@sister.software/oxlint-config 9.2.0 → 9.3.0

package/out/index.d.ts

@@ -25,6 +25,11 @@ export interface OxlintConfigOptions {
     padding?: boolean;
     /** Require braces around single-statement work bodies (bare `return` exempt; on by default). */
     braces?: boolean;
+    /**
+     * Forbid direct `process.env` / `process.argv` access (off by default). Turn on once the project funnels those reads
+     * through blessed helpers, which disable `sister-software/no-process-globals`.
+     */
+    restrictProcessGlobals?: boolean;
     /** Override the default ignore patterns. */
     ignorePatterns?: string[];
     /** Extra config deep-merged last; an escape hatch for per-repo tweaks. */

package/out/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,cAAc,mBAAmB,CAAA;AAEjC,4FAA4F;AAC5F,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAElD,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IACnC,4FAA4F;IAC5F,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,6DAA6D;IAC7D,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,kFAAkF;IAClF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gGAAgG;IAChG,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,YAAY,CAAA;CACxB;AAED,0DAA0D;AAC1D,eAAO,MAAM,qBAAqB,UAOjC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,YAAY,CA0ElF;AAED,eAAe,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,cAAc,mBAAmB,CAAA;AAEjC,4FAA4F;AAC5F,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAElD,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IACnC,4FAA4F;IAC5F,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,6DAA6D;IAC7D,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,kFAAkF;IAClF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gGAAgG;IAChG,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,YAAY,CAAA;CACxB;AAED,0DAA0D;AAC1D,eAAO,MAAM,qBAAqB,UAOjC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,YAAY,CAkFlF;AAED,eAAe,kBAAkB,CAAA"}

package/out/index.js

@@ -30,7 +30,7 @@ export const DefaultIgnorePatterns = [
  * @returns A complete oxlint config object (no `extends` required).
  */
 export function createOxlintConfig(options = {}) {
-    const { packageNamespace = "@sister.software", copyrightHolder = "Sister Software", spdxLicenseIdentifier = "UNLICENSED", author = "Teffen Ellis, et al.", react = false, headers = true, padding = true, braces = true, ignorePatterns = DefaultIgnorePatterns, overrides = {}, } = options;
+    const { packageNamespace = "@sister.software", copyrightHolder = "Sister Software", spdxLicenseIdentifier = "UNLICENSED", author = "Teffen Ellis, et al.", react = false, headers = true, padding = true, braces = true, restrictProcessGlobals = false, ignorePatterns = DefaultIgnorePatterns, overrides = {}, } = options;
     const plugins = ["typescript", "unicorn", "oxc", ...(react ? ["react"] : [])];
     const rules = {
         // JavaScript
@@ -76,9 +76,15 @@ export function createOxlintConfig(options = {}) {
         // Warning severity: a stylistic nudge (auto-fixable), not a hard CI gate.
         rules["sister-software/require-braces"] = "warn";
     }
+    if (restrictProcessGlobals) {
+        // Error severity: a governance gate — direct env/argv access should fail the lint.
+        rules["sister-software/no-process-globals"] = "error";
+    }
     return {
         plugins,
-        ...(headers || padding || braces ? { jsPlugins: ["@sister.software/oxlint-config/plugin"] } : {}),
+        ...(headers || padding || braces || restrictProcessGlobals
+            ? { jsPlugins: ["@sister.software/oxlint-config/plugin"] }
+            : {}),
         categories: { correctness: "error" },
         ignorePatterns,
         rules,

