@pyreon/lint 0.12.9 → 0.12.11

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index2.d.ts","names":[],"sources":["../../../src/types.ts","../../../src/utils/source.ts","../../../src/cache.ts","../../../src/config/ignore.ts","../../../src/config/loader.ts","../../../src/config/presets.ts","../../../src/lint.ts","../../../src/reporter.ts","../../../src/lsp/index.ts","../../../src/rules/index.ts","../../../src/runner.ts","../../../src/utils/imports.ts","../../../src/watcher.ts"],"mappings":";KAEY,QAAA;AAAA,UAEK,cAAA;EACf,IAAA;EACA,MAAA;AAAA;AAAA,UAGe,IAAA;EACf,KAAA;EACA,GAAA;AAAA;AAAA,UAGe,GAAA;EACf,IAAA,EAAM,IAAA;EACN,WAAA;AAAA;AAAA,UAGe,UAAA;EACf,MAAA;EACA,QAAA,EAAU,QAAA;EACV,OAAA;EACA,IAAA,EAAM,IAAA;EACN,GAAA,EAAK,cAAA;EACL,GAAA,GAAM,GAAA;AAAA;AAAA,KAKI,YAAA;AAAA,UAcK,QAAA;EACf,EAAA;EACA,QAAA,EAAU,YAAA;EACV,WAAA;EACA,QAAA,EAAU,QAAA;EACV,OAAA;AAAA;AAAA,UAKe,WAAA;EACf,MAAA,CAAO,UAAA,EAAY,IAAA,CAAK,UAAA;EACxB,aAAA;EACA,WAAA;AAAA;AAAA,KAGU,eAAA,IAAmB,IAAA,OAAW,MAAA;AAAA,UAEzB,gBAAA;EAAA,CACd,QAAA,WAAmB,eAAA;AAAA;AAAA,UAKL,IAAA;EACf,IAAA,EAAM,QAAA;EACN,MAAA,CAAO,OAAA,EAAS,WAAA,GAAc,gBAAA;AAAA;AAAA,UAKf,UAAA;EACf,KAAA,EAAO,MAAA,SAAe,QAAA;EACtB,OAAA;EACA,OAAA;AAAA;AAAA,UAGe,cAAA;EACf,MAAA,GAAS,UAAA;EACT,KAAA,GAAQ,MAAA,SAAe,QAAA;EACvB,OAAA;EACA,OAAA;AAAA;AAAA,KAGU,UAAA;AAAA,UAIK,cAAA;EACf,QAAA;EACA,WAAA,EAAa,UAAA;EACb,WAAA;AAAA;AAAA,UAGe,UAAA;EACf,KAAA,EAAO,cAAA;EACP,WAAA;EACA,aAAA;EACA,UAAA;AAAA;AAAA,UAKe,WAAA;EACf,KAAA;EACA,MAAA,GAAS,UAAA;EACT,GAAA;EACA,KAAA;EACA,aAAA,GAAgB,MAAA,SAAe,QAAA;EAC/B,MAAA;EACA,MAAA;AAAA;AAAA,UAKe,UAAA;EACf,MAAA;EACA,UAAA,EAAY,KAAA;IAAQ,QAAA;IAAkB,KAAA;EAAA;EACtC,SAAA;EACA,WAAA;AAAA;;;AAzHF;;;AAAA,cCGa,SAAA;EAAA,QACH,UAAA;cAEI,UAAA;EDJiB;ECc7B,MAAA,CAAO,MAAA,WAAiB,cAAA;AAAA;;;ADhB1B;;;;;AAEA;;;;;AAKA;;;;;AAKA;;;AAZA,cEkBa,QAAA;EAAA,QACH,KAAA;EAER,GAAA,CAAI,UAAA;IAAuB,OAAA;IAAc,SAAA,EAAW,SAAA;EAAA;EAKpD,GAAA,CAAI,UAAA,UAAoB,KAAA;IAAS,OAAA;IAAc,SAAA,EAAW,SAAA;EAAA;EAK1D,KAAA,CAAA;EAAA,IAII,IAAA,CAAA;AAAA;;;;AFnCN;;;;;AAEA;;;;;AAKA;;iBGOgB,kBAAA,CACd,GAAA,UACA,WAAA,yBACE,QAAA;;;AHjBJ;;;;;AAEA;;;;;AAKA;;;;;AAKA;;AAZA,iBIqBgB,UAAA,CAAW,GAAA,WAAc,cAAA;;;;iBAmCzB,kBAAA,CAAmB,QAAA,WAAmB,cAAA;;;iBCDtC,SAAA,CAAU,IAAA,EAAM,UAAA,GAAa,UAAA;;;ALvD7C;;;;;AAEA;;;;;AAKA;AAPA,iBM0KgB,IAAA,CAAK,OAAA,EAAS,WAAA,GAAc,UAAA;;;;AN9J5C;;;;;;;;;iBM2MgB,SAAA,CAAA,GAAa,QAAA;;;ANvN7B;;;AAAA,iBOyBgB,UAAA,CAAW,MAAA,EAAQ,UAAA;;APvBnC;;iBO6DgB,UAAA,CAAW,MAAA,EAAQ,UAAA;;;APxDnC;iBO+DgB,aAAA,CAAc,MAAA,EAAQ,UAAA;;;;APtEtC;;;;;AAEA;;;;;AAKA;;;;;AAKA;;;;;;iBQ6KgB,cAAA,CAAA;;;cCpHH,QAAA,EAAU,IAAA;;;;;;;ATnEvB;;;;;iBUwFgB,QAAA,CACd,QAAA,UACA,UAAA,UACA,KAAA,EAAO,IAAA,IACP,MAAA,EAAQ,UAAA,EACR,KAAA,GAAQ,QAAA,eACP,cAAA;;;;;iBA+Da,UAAA,CAAW,UAAA,UAAoB,WAAA,EAAa,UAAA;;;iBC/F5C,cAAA,CAAe,MAAA;AAAA,iBAIf,eAAA,CAAgB,MAAA;AAAA,iBAIhB,iBAAA,CAAkB,IAAA,QAAY,UAAA;AAAA,iBA2B9B,WAAA,CAAY,OAAA,EAAS,UAAA,IAAc,IAAA,UAAc,WAAA;AAAA,iBAQjD,YAAA,CACd,OAAA,EAAS,UAAA,IACT,IAAA,UACA,WAAA;;;AX9GF;;;;;AAEA;;;;;AAKA;;;AAPA,iBY4BgB,YAAA,CAAa,OAAA,EAAS,WAAA;EAAgB,MAAA;AAAA"}
+{"version":3,"file":"index2.d.ts","names":[],"sources":["../../../src/types.ts","../../../src/utils/source.ts","../../../src/cache.ts","../../../src/config/ignore.ts","../../../src/config/loader.ts","../../../src/config/presets.ts","../../../src/lint.ts","../../../src/reporter.ts","../../../src/lsp/index.ts","../../../src/rules/index.ts","../../../src/runner.ts","../../../src/utils/imports.ts","../../../src/watcher.ts"],"mappings":";KAEY,QAAA;AAAA,UAEK,cAAA;EACf,IAAA;EACA,MAAA;AAAA;AAAA,UAGe,IAAA;EACf,KAAA;EACA,GAAA;AAAA;AAAA,UAGe,GAAA;EACf,IAAA,EAAM,IAAA;EACN,WAAA;AAAA;AAAA,UAGe,UAAA;EACf,MAAA;EACA,QAAA,EAAU,QAAA;EACV,OAAA;EACA,IAAA,EAAM,IAAA;EACN,GAAA,EAAK,cAAA;EACL,GAAA,GAAM,GAAA;AAAA;AAAA,KAKI,YAAA;AAAA,UAcK,QAAA;EACf,EAAA;EACA,QAAA,EAAU,YAAA;EACV,WAAA;EACA,QAAA,EAAU,QAAA;EACV,OAAA;AAAA;AAAA,UAKe,WAAA;EACf,MAAA,CAAO,UAAA,EAAY,IAAA,CAAK,UAAA;EACxB,aAAA;EACA,WAAA;AAAA;AAAA,KAGU,eAAA,IAAmB,IAAA,OAAW,MAAA;AAAA,UAEzB,gBAAA;EAAA,CACd,QAAA,WAAmB,eAAA;AAAA;AAAA,UAKL,IAAA;EACf,IAAA,EAAM,QAAA;EACN,MAAA,CAAO,OAAA,EAAS,WAAA,GAAc,gBAAA;AAAA;AAAA,UAKf,UAAA;EACf,KAAA,EAAO,MAAA,SAAe,QAAA;EACtB,OAAA;EACA,OAAA;AAAA;AAAA,UAGe,cAAA;EACf,MAAA,GAAS,UAAA;EACT,KAAA,GAAQ,MAAA,SAAe,QAAA;EACvB,OAAA;EACA,OAAA;AAAA;AAAA,KAGU,UAAA;AAAA,UAIK,cAAA;EACf,QAAA;EACA,WAAA,EAAa,UAAA;EACb,WAAA;AAAA;AAAA,UAGe,UAAA;EACf,KAAA,EAAO,cAAA;EACP,WAAA;EACA,aAAA;EACA,UAAA;AAAA;AAAA,UAKe,WAAA;EACf,KAAA;EACA,MAAA,GAAS,UAAA;EACT,GAAA;EACA,KAAA;EACA,aAAA,GAAgB,MAAA,SAAe,QAAA;EAC/B,MAAA;EACA,MAAA;AAAA;AAAA,UAKe,UAAA;EACf,MAAA;EACA,UAAA,EAAY,KAAA;IAAQ,QAAA;IAAkB,KAAA;EAAA;EACtC,SAAA;EACA,WAAA;AAAA;;;AAzHF;;;AAAA,cCGa,SAAA;EAAA,QACH,UAAA;cAEI,UAAA;EDJiB;ECc7B,MAAA,CAAO,MAAA,WAAiB,cAAA;AAAA;;;ADhB1B;;;;;AAEA;;;;;AAKA;;;;;AAKA;;;AAZA,cEkBa,QAAA;EAAA,QACH,KAAA;EAER,GAAA,CAAI,UAAA;IAAuB,OAAA;IAAc,SAAA,EAAW,SAAA;EAAA;EAKpD,GAAA,CAAI,UAAA,UAAoB,KAAA;IAAS,OAAA;IAAc,SAAA,EAAW,SAAA;EAAA;EAK1D,KAAA,CAAA;EAAA,IAII,IAAA,CAAA;AAAA;;;;AFnCN;;;;;AAEA;;;;;AAKA;;iBGOgB,kBAAA,CACd,GAAA,UACA,WAAA,yBACE,QAAA;;;AHjBJ;;;;;AAEA;;;;;AAKA;;;;;AAKA;;AAZA,iBIqBgB,UAAA,CAAW,GAAA,WAAc,cAAA;;;;iBAmCzB,kBAAA,CAAmB,QAAA,WAAmB,cAAA;;;iBCGtC,SAAA,CAAU,IAAA,EAAM,UAAA,GAAa,UAAA;;;AL3D7C;;;;;AAEA;;;;;AAKA;AAPA,iBM0KgB,IAAA,CAAK,OAAA,EAAS,WAAA,GAAc,UAAA;;;;AN9J5C;;;;;;;;;iBM2MgB,SAAA,CAAA,GAAa,QAAA;;;ANvN7B;;;AAAA,iBOyBgB,UAAA,CAAW,MAAA,EAAQ,UAAA;;APvBnC;;iBO6DgB,UAAA,CAAW,MAAA,EAAQ,UAAA;;;APxDnC;iBO+DgB,aAAA,CAAc,MAAA,EAAQ,UAAA;;;;APtEtC;;;;;AAEA;;;;;AAKA;;;;;AAKA;;;;;;iBQ6KgB,cAAA,CAAA;;;cCnHH,QAAA,EAAU,IAAA;;;;;;;ATpEvB;;;;;iBUwFgB,QAAA,CACd,QAAA,UACA,UAAA,UACA,KAAA,EAAO,IAAA,IACP,MAAA,EAAQ,UAAA,EACR,KAAA,GAAQ,QAAA,eACP,cAAA;;;;;iBA+Da,UAAA,CAAW,UAAA,UAAoB,WAAA,EAAa,UAAA;;;iBC/F5C,cAAA,CAAe,MAAA;AAAA,iBAIf,eAAA,CAAgB,MAAA;AAAA,iBAIhB,iBAAA,CAAkB,IAAA,QAAY,UAAA;AAAA,iBA2B9B,WAAA,CAAY,OAAA,EAAS,UAAA,IAAc,IAAA,UAAc,WAAA;AAAA,iBAQjD,YAAA,CACd,OAAA,EAAS,UAAA,IACT,IAAA,UACA,WAAA;;;AX9GF;;;;;AAEA;;;;;AAKA;;;AAPA,iBY4BgB,YAAA,CAAa,OAAA,EAAS,WAAA;EAAgB,MAAA;AAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pyreon/lint",
-  "version": "0.12.9",
+  "version": "0.12.11",
   "description": "Pyreon-specific linter — 56 rules for signals, JSX, SSR, performance, router, and architecture",
   "homepage": "https://github.com/pyreon/pyreon/tree/main/packages/lint#readme",
   "bugs": {

package/src/config/presets.ts

@@ -30,6 +30,9 @@ function buildApp(): LintConfig {
       'pyreon/no-error-without-prefix': 'off',
       'pyreon/no-circular-import': 'off',
       'pyreon/no-cross-layer-import': 'off',
+      // `no-process-dev-gate` stays ON in `app` preset because the bug
+      // hits user-facing browser code regardless of whether it's a lib
+      // or an app.
