@vibe-agent-toolkit/utils 0.1.42-rc.1 → 0.2.0-rc.1

package/eslint/rules/no-manual-path-normalize.cjs

@@ -13,14 +13,21 @@
  * const normalized = toForwardSlash(relativePath);
  */
 
+const {
+  DEAD_UNSAFE_IMPORT,
+  DEAD_UNSAFE_IMPORT_MESSAGE,
+  reportDeadUnsafeImports,
+} = require('./dead-import.cjs');
 const {
   SAFE_MODULE_ONLY_SCHEMA,
   SAFE_PATH_MODULE,
+  insertAboveWithComments,
   isNameAlreadyBound,
   resolveSafeModule,
 } = require('./safe-import.cjs');
 
 const SAFE_FN = 'toForwardSlash';
+const PATH_MODULES = new Set(['node:path', 'path']);
 
 module.exports = {
   meta: {
@@ -35,6 +42,7 @@ module.exports = {
       useToForwardSlash:
         'Use toForwardSlash() from {{safeModule}} instead of manual path normalization. ' +
         'Manual normalization is error-prone and less maintainable.',
+      [DEAD_UNSAFE_IMPORT]: DEAD_UNSAFE_IMPORT_MESSAGE,
     },
     schema: [SAFE_MODULE_ONLY_SCHEMA],
   },
@@ -46,10 +54,35 @@ module.exports = {
     // barrel must have the call rewritten WITHOUT gaining a second binding of
     // the same name — that is a SyntaxError. See `safe-import.cjs`.
     let hasToForwardSlashImport = isNameAlreadyBound(sourceCode, SAFE_FN);
+    // Never mutated — the dead-import leg must not be armed by a flag that a
+    // suppressed report's `fix()` can spend. See `dead-import.cjs`.
+    const safeBoundInSource = hasToForwardSlashImport;
+    // The dead-import leg's OTHER gate: a `toForwardSlash(…)` call is the text
+    // this fixer writes, and the only evidence available that it wrote it here.
+    // Without it, any file with `toForwardSlash` in scope armed the leg — see
+    // `dead-import.cjs`. Read from the source, never from a `fix()`.
+    let safeReplacementCalled = false;
     let utilsImportNode = null;
+    // `path.sep` is the last `path.*` reference in plenty of files, and
+    // `toForwardSlash(raw)` consumes it — leaving the same dead `node:path`
+    // binding the `safePath` rules used to leave.
+    const pathImportNodes = [];
 
     return {
+      'Program:exit'() {
+        reportDeadUnsafeImports(
+          context,
+          sourceCode,
+          pathImportNodes,
+          safeBoundInSource,
+          safeReplacementCalled,
+        );
+      },
+
       ImportDeclaration(node) {
+        if (PATH_MODULES.has(node.source.value)) {
+          pathImportNodes.push(node);
+        }
         if (node.source.value === targetModule) {
           utilsImportNode = node;
           for (const spec of node.specifiers) {
@@ -61,6 +94,10 @@ module.exports = {
       },
 
       CallExpression(node) {
+        if (node.callee.type === 'Identifier' && node.callee.name === SAFE_FN) {
+          safeReplacementCalled = true;
+        }
+
         // Check for .split(...).join('/') pattern
         if (
           node.callee.type === 'MemberExpression' &&
@@ -79,12 +116,18 @@ module.exports = {
           ) {
             const splitArg = splitCall.arguments[0];
 
-            // Check if splitting by path.sep, '\\', or '\\\\'
+            // Split on path.sep, or on a single backslash character
+            // (source literal '\\'). Splitting on a two-backslash SEQUENCE
+            // (source literal '\\\\', decoded value: two backslash characters)
+            // is a different, rarer operation -- e.g. collapsing a UNC path's
+            // leading double-backslash server prefix -- and toForwardSlash()
+            // is not equivalent to it. Autofixing that case would silently
+            // change program behavior, so it is deliberately excluded here.
             const isSplittingByPathSep =
               (splitArg.type === 'MemberExpression' &&
                 splitArg.object.name === 'path' &&
                 splitArg.property.name === 'sep') ||
-              (splitArg.type === 'Literal' && (splitArg.value === '\\' || splitArg.value === '\\\\'));
+              (splitArg.type === 'Literal' && splitArg.value === '\\');
 
