         if root is None:
             root = os.path.expanduser('~')
         self.fixconfig(root=root)
 
     def fixconfig(self, root=None, section=None):
         if section in (None, 'paths'):
             # expand vars and ~
             # translate paths relative to root (or home) into absolute paths
             root = root or pycompat.getcwd()
             for c in self._tcfg, self._ucfg, self._ocfg:
                 for n, p in c.items('paths'):
                     # Ignore sub-options.
                     if ':' in n:
                         continue
                     if not p:
                         continue
                     if '%%' in p:
                         s = self.configsource('paths', n) or 'none'
                         self.warn(_("(deprecated '%%' in path %s=%s from %s)\n")
                                   % (n, p, s))
                         p = p.replace('%%', '%')
                     p = util.expandpath(p)
                     if not util.hasscheme(p) and not os.path.isabs(p):
                         p = os.path.normpath(os.path.join(root, p))
                     c.set("paths", n, p)
 
         if section in (None, 'ui'):
             # update ui options
             self.debugflag = self.configbool('ui', 'debug')
             self.verbose = self.debugflag or self.configbool('ui', 'verbose')
             self.quiet = not self.debugflag and self.configbool('ui', 'quiet')
             if self.verbose and self.quiet:
                 self.quiet = self.verbose = False
             self._reportuntrusted = self.debugflag or self.configbool("ui",
                 "report_untrusted")
             self.tracebackflag = self.configbool('ui', 'traceback')
             self.logblockedtimes = self.configbool('ui', 'logblockedtimes')
 
         if section in (None, 'trusted'):
             # update trust information
             self._trustusers.update(self.configlist('trusted', 'users'))
             self._trustgroups.update(self.configlist('trusted', 'groups'))
 
     def backupconfig(self, section, item):
         return (self._ocfg.backup(section, item),
                 self._tcfg.backup(section, item),
                 self._ucfg.backup(section, item),)
     def restoreconfig(self, data):
         self._ocfg.restore(data[0])
         self._tcfg.restore(data[1])
         self._ucfg.restore(data[2])
 
     def setconfig(self, section, name, value, source=''):
         for cfg in (self._ocfg, self._tcfg, self._ucfg):
             cfg.set(section, name, value, source)
         self.fixconfig(section=section)
         self._maybetweakdefaults()
 
     def _data(self, untrusted):
         return untrusted and self._ucfg or self._tcfg
 
     def configsource(self, section, name, untrusted=False):
         return self._data(untrusted).source(section, name)
 
     def config(self, section, name, default=_unset, untrusted=False):
         """return the plain string version of a config"""
         value = self._config(section, name, default=default,
                              untrusted=untrusted)
         if value is _unset:
             return None
         return value
 
     def _config(self, section, name, default=_unset, untrusted=False):
         value = itemdefault = default
         item = self._knownconfig.get(section, {}).get(name)
         alternates = [(section, name)]
 
         if item is not None:
             alternates.extend(item.alias)
             if callable(item.default):
                 itemdefault = item.default()
             else:
                 itemdefault = item.default
         else:
             msg = ("accessing unregistered config item: '%s.%s'")
             msg %= (section, name)
             self.develwarn(msg, 2, 'warn-config-unknown')
 
         if default is _unset:
             if item is None:
                 value = default
             elif item.default is configitems.dynamicdefault:
                 value = None
                 msg = "config item requires an explicit default value: '%s.%s'"
                 msg %= (section, name)
                 self.develwarn(msg, 2, 'warn-config-default')
             else:
                 value = itemdefault
         elif (item is not None
               and item.default is not configitems.dynamicdefault
               and default != itemdefault):
             msg = ("specifying a mismatched default value for a registered "
                    "config item: '%s.%s' '%s'")
             msg %= (section, name, default)
             self.develwarn(msg, 2, 'warn-config-default')
 
         for s, n in alternates:
             candidate = self._data(untrusted).get(s, n, None)
             if candidate is not None:
                 value = candidate
                 section = s
                 name = n
                 break
 
         if self.debugflag and not untrusted and self._reportuntrusted:
             for s, n in alternates:
                 uvalue = self._ucfg.get(s, n)
                 if uvalue is not None and uvalue != value:
                     self.debug("ignoring untrusted configuration option "
                                "%s.%s = %s\n" % (s, n, uvalue))
         return value
 
     def configsuboptions(self, section, name, default=_unset, untrusted=False):
         """Get a config option and all sub-options.
 
         Some config options have sub-options that are declared with the
         format "key:opt = value". This method is used to return the main
         option and all its declared sub-options.
 
         Returns a 2-tuple of ``(option, sub-options)``, where `sub-options``
         is a dict of defined sub-options where keys and values are strings.
         """
         main = self.config(section, name, default, untrusted=untrusted)
         data = self._data(untrusted)
         sub = {}
         prefix = '%s:' % name
         for k, v in data.items(section):
             if k.startswith(prefix):
                 sub[k[len(prefix):]] = v
 
         if self.debugflag and not untrusted and self._reportuntrusted:
             for k, v in sub.items():
                 uvalue = self._ucfg.get(section, '%s:%s' % (name, k))
                 if uvalue is not None and uvalue != v:
                     self.debug('ignoring untrusted configuration option '
                                '%s:%s.%s = %s\n' % (section, name, k, uvalue))
 
         return main, sub
 
     def configpath(self, section, name, default=_unset, untrusted=False):
         'get a path config item, expanded relative to repo root or config file'
         v = self.config(section, name, default, untrusted)
         if v is None:
             return None
         if not os.path.isabs(v) or "://" not in v:
             src = self.configsource(section, name, untrusted)
             if ':' in src:
                 base = os.path.dirname(src.rsplit(':')[0])
                 v = os.path.join(base, os.path.expanduser(v))
         return v
 
     def configbool(self, section, name, default=_unset, untrusted=False):
         """parse a configuration element as a boolean
 
         >>> u = ui(); s = b'foo'
         >>> u.setconfig(s, b'true', b'yes')
         >>> u.configbool(s, b'true')
         True
         >>> u.setconfig(s, b'false', b'no')
         >>> u.configbool(s, b'false')
         False
         >>> u.configbool(s, b'unknown')
         False
         >>> u.configbool(s, b'unknown', True)
         True
         >>> u.setconfig(s, b'invalid', b'somevalue')
         >>> u.configbool(s, b'invalid')
         Traceback (most recent call last):
             ...
         ConfigError: foo.invalid is not a boolean ('somevalue')
         """
 
         v = self._config(section, name, default, untrusted=untrusted)
         if v is None:
             return v
         if v is _unset:
             if default is _unset:
                 return False
             return default
         if isinstance(v, bool):
             return v
         b = util.parsebool(v)
         if b is None:
             raise error.ConfigError(_("%s.%s is not a boolean ('%s')")
                                     % (section, name, v))
         return b
 
     def configwith(self, convert, section, name, default=_unset,
                    desc=None, untrusted=False):
         """parse a configuration element with a conversion function
 
         >>> u = ui(); s = b'foo'
         >>> u.setconfig(s, b'float1', b'42')
         >>> u.configwith(float, s, b'float1')
         42.0
         >>> u.setconfig(s, b'float2', b'-4.25')
         >>> u.configwith(float, s, b'float2')
         -4.25
         >>> u.configwith(float, s, b'unknown', 7)
         7.0
         >>> u.setconfig(s, b'invalid', b'somevalue')
         >>> u.configwith(float, s, b'invalid')
         Traceback (most recent call last):
             ...
         ConfigError: foo.invalid is not a valid float ('somevalue')
         >>> u.configwith(float, s, b'invalid', desc=b'womble')
         Traceback (most recent call last):
             ...
         ConfigError: foo.invalid is not a valid womble ('somevalue')
         """
 
         v = self.config(section, name, default, untrusted)
         if v is None:
             return v # do not attempt to convert None
         try:
             return convert(v)
         except (ValueError, error.ParseError):
             if desc is None:
                 desc = pycompat.sysbytes(convert.__name__)
             raise error.ConfigError(_("%s.%s is not a valid %s ('%s')")
                                     % (section, name, desc, v))
 
     def configint(self, section, name, default=_unset, untrusted=False):
         """parse a configuration element as an integer
 
         >>> u = ui(); s = b'foo'
         >>> u.setconfig(s, b'int1', b'42')
         >>> u.configint(s, b'int1')
         42
         >>> u.setconfig(s, b'int2', b'-42')
         >>> u.configint(s, b'int2')
         -42
         >>> u.configint(s, b'unknown', 7)
         7
         >>> u.setconfig(s, b'invalid', b'somevalue')
         >>> u.configint(s, b'invalid')
         Traceback (most recent call last):
             ...
         ConfigError: foo.invalid is not a valid integer ('somevalue')
         """
 
         return self.configwith(int, section, name, default, 'integer',
                                untrusted)
 
     def configbytes(self, section, name, default=_unset, untrusted=False):
         """parse a configuration element as a quantity in bytes
 
         Units can be specified as b (bytes), k or kb (kilobytes), m or
         mb (megabytes), g or gb (gigabytes).
 
         >>> u = ui(); s = b'foo'
         >>> u.setconfig(s, b'val1', b'42')
         >>> u.configbytes(s, b'val1')
         42
         >>> u.setconfig(s, b'val2', b'42.5 kb')
         >>> u.configbytes(s, b'val2')
         43520
         >>> u.configbytes(s, b'unknown', b'7 MB')
         7340032
         >>> u.setconfig(s, b'invalid', b'somevalue')
         >>> u.configbytes(s, b'invalid')
         Traceback (most recent call last):
             ...
         ConfigError: foo.invalid is not a byte quantity ('somevalue')
         """
 
         value = self._config(section, name, default, untrusted)
         if value is _unset:
             if default is _unset:
                 default = 0
             value = default
         if not isinstance(value, bytes):
             return value
         try:
             return util.sizetoint(value)
         except error.ParseError:
             raise error.ConfigError(_("%s.%s is not a byte quantity ('%s')")
                                     % (section, name, value))
 
     def configlist(self, section, name, default=_unset, untrusted=False):
         """parse a configuration element as a list of comma/space separated
         strings
 
         >>> u = ui(); s = b'foo'
         >>> u.setconfig(s, b'list1', b'this,is "a small" ,test')
         >>> u.configlist(s, b'list1')
         ['this', 'is', 'a small', 'test']
         """
         # default is not always a list
         v = self.configwith(config.parselist, section, name, default,
                                'list', untrusted)
         if isinstance(v, bytes):
             return config.parselist(v)
         elif v is None:
             return []
         return v
 
     def configdate(self, section, name, default=_unset, untrusted=False):
         """parse a configuration element as a tuple of ints
 
         >>> u = ui(); s = b'foo'
         >>> u.setconfig(s, b'date', b'0 0')
         >>> u.configdate(s, b'date')
         (0, 0)
         """
         if self.config(section, name, default, untrusted):
             return self.configwith(util.parsedate, section, name, default,
                                    'date', untrusted)
         if default is _unset:
             return None
         return default
 
     def hasconfig(self, section, name, untrusted=False):
         return self._data(untrusted).hasitem(section, name)
 
     def has_section(self, section, untrusted=False):
         '''tell whether section exists in config.'''
         return section in self._data(untrusted)
 
     def configitems(self, section, untrusted=False, ignoresub=False):
         items = self._data(untrusted).items(section)
         if ignoresub:
             newitems = {}
             for k, v in items:
                 if ':' not in k:
                     newitems[k] = v
             items = newitems.items()
         if self.debugflag and not untrusted and self._reportuntrusted:
             for k, v in self._ucfg.items(section):
                 if self._tcfg.get(section, k) != v:
                     self.debug("ignoring untrusted configuration option "
                                "%s.%s = %s\n" % (section, k, v))
         return items
 
     def walkconfig(self, untrusted=False):
         cfg = self._data(untrusted)
         for section in cfg.sections():
             for name, value in self.configitems(section, untrusted):
                 yield section, name, value
 
     def plain(self, feature=None):
         '''is plain mode active?
 
