@harness-engineering/eslint-plugin 0.2.3 → 0.3.0

package/dist/index.d.ts

@@ -22,6 +22,9 @@ declare const rules: {
     'no-nested-loops-in-critical': _typescript_eslint_utils_ts_eslint.RuleModule<"nestedLoopInCritical", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
+    'no-process-env-in-spawn': _typescript_eslint_utils_ts_eslint.RuleModule<"processEnvInSpawn", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
     'no-sync-io-in-async': _typescript_eslint_utils_ts_eslint.RuleModule<"syncIoInAsync", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
@@ -66,6 +69,9 @@ declare const plugin: {
         'no-nested-loops-in-critical': _typescript_eslint_utils_ts_eslint.RuleModule<"nestedLoopInCritical", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
+        'no-process-env-in-spawn': _typescript_eslint_utils_ts_eslint.RuleModule<"processEnvInSpawn", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
         'no-sync-io-in-async': _typescript_eslint_utils_ts_eslint.RuleModule<"syncIoInAsync", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
@@ -95,6 +101,7 @@ declare const plugin: {
                 '@harness-engineering/enforce-doc-exports': string;
                 '@harness-engineering/no-unix-shell-command': string;
                 '@harness-engineering/no-hardcoded-path-separator': string;
+                '@harness-engineering/no-process-env-in-spawn': string;
                 '@harness-engineering/require-path-normalization': string;
             };
         };
@@ -110,6 +117,7 @@ declare const plugin: {
                 '@harness-engineering/enforce-doc-exports': string;
                 '@harness-engineering/no-unix-shell-command': string;
                 '@harness-engineering/no-hardcoded-path-separator': string;
+                '@harness-engineering/no-process-env-in-spawn': string;
                 '@harness-engineering/require-path-normalization': string;
             };
         };
@@ -146,6 +154,9 @@ declare const configs: {
                     'no-nested-loops-in-critical': _typescript_eslint_utils_ts_eslint.RuleModule<"nestedLoopInCritical", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
                         name: string;
                     };
+                    'no-process-env-in-spawn': _typescript_eslint_utils_ts_eslint.RuleModule<"processEnvInSpawn", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+                        name: string;
+                    };
                     'no-sync-io-in-async': _typescript_eslint_utils_ts_eslint.RuleModule<"syncIoInAsync", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
                         name: string;
                     };
@@ -173,6 +184,7 @@ declare const configs: {
             '@harness-engineering/enforce-doc-exports': string;
             '@harness-engineering/no-unix-shell-command': string;
             '@harness-engineering/no-hardcoded-path-separator': string;
+            '@harness-engineering/no-process-env-in-spawn': string;
             '@harness-engineering/require-path-normalization': string;
         };
     };
@@ -205,6 +217,9 @@ declare const configs: {
                     'no-nested-loops-in-critical': _typescript_eslint_utils_ts_eslint.RuleModule<"nestedLoopInCritical", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
                         name: string;
                     };
+                    'no-process-env-in-spawn': _typescript_eslint_utils_ts_eslint.RuleModule<"processEnvInSpawn", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+                        name: string;
+                    };
                     'no-sync-io-in-async': _typescript_eslint_utils_ts_eslint.RuleModule<"syncIoInAsync", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
                         name: string;
                     };
@@ -232,6 +247,7 @@ declare const configs: {
             '@harness-engineering/enforce-doc-exports': string;
             '@harness-engineering/no-unix-shell-command': string;
             '@harness-engineering/no-hardcoded-path-separator': string;
+            '@harness-engineering/no-process-env-in-spawn': string;
             '@harness-engineering/require-path-normalization': string;
         };
     };

package/dist/index.js

@@ -3,25 +3,25 @@ import { ESLintUtils, AST_NODE_TYPES as AST_NODE_TYPES2 } from "@typescript-esli
 
 // src/utils/ast-helpers.ts
 import { AST_NODE_TYPES } from "@typescript-eslint/utils";
-function hasJSDocComment(node, sourceCode) {
-  if (!node.range) return false;