             if (isSplittingByPathSep) {
               const variableBeingSplit = splitCall.callee.object;
@@ -110,12 +153,21 @@ module.exports = {
                       // Create new import at the top
                       const firstNode = sourceCode.ast.body[0];
                       const newImport = `import { ${SAFE_FN} } from '${targetModule}';\n`;
-                      fixes.push(fixer.insertTextBefore(firstNode, newImport));
+                      fixes.push(insertAboveWithComments(fixer, sourceCode, firstNode, newImport));
                     }
-                    // Multiple reports in one pass share this closure; without
-                    // this, a second occurrence in the same file inserts the
-                    // import a second time.
-                    hasToForwardSlashImport = true;
+                    // NOT latched. The comment here used to claim that without a
+                    // `hasToForwardSlashImport = true` a second occurrence would
+                    // insert the import twice; an adversarial run could not
+                    // reproduce that at any occurrence count. It cannot happen:
+                    // both reports insert identical text at the identical anchor,
+                    // so the ranges coincide and ESLint applies one and drops the
+                    // other as overlapping.
+                    //
+                    // Latching it is not free, either. ESLint runs `fix()` for a
+                    // SUPPRESSED problem before the `eslint-disable` filter
+                    // discards it, so the first report could spend the flag and
+                    // then be thrown away — leaving later occurrences rewritten
+                    // to a `toForwardSlash` nothing imports.
                   }
 
                   return fixes;

package/eslint/rules/path-function-rule-factory.cjs

@@ -9,6 +9,11 @@
  * subpath that owns `safePath`, NOT the barrel. See `safe-import.cjs`.
  */
 
+const {
+  DEAD_UNSAFE_IMPORT,
+  DEAD_UNSAFE_IMPORT_MESSAGE,
+  reportDeadUnsafeImports,
+} = require('./dead-import.cjs');
 const {
   UNANCHORED_EXEMPT_FILE,
   UNANCHORED_EXEMPT_MESSAGE,
@@ -18,6 +23,7 @@ const {
 const {
   EXEMPT_AND_SAFE_MODULE_SCHEMA,
   SAFE_PATH_MODULE,
+  insertAboveWithComments,
   isNameAlreadyBound,
   resolveSafeModule,
 } = require('./safe-import.cjs');
@@ -58,10 +64,31 @@ function removeSpecifier(fixer, sourceCode, importNode, spec) {
 
 /**
  * Track path module specifiers from an import declaration.
+ *
+ * Two specifier shapes are deliberately NOT tracked, because tracking them is
+ * what let the fixer delete them:
+ *
+ * - **Type-only** (`import { type join, … }` / `import type { join }`). The
+ *   binding exists only for the type checker; there is no call to rewrite, and
+ *   removing the specifier silently breaks every `typeof join` that referenced
+ *   it. `no-undef` cannot see the damage — it is a TYPE reference.
+ * - **Aliased** (`import { join as pathJoin }`). The rule never reported
+ *   `pathJoin(...)` in the first place — `classifyCall` matches on the callee's
+ *   name — so tracking the specifier bought nothing and cost the whole import:
+ *   an unrelated unbound `join(` elsewhere in the file made the fixer remove
+ *   the alias, breaking every working `pathJoin` call site.
  */
 function trackPathImport(node, unsafeFn, state) {
+  if (node.importKind === 'type') {
+    return;
+  }
   for (const spec of node.specifiers) {
-    if (spec.type === 'ImportSpecifier' && spec.imported.name === unsafeFn) {
+    if (
+      spec.type === 'ImportSpecifier' &&
+      spec.importKind !== 'type' &&
+      spec.imported.name === unsafeFn &&
+      spec.local.name === unsafeFn
+    ) {
       state.namedImportSpec = spec;
       state.namedImportNode = node;
     }
@@ -71,6 +98,24 @@ function trackPathImport(node, unsafeFn, state) {
   }
 }
 
