Fix type-checker and runtime to properly resolve global escaped identifiers

.gitignore

@@ -31,3 +31,5 @@ mvn-artifacts
 
 *.swp
 *.lock
+.eclipse
+.vscode

checker/src/main/java/dev/cel/checker/Env.java

@@ -451,17 +451,29 @@ public Env add(String name, Type type) {
  * until the root package is reached. If {@code container} starts with {@code .}, the resolution
  * is in the root container only.
  *
- * <p>Returns {@code null} if the function cannot be found.
+ * <p>Returns {@code null} if the ident cannot be found.
  */
  public @Nullable CelIdentDecl tryLookupCelIdent(CelContainer container, String name) {
- // Attempt to find the decl with just the ident name to account for shadowed variables
- CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(name);
- if (decl != null) {
- return decl;
+ // A name with a leading '.' always resolves in the root scope, bypassing local scopes.
+ if (!name.startsWith(".")) {
+ // Check if this is a qualified ident, or a field selection.
+ String simpleName = name;
+ int dotIndex = name.indexOf('.');
+ if (dotIndex > 0) {
+ simpleName = name.substring(0, dotIndex);
+ }
+
+ // Attempt to find the decl with just the ident name to account for shadowed variables.
+ CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(simpleName);
+ if (decl != null) {
+ // Appears to be a field selection on a local.
+ // Return null instead of attempting to resolve qualified name at the root scope
+ return dotIndex > 0 ? null : decl;
+ }
  }
 
  for (String cand : container.resolveCandidateNames(name)) {
- decl = tryLookupCelIdent(cand);
+CelIdentDecl decl = tryLookupCelIdent(cand);
  if (decl != null) {
  return decl;
  }
@@ -503,7 +515,13 @@ public Env add(String name, Type type) {
  return null;
  }
 
- private @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
+ /**
+ * Lookup a local identifier by name. This searches only comprehension scopes, bypassing standard
+ * environment or user-defined environment.
+ *
+ * <p>Returns {@code null} if not found in local scopes.
+ */
+ @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
  int firstUserSpaceScope = 2;
  // Iterate from the top of the stack down to the first local scope.
  // Note that:

checker/src/main/java/dev/cel/checker/ExprChecker.java

@@ -237,15 +237,18 @@ private CelExpr visit(CelExpr expr, CelExpr.CelIdent ident) {
  if (decl.equals(Env.ERROR_IDENT_DECL)) {
  // error reported
  env.setType(expr, SimpleType.ERROR);
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(decl.name(), decl));
  return expr;
  }
- if (!decl.name().equals(ident.name())) {
+
+ String refName = maybeDisambiguate(ident.name(), decl.name());
+
+ if (!refName.equals(ident.name())) {
  // Overwrite the identifier with its fully qualified name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  return expr;
  }
 
@@ -260,13 +263,15 @@ private CelExpr visit(CelExpr expr, CelExpr.CelSelect select) {
  env.reportError(expr.id(), getPosition(expr), "expression does not select a field");
  env.setType(expr, SimpleType.BOOL);
  } else {
+ String refName = maybeDisambiguate(qname, decl.name());
+
  if (namespacedDeclarations) {
  // Rewrite the node to be a variable reference to the resolved fully-qualified
  // variable name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  }
  return expr;
  }
@@ -595,14 +600,32 @@ private CelExpr visit(CelExpr expr, CelExpr.CelComprehension compre) {
  return expr;
  }
 
- private CelReference makeReference(CelIdentDecl decl) {
- CelReference.Builder ref = CelReference.newBuilder().setName(decl.name());
+ private CelReference makeReference(String name, CelIdentDecl decl) {
+ CelReference.Builder ref = CelReference.newBuilder().setName(name);
  if (decl.constant().isPresent()) {
  ref.setValue(decl.constant().get());
  }
  return ref.build();
  }
 
+ /**
+ * Returns the reference name, prefixed with a leading dot only if disambiguation is needed.
+ * Disambiguation is needed when: the original name had a leading dot, and there's a local
+ * variable that would shadow the resolved name.
+ */
+ private String maybeDisambiguate(String originalName, String resolvedName) {
+ if (!originalName.startsWith(".")) {
+ return resolvedName;
+ }
+ String simpleName = originalName.substring(1);
+ int dotIndex = simpleName.indexOf('.');
+ String localName = dotIndex > 0 ? simpleName.substring(0, dotIndex) : simpleName;
+ if (env.tryLookupCelIdentFromLocalScopes(localName) != null) {
+ return "." + resolvedName;
+ }
+ return resolvedName;
+ }
+
  private OverloadResolution resolveOverload(
  long callExprId,
  int position,

checker/src/test/java/dev/cel/checker/ExprCheckerTest.java

@@ -199,6 +199,10 @@ public void referenceTypeRelative() throws Exception {
  public void referenceTypeAbsolute() throws Exception {
  source = ".cel.expr.conformance.proto3.TestAllTypes";
  runTest();
+
+ declareVariable("app.config", SimpleType.INT);
+ source = "[0].exists(app, .app.config == 1)";
+ runTest();
  }
 
  @Test

checker/src/test/resources/referenceTypeAbsolute.baseline

@@ -1,3 +1,36 @@
 Source: .cel.expr.conformance.proto3.TestAllTypes
 =====>
 cel.expr.conformance.proto3.TestAllTypes~type(cel.expr.conformance.proto3.TestAllTypes)^cel.expr.conformance.proto3.TestAllTypes
+
+Source: [0].exists(app, .app.config == 1)
+declare app.config {
+ value int
+}
+=====>
+__comprehension__(
+ // Variable
+ app,
+ // Target
+ [
+ 0~int
+ ]~list(int),
+ // Accumulator
+ @result,
+ // Init
+ false~bool,
+ // LoopCondition
+ @not_strictly_false(
+ !_(
+ @result~bool^@result
+ )~bool^logical_not
+ )~bool^not_strictly_false,
+ // LoopStep
+ _||_(
+ @result~bool^@result,
+ _==_(
+ .app.config~int^.app.config,
+ 1~int
+ )~bool^equals
+ )~bool^logical_or,
+ // Result
+ @result~bool^@result)~bool

runtime/src/main/java/dev/cel/runtime/RuntimeUnknownResolver.java

@@ -98,6 +98,11 @@ Optional<AccumulatedUnknowns> maybePartialUnknown(CelAttribute attribute) {
 
  /** Resolve a simple name to a value. */
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // Strip leading dot if present (for global disambiguation).
+ if (name.startsWith(".")) {
+ name = name.substring(1);
+ }
+
  CelAttribute attr = CelAttribute.EMPTY;
 
  if (attributeTrackingEnabled) {
@@ -154,6 +159,10 @@ private ScopedResolver(
 
  @Override
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // A name with a leading '.' always resolves in the root scope
+ if (name.startsWith(".")) {
+ return parent.resolveSimpleName(name, exprId);
+ }
  DefaultInterpreter.IntermediateResult result = lazyEvalResultCache.get(name);
  if (result != null) {
  return copyIfMutable(result);

runtime/src/test/resources/comprehension.baseline

@@ -19,4 +19,36 @@ declare com.x {
 }
 =====>
 bindings: {com.x=1}
-result: true
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0)
+declare cel.example.y {
+ value int
+}
+=====>
+bindings: {cel.example.y={z=1}}
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0 && .y.z == 1)
+declare y.z {
+ value int
+}
+=====>
+bindings: {y.z=1}
+result: true
+
+Source: [0].exists(x, x == 0 && .x == 1)
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true
+
+Source: [0].exists(x, [x+1].exists(x, x == .x))
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true

testing/src/main/java/dev/cel/testing/BaseInterpreterTest.java

@@ -863,6 +863,26 @@ public void comprehension() throws Exception {
  container = CelContainer.ofName("com");
  source = "[0].exists(x, x == 0)";
  runTest(ImmutableMap.of("com.x", 1));
+
+ clearAllDeclarations();
+ declareVariable("cel.example.y", SimpleType.INT);
+ container = CelContainer.ofName("cel.example");
+ source = "[{'z': 0}].exists(y, y.z == 0)";
+ runTest(ImmutableMap.of("cel.example.y", ImmutableMap.of("z", 1)));
+
+ clearAllDeclarations();
+ declareVariable("y.z", SimpleType.INT);
+ container = CelContainer.ofName("y");
+ source = "[{'z': 0}].exists(y, y.z == 0 && .y.z == 1)";
+ runTest(ImmutableMap.of("y.z", 1));
+
+ clearAllDeclarations();
+ declareVariable("x", SimpleType.INT);
+ source = "[0].exists(x, x == 0 && .x == 1)";
+ runTest(ImmutableMap.of("x", 1));
+
+ source = "[0].exists(x, [x+1].exists(x, x == .x))";
+ runTest(ImmutableMap.of("x", 1));
  }
 