     },
   }
 }
@@ -44,6 +47,7 @@ function buildLib(): LintConfig {
       'pyreon/no-cross-layer-import': 'error',
       'pyreon/dev-guard-warnings': 'error',
       'pyreon/no-error-without-prefix': 'error',
+      'pyreon/no-process-dev-gate': 'error',
     },
   }
 }

package/src/rules/architecture/no-process-dev-gate.ts

@@ -0,0 +1,183 @@
+import type { Rule, VisitorCallbacks } from '../../types'
+import { getSpan } from '../../utils/ast'
+
+/**
+ * `pyreon/no-process-dev-gate` — flag the broken `typeof process` dev-mode gate
+ * pattern that is dead code in real Vite browser bundles.
+ *
+ * The pattern this rule catches:
+ *
+ * ```ts
+ * const __DEV__ = typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'
+ * ```
+ *
+ * This works in vitest (Node, `process` is defined) but is **silently dead
+ * code in real Vite browser bundles** because Vite does not polyfill
+ * `process` for the client. Every dev warning gated on this constant never
+ * fires for real users in dev mode.
+ *
+ * The fix is to use `import.meta.env.DEV`, which Vite/Rolldown literal-replace
+ * at build time:
+ *
+ * ```ts
+ * // No const needed — read directly at the use site so the bundler can fold:
+ * if (!import.meta.env?.DEV) return
+ * ```
+ *
+ * Vitest sets `import.meta.env.DEV === true` automatically (because it is
+ * Vite-based), so existing tests continue to pass.
+ *
+ * Reference implementation: `packages/fundamentals/flow/src/layout.ts:warnIgnoredOptions`.
+ *
+ * **Auto-fix**: replaces the assignment with `import.meta.env?.DEV === true`.
+ * Does NOT delete the const declaration — that has to happen by hand because
+ * the variable name and downstream usages may need updating in callers.
+ *
+ * **Server-package exception**: server-only files run in Node where `process`
+ * is always defined, so the pattern is correct there. The rule skips files
+ * matching `packages/zero/`, `packages/core/server/`, `packages/core/runtime-server/`,
+ * `packages/tools/vite-plugin/`, and any file containing `/server/` in its
+ * path. Add new server packages to `SERVER_PACKAGE_PATTERNS` below.
+ */
+/**
+ * File-path patterns for server-only packages. Substring match against the
+ * file path passed to the rule. Patterns intentionally do NOT start with `/`
+ * so they match both absolute paths (`/Users/.../packages/zero/...`) and
+ * relative paths (`packages/zero/...`) — different lint runners pass paths
+ * differently.
+ */
+const SERVER_PACKAGE_PATTERNS = [
+  'packages/zero/',
+  'packages/core/server/',
+  'packages/core/runtime-server/',
+  'packages/tools/vite-plugin/',
+  'packages/tools/cli/',
+  'packages/tools/lint/',
+  'packages/tools/mcp/',
+  'packages/tools/storybook/',
+  'packages/tools/typescript/',
+  'scripts/',
+]
+
+function isServerOnlyFile(filePath: string): boolean {
+  return SERVER_PACKAGE_PATTERNS.some((pat) => filePath.includes(pat))
+}
+
+export const noProcessDevGate: Rule = {
+  meta: {
+    id: 'pyreon/no-process-dev-gate',
+    category: 'architecture',
+    description:
+      'Forbid `typeof process !== "undefined" && process.env.NODE_ENV !== "production"` as a dev-mode gate. Use `import.meta.env.DEV` instead — `typeof process` is dead code in real Vite browser bundles because Vite does not polyfill `process` for the client.',
+    severity: 'error',
+    fixable: true,
+  },
+  create(context) {
+    const filePath = context.getFilePath()
+
+    // Skip test files — vitest has `process`, the gate works there, and
+    // tests are not shipped to users.
