@pyreon/lint 0.14.0 → 0.16.0

package/src/tests/runner.test.ts

@@ -53,8 +53,8 @@ function lintWith(ruleId: string, source: string, filePath?: string) {
 // ── Rule Metadata ───────────────────────────────────────────────────────────
 
 describe('Rule metadata', () => {
-  it('should have 59 rules', () => {
-    expect(allRules.length).toBe(59)
+  it('should have 66 rules', () => {
+    expect(allRules.length).toBe(66)
   })
 
   it('should have unique rule IDs', () => {
@@ -83,6 +83,7 @@ describe('Rule metadata', () => {
       'hooks',
       'accessibility',
       'router',
+      'ssg',
     ])
     for (const rule of allRules) {
       expect(validCategories.has(rule.meta.category)).toBe(true)
@@ -94,9 +95,9 @@ describe('Rule metadata', () => {
     for (const rule of allRules) {
       counts[rule.meta.category] = (counts[rule.meta.category] ?? 0) + 1
     }
-    expect(counts.reactivity).toBe(10)
+    expect(counts.reactivity).toBe(13)
     expect(counts.jsx).toBe(11)
-    expect(counts.lifecycle).toBe(4)
+    expect(counts.lifecycle).toBe(5)
     expect(counts.performance).toBe(4)
     expect(counts.ssr).toBe(3)
     expect(counts.architecture).toBe(7)
@@ -106,6 +107,8 @@ describe('Rule metadata', () => {
     expect(counts.hooks).toBe(3)
     expect(counts.accessibility).toBe(3)
     expect(counts.router).toBe(4)
+    // M3.5 — SSG rules.
+    expect(counts.ssg).toBe(3)
   })
 })
 
@@ -277,6 +280,61 @@ describe('Reactivity rules', () => {
     expect(diags.length).toBe(1)
   })
 
+  // ── Audit bug #1: async-effect catch ────────────────────────────────────
+  it('pyreon/no-async-effect: flags async arrow in effect()', () => {
+    const source = `effect(async () => { const id = userId(); const data = await fetch('/x'); name.set(data) })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-async-effect')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.message).toContain('async')
+    expect(diags[0]?.message).toContain('await')
+  })
+
+  it('pyreon/no-async-effect: flags async function expression in effect()', () => {
+    const source = `effect(async function () { await x() })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-async-effect')
+    expect(diags.length).toBe(1)
+  })
+
+  it('pyreon/no-async-effect: flags async in renderEffect()', () => {
+    const source = `renderEffect(async () => { await fetch('/x') })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-async-effect')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.message).toContain('renderEffect')
+  })
+
+  it('pyreon/no-async-effect: flags async in computed()', () => {
+    const source = `computed(async () => { return await fetch('/x') })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-async-effect')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.message).toContain('computed')
+    expect(diags[0]?.message).toContain('createResource')
+  })
+
+  it('pyreon/no-async-effect: clean for synchronous effect', () => {
+    const source = `effect(() => { name.set(userId()) })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-async-effect')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-async-effect: clean for synchronous computed', () => {
+    const source = `computed(() => userId() + ':' + name())`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-async-effect')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-async-effect: does not flag async on non-effect calls', () => {
+    const source = `setTimeout(async () => { await x() }, 100)`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-async-effect')
+    expect(diags.length).toBe(0)
+  })
+
   it('pyreon/no-peek-in-tracked: flags .peek() inside effect', () => {
     const source = `effect(() => { const v = x.peek() })`
     const result = lintSource(source)
@@ -327,6 +385,50 @@ describe('Reactivity rules', () => {
     const diags = findByRule(result, 'pyreon/no-signal-leak')
     expect(diags.length).toBe(0)
   })
+
+  it('pyreon/no-signal-call-write: flags `sig(value)` write attempt', () => {
+    const source = `const count = signal(0)\nfunction inc() { count(5) }`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-signal-call-write')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.message).toContain('count.set(value)')
+  })
+
+  it('pyreon/no-signal-call-write: clean for zero-arg read', () => {
+    const source = `const count = signal(0)\nfunction read() { return count() }`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-signal-call-write')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-signal-call-write: clean for `.set()` member call', () => {
+    const source = `const count = signal(0)\nfunction inc() { count.set(5) }`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-signal-call-write')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-signal-call-write: also covers computed bindings', () => {
+    const source = `const total = computed(() => 0)\nfunction wrong() { total(5) }`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-signal-call-write')
+    expect(diags.length).toBe(1)
+  })
+
+  it('pyreon/no-signal-call-write: ignores non-const signal-like declarations', () => {
+    // `let` may be reassigned to a non-signal — too risky to flag.
+    const source = `let count = signal(0)\nfunction inc() { count(5) }`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-signal-call-write')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-signal-call-write: clean when name does not bind to a signal', () => {
+    const source = `function increment(x) { return x + 1 }\nincrement(5)`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-signal-call-write')
+    expect(diags.length).toBe(0)
+  })
 })
 