         Plain mode means that all configuration variables which affect
         the behavior and output of Mercurial should be
         ignored. Additionally, the output should be stable,
         reproducible and suitable for use in scripts or applications.
 
         The only way to trigger plain mode is by setting either the
         `HGPLAIN' or `HGPLAINEXCEPT' environment variables.
 
         The return value can either be
         - False if HGPLAIN is not set, or feature is in HGPLAINEXCEPT
+        - False if feature is disabled by default and not included in HGPLAIN
         - True otherwise
         '''
         if ('HGPLAIN' not in encoding.environ and
                 'HGPLAINEXCEPT' not in encoding.environ):
             return False
         exceptions = encoding.environ.get('HGPLAINEXCEPT',
                 '').strip().split(',')
+        # TODO: add support for HGPLAIN=+feature,-feature syntax
+        if '+strictflags' not in encoding.environ.get('HGPLAIN', '').split(','):
+            exceptions.append('strictflags')
         if feature and exceptions:
             return feature not in exceptions
         return True
 
     def username(self, acceptempty=False):
         """Return default username to be used in commits.
 
         Searched in this order: $HGUSER, [ui] section of hgrcs, $EMAIL
         and stop searching if one of these is set.
         If not found and acceptempty is True, returns None.
         If not found and ui.askusername is True, ask the user, else use
         ($LOGNAME or $USER or $LNAME or $USERNAME) + "@full.hostname".
         If no username could be found, raise an Abort error.
         """
         user = encoding.environ.get("HGUSER")
         if user is None:
             user = self.config("ui", "username")
             if user is not None:
                 user = os.path.expandvars(user)
         if user is None:
             user = encoding.environ.get("EMAIL")
         if user is None and acceptempty:
             return user
         if user is None and self.configbool("ui", "askusername"):
             user = self.prompt(_("enter a commit username:"), default=None)
         if user is None and not self.interactive():
             try:
                 user = '%s@%s' % (util.getuser(), socket.getfqdn())
                 self.warn(_("no username found, using '%s' instead\n") % user)
             except KeyError:
                 pass
         if not user:
             raise error.Abort(_('no username supplied'),
                              hint=_("use 'hg config --edit' "
                                     'to set your username'))
         if "\n" in user:
             raise error.Abort(_("username %s contains a newline\n")
                               % repr(user))
         return user
 
     def shortuser(self, user):
         """Return a short representation of a user name or email address."""
         if not self.verbose:
             user = util.shortuser(user)
         return user
 
     def expandpath(self, loc, default=None):
         """Return repository location relative to cwd or from [paths]"""
         try:
             p = self.paths.getpath(loc)
             if p:
                 return p.rawloc
         except error.RepoError:
             pass
 
         if default:
             try:
                 p = self.paths.getpath(default)
                 if p:
                     return p.rawloc
             except error.RepoError:
                 pass
 
         return loc
 
     @util.propertycache
     def paths(self):
         return paths(self)
 
     def pushbuffer(self, error=False, subproc=False, labeled=False):
         """install a buffer to capture standard output of the ui object
 
         If error is True, the error output will be captured too.
 
         If subproc is True, output from subprocesses (typically hooks) will be
         captured too.
 
         If labeled is True, any labels associated with buffered
         output will be handled. By default, this has no effect
         on the output returned, but extensions and GUI tools may
         handle this argument and returned styled output. If output
         is being buffered so it can be captured and parsed or
         processed, labeled should not be set to True.
         """
         self._buffers.append([])
         self._bufferstates.append((error, subproc, labeled))
         self._bufferapplylabels = labeled
 
     def popbuffer(self):
         '''pop the last buffer and return the buffered output'''
         self._bufferstates.pop()
         if self._bufferstates:
             self._bufferapplylabels = self._bufferstates[-1][2]
         else:
             self._bufferapplylabels = None
 
         return "".join(self._buffers.pop())
 
     def write(self, *args, **opts):
         '''write args to output
 
         By default, this method simply writes to the buffer or stdout.
         Color mode can be set on the UI class to have the output decorated
         with color modifier before being written to stdout.
 
         The color used is controlled by an optional keyword argument, "label".
         This should be a string containing label names separated by space.
         Label names take the form of "topic.type". For example, ui.debug()
         issues a label of "ui.debug".
 
         When labeling output for a specific command, a label of
         "cmdname.type" is recommended. For example, status issues
         a label of "status.modified" for modified files.
         '''
         if self._buffers and not opts.get('prompt', False):
             if self._bufferapplylabels:
                 label = opts.get('label', '')
                 self._buffers[-1].extend(self.label(a, label) for a in args)
             else:
                 self._buffers[-1].extend(args)
         elif self._colormode == 'win32':
             # windows color printing is its own can of crab, defer to
             # the color module and that is it.
             color.win32print(self, self._write, *args, **opts)
         else:
             msgs = args
             if self._colormode is not None:
                 label = opts.get('label', '')
                 msgs = [self.label(a, label) for a in args]
             self._write(*msgs, **opts)
 
     def _write(self, *msgs, **opts):
         self._progclear()
         # opencode timeblockedsection because this is a critical path
         starttime = util.timer()
         try:
             for a in msgs:
                 self.fout.write(a)
         except IOError as err:
             raise error.StdioError(err)
         finally:
             self._blockedtimes['stdio_blocked'] += \
                 (util.timer() - starttime) * 1000
 
     def write_err(self, *args, **opts):
         self._progclear()
         if self._bufferstates and self._bufferstates[-1][0]:
             self.write(*args, **opts)
         elif self._colormode == 'win32':
             # windows color printing is its own can of crab, defer to
             # the color module and that is it.
             color.win32print(self, self._write_err, *args, **opts)
         else:
             msgs = args
             if self._colormode is not None:
                 label = opts.get('label', '')
                 msgs = [self.label(a, label) for a in args]
             self._write_err(*msgs, **opts)
 
     def _write_err(self, *msgs, **opts):
         try:
             with self.timeblockedsection('stdio'):
                 if not getattr(self.fout, 'closed', False):
                     self.fout.flush()
                 for a in msgs:
                     self.ferr.write(a)
                 # stderr may be buffered under win32 when redirected to files,
                 # including stdout.
                 if not getattr(self.ferr, 'closed', False):
                     self.ferr.flush()
         except IOError as inst:
             if inst.errno not in (errno.EPIPE, errno.EIO, errno.EBADF):
                 raise error.StdioError(inst)
 
     def flush(self):
         # opencode timeblockedsection because this is a critical path
         starttime = util.timer()
         try:
             try:
                 self.fout.flush()
             except IOError as err:
                 if err.errno not in (errno.EPIPE, errno.EIO, errno.EBADF):
                     raise error.StdioError(err)
             finally:
                 try:
                     self.ferr.flush()
                 except IOError as err:
                     if err.errno not in (errno.EPIPE, errno.EIO, errno.EBADF):
                         raise error.StdioError(err)
         finally:
             self._blockedtimes['stdio_blocked'] += \
                 (util.timer() - starttime) * 1000
 
     def _isatty(self, fh):
         if self.configbool('ui', 'nontty'):
             return False
         return util.isatty(fh)
 
     def disablepager(self):
         self._disablepager = True
 
     def pager(self, command):
         """Start a pager for subsequent command output.
 
         Commands which produce a long stream of output should call
         this function to activate the user's preferred pagination
         mechanism (which may be no pager). Calling this function
         precludes any future use of interactive functionality, such as
         prompting the user or activating curses.
 
         Args:
           command: The full, non-aliased name of the command. That is, "log"
                    not "history, "summary" not "summ", etc.
         """
         if (self._disablepager
             or self.pageractive):
             # how pager should do is already determined
             return
 
         if not command.startswith('internal-always-') and (
             # explicit --pager=on (= 'internal-always-' prefix) should
             # take precedence over disabling factors below
             command in self.configlist('pager', 'ignore')
             or not self.configbool('ui', 'paginate')
             or not self.configbool('pager', 'attend-' + command, True)
             # TODO: if we want to allow HGPLAINEXCEPT=pager,
             # formatted() will need some adjustment.
             or not self.formatted()
             or self.plain()
             or self._buffers
             # TODO: expose debugger-enabled on the UI object
             or '--debugger' in pycompat.sysargv):
             # We only want to paginate if the ui appears to be
             # interactive, the user didn't say HGPLAIN or
             # HGPLAINEXCEPT=pager, and the user didn't specify --debug.
             return
 
         pagercmd = self.config('pager', 'pager', rcutil.fallbackpager)
         if not pagercmd:
             return
 
         pagerenv = {}
         for name, value in rcutil.defaultpagerenv().items():
             if name not in encoding.environ:
                 pagerenv[name] = value
 
         self.debug('starting pager for command %r\n' % command)
         self.flush()
 
         wasformatted = self.formatted()
         if util.safehasattr(signal, "SIGPIPE"):
             signal.signal(signal.SIGPIPE, _catchterm)
         if self._runpager(pagercmd, pagerenv):
             self.pageractive = True
             # Preserve the formatted-ness of the UI. This is important
             # because we mess with stdout, which might confuse
             # auto-detection of things being formatted.
             self.setconfig('ui', 'formatted', wasformatted, 'pager')
             self.setconfig('ui', 'interactive', False, 'pager')
 
             # If pagermode differs from color.mode, reconfigure color now that
             # pageractive is set.
             cm = self._colormode
             if cm != self.config('color', 'pagermode', cm):
                 color.setup(self)
         else:
             # If the pager can't be spawned in dispatch when --pager=on is
             # given, don't try again when the command runs, to avoid a duplicate
             # warning about a missing pager command.
             self.disablepager()
 
     def _runpager(self, command, env=None):
         """Actually start the pager and set up file descriptors.
 