+    if (
+      filePath.includes('/tests/') ||
+      filePath.includes('/test/') ||
+      filePath.includes('/__tests__/') ||
+      filePath.includes('.test.') ||
+      filePath.includes('.spec.')
+    ) {
+      return {}
+    }
+
+    // Skip server-only packages — they run in Node where `process` is
+    // always defined, so the pattern is correct there.
+    if (isServerOnlyFile(filePath)) {
+      return {}
+    }
+
+    /**
+     * Match the broken pattern at the AST level. We're looking for any
+     * `LogicalExpression` whose two sides are:
+     *
+     *   1. `typeof process !== 'undefined'` (a UnaryExpression on the LHS
+     *      of a BinaryExpression with operator `!==`)
+     *   2. `process.env.NODE_ENV !== 'production'` (a MemberExpression on
+     *      the LHS of a BinaryExpression with operator `!==`)
+     *
+     * The order can be either way (process check first or NODE_ENV check
+     * first), and the operator can be `&&` or `||` (we only flag `&&`
+     * because `||` doesn't make sense as a dev gate).
+     */
+    function isTypeofProcessCheck(node: any): boolean {
+      // typeof process !== 'undefined'
+      if (node?.type !== 'BinaryExpression') return false
+      if (node.operator !== '!==' && node.operator !== '!=') return false
+      const left = node.left
+      const right = node.right
+      if (left?.type !== 'UnaryExpression' || left.operator !== 'typeof') return false
+      if (left.argument?.type !== 'Identifier' || left.argument.name !== 'process') return false
+      if (
+        (right?.type === 'Literal' || right?.type === 'StringLiteral') &&
+        right.value === 'undefined'
+      ) {
+        return true
+      }
+      return false
+    }
+
+    function isNodeEnvCheck(node: any): boolean {
+      // process.env.NODE_ENV !== 'production'
+      if (node?.type !== 'BinaryExpression') return false
+      if (node.operator !== '!==' && node.operator !== '!=') return false
+      const left = node.left
+      const right = node.right
+      if (left?.type !== 'MemberExpression') return false
+      if (left.object?.type !== 'MemberExpression') return false
+      if (left.object.object?.type !== 'Identifier' || left.object.object.name !== 'process') {
+        return false
+      }
+      if (left.object.property?.type !== 'Identifier' || left.object.property.name !== 'env') {
+        return false
+      }
+      if (left.property?.type !== 'Identifier' || left.property.name !== 'NODE_ENV') return false
+      if (
+        (right?.type === 'Literal' || right?.type === 'StringLiteral') &&
+        right.value === 'production'
+      ) {
+        return true
+      }
+      return false
+    }
+
+    function isBrokenDevGate(node: any): boolean {
+      if (node?.type !== 'LogicalExpression') return false
+      if (node.operator !== '&&') return false
+      // Order can be (typeof process) && (NODE_ENV) OR vice versa
+      return (
+        (isTypeofProcessCheck(node.left) && isNodeEnvCheck(node.right)) ||
+        (isNodeEnvCheck(node.left) && isTypeofProcessCheck(node.right))
+      )
+    }
+
+    const callbacks: VisitorCallbacks = {
+      LogicalExpression(node: any) {
+        if (!isBrokenDevGate(node)) return
+
+        const span = getSpan(node)
+        // Auto-fix: replace the entire `typeof process ... && process.env.NODE_ENV ...`
+        // expression with `import.meta.env?.DEV === true`. We use optional
+        // chaining + strict equality so the expression is `false` (not
+        // `undefined`) when `import.meta.env` is missing — preserving the
+        // boolean shape callers expect.