  @Test

.gitignore

@@ -31,3 +31,5 @@ mvn-artifacts
 
 *.swp
 *.lock
+.eclipse
+.vscode

checker/src/main/java/dev/cel/checker/Env.java

@@ -451,17 +451,29 @@ public Env add(String name, Type type) {
  * until the root package is reached. If {@code container} starts with {@code .}, the resolution
  * is in the root container only.
  *
- * <p>Returns {@code null} if the function cannot be found.
+ * <p>Returns {@code null} if the ident cannot be found.
  */
  public @Nullable CelIdentDecl tryLookupCelIdent(CelContainer container, String name) {
- // Attempt to find the decl with just the ident name to account for shadowed variables
- CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(name);
- if (decl != null) {
- return decl;
+ // A name with a leading '.' always resolves in the root scope, bypassing local scopes.
+ if (!name.startsWith(".")) {
+ // Check if this is a qualified ident, or a field selection.
+ String simpleName = name;
+ int dotIndex = name.indexOf('.');
+ if (dotIndex > 0) {
+ simpleName = name.substring(0, dotIndex);
+ }
+
+ // Attempt to find the decl with just the ident name to account for shadowed variables.
+ CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(simpleName);
+ if (decl != null) {
+ // Appears to be a field selection on a local.
+ // Return null instead of attempting to resolve qualified name at the root scope
+ return dotIndex > 0 ? null : decl;
+ }
  }
 
  for (String cand : container.resolveCandidateNames(name)) {
- decl = tryLookupCelIdent(cand);
+CelIdentDecl decl = tryLookupCelIdent(cand);
  if (decl != null) {
  return decl;
  }
@@ -503,7 +515,13 @@ public Env add(String name, Type type) {
  return null;
  }
 
- private @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
+ /**
+ * Lookup a local identifier by name. This searches only comprehension scopes, bypassing standard
+ * environment or user-defined environment.
+ *
+ * <p>Returns {@code null} if not found in local scopes.
+ */
+ @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
  int firstUserSpaceScope = 2;
  // Iterate from the top of the stack down to the first local scope.
  // Note that:

checker/src/main/java/dev/cel/checker/ExprChecker.java

@@ -237,15 +237,18 @@ private CelExpr visit(CelExpr expr, CelExpr.CelIdent ident) {
  if (decl.equals(Env.ERROR_IDENT_DECL)) {
  // error reported
  env.setType(expr, SimpleType.ERROR);
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(decl.name(), decl));
  return expr;
  }
- if (!decl.name().equals(ident.name())) {
+
+ String refName = maybeDisambiguate(ident.name(), decl.name());
+
+ if (!refName.equals(ident.name())) {
  // Overwrite the identifier with its fully qualified name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  return expr;
  }
 
@@ -260,13 +263,15 @@ private CelExpr visit(CelExpr expr, CelExpr.CelSelect select) {
  env.reportError(expr.id(), getPosition(expr), "expression does not select a field");
  env.setType(expr, SimpleType.BOOL);
  } else {
+ String refName = maybeDisambiguate(qname, decl.name());
+
  if (namespacedDeclarations) {
  // Rewrite the node to be a variable reference to the resolved fully-qualified
  // variable name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  }
  return expr;
  }
@@ -595,14 +600,32 @@ private CelExpr visit(CelExpr expr, CelExpr.CelComprehension compre) {
  return expr;
  }
 
- private CelReference makeReference(CelIdentDecl decl) {
- CelReference.Builder ref = CelReference.newBuilder().setName(decl.name());
+ private CelReference makeReference(String name, CelIdentDecl decl) {
+ CelReference.Builder ref = CelReference.newBuilder().setName(name);
  if (decl.constant().isPresent()) {
  ref.setValue(decl.constant().get());
  }
  return ref.build();
  }
 
+ /**
+ * Returns the reference name, prefixed with a leading dot only if disambiguation is needed.
+ * Disambiguation is needed when: the original name had a leading dot, and there's a local
+ * variable that would shadow the resolved name.
+ */
+ private String maybeDisambiguate(String originalName, String resolvedName) {
+ if (!originalName.startsWith(".")) {
+ return resolvedName;
+ }
+ String simpleName = originalName.substring(1);
+ int dotIndex = simpleName.indexOf('.');
+ String localName = dotIndex > 0 ? simpleName.substring(0, dotIndex) : simpleName;
+ if (env.tryLookupCelIdentFromLocalScopes(localName) != null) {
+ return "." + resolvedName;
+ }
+ return resolvedName;
+ }
+
  private OverloadResolution resolveOverload(
  long callExprId,
  int position,

checker/src/test/java/dev/cel/checker/ExprCheckerTest.java

@@ -199,6 +199,10 @@ public void referenceTypeRelative() throws Exception {
  public void referenceTypeAbsolute() throws Exception {
  source = ".cel.expr.conformance.proto3.TestAllTypes";
  runTest();
+
+ declareVariable("app.config", SimpleType.INT);
+ source = "[0].exists(app, .app.config == 1)";
+ runTest();
  }
 
  @Test

checker/src/test/resources/referenceTypeAbsolute.baseline

@@ -1,3 +1,36 @@
 Source: .cel.expr.conformance.proto3.TestAllTypes
 =====>
 cel.expr.conformance.proto3.TestAllTypes~type(cel.expr.conformance.proto3.TestAllTypes)^cel.expr.conformance.proto3.TestAllTypes
+
+Source: [0].exists(app, .app.config == 1)
+declare app.config {
+ value int
+}
+=====>
+__comprehension__(
+ // Variable
+ app,
+ // Target
+ [
+ 0~int
+ ]~list(int),
+ // Accumulator
+ @result,
+ // Init
+ false~bool,
+ // LoopCondition
+ @not_strictly_false(
+ !_(
+ @result~bool^@result
+ )~bool^logical_not
+ )~bool^not_strictly_false,
+ // LoopStep
+ _||_(
+ @result~bool^@result,
+ _==_(
+ .app.config~int^.app.config,
+ 1~int
+ )~bool^equals
+ )~bool^logical_or,
+ // Result
+ @result~bool^@result)~bool

runtime/src/main/java/dev/cel/runtime/RuntimeUnknownResolver.java

@@ -98,6 +98,11 @@ Optional<AccumulatedUnknowns> maybePartialUnknown(CelAttribute attribute) {
 
  /** Resolve a simple name to a value. */
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // Strip leading dot if present (for global disambiguation).
+ if (name.startsWith(".")) {
+ name = name.substring(1);
+ }
+
  CelAttribute attr = CelAttribute.EMPTY;
 
  if (attributeTrackingEnabled) {
@@ -154,6 +159,10 @@ private ScopedResolver(
 
  @Override
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // A name with a leading '.' always resolves in the root scope
+ if (name.startsWith(".")) {
+ return parent.resolveSimpleName(name, exprId);
+ }
  DefaultInterpreter.IntermediateResult result = lazyEvalResultCache.get(name);
  if (result != null) {
  return copyIfMutable(result);

runtime/src/test/resources/comprehension.baseline

@@ -19,4 +19,36 @@ declare com.x {
 }
 =====>
 bindings: {com.x=1}
-result: true
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0)
+declare cel.example.y {
+ value int
+}
+=====>
+bindings: {cel.example.y={z=1}}
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0 && .y.z == 1)
+declare y.z {
+ value int
+}
+=====>
+bindings: {y.z=1}
+result: true
+
+Source: [0].exists(x, x == 0 && .x == 1)
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true
+
+Source: [0].exists(x, [x+1].exists(x, x == .x))
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true

testing/src/main/java/dev/cel/testing/BaseInterpreterTest.java

@@ -863,6 +863,26 @@ public void comprehension() throws Exception {
  container = CelContainer.ofName("com");
  source = "[0].exists(x, x == 0)";
  runTest(ImmutableMap.of("com.x", 1));
+
+ clearAllDeclarations();
+ declareVariable("cel.example.y", SimpleType.INT);
+ container = CelContainer.ofName("cel.example");
+ source = "[{'z': 0}].exists(y, y.z == 0)";
+ runTest(ImmutableMap.of("cel.example.y", ImmutableMap.of("z", 1)));
+
+ clearAllDeclarations();
+ declareVariable("y.z", SimpleType.INT);
+ container = CelContainer.ofName("y");
+ source = "[{'z': 0}].exists(y, y.z == 0 && .y.z == 1)";
+ runTest(ImmutableMap.of("y.z", 1));
+
+ clearAllDeclarations();
+ declareVariable("x", SimpleType.INT);
+ source = "[0].exists(x, x == 0 && .x == 1)";
+ runTest(ImmutableMap.of("x", 1));
+
+ source = "[0].exists(x, [x+1].exists(x, x == .x))";
+ runTest(ImmutableMap.of("x", 1));
  }
 