-  const textBefore = sourceCode.slice(0, node.range[0]);
-  const lines = textBefore.split("\n");
-  let foundJSDoc = false;
+function lastNonEmptyLineEndsBlockComment(lines) {
   for (let i = lines.length - 1; i >= 0; i--) {
     const line = lines[i]?.trim() ?? "";
     if (line === "") continue;
-    if (line.endsWith("*/")) {
-      const startIdx = textBefore.lastIndexOf("/**");
-      const endIdx = textBefore.lastIndexOf("*/");
-      if (startIdx !== -1 && endIdx > startIdx) {
-        foundJSDoc = true;
-      }
-      break;
-    }
-    break;
+    return line.endsWith("*/");
   }
-  return foundJSDoc;
+  return false;
+}
+function textContainsJSDoc(text) {
+  const startIdx = text.lastIndexOf("/**");
+  const endIdx = text.lastIndexOf("*/");
+  return startIdx !== -1 && endIdx > startIdx;
+}
+function hasJSDocComment(node, sourceCode) {
+  if (!node.range) return false;
+  const textBefore = sourceCode.slice(0, node.range[0]);
+  const lines = textBefore.split("\n");
+  if (!lastNonEmptyLineEndsBlockComment(lines)) return false;
+  return textContainsJSDoc(textBefore);
 }
 var SKIP_KEYS = /* @__PURE__ */ new Set(["parent", "loc", "range", "tokens", "comments"]);
 var ZOD_PARSE_METHODS = /* @__PURE__ */ new Set(["parse", "safeParse"]);
@@ -33,17 +33,20 @@ function isZodParseCall(node) {
   if (prop.type !== AST_NODE_TYPES.Identifier) return false;
   return ZOD_PARSE_METHODS.has(prop.name);
 }
+function visitArrayItems(items, visitor) {
+  for (const item of items) {
+    if (item && typeof item === "object" && "type" in item) {
+      visitor(item);
+    }
+  }
+}
 function visitChildren(node, visitor) {
   for (const key of Object.keys(node)) {
     if (SKIP_KEYS.has(key)) continue;
     const value = node[key];
     if (!value || typeof value !== "object") continue;
     if (Array.isArray(value)) {
-      for (const item of value) {
-        if (item && typeof item === "object" && "type" in item) {
-          visitor(item);
-        }
-      }
+      visitArrayItems(value, visitor);
     } else if ("type" in value) {
       visitor(value);
     }
@@ -77,6 +80,43 @@ function isMarkedInternal(node, sourceCode) {
 var createRule = ESLintUtils.RuleCreator(
   (name) => `https://github.com/harness-engineering/eslint-plugin/blob/main/docs/rules/${name}.md`
 );
+function getVariableExports(decl) {
+  return decl.declarations.filter((d) => d.id.type === AST_NODE_TYPES2.Identifier).map((d) => ({ kind: "variable", name: d.id.name }));
+}
+function getExportInfo(decl, ignoreTypes) {
+  const declType = decl.type;
+  if (declType === AST_NODE_TYPES2.FunctionDeclaration) {
+    const fn = decl;
+    return fn.id ? [{ kind: "function", name: fn.id.name }] : [];
+  }
+  if (declType === AST_NODE_TYPES2.ClassDeclaration) {
+    const cls = decl;
+    return cls.id ? [{ kind: "class", name: cls.id.name }] : [];
+  }
+  if (declType === AST_NODE_TYPES2.VariableDeclaration) {
+    return getVariableExports(decl);
+  }
+  if (declType === AST_NODE_TYPES2.TSTypeAliasDeclaration && !ignoreTypes) {
+    return [{ kind: "type", name: decl.id.name }];
+  }
+  if (declType === AST_NODE_TYPES2.TSInterfaceDeclaration && !ignoreTypes) {
+    return [{ kind: "interface", name: decl.id.name }];
+  }
+  return [];
+}
+function checkExportNode(node, kind, name, sourceCode, ignoreInternal, report) {
+  if (ignoreInternal && isMarkedInternal(node, sourceCode)) return;
+  if (!hasJSDocComment(node, sourceCode)) {
+    report({ node, messageId: "missingJSDoc", data: { kind, name } });
+  }
+}
+function handleExportNamedDeclaration(node, ignoreTypes, sourceCode, ignoreInternal, report) {
+  const decl = node.declaration;
+  if (!decl) return;
+  for (const info of getExportInfo(decl, ignoreTypes)) {
+    checkExportNode(node, info.kind, info.name, sourceCode, ignoreInternal, report);
+  }
+}
 var enforce_doc_exports_default = createRule({
   name: "enforce-doc-exports",
   meta: {
@@ -101,47 +141,12 @@ var enforce_doc_exports_default = createRule({
   defaultOptions: [{ ignoreTypes: false, ignoreInternal: true }],
   create(context, [options]) {
     const sourceCode = context.sourceCode.getText();
-    function checkExport(node, kind, name) {
-      if (options.ignoreInternal && isMarkedInternal(node, sourceCode)) {
-        return;
-      }
-      if (!hasJSDocComment(node, sourceCode)) {
-        context.report({
-          node,
-          messageId: "missingJSDoc",
-          data: { kind, name }
-        });
-      }
-    }
-    function getExportInfo(decl) {
-      const declType = decl.type;