         This is separate in part so that extensions (like chg) can
         override how a pager is invoked.
         """
         if command == 'cat':
             # Save ourselves some work.
             return False
         # If the command doesn't contain any of these characters, we
         # assume it's a binary and exec it directly. This means for
         # simple pager command configurations, we can degrade
         # gracefully and tell the user about their broken pager.
         shell = any(c in command for c in "|&;<>()$`\\\"' \t\n*?[#~=%")
 
         if pycompat.iswindows and not shell:
             # Window's built-in `more` cannot be invoked with shell=False, but
             # its `more.com` can.  Hide this implementation detail from the
             # user so we can also get sane bad PAGER behavior.  MSYS has
             # `more.exe`, so do a cmd.exe style resolution of the executable to
             # determine which one to use.
             fullcmd = util.findexe(command)
             if not fullcmd:
                 self.warn(_("missing pager command '%s', skipping pager\n")
                           % command)
                 return False
 
             command = fullcmd
 
         try:
             pager = subprocess.Popen(
                 command, shell=shell, bufsize=-1,
                 close_fds=util.closefds, stdin=subprocess.PIPE,
                 stdout=util.stdout, stderr=util.stderr,
                 env=util.shellenviron(env))
         except OSError as e:
             if e.errno == errno.ENOENT and not shell:
                 self.warn(_("missing pager command '%s', skipping pager\n")
                           % command)
                 return False
             raise
 
         # back up original file descriptors
         stdoutfd = os.dup(util.stdout.fileno())
         stderrfd = os.dup(util.stderr.fileno())
 
         os.dup2(pager.stdin.fileno(), util.stdout.fileno())
         if self._isatty(util.stderr):
             os.dup2(pager.stdin.fileno(), util.stderr.fileno())
 
         @self.atexit
         def killpager():
             if util.safehasattr(signal, "SIGINT"):
                 signal.signal(signal.SIGINT, signal.SIG_IGN)
             # restore original fds, closing pager.stdin copies in the process
             os.dup2(stdoutfd, util.stdout.fileno())
             os.dup2(stderrfd, util.stderr.fileno())
             pager.stdin.close()
             pager.wait()
 
         return True
 
     @property
     def _exithandlers(self):
         return _reqexithandlers
 
     def atexit(self, func, *args, **kwargs):
         '''register a function to run after dispatching a request
 
         Handlers do not stay registered across request boundaries.'''
         self._exithandlers.append((func, args, kwargs))
         return func
 
     def interface(self, feature):
         """what interface to use for interactive console features?
 
         The interface is controlled by the value of `ui.interface` but also by
         the value of feature-specific configuration. For example:
 
         ui.interface.histedit = text
         ui.interface.chunkselector = curses
 
         Here the features are "histedit" and "chunkselector".
 
         The configuration above means that the default interfaces for commands
         is curses, the interface for histedit is text and the interface for
         selecting chunk is crecord (the best curses interface available).
 
         Consider the following example:
         ui.interface = curses
         ui.interface.histedit = text
 
         Then histedit will use the text interface and chunkselector will use
         the default curses interface (crecord at the moment).
         """
         alldefaults = frozenset(["text", "curses"])
 
         featureinterfaces = {
             "chunkselector": [
                 "text",
                 "curses",
             ]
         }
 
         # Feature-specific interface
         if feature not in featureinterfaces.keys():
             # Programming error, not user error
             raise ValueError("Unknown feature requested %s" % feature)
 
         availableinterfaces = frozenset(featureinterfaces[feature])
         if alldefaults > availableinterfaces:
             # Programming error, not user error. We need a use case to
             # define the right thing to do here.
             raise ValueError(
                 "Feature %s does not handle all default interfaces" %
                 feature)
 
         if self.plain():
             return "text"
 
         # Default interface for all the features
         defaultinterface = "text"
         i = self.config("ui", "interface")
         if i in alldefaults:
             defaultinterface = i
 
         choseninterface = defaultinterface
         f = self.config("ui", "interface.%s" % feature)
         if f in availableinterfaces:
             choseninterface = f
 
         if i is not None and defaultinterface != i:
             if f is not None:
                 self.warn(_("invalid value for ui.interface: %s\n") %
                           (i,))
             else:
                 self.warn(_("invalid value for ui.interface: %s (using %s)\n") %
                          (i, choseninterface))
         if f is not None and choseninterface != f:
             self.warn(_("invalid value for ui.interface.%s: %s (using %s)\n") %
                       (feature, f, choseninterface))
 
         return choseninterface
 
     def interactive(self):
         '''is interactive input allowed?
 
         An interactive session is a session where input can be reasonably read
         from `sys.stdin'. If this function returns false, any attempt to read
         from stdin should fail with an error, unless a sensible default has been
         specified.
 
         Interactiveness is triggered by the value of the `ui.interactive'
         configuration variable or - if it is unset - when `sys.stdin' points
         to a terminal device.
 
         This function refers to input only; for output, see `ui.formatted()'.
         '''
         i = self.configbool("ui", "interactive")
         if i is None:
             # some environments replace stdin without implementing isatty
             # usually those are non-interactive
             return self._isatty(self.fin)
 
         return i
 
     def termwidth(self):
         '''how wide is the terminal in columns?
         '''
         if 'COLUMNS' in encoding.environ:
             try:
                 return int(encoding.environ['COLUMNS'])
             except ValueError:
                 pass
         return scmutil.termsize(self)[0]
 
     def formatted(self):
         '''should formatted output be used?
 
         It is often desirable to format the output to suite the output medium.
         Examples of this are truncating long lines or colorizing messages.
         However, this is not often not desirable when piping output into other
         utilities, e.g. `grep'.
 
         Formatted output is triggered by the value of the `ui.formatted'
         configuration variable or - if it is unset - when `sys.stdout' points
         to a terminal device. Please note that `ui.formatted' should be
         considered an implementation detail; it is not intended for use outside
         Mercurial or its extensions.
 
         This function refers to output only; for input, see `ui.interactive()'.
         This function always returns false when in plain mode, see `ui.plain()'.
         '''
         if self.plain():
             return False
 
         i = self.configbool("ui", "formatted")
         if i is None:
             # some environments replace stdout without implementing isatty
             # usually those are non-interactive
             return self._isatty(self.fout)
 
         return i
 
     def _readline(self, prompt=''):
         if self._isatty(self.fin):
             try:
                 # magically add command line editing support, where
                 # available
                 import readline
                 # force demandimport to really load the module
                 readline.read_history_file
                 # windows sometimes raises something other than ImportError
             except Exception:
                 pass
 
         # call write() so output goes through subclassed implementation
         # e.g. color extension on Windows
         self.write(prompt, prompt=True)
         self.flush()
 
         # prompt ' ' must exist; otherwise readline may delete entire line
         # - http://bugs.python.org/issue12833
         with self.timeblockedsection('stdio'):
             line = util.bytesinput(self.fin, self.fout, r' ')
 
         # When stdin is in binary mode on Windows, it can cause
         # raw_input() to emit an extra trailing carriage return
         if pycompat.oslinesep == '\r\n' and line and line[-1] == '\r':
             line = line[:-1]
         return line
 
     def prompt(self, msg, default="y"):
         """Prompt user with msg, read response.
         If ui is not interactive, the default is returned.
         """
         if not self.interactive():
             self.write(msg, ' ', default or '', "\n")
             return default
         try:
             r = self._readline(self.label(msg, 'ui.prompt'))
             if not r:
                 r = default
             if self.configbool('ui', 'promptecho'):
                 self.write(r, "\n")
             return r
         except EOFError:
             raise error.ResponseExpected()
 
     @staticmethod
     def extractchoices(prompt):
         """Extract prompt message and list of choices from specified prompt.
 
         This returns tuple "(message, choices)", and "choices" is the
         list of tuple "(response character, text without &)".
 
         >>> ui.extractchoices(b"awake? $$ &Yes $$ &No")
         ('awake? ', [('y', 'Yes'), ('n', 'No')])
         >>> ui.extractchoices(b"line\\nbreak? $$ &Yes $$ &No")
         ('line\\nbreak? ', [('y', 'Yes'), ('n', 'No')])
         >>> ui.extractchoices(b"want lots of $$money$$?$$Ye&s$$N&o")
         ('want lots of $$money$$?', [('s', 'Yes'), ('o', 'No')])
         """
 
         # Sadly, the prompt string may have been built with a filename
         # containing "$$" so let's try to find the first valid-looking
         # prompt to start parsing. Sadly, we also can't rely on
         # choices containing spaces, ASCII, or basically anything
         # except an ampersand followed by a character.
         m = re.match(br'(?s)(.+?)\$\$([^\$]*&[^ \$].*)', prompt)
         msg = m.group(1)
         choices = [p.strip(' ') for p in m.group(2).split('$$')]
         def choicetuple(s):
             ampidx = s.index('&')
             return s[ampidx + 1:ampidx + 2].lower(), s.replace('&', '', 1)
         return (msg, [choicetuple(s) for s in choices])
 
     def promptchoice(self, prompt, default=0):
         """Prompt user with a message, read response, and ensure it matches
         one of the provided choices. The prompt is formatted as follows:
 
            "would you like fries with that (Yn)? $$ &Yes $$ &No"
 
         The index of the choice is returned. Responses are case
         insensitive. If ui is not interactive, the default is
         returned.
         """
 
         msg, choices = self.extractchoices(prompt)
         resps = [r for r, t in choices]
         while True:
             r = self.prompt(msg, resps[default])
             if r.lower() in resps:
                 return resps.index(r.lower())
             self.write(_("unrecognized response\n"))
 
     def getpass(self, prompt=None, default=None):
         if not self.interactive():
             return default
         try:
             self.write_err(self.label(prompt or _('password: '), 'ui.prompt'))
             # disable getpass() only if explicitly specified. it's still valid
             # to interact with tty even if fin is not a tty.
             with self.timeblockedsection('stdio'):
                 if self.configbool('ui', 'nontty'):
                     l = self.fin.readline()
                     if not l:
                         raise EOFError
                     return l.rstrip('\n')
                 else:
                     return getpass.getpass('')
         except EOFError:
             raise error.ResponseExpected()
     def status(self, *msg, **opts):
         '''write status message to output (if ui.quiet is False)
 
         This adds an output label of "ui.status".
         '''
         if not self.quiet:
             opts[r'label'] = opts.get(r'label', '') + ' ui.status'
             self.write(*msg, **opts)
     def warn(self, *msg, **opts):
         '''write warning message to output (stderr)
 
         This adds an output label of "ui.warning".
         '''
         opts[r'label'] = opts.get(r'label', '') + ' ui.warning'
         self.write_err(*msg, **opts)
     def note(self, *msg, **opts):
         '''write note to output (if ui.verbose is True)
 
