@harness-engineering/eslint-plugin 0.2.4 → 0.3.1

package/dist/index.d.ts

@@ -22,6 +22,9 @@ declare const rules: {
     'no-nested-loops-in-critical': _typescript_eslint_utils_ts_eslint.RuleModule<"nestedLoopInCritical", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
+    'no-process-env-in-spawn': _typescript_eslint_utils_ts_eslint.RuleModule<"processEnvInSpawn", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
     'no-sync-io-in-async': _typescript_eslint_utils_ts_eslint.RuleModule<"syncIoInAsync", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
@@ -66,6 +69,9 @@ declare const plugin: {
         'no-nested-loops-in-critical': _typescript_eslint_utils_ts_eslint.RuleModule<"nestedLoopInCritical", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
+        'no-process-env-in-spawn': _typescript_eslint_utils_ts_eslint.RuleModule<"processEnvInSpawn", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
         'no-sync-io-in-async': _typescript_eslint_utils_ts_eslint.RuleModule<"syncIoInAsync", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
@@ -93,8 +99,12 @@ declare const plugin: {
                 '@harness-engineering/no-forbidden-imports': string;
                 '@harness-engineering/require-boundary-schema': string;
                 '@harness-engineering/enforce-doc-exports': string;
+                '@harness-engineering/no-nested-loops-in-critical': string;
+                '@harness-engineering/no-sync-io-in-async': string;
+                '@harness-engineering/no-unbounded-array-chains': string;
                 '@harness-engineering/no-unix-shell-command': string;
                 '@harness-engineering/no-hardcoded-path-separator': string;
+                '@harness-engineering/no-process-env-in-spawn': string;
                 '@harness-engineering/require-path-normalization': string;
             };
         };
@@ -108,8 +118,12 @@ declare const plugin: {
                 '@harness-engineering/no-forbidden-imports': string;
                 '@harness-engineering/require-boundary-schema': string;
                 '@harness-engineering/enforce-doc-exports': string;
+                '@harness-engineering/no-nested-loops-in-critical': string;
+                '@harness-engineering/no-sync-io-in-async': string;
+                '@harness-engineering/no-unbounded-array-chains': string;
                 '@harness-engineering/no-unix-shell-command': string;
                 '@harness-engineering/no-hardcoded-path-separator': string;
+                '@harness-engineering/no-process-env-in-spawn': string;
                 '@harness-engineering/require-path-normalization': string;
             };
         };
@@ -146,6 +160,9 @@ declare const configs: {
                     'no-nested-loops-in-critical': _typescript_eslint_utils_ts_eslint.RuleModule<"nestedLoopInCritical", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
                         name: string;
                     };
+                    'no-process-env-in-spawn': _typescript_eslint_utils_ts_eslint.RuleModule<"processEnvInSpawn", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+                        name: string;
+                    };
                     'no-sync-io-in-async': _typescript_eslint_utils_ts_eslint.RuleModule<"syncIoInAsync", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
                         name: string;
                     };
@@ -171,8 +188,12 @@ declare const configs: {
             '@harness-engineering/no-forbidden-imports': string;
             '@harness-engineering/require-boundary-schema': string;
             '@harness-engineering/enforce-doc-exports': string;
+            '@harness-engineering/no-nested-loops-in-critical': string;
+            '@harness-engineering/no-sync-io-in-async': string;
+            '@harness-engineering/no-unbounded-array-chains': string;
             '@harness-engineering/no-unix-shell-command': string;
             '@harness-engineering/no-hardcoded-path-separator': string;
+            '@harness-engineering/no-process-env-in-spawn': string;
             '@harness-engineering/require-path-normalization': string;
         };
     };
@@ -205,6 +226,9 @@ declare const configs: {