-      if (declType === AST_NODE_TYPES2.FunctionDeclaration) {
-        const fn = decl;
-        return fn.id ? [{ kind: "function", name: fn.id.name }] : [];
-      }
-      if (declType === AST_NODE_TYPES2.ClassDeclaration) {
-        const cls = decl;
-        return cls.id ? [{ kind: "class", name: cls.id.name }] : [];
-      }
-      if (declType === AST_NODE_TYPES2.VariableDeclaration) {
-        const varDecl = decl;
-        return varDecl.declarations.filter((d) => d.id.type === AST_NODE_TYPES2.Identifier).map((d) => ({ kind: "variable", name: d.id.name }));
-      }
-      if (declType === AST_NODE_TYPES2.TSTypeAliasDeclaration && !options.ignoreTypes) {
-        return [{ kind: "type", name: decl.id.name }];
-      }
-      if (declType === AST_NODE_TYPES2.TSInterfaceDeclaration && !options.ignoreTypes) {
-        return [{ kind: "interface", name: decl.id.name }];
-      }
-      return [];
-    }
+    const ignoreTypes = options.ignoreTypes ?? false;
+    const ignoreInternal = options.ignoreInternal ?? true;
+    const report = context.report.bind(context);
     return {
       ExportNamedDeclaration(node) {
-        const decl = node.declaration;
-        if (!decl) return;
-        for (const info of getExportInfo(decl)) {
-          checkExport(node, info.kind, info.name);
-        }
+        handleExportNamedDeclaration(node, ignoreTypes, sourceCode, ignoreInternal, report);
       }
     };
   }
@@ -196,6 +201,24 @@ function normalizePath(filePath) {
   }
   return path.basename(filePath);
 }
+function checkImportDeclaration(node, context, currentFile) {
+  const importPath = node.source.value;
+  if (!importPath.startsWith(".")) {
+    return;
+  }
+  const importingDir = path.dirname(context.filename);
+  const resolvedPath = path.resolve(importingDir, importPath);
+  const normalizedImport = normalizePath(resolvedPath);
+  const cycle = detectCycle(currentFile, normalizedImport);
+  if (cycle) {
+    context.report({
+      node,
+      messageId: "circularDep",
+      data: { cycle: cycle.map((f) => path.basename(f)).join(" \u2192 ") }
+    });
+  }
+  addEdge(currentFile, normalizedImport);
+}
 var no_circular_deps_default = createRule2({
   name: "no-circular-deps",
   meta: {
@@ -213,24 +236,7 @@ var no_circular_deps_default = createRule2({
     const currentFile = normalizePath(context.filename);
     return {
       ImportDeclaration(node) {
-        const importPath = node.source.value;
-        if (!importPath.startsWith(".")) {
-          return;
-        }
-        const importingDir = path.dirname(context.filename);
-        const resolvedPath = path.resolve(importingDir, importPath);
-        const normalizedImport = normalizePath(resolvedPath);
-        const cycle = detectCycle(currentFile, normalizedImport);
-        if (cycle) {
-          context.report({
-            node,
-            messageId: "circularDep",
-            data: {
-              cycle: cycle.map((f) => path.basename(f)).join(" \u2192 ")
-            }
-          });
-        }
-        addEdge(currentFile, normalizedImport);
+        checkImportDeclaration(node, context, currentFile);
       }
     };
   }
@@ -348,6 +354,34 @@ function normalizePath2(filePath) {
 var createRule3 = ESLintUtils3.RuleCreator(
   (name) => `https://github.com/harness-engineering/eslint-plugin/blob/main/docs/rules/${name}.md`
 );
+function importMatchesDisallowed(importPath, resolvedImport, disallowed) {
+  return importPath === disallowed || matchesPattern(resolvedImport, disallowed) || matchesPattern(importPath, disallowed);
+}
+function findViolatedRule(applicableRules, importPath, resolvedImport) {
+  for (const rule of applicableRules) {
+    for (const disallowed of rule.disallow) {
+      if (importMatchesDisallowed(importPath, resolvedImport, disallowed)) {
+        return rule;
+      }
+    }
+  }
+  return void 0;
+}
+function buildForbiddenMessage(rule, importPath) {
+  return rule.message ?? `Import "${importPath}" is forbidden in files matching "${rule.from}"`;
+}
+function checkImportDeclaration2(node, applicableRules, filename, report) {
+  const importPath = node.source.value;
+  const resolvedImport = resolveImportPath(importPath, filename);
+  const violatedRule = findViolatedRule(applicableRules, importPath, resolvedImport);
+  if (violatedRule) {
+    report({
+      node,
+      messageId: "forbiddenImport",
+      data: { message: buildForbiddenMessage(violatedRule, importPath) }
+    });
+  }
+}
 var no_forbidden_imports_default = createRule3({