+        const replacement = 'import.meta.env?.DEV === true'
+
+        context.report({
+          message:
+            '`typeof process !== "undefined" && process.env.NODE_ENV !== "production"` is dead code in real Vite browser bundles — Vite does not polyfill `process`, so this guard is `false` and any wrapped dev warnings never fire for real users. Use `import.meta.env.DEV` instead, which Vite literal-replaces at build time and tree-shakes correctly in prod. Reference implementation: `packages/fundamentals/flow/src/layout.ts:warnIgnoredOptions`.',
+          span,
+          fix: { span, replacement },
+        })
+      },
+    }
+
+    return callbacks
+  },
+}

package/src/rules/index.ts

@@ -9,6 +9,7 @@ import { noCircularImport } from './architecture/no-circular-import'
 import { noCrossLayerImport } from './architecture/no-cross-layer-import'
 import { noDeepImport } from './architecture/no-deep-import'
 import { noErrorWithoutPrefix } from './architecture/no-error-without-prefix'
+import { noProcessDevGate } from './architecture/no-process-dev-gate'
 import { noSubmitWithoutValidation } from './form/no-submit-without-validation'
 // Form
 import { noUnregisteredField } from './form/no-unregistered-field'
@@ -107,12 +108,13 @@ export const allRules: Rule[] = [
   noWindowInSsr,
   noMismatchRisk,
   preferRequestContext,
-  // Architecture (5)
+  // Architecture (6)
   noCircularImport,
   noDeepImport,
   noCrossLayerImport,
   devGuardWarnings,
   noErrorWithoutPrefix,
+  noProcessDevGate,
   // Store (3)
   noStoreOutsideProvider,
   noMutateStoreState,
@@ -183,6 +185,7 @@ export {
   noNestedEffect,
   noOnChange,
   noPeekInTracked,
+  noProcessDevGate,
   noPropsDestructure,
   // Hooks
   noRawAddEventListener,

package/src/tests/runner.test.ts

@@ -36,8 +36,8 @@ function lintWith(ruleId: string, source: string, filePath?: string) {
 // ── Rule Metadata ───────────────────────────────────────────────────────────
 
 describe('Rule metadata', () => {
-  it('should have 56 rules', () => {
-    expect(allRules.length).toBe(57)
+  it('should have 58 rules', () => {
+    expect(allRules.length).toBe(58)
   })
 
   it('should have unique rule IDs', () => {
@@ -82,7 +82,7 @@ describe('Rule metadata', () => {
     expect(counts.lifecycle).toBe(4)
     expect(counts.performance).toBe(4)
     expect(counts.ssr).toBe(3)
-    expect(counts.architecture).toBe(5)
+    expect(counts.architecture).toBe(6)
     expect(counts.store).toBe(3)
     expect(counts.form).toBe(3)
     expect(counts.styling).toBe(4)
@@ -616,6 +616,266 @@ describe('Architecture rules', () => {
     expect(diags.length).toBe(0)
   })
 
+  // ── pyreon/no-process-dev-gate ────────────────────────────────────────────
+  // The recurring browser-dead-code bug we fixed in PR #200. Tests cover:
+  //   - the canonical broken pattern (typeof process first, NODE_ENV second)
+  //   - the reversed pattern (NODE_ENV first, typeof process second)
+  //   - assignment context (const __DEV__ = ...) and inline use
+  //   - the auto-fix output is the import.meta.env.DEV form
+  //   - server packages are exempt (the pattern is correct in Node)
+  //   - test files are exempt
+  //   - the correct pattern (import.meta.env.DEV) does NOT trigger the rule
+
+  it('pyreon/no-process-dev-gate: flags the canonical broken __DEV__ assignment', () => {
+    const source = `const __DEV__ = typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'`
+    const result = lintFile(
+      'packages/core/runtime-dom/src/transition.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.fix).toBeDefined()
+    expect(diags[0]?.fix?.replacement).toBe('import.meta.env?.DEV === true')
+  })
+
+  it('pyreon/no-process-dev-gate: flags the reversed pattern (NODE_ENV first)', () => {
+    const source = `const __DEV__ = process.env.NODE_ENV !== 'production' && typeof process !== 'undefined'`
+    const result = lintFile(
+      'packages/core/runtime-dom/src/transition.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(1)
+  })
+
+  it('pyreon/no-process-dev-gate: flags inline use, not just assignment', () => {
+    // The pattern should be caught wherever it appears, not just in
+    // const declarations.
+    const source = `if (typeof process !== 'undefined' && process.env.NODE_ENV !== 'production') { console.warn('hi') }`
+    const result = lintFile(
+      'packages/core/runtime-dom/src/transition.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(1)
+  })
+
+  it('pyreon/no-process-dev-gate: clean for the correct import.meta.env.DEV pattern', () => {
+    const source = `if (!import.meta.env?.DEV) return`
+    const result = lintFile(
+      'packages/core/runtime-dom/src/transition.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-process-dev-gate: exempts server-only packages (Node always has process)', () => {
+    const source = `const __DEV__ = typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'`
+    // packages/core/server/ is the SSR adapter — runs in Node, the pattern is correct there.
