@ttsc/lint 0.10.2 → 0.11.0-dev.20260518

package/{plugin → linthost}/config.go

@@ -1,15 +1,29 @@
-package main
+package linthost
 
 import (
+  "bytes"
+  "context"
   "encoding/json"
   "fmt"
   "os"
   "os/exec"
   "path/filepath"
+  "runtime"
   "sort"
   "strings"
+  "sync"
+  "time"
 )
 
+// configLoaderTimeout caps every `ttsx`/`node -e` subprocess that
+// evaluates a user-supplied lint config. The JS factory imposes the
+// same 60 s budget on its mirroring spawnSync; without the Go-side cap
+// a runaway user config would hang `ttsc-lint` forever, while
+// `ttsc`/`pnpm` upstream of it stays responsive. 60 s is generous
+// enough for cold ttsx starts on CI runners and tight enough to keep
+// user-visible feedback under a minute.
+const configLoaderTimeout = 60 * time.Second
+
 // Severity is the `error | warning | off` ladder.
 type Severity int
 
@@ -69,6 +83,13 @@ func FindLintEntry(entries []PluginEntry) (*PluginEntry, error) {
 // rule name (e.g. "no-var").
 type RuleConfig map[string]Severity
 
+// RuleOptionsMap captures the rule-specific options blob, keyed by rule
+// name. Severity-only rules never appear here. The values are the raw
+// JSON the user wrote in the second tuple slot of an ESLint-style
+// `["error", { ... }]` setting; each rule decodes the blob into its own
+// option struct on demand.
+type RuleOptionsMap map[string]json.RawMessage
+
 // ResolvedRuleConfig is the rule map that applies to one source file.
 // `Ignored` means an external ESLint-style ignore-only config matched the
 // file and the engine should skip linting it entirely.
@@ -81,6 +102,10 @@ type RuleResolver interface {
   ResolveRules(fileName string) ResolvedRuleConfig
   ActiveRuleNames() []string
   EnabledRuleConfig() RuleConfig
+  // RuleOptions returns the raw JSON options for `name`, or nil when the
+  // rule was configured with a severity alone. Returns nil for unknown
+  // rule names too — rules treat that as "use defaults".
+  RuleOptions(name string) json.RawMessage
 }
 
 func (c RuleConfig) ResolveRules(string) ResolvedRuleConfig {
@@ -101,11 +126,57 @@ func (c RuleConfig) EnabledRuleConfig() RuleConfig {
   return out
 }
 
+// RuleOptions on a bare RuleConfig is always nil — this form is the
+// severity-only path used by Go unit tests and the legacy inline-rules
+// surface that predates option support.
+func (RuleConfig) RuleOptions(string) json.RawMessage { return nil }
+
+// InlineRuleResolver pairs a severity map with an options map for
+// tsconfig-inline rule blocks. The fields are public so tests can
+// construct one without going through ParseRulesWithOptions.
+type InlineRuleResolver struct {
+  Rules   RuleConfig
+  Options RuleOptionsMap
+}
+
+func (r InlineRuleResolver) ResolveRules(string) ResolvedRuleConfig {
+  return ResolvedRuleConfig{Rules: r.Rules}
+}
+
+func (r InlineRuleResolver) ActiveRuleNames() []string {
+  return r.Rules.ActiveRuleNames()
+}
+
+func (r InlineRuleResolver) EnabledRuleConfig() RuleConfig {
+  return r.Rules.EnabledRuleConfig()
+}
+
+func (r InlineRuleResolver) RuleOptions(name string) json.RawMessage {
+  if r.Options == nil {
+    return nil
+  }
+  return r.Options[name]
+}
+
 type ConfigStore struct {
   entries               []ConfigEntry
   externalConfigPath    string
   eslintRuntime         bool
   eslintRuntimeRequired bool
+  // options is a flat rule-name → JSON map. Options are not scoped by
+  // `files` / `ignores`: a rule's behavior is a single project-wide
+  // configuration even when its severity is per-file. The simplification
+  // matches prettier-style options (one setting per project) while
+  // keeping severity layering intact.
+  options RuleOptionsMap
+}
+
+// RuleOptions implements RuleResolver.RuleOptions on ConfigStore.
+func (s *ConfigStore) RuleOptions(name string) json.RawMessage {
+  if s == nil {
+    return nil
+  }
+  return s.options[name]
 }
 