   name: "no-forbidden-imports",
   meta: {
@@ -373,25 +407,10 @@ var no_forbidden_imports_default = createRule3({
     if (applicableRules.length === 0) {
       return {};
     }
+    const report = context.report.bind(context);
     return {
       ImportDeclaration(node) {
-        const importPath = node.source.value;
-        const resolvedImport = resolveImportPath(importPath, context.filename);
-        for (const rule of applicableRules) {
-          for (const disallowed of rule.disallow) {
-            const isMatch = importPath === disallowed || matchesPattern(resolvedImport, disallowed) || matchesPattern(importPath, disallowed);
-            if (isMatch) {
-              context.report({
-                node,
-                messageId: "forbiddenImport",
-                data: {
-                  message: rule.message || `Import "${importPath}" is forbidden in files matching "${rule.from}"`
-                }
-              });
-              return;
-            }
-          }
-        }
+        checkImportDeclaration2(node, applicableRules, context.filename, report);
       }
     };
   }
@@ -402,6 +421,25 @@ import { ESLintUtils as ESLintUtils4 } from "@typescript-eslint/utils";
 var createRule4 = ESLintUtils4.RuleCreator(
   (name) => `https://github.com/harness-engineering/eslint-plugin/blob/main/docs/rules/${name}.md`
 );
+function isLayerViolation(importLayer, currentLayer, currentLayerDef) {
+  return importLayer !== currentLayer && !currentLayerDef.allowedDependencies.includes(importLayer);
+}
+function resolveImportLayer(importPath, filename, layers) {
+  if (!importPath.startsWith(".")) return null;
+  const resolvedImport = resolveImportPath(importPath, filename);
+  return getLayerForFile(resolvedImport, layers) ?? null;
+}
+function checkLayerImport(node, context, currentLayer, currentLayerDef, layers) {
+  const importLayer = resolveImportLayer(node.source.value, context.filename, layers);
+  if (!importLayer) return;
+  if (isLayerViolation(importLayer, currentLayer, currentLayerDef)) {
+    context.report({
+      node,
+      messageId: "layerViolation",
+      data: { fromLayer: currentLayer, toLayer: importLayer }
+    });
+  }
+}
 var no_layer_violation_default = createRule4({
   name: "no-layer-violation",
   meta: {
@@ -429,27 +467,10 @@ var no_layer_violation_default = createRule4({
     if (!currentLayerDef) {
       return {};
     }
+    const layers = config.layers;
     return {
       ImportDeclaration(node) {
-        const importPath = node.source.value;
-        if (!importPath.startsWith(".")) {
-          return;
-        }
-        const resolvedImport = resolveImportPath(importPath, context.filename);
-        const importLayer = getLayerForFile(resolvedImport, config.layers);
-        if (!importLayer) {
-          return;
-        }
-        if (importLayer !== currentLayer && !currentLayerDef.allowedDependencies.includes(importLayer)) {
-          context.report({
-            node,
-            messageId: "layerViolation",
-            data: {
-              fromLayer: currentLayer,
-              toLayer: importLayer
-            }
-          });
-        }
+        checkLayerImport(node, context, currentLayer, currentLayerDef, layers);
       }
     };
   }
@@ -460,6 +481,49 @@ import { ESLintUtils as ESLintUtils5 } from "@typescript-eslint/utils";
 var createRule5 = ESLintUtils5.RuleCreator(
   (name) => `https://github.com/harness-engineering/eslint-plugin/blob/main/docs/rules/${name}.md`
 );
+function getAnnotationTarget(node) {
+  const parentType = node.parent?.type;
+  if (parentType === "ExportNamedDeclaration" || parentType === "VariableDeclaration") {
+    return node.parent;
+  }
+  return node;
+}
+function hasCriticalAnnotation(node, sourceText) {
+  const target = getAnnotationTarget(node);
+  const startLine = target.loc.start.line;
+  const lines = sourceText.split("\n");
+  for (let i = Math.max(0, startLine - 2); i < startLine; i++) {
+    if (lines[i]?.includes("@perf-critical")) return true;
+  }
+  return false;
+}
+function makeEnterFunction(criticalStack, loopDepthRef, sourceText) {
+  return function enterFunction(node) {
+    criticalStack.push(hasCriticalAnnotation(node, sourceText));
+    loopDepthRef.value = 0;
+  };
+}
+function makeExitFunction(criticalStack, loopDepthRef) {
+  return function exitFunction() {
+    criticalStack.pop();
+    loopDepthRef.value = 0;
+  };
+}
+function makeEnterLoop(criticalStack, loopDepthRef, reportFn) {
+  return function enterLoop(node) {