+    const result = lintFile(
+      'packages/core/server/src/handler.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-process-dev-gate: exempts runtime-server, zero, vite-plugin', () => {
+    const source = `const __DEV__ = typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'`
+    for (const path of [
+      'packages/core/runtime-server/src/index.ts',
+      'packages/zero/zero/src/logger.ts',
+      'packages/tools/vite-plugin/src/index.ts',
+    ]) {
+      const result = lintFile(path, source, allRules, defaultConfig())
+      const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+      expect(diags.length, `expected ${path} to be exempt`).toBe(0)
+    }
+  })
+
+  it('pyreon/no-process-dev-gate: exempts test files', () => {
+    const source = `const __DEV__ = typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'`
+    const result = lintFile(
+      'packages/core/runtime-dom/src/tests/transition.test.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-process-dev-gate: does NOT flag isolated typeof process check', () => {
+    // A bare `typeof process !== 'undefined'` (e.g., for SSR detection) is
+    // fine — it's the COMBINATION with NODE_ENV check that flags as a dev
+    // gate. This protects against false positives on legitimate isomorphic code.
+    const source = `if (typeof process !== 'undefined') { console.log('node') }`
+    const result = lintFile(
+      'packages/core/runtime-dom/src/transition.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-process-dev-gate: does NOT flag isolated NODE_ENV check', () => {
+    // Bare NODE_ENV check (without the typeof process guard) is also fine
+    // — it's not the dead-in-browser pattern.
+    const source = `if (process.env.NODE_ENV !== 'production') { /* ... */ }`
+    const result = lintFile(
+      'packages/core/runtime-dom/src/transition.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-process-dev-gate: codebase-wide check — all browser packages are clean', async () => {
+    // Meta-test: scan every browser-package source file and assert NONE
+    // of them contain the broken pattern. If a future PR introduces a
+    // new file with `typeof process !== 'undefined' && process.env...`
+    // anywhere in the browser packages, this test fails immediately
+    // (in addition to the per-file lint rule firing on `bun run lint`).
+    //
+    // The lint rule by itself is the primary defence — this meta-test
+    // is the safety net for cases where someone might disable the rule
+    // for a single file or commit. The two layers together make the
+    // bug class impossible to reintroduce silently.
+    const fs = await import('node:fs')
+    const path = await import('node:path')
+
+    // Resolve the workspace root by walking up from this test file.
+    // This test file lives at `packages/tools/lint/src/tests/runner.test.ts`,
+    // so 5 levels up gets us to the workspace root.
+    const workspaceRoot = path.resolve(import.meta.dirname, '../../../../..')
+
+    // The list of source roots to scan. Mirrors the lint rule's
+    // SERVER_PACKAGE_PATTERNS exemption — these are the BROWSER-running
+    // packages that must be clean.
+    const browserPackageRoots = [
+      'packages/core/core/src',
+      'packages/core/runtime-dom/src',
+      'packages/core/router/src',
+      'packages/core/head/src',
+      'packages/fundamentals/flow/src',
+      'packages/fundamentals/code/src',
+      'packages/fundamentals/charts/src',
+      'packages/fundamentals/document/src',
+      'packages/fundamentals/form/src',
+      'packages/fundamentals/hooks/src',
+      'packages/fundamentals/store/src',
+      'packages/fundamentals/state-tree/src',
+      'packages/ui-system/styler/src',
+      'packages/ui-system/unistyle/src',
+      'packages/ui-system/elements/src',
+      'packages/ui-system/rocketstyle/src',
+      'packages/ui-system/coolgrid/src',
+      'packages/ui-system/kinetic/src',
+      'packages/ui-system/document-primitives/src',
+      'packages/ui-system/connector-document/src',
+      'packages/ui/components/src',
+      'packages/ui/primitives/src',
+    ]
+
+    // Recursively walk a directory and collect all .ts/.tsx files
+    // (excluding tests).
+    function walk(dir: string, out: string[] = []): string[] {
+      let entries: import('node:fs').Dirent[]
+      try {
+        entries = fs.readdirSync(dir, { withFileTypes: true })
+      } catch {
+        // Directory may not exist (e.g., new package not yet created).
+        // The test should pass — this is a clean state.
+        return out
+      }
+      for (const entry of entries) {
+        const full = path.join(dir, entry.name)
+        if (entry.isDirectory()) {
+          // Skip test directories — the lint rule exempts them and
+          // they may legitimately use `process` for test env detection.