 type ConfigEntry struct {
@@ -242,22 +313,77 @@ func (e ConfigEntry) matchesIgnores(fileName string) bool {
 // Anything else returns an error (no silent fallback — typos in a rule
 // severity should be loud).
 func ParseRules(raw any) (RuleConfig, error) {
+  cfg, _, err := ParseRulesWithOptions(raw)
+  return cfg, err
+}
+
+// ParseRulesWithOptions accepts either a severity literal or a
+// `[severity, options]` tuple per rule and returns the severity map
+// alongside an options map keyed by rule name. The options map only
+// contains entries for rules whose configuration was the tuple form.
+func ParseRulesWithOptions(raw any) (RuleConfig, RuleOptionsMap, error) {
   if raw == nil {
-    return RuleConfig{}, nil
+    return RuleConfig{}, RuleOptionsMap{}, nil
   }
   dict, ok := raw.(map[string]any)
   if !ok {
-    return nil, fmt.Errorf("@ttsc/lint: \"config\" must be an object, got %T", raw)
+    return nil, nil, fmt.Errorf("@ttsc/lint: \"config\" must be an object, got %T", raw)
   }
-  out := make(RuleConfig, len(dict))
+  cfg := make(RuleConfig, len(dict))
+  opts := make(RuleOptionsMap)
   for name, value := range dict {
-    sev, err := parseSeverity(value)
+    sev, raw, err := parseRuleEntry(value)
     if err != nil {
-      return nil, fmt.Errorf("@ttsc/lint: rule %q: %w", name, err)
+      return nil, nil, fmt.Errorf("@ttsc/lint: rule %q: %w", name, err)
+    }
+    cfg[name] = sev
+    if len(raw) > 0 {
+      opts[name] = raw
     }
-    out[name] = sev
   }
-  return out, nil
+  return cfg, opts, nil
+}
+
+// parseRuleEntry splits an ESLint-shaped rule entry into its severity
+// and (optional) options payload. Bare severity literals produce a nil
+// options blob; `[severity]` (no options) does the same; `[severity,
+// options]` re-serializes the options to JSON so each rule can decode it
+// into its own struct later.
+func parseRuleEntry(value any) (Severity, json.RawMessage, error) {
+  if tuple, ok := value.([]any); ok {
+    if len(tuple) == 0 {
+      return SeverityOff, nil, fmt.Errorf("severity tuple must not be empty")
+    }
+    sev, err := parseSeverity(tuple[0])
+    if err != nil {
+      return SeverityOff, nil, err
+    }
+    if len(tuple) == 1 {
+      return sev, nil, nil
+    }
+    if len(tuple) > 2 {
+      return SeverityOff, nil, fmt.Errorf("severity tuple must be [severity] or [severity, options], got %d elements", len(tuple))
+    }
+    if tuple[1] == nil {
+      return sev, nil, nil
+    }
+    if _, ok := tuple[1].(map[string]any); !ok {
+      // ESLint accepts string-typed positional options as a shorthand
+      // (e.g. `["error", "single"]` for the `quotes` rule). ttsc does
+      // not: every option struct in TtscLintRuleOptions is an object,
+      // and silently encoding a non-object slot would land in
+      // DecodeOptions as a decode error that every rule discards. Fail
+      // loudly so users discover the proper `["error", { … }]` form.
+      return SeverityOff, nil, fmt.Errorf("severity tuple's options slot must be an object, got %T", tuple[1])
+    }
+    encoded, err := json.Marshal(tuple[1])
+    if err != nil {
+      return SeverityOff, nil, fmt.Errorf("encode options: %w", err)
+    }
+    return sev, encoded, nil
+  }
+  sev, err := parseSeverity(value)
+  return sev, nil, err
 }
 
 func parseExternalConfigRules(raw any) (RuleConfig, error) {
@@ -331,8 +457,43 @@ func collectExternalConfigEntries(store *ConfigStore, raw any, baseDir, path str
       if err != nil {
         return err
       }
-      if rules, ok := typed["rules"]; ok {
-        parsed, err := parseExternalRuleMap(rules, path+".rules")
+      rulesValue, hasRules := typed["rules"]
+      formatValue, hasFormat := typed["format"]
+      if hasRules || hasFormat {
+        // Expand the format block (if any) into a rules-shaped map,
+        // then overlay any explicit `rules` entries. `rules`-wins
+        // semantics match the inline path; the conflict-resolution
+        // table is identical regardless of which surface a user
+        // chose.
+        var formatRulesRaw map[string]any
+        if hasFormat {
+          fmtMap, ok := formatValue.(map[string]any)
+          if !ok {
+            return fmt.Errorf("@ttsc/lint: %s.format must be an object, got %T", path, formatValue)
+          }
+          expanded, err := expandFormatBlock(fmtMap)
+          if err != nil {
+            return err
+          }
+          formatRulesRaw = expanded
+        }
+        var rulesMap map[string]any
+        if hasRules {
+          // `parseExternalRuleMapInto` accepts the raw map directly.
+          // Coerce here to feed the same merge pipeline as the
+          // inline path.
+          typedMap, ok := rulesValue.(map[string]any)
+          if !ok {
+            return fmt.Errorf("@ttsc/lint: %s.rules must be a rule severity map, got %T", path, rulesValue)
+          }
+          rulesMap = typedMap
+        }
+        merged := mergeRuleMaps(formatRulesRaw, rulesMap)
+        if len(merged) == 0 {
+          // `format: { severity: "off" }` and no rules — drop entry.
+          return nil
+        }
+        parsed, err := parseExternalRuleMapInto(merged, path+".rules", store)
         if err != nil {
           return err
         }
@@ -353,7 +514,7 @@ func collectExternalConfigEntries(store *ConfigStore, raw any, baseDir, path str
       }
       return nil
     }
-    parsed, err := parseExternalRuleMap(typed, path)
+    parsed, err := parseExternalRuleMapInto(typed, path, store)
     if err != nil {
       return err
     }
@@ -394,25 +555,38 @@ func collectExternalExtends(store *ConfigStore, raw any, baseDir, path string, a
   }
 }
 