+    if (criticalStack.length === 0 || criticalStack[criticalStack.length - 1] !== true) return;
+    loopDepthRef.value++;
+    if (loopDepthRef.value > 1) {
+      reportFn(node);
+    }
+  };
+}
+function makeExitLoop(criticalStack, loopDepthRef) {
+  return function exitLoop() {
+    if (criticalStack.length === 0 || criticalStack[criticalStack.length - 1] !== true) return;
+    loopDepthRef.value--;
+  };
+}
 var no_nested_loops_in_critical_default = createRule5({
   name: "no-nested-loops-in-critical",
   meta: {
@@ -479,38 +543,14 @@ var no_nested_loops_in_critical_default = createRule5({
       return {};
     }
     const criticalStack = [];
-    let loopDepth = 0;
-    function isCritical() {
-      return criticalStack.length > 0 && criticalStack[criticalStack.length - 1] === true;
-    }
-    function hasCriticalAnnotation(node) {
-      const target = node.parent?.type === "ExportNamedDeclaration" || node.parent?.type === "VariableDeclaration" ? node.parent : node;
-      const startLine = target.loc.start.line;
-      const lines = sourceText.split("\n");
-      for (let i = Math.max(0, startLine - 2); i < startLine; i++) {
-        if (lines[i]?.includes("@perf-critical")) return true;
-      }
-      return false;
-    }
-    function enterFunction(node) {
-      criticalStack.push(hasCriticalAnnotation(node));
-      loopDepth = 0;
-    }
-    function exitFunction() {
-      criticalStack.pop();
-      loopDepth = 0;
-    }
-    function enterLoop(node) {
-      if (!isCritical()) return;
-      loopDepth++;
-      if (loopDepth > 1) {
-        context.report({ node, messageId: "nestedLoopInCritical" });
-      }
-    }
-    function exitLoop() {
-      if (!isCritical()) return;
-      loopDepth--;
-    }
+    const loopDepthRef = { value: 0 };
+    const reportNestedLoop = (node) => {
+      context.report({ node, messageId: "nestedLoopInCritical" });
+    };
+    const enterFunction = makeEnterFunction(criticalStack, loopDepthRef, sourceText);
+    const exitFunction = makeExitFunction(criticalStack, loopDepthRef);
+    const enterLoop = makeEnterLoop(criticalStack, loopDepthRef, reportNestedLoop);
+    const exitLoop = makeExitLoop(criticalStack, loopDepthRef);
     return {
       FunctionDeclaration: enterFunction,
       "FunctionDeclaration:exit": exitFunction,
@@ -549,6 +589,32 @@ var SYNC_FS_METHODS = /* @__PURE__ */ new Set([
   "renameSync",
   "accessSync"
 ]);
+function getSyncMethodName(node) {
+  if (node.callee.type === "Identifier" && SYNC_FS_METHODS.has(node.callee.name)) {
+    return node.callee.name;
+  }
+  if (node.callee.type === "MemberExpression" && node.callee.property.type === "Identifier" && SYNC_FS_METHODS.has(node.callee.property.name)) {
+    return node.callee.property.name;
+  }
+  return void 0;
+}
+function adjustAsyncDepth(node, depthRef, delta) {
+  if (node.async) {
+    depthRef.value += delta;
+  }
+}
+function checkSyncCallInAsync(node, depthRef, reportFn) {
+  if (depthRef.value === 0) return;
+  const name = getSyncMethodName(node);
+  if (name) {
+    reportFn(name);
+  }
+}
+function reportSyncCallExpression(node, context, asyncDepthRef) {
+  checkSyncCallInAsync(node, asyncDepthRef, (name) => {
+    context.report({ node, messageId: "syncIoInAsync", data: { name } });
+  });
+}
 var no_sync_io_in_async_default = createRule6({
   name: "no-sync-io-in-async",
   meta: {
@@ -563,17 +629,9 @@ var no_sync_io_in_async_default = createRule6({
   },
   defaultOptions: [],
   create(context) {
-    let asyncDepth = 0;
-    function enterFunction(node) {
-      if (node.async) {
-        asyncDepth++;
-      }
-    }
-    function exitFunction(node) {
-      if (node.async) {
-        asyncDepth--;
-      }
-    }
+    const asyncDepthRef = { value: 0 };
+    const enterFunction = (node) => adjustAsyncDepth(node, asyncDepthRef, 1);
+    const exitFunction = (node) => adjustAsyncDepth(node, asyncDepthRef, -1);
     return {
       FunctionDeclaration: enterFunction,
       "FunctionDeclaration:exit": exitFunction,
@@ -582,21 +640,7 @@ var no_sync_io_in_async_default = createRule6({
       ArrowFunctionExpression: enterFunction,
       "ArrowFunctionExpression:exit": exitFunction,
       CallExpression(node) {
-        if (asyncDepth === 0) return;
-        let name;
-        if (node.callee.type === "Identifier" && SYNC_FS_METHODS.has(node.callee.name)) {
-          name = node.callee.name;
-        }
-        if (node.callee.type === "MemberExpression" && node.callee.property.type === "Identifier" && SYNC_FS_METHODS.has(node.callee.property.name)) {