         This adds an output label of "ui.note".
         '''
         if self.verbose:
             opts[r'label'] = opts.get(r'label', '') + ' ui.note'
             self.write(*msg, **opts)
     def debug(self, *msg, **opts):
         '''write debug message to output (if ui.debugflag is True)
 
         This adds an output label of "ui.debug".
         '''
         if self.debugflag:
             opts[r'label'] = opts.get(r'label', '') + ' ui.debug'
             self.write(*msg, **opts)
 
     def edit(self, text, user, extra=None, editform=None, pending=None,
              repopath=None, action=None):
         if action is None:
             self.develwarn('action is None but will soon be a required '
                            'parameter to ui.edit()')
         extra_defaults = {
             'prefix': 'editor',
             'suffix': '.txt',
         }
         if extra is not None:
             if extra.get('suffix') is not None:
                 self.develwarn('extra.suffix is not None but will soon be '
                                'ignored by ui.edit()')
             extra_defaults.update(extra)
         extra = extra_defaults
 
         if action == 'diff':
             suffix = '.diff'
         elif action:
             suffix = '.%s.hg.txt' % action
         else:
             suffix = extra['suffix']
 
         rdir = None
         if self.configbool('experimental', 'editortmpinhg'):
             rdir = repopath
         (fd, name) = tempfile.mkstemp(prefix='hg-' + extra['prefix'] + '-',
                                       suffix=suffix,
                                       dir=rdir)
         try:
             f = os.fdopen(fd, r'wb')
             f.write(util.tonativeeol(text))
             f.close()
 
             environ = {'HGUSER': user}
             if 'transplant_source' in extra:
                 environ.update({'HGREVISION': hex(extra['transplant_source'])})
             for label in ('intermediate-source', 'source', 'rebase_source'):
                 if label in extra:
                     environ.update({'HGREVISION': extra[label]})
                     break
             if editform:
                 environ.update({'HGEDITFORM': editform})
             if pending:
                 environ.update({'HG_PENDING': pending})
 
             editor = self.geteditor()
 
             self.system("%s \"%s\"" % (editor, name),
                         environ=environ,
                         onerr=error.Abort, errprefix=_("edit failed"),
                         blockedtag='editor')
 
             f = open(name, r'rb')
             t = util.fromnativeeol(f.read())
             f.close()
         finally:
             os.unlink(name)
 
         return t
 
     def system(self, cmd, environ=None, cwd=None, onerr=None, errprefix=None,
                blockedtag=None):
         '''execute shell command with appropriate output stream. command
         output will be redirected if fout is not stdout.
 
         if command fails and onerr is None, return status, else raise onerr
         object as exception.
         '''
         if blockedtag is None:
             # Long cmds tend to be because of an absolute path on cmd. Keep
             # the tail end instead
             cmdsuffix = cmd.translate(None, _keepalnum)[-85:]
             blockedtag = 'unknown_system_' + cmdsuffix
         out = self.fout
         if any(s[1] for s in self._bufferstates):
             out = self
         with self.timeblockedsection(blockedtag):
             rc = self._runsystem(cmd, environ=environ, cwd=cwd, out=out)
         if rc and onerr:
             errmsg = '%s %s' % (os.path.basename(cmd.split(None, 1)[0]),
                                 util.explainexit(rc)[0])
             if errprefix:
                 errmsg = '%s: %s' % (errprefix, errmsg)
             raise onerr(errmsg)
         return rc
 
     def _runsystem(self, cmd, environ, cwd, out):
         """actually execute the given shell command (can be overridden by
         extensions like chg)"""
         return util.system(cmd, environ=environ, cwd=cwd, out=out)
 
     def traceback(self, exc=None, force=False):
         '''print exception traceback if traceback printing enabled or forced.
         only to call in exception handler. returns true if traceback
         printed.'''
         if self.tracebackflag or force:
             if exc is None:
                 exc = sys.exc_info()
             cause = getattr(exc[1], 'cause', None)
 
             if cause is not None:
                 causetb = traceback.format_tb(cause[2])
                 exctb = traceback.format_tb(exc[2])
                 exconly = traceback.format_exception_only(cause[0], cause[1])
 
                 # exclude frame where 'exc' was chained and rethrown from exctb
                 self.write_err('Traceback (most recent call last):\n',
                                ''.join(exctb[:-1]),
                                ''.join(causetb),
                                ''.join(exconly))
             else:
                 output = traceback.format_exception(exc[0], exc[1], exc[2])
                 data = r''.join(output)
                 if pycompat.ispy3:
                     enc = pycompat.sysstr(encoding.encoding)
                     data = data.encode(enc, errors=r'replace')
                 self.write_err(data)
         return self.tracebackflag or force
 
     def geteditor(self):
         '''return editor to use'''
         if pycompat.sysplatform == 'plan9':
             # vi is the MIPS instruction simulator on Plan 9. We
             # instead default to E to plumb commit messages to
             # avoid confusion.
             editor = 'E'
         else:
             editor = 'vi'
         return (encoding.environ.get("HGEDITOR") or
                 self.config("ui", "editor", editor))
 
     @util.propertycache
     def _progbar(self):
         """setup the progbar singleton to the ui object"""
         if (self.quiet or self.debugflag
                 or self.configbool('progress', 'disable')
                 or not progress.shouldprint(self)):
             return None
         return getprogbar(self)
 
     def _progclear(self):
         """clear progress bar output if any. use it before any output"""
         if not haveprogbar(): # nothing loaded yet
             return
         if self._progbar is not None and self._progbar.printed:
             self._progbar.clear()
 
     def progress(self, topic, pos, item="", unit="", total=None):
         '''show a progress message
 
         By default a textual progress bar will be displayed if an operation
         takes too long. 'topic' is the current operation, 'item' is a
         non-numeric marker of the current position (i.e. the currently
         in-process file), 'pos' is the current numeric position (i.e.
         revision, bytes, etc.), unit is a corresponding unit label,
         and total is the highest expected pos.
 
         Multiple nested topics may be active at a time.
 
         All topics should be marked closed by setting pos to None at
         termination.
         '''
         if self._progbar is not None:
             self._progbar.progress(topic, pos, item=item, unit=unit,
                                    total=total)
         if pos is None or not self.configbool('progress', 'debug'):
             return
 
         if unit:
             unit = ' ' + unit
         if item:
             item = ' ' + item
 
         if total:
             pct = 100.0 * pos / total
             self.debug('%s:%s %d/%d%s (%4.2f%%)\n'
                      % (topic, item, pos, total, unit, pct))
         else:
             self.debug('%s:%s %d%s\n' % (topic, item, pos, unit))
 
     def log(self, service, *msg, **opts):
         '''hook for logging facility extensions
 
         service should be a readily-identifiable subsystem, which will
         allow filtering.
 
         *msg should be a newline-terminated format string to log, and
         then any values to %-format into that format string.
 
         **opts currently has no defined meanings.
         '''
 
     def label(self, msg, label):
         '''style msg based on supplied label
 
         If some color mode is enabled, this will add the necessary control
         characters to apply such color. In addition, 'debug' color mode adds
         markup showing which label affects a piece of text.
 
         ui.write(s, 'label') is equivalent to
         ui.write(ui.label(s, 'label')).
         '''
         if self._colormode is not None:
             return color.colorlabel(self, msg, label)
         return msg
 
     def develwarn(self, msg, stacklevel=1, config=None):
         """issue a developer warning message
 
         Use 'stacklevel' to report the offender some layers further up in the
         stack.
         """
         if not self.configbool('devel', 'all-warnings'):
             if config is not None and not self.configbool('devel', config):
                 return
         msg = 'devel-warn: ' + msg
         stacklevel += 1 # get in develwarn
         if self.tracebackflag:
             util.debugstacktrace(msg, stacklevel, self.ferr, self.fout)
             self.log('develwarn', '%s at:\n%s' %
                      (msg, ''.join(util.getstackframes(stacklevel))))
         else:
             curframe = inspect.currentframe()
             calframe = inspect.getouterframes(curframe, 2)
             self.write_err('%s at: %s:%s (%s)\n'
                            % ((msg,) + calframe[stacklevel][1:4]))
             self.log('develwarn', '%s at: %s:%s (%s)\n',
                      msg, *calframe[stacklevel][1:4])
             curframe = calframe = None  # avoid cycles
 
     def deprecwarn(self, msg, version):
         """issue a deprecation warning
 
         - msg: message explaining what is deprecated and how to upgrade,
         - version: last version where the API will be supported,
         """
         if not (self.configbool('devel', 'all-warnings')
                 or self.configbool('devel', 'deprec-warn')):
             return
         msg += ("\n(compatibility will be dropped after Mercurial-%s,"
                 " update your code.)") % version
         self.develwarn(msg, stacklevel=2, config='deprec-warn')
 
     def exportableenviron(self):
         """The environment variables that are safe to export, e.g. through
         hgweb.
         """
         return self._exportableenviron
 
     @contextlib.contextmanager
     def configoverride(self, overrides, source=""):
         """Context manager for temporary config overrides
         `overrides` must be a dict of the following structure:
         {(section, name) : value}"""
         backups = {}
         try:
             for (section, name), value in overrides.items():
                 backups[(section, name)] = self.backupconfig(section, name)
                 self.setconfig(section, name, value, source)
             yield
         finally:
             for __, backup in backups.items():
                 self.restoreconfig(backup)
             # just restoring ui.quiet config to the previous value is not enough
             # as it does not update ui.quiet class member
             if ('ui', 'quiet') in overrides:
                 self.fixconfig(section='ui')
 
 class paths(dict):
     """Represents a collection of paths and their configs.
 
     Data is initially derived from ui instances and the config files they have
     loaded.
     """
     def __init__(self, ui):
         dict.__init__(self)
 
         for name, loc in ui.configitems('paths', ignoresub=True):
             # No location is the same as not existing.
             if not loc:
                 continue
             loc, sub = ui.configsuboptions('paths', name)
             self[name] = path(ui, name, rawloc=loc, suboptions=sub)
 
     def getpath(self, name, default=None):
         """Return a ``path`` from a string, falling back to default.
 
         ``name`` can be a named path or locations. Locations are filesystem
         paths or URIs.
 
         Returns None if ``name`` is not a registered path, a URI, or a local
         path to a repo.
         """
         # Only fall back to default if no path was requested.
         if name is None:
             if not default:
                 default = ()
             elif not isinstance(default, (tuple, list)):
                 default = (default,)
             for k in default:
                 try:
                     return self[k]
                 except KeyError:
                     continue
             return None
 
         # Most likely empty string.
         # This may need to raise in the future.
         if not name:
             return None
 
         try:
             return self[name]
         except KeyError:
             # Try to resolve as a local path or URI.
             try:
                 # We don't pass sub-options in, so no need to pass ui instance.
                 return path(None, None, rawloc=name)
             except ValueError:
                 raise error.RepoError(_('repository %s does not exist') %
                                         name)
 
 _pathsuboptions = {}
 
 def pathsuboption(option, attr):
     """Decorator used to declare a path sub-option.
 
