@sister.software/oxlint-config 9.1.0 → 9.3.0

package/out/braces-plugin.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @copyright Sister Software
+ * @license AGPL-3.0
+ * @author Teffen Ellis, et al.
+ * @file A require-braces rule, authored as an oxlint JS plugin (ESLint v9-compatible API). It
+ *   requires braces around single-statement `if`/`else`/`for`/`while`/`do` bodies that do work
+ *   (assignments, calls, …) and autofixes by wrapping them — but leaves a bare control-flow terminal
+ *   (`return`/`throw`/`break`/`continue`) alone (braces optional). Unlike the built-in `curly` rule,
+ *   which can't exempt those.
+ */
+import type { Rule } from "./plugin-types.js";
+export declare const bracesRule: Rule;
+export default bracesRule;
+//# sourceMappingURL=braces-plugin.d.ts.map

package/out/braces-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"braces-plugin.d.ts","sourceRoot":"","sources":["../src/braces-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAgBtD,eAAO,MAAM,UAAU,EAAE,IA2DxB,CAAA;AAED,eAAe,UAAU,CAAA"}

package/out/braces-plugin.js

@@ -0,0 +1,80 @@
+/**
+ * @copyright Sister Software
+ * @license AGPL-3.0
+ * @author Teffen Ellis, et al.
+ * @file A require-braces rule, authored as an oxlint JS plugin (ESLint v9-compatible API). It
+ *   requires braces around single-statement `if`/`else`/`for`/`while`/`do` bodies that do work
+ *   (assignments, calls, …) and autofixes by wrapping them — but leaves a bare control-flow terminal
+ *   (`return`/`throw`/`break`/`continue`) alone (braces optional). Unlike the built-in `curly` rule,
+ *   which can't exempt those.
+ */
+/**
+ * Body node types that may stay brace-less: an existing block; a bare control-flow terminal
+ * (`return`/`throw`/`break`/`continue`, exempt by house style); or an empty statement (a different concern —
+ * `no-empty`).
+ */
+const EXEMPT_BODY_TYPES = new Set([
+    "BlockStatement",
+    "ReturnStatement",
+    "ThrowStatement",
+    "BreakStatement",
+    "ContinueStatement",
+    "EmptyStatement",
+]);
+export const bracesRule = {
+    meta: {
+        name: "require-braces",
+        type: "layout",
+        fixable: "code",
+        schema: [{ type: "object", additionalProperties: true }],
+    },
+    create(context) {
+        const sourceCode = context.sourceCode ?? context.getSourceCode();
+        function check(body) {
+            if (!body || EXEMPT_BODY_TYPES.has(body.type))
+                return;
+            // `else if (…)` — the alternate is itself an `if`; its own body is visited separately.
+            if (body.type === "IfStatement")
+                return;
+            const inner = sourceCode.getText().slice(body.range[0], body.range[1]);
+            context.report({
+                node: body,
+                message: "Expected braces around this single-statement body.",
+                fix(fixer) {
+                    // Wrap inline; oxfmt expands it to a formatted multi-line block afterward.
+                    return fixer.replaceTextRange(body.range, `{ ${inner} }`);
+                },
+            });
+        }
+        return {
+            IfStatement(node) {
+                check(node.consequent);
+                check(node.alternate);
+            },
+            ForStatement(node) {
+                checkLoopBody(node);
+            },
+            ForInStatement(node) {
+                checkLoopBody(node);
+            },
+            ForOfStatement(node) {
+                checkLoopBody(node);
+            },
+            WhileStatement(node) {
+                checkLoopBody(node);
+            },
+            DoWhileStatement(node) {
+                checkLoopBody(node);
+            },
+        };
+        function checkLoopBody(node) {
+            const body = node.body;
+            // A loop body is a single statement (never a statement-list array).
+            if (body && !Array.isArray(body)) {
+                check(body);
+            }
+        }
+    },
+};
+export default bracesRule;
+//# sourceMappingURL=braces-plugin.js.map

