@ttsc/lint 0.26.2 → 0.28.0

package/lib/index.js

@@ -48,20 +48,20 @@ function goSubpackageName(namespace) {
     return namespace.replace(/-/g, "_");
 }
 const LINT_CONFIG_FILENAMES = [
+    "lint.config.json",
+    "lint.config.js",
+    "lint.config.mjs",
+    "lint.config.cjs",
     "lint.config.ts",
     "lint.config.mts",
     "lint.config.cts",
-    "lint.config.mjs",
-    "lint.config.cjs",
-    "lint.config.js",
-    "lint.config.json",
+    "ttsc-lint.config.json",
+    "ttsc-lint.config.js",
+    "ttsc-lint.config.mjs",
+    "ttsc-lint.config.cjs",
     "ttsc-lint.config.ts",
     "ttsc-lint.config.mts",
     "ttsc-lint.config.cts",
-    "ttsc-lint.config.mjs",
-    "ttsc-lint.config.cjs",
-    "ttsc-lint.config.js",
-    "ttsc-lint.config.json",
 ];
 /**
  * Tsconfig plugin-entry keys owned by the ttsc host framework. They are
@@ -95,13 +95,14 @@ const FRAMEWORK_KEYS = new Set([
  */
 function createTtscPlugin(context) {
     rejectUnsupportedEntryKeys(context.plugin);
-    const contributors = resolveConfigFileContributors(context);
+    const resolvedConfig = resolveConfigFileContributors(context);
     // Build the descriptor without a `contributors` key when none were
     // declared, so consumers (and the existing key-shape regression
     // tests) see the same surface as before this feature shipped.
     const descriptor = {
         capabilities: {
             diagnosticsTiming: true,
+            graphNodes: true,
             lsp: true,
             projectContextArgs: true,
             projectDiagnostics: true,
@@ -109,6 +110,9 @@ function createTtscPlugin(context) {
             residentCheck: true,
             threadingArgs: true,
         },
+        hostInputHashes: resolvedConfig.hostInputHashes,
+        hostInputRealpaths: resolvedConfig.hostInputRealpaths,
+        hostInputs: resolvedConfig.hostInputs,
         name: "@ttsc/lint",
         reportsTypeScriptDiagnostics: true,
         // `context.dirname` is this descriptor's own directory in every load mode —
@@ -117,8 +121,8 @@ function createTtscPlugin(context) {
         source: node_path_1.default.resolve(context.dirname, "..", "plugin"),
         stage: "check",
     };
-    if (contributors.length > 0) {
-        descriptor.contributors = contributors;
+    if (resolvedConfig.contributors.length > 0) {
+        descriptor.contributors = resolvedConfig.contributors;
     }
     return descriptor;
 }
@@ -163,12 +167,28 @@ function loadContributorPluginViaRequire(specifier, context, namespace, anchorFi
  */
 function resolveConfigFileContributors(context) {
     const configFile = readConfigFileOption(context);
-    const configPath = configFile !== undefined
-        ? node_path_1.default.resolve(pluginConfigBaseDir(context), configFile)
-        : findLintConfigFile(context);
-    if (!configPath || !node_fs_1.default.existsSync(configPath))
-        return [];
-    const entries = readConfigPluginEntries(configPath, context);
+    const explicitConfigPath = configFile === undefined
+        ? undefined
+        : node_path_1.default.resolve(pluginConfigBaseDir(context), configFile);
+    const discovery = explicitConfigPath === undefined
+        ? discoverLintConfigFile(context)
+        : {
+            configPath: explicitConfigPath,
+            hostInputHashes: hashHostInputPaths([explicitConfigPath]),
+            hostInputRealpaths: realpathHostInputPaths([explicitConfigPath]),
+            hostInputs: [explicitConfigPath],
+        };
+    const { configPath } = discovery;
+    if (!configPath || !node_fs_1.default.existsSync(configPath)) {
+        return {
+            contributors: [],
+            hostInputHashes: discovery.hostInputHashes,
+            hostInputRealpaths: discovery.hostInputRealpaths,
+            hostInputs: discovery.hostInputs,
+        };
+    }
+    const evaluation = readConfigPluginEntries(configPath, context);
+    const entries = evaluation.entries;
     assertContributorNamespacesDoNotCollide(entries, configPath);
     // Dedup exact repeated namespaces on the Go-subpackage form. Config-array
     // folding can surface the same namespace more than once; that existing
@@ -182,7 +202,157 @@ function resolveConfigFileContributors(context) {
         occupied.add(goName);