                     'no-nested-loops-in-critical': _typescript_eslint_utils_ts_eslint.RuleModule<"nestedLoopInCritical", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
                         name: string;
                     };
+                    'no-process-env-in-spawn': _typescript_eslint_utils_ts_eslint.RuleModule<"processEnvInSpawn", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+                        name: string;
+                    };
                     'no-sync-io-in-async': _typescript_eslint_utils_ts_eslint.RuleModule<"syncIoInAsync", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
                         name: string;
                     };
@@ -230,8 +254,12 @@ declare const configs: {
             '@harness-engineering/no-forbidden-imports': string;
             '@harness-engineering/require-boundary-schema': string;
             '@harness-engineering/enforce-doc-exports': string;
+            '@harness-engineering/no-nested-loops-in-critical': string;
+            '@harness-engineering/no-sync-io-in-async': string;
+            '@harness-engineering/no-unbounded-array-chains': string;
             '@harness-engineering/no-unix-shell-command': string;
             '@harness-engineering/no-hardcoded-path-separator': string;
+            '@harness-engineering/no-process-env-in-spawn': string;
             '@harness-engineering/require-path-normalization': string;
         };
     };

package/dist/index.js

@@ -308,17 +308,27 @@ function getConfig(filePath) {
     return null;
   }
 }
+function getConfigRoot(filePath) {
+  const configPath = findConfigFile(path2.dirname(filePath));
+  return configPath ? path2.dirname(configPath) : null;
+}
 
 // src/utils/path-utils.ts
 import * as path3 from "path";
 import { minimatch } from "minimatch";
-function resolveImportPath(importPath, importingFile) {
+function resolveImportPath(importPath, importingFile, projectRoot) {
   if (!importPath.startsWith(".")) {
     return importPath;
   }
   const importingDir = path3.dirname(importingFile);
   const resolved = path3.resolve(importingDir, importPath);
   const normalized = resolved.replace(/\\/g, "/");
+  if (projectRoot) {
+    const root = projectRoot.replace(/\\/g, "/").replace(/\/$/, "");
+    if (normalized.startsWith(root + "/")) {
+      return normalized.slice(root.length + 1);
+    }
+  }
   const srcIndex = normalized.indexOf("/src/");
   if (srcIndex !== -1) {
     return normalized.slice(srcIndex + 1);
@@ -341,8 +351,14 @@ function getLayerForFile(filePath, layers) {
 function getLayerByName(name, layers) {
   return layers.find((l) => l.name === name);
 }
-function normalizePath2(filePath) {
+function normalizePath2(filePath, projectRoot) {
   const normalized = filePath.replace(/\\/g, "/");
+  if (projectRoot) {
+    const root = projectRoot.replace(/\\/g, "/").replace(/\/$/, "");
+    if (normalized.startsWith(root + "/")) {
+      return normalized.slice(root.length + 1);
+    }
+  }
   const srcIndex = normalized.indexOf("/src/");
   if (srcIndex !== -1) {
     return normalized.slice(srcIndex + 1);
@@ -370,9 +386,9 @@ function findViolatedRule(applicableRules, importPath, resolvedImport) {
 function buildForbiddenMessage(rule, importPath) {
   return rule.message ?? `Import "${importPath}" is forbidden in files matching "${rule.from}"`;
 }
-function checkImportDeclaration2(node, applicableRules, filename, report) {
+function checkImportDeclaration2(node, applicableRules, filename, projectRoot, report) {
   const importPath = node.source.value;
-  const resolvedImport = resolveImportPath(importPath, filename);
+  const resolvedImport = resolveImportPath(importPath, filename, projectRoot ?? void 0);
   const violatedRule = findViolatedRule(applicableRules, importPath, resolvedImport);
   if (violatedRule) {
     report({
@@ -400,7 +416,8 @@ var no_forbidden_imports_default = createRule3({
     if (!config?.forbiddenImports?.length) {
       return {};
     }
-    const filePath = normalizePath2(context.filename);
+    const projectRoot = getConfigRoot(context.filename);
+    const filePath = normalizePath2(context.filename, projectRoot ?? void 0);
     const applicableRules = config.forbiddenImports.filter(
       (rule) => matchesPattern(filePath, rule.from)
     );
@@ -410,7 +427,7 @@ var no_forbidden_imports_default = createRule3({
     const report = context.report.bind(context);