package/out/braces-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"braces-plugin.js","sourceRoot":"","sources":["../src/braces-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACjC,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,gBAAgB;CAChB,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,UAAU,GAAS;IAC/B,IAAI,EAAE;QACL,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;KACxD;IACD,MAAM,CAAC,OAAO;QACb,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,aAAc,EAAE,CAAA;QAEjE,SAAS,KAAK,CAAC,IAAgC;YAC9C,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAM;YAErD,uFAAuF;YACvF,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAM;YAEvC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YAEtE,OAAO,CAAC,MAAM,CAAC;gBACd,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,oDAAoD;gBAC7D,GAAG,CAAC,KAAK;oBACR,2EAA2E;oBAC3E,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,CAAA;gBAC1D,CAAC;aACD,CAAC,CAAA;QACH,CAAC;QAED,OAAO;YACN,WAAW,CAAC,IAAI;gBACf,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBACtB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACtB,CAAC;YACD,YAAY,CAAC,IAAI;gBAChB,aAAa,CAAC,IAAI,CAAC,CAAA;YACpB,CAAC;YACD,cAAc,CAAC,IAAI;gBAClB,aAAa,CAAC,IAAI,CAAC,CAAA;YACpB,CAAC;YACD,cAAc,CAAC,IAAI;gBAClB,aAAa,CAAC,IAAI,CAAC,CAAA;YACpB,CAAC;YACD,cAAc,CAAC,IAAI;gBAClB,aAAa,CAAC,IAAI,CAAC,CAAA;YACpB,CAAC;YACD,gBAAgB,CAAC,IAAI;gBACpB,aAAa,CAAC,IAAI,CAAC,CAAA;YACpB,CAAC;SACD,CAAA;QAED,SAAS,aAAa,CAAC,IAAa;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;YAEtB,oEAAoE;YACpE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,CAAA;YACZ,CAAC;QACF,CAAC;IACF,CAAC;CACD,CAAA;AAED,eAAe,UAAU,CAAA"}

package/out/index.d.ts

@@ -23,6 +23,13 @@ export interface OxlintConfigOptions {
     headers?: boolean;
     /** Require a blank line before `return`/block-like statements (on by default). */
     padding?: boolean;
+    /** Require braces around single-statement work bodies (bare `return` exempt; on by default). */
+    braces?: boolean;
+    /**
+     * Forbid direct `process.env` / `process.argv` access (off by default). Turn on once the project funnels those reads
+     * through blessed helpers, which disable `sister-software/no-process-globals`.
+     */
+    restrictProcessGlobals?: boolean;
     /** Override the default ignore patterns. */
     ignorePatterns?: string[];
     /** Extra config deep-merged last; an escape hatch for per-repo tweaks. */

package/out/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,cAAc,mBAAmB,CAAA;AAEjC,4FAA4F;AAC5F,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAElD,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IACnC,4FAA4F;IAC5F,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,6DAA6D;IAC7D,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,kFAAkF;IAClF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,YAAY,CAAA;CACxB;AAED,0DAA0D;AAC1D,eAAO,MAAM,qBAAqB,UAOjC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,YAAY,CAoElF;AAED,eAAe,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,cAAc,mBAAmB,CAAA;AAEjC,4FAA4F;AAC5F,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAElD,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IACnC,4FAA4F;IAC5F,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,6DAA6D;IAC7D,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,kFAAkF;IAClF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gGAAgG;IAChG,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,YAAY,CAAA;CACxB;AAED,0DAA0D;AAC1D,eAAO,MAAM,qBAAqB,UAOjC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,YAAY,CAkFlF;AAED,eAAe,kBAAkB,CAAA"}