         out.push({ name: goName, source: entry.source });
     }
-    return out;
+    const dependencyInputs = evaluation.dependencies
+        .filter((dependency) => dependency.scope === "watch" && dependency.kind !== "directory")
+        .map((dependency) => dependency.path);
+    const hostInputHashes = { ...discovery.hostInputHashes };
+    const hostInputRealpaths = { ...discovery.hostInputRealpaths };
+    const unstableRealpaths = new Set();
+    const unprovenInputs = new Set();
+    const missingOptionalDigest = (0, node_crypto_1.createHash)("sha256")
+        .update("missing\0")
+        .digest("hex");
+    const directoryCandidateDigest = (0, node_crypto_1.createHash)("sha256")
+        .update("ttsc:host-input:directory\0")
+        .digest("hex");
+    for (const dependency of evaluation.dependencies) {
+        if (dependency.scope !== "watch" || dependency.kind === "directory") {
+            continue;
+        }
+        const input = node_path_1.default.resolve(dependency.path);
+        const realpath = dependency.realpath;
+        if (!dependency.identityStable) {
+            delete hostInputRealpaths[input];
+            delete hostInputHashes[input];
+            unstableRealpaths.add(input);
+            unprovenInputs.add(input);
+            continue;
+        }
+        if (Object.prototype.hasOwnProperty.call(hostInputRealpaths, input) &&
+            hostInputRealpaths[input] !== realpath) {
+            delete hostInputRealpaths[input];
+            delete hostInputHashes[input];
+            unstableRealpaths.add(input);
+        }
+        else if (!unstableRealpaths.has(input)) {
+            hostInputRealpaths[input] = realpath;
+        }
+        let hash;
+        if (dependency.kind === "file" &&
+            /^[0-9a-f]{64}$/.test(dependency.digest)) {
+            hash = dependency.digest;
+        }
+        else if (dependency.digest === missingOptionalDigest) {
+            // The evaluator's optional-file digest includes a state prefix. The
+            // public host-input contract uses null for the observed missing state.
+            hash = null;
+        }
+        else if (dependency.digest === directoryCandidateDigest) {
+            // A path that is currently a directory is still an exact file candidate:
+            // replacing it with a file changes module/config selection.
+            hash = directoryCandidateDigest;
+        }
+        if (hash === undefined) {
+            delete hostInputHashes[input];
+            unprovenInputs.add(input);
+        }
+        else if (unprovenInputs.has(input)) {
+            // A later observation cannot revive proof another evaluation stage
+            // could not provide for the same combined descriptor result.
+        }
+        else if (Object.prototype.hasOwnProperty.call(hostInputHashes, input) &&
+            hostInputHashes[input] !== hash) {
+            delete hostInputHashes[input];
+            unprovenInputs.add(input);
+        }
+        else {
+            hostInputHashes[input] = hash;
+        }
+    }
+    return {
+        contributors: out,
+        hostInputHashes,
+        hostInputRealpaths,
+        hostInputs: [...discovery.hostInputs, ...dependencyInputs],
+    };
+}
+/** Snapshot config candidates before any discovery/evaluation side effect. */
+function hashHostInputPaths(inputs) {
+    return Object.fromEntries(inputs.map((input) => {
+        const file = node_path_1.default.resolve(input);
+        try {
+            if (node_fs_1.default.statSync(file).isDirectory()) {
+                return [
+                    file,
+                    (0, node_crypto_1.createHash)("sha256")
+                        .update("ttsc:host-input:directory\0")
+                        .digest("hex"),
+                ];
+            }
+            return [
+                file,
+                (0, node_crypto_1.createHash)("sha256").update(node_fs_1.default.readFileSync(file)).digest("hex"),
+            ];
+        }
+        catch {
+            return [file, null];
+        }
+    }));
+}
+function hostInputRealpath(file) {
+    try {
+        return node_fs_1.default.realpathSync.native(file);
+    }
+    catch {
+        return null;
+    }
+}
+function realpathHostInputPaths(inputs) {