-          name = node.callee.property.name;
-        }
-        if (name) {
-          context.report({
-            node,
-            messageId: "syncIoInAsync",
-            data: { name }
-          });
-        }
+        reportSyncCallExpression(node, context, asyncDepthRef);
       }
     };
   }
@@ -618,6 +662,28 @@ var ARRAY_METHODS = /* @__PURE__ */ new Set([
   "every",
   "forEach"
 ]);
+function isArrayMethodCall(node) {
+  return node.property.type === "Identifier" && ARRAY_METHODS.has(node.property.name);
+}
+function isInnerChainLink(node) {
+  const callExpr = node.parent;
+  if (!callExpr) return false;
+  const parentMember = callExpr.parent;
+  return parentMember !== null && parentMember !== void 0 && parentMember.type === "MemberExpression" && parentMember.property.type === "Identifier" && ARRAY_METHODS.has(parentMember.property.name);
+}
+function countChainLength(node) {
+  let length = 1;
+  let current = node;
+  while (true) {
+    const obj = current.object;
+    if (obj.type !== "CallExpression" || obj.callee.type !== "MemberExpression" || obj.callee.property.type !== "Identifier" || !ARRAY_METHODS.has(obj.callee.property.name)) {
+      break;
+    }
+    length++;
+    current = obj.callee;
+  }
+  return length;
+}
 var no_unbounded_array_chains_default = createRule7({
   name: "no-unbounded-array-chains",
   meta: {
@@ -634,30 +700,11 @@ var no_unbounded_array_chains_default = createRule7({
   create(context) {
     return {
       "CallExpression > MemberExpression.callee"(node) {
-        if (node.property.type !== "Identifier" || !ARRAY_METHODS.has(node.property.name)) {
-          return;
-        }
+        if (!isArrayMethodCall(node)) return;
+        if (isInnerChainLink(node)) return;
         const callExpr = node.parent;
-        if (callExpr.parent && callExpr.parent.type === "MemberExpression" && callExpr.parent.property.type === "Identifier" && ARRAY_METHODS.has(callExpr.parent.property.name)) {
-          return;
-        }
-        let chainLength = 1;
-        let current = node;
-        while (true) {
-          const memberExpr = current;
-          const obj = memberExpr.object;
-          if (obj.type === "CallExpression" && obj.callee.type === "MemberExpression" && obj.callee.property.type === "Identifier" && ARRAY_METHODS.has(obj.callee.property.name)) {
-            chainLength++;
-            current = obj.callee;
-          } else {
-            break;
-          }
-        }
-        if (chainLength >= 3) {
-          context.report({
-            node: callExpr,
-            messageId: "unboundedArrayChain"
-          });
+        if (countChainLength(node) >= 3) {
+          context.report({ node: callExpr, messageId: "unboundedArrayChain" });
         }
       }
     };
@@ -669,6 +716,25 @@ import { ESLintUtils as ESLintUtils8, AST_NODE_TYPES as AST_NODE_TYPES3 } from "
 var createRule8 = ESLintUtils8.RuleCreator(
   (name) => `https://github.com/harness-engineering/eslint-plugin/blob/main/docs/rules/${name}.md`
 );
+function extractFunctionDeclaration(node) {
+  const decl = node.declaration;
+  if (!decl || decl.type !== AST_NODE_TYPES3.FunctionDeclaration) {
+    return null;
+  }
+  const fn = decl;
+  if (!fn.id || !fn.body) return null;
+  return fn;
+}
+function isFileInBoundary(filePath, patterns) {
+  return patterns.some((pattern) => matchesPattern(filePath, pattern));
+}
+function checkBoundaryExport(node, report) {
+  const fn = extractFunctionDeclaration(node);
+  if (!fn) return;
+  if (!hasZodValidation(fn.body)) {
+    report({ node: fn, messageId: "missingSchema", data: { name: fn.id.name } });
+  }
+}
 var require_boundary_schema_default = createRule8({
   name: "require-boundary-schema",
   meta: {
@@ -688,27 +754,13 @@ var require_boundary_schema_default = createRule8({
       return {};
     }
     const filePath = normalizePath2(context.filename);
-    const isBoundaryFile = config.boundaries.requireSchema.some(
-      (pattern) => matchesPattern(filePath, pattern)
-    );
-    if (!isBoundaryFile) {
+    if (!isFileInBoundary(filePath, config.boundaries.requireSchema)) {
       return {};
     }
+    const report = context.report.bind(context);
     return {
       ExportNamedDeclaration(node) {
-        const decl = node.declaration;
-        if (!decl || decl.type !== AST_NODE_TYPES3.FunctionDeclaration) {
-          return;
-        }
-        const fn = decl;
-        if (!fn.id || !fn.body) return;
-        if (!hasZodValidation(fn.body)) {
-          context.report({