package/out/index.js

@@ -30,7 +30,7 @@ export const DefaultIgnorePatterns = [
  * @returns A complete oxlint config object (no `extends` required).
  */
 export function createOxlintConfig(options = {}) {
-    const { packageNamespace = "@sister.software", copyrightHolder = "Sister Software", spdxLicenseIdentifier = "UNLICENSED", author = "Teffen Ellis, et al.", react = false, headers = true, padding = true, ignorePatterns = DefaultIgnorePatterns, overrides = {}, } = options;
+    const { packageNamespace = "@sister.software", copyrightHolder = "Sister Software", spdxLicenseIdentifier = "UNLICENSED", author = "Teffen Ellis, et al.", react = false, headers = true, padding = true, braces = true, restrictProcessGlobals = false, ignorePatterns = DefaultIgnorePatterns, overrides = {}, } = options;
     const plugins = ["typescript", "unicorn", "oxc", ...(react ? ["react"] : [])];
     const rules = {
         // JavaScript
@@ -72,9 +72,19 @@ export function createOxlintConfig(options = {}) {
         // Warning severity: a stylistic nudge (auto-fixable), not a hard CI gate.
         rules["sister-software/padding-lines"] = "warn";
     }
+    if (braces) {
+        // Warning severity: a stylistic nudge (auto-fixable), not a hard CI gate.
+        rules["sister-software/require-braces"] = "warn";
+    }
+    if (restrictProcessGlobals) {
+        // Error severity: a governance gate — direct env/argv access should fail the lint.
+        rules["sister-software/no-process-globals"] = "error";
+    }
     return {
         plugins,
-        ...(headers || padding ? { jsPlugins: ["@sister.software/oxlint-config/plugin"] } : {}),
+        ...(headers || padding || braces || restrictProcessGlobals
+            ? { jsPlugins: ["@sister.software/oxlint-config/plugin"] }
+            : {}),
         categories: { correctness: "error" },
         ignorePatterns,
         rules,