+    return Object.fromEntries(inputs.map((input) => {
+        const file = node_path_1.default.resolve(input);
+        return [file, hostInputRealpath(file)];
+    }));
+}
+/** Mirror native discovery and fingerprint every candidate before selecting. */
+function discoverLintConfigFile(context) {
+    const hostInputHashes = {};
+    const hostInputRealpaths = {};
+    const hostInputs = [];
+    const recordCandidates = (candidates) => {
+        for (const candidate of candidates) {
+            const absolute = node_path_1.default.resolve(candidate);
+            if (Object.prototype.hasOwnProperty.call(hostInputHashes, absolute)) {
+                continue;
+            }
+            hostInputs.push(absolute);
+            Object.assign(hostInputHashes, hashHostInputPaths([absolute]));
+            Object.assign(hostInputRealpaths, realpathHostInputPaths([absolute]));
+        }
+    };
+    for (const origin of discoveryConfigBaseDirs(context)) {
+        for (let directory = origin;; directory = node_path_1.default.dirname(directory)) {
+            const candidates = LINT_CONFIG_FILENAMES.map((name) => node_path_1.default.join(directory, name));
+            recordCandidates(candidates);
+            const matches = lintConfigMatchesIn(directory);
+            if (matches.length === 1) {
+                return {
+                    configPath: matches[0],
+                    hostInputHashes,
+                    hostInputRealpaths,
+                    hostInputs,
+                };
+            }
+            if (matches.length > 1) {
+                throw new Error(`@ttsc/lint: multiple lint config files found in ${directory} (${matches
+                    .map((file) => node_path_1.default.basename(file))
+                    .join(", ")}); set "configFile" explicitly`);
+            }
+            const parent = node_path_1.default.dirname(directory);
+            if (parent === directory)
+                break;
+        }
+    }
+    return { hostInputHashes, hostInputRealpaths, hostInputs };
 }
 function assertContributorNamespacesDoNotCollide(entries, configPath) {
     const namespacesByGoName = new Map();
@@ -237,23 +407,6 @@ function readConfigFileOption(context) {
     }
     return value;
 }
-function findLintConfigFile(context) {
-    // Mirror the Go side (driver.PluginConfigBaseDir): the caller-declared
-    // pluginConfigDir is the single walk origin when present — it names the
-    // real project when the resolved tsconfig is a generated wrapper in a temp
-    // dir (@ttsc/unplugin's alias overlay), and it keeps the wrapper's temp
-    // ancestry out of the walk so a stray config planted there is never
-    // honored. Otherwise walk upward from the tsconfig directory first, then
-    // fall back to the working directory: that covers callers that point at an
-    // out-of-tree tsconfig without declaring an anchor.
-    for (const origin of discoveryConfigBaseDirs(context)) {
-        const discovered = findLintConfigFileFrom(origin);
-        if (discovered !== undefined) {
-            return discovered;
-        }
-    }
-    return undefined;
-}
 function discoveryConfigBaseDirs(context) {
     if (context.pluginConfigDir) {
         return [node_path_1.default.resolve(context.cwd ?? ".", context.pluginConfigDir)];
@@ -262,45 +415,25 @@ function discoveryConfigBaseDirs(context) {
     const cwd = node_path_1.default.resolve(context.cwd ?? context.projectRoot);
     return tsconfigDir === cwd ? [tsconfigDir] : [tsconfigDir, cwd];
 }
-function findLintConfigFileFrom(origin) {
-    // Mirror the Go-side discovery loop: walk from `origin` upward, returning
-    // the first directory that has exactly one of the candidate filenames.
-    // Multiple files in the same directory is treated as ambiguous and skipped
-    // (the Go side raises a hard error on the duplicate; here we leave it to
-    // the binary's own discovery to surface the issue once with one canonical
-    // message).
-    const candidateSet = new Set(LINT_CONFIG_FILENAMES);
-    let dir = origin;
-    while (true) {
-        // One `readdirSync` per directory level beats 14 `existsSync`+
-        // `statSync` pairs (= 28 stat syscalls) per level; intersect the
-        // listing with the candidate set instead.