package/out/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,cAAc,mBAAmB,CAAA;AA6BjC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,iBAAiB;IACjB,aAAa;IACb,qBAAqB;CACrB,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA+B,EAAE;IACnE,MAAM,EACL,gBAAgB,GAAG,kBAAkB,EACrC,eAAe,GAAG,iBAAiB,EACnC,qBAAqB,GAAG,YAAY,EACpC,MAAM,GAAG,sBAAsB,EAC/B,KAAK,GAAG,KAAK,EACb,OAAO,GAAG,IAAI,EACd,OAAO,GAAG,IAAI,EACd,MAAM,GAAG,IAAI,EACb,cAAc,GAAG,qBAAqB,EACtC,SAAS,GAAG,EAAE,GACd,GAAG,OAAO,CAAA;IAEX,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAE7E,MAAM,KAAK,GAA4B;QACtC,aAAa;QACb,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC/C,cAAc,EAAE,MAAM;QACtB,kBAAkB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QACtC,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE;YACjB,MAAM;YACN;gBACC,IAAI,EAAE,KAAK;gBACX,iBAAiB,EAAE,IAAI;gBACvB,YAAY,EAAE,KAAK;gBACnB,yBAAyB,EAAE,IAAI;gBAC/B,8BAA8B,EAAE,IAAI;gBACpC,uFAAuF;gBACvF,gFAAgF;gBAChF,iBAAiB,EAAE,MAAM;gBACzB,kBAAkB,EAAE,IAAI;aACxB;SACD;QAED,2EAA2E;QAC3E,2BAA2B,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;QAChF,sBAAsB,EAAE,KAAK;QAC7B,+BAA+B,EAAE,KAAK;QACtC,4BAA4B,EAAE,KAAK;QACnC,2BAA2B,EAAE,KAAK;QAClC,kCAAkC,EAAE,KAAK;QACzC,4BAA4B,EAAE,KAAK;QACnC,+BAA+B,EAAE,KAAK;KACtC,CAAA;IAED,IAAI,OAAO,EAAE,CAAC;QACb,0FAA0F;QAC1F,oFAAoF;QACpF,KAAK,CAAC,qCAAqC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7G,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACb,0EAA0E;QAC1E,KAAK,CAAC,+BAA+B,CAAC,GAAG,MAAM,CAAA;IAChD,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACZ,0EAA0E;QAC1E,KAAK,CAAC,gCAAgC,CAAC,GAAG,MAAM,CAAA;IACjD,CAAC;IAED,OAAO;QACN,OAAO;QACP,GAAG,CAAC,OAAO,IAAI,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,UAAU,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;QACpC,cAAc;QACd,KAAK;QACL,SAAS,EAAE,sBAAsB,CAAC,gBAAgB,CAAC;QACnD,GAAG,SAAS;KACZ,CAAA;AACF,CAAC;AAED,eAAe,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,cAAc,mBAAmB,CAAA;AAkCjC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,iBAAiB;IACjB,aAAa;IACb,qBAAqB;CACrB,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA+B,EAAE;IACnE,MAAM,EACL,gBAAgB,GAAG,kBAAkB,EACrC,eAAe,GAAG,iBAAiB,EACnC,qBAAqB,GAAG,YAAY,EACpC,MAAM,GAAG,sBAAsB,EAC/B,KAAK,GAAG,KAAK,EACb,OAAO,GAAG,IAAI,EACd,OAAO,GAAG,IAAI,EACd,MAAM,GAAG,IAAI,EACb,sBAAsB,GAAG,KAAK,EAC9B,cAAc,GAAG,qBAAqB,EACtC,SAAS,GAAG,EAAE,GACd,GAAG,OAAO,CAAA;IAEX,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAE7E,MAAM,KAAK,GAA4B;QACtC,aAAa;QACb,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC/C,cAAc,EAAE,MAAM;QACtB,kBAAkB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QACtC,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE;YACjB,MAAM;YACN;gBACC,IAAI,EAAE,KAAK;gBACX,iBAAiB,EAAE,IAAI;gBACvB,YAAY,EAAE,KAAK;gBACnB,yBAAyB,EAAE,IAAI;gBAC/B,8BAA8B,EAAE,IAAI;gBACpC,uFAAuF;gBACvF,gFAAgF;gBAChF,iBAAiB,EAAE,MAAM;gBACzB,kBAAkB,EAAE,IAAI;aACxB;SACD;QAED,2EAA2E;QAC3E,2BAA2B,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;QAChF,sBAAsB,EAAE,KAAK;QAC7B,+BAA+B,EAAE,KAAK;QACtC,4BAA4B,EAAE,KAAK;QACnC,2BAA2B,EAAE,KAAK;QAClC,kCAAkC,EAAE,KAAK;QACzC,4BAA4B,EAAE,KAAK;QACnC,+BAA+B,EAAE,KAAK;KACtC,CAAA;IAED,IAAI,OAAO,EAAE,CAAC;QACb,0FAA0F;QAC1F,oFAAoF;QACpF,KAAK,CAAC,qCAAqC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7G,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACb,0EAA0E;QAC1E,KAAK,CAAC,+BAA+B,CAAC,GAAG,MAAM,CAAA;IAChD,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACZ,0EAA0E;QAC1E,KAAK,CAAC,gCAAgC,CAAC,GAAG,MAAM,CAAA;IACjD,CAAC;IAED,IAAI,sBAAsB,EAAE,CAAC;QAC5B,mFAAmF;QACnF,KAAK,CAAC,oCAAoC,CAAC,GAAG,OAAO,CAAA;IACtD,CAAC;IAED,OAAO;QACN,OAAO;QACP,GAAG,CAAC,OAAO,IAAI,OAAO,IAAI,MAAM,IAAI,sBAAsB;YACzD,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,uCAAuC,CAAC,EAAE;YAC1D,CAAC,CAAC,EAAE,CAAC;QACN,UAAU,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;QACpC,cAAc;QACd,KAAK;QACL,SAAS,EAAE,sBAAsB,CAAC,gBAAgB,CAAC;QACnD,GAAG,SAAS;KACZ,CAAA;AACF,CAAC;AAED,eAAe,kBAAkB,CAAA"}