package/out/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,cAAc,mBAAmB,CAAA;AA2BjC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,iBAAiB;IACjB,aAAa;IACb,qBAAqB;CACrB,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA+B,EAAE;IACnE,MAAM,EACL,gBAAgB,GAAG,kBAAkB,EACrC,eAAe,GAAG,iBAAiB,EACnC,qBAAqB,GAAG,YAAY,EACpC,MAAM,GAAG,sBAAsB,EAC/B,KAAK,GAAG,KAAK,EACb,OAAO,GAAG,IAAI,EACd,OAAO,GAAG,IAAI,EACd,cAAc,GAAG,qBAAqB,EACtC,SAAS,GAAG,EAAE,GACd,GAAG,OAAO,CAAA;IAEX,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAE7E,MAAM,KAAK,GAA4B;QACtC,aAAa;QACb,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC/C,cAAc,EAAE,MAAM;QACtB,kBAAkB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QACtC,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE;YACjB,MAAM;YACN;gBACC,IAAI,EAAE,KAAK;gBACX,iBAAiB,EAAE,IAAI;gBACvB,YAAY,EAAE,KAAK;gBACnB,yBAAyB,EAAE,IAAI;gBAC/B,8BAA8B,EAAE,IAAI;gBACpC,uFAAuF;gBACvF,gFAAgF;gBAChF,iBAAiB,EAAE,MAAM;gBACzB,kBAAkB,EAAE,IAAI;aACxB;SACD;QAED,2EAA2E;QAC3E,2BAA2B,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;QAChF,sBAAsB,EAAE,KAAK;QAC7B,+BAA+B,EAAE,KAAK;QACtC,4BAA4B,EAAE,KAAK;QACnC,2BAA2B,EAAE,KAAK;QAClC,kCAAkC,EAAE,KAAK;QACzC,4BAA4B,EAAE,KAAK;QACnC,+BAA+B,EAAE,KAAK;KACtC,CAAA;IAED,IAAI,OAAO,EAAE,CAAC;QACb,0FAA0F;QAC1F,oFAAoF;QACpF,KAAK,CAAC,qCAAqC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7G,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACb,0EAA0E;QAC1E,KAAK,CAAC,+BAA+B,CAAC,GAAG,MAAM,CAAA;IAChD,CAAC;IAED,OAAO;QACN,OAAO;QACP,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,UAAU,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;QACpC,cAAc;QACd,KAAK;QACL,SAAS,EAAE,sBAAsB,CAAC,gBAAgB,CAAC;QACnD,GAAG,SAAS;KACZ,CAAA;AACF,CAAC;AAED,eAAe,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,cAAc,mBAAmB,CAAA;AAkCjC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,iBAAiB;IACjB,aAAa;IACb,qBAAqB;CACrB,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA+B,EAAE;IACnE,MAAM,EACL,gBAAgB,GAAG,kBAAkB,EACrC,eAAe,GAAG,iBAAiB,EACnC,qBAAqB,GAAG,YAAY,EACpC,MAAM,GAAG,sBAAsB,EAC/B,KAAK,GAAG,KAAK,EACb,OAAO,GAAG,IAAI,EACd,OAAO,GAAG,IAAI,EACd,MAAM,GAAG,IAAI,EACb,sBAAsB,GAAG,KAAK,EAC9B,cAAc,GAAG,qBAAqB,EACtC,SAAS,GAAG,EAAE,GACd,GAAG,OAAO,CAAA;IAEX,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAE7E,MAAM,KAAK,GAA4B;QACtC,aAAa;QACb,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC/C,cAAc,EAAE,MAAM;QACtB,kBAAkB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QACtC,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE;YACjB,MAAM;YACN;gBACC,IAAI,EAAE,KAAK;gBACX,iBAAiB,EAAE,IAAI;gBACvB,YAAY,EAAE,KAAK;gBACnB,yBAAyB,EAAE,IAAI;gBAC/B,8BAA8B,EAAE,IAAI;gBACpC,uFAAuF;gBACvF,gFAAgF;gBAChF,iBAAiB,EAAE,MAAM;gBACzB,kBAAkB,EAAE,IAAI;aACxB;SACD;QAED,2EAA2E;QAC3E,2BAA2B,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;QAChF,sBAAsB,EAAE,KAAK;QAC7B,+BAA+B,EAAE,KAAK;QACtC,4BAA4B,EAAE,KAAK;QACnC,2BAA2B,EAAE,KAAK;QAClC,kCAAkC,EAAE,KAAK;QACzC,4BAA4B,EAAE,KAAK;QACnC,+BAA+B,EAAE,KAAK;KACtC,CAAA;IAED,IAAI,OAAO,EAAE,CAAC;QACb,0FAA0F;QAC1F,oFAAoF;QACpF,KAAK,CAAC,qCAAqC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7G,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACb,0EAA0E;QAC1E,KAAK,CAAC,+BAA+B,CAAC,GAAG,MAAM,CAAA;IAChD,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACZ,0EAA0E;QAC1E,KAAK,CAAC,gCAAgC,CAAC,GAAG,MAAM,CAAA;IACjD,CAAC;IAED,IAAI,sBAAsB,EAAE,CAAC;QAC5B,mFAAmF;QACnF,KAAK,CAAC,oCAAoC,CAAC,GAAG,OAAO,CAAA;IACtD,CAAC;IAED,OAAO;QACN,OAAO;QACP,GAAG,CAAC,OAAO,IAAI,OAAO,IAAI,MAAM,IAAI,sBAAsB;YACzD,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,uCAAuC,CAAC,EAAE;YAC1D,CAAC,CAAC,EAAE,CAAC;QACN,UAAU,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;QACpC,cAAc;QACd,KAAK;QACL,SAAS,EAAE,sBAAsB,CAAC,gBAAgB,CAAC;QACnD,GAAG,SAAS;KACZ,CAAA;AACF,CAAC;AAED,eAAe,kBAAkB,CAAA"}

package/out/plugin-types.d.ts

@@ -15,7 +15,11 @@ export interface AstNode {
     type: string;
     range: [number, number];
     parent?: AstNode;
-    body?: AstNode[];
+    /** A statement-list body (block/program) is an array; a loop body is a single statement. */
+    body?: AstNode[] | AstNode;
+    /** `if`/`else` branches, for the require-braces rule. */
+    consequent?: AstNode;
+    alternate?: AstNode | null;
 }
 export interface SourceCode {
     getText(): string;