-        let entries;
+/** Return the non-directory candidates native discovery recognizes. */
+function lintConfigMatchesIn(directory) {
+    const matches = [];
+    for (const name of LINT_CONFIG_FILENAMES) {
+        const candidate = node_path_1.default.join(directory, name);
         try {
-            entries = node_fs_1.default.readdirSync(dir, { withFileTypes: true });
+            // Go's os.Stat follows symlinks and junctions. Follow them here too so a
+            // directory or dangling link cannot stop descriptor discovery before
+            // the native host reaches a valid ancestor config. Probing the canonical
+            // candidate spelling also preserves Go's behavior on case-insensitive
+            // filesystems when the directory entry uses different casing.
+            if (!node_fs_1.default.statSync(candidate).isDirectory())
+                matches.push(candidate);
         }
         catch {
-            entries = [];
-        }
-        const matches = [];
-        for (const entry of entries) {
-            if (!candidateSet.has(entry.name))
-                continue;
-            if (!entry.isFile() && !entry.isSymbolicLink())
-                continue;
-            matches.push(node_path_1.default.join(dir, entry.name));
-        }
-        if (matches.length === 1) {
-            return matches[0];
+            // Missing, dangling, and unreadable candidates are not native matches.
         }
-        if (matches.length > 1) {
-            return undefined; // ambiguous — defer to the Go side's error
-        }
-        const parent = node_path_1.default.dirname(dir);
-        if (parent === dir)
-            return undefined;
-        dir = parent;
     }
+    return matches;
 }
 /**
  * Base directory for resolving a relative `configFile` from the tsconfig plugin
@@ -332,8 +465,9 @@ function readConfigPluginEntries(configPath, context) {
     // is a real subprocess, and a host that only wanted to know whether there
     // were contributors would otherwise depend on a launcher being resolvable and
     // on a compiler accepting one more invocation.
-    if (jsonConfigDeclaresNoContributor(configPath))
-        return [];
+    if (jsonConfigDeclaresNoContributor(configPath)) {
+        return { dependencies: [], entries: [] };
+    }
     // Every other config uses the same isolated evaluator. Executable config can
     // name contributor packages whose top-level code writes to stdout, so loading
     // it in this host process would corrupt CLI JSON or preface the first LSP
@@ -417,9 +551,11 @@ const CONFIG_KEYS = new Set<string>([
 ]);
 const dependencies = new Map<string, {
   digest: string;
+  identityStable: boolean;
   kind: "directory" | "file" | "optional-file";
   path: string;
   owners: Set<string>;
+  realpath: string | null;
 }>();
 const graphNodes = new Map<string, string>();
 const graphEdges: Array<{
@@ -450,6 +586,23 @@ const configUrlSpellings = [
     pathToFileURL(realConfigLocation()).href,
   ]),
 ];
+const moduleProbeExtensions = [
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".json",
+  ".node",
+] as const;
+const jsToTsProbeExtensions = new Map<string, readonly string[]>([
+  [".js", [".ts", ".tsx"]],
+  [".jsx", [".tsx"]],
+  [".mjs", [".mts"]],
+  [".cjs", [".cts"]],
+]);
 for (const spelling of configUrlSpellings) {
   graphNodes.set(spelling, configLocation);
 }
@@ -471,6 +624,11 @@ declare const process: {
 
 const hooks = registerHooks({
   resolve(specifier, context, nextResolve) {
+    const requestedParent =
+      context.parentURL && new URL(context.parentURL).href;
+    if (requestedParent !== undefined && graphNodes.has(requestedParent)) {
+      recordLocalResolutionCandidates(specifier, requestedParent);
+    }
     const resolved = nextResolve(specifier, context);
     if (typeof resolved.url !== "string" || !resolved.url.startsWith("file:")) {
       return resolved;
@@ -603,14 +761,32 @@ function recordDependency(
   const previous = dependencies.get(key);
   const mergedOwners = previous?.owners ?? new Set<string>();
   for (const owner of owners) mergedOwners.add(owner);
+  const realpath = dependencyRealpath(location);