  @Test

.gitignore

@@ -31,3 +31,5 @@ mvn-artifacts
 
 *.swp
 *.lock
+.eclipse
+.vscode

checker/src/main/java/dev/cel/checker/Env.java

@@ -451,17 +451,29 @@ public Env add(String name, Type type) {
  * until the root package is reached. If {@code container} starts with {@code .}, the resolution
  * is in the root container only.
  *
- * <p>Returns {@code null} if the function cannot be found.
+ * <p>Returns {@code null} if the ident cannot be found.
  */
  public @Nullable CelIdentDecl tryLookupCelIdent(CelContainer container, String name) {
- // Attempt to find the decl with just the ident name to account for shadowed variables
- CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(name);
- if (decl != null) {
- return decl;
+ // A name with a leading '.' always resolves in the root scope, bypassing local scopes.
+ if (!name.startsWith(".")) {
+ // Check if this is a qualified ident, or a field selection.
+ String simpleName = name;
+ int dotIndex = name.indexOf('.');
+ if (dotIndex > 0) {
+ simpleName = name.substring(0, dotIndex);
+ }
+
+ // Attempt to find the decl with just the ident name to account for shadowed variables.
+ CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(simpleName);
+ if (decl != null) {
+ // Appears to be a field selection on a local.
+ // Return null instead of attempting to resolve qualified name at the root scope
+ return dotIndex > 0 ? null : decl;
+ }
  }
 
  for (String cand : container.resolveCandidateNames(name)) {
- decl = tryLookupCelIdent(cand);
+CelIdentDecl decl = tryLookupCelIdent(cand);
  if (decl != null) {
  return decl;
  }
@@ -503,7 +515,13 @@ public Env add(String name, Type type) {
  return null;
  }
 
- private @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
+ /**
+ * Lookup a local identifier by name. This searches only comprehension scopes, bypassing standard
+ * environment or user-defined environment.
+ *
+ * <p>Returns {@code null} if not found in local scopes.
+ */
+ @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
  int firstUserSpaceScope = 2;
  // Iterate from the top of the stack down to the first local scope.
  // Note that:

checker/src/main/java/dev/cel/checker/ExprChecker.java

@@ -237,15 +237,18 @@ private CelExpr visit(CelExpr expr, CelExpr.CelIdent ident) {
  if (decl.equals(Env.ERROR_IDENT_DECL)) {
  // error reported
  env.setType(expr, SimpleType.ERROR);
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(decl.name(), decl));
  return expr;
  }
- if (!decl.name().equals(ident.name())) {
+
+ String refName = maybeDisambiguate(ident.name(), decl.name());
+
+ if (!refName.equals(ident.name())) {
  // Overwrite the identifier with its fully qualified name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  return expr;
  }
 
@@ -260,13 +263,15 @@ private CelExpr visit(CelExpr expr, CelExpr.CelSelect select) {
  env.reportError(expr.id(), getPosition(expr), "expression does not select a field");
  env.setType(expr, SimpleType.BOOL);
  } else {
+ String refName = maybeDisambiguate(qname, decl.name());
+
  if (namespacedDeclarations) {
  // Rewrite the node to be a variable reference to the resolved fully-qualified
  // variable name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  }
  return expr;
  }
@@ -595,14 +600,32 @@ private CelExpr visit(CelExpr expr, CelExpr.CelComprehension compre) {
  return expr;
  }
 
- private CelReference makeReference(CelIdentDecl decl) {
- CelReference.Builder ref = CelReference.newBuilder().setName(decl.name());
+ private CelReference makeReference(String name, CelIdentDecl decl) {
+ CelReference.Builder ref = CelReference.newBuilder().setName(name);
  if (decl.constant().isPresent()) {
  ref.setValue(decl.constant().get());
  }
  return ref.build();
  }
 
+ /**
+ * Returns the reference name, prefixed with a leading dot only if disambiguation is needed.
+ * Disambiguation is needed when: the original name had a leading dot, and there's a local
+ * variable that would shadow the resolved name.
+ */
+ private String maybeDisambiguate(String originalName, String resolvedName) {
+ if (!originalName.startsWith(".")) {
+ return resolvedName;
+ }
+ String simpleName = originalName.substring(1);
+ int dotIndex = simpleName.indexOf('.');
+ String localName = dotIndex > 0 ? simpleName.substring(0, dotIndex) : simpleName;
+ if (env.tryLookupCelIdentFromLocalScopes(localName) != null) {
+ return "." + resolvedName;
+ }
+ return resolvedName;
+ }
+
  private OverloadResolution resolveOverload(
  long callExprId,
  int position,

checker/src/test/java/dev/cel/checker/ExprCheckerTest.java

@@ -199,6 +199,10 @@ public void referenceTypeRelative() throws Exception {
  public void referenceTypeAbsolute() throws Exception {
  source = ".cel.expr.conformance.proto3.TestAllTypes";
  runTest();
+
+ declareVariable("app.config", SimpleType.INT);
+ source = "[0].exists(app, .app.config == 1)";
+ runTest();
  }
 
  @Test

checker/src/test/resources/referenceTypeAbsolute.baseline

@@ -1,3 +1,36 @@
 Source: .cel.expr.conformance.proto3.TestAllTypes
 =====>
 cel.expr.conformance.proto3.TestAllTypes~type(cel.expr.conformance.proto3.TestAllTypes)^cel.expr.conformance.proto3.TestAllTypes
+
+Source: [0].exists(app, .app.config == 1)
+declare app.config {
+ value int
+}
+=====>
+__comprehension__(
+ // Variable
+ app,
+ // Target
+ [
+ 0~int
+ ]~list(int),
+ // Accumulator
+ @result,
+ // Init
+ false~bool,
+ // LoopCondition
+ @not_strictly_false(
+ !_(
+ @result~bool^@result
+ )~bool^logical_not
+ )~bool^not_strictly_false,
+ // LoopStep
+ _||_(
+ @result~bool^@result,
+ _==_(
+ .app.config~int^.app.config,
+ 1~int
+ )~bool^equals
+ )~bool^logical_or,
+ // Result
+ @result~bool^@result)~bool

runtime/src/main/java/dev/cel/runtime/RuntimeUnknownResolver.java

@@ -98,6 +98,11 @@ Optional<AccumulatedUnknowns> maybePartialUnknown(CelAttribute attribute) {
 
  /** Resolve a simple name to a value. */
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // Strip leading dot if present (for global disambiguation).
+ if (name.startsWith(".")) {
+ name = name.substring(1);
+ }
+
  CelAttribute attr = CelAttribute.EMPTY;
 
  if (attributeTrackingEnabled) {
@@ -154,6 +159,10 @@ private ScopedResolver(
 
  @Override
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // A name with a leading '.' always resolves in the root scope
+ if (name.startsWith(".")) {
+ return parent.resolveSimpleName(name, exprId);
+ }
  DefaultInterpreter.IntermediateResult result = lazyEvalResultCache.get(name);
  if (result != null) {
  return copyIfMutable(result);

runtime/src/test/resources/comprehension.baseline

@@ -19,4 +19,36 @@ declare com.x {
 }
 =====>
 bindings: {com.x=1}
-result: true
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0)
+declare cel.example.y {
+ value int
+}
+=====>
+bindings: {cel.example.y={z=1}}
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0 && .y.z == 1)
+declare y.z {
+ value int
+}
+=====>
+bindings: {y.z=1}
+result: true
+
+Source: [0].exists(x, x == 0 && .x == 1)
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true
+
+Source: [0].exists(x, [x+1].exists(x, x == .x))
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true

testing/src/main/java/dev/cel/testing/BaseInterpreterTest.java

@@ -863,6 +863,26 @@ public void comprehension() throws Exception {
  container = CelContainer.ofName("com");
  source = "[0].exists(x, x == 0)";
  runTest(ImmutableMap.of("com.x", 1));
+
+ clearAllDeclarations();
+ declareVariable("cel.example.y", SimpleType.INT);
+ container = CelContainer.ofName("cel.example");
+ source = "[{'z': 0}].exists(y, y.z == 0)";
+ runTest(ImmutableMap.of("cel.example.y", ImmutableMap.of("z", 1)));
+
+ clearAllDeclarations();
+ declareVariable("y.z", SimpleType.INT);
+ container = CelContainer.ofName("y");
+ source = "[{'z': 0}].exists(y, y.z == 0 && .y.z == 1)";
+ runTest(ImmutableMap.of("y.z", 1));
+
+ clearAllDeclarations();
+ declareVariable("x", SimpleType.INT);
+ source = "[0].exists(x, x == 0 && .x == 1)";
+ runTest(ImmutableMap.of("x", 1));
+
+ source = "[0].exists(x, [x+1].exists(x, x == .x))";
+ runTest(ImmutableMap.of("x", 1));
  }
 