 // ── JSX Rules ───────────────────────────────────────────────────────────────
@@ -418,6 +520,40 @@ describe('JSX rules', () => {
     expect(diags.length).toBe(0)
   })
 
+  it('pyreon/no-props-destructure: clean for render-prop callbacks', () => {
+    // <For>{(item) => <li>...</li>}</For> — array element, not Pyreon props.
+    // The `depth > 1` exemption covers this.
+    const source = `const App = () => <For each={items}>{({id}) => <li>{id}</li>}</For>`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-props-destructure')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-props-destructure: flags inside known component-factory call', () => {
+    // `lazy(({foo}) => <div>{foo}</div>)` — foo IS a Pyreon prop, so
+    // destructuring loses reactivity.
+    const source = `const Wrapped = lazy(({ foo }) => <div>{foo}</div>)`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-props-destructure')
+    expect(diags.length).toBe(1)
+  })
+
+  it('pyreon/no-props-destructure: respects exemptPaths option', () => {
+    const config = configWithExemptPaths('pyreon/no-props-destructure', [
+      'examples/legacy/',
+    ])
+    const source = `const App = ({ name }) => <div>{name}</div>`
+    const exempted = lintFile(
+      'examples/legacy/old.tsx',
+      source,
+      allRules,
+      config,
+    )
+    expect(findByRule(exempted, 'pyreon/no-props-destructure').length).toBe(0)
+    const checked = lintFile('src/App.tsx', source, allRules, config)
+    expect(findByRule(checked, 'pyreon/no-props-destructure').length).toBe(1)
+  })
+
   it('pyreon/no-index-as-by: flags by={(_, i) => i}', () => {
     const source = `const App = () => <For each={items} by={(_, i) => i}>{r => <li />}</For>`
     const result = lintSource(source)
@@ -488,6 +624,302 @@ describe('Lifecycle rules', () => {
     const diags = findByRule(result, 'pyreon/no-dom-in-setup')
     expect(diags.length).toBe(0)
   })
+
+  it('pyreon/no-imperative-effect-on-create: flags fetch() inside effect', () => {
+    const source = `const App = () => { effect(() => fetch('/api')) }`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.message).toContain('fetch')
+  })
+
+  it('pyreon/no-imperative-effect-on-create: flags addEventListener inside effect', () => {
+    const source = `const App = () => { effect(() => { document.addEventListener('click', () => {}) }) }`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.message).toContain('addEventListener')
+  })
+
+  it('pyreon/no-imperative-effect-on-create: flags setTimeout inside effect', () => {
+    const source = `effect(() => setTimeout(() => doStuff(), 100))`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.message).toContain('setTimeout')
+  })
+
+  it('pyreon/no-imperative-effect-on-create: flags await inside async effect', () => {
+    const source = `effect(async () => { await loadData() })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.message).toContain('await')
+  })
+
+  it('pyreon/no-imperative-effect-on-create: flags document/window member access', () => {
+    const source = `effect(() => { const w = window.innerWidth })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: clean for pure reactive tracking', () => {
+    // The idiomatic pattern — effect tracks signals, no imperative work.
+    const source = `effect(() => { sum.set(a() + b()) })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: clean for console.log debug effect', () => {
+    const source = `effect(() => console.log('count:', count()))`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: clean when wrapped in onMount', () => {
+    const source = `onMount(() => { effect(() => fetch('/api')) })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: clean for nested function (not run synchronously)', () => {
+    // The fetch is inside a function the effect attaches as a handler —
+    // it runs later, not at effect setup, so the bug class doesn't apply.
+    const source = `effect(() => { const handler = () => fetch('/api'); attach(handler) })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: flags localStorage.setItem inside effect', () => {
+    const source = `effect(() => { localStorage.setItem('k', count()) })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: flags new IntersectionObserver inside effect', () => {
+    const source = `effect(() => { const io = new IntersectionObserver(() => {}) })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.message).toContain('IntersectionObserver')
+  })
+
+  it('pyreon/no-imperative-effect-on-create: flags new ResizeObserver inside effect', () => {
+    const source = `effect(() => { new ResizeObserver(() => {}).observe(el) })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.message).toContain('ResizeObserver')
+  })
+
+  it('pyreon/no-imperative-effect-on-create: flags new WebSocket inside effect', () => {
+    const source = `effect(() => { const ws = new WebSocket(url()) })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.message).toContain('WebSocket')
+  })
+
+  it('pyreon/no-imperative-effect-on-create: flags fetch inside IIFE inside effect', () => {
+    // IIFE — `(async () => { await fetch() })()` runs synchronously at
+    // the call site, so its body should be walked even though it's
+    // structurally a "nested function".
+    const source = `effect(() => { (async () => { await fetch('/api') })() })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: flags fetch inside arrow-IIFE expression-body', () => {
+    const source = `effect(() => (() => fetch('/api'))())`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: clean for empty IIFE', () => {
+    const source = `effect(() => { (() => {})() })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: still bails at handler inside IIFE', () => {
+    // `setTimeout(...)` IS flagged, but the inner fetch (inside the