+  const identityStable =
+    previous?.identityStable !== false &&
+    (previous === undefined || previous.realpath === realpath);
   dependencies.set(key, {
-    digest: previous !== undefined && previous.digest !== digest ? "" : digest,
+    digest:
+      !identityStable ||
+      (previous !== undefined && previous.digest !== digest)
+        ? ""
+        : digest,
+    identityStable,
     kind,
     owners: mergedOwners,
     path: location,
+    realpath,
   });
 }
 
+function dependencyRealpath(location: string): string | null {
+  try {
+    return realPath(location);
+  } catch {
+    return null;
+  }
+}
+
 function isLocalModuleSpecifier(specifier: string): boolean {
   return specifier.startsWith(".") ||
     specifier.startsWith("/") ||
@@ -728,13 +904,19 @@ function directoryDigestRecord(
 
 function optionalFileDigest(location: string): string {
   try {
-    if (fs.statSync(location).isFile()) {
+    const entry = fs.statSync(location);
+    if (entry.isFile()) {
       return createHash("sha256")
         .update(Buffer.concat([Buffer.from("file\\0"), fs.readFileSync(location)]))
         .digest("hex");
     }
+    if (entry.isDirectory()) {
+      return createHash("sha256")
+        .update("ttsc:host-input:directory\\0")
+        .digest("hex");
+    }
   } catch {
-    // Missing, unreadable, and non-file candidates share the absent state.
+    // Missing and unreadable candidates share the absent state.
   }
   return createHash("sha256").update("missing\\0").digest("hex");
 }
@@ -760,6 +942,80 @@ function recordOptionalFileDependency(
   return false;
 }
 
+function moduleResolutionCandidates(base: string): string[] {
+  const extension = path.extname(base).toLowerCase();
+  const substitutions = jsToTsProbeExtensions.get(extension) ?? [];
+  const stem = base.slice(0, base.length - extension.length);
+  return [
+    base,
+    ...substitutions.map((candidate) => stem + candidate),
+    ...moduleProbeExtensions.map((candidate) => base + candidate),
+    path.join(base, "package.json"),
+    ...moduleProbeExtensions.map((candidate) =>
+      path.join(base, "index" + candidate),
+    ),
+  ];
+}
+
+/** Record exact local probes before the runtime resolver chooses one. */
+function recordLocalResolutionCandidates(
+  specifier: string,
+  parentUrl: string,
+): void {
+  if (!isLocalModuleSpecifier(specifier)) return;
+  let bases: string[];
+  try {
+    if (specifier.startsWith("file:")) {
+      bases = [fileURLToPath(specifier)];
+    } else {
+      const directory = path.dirname(fileURLToPath(parentUrl));
+      const raw = path.resolve(directory, specifier);
+      const suffixStart = specifier.search(/[?#]/);
+      const pathname =
+        suffixStart === -1 ? specifier : specifier.slice(0, suffixStart);
+      bases = pathname === ""
+        ? [raw]
+        : [...new Set([raw, path.resolve(directory, pathname)])];
+    }
+  } catch {
+    return;
+  }
+  const owners = [parentUrl];
+  for (const base of bases) {
+    try {
+      if (fs.statSync(base).isFile()) {
+        recordOptionalFileDependency(base, owners);
+        continue;
+      }
+    } catch {
+      // A missing exact spelling falls through to source/extension/directory
+      // probes, all of which can redirect a later evaluation.
+    }
+    for (const candidate of moduleResolutionCandidates(base)) {
+      recordOptionalFileDependency(candidate, owners);
+    }
+  }
+}
+
+/** CommonJS LOAD_AS_FILE / LOAD_AS_DIRECTORY candidates for one legacy path. */
+function recordLegacyPackagePathCandidates(
+  candidate: string,
+  owners: readonly string[],
+): void {
+  for (const file of [
+    candidate,
+    candidate + ".js",
+    candidate + ".json",
+    candidate + ".node",
+    path.join(candidate, "package.json"),
+    path.join(candidate, "index.js"),
+    path.join(candidate, "index.json"),
+    path.join(candidate, "index.node"),
+  ]) {
+    recordOptionalFileDependency(file, owners);
+  }
+}
+
 function recordPackageManifests(
   location: string,
   owners: readonly string[],
@@ -805,26 +1061,26 @@ function recordNodeModulesSearchDirectories(
             // The directory digest of node_modules records a missing scope.