     Arguments are the sub-option name and the attribute it should set on
     ``path`` instances.
 
     The decorated function will receive as arguments a ``ui`` instance,
     ``path`` instance, and the string value of this option from the config.
     The function should return the value that will be set on the ``path``
     instance.
 
     This decorator can be used to perform additional verification of
     sub-options and to change the type of sub-options.
     """
     def register(func):
         _pathsuboptions[option] = (attr, func)
         return func
     return register
 
 @pathsuboption('pushurl', 'pushloc')
 def pushurlpathoption(ui, path, value):
     u = util.url(value)
     # Actually require a URL.
     if not u.scheme:
         ui.warn(_('(paths.%s:pushurl not a URL; ignoring)\n') % path.name)
         return None
 
     # Don't support the #foo syntax in the push URL to declare branch to
     # push.
     if u.fragment:
         ui.warn(_('("#fragment" in paths.%s:pushurl not supported; '
                   'ignoring)\n') % path.name)
         u.fragment = None
 
     return str(u)
 
 @pathsuboption('pushrev', 'pushrev')
 def pushrevpathoption(ui, path, value):
     return value
 
 class path(object):
     """Represents an individual path and its configuration."""
 
     def __init__(self, ui, name, rawloc=None, suboptions=None):
         """Construct a path from its config options.
 
         ``ui`` is the ``ui`` instance the path is coming from.
         ``name`` is the symbolic name of the path.
         ``rawloc`` is the raw location, as defined in the config.
         ``pushloc`` is the raw locations pushes should be made to.
 
         If ``name`` is not defined, we require that the location be a) a local
         filesystem path with a .hg directory or b) a URL. If not,
         ``ValueError`` is raised.
         """
         if not rawloc:
             raise ValueError('rawloc must be defined')
 
         # Locations may define branches via syntax <base>#<branch>.
         u = util.url(rawloc)
         branch = None
         if u.fragment:
             branch = u.fragment
             u.fragment = None
 
         self.url = u
         self.branch = branch
 
         self.name = name
         self.rawloc = rawloc
         self.loc = '%s' % u
 
         # When given a raw location but not a symbolic name, validate the
         # location is valid.
         if not name and not u.scheme and not self._isvalidlocalpath(self.loc):
             raise ValueError('location is not a URL or path to a local '
                              'repo: %s' % rawloc)
 
         suboptions = suboptions or {}
 
         # Now process the sub-options. If a sub-option is registered, its
         # attribute will always be present. The value will be None if there
         # was no valid sub-option.
         for suboption, (attr, func) in _pathsuboptions.iteritems():
             if suboption not in suboptions:
                 setattr(self, attr, None)
                 continue
 
             value = func(ui, self, suboptions[suboption])
             setattr(self, attr, value)
 
     def _isvalidlocalpath(self, path):
         """Returns True if the given path is a potentially valid repository.
         This is its own function so that extensions can change the definition of
         'valid' in this case (like when pulling from a git repo into a hg
         one)."""
         return os.path.isdir(os.path.join(path, '.hg'))
 
     @property
     def suboptions(self):
         """Return sub-options and their values for this path.
 
         This is intended to be used for presentation purposes.
         """
         d = {}
         for subopt, (attr, _func) in _pathsuboptions.iteritems():
             value = getattr(self, attr)
             if value is not None:
                 d[subopt] = value
         return d
 
 # we instantiate one globally shared progress bar to avoid
 # competing progress bars when multiple UI objects get created
 _progresssingleton = None
 
 def getprogbar(ui):
     global _progresssingleton
     if _progresssingleton is None:
         # passing 'ui' object to the singleton is fishy,
         # this is how the extension used to work but feel free to rework it.
         _progresssingleton = progress.progbar(ui)
     return _progresssingleton
 
 def haveprogbar():
     return _progresssingleton is not None

tests/test-commandserver.t

@@ -1,1009 +1,1023
 #if windows
   $ PYTHONPATH="$TESTDIR/../contrib;$PYTHONPATH"
 #else
   $ PYTHONPATH="$TESTDIR/../contrib:$PYTHONPATH"
 #endif
   $ export PYTHONPATH
 
 typical client does not want echo-back messages, so test without it:
 
   $ grep -v '^promptecho ' < $HGRCPATH >> $HGRCPATH.new
   $ mv $HGRCPATH.new $HGRCPATH
 
   $ hg init repo
   $ cd repo
 
   >>> from __future__ import absolute_import, print_function
   >>> import os
   >>> import sys
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def hellomessage(server):
   ...     ch, data = readchannel(server)
   ...     print('%c, %r' % (ch, data))
   ...     # run an arbitrary command to make sure the next thing the server
   ...     # sends isn't part of the hello message
   ...     runcommand(server, ['id'])
   o, 'capabilities: getencoding runcommand\nencoding: *\npid: *' (glob)
   *** runcommand id
   000000000000 tip
 
   >>> from hgclient import check
   >>> @check
   ... def unknowncommand(server):
   ...     server.stdin.write('unknowncommand\n')
   abort: unknown command unknowncommand
 
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def checkruncommand(server):
   ...     # hello block
   ...     readchannel(server)
   ... 
   ...     # no args
   ...     runcommand(server, [])
   ... 
   ...     # global options
   ...     runcommand(server, ['id', '--quiet'])
   ... 
   ...     # make sure global options don't stick through requests
   ...     runcommand(server, ['id'])
   ... 
   ...     # --config
   ...     runcommand(server, ['id', '--config', 'ui.quiet=True'])
   ... 
   ...     # make sure --config doesn't stick
   ...     runcommand(server, ['id'])
   ... 
   ...     # negative return code should be masked
   ...     runcommand(server, ['id', '-runknown'])
   *** runcommand 
   Mercurial Distributed SCM
   
   basic commands:
   
    add           add the specified files on the next commit
    annotate      show changeset information by line for each file
    clone         make a copy of an existing repository
    commit        commit the specified files or all outstanding changes
    diff          diff repository (or selected files)
    export        dump the header and diffs for one or more changesets
    forget        forget the specified files on the next commit
    init          create a new repository in the given directory
    log           show revision history of entire repository or files
    merge         merge another revision into working directory
    pull          pull changes from the specified source
    push          push changes to the specified destination
    remove        remove the specified files on the next commit
    serve         start stand-alone webserver
    status        show changed files in the working directory
    summary       summarize working directory state
    update        update working directory (or switch revisions)
   
   (use 'hg help' for the full list of commands or 'hg -v' for details)
   *** runcommand id --quiet
   000000000000
   *** runcommand id
   000000000000 tip
   *** runcommand id --config ui.quiet=True
   000000000000
   *** runcommand id
   000000000000 tip
   *** runcommand id -runknown
   abort: unknown revision 'unknown'!
    [255]
 
   >>> from hgclient import check, readchannel
   >>> @check
   ... def inputeof(server):
   ...     readchannel(server)
   ...     server.stdin.write('runcommand\n')
   ...     # close stdin while server is waiting for input
   ...     server.stdin.close()
   ... 
   ...     # server exits with 1 if the pipe closed while reading the command
   ...     print('server exit code =', server.wait())
   server exit code = 1
 
   >>> from hgclient import check, readchannel, runcommand, stringio
   >>> @check
   ... def serverinput(server):
   ...     readchannel(server)
   ... 
   ...     patch = """
   ... # HG changeset patch
   ... # User test
   ... # Date 0 0
   ... # Node ID c103a3dec114d882c98382d684d8af798d09d857
   ... # Parent  0000000000000000000000000000000000000000
   ... 1
   ... 
   ... diff -r 000000000000 -r c103a3dec114 a
   ... --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
   ... +++ b/a	Thu Jan 01 00:00:00 1970 +0000
   ... @@ -0,0 +1,1 @@
   ... +1
   ... """
   ... 
   ...     runcommand(server, ['import', '-'], input=stringio(patch))
   ...     runcommand(server, ['log'])
   *** runcommand import -
   applying patch from stdin
   *** runcommand log
   changeset:   0:eff892de26ec
   tag:         tip
   user:        test
   date:        Thu Jan 01 00:00:00 1970 +0000
   summary:     1
   
 
+check strict parsing of early options:
+
+  >>> import os
+  >>> from hgclient import check, readchannel, runcommand
+  >>> os.environ['HGPLAIN'] = '+strictflags'
+  >>> @check
+  ... def cwd(server):
+  ...     readchannel(server)
+  ...     runcommand(server, ['log', '-b', '--config=alias.log=!echo pwned',
+  ...                         'default'])
+  *** runcommand log -b --config=alias.log=!echo pwned default
+  abort: unknown revision '--config=alias.log=!echo pwned'!
+   [255]
+
 check that "histedit --commands=-" can read rules from the input channel:
 
   >>> import cStringIO
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def serverinput(server):
   ...     readchannel(server)
   ...     rules = 'pick eff892de26ec\n'
   ...     runcommand(server, ['histedit', '0', '--commands=-',
   ...                         '--config', 'extensions.histedit='],
   ...                input=cStringIO.StringIO(rules))
   *** runcommand histedit 0 --commands=- --config extensions.histedit=
 
 check that --cwd doesn't persist between requests:
 
   $ mkdir foo
   $ touch foo/bar
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def cwd(server):
   ...     readchannel(server)
   ...     runcommand(server, ['--cwd', 'foo', 'st', 'bar'])
   ...     runcommand(server, ['st', 'foo/bar'])
   *** runcommand --cwd foo st bar
   ? bar
   *** runcommand st foo/bar
   ? foo/bar
 
   $ rm foo/bar
 
 
 check that local configs for the cached repo aren't inherited when -R is used:
 
   $ cat <<EOF >> .hg/hgrc
   > [ui]
   > foo = bar
   > EOF
 
   >>> from hgclient import check, readchannel, runcommand, sep
   >>> @check
   ... def localhgrc(server):
   ...     readchannel(server)
   ... 
   ...     # the cached repo local hgrc contains ui.foo=bar, so showconfig should
   ...     # show it
   ...     runcommand(server, ['showconfig'], outfilter=sep)
   ... 
   ...     # but not for this repo
   ...     runcommand(server, ['init', 'foo'])
   ...     runcommand(server, ['-R', 'foo', 'showconfig', 'ui', 'defaults'])
   *** runcommand showconfig
   bundle.mainreporoot=$TESTTMP/repo
   devel.all-warnings=true
   devel.default-date=0 0
   extensions.fsmonitor= (fsmonitor !)
   largefiles.usercache=$TESTTMP/.cache/largefiles
   ui.slash=True
   ui.interactive=False
   ui.mergemarkers=detailed
   ui.usehttp2=true (?)
   ui.foo=bar
   ui.nontty=true
   web.address=localhost
   web\.ipv6=(?:True|False) (re)
   *** runcommand init foo
   *** runcommand -R foo showconfig ui defaults
   ui.slash=True
   ui.interactive=False
   ui.mergemarkers=detailed
   ui.usehttp2=true (?)
   ui.nontty=true
 