     return {
       ImportDeclaration(node) {
-        checkImportDeclaration2(node, applicableRules, context.filename, report);
+        checkImportDeclaration2(node, applicableRules, context.filename, projectRoot, report);
       }
     };
   }
@@ -424,13 +441,13 @@ var createRule4 = ESLintUtils4.RuleCreator(
 function isLayerViolation(importLayer, currentLayer, currentLayerDef) {
   return importLayer !== currentLayer && !currentLayerDef.allowedDependencies.includes(importLayer);
 }
-function resolveImportLayer(importPath, filename, layers) {
+function resolveImportLayer(importPath, filename, layers, projectRoot) {
   if (!importPath.startsWith(".")) return null;
-  const resolvedImport = resolveImportPath(importPath, filename);
+  const resolvedImport = resolveImportPath(importPath, filename, projectRoot ?? void 0);
   return getLayerForFile(resolvedImport, layers) ?? null;
 }
-function checkLayerImport(node, context, currentLayer, currentLayerDef, layers) {
-  const importLayer = resolveImportLayer(node.source.value, context.filename, layers);
+function checkLayerImport(node, context, currentLayer, currentLayerDef, layers, projectRoot) {
+  const importLayer = resolveImportLayer(node.source.value, context.filename, layers, projectRoot);
   if (!importLayer) return;
   if (isLayerViolation(importLayer, currentLayer, currentLayerDef)) {
     context.report({
@@ -458,7 +475,8 @@ var no_layer_violation_default = createRule4({
     if (!config?.layers?.length) {
       return {};
     }
-    const filePath = normalizePath2(context.filename);
+    const projectRoot = getConfigRoot(context.filename);
+    const filePath = normalizePath2(context.filename, projectRoot ?? void 0);
     const currentLayer = getLayerForFile(filePath, config.layers);
     if (!currentLayer) {
       return {};
@@ -470,7 +488,7 @@ var no_layer_violation_default = createRule4({
     const layers = config.layers;
     return {
       ImportDeclaration(node) {
-        checkLayerImport(node, context, currentLayer, currentLayerDef, layers);
+        checkLayerImport(node, context, currentLayer, currentLayerDef, layers, projectRoot);
       }
     };
   }
@@ -935,11 +953,74 @@ var no_hardcoded_path_separator_default = createRule10({
   }
 });
 
-// src/rules/require-path-normalization.ts
+// src/rules/no-process-env-in-spawn.ts
 import { ESLintUtils as ESLintUtils11 } from "@typescript-eslint/utils";
 var createRule11 = ESLintUtils11.RuleCreator(
   (name) => `https://github.com/harness-engineering/eslint-plugin/blob/main/docs/rules/${name}.md`
 );
+var SPAWN_FUNCTIONS = /* @__PURE__ */ new Set(["spawn", "spawnSync", "execFile", "execFileSync", "fork"]);
+function getSpawnFunctionName(node) {
+  if (node.callee.type === "Identifier" && SPAWN_FUNCTIONS.has(node.callee.name)) {
+    return node.callee.name;
+  }
+  if (node.callee.type === "MemberExpression" && node.callee.property.type === "Identifier" && SPAWN_FUNCTIONS.has(node.callee.property.name)) {
+    return node.callee.property.name;
+  }
+  return void 0;
+}
+function isProcessEnv(node) {
+  return node.type === "MemberExpression" && node.object.type === "Identifier" && node.object.name === "process" && node.property.type === "Identifier" && node.property.name === "env";
+}
+function hasProcessEnvProperty(node) {
+  for (const prop of node.properties) {
+    if (prop.type === "Property" && prop.key.type === "Identifier" && prop.key.name === "env" && isProcessEnv(prop.value)) {
+      return prop;
+    }
+    if (prop.type === "SpreadElement" && isProcessEnv(prop.argument)) {
+      return prop;
+    }
+  }
+  return void 0;
+}
+function findEnvViolation(args) {
+  for (const arg of args) {
+    if (arg.type !== "ObjectExpression") continue;
+    const envProp = hasProcessEnvProperty(arg);
+    if (envProp) return envProp;
+  }
+  return void 0;
+}
+var no_process_env_in_spawn_default = createRule11({
+  name: "no-process-env-in-spawn",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow passing process.env directly to spawn/execFile/fork, which leaks all server-side secrets to child processes"
+    },
+    messages: {
+      processEnvInSpawn: "Do not pass process.env directly to '{{name}}'. Build an explicit env object with only the variables the child process needs."