           }
         }
-        if (packageName !== undefined) {
-          const selected = recordPackageCandidateTopology(
-            modules,
-            packageName,
-            specifier,
-            childLocation,
-            owners,
-            conditions,
-          );
-          if (
-            selected ||
-            resolvedPackageContains(modules, packageName, childLocation)
-          ) {
-            return;
-          }
-        }
       }
     } catch {
       // Missing search levels do not participate in the current resolution.
     }
+    if (packageName !== undefined) {
+      const selected = recordPackageCandidateTopology(
+        modules,
+        packageName,
+        specifier,
+        childLocation,
+        owners,
+        conditions,
+      );
+      if (
+        selected ||
+        resolvedPackageContains(modules, packageName, childLocation)
+      ) {
+        return;
+      }
+    }
     if (
       packageName === undefined &&
       samePhysicalPath(current, resolutionRoot)
@@ -846,14 +1102,32 @@ function recordPackageCandidateTopology(
   conditions: readonly string[],
 ): boolean {
   const packageRoot = path.join(modules, packageName);
+  const subpath = specifier
+    .slice(packageName.length)
+    .replace(/^[/\\\\]+/, "");
   try {
-    if (!fs.statSync(packageRoot).isDirectory()) return false;
+    if (!fs.statSync(packageRoot).isDirectory()) {
+      recordOptionalFileDependency(
+        path.join(packageRoot, "package.json"),
+        owners,
+      );
+      recordLegacyPackagePathCandidates(
+        subpath === "" ? packageRoot : path.join(packageRoot, subpath),
+        owners,
+      );
+      return false;
+    }
   } catch {
+    recordOptionalFileDependency(
+      path.join(packageRoot, "package.json"),
+      owners,
+    );
+    recordLegacyPackagePathCandidates(
+      subpath === "" ? packageRoot : path.join(packageRoot, subpath),
+      owners,
+    );
     return false;
   }
-  const subpath = specifier
-    .slice(packageName.length)
-    .replace(/^[/\\\\]+/, "");
   const rootTopology = recordPackageRootTopology(
     packageRoot,
     owners,
@@ -888,6 +1162,7 @@ function recordPackageRootTopology(
   const legacySelected = (): boolean =>
     useMain &&
     packagePathCandidateMatchesChild(normalizedRoot, childLocation, true);
+  if (useMain) recordLegacyPackagePathCandidates(normalizedRoot, owners);
   if (!recordOptionalFileDependency(manifest, owners)) {
     const selected = legacySelected();
     if (!selected) {
@@ -934,6 +1209,7 @@ function recordPackageRootTopology(
         // it literally and permits absolute paths and paths outside the package.
         const main = path.resolve(normalizedRoot, metadata.main);
         recordPackagePathCandidate(main, owners);
+        recordLegacyPackagePathCandidates(main, owners);
         selected =
           packagePathCandidateMatchesChild(main, childLocation, true) ||
           selected;
@@ -1181,6 +1457,7 @@ function recordPackageSubpathTopology(
   const candidate = boundedPackageTarget(packageRoot, subpath);
   if (candidate === undefined) return false;
   recordPackagePathCandidate(candidate, owners);
+  recordLegacyPackagePathCandidates(candidate, owners);
   let selected = packagePathCandidateMatchesChild(
     candidate,
     childLocation,
@@ -1200,6 +1477,7 @@ function recordPackageSubpathTopology(
       if (typeof metadata.main === "string") {
         const main = path.resolve(candidate, metadata.main);
         recordPackagePathCandidate(main, owners);
+        recordLegacyPackagePathCandidates(main, owners);
         selected =
           packagePathCandidateMatchesChild(main, childLocation, true) ||
           selected;
@@ -1370,10 +1648,25 @@ function realPath(location: string): string {
 
 function finalizeDependencies(): Array<{
   digest: string;
+  identityStable: boolean;
   kind: "directory" | "file" | "optional-file";
   path: string;
+  realpath: string | null;
   scope: "cache" | "watch";
 }> {
+  // The evaluator may have observed a dependency, run arbitrary config code,
+  // and then serialize after that path changed again. Re-read every recorded
+  // dependency under its original ownership set so an A -> B -> A transition
+  // is marked identity-unstable instead of pairing transient output with the
+  // restored fingerprint.