package/out/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE/C,QAAA,MAAM,oBAAoB,EAAE,MAO3B,CAAA;AAED,eAAe,oBAAoB,CAAA"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAG/C,QAAA,MAAM,oBAAoB,EAAE,MAQ3B,CAAA;AAED,eAAe,oBAAoB,CAAA"}

package/out/plugin.js

@@ -8,12 +8,14 @@
 import { bracesRule } from "./braces-plugin.js";
 import { headerRule } from "./headers-plugin.js";
 import { paddingRule } from "./padding-plugin.js";
+import { noProcessGlobalsRule } from "./process-globals-plugin.js";
 const sisterSoftwarePlugin = {
     meta: { name: "sister-software" },
     rules: {
         "require-file-header": headerRule,
         "padding-lines": paddingRule,
         "require-braces": bracesRule,
+        "no-process-globals": noProcessGlobalsRule,
     },
 };
 export default sisterSoftwarePlugin;

package/out/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAGjD,MAAM,oBAAoB,GAAW;IACpC,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACjC,KAAK,EAAE;QACN,qBAAqB,EAAE,UAAU;QACjC,eAAe,EAAE,WAAW;QAC5B,gBAAgB,EAAE,UAAU;KAC5B;CACD,CAAA;AAED,eAAe,oBAAoB,CAAA"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAElE,MAAM,oBAAoB,GAAW;IACpC,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACjC,KAAK,EAAE;QACN,qBAAqB,EAAE,UAAU;QACjC,eAAe,EAAE,WAAW;QAC5B,gBAAgB,EAAE,UAAU;QAC5B,oBAAoB,EAAE,oBAAoB;KAC1C;CACD,CAAA;AAED,eAAe,oBAAoB,CAAA"}

package/out/process-globals-plugin.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @copyright Sister Software
+ * @license AGPL-3.0
+ * @author Teffen Ellis, et al.
+ * @file A no-process-globals rule, authored as an oxlint JS plugin (ESLint v9-compatible API). It
+ *   forbids direct `process.env` / `process.argv` access so those reads can be funneled through a
+ *   few blessed helpers; the helper files disable the rule (`sister-software/no-process-globals`).
+ *   oxlint has no `no-restricted-syntax`, so this is a small dedicated rule instead.
+ */
+import type { Rule } from "./plugin-types.js";
+export declare const noProcessGlobalsRule: Rule;
+export default noProcessGlobalsRule;
+//# sourceMappingURL=process-globals-plugin.d.ts.map

