CC: Objects with tracked members appear pure

[bracevac]

Compiler version

3.8 nightly

Minimized code

//> using scala 3.nightly

import scala.language.experimental.captureChecking
import scala.caps.*

class Console() extends SharedCapability:
  def println(s: String): Unit = System.out.println(s"console: $s")

def log(s: String)(using Console): Unit =
  summon[Console].println(s)

object test:
  val addPure: (Int, Int) -> Int = (a, b) => a + b // same as before
  
  given Console = Console() // provide capability locally
  
  // and this is now considered pure somehow 
  val addWritesToConsole: (Int, Int) -> Int = (a, b) =>
    log(s"adding a ($a) to b ($b)")
    a + b

Output

The capture checker happily accepts this.

Expectation

It should reject! If we turn test into a def, we'll get:

-- [E007] Type Mismatch Error: local/ccimplicit.scala:18:46 --------------------
18 |  val addWritesToConsole: (Int, Int) -> Int = (a, b) =>
   |                                              ^
   |   Found:    (a: Int, b: Int) ->{given_Console} Int
   |   Required: (Int, Int) -> Int
   |
   |   Note that capability given_Console is not included in capture set {}.
19 |    log(s"adding a ($a) to b ($b)")
20 |    a + b
   |
   | longer explanation available when compiling with `-explain`

We need to improve handling of objects/classes/self types.

[bracevac]

Capture checkers, assemble! @Linyxus @noti0na1 @natsukagami @odersky

[Linyxus]

Forwarding my Slack message for further discussion:

My intuition is that test itself must be a capability. The rationale will be that: in general capabilities can be classified into two categories:

• Derived capabilities, like a logger derived from a file capability, a function capturing a mutable buffer, then themselves become capabilities. They are capabilities getting authority from some existing ones.
• Base capabilities, which is like the cornerstone of the capability hierarchy. They are the ones who are ultimately providing authorities (which is not something that pre-exist in the context, like for derived capabilities). Like mutable buffer, CanThrow .

Based on this rationale, test is clearly a base capability: the Console capability is not one it gets from the outside, but what it forges. So it is essentially providing the authority of that forged Console, like a delegate.

And maybe the rule can be that, if the closure of any class contains some fresh capabilities (that are not obtained from the outside), that class must be marked as a capability too.

We must also let classes forging capabilities inherit the classifier of the capabilities they forge. For instance, if test forged a Async, it must inherit Control. Otherwise, the classifier hierarchy can be bypassed.