+  for (const dependency of [...dependencies.values()]) {
+    recordDependency(
+      dependency.kind,
+      dependency.path,
+      currentDependencyDigest(dependency.kind, dependency.path),
+      [...dependency.owners],
+    );
+  }
   const watched = graphWatchReachability();
   return [...dependencies.values()].map(({ owners, ...dependency }) => ({
     ...dependency,
@@ -1383,6 +1676,21 @@ function finalizeDependencies(): Array<{
   }));
 }
 
+function currentDependencyDigest(
+  kind: "directory" | "file" | "optional-file",
+  location: string,
+): string {
+  try {
+    if (kind === "directory") return directoryDigest(location);
+    if (kind === "optional-file") return optionalFileDigest(location);
+    return createHash("sha256")
+      .update(fs.readFileSync(location))
+      .digest("hex");
+  } catch {
+    return "";
+  }
+}
+
 function graphWatchReachability(): Set<string> {
   const adjacency = new Map<string, typeof graphEdges>();
   for (const edge of graphEdges) {
@@ -1547,7 +1855,7 @@ function readTtsxConfigPlugins(configPath, context) {
         if (cached &&
             cached.entries.every(isValidConfigPluginEntry) &&
             configDependenciesAreCurrent(cached.dependencies)) {
-            return cached.entries;
+            return cached;
         }
     }
     // A config can be saved while it is being evaluated. Retry a bounded number
@@ -1560,10 +1868,10 @@ function readTtsxConfigPlugins(configPath, context) {
         if (configDependenciesAreCurrent(evaluation.dependencies)) {
             if (cacheKey)
                 writeConfigPluginCache(cacheKey, evaluation);
-            return evaluation.entries;
+            return evaluation;
         }
     }
-    return evaluation.entries;
+    return evaluation;
 }
 /**
  * Reports whether a cached plugin entry is still usable: a well-formed
@@ -1590,7 +1898,7 @@ function isValidConfigPluginEntry(entry) {
     }
 }
 function evaluateTtsxConfigPlugins(configPath, context) {
-    const tempDir = realpathIfPossible(node_fs_1.default.mkdtempSync(node_path_1.default.join(loaderTempBase(configPath), "ttsc-lint-cfg-")));
+    const tempDir = createCanonicalTempDirectory("ttsc-lint-cfg-", loaderTempBase(configPath));
     try {
         linkNearestNodeModules(tempDir, node_path_1.default.dirname(configPath));
         const loaderPath = node_path_1.default.join(tempDir, "loader.mts");
@@ -1735,11 +2043,27 @@ function evaluateTtsxConfigPlugins(configPath, context) {
 // ────────────────────────────────────────────────────────────────────────────
 // Config cache (shared with the Go sidecar — packages/lint/linthost/config.go)
 // ────────────────────────────────────────────────────────────────────────────
+/** Create evaluator storage beneath a frozen physical parent. */
+function createCanonicalTempDirectory(prefix, parent) {
+    const physicalParent = node_fs_1.default.realpathSync.native(parent);
+    if (!node_fs_1.default.lstatSync(physicalParent).isDirectory()) {
+        throw new Error(`@ttsc/lint: temporary directory parent is not a directory: ${physicalParent}`);
+    }
+    const directory = node_fs_1.default.mkdtempSync(node_path_1.default.join(physicalParent, prefix));
+    if (!node_fs_1.default.lstatSync(directory).isDirectory()) {
+        throw new Error(`@ttsc/lint: temporary directory postflight is not a directory: ${directory}`);
+    }
+    const physicalDirectory = node_fs_1.default.realpathSync.native(directory);
+    if (node_path_1.default.dirname(physicalDirectory) !== physicalParent) {
+        throw new Error(`@ttsc/lint: temporary directory escaped its physical parent: ${physicalDirectory}`);
+    }
+    return physicalDirectory;
+}
 /**
  * Namespaces the on-disk config cache. Kept in lockstep with the Go sidecar's
  * `configCacheVersion`; bump both when the cached shape changes.