package/out/process-globals-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-globals-plugin.d.ts","sourceRoot":"","sources":["../src/process-globals-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,mBAAmB,CAAA;AA+BtD,eAAO,MAAM,oBAAoB,EAAE,IAwBlC,CAAA;AAED,eAAe,oBAAoB,CAAA"}

package/out/process-globals-plugin.js

@@ -0,0 +1,48 @@
+/**
+ * @copyright Sister Software
+ * @license AGPL-3.0
+ * @author Teffen Ellis, et al.
+ * @file A no-process-globals rule, authored as an oxlint JS plugin (ESLint v9-compatible API). It
+ *   forbids direct `process.env` / `process.argv` access so those reads can be funneled through a
+ *   few blessed helpers; the helper files disable the rule (`sister-software/no-process-globals`).
+ *   oxlint has no `no-restricted-syntax`, so this is a small dedicated rule instead.
+ */
+/** `process` members that must be reached through a blessed helper, not accessed directly. */
+const RESTRICTED_MEMBERS = new Set(["env", "argv"]);
+/** The accessed member name for `process.env` (identifier) or `process["env"]` (string literal). */
+function accessedMember(node) {
+    const property = node.property;
+    if (!property)
+        return null;
+    if (!node.computed && property.type === "Identifier")
+        return property.name ?? null;
+    if (node.computed && (property.type === "Literal" || property.type === "StringLiteral")) {
+        return typeof property.value === "string" ? property.value : null;
+    }
+    return null;
+}
+export const noProcessGlobalsRule = {
+    meta: {
+        name: "no-process-globals",
+        type: "problem",
+        schema: [{ type: "object", additionalProperties: true }],
+    },
+    create(context) {
+        return {
+            MemberExpression(node) {
+                const member = node;
+                if (member.object?.type !== "Identifier" || member.object.name !== "process")
+                    return;
+                const name = accessedMember(member);
+                if (!name || !RESTRICTED_MEMBERS.has(name))
+                    return;
+                context.report({
+                    node,
+                    message: `Direct \`process.${name}\` access is restricted — read it through the project's blessed helper (disable \`sister-software/no-process-globals\` there).`,
+                });
+            },
+        };
+    },
+};
+export default noProcessGlobalsRule;
+//# sourceMappingURL=process-globals-plugin.js.map

package/out/process-globals-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-globals-plugin.js","sourceRoot":"","sources":["../src/process-globals-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,8FAA8F;AAC9F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAanD,oGAAoG;AACpG,SAAS,cAAc,CAAC,IAAgB;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;IAE9B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAA;IAElF,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,CAAC;QACzF,OAAO,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,CAAC;IAED,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAS;IACzC,IAAI,EAAE;QACL,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;KACxD;IACD,MAAM,CAAC,OAAO;QACb,OAAO;YACN,gBAAgB,CAAC,IAAI;gBACpB,MAAM,MAAM,GAAG,IAAkB,CAAA;gBAEjC,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBAAE,OAAM;gBAEpF,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBAEnC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAM;gBAElD,OAAO,CAAC,MAAM,CAAC;oBACd,IAAI;oBACJ,OAAO,EAAE,oBAAoB,IAAI,gIAAgI;iBACjK,CAAC,CAAA;YACH,CAAC;SACD,CAAA;IACF,CAAC;CACD,CAAA;AAED,eAAe,oBAAoB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
  "name": "@sister.software/oxlint-config",
- "version": "9.2.0",
+ "version": "9.3.0",
  "description": "Sister Software's oxlint config",
  "license": "AGPL-3.0",
  "author": "teffen@sister.software",

package/src/index.ts

@@ -30,6 +30,11 @@ export interface OxlintConfigOptions {
 	padding?: boolean
 	/** Require braces around single-statement work bodies (bare `return` exempt; on by default). */
 	braces?: boolean
+	/**
+	 * Forbid direct `process.env` / `process.argv` access (off by default). Turn on once the project funnels those reads
+	 * through blessed helpers, which disable `sister-software/no-process-globals`.
+	 */
+	restrictProcessGlobals?: boolean
 	/** Override the default ignore patterns. */
 	ignorePatterns?: string[]
 	/** Extra config deep-merged last; an escape hatch for per-repo tweaks. */
@@ -70,6 +75,7 @@ export function createOxlintConfig(options: OxlintConfigOptions = {}): OxlintCon
 		headers = true,
 		padding = true,
 		braces = true,
+		restrictProcessGlobals = false,
 		ignorePatterns = DefaultIgnorePatterns,
 		overrides = {},
 	} = options
@@ -125,9 +131,16 @@ export function createOxlintConfig(options: OxlintConfigOptions = {}): OxlintCon
 		rules["sister-software/require-braces"] = "warn"
 	}
 