  @Test

.gitignore

@@ -31,3 +31,5 @@ mvn-artifacts
 
 *.swp
 *.lock
+.eclipse
+.vscode

checker/src/main/java/dev/cel/checker/Env.java

@@ -451,17 +451,29 @@ public Env add(String name, Type type) {
  * until the root package is reached. If {@code container} starts with {@code .}, the resolution
  * is in the root container only.
  *
- * <p>Returns {@code null} if the function cannot be found.
+ * <p>Returns {@code null} if the ident cannot be found.
  */
  public @Nullable CelIdentDecl tryLookupCelIdent(CelContainer container, String name) {
- // Attempt to find the decl with just the ident name to account for shadowed variables
- CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(name);
- if (decl != null) {
- return decl;
+ // A name with a leading '.' always resolves in the root scope, bypassing local scopes.
+ if (!name.startsWith(".")) {
+ // Check if this is a qualified ident, or a field selection.
+ String simpleName = name;
+ int dotIndex = name.indexOf('.');
+ if (dotIndex > 0) {
+ simpleName = name.substring(0, dotIndex);
+ }
+
+ // Attempt to find the decl with just the ident name to account for shadowed variables.
+ CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(simpleName);
+ if (decl != null) {
+ // Appears to be a field selection on a local.
+ // Return null instead of attempting to resolve qualified name at the root scope
+ return dotIndex > 0 ? null : decl;
+ }
  }
 
  for (String cand : container.resolveCandidateNames(name)) {
- decl = tryLookupCelIdent(cand);
+CelIdentDecl decl = tryLookupCelIdent(cand);
  if (decl != null) {
  return decl;
  }
@@ -503,7 +515,13 @@ public Env add(String name, Type type) {
  return null;
  }
 
- private @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
+ /**
+ * Lookup a local identifier by name. This searches only comprehension scopes, bypassing standard
+ * environment or user-defined environment.
+ *
+ * <p>Returns {@code null} if not found in local scopes.
+ */
+ @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
  int firstUserSpaceScope = 2;
  // Iterate from the top of the stack down to the first local scope.
  // Note that:

checker/src/main/java/dev/cel/checker/ExprChecker.java

@@ -237,15 +237,18 @@ private CelExpr visit(CelExpr expr, CelExpr.CelIdent ident) {
  if (decl.equals(Env.ERROR_IDENT_DECL)) {
  // error reported
  env.setType(expr, SimpleType.ERROR);
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(decl.name(), decl));
  return expr;
  }
- if (!decl.name().equals(ident.name())) {
+
+ String refName = maybeDisambiguate(ident.name(), decl.name());
+
+ if (!refName.equals(ident.name())) {
  // Overwrite the identifier with its fully qualified name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  return expr;
  }
 
@@ -260,13 +263,15 @@ private CelExpr visit(CelExpr expr, CelExpr.CelSelect select) {
  env.reportError(expr.id(), getPosition(expr), "expression does not select a field");
  env.setType(expr, SimpleType.BOOL);
  } else {
+ String refName = maybeDisambiguate(qname, decl.name());
+
  if (namespacedDeclarations) {
  // Rewrite the node to be a variable reference to the resolved fully-qualified
  // variable name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  }
  return expr;
  }
@@ -595,14 +600,32 @@ private CelExpr visit(CelExpr expr, CelExpr.CelComprehension compre) {
  return expr;
  }
 
- private CelReference makeReference(CelIdentDecl decl) {
- CelReference.Builder ref = CelReference.newBuilder().setName(decl.name());
+ private CelReference makeReference(String name, CelIdentDecl decl) {
+ CelReference.Builder ref = CelReference.newBuilder().setName(name);
  if (decl.constant().isPresent()) {
  ref.setValue(decl.constant().get());
  }
  return ref.build();
  }
 
+ /**
+ * Returns the reference name, prefixed with a leading dot only if disambiguation is needed.
+ * Disambiguation is needed when: the original name had a leading dot, and there's a local
+ * variable that would shadow the resolved name.
+ */
+ private String maybeDisambiguate(String originalName, String resolvedName) {
+ if (!originalName.startsWith(".")) {
+ return resolvedName;
+ }
+ String simpleName = originalName.substring(1);
+ int dotIndex = simpleName.indexOf('.');
+ String localName = dotIndex > 0 ? simpleName.substring(0, dotIndex) : simpleName;
+ if (env.tryLookupCelIdentFromLocalScopes(localName) != null) {
+ return "." + resolvedName;
+ }
+ return resolvedName;
+ }
+
  private OverloadResolution resolveOverload(
  long callExprId,
  int position,

checker/src/test/java/dev/cel/checker/ExprCheckerTest.java

@@ -199,6 +199,10 @@ public void referenceTypeRelative() throws Exception {
  public void referenceTypeAbsolute() throws Exception {
  source = ".cel.expr.conformance.proto3.TestAllTypes";
  runTest();
+
+ declareVariable("app.config", SimpleType.INT);
+ source = "[0].exists(app, .app.config == 1)";
+ runTest();
  }
 
  @Test

checker/src/test/resources/referenceTypeAbsolute.baseline

@@ -1,3 +1,36 @@
 Source: .cel.expr.conformance.proto3.TestAllTypes
 =====>
 cel.expr.conformance.proto3.TestAllTypes~type(cel.expr.conformance.proto3.TestAllTypes)^cel.expr.conformance.proto3.TestAllTypes
+
+Source: [0].exists(app, .app.config == 1)
+declare app.config {
+ value int
+}
+=====>
+__comprehension__(
+ // Variable
+ app,
+ // Target
+ [
+ 0~int
+ ]~list(int),
+ // Accumulator
+ @result,
+ // Init
+ false~bool,
+ // LoopCondition
+ @not_strictly_false(
+ !_(
+ @result~bool^@result
+ )~bool^logical_not
+ )~bool^not_strictly_false,
+ // LoopStep
+ _||_(
+ @result~bool^@result,
+ _==_(
+ .app.config~int^.app.config,
+ 1~int
+ )~bool^equals
+ )~bool^logical_or,
+ // Result
+ @result~bool^@result)~bool

runtime/src/main/java/dev/cel/runtime/RuntimeUnknownResolver.java

@@ -98,6 +98,11 @@ Optional<AccumulatedUnknowns> maybePartialUnknown(CelAttribute attribute) {
 
  /** Resolve a simple name to a value. */
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // Strip leading dot if present (for global disambiguation).
+ if (name.startsWith(".")) {
+ name = name.substring(1);
+ }
+
  CelAttribute attr = CelAttribute.EMPTY;
 
  if (attributeTrackingEnabled) {
@@ -154,6 +159,10 @@ private ScopedResolver(
 
  @Override
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // A name with a leading '.' always resolves in the root scope
+ if (name.startsWith(".")) {
+ return parent.resolveSimpleName(name, exprId);
+ }
  DefaultInterpreter.IntermediateResult result = lazyEvalResultCache.get(name);
  if (result != null) {
  return copyIfMutable(result);

runtime/src/test/resources/comprehension.baseline

@@ -19,4 +19,36 @@ declare com.x {
 }
 =====>
 bindings: {com.x=1}
-result: true
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0)
+declare cel.example.y {
+ value int
+}
+=====>
+bindings: {cel.example.y={z=1}}
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0 && .y.z == 1)
+declare y.z {
+ value int
+}
+=====>
+bindings: {y.z=1}
+result: true
+
+Source: [0].exists(x, x == 0 && .x == 1)
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true
+
+Source: [0].exists(x, [x+1].exists(x, x == .x))
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true

testing/src/main/java/dev/cel/testing/BaseInterpreterTest.java

@@ -863,6 +863,26 @@ public void comprehension() throws Exception {
  container = CelContainer.ofName("com");
  source = "[0].exists(x, x == 0)";
  runTest(ImmutableMap.of("com.x", 1));
+
+ clearAllDeclarations();
+ declareVariable("cel.example.y", SimpleType.INT);
+ container = CelContainer.ofName("cel.example");
+ source = "[{'z': 0}].exists(y, y.z == 0)";
+ runTest(ImmutableMap.of("cel.example.y", ImmutableMap.of("z", 1)));
+
+ clearAllDeclarations();
+ declareVariable("y.z", SimpleType.INT);
+ container = CelContainer.ofName("y");
+ source = "[{'z': 0}].exists(y, y.z == 0 && .y.z == 1)";
+ runTest(ImmutableMap.of("y.z", 1));
+
+ clearAllDeclarations();
+ declareVariable("x", SimpleType.INT);
+ source = "[0].exists(x, x == 0 && .x == 1)";
+ runTest(ImmutableMap.of("x", 1));
+
+ source = "[0].exists(x, [x+1].exists(x, x == .x))";
+ runTest(ImmutableMap.of("x", 1));
  }
 