+/**
+ * Is `name` re-exported by a bare `export { name }` in this file?
+ *
+ * Removing the import specifier then leaves the export naming nothing, and the
+ * result does not PARSE — `Export 'join' is not defined`. An autofix whose
+ * output cannot be parsed is the worst outcome available, so the specifier
+ * stays and the call sites are still rewritten. Whatever is left is a lint
+ * finding a human can read, not a broken file.
+ */
+function isReExported(sourceCode, name) {
+  return sourceCode.ast.body.some(
+    (node) =>
+      node.type === 'ExportNamedDeclaration' &&
+      !node.source &&
+      node.specifiers.some((spec) => spec.local?.name === name),
+  );
+}
+
 /**
  * Track safe module import from an import declaration.
  */
@@ -83,51 +128,228 @@ function trackSafeImport(node, state) {
   }
 }
 
+/**
+ * Is `name` resolvable from `node`'s scope outward — a parameter, a local, an
+ * import, or a configured global?
+ *
+ * Used only to decide whether a bare `join(...)` with no `node:path` import is
+ * OUR `join` or somebody else's. `import { join } from 'lodash'` binds the name
+ * and is not our business; an unbound `join` is a ReferenceError waiting to
+ * happen, and — see `classifyCall` — is exactly what a half-applied autofix
+ * leaves behind.
+ */
+function isIdentifierBound(sourceCode, node, name) {
+  for (let scope = sourceCode.getScope(node); scope; scope = scope.upper) {
+    if (scope.variables.some((variable) => variable.name === name)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Is this the call THIS rule's fixer writes — `safePath.<unsafeFn>(…)`?
+ *
+ * The evidence that this rule migrated something in this file, and the reason it
+ * is not enough to ask whether `safePath` is merely in scope. Read by BOTH legs
+ * that would otherwise mistake a file-wide fact for a claim about `unsafeFn`:
+ * the dead-import leg, and the bare-call repair leg in `classifyCall`.
+ * Matched whether or not `safePath` is bound: an ORPHANED `safePath.join(…)` —
+ * the repair leg's own subject — is still this fixer's handiwork.
+ *
+ * @param {object} node - A `CallExpression`.
+ * @param {string} unsafeFn - The member this rule migrates.
+ * @returns {boolean} True if the callee is `safePath.<unsafeFn>`.
+ */
+function isSafeReplacementCall(node, unsafeFn) {
+  return (
+    node.callee.type === 'MemberExpression' &&
+    node.callee.object.type === 'Identifier' &&
+    node.callee.object.name === SAFE_OBJECT &&
+    node.callee.property.type === 'Identifier' &&
+    node.callee.property.name === unsafeFn
+  );
+}
+
 /**
  * Check if a call expression is an unsafe path function call.
- * Returns { isUnsafe, isNamed } or null if not a match.
+ *
+ * Returns `{ isNamed }` — or `{ importOnly: true }` for a call that is already
+ * correct and merely missing its import — or `{ isRepair: true }` for a bare call
+ * that is ours only if the file also shows THIS function mid-migration, which
+ * `Program:exit` decides once the whole file has been seen — or null if not a
+ * match.
  */
-function classifyCall(node, unsafeFn, state) {
-  // Direct call from named import: join(...)
-  if (
-    node.callee.type === 'Identifier' &&
-    node.callee.name === unsafeFn &&
-    state.namedImportSpec
-  ) {
-    return { isNamed: true };
+function classifyCall(node, unsafeFn, state, sourceCode) {
+  const isMember = node.callee.type === 'MemberExpression' && node.callee.property.type === 'Identifier';
+
+  // Direct call: join(...)
+  if (node.callee.type === 'Identifier' && node.callee.name === unsafeFn) {
+    if (state.namedImportSpec) {
+      return { isNamed: true };
+    }
+    // REPAIR LEG. Keying detection on "did I see the import?" made this rule
+    // stop reporting the moment a fix removed the specifier, so a partial
+    // `--fix` reached a stable fixpoint over source that no longer compiles and
+    // exited clean.
+    //
+    // An unbound `join` is NOT reliably our `join`: ESLint scope analysis does
+    // not bind `declare global { function join() }`, and it cannot see an ambient
+    // global from a `globals.d.ts`, an `@types` package, or a bundler — `resolve`
+    // and `relative` are entirely plausible as those. So the leg needs a second
+    // condition, and `safePathBoundInSource` alone was the wrong one: it is a
+    // fact about the FILE, not about `unsafeFn`, and a SIBLING instance of this
+    // factory hands it over for free. `no-path-resolve` rewrites a
+    // `path.resolve(...)` and imports `safePath`; on the next `--fix` pass the
+    // `join` instance sees a file with `safePath` bound and an ambient-global
+    // `join(...)` that predates any of this pack's involvement, and rewrites it
+    // to a different function. Measured with both rules enabled over one file.
+    //
+    // So this is only a CANDIDATE. `Program:exit` admits it once the file has
+    // been seen to contain a `safePath.<unsafeFn>(...)` call — the same positive
+    // evidence the dead-import leg reads, and the only in-file signal that THIS
+    // function is mid-migration HERE. Every genuine strand carries it:
+    // `removeSpecifier` only ever ships inside the same report's fix as the
+    // callee rewrite that consumed the specifier, and ESLint merges a report's
+    // fixes into one all-or-nothing range — so a file cannot lose the `node:path`
+    // specifier without gaining a `safePath.<unsafeFn>(` call.
+    //
+    // What this gives up: a file a HUMAN half-migrated by hand — import deleted,
+    // not one call rewritten — is no longer finished by `--fix`. That file is a
+    // loud `no-undef`/`tsc` error rather than a silent one, and it was never this
+    // pack's doing. Silently redirecting a live call to another function is.
+    if (state.safePathBoundInSource && !isIdentifierBound(sourceCode, node.callee, unsafeFn)) {
+      return { isNamed: false, isRepair: true };
+    }
+    return null;
   }
-  // Member expression: path.join(...)
+
+  // Namespace call: path.join(...)
   if (
-    node.callee.type === 'MemberExpression' &&
+    isMember &&
     node.callee.object.type === 'Identifier' &&
     node.callee.object.name === state.defaultImportName &&
-    node.callee.property.type === 'Identifier' &&
     node.callee.property.name === unsafeFn
   ) {
     return { isNamed: false };
   }
+
+  // REPAIR LEG, the other half: `safePath.join(...)` with no `safePath` in
+  // scope. This is what a partially-applied fix leaves — and without it, that
+  // state is PERMANENT rather than transient.
+  //
+  // ESLint runs `fix()` for a problem BEFORE the `eslint-disable` filter
+  // discards it, so a suppressed report on the first call site consumes the
+  // once-per-file import edit and then throws it away. Every other call is
+  // rewritten to `safePath.join`, nothing imports `safePath`, and no report
+  // survives to carry the import on any later pass. Recognising the orphaned
+  // call is what closes that loop; it costs one extra pass, and only in a file
+  // that is already broken.
+  if (
+    isMember &&
+    node.callee.object.type === 'Identifier' &&
+    node.callee.object.name === SAFE_OBJECT &&
+    node.callee.property.name === unsafeFn &&
+    !isIdentifierBound(sourceCode, node.callee.object, SAFE_OBJECT)
+  ) {
+    return { importOnly: true };
+  }
+
   return null;
 }
 