+    // setTimeout callback — a real deferred handler) should NOT
+    // double-fire. Single diagnostic for setTimeout, not two.
+    const source = `effect(() => { (() => { setTimeout(() => fetch('/api')) })() })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.message).toContain('setTimeout')
+  })
+
+  // ── Coverage: every entry in each IMPERATIVE_* set must fire ──
+  //
+  // Set-lookup typos in the rule source would slip through happy-path
+  // tests because the happy paths only cover a few entries from each
+  // set. These table-driven tests exercise EVERY entry — a typo that
+  // breaks lookup of any single name fails one of these.
+
+  describe('pyreon/no-imperative-effect-on-create: coverage', () => {
+    const globalCalls = [
+      'fetch',
+      'setTimeout',
+      'setInterval',
+      'requestAnimationFrame',
+      'requestIdleCallback',
+      'queueMicrotask',
+    ]
+    for (const name of globalCalls) {
+      it(`flags global call: ${name}(...)`, () => {
+        const source = `effect(() => { ${name}(() => {}) })`
+        const result = lintSource(source)
+        const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+        expect(diags.length).toBe(1)
+        expect(diags[0]?.message).toContain(name)
+      })
+    }
+
+    const memberMethods = [
+      'addEventListener',
+      'removeEventListener',
+      'querySelector',
+      'querySelectorAll',
+      'getElementById',
+      'getElementsByClassName',
+      'getElementsByTagName',
+      'getBoundingClientRect',
+      'getComputedStyle',
+      'focus',
+      'blur',
+      'scrollIntoView',
+      'scrollTo',
+      'scrollBy',
+      'requestFullscreen',
+      'play',
+      'pause',
+    ]
+    for (const method of memberMethods) {
+      it(`flags member method: el.${method}(...)`, () => {
+        const source = `effect(() => { el.${method}() })`
+        const result = lintSource(source)
+        const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+        expect(diags.length).toBe(1)
+        expect(diags[0]?.message).toContain(method)
+      })
+    }
+
+    const constructors = [
+      'IntersectionObserver',
+      'ResizeObserver',
+      'MutationObserver',
+      'PerformanceObserver',
+      'Worker',
+      'SharedWorker',
+      'WebSocket',
+      'EventSource',
+      'BroadcastChannel',
+    ]
+    for (const ctor of constructors) {
+      it(`flags constructor: new ${ctor}(...)`, () => {
+        const source = `effect(() => { new ${ctor}('arg') })`
+        const result = lintSource(source)
+        const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+        expect(diags.length).toBe(1)
+        expect(diags[0]?.message).toContain(ctor)
+      })
+    }
+
+    const browserObjects = [
+      'document',
+      'window',
+      'navigator',
+      'localStorage',
+      'sessionStorage',
+    ]
+    for (const obj of browserObjects) {
+      it(`flags browser-object member read: ${obj}.X`, () => {
+        const source = `effect(() => { const x = ${obj}.something })`
+        const result = lintSource(source)
+        const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+        expect(diags.length).toBe(1)
+        expect(diags[0]?.message).toContain(obj)
+      })
+    }
+
+    const promiseMethods = ['then', 'catch', 'finally']
+    for (const method of promiseMethods) {
+      it(`flags promise method: p.${method}(...)`, () => {
+        const source = `effect(() => { p.${method}(() => {}) })`
+        const result = lintSource(source)
+        const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+        expect(diags.length).toBe(1)
+        expect(diags[0]?.message).toContain(method)
+      })
+    }
+  })
+
+  // ── Edge cases ──
+
+  it('pyreon/no-imperative-effect-on-create: function-expression IIFE form', () => {
+    // `(function () { await fetch() })()` — the function-keyword IIFE
+    // shape, less common than arrow IIFEs but still valid.
+    const source = `effect(() => { (async function () { await fetch('/api') })() })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: clean when effect callback is a fn reference', () => {
+    // `effect(handler)` — no inline body to walk. Rule must not crash
+    // and must not false-fire on the handler reference itself.
+    const source = `function track() { fetch('/api') }; effect(track)`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: clean inside renderEffect wrapper', () => {
+    const source = `renderEffect(() => { effect(() => fetch('/api')) })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: clean inside onCleanup wrapper', () => {
+    const source = `onCleanup(() => { effect(() => setTimeout(() => {}, 100)) })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: known limitation — bracket access not detected', () => {
+    // The rule only matches dotted member access. `el['addEventListener']`
+    // bypasses detection — documented limitation. If a future enhancement
+    // adds bracket-access support, this test should be flipped to assert 1.
+    const source = `effect(() => { el['addEventListener']('click', fn) })`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(0)
+  })
+
+  it('pyreon/no-imperative-effect-on-create: known limitation — non-DOM identifier with matching method', () => {
+    // `myObj.focus()` flags even when `myObj` isn't a DOM element. The
+    // rule has no type info; method-name matching is the heuristic. This
+    // is an acceptable false-positive trade-off — the alternative (full
+    // type checking) is out of scope for an AST walker.
+    const source = `const myObj = { focus: () => null }; effect(() => myObj.focus())`
+    const result = lintSource(source)
+    const diags = findByRule(result, 'pyreon/no-imperative-effect-on-create')
+    expect(diags.length).toBe(1)
+  })
 })
 