  @Test

.gitignore

@@ -31,3 +31,5 @@ mvn-artifacts
 
 *.swp
 *.lock
+.eclipse
+.vscode

checker/src/main/java/dev/cel/checker/Env.java

@@ -451,17 +451,29 @@ public Env add(String name, Type type) {
  * until the root package is reached. If {@code container} starts with {@code .}, the resolution
  * is in the root container only.
  *
- * <p>Returns {@code null} if the function cannot be found.
+ * <p>Returns {@code null} if the ident cannot be found.
  */
  public @Nullable CelIdentDecl tryLookupCelIdent(CelContainer container, String name) {
- // Attempt to find the decl with just the ident name to account for shadowed variables
- CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(name);
- if (decl != null) {
- return decl;
+ // A name with a leading '.' always resolves in the root scope, bypassing local scopes.
+ if (!name.startsWith(".")) {
+ // Check if this is a qualified ident, or a field selection.
+ String simpleName = name;
+ int dotIndex = name.indexOf('.');
+ if (dotIndex > 0) {
+ simpleName = name.substring(0, dotIndex);
+ }
+
+ // Attempt to find the decl with just the ident name to account for shadowed variables.
+ CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(simpleName);
+ if (decl != null) {
+ // Appears to be a field selection on a local.
+ // Return null instead of attempting to resolve qualified name at the root scope
+ return dotIndex > 0 ? null : decl;
+ }
  }
 
  for (String cand : container.resolveCandidateNames(name)) {
- decl = tryLookupCelIdent(cand);
+CelIdentDecl decl = tryLookupCelIdent(cand);
  if (decl != null) {
  return decl;
  }
@@ -503,7 +515,13 @@ public Env add(String name, Type type) {
  return null;
  }
 
- private @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
+ /**
+ * Lookup a local identifier by name. This searches only comprehension scopes, bypassing standard
+ * environment or user-defined environment.
+ *
+ * <p>Returns {@code null} if not found in local scopes.
+ */
+ @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
  int firstUserSpaceScope = 2;
  // Iterate from the top of the stack down to the first local scope.
  // Note that:

checker/src/main/java/dev/cel/checker/ExprChecker.java

@@ -237,15 +237,18 @@ private CelExpr visit(CelExpr expr, CelExpr.CelIdent ident) {
  if (decl.equals(Env.ERROR_IDENT_DECL)) {
  // error reported
  env.setType(expr, SimpleType.ERROR);
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(decl.name(), decl));
  return expr;
  }
- if (!decl.name().equals(ident.name())) {
+
+ String refName = maybeDisambiguate(ident.name(), decl.name());
+
+ if (!refName.equals(ident.name())) {
  // Overwrite the identifier with its fully qualified name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  return expr;
  }
 
@@ -260,13 +263,15 @@ private CelExpr visit(CelExpr expr, CelExpr.CelSelect select) {
  env.reportError(expr.id(), getPosition(expr), "expression does not select a field");
  env.setType(expr, SimpleType.BOOL);
  } else {
+ String refName = maybeDisambiguate(qname, decl.name());
+
  if (namespacedDeclarations) {
  // Rewrite the node to be a variable reference to the resolved fully-qualified
  // variable name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  }
  return expr;
  }
@@ -595,14 +600,32 @@ private CelExpr visit(CelExpr expr, CelExpr.CelComprehension compre) {
  return expr;
  }
 
- private CelReference makeReference(CelIdentDecl decl) {
- CelReference.Builder ref = CelReference.newBuilder().setName(decl.name());
+ private CelReference makeReference(String name, CelIdentDecl decl) {
+ CelReference.Builder ref = CelReference.newBuilder().setName(name);
  if (decl.constant().isPresent()) {
  ref.setValue(decl.constant().get());
  }
  return ref.build();
  }
 
+ /**
+ * Returns the reference name, prefixed with a leading dot only if disambiguation is needed.
+ * Disambiguation is needed when: the original name had a leading dot, and there's a local
+ * variable that would shadow the resolved name.
+ */
+ private String maybeDisambiguate(String originalName, String resolvedName) {
+ if (!originalName.startsWith(".")) {
+ return resolvedName;
+ }
+ String simpleName = originalName.substring(1);
+ int dotIndex = simpleName.indexOf('.');
+ String localName = dotIndex > 0 ? simpleName.substring(0, dotIndex) : simpleName;
+ if (env.tryLookupCelIdentFromLocalScopes(localName) != null) {
+ return "." + resolvedName;
+ }
+ return resolvedName;
+ }
+
  private OverloadResolution resolveOverload(
  long callExprId,
  int position,

checker/src/test/java/dev/cel/checker/ExprCheckerTest.java

@@ -199,6 +199,10 @@ public void referenceTypeRelative() throws Exception {
  public void referenceTypeAbsolute() throws Exception {
  source = ".cel.expr.conformance.proto3.TestAllTypes";
  runTest();
+
+ declareVariable("app.config", SimpleType.INT);
+ source = "[0].exists(app, .app.config == 1)";
+ runTest();
  }
 
  @Test

checker/src/test/resources/referenceTypeAbsolute.baseline

@@ -1,3 +1,36 @@
 Source: .cel.expr.conformance.proto3.TestAllTypes
 =====>
 cel.expr.conformance.proto3.TestAllTypes~type(cel.expr.conformance.proto3.TestAllTypes)^cel.expr.conformance.proto3.TestAllTypes
+
+Source: [0].exists(app, .app.config == 1)
+declare app.config {
+ value int
+}
+=====>
+__comprehension__(
+ // Variable
+ app,
+ // Target
+ [
+ 0~int
+ ]~list(int),
+ // Accumulator
+ @result,
+ // Init
+ false~bool,
+ // LoopCondition
+ @not_strictly_false(
+ !_(
+ @result~bool^@result
+ )~bool^logical_not
+ )~bool^not_strictly_false,
+ // LoopStep
+ _||_(
+ @result~bool^@result,
+ _==_(
+ .app.config~int^.app.config,
+ 1~int
+ )~bool^equals
+ )~bool^logical_or,
+ // Result
+ @result~bool^@result)~bool

runtime/src/main/java/dev/cel/runtime/RuntimeUnknownResolver.java

@@ -98,6 +98,11 @@ Optional<AccumulatedUnknowns> maybePartialUnknown(CelAttribute attribute) {
 
  /** Resolve a simple name to a value. */
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // Strip leading dot if present (for global disambiguation).
+ if (name.startsWith(".")) {
+ name = name.substring(1);
+ }
+
  CelAttribute attr = CelAttribute.EMPTY;
 
  if (attributeTrackingEnabled) {
@@ -154,6 +159,10 @@ private ScopedResolver(
 
  @Override
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // A name with a leading '.' always resolves in the root scope
+ if (name.startsWith(".")) {
+ return parent.resolveSimpleName(name, exprId);
+ }
  DefaultInterpreter.IntermediateResult result = lazyEvalResultCache.get(name);
  if (result != null) {
  return copyIfMutable(result);

runtime/src/test/resources/comprehension.baseline

@@ -19,4 +19,36 @@ declare com.x {
 }
 =====>
 bindings: {com.x=1}
-result: true
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0)
+declare cel.example.y {
+ value int
+}
+=====>
+bindings: {cel.example.y={z=1}}
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0 && .y.z == 1)
+declare y.z {
+ value int
+}
+=====>
+bindings: {y.z=1}
+result: true
+
+Source: [0].exists(x, x == 0 && .x == 1)
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true
+
+Source: [0].exists(x, [x+1].exists(x, x == .x))
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true

testing/src/main/java/dev/cel/testing/BaseInterpreterTest.java

@@ -863,6 +863,26 @@ public void comprehension() throws Exception {
  container = CelContainer.ofName("com");
  source = "[0].exists(x, x == 0)";
  runTest(ImmutableMap.of("com.x", 1));
+
+ clearAllDeclarations();
+ declareVariable("cel.example.y", SimpleType.INT);
+ container = CelContainer.ofName("cel.example");
+ source = "[{'z': 0}].exists(y, y.z == 0)";
+ runTest(ImmutableMap.of("cel.example.y", ImmutableMap.of("z", 1)));
+
+ clearAllDeclarations();
+ declareVariable("y.z", SimpleType.INT);
+ container = CelContainer.ofName("y");
+ source = "[{'z': 0}].exists(y, y.z == 0 && .y.z == 1)";
+ runTest(ImmutableMap.of("y.z", 1));
+
+ clearAllDeclarations();
+ declareVariable("x", SimpleType.INT);
+ source = "[0].exists(x, x == 0 && .x == 1)";
+ runTest(ImmutableMap.of("x", 1));
+
+ source = "[0].exists(x, [x+1].exists(x, x == .x))";
+ runTest(ImmutableMap.of("x", 1));
  }
 