-func parseExternalRuleMap(raw any, path string) (RuleConfig, error) {
+// parseExternalRuleMapInto parses the rules map and folds any
+// option blobs into `store.options`. Used by entry-creation paths so
+// the store ends with a unified options map for RuleResolver consumers.
+func parseExternalRuleMapInto(raw any, path string, store *ConfigStore) (RuleConfig, error) {
   out := RuleConfig{}
-  if err := collectExternalRuleMap(out, raw, path); err != nil {
+  if store.options == nil {
+    store.options = RuleOptionsMap{}
+  }
+  if err := collectExternalRuleMapWithOptions(out, store.options, raw, path); err != nil {
     return nil, err
   }
   return out, nil
 }
 
-func collectExternalRuleMap(out RuleConfig, raw any, path string) error {
+// collectExternalRuleMapWithOptions also records the rule's options blob
+// when the entry is a `[severity, options]` tuple. `opts` may be nil
+// when the caller does not need option capture (legacy paths).
+func collectExternalRuleMapWithOptions(out RuleConfig, opts RuleOptionsMap, raw any, path string) error {
   dict, ok := raw.(map[string]any)
   if !ok {
     return fmt.Errorf("@ttsc/lint: %s must be a rules object, got %T", path, raw)
   }
   for name, value := range dict {
-    sev, err := parseExternalSeverity(value)
+    sev, ruleOpts, err := parseExternalRuleEntry(value)
     if err != nil {
       return fmt.Errorf("@ttsc/lint: rule %q: %w", name, err)
     }
-    out[normalizeExternalRuleName(name)] = sev
+    canonical := normalizeExternalRuleName(name)
+    out[canonical] = sev
+    if opts != nil && len(ruleOpts) > 0 {
+      opts[canonical] = ruleOpts
+    }
   }
   return nil
 }
@@ -422,6 +596,7 @@ func isESLintConfigObject(value map[string]any) bool {
     "basePath",
     "extends",
     "files",
+    "format",
     "ignores",
     "languageOptions",
     "linterOptions",
@@ -443,7 +618,6 @@ func hasESLintRuntimeFields(value map[string]any) bool {
   for _, key := range []string{
     "languageOptions",
     "linterOptions",
-    "plugins",
     "processor",
     "settings",
   } {
@@ -451,9 +625,71 @@ func hasESLintRuntimeFields(value map[string]any) bool {
       return true
     }
   }
+  if plugins, ok := value["plugins"]; ok {
+    if !isNativePluginMap(plugins) {
+      return true
+    }
+  }
   return false
 }
 