package/out/plugin-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-types.d.ts","sourceRoot":"","sources":["../src/plugin-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,OAAO;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACvB;AAED,yEAAyE;AACzE,MAAM,WAAW,OAAO;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,IAAI,MAAM,CAAA;IACjB,cAAc,IAAI,OAAO,EAAE,CAAA;CAC3B;AAED,MAAM,WAAW,KAAK;IACrB,qBAAqB,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IACrE,oBAAoB,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IACpE,gBAAgB,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAChE;AAED,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,OAAO,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,aAAa,CAAC,IAAI,UAAU,CAAA;IAC5B,MAAM,CAAC,UAAU,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;CACzF;AAED,MAAM,WAAW,IAAI;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;QAAC,MAAM,EAAE,OAAO,EAAE,CAAA;KAAE,CAAA;IACxF,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC,CAAA;CACrE;AAED,MAAM,WAAW,MAAM;IACtB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACtB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;CAC3B"}
+{"version":3,"file":"plugin-types.d.ts","sourceRoot":"","sources":["../src/plugin-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,OAAO;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACvB;AAED,yEAAyE;AACzE,MAAM,WAAW,OAAO;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC1B,yDAAyD;IACzD,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,SAAS,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,IAAI,MAAM,CAAA;IACjB,cAAc,IAAI,OAAO,EAAE,CAAA;CAC3B;AAED,MAAM,WAAW,KAAK;IACrB,qBAAqB,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IACrE,oBAAoB,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IACpE,gBAAgB,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAChE;AAED,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,OAAO,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,aAAa,CAAC,IAAI,UAAU,CAAA;IAC5B,MAAM,CAAC,UAAU,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;CACzF;AAED,MAAM,WAAW,IAAI;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;QAAC,MAAM,EAAE,OAAO,EAAE,CAAA;KAAE,CAAA;IACxF,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC,CAAA;CACrE;AAED,MAAM,WAAW,MAAM;IACtB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACtB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;CAC3B"}

package/out/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE/C,QAAA,MAAM,oBAAoB,EAAE,MAM3B,CAAA;AAED,eAAe,oBAAoB,CAAA"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAG/C,QAAA,MAAM,oBAAoB,EAAE,MAQ3B,CAAA;AAED,eAAe,oBAAoB,CAAA"}

package/out/plugin.js

@@ -5,13 +5,17 @@
  * @file The bundled Sister Software oxlint JS plugin. A single plugin (oxlint requires unique plugin
  *   names) exposing all of Sister Software's custom rules under the `sister-software/` namespace.
  */
+import { bracesRule } from "./braces-plugin.js";
 import { headerRule } from "./headers-plugin.js";
 import { paddingRule } from "./padding-plugin.js";
+import { noProcessGlobalsRule } from "./process-globals-plugin.js";
 const sisterSoftwarePlugin = {
     meta: { name: "sister-software" },
     rules: {
         "require-file-header": headerRule,
         "padding-lines": paddingRule,
+        "require-braces": bracesRule,
+        "no-process-globals": noProcessGlobalsRule,
     },
 };
 export default sisterSoftwarePlugin;

package/out/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAGjD,MAAM,oBAAoB,GAAW;IACpC,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACjC,KAAK,EAAE;QACN,qBAAqB,EAAE,UAAU;QACjC,eAAe,EAAE,WAAW;KAC5B;CACD,CAAA;AAED,eAAe,oBAAoB,CAAA"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAElE,MAAM,oBAAoB,GAAW;IACpC,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACjC,KAAK,EAAE;QACN,qBAAqB,EAAE,UAAU;QACjC,eAAe,EAAE,WAAW;QAC5B,gBAAgB,EAAE,UAAU;QAC5B,oBAAoB,EAAE,oBAAoB;KAC1C;CACD,CAAA;AAED,eAAe,oBAAoB,CAAA"}

package/out/process-globals-plugin.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @copyright Sister Software
+ * @license AGPL-3.0
+ * @author Teffen Ellis, et al.
+ * @file A no-process-globals rule, authored as an oxlint JS plugin (ESLint v9-compatible API). It
+ *   forbids direct `process.env` / `process.argv` access so those reads can be funneled through a
+ *   few blessed helpers; the helper files disable the rule (`sister-software/no-process-globals`).
+ *   oxlint has no `no-restricted-syntax`, so this is a small dedicated rule instead.
+ */
+import type { Rule } from "./plugin-types.js";
+export declare const noProcessGlobalsRule: Rule;
+export default noProcessGlobalsRule;
+//# sourceMappingURL=process-globals-plugin.d.ts.map