  @Test

.gitignore

@@ -31,3 +31,5 @@ mvn-artifacts
 
 *.swp
 *.lock
+.eclipse
+.vscode

checker/src/main/java/dev/cel/checker/Env.java

@@ -451,17 +451,29 @@ public Env add(String name, Type type) {
  * until the root package is reached. If {@code container} starts with {@code .}, the resolution
  * is in the root container only.
  *
- * <p>Returns {@code null} if the function cannot be found.
+ * <p>Returns {@code null} if the ident cannot be found.
  */
  public @Nullable CelIdentDecl tryLookupCelIdent(CelContainer container, String name) {
- // Attempt to find the decl with just the ident name to account for shadowed variables
- CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(name);
- if (decl != null) {
- return decl;
+ // A name with a leading '.' always resolves in the root scope, bypassing local scopes.
+ if (!name.startsWith(".")) {
+ // Check if this is a qualified ident, or a field selection.
+ String simpleName = name;
+ int dotIndex = name.indexOf('.');
+ if (dotIndex > 0) {
+ simpleName = name.substring(0, dotIndex);
+ }
+
+ // Attempt to find the decl with just the ident name to account for shadowed variables.
+ CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(simpleName);
+ if (decl != null) {
+ // Appears to be a field selection on a local.
+ // Return null instead of attempting to resolve qualified name at the root scope
+ return dotIndex > 0 ? null : decl;
+ }
  }
 
  for (String cand : container.resolveCandidateNames(name)) {
- decl = tryLookupCelIdent(cand);
+CelIdentDecl decl = tryLookupCelIdent(cand);
  if (decl != null) {
  return decl;
  }
@@ -503,7 +515,13 @@ public Env add(String name, Type type) {
  return null;
  }
 
- private @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
+ /**
+ * Lookup a local identifier by name. This searches only comprehension scopes, bypassing standard
+ * environment or user-defined environment.
+ *
+ * <p>Returns {@code null} if not found in local scopes.
+ */
+ @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
  int firstUserSpaceScope = 2;
  // Iterate from the top of the stack down to the first local scope.
  // Note that:

checker/src/main/java/dev/cel/checker/ExprChecker.java

@@ -237,15 +237,18 @@ private CelExpr visit(CelExpr expr, CelExpr.CelIdent ident) {
  if (decl.equals(Env.ERROR_IDENT_DECL)) {
  // error reported
  env.setType(expr, SimpleType.ERROR);
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(decl.name(), decl));
  return expr;
  }
- if (!decl.name().equals(ident.name())) {
+
+ String refName = maybeDisambiguate(ident.name(), decl.name());
+
+ if (!refName.equals(ident.name())) {
  // Overwrite the identifier with its fully qualified name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  return expr;
  }
 
@@ -260,13 +263,15 @@ private CelExpr visit(CelExpr expr, CelExpr.CelSelect select) {
  env.reportError(expr.id(), getPosition(expr), "expression does not select a field");
  env.setType(expr, SimpleType.BOOL);
  } else {
+ String refName = maybeDisambiguate(qname, decl.name());
+
  if (namespacedDeclarations) {
  // Rewrite the node to be a variable reference to the resolved fully-qualified
  // variable name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  }
  return expr;
  }
@@ -595,14 +600,32 @@ private CelExpr visit(CelExpr expr, CelExpr.CelComprehension compre) {
  return expr;
  }
 
- private CelReference makeReference(CelIdentDecl decl) {
- CelReference.Builder ref = CelReference.newBuilder().setName(decl.name());
+ private CelReference makeReference(String name, CelIdentDecl decl) {
+ CelReference.Builder ref = CelReference.newBuilder().setName(name);
  if (decl.constant().isPresent()) {
  ref.setValue(decl.constant().get());
  }
  return ref.build();
  }
 
+ /**
+ * Returns the reference name, prefixed with a leading dot only if disambiguation is needed.
+ * Disambiguation is needed when: the original name had a leading dot, and there's a local
+ * variable that would shadow the resolved name.
+ */
+ private String maybeDisambiguate(String originalName, String resolvedName) {
+ if (!originalName.startsWith(".")) {
+ return resolvedName;
+ }
+ String simpleName = originalName.substring(1);
+ int dotIndex = simpleName.indexOf('.');
+ String localName = dotIndex > 0 ? simpleName.substring(0, dotIndex) : simpleName;
+ if (env.tryLookupCelIdentFromLocalScopes(localName) != null) {
+ return "." + resolvedName;
+ }
+ return resolvedName;
+ }
+
  private OverloadResolution resolveOverload(
  long callExprId,
  int position,

checker/src/test/java/dev/cel/checker/ExprCheckerTest.java

@@ -199,6 +199,10 @@ public void referenceTypeRelative() throws Exception {
  public void referenceTypeAbsolute() throws Exception {
  source = ".cel.expr.conformance.proto3.TestAllTypes";
  runTest();
+
+ declareVariable("app.config", SimpleType.INT);
+ source = "[0].exists(app, .app.config == 1)";
+ runTest();
  }
 
  @Test

checker/src/test/resources/referenceTypeAbsolute.baseline

@@ -1,3 +1,36 @@
 Source: .cel.expr.conformance.proto3.TestAllTypes
 =====>
 cel.expr.conformance.proto3.TestAllTypes~type(cel.expr.conformance.proto3.TestAllTypes)^cel.expr.conformance.proto3.TestAllTypes
+
+Source: [0].exists(app, .app.config == 1)
+declare app.config {
+ value int
+}
+=====>
+__comprehension__(
+ // Variable
+ app,
+ // Target
+ [
+ 0~int
+ ]~list(int),
+ // Accumulator
+ @result,
+ // Init
+ false~bool,
+ // LoopCondition
+ @not_strictly_false(
+ !_(
+ @result~bool^@result
+ )~bool^logical_not
+ )~bool^not_strictly_false,
+ // LoopStep
+ _||_(
+ @result~bool^@result,
+ _==_(
+ .app.config~int^.app.config,
+ 1~int
+ )~bool^equals
+ )~bool^logical_or,
+ // Result
+ @result~bool^@result)~bool

runtime/src/main/java/dev/cel/runtime/RuntimeUnknownResolver.java

@@ -98,6 +98,11 @@ Optional<AccumulatedUnknowns> maybePartialUnknown(CelAttribute attribute) {
 
  /** Resolve a simple name to a value. */
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // Strip leading dot if present (for global disambiguation).
+ if (name.startsWith(".")) {
+ name = name.substring(1);
+ }
+
  CelAttribute attr = CelAttribute.EMPTY;
 
  if (attributeTrackingEnabled) {
@@ -154,6 +159,10 @@ private ScopedResolver(
 
  @Override
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // A name with a leading '.' always resolves in the root scope
+ if (name.startsWith(".")) {
+ return parent.resolveSimpleName(name, exprId);
+ }
  DefaultInterpreter.IntermediateResult result = lazyEvalResultCache.get(name);
  if (result != null) {
  return copyIfMutable(result);

runtime/src/test/resources/comprehension.baseline

@@ -19,4 +19,36 @@ declare com.x {
 }
 =====>
 bindings: {com.x=1}
-result: true
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0)
+declare cel.example.y {
+ value int
+}
+=====>
+bindings: {cel.example.y={z=1}}
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0 && .y.z == 1)
+declare y.z {
+ value int
+}
+=====>
+bindings: {y.z=1}
+result: true
+
+Source: [0].exists(x, x == 0 && .x == 1)
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true
+
+Source: [0].exists(x, [x+1].exists(x, x == .x))
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true

testing/src/main/java/dev/cel/testing/BaseInterpreterTest.java

@@ -863,6 +863,26 @@ public void comprehension() throws Exception {
  container = CelContainer.ofName("com");
  source = "[0].exists(x, x == 0)";
  runTest(ImmutableMap.of("com.x", 1));
+
+ clearAllDeclarations();
+ declareVariable("cel.example.y", SimpleType.INT);
+ container = CelContainer.ofName("cel.example");
+ source = "[{'z': 0}].exists(y, y.z == 0)";
+ runTest(ImmutableMap.of("cel.example.y", ImmutableMap.of("z", 1)));
+
+ clearAllDeclarations();
+ declareVariable("y.z", SimpleType.INT);
+ container = CelContainer.ofName("y");
+ source = "[{'z': 0}].exists(y, y.z == 0 && .y.z == 1)";
+ runTest(ImmutableMap.of("y.z", 1));
+
+ clearAllDeclarations();
+ declareVariable("x", SimpleType.INT);
+ source = "[0].exists(x, x == 0 && .x == 1)";
+ runTest(ImmutableMap.of("x", 1));
+
+ source = "[0].exists(x, [x+1].exists(x, x == .x))";
+ runTest(ImmutableMap.of("x", 1));
  }
 