   $ rm -R foo
 
 #if windows
   $ PYTHONPATH="$TESTTMP/repo;$PYTHONPATH"
 #else
   $ PYTHONPATH="$TESTTMP/repo:$PYTHONPATH"
 #endif
 
   $ cat <<EOF > hook.py
   > from __future__ import print_function
   > import sys
   > def hook(**args):
   >     print('hook talking')
   >     print('now try to read something: %r' % sys.stdin.read())
   > EOF
 
   >>> from hgclient import check, readchannel, runcommand, stringio
   >>> @check
   ... def hookoutput(server):
   ...     readchannel(server)
   ...     runcommand(server, ['--config',
   ...                         'hooks.pre-identify=python:hook.hook',
   ...                         'id'],
   ...                input=stringio('some input'))
   *** runcommand --config hooks.pre-identify=python:hook.hook id
   eff892de26ec tip
 
 Clean hook cached version
   $ rm hook.py*
   $ rm -Rf __pycache__
 
   $ echo a >> a
   >>> import os
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def outsidechanges(server):
   ...     readchannel(server)
   ...     runcommand(server, ['status'])
   ...     os.system('hg ci -Am2')
   ...     runcommand(server, ['tip'])
   ...     runcommand(server, ['status'])
   *** runcommand status
   M a
   *** runcommand tip
   changeset:   1:d3a0a68be6de
   tag:         tip
   user:        test
   date:        Thu Jan 01 00:00:00 1970 +0000
   summary:     2
   
   *** runcommand status
 
   >>> import os
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def bookmarks(server):
   ...     readchannel(server)
   ...     runcommand(server, ['bookmarks'])
   ... 
   ...     # changes .hg/bookmarks
   ...     os.system('hg bookmark -i bm1')
   ...     os.system('hg bookmark -i bm2')
   ...     runcommand(server, ['bookmarks'])
   ... 
   ...     # changes .hg/bookmarks.current
   ...     os.system('hg upd bm1 -q')
   ...     runcommand(server, ['bookmarks'])
   ... 
   ...     runcommand(server, ['bookmarks', 'bm3'])
   ...     f = open('a', 'ab')
   ...     f.write('a\n')
   ...     f.close()
   ...     runcommand(server, ['commit', '-Amm'])
   ...     runcommand(server, ['bookmarks'])
   ...     print('')
   *** runcommand bookmarks
   no bookmarks set
   *** runcommand bookmarks
      bm1                       1:d3a0a68be6de
      bm2                       1:d3a0a68be6de
   *** runcommand bookmarks
    * bm1                       1:d3a0a68be6de
      bm2                       1:d3a0a68be6de
   *** runcommand bookmarks bm3
   *** runcommand commit -Amm
   *** runcommand bookmarks
      bm1                       1:d3a0a68be6de
      bm2                       1:d3a0a68be6de
    * bm3                       2:aef17e88f5f0
   
 
   >>> import os
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def tagscache(server):
   ...     readchannel(server)
   ...     runcommand(server, ['id', '-t', '-r', '0'])
   ...     os.system('hg tag -r 0 foo')
   ...     runcommand(server, ['id', '-t', '-r', '0'])
   *** runcommand id -t -r 0
   
   *** runcommand id -t -r 0
   foo
 
   >>> import os
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def setphase(server):
   ...     readchannel(server)
   ...     runcommand(server, ['phase', '-r', '.'])
   ...     os.system('hg phase -r . -p')
   ...     runcommand(server, ['phase', '-r', '.'])
   *** runcommand phase -r .
   3: draft
   *** runcommand phase -r .
   3: public
 
   $ echo a >> a
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def rollback(server):
   ...     readchannel(server)
   ...     runcommand(server, ['phase', '-r', '.', '-p'])
   ...     runcommand(server, ['commit', '-Am.'])
   ...     runcommand(server, ['rollback'])
   ...     runcommand(server, ['phase', '-r', '.'])
   ...     print('')
   *** runcommand phase -r . -p
   no phases changed
   *** runcommand commit -Am.
   *** runcommand rollback
   repository tip rolled back to revision 3 (undo commit)
   working directory now based on revision 3
   *** runcommand phase -r .
   3: public
   
 
   >>> import os
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def branch(server):
   ...     readchannel(server)
   ...     runcommand(server, ['branch'])
   ...     os.system('hg branch foo')
   ...     runcommand(server, ['branch'])
   ...     os.system('hg branch default')
   *** runcommand branch
   default
   marked working directory as branch foo
   (branches are permanent and global, did you want a bookmark?)
   *** runcommand branch
   foo
   marked working directory as branch default
   (branches are permanent and global, did you want a bookmark?)
 
   $ touch .hgignore
   >>> import os
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def hgignore(server):
   ...     readchannel(server)
   ...     runcommand(server, ['commit', '-Am.'])
   ...     f = open('ignored-file', 'ab')
   ...     f.write('')
   ...     f.close()
   ...     f = open('.hgignore', 'ab')
   ...     f.write('ignored-file')
   ...     f.close()
   ...     runcommand(server, ['status', '-i', '-u'])
   ...     print('')
   *** runcommand commit -Am.
   adding .hgignore
   *** runcommand status -i -u
   I ignored-file
   
 
 cache of non-public revisions should be invalidated on repository change
 (issue4855):
 
   >>> import os
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def phasesetscacheaftercommit(server):
   ...     readchannel(server)
   ...     # load _phasecache._phaserevs and _phasesets
   ...     runcommand(server, ['log', '-qr', 'draft()'])
   ...     # create draft commits by another process
   ...     for i in xrange(5, 7):
   ...         f = open('a', 'ab')
   ...         f.seek(0, os.SEEK_END)
   ...         f.write('a\n')
   ...         f.close()
   ...         os.system('hg commit -Aqm%d' % i)
   ...     # new commits should be listed as draft revisions
   ...     runcommand(server, ['log', '-qr', 'draft()'])
   ...     print('')
   *** runcommand log -qr draft()
   4:7966c8e3734d
   *** runcommand log -qr draft()
   4:7966c8e3734d
   5:41f6602d1c4f
   6:10501e202c35
   
 
   >>> import os
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def phasesetscacheafterstrip(server):
   ...     readchannel(server)
   ...     # load _phasecache._phaserevs and _phasesets
   ...     runcommand(server, ['log', '-qr', 'draft()'])
   ...     # strip cached revisions by another process
   ...     os.system('hg --config extensions.strip= strip -q 5')
   ...     # shouldn't abort by "unknown revision '6'"
   ...     runcommand(server, ['log', '-qr', 'draft()'])
   ...     print('')
   *** runcommand log -qr draft()
   4:7966c8e3734d
   5:41f6602d1c4f
   6:10501e202c35
   *** runcommand log -qr draft()
   4:7966c8e3734d
   
 
 cache of phase roots should be invalidated on strip (issue3827):
 
   >>> import os
   >>> from hgclient import check, readchannel, runcommand, sep
   >>> @check
   ... def phasecacheafterstrip(server):
   ...     readchannel(server)
   ... 
   ...     # create new head, 5:731265503d86
   ...     runcommand(server, ['update', '-C', '0'])
   ...     f = open('a', 'ab')
   ...     f.write('a\n')
   ...     f.close()
   ...     runcommand(server, ['commit', '-Am.', 'a'])
   ...     runcommand(server, ['log', '-Gq'])
   ... 
   ...     # make it public; draft marker moves to 4:7966c8e3734d
   ...     runcommand(server, ['phase', '-p', '.'])
   ...     # load _phasecache.phaseroots
   ...     runcommand(server, ['phase', '.'], outfilter=sep)
   ... 
   ...     # strip 1::4 outside server
   ...     os.system('hg -q --config extensions.mq= strip 1')
   ... 
   ...     # shouldn't raise "7966c8e3734d: no node!"
   ...     runcommand(server, ['branches'])
   *** runcommand update -C 0
   1 files updated, 0 files merged, 2 files removed, 0 files unresolved
   (leaving bookmark bm3)
   *** runcommand commit -Am. a
   created new head
   *** runcommand log -Gq
   @  5:731265503d86
   |
   | o  4:7966c8e3734d
   | |
   | o  3:b9b85890c400
   | |
   | o  2:aef17e88f5f0
   | |
   | o  1:d3a0a68be6de
   |/
   o  0:eff892de26ec
   
   *** runcommand phase -p .
   *** runcommand phase .
   5: public
   *** runcommand branches
   default                        1:731265503d86
 
 in-memory cache must be reloaded if transaction is aborted. otherwise
 changelog and manifest would have invalid node:
 
   $ echo a >> a
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def txabort(server):
   ...     readchannel(server)
   ...     runcommand(server, ['commit', '--config', 'hooks.pretxncommit=false',
   ...                         '-mfoo'])
   ...     runcommand(server, ['verify'])
   *** runcommand commit --config hooks.pretxncommit=false -mfoo
   transaction abort!
   rollback completed
   abort: pretxncommit hook exited with status 1
    [255]
   *** runcommand verify
   checking changesets
   checking manifests
   crosschecking files in changesets and manifests
   checking files
   1 files, 2 changesets, 2 total revisions
   $ hg revert --no-backup -aq
 
   $ cat >> .hg/hgrc << EOF
   > [experimental]
   > evolution.createmarkers=True
   > EOF
 
   >>> import os
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def obsolete(server):
   ...     readchannel(server)
   ... 
   ...     runcommand(server, ['up', 'null'])
   ...     runcommand(server, ['phase', '-df', 'tip'])
   ...     cmd = 'hg debugobsolete `hg log -r tip --template {node}`'
   ...     if os.name == 'nt':
   ...         cmd = 'sh -c "%s"' % cmd # run in sh, not cmd.exe
   ...     os.system(cmd)
   ...     runcommand(server, ['log', '--hidden'])
   ...     runcommand(server, ['log'])
   *** runcommand up null
   0 files updated, 0 files merged, 1 files removed, 0 files unresolved
   *** runcommand phase -df tip
   obsoleted 1 changesets
   *** runcommand log --hidden
   changeset:   1:731265503d86
   tag:         tip
   user:        test
   date:        Thu Jan 01 00:00:00 1970 +0000
   obsolete:    pruned
   summary:     .
   
   changeset:   0:eff892de26ec
   bookmark:    bm1
   bookmark:    bm2
   bookmark:    bm3
   user:        test
   date:        Thu Jan 01 00:00:00 1970 +0000
   summary:     1
   
   *** runcommand log
   changeset:   0:eff892de26ec
   bookmark:    bm1
   bookmark:    bm2
   bookmark:    bm3
   tag:         tip
   user:        test
   date:        Thu Jan 01 00:00:00 1970 +0000
   summary:     1
   