+    },
+    schema: []
+  },
+  defaultOptions: [],
+  create(context) {
+    function checkCall(node) {
+      const name = getSpawnFunctionName(node);
+      if (!name) return;
+      const violation = findEnvViolation(node.arguments);
+      if (violation) {
+        context.report({ node: violation, messageId: "processEnvInSpawn", data: { name } });
+      }
+    }
+    return { CallExpression: checkCall };
+  }
+});
+
+// src/rules/require-path-normalization.ts
+import { ESLintUtils as ESLintUtils12 } from "@typescript-eslint/utils";
+var createRule12 = ESLintUtils12.RuleCreator(
+  (name) => `https://github.com/harness-engineering/eslint-plugin/blob/main/docs/rules/${name}.md`
+);
 function isRelativeCall(node) {
   const callee = node.callee;
   if (callee.type === "Identifier" && callee.name === "relative") {
@@ -965,7 +1046,7 @@ function hasNormalization(node) {
   if (grandparent?.type !== "CallExpression" || grandparent.arguments.length < 1) return false;
   return isBackslashNormalizationArg(grandparent.arguments[0]);
 }
-var require_path_normalization_default = createRule11({
+var require_path_normalization_default = createRule12({
   name: "require-path-normalization",
   meta: {
     type: "problem",
@@ -1000,6 +1081,7 @@ var rules = {
   "no-hardcoded-path-separator": no_hardcoded_path_separator_default,
   "no-layer-violation": no_layer_violation_default,
   "no-nested-loops-in-critical": no_nested_loops_in_critical_default,
+  "no-process-env-in-spawn": no_process_env_in_spawn_default,
   "no-sync-io-in-async": no_sync_io_in_async_default,
   "no-unbounded-array-chains": no_unbounded_array_chains_default,
   "no-unix-shell-command": no_unix_shell_command_default,
@@ -1011,7 +1093,7 @@ var rules = {
 var plugin = {
   meta: {
     name: "@harness-engineering/eslint-plugin",
-    version: "0.2.4"
+    version: "0.3.0"
   },
   rules,
   configs: {
@@ -1027,8 +1109,12 @@ var plugin = {
         "@harness-engineering/no-forbidden-imports": "error",
         "@harness-engineering/require-boundary-schema": "warn",
         "@harness-engineering/enforce-doc-exports": "warn",
+        "@harness-engineering/no-nested-loops-in-critical": "warn",
+        "@harness-engineering/no-sync-io-in-async": "warn",
+        "@harness-engineering/no-unbounded-array-chains": "warn",
         "@harness-engineering/no-unix-shell-command": "warn",
         "@harness-engineering/no-hardcoded-path-separator": "warn",
+        "@harness-engineering/no-process-env-in-spawn": "error",
         "@harness-engineering/require-path-normalization": "warn"
       }
     },
@@ -1044,8 +1130,12 @@ var plugin = {
         "@harness-engineering/no-forbidden-imports": "error",
         "@harness-engineering/require-boundary-schema": "error",
         "@harness-engineering/enforce-doc-exports": "error",
+        "@harness-engineering/no-nested-loops-in-critical": "error",
+        "@harness-engineering/no-sync-io-in-async": "error",
+        "@harness-engineering/no-unbounded-array-chains": "error",
         "@harness-engineering/no-unix-shell-command": "error",
         "@harness-engineering/no-hardcoded-path-separator": "error",
+        "@harness-engineering/no-process-env-in-spawn": "error",
         "@harness-engineering/require-path-normalization": "error"
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harness-engineering/eslint-plugin",
-  "version": "0.2.4",
+  "version": "0.3.1",
   "description": "ESLint plugin for harness engineering architectural constraints",
   "type": "module",
   "main": "./dist/index.js",
@@ -16,19 +16,19 @@
     "README.md"
   ],
   "dependencies": {
-    "@typescript-eslint/utils": "^8.58.0",
+    "@typescript-eslint/utils": "^8.59.0",
     "minimatch": "^10.2.5",
     "zod": "^3.25.76"
   },
   "devDependencies": {
     "@types/node": "^22.19.15",
-    "@typescript-eslint/parser": "^8.58.0",
-    "@typescript-eslint/rule-tester": "^8.58.0",
-    "@vitest/coverage-v8": "^4.1.2",
-    "eslint": "^10.1.0",
+    "@typescript-eslint/parser": "^8.59.0",
+    "@typescript-eslint/rule-tester": "^8.59.0",
+    "@vitest/coverage-v8": "^4.1.5",
+    "eslint": "^10.2.1",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.2"
+    "vitest": "^4.1.5"
   },
   "peerDependencies": {
     "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0",