+	if (restrictProcessGlobals) {
+		// Error severity: a governance gate — direct env/argv access should fail the lint.
+		rules["sister-software/no-process-globals"] = "error"
+	}
+
 	return {
 		plugins,
-		...(headers || padding || braces ? { jsPlugins: ["@sister.software/oxlint-config/plugin"] } : {}),
+		...(headers || padding || braces || restrictProcessGlobals
+			? { jsPlugins: ["@sister.software/oxlint-config/plugin"] }
+			: {}),
 		categories: { correctness: "error" },
 		ignorePatterns,
 		rules,

package/src/plugin.ts

@@ -10,6 +10,7 @@ import { bracesRule } from "./braces-plugin.js"
 import { headerRule } from "./headers-plugin.js"
 import { paddingRule } from "./padding-plugin.js"
 import type { Plugin } from "./plugin-types.js"
+import { noProcessGlobalsRule } from "./process-globals-plugin.js"
 
 const sisterSoftwarePlugin: Plugin = {
 	meta: { name: "sister-software" },
@@ -17,6 +18,7 @@ const sisterSoftwarePlugin: Plugin = {
 		"require-file-header": headerRule,
 		"padding-lines": paddingRule,
 		"require-braces": bracesRule,
+		"no-process-globals": noProcessGlobalsRule,
 	},
 }
 

package/src/process-globals-plugin.ts

@@ -0,0 +1,68 @@
+/**
+ * @copyright Sister Software
+ * @license AGPL-3.0
+ * @author Teffen Ellis, et al.
+ * @file A no-process-globals rule, authored as an oxlint JS plugin (ESLint v9-compatible API). It
+ *   forbids direct `process.env` / `process.argv` access so those reads can be funneled through a
+ *   few blessed helpers; the helper files disable the rule (`sister-software/no-process-globals`).
+ *   oxlint has no `no-restricted-syntax`, so this is a small dedicated rule instead.
+ */
+
+import type { AstNode, Rule } from "./plugin-types.js"
+
+/** `process` members that must be reached through a blessed helper, not accessed directly. */
+const RESTRICTED_MEMBERS = new Set(["env", "argv"])
+
+interface Identifierish extends AstNode {
+	name?: string
+	value?: unknown
+}
+
+interface MemberNode extends AstNode {
+	object?: Identifierish
+	property?: Identifierish
+	computed?: boolean
+}
+
+/** The accessed member name for `process.env` (identifier) or `process["env"]` (string literal). */
+function accessedMember(node: MemberNode): string | null {
+	const property = node.property
+
+	if (!property) return null
+
+	if (!node.computed && property.type === "Identifier") return property.name ?? null
+
+	if (node.computed && (property.type === "Literal" || property.type === "StringLiteral")) {
+		return typeof property.value === "string" ? property.value : null
+	}
+
+	return null
+}
+
+export const noProcessGlobalsRule: Rule = {
+	meta: {
+		name: "no-process-globals",
+		type: "problem",
+		schema: [{ type: "object", additionalProperties: true }],
+	},
+	create(context) {
+		return {
+			MemberExpression(node) {
+				const member = node as MemberNode
+
+				if (member.object?.type !== "Identifier" || member.object.name !== "process") return
+
+				const name = accessedMember(member)
+
+				if (!name || !RESTRICTED_MEMBERS.has(name)) return
+
+				context.report({
+					node,
+					message: `Direct \`process.${name}\` access is restricted — read it through the project's blessed helper (disable \`sister-software/no-process-globals\` there).`,
+				})
+			},
+		}
+	},
+}
+
+export default noProcessGlobalsRule