  */
-const CONFIG_CACHE_VERSION = "v5";
+const CONFIG_CACHE_VERSION = "v7";
 /**
  * Directory shared by this factory and the Go sidecar for cached lint configs.
  * The two write different files (the `kind` segment of the cache key keeps
@@ -1848,6 +2172,12 @@ function normalizeConfigDependencyFingerprints(value) {
             typeof candidate !== "object" ||
             typeof candidate.path !== "string" ||
             typeof candidate.digest !== "string" ||
+            typeof candidate.identityStable !==
+                "boolean" ||
+            (candidate.realpath !== null &&
+                (typeof candidate.realpath !==
+                    "string" ||
+                    !node_path_1.default.isAbsolute(candidate.realpath))) ||
             !["directory", "file", "optional-file"].includes(candidate.kind) ||
             !["cache", "watch"].includes(candidate.scope)) {
             return undefined;
@@ -1855,22 +2185,36 @@ function normalizeConfigDependencyFingerprints(value) {
         const candidatePath = candidate.path;
         const digest = candidate.digest;
         const kind = candidate.kind;
+        const identityStable = candidate
+            .identityStable;
+        const realpath = candidate.realpath;
         const scope = candidate.scope;
-        if (!node_path_1.default.isAbsolute(candidatePath) || !/^[0-9a-f]{64}$/.test(digest)) {
+        if (!node_path_1.default.isAbsolute(candidatePath) ||
+            (digest !== "" && !/^[0-9a-f]{64}$/.test(digest))) {
             return undefined;
         }
         const location = node_path_1.default.resolve(candidatePath);
-        const previous = dependencies.get(location);
+        // The same lexical path can be both a traversed directory and an exact
+        // file candidate. Those observations have different freshness contracts:
+        // one fingerprints the listing, while the other fingerprints its entry
+        // type. Preserve both, but still reject contradictory duplicates of one
+        // kind.
+        const key = kind + "\0" + location;
+        const previous = dependencies.get(key);
         if (previous !== undefined &&
             (previous.digest !== digest ||
+                previous.identityStable !== identityStable ||
                 previous.kind !== kind ||
+                previous.realpath !== realpath ||
                 previous.scope !== scope)) {
             return undefined;
         }
-        dependencies.set(location, {
+        dependencies.set(key, {
             digest,
+            identityStable,
             kind,
             path: location,
+            realpath,
             scope,
         });
     }
@@ -1880,6 +2224,10 @@ function configDependenciesAreCurrent(dependencies) {
     if (dependencies.length === 0)
         return false;
     return dependencies.every((dependency) => {
+        if (!dependency.identityStable ||
+            dependency.realpath !== hostInputRealpath(dependency.path)) {
+            return false;
+        }
         if (!/^[0-9a-f]{64}$/.test(dependency.digest))
             return false;
         try {
@@ -1950,14 +2298,20 @@ function configDirectoryDigestRecord(name, entry, target) {
 }
 function configOptionalFileDigest(location) {
     try {
-        if (node_fs_1.default.statSync(location).isFile()) {
+        const entry = node_fs_1.default.statSync(location);
+        if (entry.isFile()) {
             return (0, node_crypto_1.createHash)("sha256")
                 .update(node_buffer_1.Buffer.concat([node_buffer_1.Buffer.from("file\0"), node_fs_1.default.readFileSync(location)]))
                 .digest("hex");
         }
+        if (entry.isDirectory()) {
+            return (0, node_crypto_1.createHash)("sha256")
+                .update("ttsc:host-input:directory\0")
+                .digest("hex");
+        }
     }
     catch {
-        // Missing, unreadable, and non-file candidates share the absent state.
+        // Missing and unreadable candidates share the absent state.
     }
     return (0, node_crypto_1.createHash)("sha256").update("missing\0").digest("hex");
 }
@@ -2177,14 +2531,6 @@ function loaderTempBase(configPath) {
     }
     return node_path_1.default.dirname(configPath);
 }
-function realpathIfPossible(location) {
-    try {
-        return node_fs_1.default.realpathSync(location);
-    }
-    catch {
-        return location;
-    }
-}
 function nodeConfigLoaderEnv(configPath) {
     const env = { ...process.env };
     const parts = [];