+// isNativePluginMap reports whether every entry in a flat-config
+// `plugins` map points at a ttsc-lint native contributor object
+// (carrying a non-empty string `source` field). Native contributors are
+// compiled into the lint binary at build time and require no JS ESLint
+// runtime; only mixed or pure-ESLint plugin maps require the runtime
+// fallback.
+func isNativePluginMap(value any) bool {
+  dict, ok := value.(map[string]any)
+  if !ok {
+    return false
+  }
+  if len(dict) == 0 {
+    return true
+  }
+  for _, entry := range dict {
+    if !isNativePluginValue(entry) {
+      return false
+    }
+  }
+  return true
+}
+
+func isNativePluginValue(entry any) bool {
+  if entry == nil {
+    return false
+  }
+  switch typed := entry.(type) {
+  case string:
+    // A non-empty string is a native npm specifier (matching the JS
+    // factory's `normalizePluginValue` contract for `.js`/`.cjs`/`.ts`
+    // configs and the JSON-only `readJsonConfigPlugins` path). The JS
+    // factory resolves the specifier at load time and bakes the
+    // contributor into the binary, so the Go sidecar should not flip
+    // `eslintRuntimeRequired` for a file that already declared a
+    // native specifier.
+    return typed != ""
+  case map[string]any:
+    // Walk ESM-from-CJS `.default` indirection so a contributor authored
+    // as `export default plugin` registers as native here, matching the
+    // JS factory's `extractPluginSource` behavior.
+    current := typed
+    for i := 0; i < 4; i++ {
+      if source, ok := current["source"].(string); ok && source != "" {
+        return true
+      }
+      next, ok := current["default"].(map[string]any)
+      if !ok {
+        return false
+      }
+      current = next
+    }
+    return false
+  default:
+    return false
+  }
+}
+
 func normalizeExternalRuleName(name string) string {
   name = strings.TrimPrefix(name, "@typescript-eslint/")
   return strings.TrimPrefix(name, "typescript-eslint/")
@@ -506,10 +742,22 @@ func LoadRuleConfig(entry *PluginEntry, cwd, tsconfigPath string) (RuleConfig, e
   }
 }
 
-// LoadConfigResolver resolves one plugin entry into the engine-facing config
-// model. Inline `config` remains the native flat rule map. External config
-// files may carry ESLint flat-config-style file globs, ignores, object
-// extends, and rule severity tuples.
+// LoadConfigResolver resolves one plugin entry into the engine-facing
+// config model.
+//
+// Two equivalent input shapes are accepted:
+//
+//   - `rules` (inline severity map) + `extends` (config file path) —
+//     the canonical fields mirroring ESLint flat-config vocabulary.
+//   - `config` (legacy) — accepts the same string-or-map values but
+//     emits a one-time stderr deprecation notice. Removed in a future
+//     minor.
+//
+// `rules` and `extends` are mutually exclusive on a single plugin
+// entry; mixing legacy `config` with either new field is rejected.
+// `configFile` and `configPath` remain reserved keywords surfaced with
+// a hint pointing at `extends`, in case a user mistakenly reaches for
+// either spelling.
 func LoadConfigResolver(entry *PluginEntry, cwd, tsconfigPath string) (RuleResolver, error) {
   if entry == nil {
     return RuleConfig{}, nil
@@ -518,35 +766,124 @@ func LoadConfigResolver(entry *PluginEntry, cwd, tsconfigPath string) (RuleResol
   if inline == nil {
     inline = map[string]any{}
   }
-  for _, key := range []string{"rules", "configFile", "configPath"} {
+  for _, key := range []string{"configFile", "configPath"} {
     if _, ok := inline[key]; ok {
-      return nil, fmt.Errorf("@ttsc/lint: %q is not supported; use \"config\"", key)
+      return nil, fmt.Errorf("@ttsc/lint: %q is not supported; use \"extends\"", key)
     }
   }
 