  @Test

.gitignore

@@ -31,3 +31,5 @@ mvn-artifacts
 
 *.swp
 *.lock
+.eclipse
+.vscode

checker/src/main/java/dev/cel/checker/Env.java

@@ -451,17 +451,29 @@ public Env add(String name, Type type) {
  * until the root package is reached. If {@code container} starts with {@code .}, the resolution
  * is in the root container only.
  *
- * <p>Returns {@code null} if the function cannot be found.
+ * <p>Returns {@code null} if the ident cannot be found.
  */
  public @Nullable CelIdentDecl tryLookupCelIdent(CelContainer container, String name) {
- // Attempt to find the decl with just the ident name to account for shadowed variables
- CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(name);
- if (decl != null) {
- return decl;
+ // A name with a leading '.' always resolves in the root scope, bypassing local scopes.
+ if (!name.startsWith(".")) {
+ // Check if this is a qualified ident, or a field selection.
+ String simpleName = name;
+ int dotIndex = name.indexOf('.');
+ if (dotIndex > 0) {
+ simpleName = name.substring(0, dotIndex);
+ }
+
+ // Attempt to find the decl with just the ident name to account for shadowed variables.
+ CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(simpleName);
+ if (decl != null) {
+ // Appears to be a field selection on a local.
+ // Return null instead of attempting to resolve qualified name at the root scope
+ return dotIndex > 0 ? null : decl;
+ }
  }
 
  for (String cand : container.resolveCandidateNames(name)) {
- decl = tryLookupCelIdent(cand);
+CelIdentDecl decl = tryLookupCelIdent(cand);
  if (decl != null) {
  return decl;
  }
@@ -503,7 +515,13 @@ public Env add(String name, Type type) {
  return null;
  }
 
- private @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
+ /**
+ * Lookup a local identifier by name. This searches only comprehension scopes, bypassing standard
+ * environment or user-defined environment.
+ *
+ * <p>Returns {@code null} if not found in local scopes.
+ */
+ @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
  int firstUserSpaceScope = 2;
  // Iterate from the top of the stack down to the first local scope.
  // Note that:

checker/src/main/java/dev/cel/checker/ExprChecker.java

@@ -237,15 +237,18 @@ private CelExpr visit(CelExpr expr, CelExpr.CelIdent ident) {
  if (decl.equals(Env.ERROR_IDENT_DECL)) {
  // error reported
  env.setType(expr, SimpleType.ERROR);
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(decl.name(), decl));
  return expr;
  }
- if (!decl.name().equals(ident.name())) {
+
+ String refName = maybeDisambiguate(ident.name(), decl.name());
+
+ if (!refName.equals(ident.name())) {
  // Overwrite the identifier with its fully qualified name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  return expr;
  }
 
@@ -260,13 +263,15 @@ private CelExpr visit(CelExpr expr, CelExpr.CelSelect select) {
  env.reportError(expr.id(), getPosition(expr), "expression does not select a field");
  env.setType(expr, SimpleType.BOOL);
  } else {
+ String refName = maybeDisambiguate(qname, decl.name());
+
  if (namespacedDeclarations) {
  // Rewrite the node to be a variable reference to the resolved fully-qualified
  // variable name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  }
  return expr;
  }
@@ -595,14 +600,32 @@ private CelExpr visit(CelExpr expr, CelExpr.CelComprehension compre) {
  return expr;
  }
 
- private CelReference makeReference(CelIdentDecl decl) {
- CelReference.Builder ref = CelReference.newBuilder().setName(decl.name());
+ private CelReference makeReference(String name, CelIdentDecl decl) {
+ CelReference.Builder ref = CelReference.newBuilder().setName(name);
  if (decl.constant().isPresent()) {
  ref.setValue(decl.constant().get());
  }
  return ref.build();
  }
 
+ /**
+ * Returns the reference name, prefixed with a leading dot only if disambiguation is needed.
+ * Disambiguation is needed when: the original name had a leading dot, and there's a local
+ * variable that would shadow the resolved name.
+ */
+ private String maybeDisambiguate(String originalName, String resolvedName) {
+ if (!originalName.startsWith(".")) {
+ return resolvedName;
+ }
+ String simpleName = originalName.substring(1);
+ int dotIndex = simpleName.indexOf('.');
+ String localName = dotIndex > 0 ? simpleName.substring(0, dotIndex) : simpleName;
+ if (env.tryLookupCelIdentFromLocalScopes(localName) != null) {
+ return "." + resolvedName;
+ }
+ return resolvedName;
+ }
+
  private OverloadResolution resolveOverload(
  long callExprId,
  int position,

checker/src/test/java/dev/cel/checker/ExprCheckerTest.java

@@ -199,6 +199,10 @@ public void referenceTypeRelative() throws Exception {
  public void referenceTypeAbsolute() throws Exception {
  source = ".cel.expr.conformance.proto3.TestAllTypes";
  runTest();
+
+ declareVariable("app.config", SimpleType.INT);
+ source = "[0].exists(app, .app.config == 1)";
+ runTest();
  }
 
  @Test

checker/src/test/resources/referenceTypeAbsolute.baseline

@@ -1,3 +1,36 @@
 Source: .cel.expr.conformance.proto3.TestAllTypes
 =====>
 cel.expr.conformance.proto3.TestAllTypes~type(cel.expr.conformance.proto3.TestAllTypes)^cel.expr.conformance.proto3.TestAllTypes
+
+Source: [0].exists(app, .app.config == 1)
+declare app.config {
+ value int
+}
+=====>
+__comprehension__(
+ // Variable
+ app,
+ // Target
+ [
+ 0~int
+ ]~list(int),
+ // Accumulator
+ @result,
+ // Init
+ false~bool,
+ // LoopCondition
+ @not_strictly_false(
+ !_(
+ @result~bool^@result
+ )~bool^logical_not
+ )~bool^not_strictly_false,
+ // LoopStep
+ _||_(
+ @result~bool^@result,
+ _==_(
+ .app.config~int^.app.config,
+ 1~int
+ )~bool^equals
+ )~bool^logical_or,
+ // Result
+ @result~bool^@result)~bool

runtime/src/main/java/dev/cel/runtime/RuntimeUnknownResolver.java

@@ -98,6 +98,11 @@ Optional<AccumulatedUnknowns> maybePartialUnknown(CelAttribute attribute) {
 
  /** Resolve a simple name to a value. */
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // Strip leading dot if present (for global disambiguation).
+ if (name.startsWith(".")) {
+ name = name.substring(1);
+ }
+
  CelAttribute attr = CelAttribute.EMPTY;
 
  if (attributeTrackingEnabled) {
@@ -154,6 +159,10 @@ private ScopedResolver(
 
  @Override
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // A name with a leading '.' always resolves in the root scope
+ if (name.startsWith(".")) {
+ return parent.resolveSimpleName(name, exprId);
+ }
  DefaultInterpreter.IntermediateResult result = lazyEvalResultCache.get(name);
  if (result != null) {
  return copyIfMutable(result);

runtime/src/test/resources/comprehension.baseline

@@ -19,4 +19,36 @@ declare com.x {
 }
 =====>
 bindings: {com.x=1}
-result: true
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0)
+declare cel.example.y {
+ value int
+}
+=====>
+bindings: {cel.example.y={z=1}}
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0 && .y.z == 1)
+declare y.z {
+ value int
+}
+=====>
+bindings: {y.z=1}
+result: true
+
+Source: [0].exists(x, x == 0 && .x == 1)
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true
+
+Source: [0].exists(x, [x+1].exists(x, x == .x))
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true

testing/src/main/java/dev/cel/testing/BaseInterpreterTest.java

@@ -863,6 +863,26 @@ public void comprehension() throws Exception {
  container = CelContainer.ofName("com");
  source = "[0].exists(x, x == 0)";
  runTest(ImmutableMap.of("com.x", 1));
+
+ clearAllDeclarations();
+ declareVariable("cel.example.y", SimpleType.INT);
+ container = CelContainer.ofName("cel.example");
+ source = "[{'z': 0}].exists(y, y.z == 0)";
+ runTest(ImmutableMap.of("cel.example.y", ImmutableMap.of("z", 1)));
+
+ clearAllDeclarations();
+ declareVariable("y.z", SimpleType.INT);
+ container = CelContainer.ofName("y");
+ source = "[{'z': 0}].exists(y, y.z == 0 && .y.z == 1)";
+ runTest(ImmutableMap.of("y.z", 1));
+
+ clearAllDeclarations();
+ declareVariable("x", SimpleType.INT);
+ source = "[0].exists(x, x == 0 && .x == 1)";
+ runTest(ImmutableMap.of("x", 1));
+
+ source = "[0].exists(x, [x+1].exists(x, x == .x))";
+ runTest(ImmutableMap.of("x", 1));
  }
 