-            node: fn,
-            messageId: "missingSchema",
-            data: { name: fn.id.name }
-          });
-        }
+        checkBoundaryExport(node, report);
       }
     };
   }
@@ -724,6 +776,28 @@ var UNIX_COMMAND_PATTERN = new RegExp(
   `(?:^|[;&|]\\s*)(?:/(?:usr/)?(?:bin|sbin)/)?(?:${UNIX_COMMANDS.join("|")})(?:\\s|$)`
 );
 var FLAGGED_FUNCTIONS = /* @__PURE__ */ new Set(["exec", "execSync"]);
+function getFlaggedFunctionName(node) {
+  if (node.callee.type === "Identifier" && FLAGGED_FUNCTIONS.has(node.callee.name)) {
+    return node.callee.name;
+  }
+  if (node.callee.type === "MemberExpression" && node.callee.property.type === "Identifier" && FLAGGED_FUNCTIONS.has(node.callee.property.name)) {
+    return node.callee.property.name;
+  }
+  return void 0;
+}
+function isFlaggedCall(node) {
+  return getFlaggedFunctionName(node) !== void 0;
+}
+function extractCommandString(arg) {
+  if (!arg) return void 0;
+  if (arg.type === "Literal" && typeof arg.value === "string") {
+    return arg.value;
+  }
+  if (arg.type === "TemplateLiteral" && arg.quasis.length > 0) {
+    return arg.quasis.map((q) => q.value.raw).join(" ");
+  }
+  return void 0;
+}
 var no_unix_shell_command_default = createRule9({
   name: "no-unix-shell-command",
   meta: {
@@ -740,27 +814,10 @@ var no_unix_shell_command_default = createRule9({
   create(context) {
     return {
       CallExpression(node) {
-        let functionName;
-        if (node.callee.type === "Identifier" && FLAGGED_FUNCTIONS.has(node.callee.name)) {
-          functionName = node.callee.name;
-        }
-        if (node.callee.type === "MemberExpression" && node.callee.property.type === "Identifier" && FLAGGED_FUNCTIONS.has(node.callee.property.name)) {
-          functionName = node.callee.property.name;
-        }
-        if (!functionName) return;
-        const firstArg = node.arguments[0];
-        if (!firstArg) return;
-        let commandString;
-        if (firstArg.type === "Literal" && typeof firstArg.value === "string") {
-          commandString = firstArg.value;
-        } else if (firstArg.type === "TemplateLiteral" && firstArg.quasis.length > 0) {
-          commandString = firstArg.quasis.map((q) => q.value.raw).join(" ");
-        }
+        if (!isFlaggedCall(node)) return;
+        const commandString = extractCommandString(node.arguments[0]);
         if (commandString && UNIX_COMMAND_PATTERN.test(commandString)) {
-          context.report({
-            node,
-            messageId: "unixShellCommand"
-          });
+          context.report({ node, messageId: "unixShellCommand" });
         }
       }
     };
@@ -878,11 +935,71 @@ var no_hardcoded_path_separator_default = createRule10({
   }
 });
 
-// src/rules/require-path-normalization.ts
+// src/rules/no-process-env-in-spawn.ts
 import { ESLintUtils as ESLintUtils11 } from "@typescript-eslint/utils";
 var createRule11 = ESLintUtils11.RuleCreator(
   (name) => `https://github.com/harness-engineering/eslint-plugin/blob/main/docs/rules/${name}.md`
 );
+var SPAWN_FUNCTIONS = /* @__PURE__ */ new Set(["spawn", "spawnSync", "execFile", "execFileSync", "fork"]);
+function getSpawnFunctionName(node) {
+  if (node.callee.type === "Identifier" && SPAWN_FUNCTIONS.has(node.callee.name)) {
+    return node.callee.name;
+  }
+  if (node.callee.type === "MemberExpression" && node.callee.property.type === "Identifier" && SPAWN_FUNCTIONS.has(node.callee.property.name)) {
+    return node.callee.property.name;
+  }
+  return void 0;
+}
+function isProcessEnv(node) {
+  return node.type === "MemberExpression" && node.object.type === "Identifier" && node.object.name === "process" && node.property.type === "Identifier" && node.property.name === "env";
+}
+function hasProcessEnvProperty(node) {
+  for (const prop of node.properties) {
+    if (prop.type === "Property" && prop.key.type === "Identifier" && prop.key.name === "env" && isProcessEnv(prop.value)) {
+      return prop;
+    }
+    if (prop.type === "SpreadElement" && isProcessEnv(prop.argument)) {
+      return prop;
+    }
+  }
+  return void 0;
+}
+var no_process_env_in_spawn_default = createRule11({
+  name: "no-process-env-in-spawn",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow passing process.env directly to spawn/execFile/fork, which leaks all server-side secrets to child processes"
+    },
+    messages: {
+      processEnvInSpawn: "Do not pass process.env directly to '{{name}}'. Build an explicit env object with only the variables the child process needs."