-  value, ok := inline["config"]
-  if !ok {
-    discovered, err := findLintConfigFile(cwd, tsconfigPath)
+  rulesValue, hasRules := inline["rules"]
+  extendsValue, hasExtends := inline["extends"]
+  legacyValue, hasLegacy := inline["config"]
+  formatValue, hasFormat := inline["format"]
+
+  if hasLegacy && (hasRules || hasExtends || hasFormat) {
+    sibling := ""
+    switch {
+    case hasFormat && !hasRules && !hasExtends:
+      sibling = "format"
+    case hasExtends && !hasRules && !hasFormat:
+      sibling = "extends"
+    case hasRules && !hasExtends && !hasFormat:
+      sibling = "rules"
+    default:
+      sibling = "rules/extends/format"
+    }
+    return nil, fmt.Errorf("@ttsc/lint: tsconfig plugin entry mixes legacy \"config\" with the new %q field; remove \"config\" (deprecated)", sibling)
+  }
+  if hasRules && hasExtends {
+    return nil, fmt.Errorf("@ttsc/lint: \"rules\" and \"extends\" cannot be combined on a single plugin entry; put base rules in the \"extends\" file and inline overrides in lint.config.ts itself")
+  }
+  if hasFormat && hasExtends {
+    return nil, fmt.Errorf("@ttsc/lint: \"format\" and \"extends\" cannot be combined on a single plugin entry; put format options inside the extends-target lint.config.ts instead")
+  }
+
+  // Expand the format block (if any) into a rules-shaped map. The
+  // returned map is empty when `format.severity === "off"` so the
+  // downstream merge with `rules` still produces the right result.
+  var formatRulesRaw map[string]any
+  if hasFormat {
+    formatMap, ok := formatValue.(map[string]any)
+    if !ok {
+      return nil, fmt.Errorf("@ttsc/lint: \"format\" must be an object, got %T", formatValue)
+    }
+    expanded, err := expandFormatBlock(formatMap)
     if err != nil {
       return nil, err
     }
-    if discovered == "" {
-      return nil, fmt.Errorf("@ttsc/lint: \"config\" is required when no lint.config.*, ttsc-lint.config.*, or supported eslint.config.* file can be discovered")
+    formatRulesRaw = expanded
+  }
+
+  if hasRules || hasFormat {
+    // Merge format defaults with inline rule overrides; the `rules`
+    // entry wins on key collisions (more explicit surface).
+    var rulesMap map[string]any
+    if hasRules {
+      typed, ok := rulesValue.(map[string]any)
+      if !ok {
+        return nil, fmt.Errorf("@ttsc/lint: \"rules\" must be a rule severity map, got %T", rulesValue)
+      }
+      rulesMap = typed
+    }
+    merged := mergeRuleMaps(formatRulesRaw, rulesMap)
+    if len(merged) == 0 {
+      // `format: { severity: "off" }` with no `rules` field — no
+      // rules to register.
+      return InlineRuleResolver{Rules: RuleConfig{}, Options: RuleOptionsMap{}}, nil
+    }
+    cfg, opts, err := ParseRulesWithOptions(merged)
+    if err != nil {
+      return nil, err
     }
-    return loadExternalConfigResolver(discovered)
+    return InlineRuleResolver{Rules: cfg, Options: opts}, nil
   }
-  switch typed := value.(type) {
-  case string:
-    if strings.TrimSpace(typed) == "" {
-      return nil, fmt.Errorf("@ttsc/lint: \"config\" must not be empty")
+  if hasExtends {
+    extendsStr, ok := extendsValue.(string)
+    if !ok {
+      return nil, fmt.Errorf("@ttsc/lint: \"extends\" must be a string path, got %T", extendsValue)
+    }
+    if strings.TrimSpace(extendsStr) == "" {
+      return nil, fmt.Errorf("@ttsc/lint: \"extends\" must not be empty")
     }
-    location := resolveConfigFilePath(typed, cwd, tsconfigPath)
+    location := resolveConfigFilePath(extendsStr, cwd, tsconfigPath)
     return loadExternalConfigResolver(location)
-  case map[string]any:
-    return ParseRules(typed)
-  default:
-    return nil, fmt.Errorf("@ttsc/lint: \"config\" must be a string path or object, got %T", value)
   }
+  if hasLegacy {
+    emitLegacyConfigDeprecation()
+    switch typed := legacyValue.(type) {
+    case string:
+      if strings.TrimSpace(typed) == "" {
+        return nil, fmt.Errorf("@ttsc/lint: legacy \"config\" must not be empty")
+      }
+      location := resolveConfigFilePath(typed, cwd, tsconfigPath)
+      return loadExternalConfigResolver(location)
+    case map[string]any:
+      cfg, opts, err := ParseRulesWithOptions(typed)
+      if err != nil {
+        return nil, err
+      }
+      return InlineRuleResolver{Rules: cfg, Options: opts}, nil
+    default:
+      return nil, fmt.Errorf("@ttsc/lint: legacy \"config\" must be a string path or object, got %T", legacyValue)
+    }
+  }
+
+  discovered, err := findLintConfigFile(cwd, tsconfigPath)
+  if err != nil {
+    return nil, err
+  }
+  if discovered == "" {
+    return nil, fmt.Errorf("@ttsc/lint: \"rules\" or \"extends\" is required when no lint.config.*, ttsc-lint.config.*, or supported eslint.config.* file can be discovered (searched upward from %s)", cwd)
+  }
+  return loadExternalConfigResolver(discovered)
+}
+
+var legacyConfigDeprecationOnce sync.Once
+
+func emitLegacyConfigDeprecation() {
+  legacyConfigDeprecationOnce.Do(func() {
+    fmt.Fprintln(os.Stderr, "@ttsc/lint: tsconfig plugin entry \"config\" is deprecated; use \"rules\" for inline severity maps or \"extends\" for a config file path.")
+  })
 }
 