+          if (
+            entry.name === 'tests' ||
+            entry.name === '__tests__' ||
+            entry.name === 'test' ||
+            entry.name === 'node_modules' ||
+            entry.name === 'dist' ||
+            entry.name === 'lib'
+          ) {
+            continue
+          }
+          walk(full, out)
+        } else if (
+          (entry.name.endsWith('.ts') || entry.name.endsWith('.tsx')) &&
+          !entry.name.endsWith('.d.ts') &&
+          !entry.name.includes('.test.') &&
+          !entry.name.includes('.spec.')
+        ) {
+          out.push(full)
+        }
+      }
+      return out
+    }
+
+    const offenders: string[] = []
+    // The exact pattern we forbid. We use a strict regex that requires
+    // the FULL combined pattern including the `&&` and the NODE_ENV
+    // check, which only appears in actual buggy code (not isolated
+    // typeof process or NODE_ENV checks).
+    const brokenPattern =
+      /typeof\s+process\s*!==\s*['"]undefined['"]\s*&&\s*process\.env\.NODE_ENV\s*!==\s*['"]production['"]/
+
+    // Strip comments before matching — explanation comments in fixed
+    // files (e.g., `flow/src/layout.ts:warnIgnoredOptions`) legitimately
+    // mention the bad pattern as documentation. We only care about
+    // executable code.
+    function stripComments(source: string): string {
+      return source
+        .replace(/\/\*[\s\S]*?\*\//g, '') // block comments
+        .replace(/^\s*\/\/.*$/gm, '') // line comments at start of line
+        .replace(/([^:])\/\/.*$/gm, '$1') // trailing line comments (avoid breaking URLs)
+    }
+
+    for (const root of browserPackageRoots) {
+      const absRoot = path.join(workspaceRoot, root)
+      const files = walk(absRoot)
+      for (const file of files) {
+        const source = fs.readFileSync(file, 'utf-8')
+        const codeOnly = stripComments(source)
+        if (brokenPattern.test(codeOnly)) {
+          offenders.push(path.relative(workspaceRoot, file))
+        }
+      }
+    }
+
+    // If this fails, the offending files are listed. Each one needs
+    // the broken pattern replaced with `import.meta.env?.DEV === true`
+    // (or the inline `if (!import.meta.env?.DEV) return` form). See
+    // `packages/fundamentals/flow/src/layout.ts:warnIgnoredOptions`
+    // for the reference implementation.
+    expect(
+      offenders,
+      `Browser-package source files with the broken \`typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'\` dev gate. ` +
+        `This pattern is dead code in real Vite browser bundles because Vite does not polyfill \`process\`. ` +
+        `Replace with \`const __DEV__ = import.meta.env?.DEV === true\`. ` +
+        `See pyreon/no-process-dev-gate lint rule for details.`,
+    ).toEqual([])
+  })
+
   it('pyreon/no-error-without-prefix: flags throw without [Pyreon]', () => {
     const source = `throw new Error("something went wrong")`
     const result = lintSource(source)
@@ -1013,7 +1273,7 @@ describe('Ignore filter', () => {
 describe('Presets', () => {
   it('recommended should include all rules', () => {
     const config = getPreset('recommended')
-    expect(Object.keys(config.rules).length).toBe(57)
+    expect(Object.keys(config.rules).length).toBe(58)
   })
 
   it('strict should promote all warns to errors', () => {
@@ -1034,10 +1294,19 @@ describe('Presets', () => {
     expect(app.rules['pyreon/no-cross-layer-import']).toBe('off')
   })
 
+  it('app preset KEEPS no-process-dev-gate enabled (browser bug, not a lib-only concern)', () => {
+    // The browser-dead-code bug hits user-facing code regardless of
+    // whether the project is a library or an app. Apps that build for
+    // the browser still need the warning.
+    const app = getPreset('app')
+    expect(app.rules['pyreon/no-process-dev-gate']).toBe('error')
+  })
+
   it('lib should have architecture rules as error', () => {
     const lib = getPreset('lib')
     expect(lib.rules['pyreon/no-circular-import']).toBe('error')
     expect(lib.rules['pyreon/no-cross-layer-import']).toBe('error')
     expect(lib.rules['pyreon/dev-guard-warnings']).toBe('error')
+    expect(lib.rules['pyreon/no-process-dev-gate']).toBe('error')
   })
 })