 
   $ cat <<EOF >> .hg/hgrc
   > [extensions]
   > mq =
   > EOF
 
   >>> import os
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def mqoutsidechanges(server):
   ...     readchannel(server)
   ... 
   ...     # load repo.mq
   ...     runcommand(server, ['qapplied'])
   ...     os.system('hg qnew 0.diff')
   ...     # repo.mq should be invalidated
   ...     runcommand(server, ['qapplied'])
   ... 
   ...     runcommand(server, ['qpop', '--all'])
   ...     os.system('hg qqueue --create foo')
   ...     # repo.mq should be recreated to point to new queue
   ...     runcommand(server, ['qqueue', '--active'])
   *** runcommand qapplied
   *** runcommand qapplied
   0.diff
   *** runcommand qpop --all
   popping 0.diff
   patch queue now empty
   *** runcommand qqueue --active
   foo
 
   $ cat <<EOF > dbgui.py
   > import os
   > import sys
   > from mercurial import commands, registrar
   > cmdtable = {}
   > command = registrar.command(cmdtable)
   > @command(b"debuggetpass", norepo=True)
   > def debuggetpass(ui):
   >     ui.write("%s\\n" % ui.getpass())
   > @command(b"debugprompt", norepo=True)
   > def debugprompt(ui):
   >     ui.write("%s\\n" % ui.prompt("prompt:"))
   > @command(b"debugreadstdin", norepo=True)
   > def debugreadstdin(ui):
   >     ui.write("read: %r\n" % sys.stdin.read(1))
   > @command(b"debugwritestdout", norepo=True)
   > def debugwritestdout(ui):
   >     os.write(1, "low-level stdout fd and\n")
   >     sys.stdout.write("stdout should be redirected to /dev/null\n")
   >     sys.stdout.flush()
   > EOF
   $ cat <<EOF >> .hg/hgrc
   > [extensions]
   > dbgui = dbgui.py
   > EOF
 
   >>> from hgclient import check, readchannel, runcommand, stringio
   >>> @check
   ... def getpass(server):
   ...     readchannel(server)
   ...     runcommand(server, ['debuggetpass', '--config',
   ...                         'ui.interactive=True'],
   ...                input=stringio('1234\n'))
   ...     runcommand(server, ['debuggetpass', '--config',
   ...                         'ui.interactive=True'],
   ...                input=stringio('\n'))
   ...     runcommand(server, ['debuggetpass', '--config',
   ...                         'ui.interactive=True'],
   ...                input=stringio(''))
   ...     runcommand(server, ['debugprompt', '--config',
   ...                         'ui.interactive=True'],
   ...                input=stringio('5678\n'))
   ...     runcommand(server, ['debugreadstdin'])
   ...     runcommand(server, ['debugwritestdout'])
   *** runcommand debuggetpass --config ui.interactive=True
   password: 1234
   *** runcommand debuggetpass --config ui.interactive=True
   password: 
   *** runcommand debuggetpass --config ui.interactive=True
   password: abort: response expected
    [255]
   *** runcommand debugprompt --config ui.interactive=True
   prompt: 5678
   *** runcommand debugreadstdin
   read: ''
   *** runcommand debugwritestdout
 
 
 run commandserver in commandserver, which is silly but should work:
 
   >>> from __future__ import print_function
   >>> from hgclient import check, readchannel, runcommand, stringio
   >>> @check
   ... def nested(server):
   ...     print('%c, %r' % readchannel(server))
   ...     class nestedserver(object):
   ...         stdin = stringio('getencoding\n')
   ...         stdout = stringio()
   ...     runcommand(server, ['serve', '--cmdserver', 'pipe'],
   ...                output=nestedserver.stdout, input=nestedserver.stdin)
   ...     nestedserver.stdout.seek(0)
   ...     print('%c, %r' % readchannel(nestedserver))  # hello
   ...     print('%c, %r' % readchannel(nestedserver))  # getencoding
   o, 'capabilities: getencoding runcommand\nencoding: *\npid: *' (glob)
   *** runcommand serve --cmdserver pipe
   o, 'capabilities: getencoding runcommand\nencoding: *\npid: *' (glob)
   r, '*' (glob)
 
 
 start without repository:
 
   $ cd ..
 
   >>> from __future__ import print_function
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def hellomessage(server):
   ...     ch, data = readchannel(server)
   ...     print('%c, %r' % (ch, data))
   ...     # run an arbitrary command to make sure the next thing the server
   ...     # sends isn't part of the hello message
   ...     runcommand(server, ['id'])
   o, 'capabilities: getencoding runcommand\nencoding: *\npid: *' (glob)
   *** runcommand id
   abort: there is no Mercurial repository here (.hg not found)
    [255]
 
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def startwithoutrepo(server):
   ...     readchannel(server)
   ...     runcommand(server, ['init', 'repo2'])
   ...     runcommand(server, ['id', '-R', 'repo2'])
   *** runcommand init repo2
   *** runcommand id -R repo2
   000000000000 tip
 
 
 don't fall back to cwd if invalid -R path is specified (issue4805):
 
   $ cd repo
   $ hg serve --cmdserver pipe -R ../nonexistent
   abort: repository ../nonexistent not found!
   [255]
   $ cd ..
 
 
 unix domain socket:
 
   $ cd repo
   $ hg update -q
 
 #if unix-socket unix-permissions
 
   >>> from __future__ import print_function
   >>> from hgclient import check, readchannel, runcommand, stringio, unixserver
   >>> server = unixserver('.hg/server.sock', '.hg/server.log')
   >>> def hellomessage(conn):
   ...     ch, data = readchannel(conn)
   ...     print('%c, %r' % (ch, data))
   ...     runcommand(conn, ['id'])
   >>> check(hellomessage, server.connect)
   o, 'capabilities: getencoding runcommand\nencoding: *\npid: *' (glob)
   *** runcommand id
   eff892de26ec tip bm1/bm2/bm3
   >>> def unknowncommand(conn):
   ...     readchannel(conn)
   ...     conn.stdin.write('unknowncommand\n')
   >>> check(unknowncommand, server.connect)  # error sent to server.log
   >>> def serverinput(conn):
   ...     readchannel(conn)
   ...     patch = """
   ... # HG changeset patch
   ... # User test
   ... # Date 0 0
   ... 2
   ... 
   ... diff -r eff892de26ec -r 1ed24be7e7a0 a
   ... --- a/a
   ... +++ b/a
   ... @@ -1,1 +1,2 @@
   ...  1
   ... +2
   ... """
   ...     runcommand(conn, ['import', '-'], input=stringio(patch))
   ...     runcommand(conn, ['log', '-rtip', '-q'])
   >>> check(serverinput, server.connect)
   *** runcommand import -
   applying patch from stdin
   *** runcommand log -rtip -q
   2:1ed24be7e7a0
   >>> server.shutdown()
 
   $ cat .hg/server.log
   listening at .hg/server.sock
   abort: unknown command unknowncommand
   killed!
   $ rm .hg/server.log
 
  if server crashed before hello, traceback will be sent to 'e' channel as
  last ditch:
 
   $ cat <<EOF >> .hg/hgrc
   > [cmdserver]
   > log = inexistent/path.log
   > EOF
   >>> from __future__ import print_function
   >>> from hgclient import check, readchannel, unixserver
   >>> server = unixserver('.hg/server.sock', '.hg/server.log')
   >>> def earlycrash(conn):
   ...     while True:
   ...         try:
   ...             ch, data = readchannel(conn)
   ...             if not data.startswith('  '):
   ...                 print('%c, %r' % (ch, data))
   ...         except EOFError:
   ...             break
   >>> check(earlycrash, server.connect)
   e, 'Traceback (most recent call last):\n'
   e, "IOError: *" (glob)
   >>> server.shutdown()
 
   $ cat .hg/server.log | grep -v '^  '
   listening at .hg/server.sock
   Traceback (most recent call last):
   IOError: * (glob)
   killed!
 #endif
 #if no-unix-socket
 
   $ hg serve --cmdserver unix -a .hg/server.sock
   abort: unsupported platform
   [255]
 
 #endif
 
   $ cd ..
 
 Test that accessing to invalid changelog cache is avoided at
 subsequent operations even if repo object is reused even after failure
 of transaction (see 0a7610758c42 also)
 
 "hg log" after failure of transaction is needed to detect invalid
 cache in repoview: this can't detect by "hg verify" only.
 
 Combination of "finalization" and "empty-ness of changelog" (2 x 2 =
 4) are tested, because '00changelog.i' are differently changed in each
 cases.
 
   $ cat > $TESTTMP/failafterfinalize.py <<EOF
   > # extension to abort transaction after finalization forcibly
   > from mercurial import commands, error, extensions, lock as lockmod
   > from mercurial import registrar
   > cmdtable = {}
   > command = registrar.command(cmdtable)
   > configtable = {}
   > configitem = registrar.configitem(configtable)
   > configitem('failafterfinalize', 'fail',
   >     default=None,
   > )
   > def fail(tr):
   >     raise error.Abort('fail after finalization')
   > def reposetup(ui, repo):
   >     class failrepo(repo.__class__):
   >         def commitctx(self, ctx, error=False):
   >             if self.ui.configbool('failafterfinalize', 'fail'):
   >                 # 'sorted()' by ASCII code on category names causes
   >                 # invoking 'fail' after finalization of changelog
   >                 # using "'cl-%i' % id(self)" as category name
   >                 self.currenttransaction().addfinalize('zzzzzzzz', fail)
   >             return super(failrepo, self).commitctx(ctx, error)
   >     repo.__class__ = failrepo
   > EOF
 
   $ hg init repo3
   $ cd repo3
 
   $ cat <<EOF >> $HGRCPATH
   > [ui]
   > logtemplate = {rev} {desc|firstline} ({files})\n
   > 
   > [extensions]
   > failafterfinalize = $TESTTMP/failafterfinalize.py
   > EOF
 
 - test failure with "empty changelog"
 
   $ echo foo > foo
   $ hg add foo
 
 (failure before finalization)
 
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def abort(server):
   ...     readchannel(server)
   ...     runcommand(server, ['commit',
   ...                         '--config', 'hooks.pretxncommit=false',
   ...                         '-mfoo'])
   ...     runcommand(server, ['log'])
   ...     runcommand(server, ['verify', '-q'])
   *** runcommand commit --config hooks.pretxncommit=false -mfoo
   transaction abort!
   rollback completed
   abort: pretxncommit hook exited with status 1
    [255]
   *** runcommand log
   *** runcommand verify -q
 
 (failure after finalization)
 
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def abort(server):
   ...     readchannel(server)
   ...     runcommand(server, ['commit',
   ...                         '--config', 'failafterfinalize.fail=true',
   ...                         '-mfoo'])
   ...     runcommand(server, ['log'])
   ...     runcommand(server, ['verify', '-q'])
   *** runcommand commit --config failafterfinalize.fail=true -mfoo
   transaction abort!
   rollback completed
   abort: fail after finalization
    [255]
   *** runcommand log
   *** runcommand verify -q
 
 - test failure with "not-empty changelog"
 
   $ echo bar > bar
   $ hg add bar
   $ hg commit -mbar bar
 
 (failure before finalization)
 
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def abort(server):
   ...     readchannel(server)
   ...     runcommand(server, ['commit',
   ...                         '--config', 'hooks.pretxncommit=false',
   ...                         '-mfoo', 'foo'])
   ...     runcommand(server, ['log'])
   ...     runcommand(server, ['verify', '-q'])
   *** runcommand commit --config hooks.pretxncommit=false -mfoo foo
   transaction abort!
   rollback completed
   abort: pretxncommit hook exited with status 1
    [255]
   *** runcommand log
   0 bar (bar)
   *** runcommand verify -q
 
 (failure after finalization)
 
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def abort(server):
   ...     readchannel(server)
   ...     runcommand(server, ['commit',
   ...                         '--config', 'failafterfinalize.fail=true',
   ...                         '-mfoo', 'foo'])
   ...     runcommand(server, ['log'])
   ...     runcommand(server, ['verify', '-q'])
   *** runcommand commit --config failafterfinalize.fail=true -mfoo foo
   transaction abort!
   rollback completed
   abort: fail after finalization
    [255]
   *** runcommand log
   0 bar (bar)
   *** runcommand verify -q
 
   $ cd ..
 