 func loadExternalConfigResolver(location string) (RuleResolver, error) {
@@ -594,7 +931,11 @@ func findLintConfigFile(cwd, tsconfigPath string) (string, error) {
       }
     }
     if len(matches) > 1 {
-      return "", fmt.Errorf("@ttsc/lint: multiple lint config files found in %s; set \"config\" explicitly", dir)
+      names := make([]string, 0, len(matches))
+      for _, m := range matches {
+        names = append(names, filepath.Base(m))
+      }
+      return "", fmt.Errorf("@ttsc/lint: multiple lint config files found in %s (%s); set \"extends\" explicitly", dir, strings.Join(names, ", "))
     }
     if len(matches) == 1 {
       return matches[0], nil
@@ -655,6 +996,11 @@ func loadJSONConfigFile(location string) (any, error) {
   if err != nil {
     return nil, fmt.Errorf("@ttsc/lint: read config file %s: %w", location, err)
   }
+  // Strip a leading UTF-8 BOM so files saved by Windows editors round
+  // trip through `json.Unmarshal` without an opaque "invalid character"
+  // failure. Mirrors the equivalent JS-side guard in
+  // `packages/lint/src/index.ts::readJsonConfigPlugins`.
+  body = bytes.TrimPrefix(body, []byte{0xEF, 0xBB, 0xBF})
   var out any
   if err := json.Unmarshal(body, &out); err != nil {
     return nil, fmt.Errorf("@ttsc/lint: parse config file %s: %w", location, err)
@@ -671,8 +1017,26 @@ const { pathToFileURL } = require("node:url");
 
 (async () => {
   const mod = await import(pathToFileURL(process.argv[1]).href);
-  const candidate = mod.default ?? mod.config ?? mod;
-  const value = typeof candidate === "function" ? await candidate() : candidate;
+  let current = mod;
+  let allowNamedConfig = true;
+  // Match the 8-hop walk used by the TypeScript loader at
+  // ` + "`" + `typeScriptConfigLoaderSource` + "`" + ` so doubly-wrapped CJS/ESM
+  // interop (e.g. ` + "`" + `{default:{default:config}}` + "`" + `) is resolved
+  // consistently across .js/.cjs/.mjs and .ts/.cts/.mts loaders.
+  for (let i = 0; i < 8; i++) {
+    if (current !== null && typeof current === "object" && Object.prototype.hasOwnProperty.call(current, "default")) {
+      current = current.default;
+      allowNamedConfig = false;
+      continue;
+    }
+    if (allowNamedConfig && current !== null && typeof current === "object" && Object.prototype.hasOwnProperty.call(current, "config")) {
+      current = current.config;
+      allowNamedConfig = false;
+      continue;
+    }
+    break;
+  }
+  const value = typeof current === "function" ? await current() : current;
   if (value === null || typeof value !== "object") {
     throw new Error("config file must export an object or flat config array");
   }
@@ -753,22 +1117,57 @@ function isESLintConfigObject(value) {
 }
 
 function hasESLintRuntimeFields(value) {
-  return [
-    "languageOptions",
-    "linterOptions",
-    "plugins",
-    "processor",
-    "settings",
-  ].some((key) => Object.prototype.hasOwnProperty.call(value, key));
+  for (const key of ["languageOptions", "linterOptions", "processor", "settings"]) {
+    if (Object.prototype.hasOwnProperty.call(value, key)) return true;
+  }
+  if (Object.prototype.hasOwnProperty.call(value, "plugins")) {
+    if (!isNativePluginMap(value.plugins)) return true;
+  }
+  return false;
+}
+
+function isNativePluginMap(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const entries = Object.values(value);
+  if (entries.length === 0) return true;
+  for (const entry of entries) {
+    if (!isNativePluginValue(entry)) return false;
+  }
+  return true;
+}
+
+function isNativePluginValue(entry) {
+  // A non-empty string is a native specifier — JS factory resolves it
+  // at load time, so the loader must not flip the ESLint-runtime flag.
+  if (typeof entry === "string") return entry.length > 0;
+  if (entry === null || typeof entry !== "object") return false;
+  let current = entry;
+  for (let i = 0; i < 4; i++) {
+    if (typeof current.source === "string" && current.source.length > 0) {
+      return true;
+    }
+    if (current.default === null || typeof current.default !== "object") {
+      return false;
+    }
+    current = current.default;
+  }
+  return false;
 }
 `
   node := os.Getenv("TTSC_NODE_BINARY")
   if node == "" {
     node = "node"
   }
-  cmd := exec.Command(node, "-e", script, location)
+  ctx, cancel := context.WithTimeout(context.Background(), configLoaderTimeout)
+  defer cancel()
+  cmd := exec.CommandContext(ctx, node, "-e", script, location)
   output, err := cmd.Output()
   if err != nil {
+    if ctx.Err() == context.DeadlineExceeded {
+      return nil, fmt.Errorf("@ttsc/lint: load config file %s: timed out after %s", location, configLoaderTimeout)
+    }
     stderr := ""
     if exit, ok := err.(*exec.ExitError); ok {
       stderr = strings.TrimSpace(string(exit.Stderr))
@@ -826,10 +1225,15 @@ func loadTypeScriptConfigFile(location string) (any, error) {
   }
   args = append(args, loader)
 