  @Test

.gitignore

@@ -31,3 +31,5 @@ mvn-artifacts
 
 *.swp
 *.lock
+.eclipse
+.vscode

checker/src/main/java/dev/cel/checker/Env.java

@@ -451,17 +451,29 @@ public Env add(String name, Type type) {
  * until the root package is reached. If {@code container} starts with {@code .}, the resolution
  * is in the root container only.
  *
- * <p>Returns {@code null} if the function cannot be found.
+ * <p>Returns {@code null} if the ident cannot be found.
  */
  public @Nullable CelIdentDecl tryLookupCelIdent(CelContainer container, String name) {
- // Attempt to find the decl with just the ident name to account for shadowed variables
- CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(name);
- if (decl != null) {
- return decl;
+ // A name with a leading '.' always resolves in the root scope, bypassing local scopes.
+ if (!name.startsWith(".")) {
+ // Check if this is a qualified ident, or a field selection.
+ String simpleName = name;
+ int dotIndex = name.indexOf('.');
+ if (dotIndex > 0) {
+ simpleName = name.substring(0, dotIndex);
+ }
+
+ // Attempt to find the decl with just the ident name to account for shadowed variables.
+ CelIdentDecl decl = tryLookupCelIdentFromLocalScopes(simpleName);
+ if (decl != null) {
+ // Appears to be a field selection on a local.
+ // Return null instead of attempting to resolve qualified name at the root scope
+ return dotIndex > 0 ? null : decl;
+ }
  }
 
  for (String cand : container.resolveCandidateNames(name)) {
- decl = tryLookupCelIdent(cand);
+CelIdentDecl decl = tryLookupCelIdent(cand);
  if (decl != null) {
  return decl;
  }
@@ -503,7 +515,13 @@ public Env add(String name, Type type) {
  return null;
  }
 
- private @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
+ /**
+ * Lookup a local identifier by name. This searches only comprehension scopes, bypassing standard
+ * environment or user-defined environment.
+ *
+ * <p>Returns {@code null} if not found in local scopes.
+ */
+ @Nullable CelIdentDecl tryLookupCelIdentFromLocalScopes(String name) {
  int firstUserSpaceScope = 2;
  // Iterate from the top of the stack down to the first local scope.
  // Note that:

checker/src/main/java/dev/cel/checker/ExprChecker.java

@@ -237,15 +237,18 @@ private CelExpr visit(CelExpr expr, CelExpr.CelIdent ident) {
  if (decl.equals(Env.ERROR_IDENT_DECL)) {
  // error reported
  env.setType(expr, SimpleType.ERROR);
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(decl.name(), decl));
  return expr;
  }
- if (!decl.name().equals(ident.name())) {
+
+ String refName = maybeDisambiguate(ident.name(), decl.name());
+
+ if (!refName.equals(ident.name())) {
  // Overwrite the identifier with its fully qualified name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  return expr;
  }
 
@@ -260,13 +263,15 @@ private CelExpr visit(CelExpr expr, CelExpr.CelSelect select) {
  env.reportError(expr.id(), getPosition(expr), "expression does not select a field");
  env.setType(expr, SimpleType.BOOL);
  } else {
+ String refName = maybeDisambiguate(qname, decl.name());
+
  if (namespacedDeclarations) {
  // Rewrite the node to be a variable reference to the resolved fully-qualified
  // variable name.
- expr = replaceIdentSubtree(expr, decl.name());
+ expr = replaceIdentSubtree(expr, refName);
  }
  env.setType(expr, decl.type());
- env.setRef(expr, makeReference(decl));
+ env.setRef(expr, makeReference(refName, decl));
  }
  return expr;
  }
@@ -595,14 +600,32 @@ private CelExpr visit(CelExpr expr, CelExpr.CelComprehension compre) {
  return expr;
  }
 
- private CelReference makeReference(CelIdentDecl decl) {
- CelReference.Builder ref = CelReference.newBuilder().setName(decl.name());
+ private CelReference makeReference(String name, CelIdentDecl decl) {
+ CelReference.Builder ref = CelReference.newBuilder().setName(name);
  if (decl.constant().isPresent()) {
  ref.setValue(decl.constant().get());
  }
  return ref.build();
  }
 
+ /**
+ * Returns the reference name, prefixed with a leading dot only if disambiguation is needed.
+ * Disambiguation is needed when: the original name had a leading dot, and there's a local
+ * variable that would shadow the resolved name.
+ */
+ private String maybeDisambiguate(String originalName, String resolvedName) {
+ if (!originalName.startsWith(".")) {
+ return resolvedName;
+ }
+ String simpleName = originalName.substring(1);
+ int dotIndex = simpleName.indexOf('.');
+ String localName = dotIndex > 0 ? simpleName.substring(0, dotIndex) : simpleName;
+ if (env.tryLookupCelIdentFromLocalScopes(localName) != null) {
+ return "." + resolvedName;
+ }
+ return resolvedName;
+ }
+
  private OverloadResolution resolveOverload(
  long callExprId,
  int position,

checker/src/test/java/dev/cel/checker/ExprCheckerTest.java

@@ -199,6 +199,10 @@ public void referenceTypeRelative() throws Exception {
  public void referenceTypeAbsolute() throws Exception {
  source = ".cel.expr.conformance.proto3.TestAllTypes";
  runTest();
+
+ declareVariable("app.config", SimpleType.INT);
+ source = "[0].exists(app, .app.config == 1)";
+ runTest();
  }
 
  @Test

checker/src/test/resources/referenceTypeAbsolute.baseline

@@ -1,3 +1,36 @@
 Source: .cel.expr.conformance.proto3.TestAllTypes
 =====>
 cel.expr.conformance.proto3.TestAllTypes~type(cel.expr.conformance.proto3.TestAllTypes)^cel.expr.conformance.proto3.TestAllTypes
+
+Source: [0].exists(app, .app.config == 1)
+declare app.config {
+ value int
+}
+=====>
+__comprehension__(
+ // Variable
+ app,
+ // Target
+ [
+ 0~int
+ ]~list(int),
+ // Accumulator
+ @result,
+ // Init
+ false~bool,
+ // LoopCondition
+ @not_strictly_false(
+ !_(
+ @result~bool^@result
+ )~bool^logical_not
+ )~bool^not_strictly_false,
+ // LoopStep
+ _||_(
+ @result~bool^@result,
+ _==_(
+ .app.config~int^.app.config,
+ 1~int
+ )~bool^equals
+ )~bool^logical_or,
+ // Result
+ @result~bool^@result)~bool

runtime/src/main/java/dev/cel/runtime/RuntimeUnknownResolver.java

@@ -98,6 +98,11 @@ Optional<AccumulatedUnknowns> maybePartialUnknown(CelAttribute attribute) {
 
  /** Resolve a simple name to a value. */
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // Strip leading dot if present (for global disambiguation).
+ if (name.startsWith(".")) {
+ name = name.substring(1);
+ }
+
  CelAttribute attr = CelAttribute.EMPTY;
 
  if (attributeTrackingEnabled) {
@@ -154,6 +159,10 @@ private ScopedResolver(
 
  @Override
  DefaultInterpreter.IntermediateResult resolveSimpleName(String name, Long exprId) {
+ // A name with a leading '.' always resolves in the root scope
+ if (name.startsWith(".")) {
+ return parent.resolveSimpleName(name, exprId);
+ }
  DefaultInterpreter.IntermediateResult result = lazyEvalResultCache.get(name);
  if (result != null) {
  return copyIfMutable(result);

runtime/src/test/resources/comprehension.baseline

@@ -19,4 +19,36 @@ declare com.x {
 }
 =====>
 bindings: {com.x=1}
-result: true
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0)
+declare cel.example.y {
+ value int
+}
+=====>
+bindings: {cel.example.y={z=1}}
+result: true
+
+Source: [{'z': 0}].exists(y, y.z == 0 && .y.z == 1)
+declare y.z {
+ value int
+}
+=====>
+bindings: {y.z=1}
+result: true
+
+Source: [0].exists(x, x == 0 && .x == 1)
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true
+
+Source: [0].exists(x, [x+1].exists(x, x == .x))
+declare x {
+ value int
+}
+=====>
+bindings: {x=1}
+result: true

testing/src/main/java/dev/cel/testing/BaseInterpreterTest.java

@@ -863,6 +863,26 @@ public void comprehension() throws Exception {
  container = CelContainer.ofName("com");
  source = "[0].exists(x, x == 0)";
  runTest(ImmutableMap.of("com.x", 1));
+
+ clearAllDeclarations();
+ declareVariable("cel.example.y", SimpleType.INT);
+ container = CelContainer.ofName("cel.example");
+ source = "[{'z': 0}].exists(y, y.z == 0)";
+ runTest(ImmutableMap.of("cel.example.y", ImmutableMap.of("z", 1)));
+
+ clearAllDeclarations();
+ declareVariable("y.z", SimpleType.INT);
+ container = CelContainer.ofName("y");
+ source = "[{'z': 0}].exists(y, y.z == 0 && .y.z == 1)";
+ runTest(ImmutableMap.of("y.z", 1));
+
+ clearAllDeclarations();
+ declareVariable("x", SimpleType.INT);
+ source = "[0].exists(x, x == 0 && .x == 1)";
+ runTest(ImmutableMap.of("x", 1));
+
+ source = "[0].exists(x, [x+1].exists(x, x == .x))";
+ runTest(ImmutableMap.of("x", 1));
  }
 
  @Test