 Test symlink traversal over cached audited paths:
 -------------------------------------------------
 
 #if symlink
 
 set up symlink hell
 
   $ mkdir merge-symlink-out
   $ hg init merge-symlink
   $ cd merge-symlink
   $ touch base
   $ hg commit -qAm base
   $ ln -s ../merge-symlink-out a
   $ hg commit -qAm 'symlink a -> ../merge-symlink-out'
   $ hg up -q 0
   $ mkdir a
   $ touch a/poisoned
   $ hg commit -qAm 'file a/poisoned'
   $ hg log -G -T '{rev}: {desc}\n'
   @  2: file a/poisoned
   |
   | o  1: symlink a -> ../merge-symlink-out
   |/
   o  0: base
   
 
 try trivial merge after update: cache of audited paths should be discarded,
 and the merge should fail (issue5628)
 
   $ hg up -q null
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def merge(server):
   ...     readchannel(server)
   ...     # audit a/poisoned as a good path
   ...     runcommand(server, ['up', '-qC', '2'])
   ...     runcommand(server, ['up', '-qC', '1'])
   ...     # here a is a symlink, so a/poisoned is bad
   ...     runcommand(server, ['merge', '2'])
   *** runcommand up -qC 2
   *** runcommand up -qC 1
   *** runcommand merge 2
   abort: path 'a/poisoned' traverses symbolic link 'a'
    [255]
   $ ls ../merge-symlink-out
 
 cache of repo.auditor should be discarded, so matcher would never traverse
 symlinks:
 
   $ hg up -qC 0
   $ touch ../merge-symlink-out/poisoned
   >>> from hgclient import check, readchannel, runcommand
   >>> @check
   ... def files(server):
   ...     readchannel(server)
   ...     runcommand(server, ['up', '-qC', '2'])
   ...     # audit a/poisoned as a good path
   ...     runcommand(server, ['files', 'a/poisoned'])
   ...     runcommand(server, ['up', '-qC', '0'])
   ...     runcommand(server, ['up', '-qC', '1'])
   ...     # here 'a' is a symlink, so a/poisoned should be warned
   ...     runcommand(server, ['files', 'a/poisoned'])
   *** runcommand up -qC 2
   *** runcommand files a/poisoned
   a/poisoned
   *** runcommand up -qC 0
   *** runcommand up -qC 1
   *** runcommand files a/poisoned
   abort: path 'a/poisoned' traverses symbolic link 'a'
    [255]
 
   $ cd ..
 
 #endif

tests/test-dispatch.t

@@ -1,163 +1,208
 test command parsing and dispatch
 
   $ hg init a
   $ cd a
 
 Redundant options used to crash (issue436):
   $ hg -v log -v
   $ hg -v log -v x
 
   $ echo a > a
   $ hg ci -Ama
   adding a
 
 Missing arg:
 
   $ hg cat
   hg cat: invalid arguments
   hg cat [OPTION]... FILE...
   
   output the current or given revision of files
   
   options ([+] can be repeated):
   
    -o --output FORMAT       print output to file with formatted name
    -r --rev REV             print the given revision
       --decode              apply any matching decode filter
    -I --include PATTERN [+] include names matching the given patterns
    -X --exclude PATTERN [+] exclude names matching the given patterns
   
   (use 'hg cat -h' to show more help)
   [255]
 
 Missing parameter for early option:
 
   $ hg log -R 2>&1 | grep 'hg log'
   hg log: option -R requires argument
   hg log [OPTION]... [FILE]
   (use 'hg log -h' to show more help)
 
   $ hg log -R -- 2>&1 | grep 'hg log'
   hg log: option -R requires argument
   hg log [OPTION]... [FILE]
   (use 'hg log -h' to show more help)
 
 Parsing of early options should stop at "--":
 
   $ hg cat -- --config=hooks.pre-cat=false
   --config=hooks.pre-cat=false: no such file in rev cb9a9f314b8b
   [1]
   $ hg cat -- --debugger
   --debugger: no such file in rev cb9a9f314b8b
   [1]
 
 Unparsable form of early options:
 
   $ hg cat --debugg
   abort: option --debugger may not be abbreviated!
   [255]
 
 Parsing failure of early options should be detected before executing the
 command:
 
   $ hg log -b '--config=hooks.pre-log=false' default
   abort: option --config may not be abbreviated!
   [255]
   $ hg log -b -R. default
   abort: option -R has to be separated from other options (e.g. not -qR) and --repository may only be abbreviated as --repo!
   [255]
   $ hg log --cwd .. -b --cwd=. default
   abort: option --cwd may not be abbreviated!
   [255]
 
 However, we can't prevent it from loading extensions and configs:
 
   $ cat <<EOF > bad.py
   > raise Exception('bad')
   > EOF
   $ hg log -b '--config=extensions.bad=bad.py' default
   *** failed to import extension bad from bad.py: bad
   abort: option --config may not be abbreviated!
   [255]
 
   $ mkdir -p badrepo/.hg
   $ echo 'invalid-syntax' > badrepo/.hg/hgrc
   $ hg log -b -Rbadrepo default
   hg: parse error at badrepo/.hg/hgrc:1: invalid-syntax
   [255]
 
   $ hg log -b --cwd=inexistent default
   abort: No such file or directory: 'inexistent'
   [255]
 
   $ hg log -b '--config=ui.traceback=yes' 2>&1 | grep '^Traceback'
   Traceback (most recent call last):
   $ hg log -b '--config=profiling.enabled=yes' 2>&1 | grep -i sample
   Sample count: .*|No samples recorded\. (re)
 
 Early options can't be specified in [aliases] and [defaults] because they are
 applied before the command name is resolved:
 
   $ hg log -b '--config=alias.log=log --config=hooks.pre-log=false'
   hg log: option -b not recognized
   error in definition for alias 'log': --config may only be given on the command
   line
   [255]
 
   $ hg log -b '--config=defaults.log=--config=hooks.pre-log=false'
   abort: option --config may not be abbreviated!
   [255]
 
 Shell aliases bypass any command parsing rules but for the early one:
 
   $ hg log -b '--config=alias.log=!echo howdy'
   howdy
 
+Early options must come first if HGPLAIN=+strictflags is specified:
+(BUG: chg cherry-picks early options to pass them as a server command)
+
+#if no-chg
+  $ HGPLAIN=+strictflags hg log -b --config='hooks.pre-log=false' default
+  abort: unknown revision '--config=hooks.pre-log=false'!
+  [255]
+  $ HGPLAIN=+strictflags hg log -b -R. default
+  abort: unknown revision '-R.'!
+  [255]
+  $ HGPLAIN=+strictflags hg log -b --cwd=. default
+  abort: unknown revision '--cwd=.'!
+  [255]
+#endif
+  $ HGPLAIN=+strictflags hg log -b --debugger default
+  abort: unknown revision '--debugger'!
+  [255]
+  $ HGPLAIN=+strictflags hg log -b --config='alias.log=!echo pwned' default
+  abort: unknown revision '--config=alias.log=!echo pwned'!
+  [255]
+
+  $ HGPLAIN=+strictflags hg log --config='hooks.pre-log=false' -b default
+  abort: option --config may not be abbreviated!
+  [255]
+  $ HGPLAIN=+strictflags hg log -q --cwd=.. -b default
+  abort: option --cwd may not be abbreviated!
+  [255]
+  $ HGPLAIN=+strictflags hg log -q -R . -b default
+  abort: option -R has to be separated from other options (e.g. not -qR) and --repository may only be abbreviated as --repo!
+  [255]
+
+  $ HGPLAIN=+strictflags hg --config='hooks.pre-log=false' log -b default
+  abort: pre-log hook exited with status 1
+  [255]
+  $ HGPLAIN=+strictflags hg --cwd .. -q -Ra log -b default
+  0:cb9a9f314b8b
+
+For compatibility reasons, HGPLAIN=+strictflags is not enabled by plain HGPLAIN:
+
+  $ HGPLAIN= hg log --config='hooks.pre-log=false' -b default
+  abort: pre-log hook exited with status 1
+  [255]
+  $ HGPLAINEXCEPT= hg log --cwd .. -q -Ra -b default
+  0:cb9a9f314b8b
+
 [defaults]
 
   $ hg cat a
   a
   $ cat >> $HGRCPATH <<EOF
   > [defaults]
   > cat = -r null
   > EOF
   $ hg cat a
   a: no such file in rev 000000000000
   [1]
 
   $ cd "$TESTTMP"
 
 OSError "No such file or directory" / "The system cannot find the path
 specified" should include filename even when it is empty
 
   $ hg -R a archive ''
   abort: *: '' (glob)
   [255]
 
 #if no-outer-repo
 
 No repo:
 
   $ hg cat
   abort: no repository found in '$TESTTMP' (.hg not found)!
   [255]
 
 #endif
 
 #if rmcwd
 
 Current directory removed:
 
   $ mkdir $TESTTMP/repo1
   $ cd $TESTTMP/repo1
   $ rm -rf $TESTTMP/repo1
 
 The output could be one of the following and something else:
  chg: abort: failed to getcwd (errno = *) (glob)
  abort: error getting current working directory: * (glob)
  sh: 0: getcwd() failed: No such file or directory
 Since the exact behavior depends on the shell, only check it returns non-zero.
   $ HGDEMANDIMPORT=disable hg version -q 2>/dev/null || false
   [1]
 
 #endif