package/out/process-globals-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-globals-plugin.d.ts","sourceRoot":"","sources":["../src/process-globals-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,mBAAmB,CAAA;AA+BtD,eAAO,MAAM,oBAAoB,EAAE,IAwBlC,CAAA;AAED,eAAe,oBAAoB,CAAA"}

package/out/process-globals-plugin.js

@@ -0,0 +1,48 @@
+/**
+ * @copyright Sister Software
+ * @license AGPL-3.0
+ * @author Teffen Ellis, et al.
+ * @file A no-process-globals rule, authored as an oxlint JS plugin (ESLint v9-compatible API). It
+ *   forbids direct `process.env` / `process.argv` access so those reads can be funneled through a
+ *   few blessed helpers; the helper files disable the rule (`sister-software/no-process-globals`).
+ *   oxlint has no `no-restricted-syntax`, so this is a small dedicated rule instead.
+ */
+/** `process` members that must be reached through a blessed helper, not accessed directly. */
+const RESTRICTED_MEMBERS = new Set(["env", "argv"]);
+/** The accessed member name for `process.env` (identifier) or `process["env"]` (string literal). */
+function accessedMember(node) {
+    const property = node.property;
+    if (!property)
+        return null;
+    if (!node.computed && property.type === "Identifier")
+        return property.name ?? null;
+    if (node.computed && (property.type === "Literal" || property.type === "StringLiteral")) {
+        return typeof property.value === "string" ? property.value : null;
+    }
+    return null;
+}
+export const noProcessGlobalsRule = {
+    meta: {
+        name: "no-process-globals",
+        type: "problem",
+        schema: [{ type: "object", additionalProperties: true }],
+    },
+    create(context) {
+        return {
+            MemberExpression(node) {
+                const member = node;
+                if (member.object?.type !== "Identifier" || member.object.name !== "process")
+                    return;
+                const name = accessedMember(member);
+                if (!name || !RESTRICTED_MEMBERS.has(name))
+                    return;
+                context.report({
+                    node,
+                    message: `Direct \`process.${name}\` access is restricted — read it through the project's blessed helper (disable \`sister-software/no-process-globals\` there).`,
+                });
+            },
+        };
+    },
+};
+export default noProcessGlobalsRule;
+//# sourceMappingURL=process-globals-plugin.js.map

package/out/process-globals-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-globals-plugin.js","sourceRoot":"","sources":["../src/process-globals-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,8FAA8F;AAC9F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAanD,oGAAoG;AACpG,SAAS,cAAc,CAAC,IAAgB;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;IAE9B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAA;IAElF,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,CAAC;QACzF,OAAO,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,CAAC;IAED,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAS;IACzC,IAAI,EAAE;QACL,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;KACxD;IACD,MAAM,CAAC,OAAO;QACb,OAAO;YACN,gBAAgB,CAAC,IAAI;gBACpB,MAAM,MAAM,GAAG,IAAkB,CAAA;gBAEjC,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBAAE,OAAM;gBAEpF,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBAEnC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAM;gBAElD,OAAO,CAAC,MAAM,CAAC;oBACd,IAAI;oBACJ,OAAO,EAAE,oBAAoB,IAAI,gIAAgI;iBACjK,CAAC,CAAA;YACH,CAAC;SACD,CAAA;IACF,CAAC;CACD,CAAA;AAED,eAAe,oBAAoB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
  "name": "@sister.software/oxlint-config",
- "version": "9.1.0",
+ "version": "9.3.0",
  "description": "Sister Software's oxlint config",
  "license": "AGPL-3.0",
  "author": "teffen@sister.software",