 // ── Performance Rules ───────────────────────────────────────────────────────
@@ -747,7 +1179,7 @@ describe('Architecture rules', () => {
     const diags = findByRule(result, 'pyreon/no-process-dev-gate')
     expect(diags.length).toBe(1)
     expect(diags[0]?.fix).toBeDefined()
-    expect(diags[0]?.fix?.replacement).toBe('import.meta.env?.DEV === true')
+    expect(diags[0]?.fix?.replacement).toBe(`process.env.NODE_ENV !== 'production'`)
   })
 
   it('pyreon/no-process-dev-gate: flags the reversed pattern (NODE_ENV first)', () => {
@@ -776,8 +1208,13 @@ describe('Architecture rules', () => {
     expect(diags.length).toBe(1)
   })
 
-  it('pyreon/no-process-dev-gate: clean for the correct import.meta.env.DEV pattern', () => {
-    const source = `if (!import.meta.env?.DEV) return`
+  it('pyreon/no-process-dev-gate: clean for the bundler-agnostic process.env.NODE_ENV pattern', () => {
+    // The recommended pattern: bare `process.env.NODE_ENV !== 'production'`
+    // (no `typeof process` guard). Every modern bundler (Vite, Webpack,
+    // esbuild, Rollup, Parcel, Bun) auto-replaces `process.env.NODE_ENV`
+    // at consumer build time. Cross-bundler library convention used by
+    // React, Vue, Preact, Solid.
+    const source = `if (process.env.NODE_ENV !== 'production') console.warn('hi')`
     const result = lintFile(
       'packages/core/runtime-dom/src/transition.ts',
       source,
@@ -788,6 +1225,107 @@ describe('Architecture rules', () => {
     expect(diags.length).toBe(0)
   })
 