-  cmd := ttsxCommand(args...)
+  ctx, cancel := context.WithTimeout(context.Background(), configLoaderTimeout)
+  defer cancel()
+  cmd := ttsxCommandContext(ctx, args...)
   cmd.Env = nodeConfigLoaderEnv(location)
   output, err := cmd.Output()
   if err != nil {
+    if ctx.Err() == context.DeadlineExceeded {
+      return nil, fmt.Errorf("@ttsc/lint: load TypeScript config file %s: timed out after %s", location, configLoaderTimeout)
+    }
     stderr := ""
     if exit, ok := err.(*exec.ExitError); ok {
       stderr = strings.TrimSpace(string(exit.Stderr))
@@ -990,28 +1394,81 @@ function isESLintConfigObject(value: Record<string, unknown>): boolean {
 }
 
 function hasESLintRuntimeFields(value: Record<string, unknown>): boolean {
-  return [
-    "languageOptions",
-    "linterOptions",
-    "plugins",
-    "processor",
-    "settings",
-  ].some((key) => hasOwn(value, key));
+  for (const key of ["languageOptions", "linterOptions", "processor", "settings"]) {
+    if (hasOwn(value, key)) return true;
+  }
+  if (hasOwn(value, "plugins")) {
+    const plugins = value.plugins;
+    if (!isNativePluginMap(plugins)) return true;
+  }
+  return false;
+}
+
+// isNativePluginMap reports whether every entry of a plugins map points
+// at a ttsc-lint native contributor (an object with a string "source"
+// field). Native plugins are compiled into the lint binary at build
+// time, so their presence does NOT require the JavaScript ESLint
+// runtime; only mixed or pure-ESLint plugin maps do.
+function isNativePluginMap(value: unknown): boolean {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const entries = Object.values(value as Record<string, unknown>);
+  if (entries.length === 0) return true;
+  for (const entry of entries) {
+    if (!isNativePluginValue(entry)) return false;
+  }
+  return true;
+}
+
+function isNativePluginValue(entry: unknown): boolean {
+  // A non-empty string is a native specifier — see the matching Go-side
+  // and JS-loader implementations.
+  if (typeof entry === "string") return entry.length > 0;
+  if (entry === null || typeof entry !== "object") return false;
+  // ESM-from-CJS interop wraps CJS modules' "exports.default" so a
+  // contributor authored as "export default plugin" lands under a
+  // ".default" indirection. Walk a few hops so both "export default"
+  // and plain "module.exports = plugin" contributors register as
+  // native here.
+  let current = entry as Record<string, unknown>;
+  for (let i = 0; i < 4; i++) {
+    if (typeof current.source === "string" && (current.source as string).length > 0) {
+      return true;
+    }
+    const next = current.default;
+    if (next === null || typeof next !== "object" || Array.isArray(next)) {
+      return false;
+    }
+    current = next as Record<string, unknown>;
+  }
+  return false;
 }
 `, importLiteral)
 }
 
 func typeScriptConfigLoaderTsconfig(loader, location, outDir string) string {
+  // Mirror the JS-factory loader's lenient settings (see the matching
+  // tsconfig synthesis in `packages/lint/src/index.ts::readTtsxConfigPlugins`).
+  // Both sides evaluate the SAME user-authored lint config; without
+  // matching strictness, a config that loads fine through the JS
+  // factory could be rejected by the Go sidecar (or vice versa) on
+  // identical input. The loader is extracting data, not validating
+  // user code, so `strict: false` + `allowJs: true` + `noImplicitAny:
+  // false` is the right baseline.
   content := map[string]any{
     "compilerOptions": map[string]any{
       "allowImportingTsExtensions":      true,
+      "allowJs":                         true,
+      "checkJs":                         false,
       "module":                          "ESNext",
       "moduleResolution":                "bundler",
+      "noImplicitAny":                   false,
       "outDir":                          filepath.ToSlash(filepath.Join(outDir, "out")),
       "rewriteRelativeImportExtensions": true,
       "rootDir":                         "/",
       "skipLibCheck":                    true,
-      "strict":                          true,
+      "strict":                          false,
       "target":                          "ES2022",
     },
     "files": []string{
@@ -1027,6 +1484,14 @@ func typeScriptConfigLoaderTsconfig(loader, location, outDir string) string {
 }
 