package/src/braces-plugin.ts

@@ -0,0 +1,89 @@
+/**
+ * @copyright Sister Software
+ * @license AGPL-3.0
+ * @author Teffen Ellis, et al.
+ * @file A require-braces rule, authored as an oxlint JS plugin (ESLint v9-compatible API). It
+ *   requires braces around single-statement `if`/`else`/`for`/`while`/`do` bodies that do work
+ *   (assignments, calls, …) and autofixes by wrapping them — but leaves a bare control-flow terminal
+ *   (`return`/`throw`/`break`/`continue`) alone (braces optional). Unlike the built-in `curly` rule,
+ *   which can't exempt those.
+ */
+
+import type { AstNode, Rule } from "./plugin-types.js"
+
+/**
+ * Body node types that may stay brace-less: an existing block; a bare control-flow terminal
+ * (`return`/`throw`/`break`/`continue`, exempt by house style); or an empty statement (a different concern —
+ * `no-empty`).
+ */
+const EXEMPT_BODY_TYPES = new Set([
+	"BlockStatement",
+	"ReturnStatement",
+	"ThrowStatement",
+	"BreakStatement",
+	"ContinueStatement",
+	"EmptyStatement",
+])
+
+export const bracesRule: Rule = {
+	meta: {
+		name: "require-braces",
+		type: "layout",
+		fixable: "code",
+		schema: [{ type: "object", additionalProperties: true }],
+	},
+	create(context) {
+		const sourceCode = context.sourceCode ?? context.getSourceCode!()
+
+		function check(body: AstNode | null | undefined) {
+			if (!body || EXEMPT_BODY_TYPES.has(body.type)) return
+
+			// `else if (…)` — the alternate is itself an `if`; its own body is visited separately.
+			if (body.type === "IfStatement") return
+
+			const inner = sourceCode.getText().slice(body.range[0], body.range[1])
+
+			context.report({
+				node: body,
+				message: "Expected braces around this single-statement body.",
+				fix(fixer) {
+					// Wrap inline; oxfmt expands it to a formatted multi-line block afterward.
+					return fixer.replaceTextRange(body.range, `{ ${inner} }`)
+				},
+			})
+		}
+
+		return {
+			IfStatement(node) {
+				check(node.consequent)
+				check(node.alternate)
+			},
+			ForStatement(node) {
+				checkLoopBody(node)
+			},
+			ForInStatement(node) {
+				checkLoopBody(node)
+			},
+			ForOfStatement(node) {
+				checkLoopBody(node)
+			},
+			WhileStatement(node) {
+				checkLoopBody(node)
+			},
+			DoWhileStatement(node) {
+				checkLoopBody(node)
+			},
+		}
+
+		function checkLoopBody(node: AstNode) {
+			const body = node.body
+
+			// A loop body is a single statement (never a statement-list array).
+			if (body && !Array.isArray(body)) {
+				check(body)
+			}
+		}
+	},
+}
+
+export default bracesRule

package/src/index.ts

@@ -28,6 +28,13 @@ export interface OxlintConfigOptions {
 	headers?: boolean
 	/** Require a blank line before `return`/block-like statements (on by default). */
 	padding?: boolean
+	/** Require braces around single-statement work bodies (bare `return` exempt; on by default). */
+	braces?: boolean
+	/**
+	 * Forbid direct `process.env` / `process.argv` access (off by default). Turn on once the project funnels those reads
+	 * through blessed helpers, which disable `sister-software/no-process-globals`.
+	 */
+	restrictProcessGlobals?: boolean
 	/** Override the default ignore patterns. */
 	ignorePatterns?: string[]
 	/** Extra config deep-merged last; an escape hatch for per-repo tweaks. */
@@ -67,6 +74,8 @@ export function createOxlintConfig(options: OxlintConfigOptions = {}): OxlintCon
 		react = false,
 		headers = true,
 		padding = true,
+		braces = true,
+		restrictProcessGlobals = false,
 		ignorePatterns = DefaultIgnorePatterns,
 		overrides = {},
 	} = options
@@ -117,9 +126,21 @@ export function createOxlintConfig(options: OxlintConfigOptions = {}): OxlintCon
 		rules["sister-software/padding-lines"] = "warn"
 	}
 