+  // Regression: `import.meta.env.DEV` is Vite/Rolldown-specific. In a
+  // Pyreon library shipped to consumers using Webpack (Next.js), esbuild,
+  // Rollup, Parcel, or Bun, `import.meta.env.DEV` is undefined and dev
+  // warnings never fire — even in development. PR #200 made this the
+  // recommended replacement for the broken `typeof process` compound;
+  // that direction was wrong for library code. The bundler-agnostic
+  // standard is bare `process.env.NODE_ENV !== 'production'`.
+  it('pyreon/no-process-dev-gate: flags `import.meta.env.DEV` Vite-tied pattern', () => {
+    const source = `const __DEV__ = import.meta.env?.DEV === true`
+    const result = lintFile(
+      'packages/core/runtime-dom/src/transition.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.fix?.replacement).toBe(`process.env.NODE_ENV !== 'production'`)
+  })
+
+  it('pyreon/no-process-dev-gate: flags bare `import.meta.env.DEV` truthy check', () => {
+    const source = `if (import.meta.env?.DEV) console.warn('hi')`
+    const result = lintFile(
+      'packages/core/runtime-dom/src/transition.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(1)
+  })
+
+  it('pyreon/no-process-dev-gate: flags negated `!import.meta.env.DEV` early-return', () => {
+    const source = `function f() { if (!import.meta.env?.DEV) return; console.warn('hi') }`
+    const result = lintFile(
+      'packages/core/runtime-dom/src/transition.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(1)
+  })
+
+  it('pyreon/no-process-dev-gate: flags `(import.meta as ViteMeta).env?.DEV === true` cast variant', () => {
+    const source = `interface ViteMeta { env?: { DEV?: boolean } }
+const __DEV__ = (import.meta as ViteMeta).env?.DEV === true`
+    const result = lintFile(
+      'packages/ui-system/styler/src/sheet.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.fix?.replacement).toBe(`process.env.NODE_ENV !== 'production'`)
+  })
+
+  it('pyreon/no-process-dev-gate: does NOT flag `process.env.NODE_ENV` (the recommended pattern)', () => {
+    const source = `const __DEV__ = process.env.NODE_ENV !== 'production'`
+    const result = lintFile(
+      'packages/core/runtime-dom/src/transition.ts',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(0)
+  })
+
+  // Regression: the optional-chaining variant `process?.env?.NODE_ENV` was
+  // silently missed. ESTree wraps `process?.env?.NODE_ENV` in a
+  // `ChainExpression` containing nested `MemberExpression` nodes with
+  // `optional: true`, but the original rule only matched plain
+  // `MemberExpression`. The bug shipped to `packages/ui-system/ui-core/src/context.tsx`
+  // — a real browser package whose dev warning was dead code in production.
+  it('pyreon/no-process-dev-gate: flags optional-chaining variant (process?.env?.NODE_ENV)', () => {
+    const source = `const __DEV__ = typeof process !== 'undefined' && process?.env?.NODE_ENV !== 'production'`
+    const result = lintFile(
+      'packages/ui-system/ui-core/src/context.tsx',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(1)
+    expect(diags[0]?.fix?.replacement).toBe(`process.env.NODE_ENV !== 'production'`)
+  })
+
+  it('pyreon/no-process-dev-gate: flags partial optional-chaining (process.env?.NODE_ENV)', () => {
+    const source = `const __DEV__ = typeof process !== 'undefined' && process.env?.NODE_ENV !== 'production'`
+    const result = lintFile(
+      'packages/ui-system/ui-core/src/context.tsx',
+      source,
+      allRules,
+      defaultConfig(),
+    )
+    const diags = findByRule(result, 'pyreon/no-process-dev-gate')
+    expect(diags.length).toBe(1)
+  })
+
   it('pyreon/no-process-dev-gate: exempt via configured exemptPaths (server-only code)', () => {
     const source = `const __DEV__ = typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'`
     const cfg = configWithExemptPaths('pyreon/no-process-dev-gate', [
@@ -1420,7 +1958,7 @@ describe('Ignore filter', () => {
 describe('Presets', () => {
   it('recommended should include all rules', () => {
     const config = getPreset('recommended')
-    expect(Object.keys(config.rules).length).toBe(59)
+    expect(Object.keys(config.rules).length).toBe(66)
   })
 
   it('strict should promote all warns to errors', () => {
@@ -2485,7 +3023,7 @@ describe('config-file round-trip', () => {
       const base = getPreset('recommended')
       const runtimeCfg: LintConfig = {
         ...base,
-        rules: { ...base.rules, ...(loaded?.rules ?? {}) },
+        rules: { ...base.rules, ...loaded?.rules },
       }
 
       // In an exempt path — rule silent.