 func ttsxCommand(args ...string) *exec.Cmd {
+  return ttsxCommandContext(context.Background(), args...)
+}
+
+// ttsxCommandContext is the timeout-aware variant. Callers that
+// evaluate user-supplied config should wrap their context with
+// `context.WithTimeout(parent, configLoaderTimeout)` so a runaway
+// `ttsx` subprocess can never hang the lint binary indefinitely.
+func ttsxCommandContext(ctx context.Context, args ...string) *exec.Cmd {
   ttsx := os.Getenv("TTSC_TTSX_BINARY")
   if ttsx == "" {
     ttsx = "ttsx"
@@ -1036,9 +1501,9 @@ func ttsxCommand(args ...string) *exec.Cmd {
     if node == "" {
       node = "node"
     }
-    return exec.Command(node, append([]string{ttsx}, args...)...)
+    return exec.CommandContext(ctx, node, append([]string{ttsx}, args...)...)
   }
-  return exec.Command(ttsx, args...)
+  return exec.CommandContext(ctx, ttsx, args...)
 }
 
 func shouldRunTtsxThroughNode(binary string) bool {
@@ -1071,8 +1536,32 @@ func linkNearestNodeModules(tempDir, sourceDir string) error {
     return nil
   }
   link := filepath.Join(tempDir, "node_modules")
-  if err := os.Symlink(nodeModules, link); err != nil {
-    return fmt.Errorf("@ttsc/lint: link config node_modules %s: %w", nodeModules, err)
+  err := os.Symlink(nodeModules, link)
+  if err == nil {
+    return nil
+  }
+  // Windows: a true symbolic link needs SeCreateSymbolicLinkPrivilege
+  // (admin or Developer Mode). The JS side uses fs.symlink with the
+  // `"junction"` type to dodge that restriction; here we shell out to
+  // `mklink /J` to create an equivalent directory junction. Junctions
+  // only work for absolute directory targets, which matches the input.
+  if runtime.GOOS == "windows" {
+    jerr := createWindowsJunction(link, nodeModules)
+    if jerr == nil {
+      return nil
+    }
+    err = fmt.Errorf("%w (junction fallback: %v)", err, jerr)
+  }
+  return fmt.Errorf("@ttsc/lint: link config node_modules %s: %w", nodeModules, err)
+}
+
+func createWindowsJunction(link, target string) error {
+  // `cmd /c mklink /J link target` is the standard recipe and works
+  // without elevated privileges. Both arguments must be absolute paths
+  // with native separators, which they already are here.
+  cmd := exec.Command("cmd", "/c", "mklink", "/J", link, target)
+  if out, err := cmd.CombinedOutput(); err != nil {
+    return fmt.Errorf("mklink /J failed: %v: %s", err, strings.TrimSpace(string(out)))
   }
   return nil
 }
@@ -1103,14 +1592,42 @@ func setEnv(env []string, key, value string) []string {
   return append(env, prefix+value)
 }
 
-func parseExternalSeverity(v any) (Severity, error) {
+// parseExternalRuleEntry mirrors parseRuleEntry for ESLint-style config
+// inputs. The contract is identical to the inline path: severity
+// literal, `[severity]`, or `[severity, options]`. Tuples longer than
+// two elements are rejected because no built-in rule's option struct
+// models positional ESLint args, so silently encoding the tail as a
+// JSON array would land in `DecodeOptions` and fall back to defaults
+// — a silent fallback the standard parser deliberately avoids.
+func parseExternalRuleEntry(v any) (Severity, json.RawMessage, error) {
   if tuple, ok := v.([]any); ok {
     if len(tuple) == 0 {
-      return SeverityOff, fmt.Errorf("severity tuple must not be empty")
+      return SeverityOff, nil, fmt.Errorf("severity tuple must not be empty")
+    }
+    sev, err := parseSeverity(tuple[0])
+    if err != nil {
+      return SeverityOff, nil, err
+    }
+    if len(tuple) == 1 {
+      return sev, nil, nil
+    }
+    if len(tuple) > 2 {
+      return SeverityOff, nil, fmt.Errorf("severity tuple must be [severity] or [severity, options], got %d elements", len(tuple))
+    }
+    if tuple[1] == nil {
+      return sev, nil, nil
+    }
+    if _, ok := tuple[1].(map[string]any); !ok {
+      return SeverityOff, nil, fmt.Errorf("severity tuple's options slot must be an object, got %T", tuple[1])
+    }
+    encoded, err := json.Marshal(tuple[1])
+    if err != nil {
+      return SeverityOff, nil, fmt.Errorf("encode options: %w", err)
     }
-    return parseSeverity(tuple[0])
+    return sev, encoded, nil
   }
-  return parseSeverity(v)
+  sev, err := parseSeverity(v)
+  return sev, nil, err
 }
 
 func parseSeverity(v any) (Severity, error) {