+	if (braces) {
+		// Warning severity: a stylistic nudge (auto-fixable), not a hard CI gate.
+		rules["sister-software/require-braces"] = "warn"
+	}
+
+	if (restrictProcessGlobals) {
+		// Error severity: a governance gate — direct env/argv access should fail the lint.
+		rules["sister-software/no-process-globals"] = "error"
+	}
+
 	return {
 		plugins,
-		...(headers || padding ? { jsPlugins: ["@sister.software/oxlint-config/plugin"] } : {}),
+		...(headers || padding || braces || restrictProcessGlobals
+			? { jsPlugins: ["@sister.software/oxlint-config/plugin"] }
+			: {}),
 		categories: { correctness: "error" },
 		ignorePatterns,
 		rules,

package/src/plugin-types.ts

@@ -17,7 +17,11 @@ export interface AstNode {
 	type: string
 	range: [number, number]
 	parent?: AstNode
-	body?: AstNode[]
+	/** A statement-list body (block/program) is an array; a loop body is a single statement. */
+	body?: AstNode[] | AstNode
+	/** `if`/`else` branches, for the require-braces rule. */
+	consequent?: AstNode
+	alternate?: AstNode | null
 }
 
 export interface SourceCode {

package/src/plugin.ts

@@ -6,15 +6,19 @@
  *   names) exposing all of Sister Software's custom rules under the `sister-software/` namespace.
  */
 
+import { bracesRule } from "./braces-plugin.js"
 import { headerRule } from "./headers-plugin.js"
 import { paddingRule } from "./padding-plugin.js"
 import type { Plugin } from "./plugin-types.js"
+import { noProcessGlobalsRule } from "./process-globals-plugin.js"
 
 const sisterSoftwarePlugin: Plugin = {
 	meta: { name: "sister-software" },
 	rules: {
 		"require-file-header": headerRule,
 		"padding-lines": paddingRule,
+		"require-braces": bracesRule,
+		"no-process-globals": noProcessGlobalsRule,
 	},
 }
 

package/src/process-globals-plugin.ts

@@ -0,0 +1,68 @@
+/**
+ * @copyright Sister Software
+ * @license AGPL-3.0
+ * @author Teffen Ellis, et al.
+ * @file A no-process-globals rule, authored as an oxlint JS plugin (ESLint v9-compatible API). It
+ *   forbids direct `process.env` / `process.argv` access so those reads can be funneled through a
+ *   few blessed helpers; the helper files disable the rule (`sister-software/no-process-globals`).
+ *   oxlint has no `no-restricted-syntax`, so this is a small dedicated rule instead.
+ */
+
+import type { AstNode, Rule } from "./plugin-types.js"
+
+/** `process` members that must be reached through a blessed helper, not accessed directly. */
+const RESTRICTED_MEMBERS = new Set(["env", "argv"])
+
+interface Identifierish extends AstNode {
+	name?: string
+	value?: unknown
+}
+
+interface MemberNode extends AstNode {
+	object?: Identifierish
+	property?: Identifierish
+	computed?: boolean
+}
+
+/** The accessed member name for `process.env` (identifier) or `process["env"]` (string literal). */
+function accessedMember(node: MemberNode): string | null {
+	const property = node.property
+
+	if (!property) return null
+
+	if (!node.computed && property.type === "Identifier") return property.name ?? null
+
+	if (node.computed && (property.type === "Literal" || property.type === "StringLiteral")) {
+		return typeof property.value === "string" ? property.value : null
+	}
+
+	return null
+}
+
+export const noProcessGlobalsRule: Rule = {
+	meta: {
+		name: "no-process-globals",
+		type: "problem",
+		schema: [{ type: "object", additionalProperties: true }],
+	},
+	create(context) {
+		return {
+			MemberExpression(node) {
+				const member = node as MemberNode
+
+				if (member.object?.type !== "Identifier" || member.object.name !== "process") return
+
+				const name = accessedMember(member)
+
+				if (!name || !RESTRICTED_MEMBERS.has(name)) return
+
+				context.report({
+					node,
+					message: `Direct \`process.${name}\` access is restricted — read it through the project's blessed helper (disable \`sister-software/no-process-globals\` there).`,
+				})
+			},
+		}
+	},
+}
+
+export default noProcessGlobalsRule