+    },
+    schema: []
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node) {
+        const name = getSpawnFunctionName(node);
+        if (!name) return;
+        for (const arg of node.arguments) {
+          if (arg.type === "ObjectExpression") {
+            const envProp = hasProcessEnvProperty(arg);
+            if (envProp) {
+              context.report({ node: envProp, messageId: "processEnvInSpawn", data: { name } });
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/rules/require-path-normalization.ts
+import { ESLintUtils as ESLintUtils12 } from "@typescript-eslint/utils";
+var createRule12 = ESLintUtils12.RuleCreator(
+  (name) => `https://github.com/harness-engineering/eslint-plugin/blob/main/docs/rules/${name}.md`
+);
 function isRelativeCall(node) {
   const callee = node.callee;
   if (callee.type === "Identifier" && callee.name === "relative") {
@@ -908,7 +1025,7 @@ function hasNormalization(node) {
   if (grandparent?.type !== "CallExpression" || grandparent.arguments.length < 1) return false;
   return isBackslashNormalizationArg(grandparent.arguments[0]);
 }
-var require_path_normalization_default = createRule11({
+var require_path_normalization_default = createRule12({
   name: "require-path-normalization",
   meta: {
     type: "problem",
@@ -943,6 +1060,7 @@ var rules = {
   "no-hardcoded-path-separator": no_hardcoded_path_separator_default,
   "no-layer-violation": no_layer_violation_default,
   "no-nested-loops-in-critical": no_nested_loops_in_critical_default,
+  "no-process-env-in-spawn": no_process_env_in_spawn_default,
   "no-sync-io-in-async": no_sync_io_in_async_default,
   "no-unbounded-array-chains": no_unbounded_array_chains_default,
   "no-unix-shell-command": no_unix_shell_command_default,
@@ -954,7 +1072,7 @@ var rules = {
 var plugin = {
   meta: {
     name: "@harness-engineering/eslint-plugin",
-    version: "0.1.0"
+    version: "0.2.4"
   },
   rules,
   configs: {
@@ -972,6 +1090,7 @@ var plugin = {
         "@harness-engineering/enforce-doc-exports": "warn",
         "@harness-engineering/no-unix-shell-command": "warn",
         "@harness-engineering/no-hardcoded-path-separator": "warn",
+        "@harness-engineering/no-process-env-in-spawn": "error",
         "@harness-engineering/require-path-normalization": "warn"
       }
     },
@@ -989,6 +1108,7 @@ var plugin = {
         "@harness-engineering/enforce-doc-exports": "error",
         "@harness-engineering/no-unix-shell-command": "error",
         "@harness-engineering/no-hardcoded-path-separator": "error",
+        "@harness-engineering/no-process-env-in-spawn": "error",
         "@harness-engineering/require-path-normalization": "error"
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harness-engineering/eslint-plugin",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "description": "ESLint plugin for harness engineering architectural constraints",
   "type": "module",
   "main": "./dist/index.js",
@@ -16,18 +16,19 @@
     "README.md"
   ],
   "dependencies": {
-    "@typescript-eslint/utils": "^8.0.0",
-    "minimatch": "^10.2.4",
-    "zod": "^3.22.0"
+    "@typescript-eslint/utils": "^8.59.0",
+    "minimatch": "^10.2.5",
+    "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
-    "@typescript-eslint/parser": "^8.57.0",
-    "@typescript-eslint/rule-tester": "^8.0.0",
-    "eslint": "^10.0.0",
-    "tsup": "^8.0.0",
-    "typescript": "^5.3.3",
-    "vitest": "^4.0.18"
+    "@types/node": "^22.19.15",
+    "@typescript-eslint/parser": "^8.59.0",
+    "@typescript-eslint/rule-tester": "^8.59.0",
+    "@vitest/coverage-v8": "^4.1.5",
+    "eslint": "^10.2.1",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.5"
   },
   "peerDependencies": {
     "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0",
@@ -59,6 +60,7 @@
     "test:watch": "vitest",
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
-    "clean": "node ../../scripts/clean.mjs dist"
+    "clean": "node ../../scripts/clean.mjs dist",
+    "test:coverage": "vitest run --coverage"
   }
 }