 /**
  * Build auto-fix for an unsafe path function call.
+ *
+ * ## Why the import edits are emitted at most ONCE per file
+ *
+ * ESLint merges the fixes one `fix()` yields into a SINGLE range spanning
+ * `min..max`, and applies only non-overlapping ranges per pass. A fix that
+ * touches both the import and its own call site therefore spans everything in
+ * between — so N such reports produce N nested ranges, ESLint keeps the
+ * shortest and DISCARDS THE REST.
+ *
+ * That is not an edge case, it is every file with more than one call site. The
+ * import edit landed, the other calls did not, and (before `classifyCall` grew
+ * its bare-call leg) the next pass could no longer see them because the
+ * specifier it keyed on was gone. `--fix` reached a stable fixpoint over source
+ * that does not compile and exited clean. An adopter measured 146 files left
+ * with a dangling reference across one sweep — worst single file, 75 call sites.
+ *
+ * So: the shared edits belong to the first report, and every later report emits
+ * a fix LOCAL to its own callee. Nothing overlaps, and one pass fixes the file.
+ * `no-manual-path-normalize.cjs` carries the same guard for the same reason.
+ *
+ * Only the FIRST report's fix is self-sufficient, and that is load-bearing:
+ * applying a later one ALONE — an editor's "fix this problem", or an
+ * `eslint-disable` on the first call site — rewrites the call without adding
+ * the import. ESLint runs `fix()` before the disable filter, so a suppressed
+ * report consumes the once-per-file edit and then discards it.
+ *
+ * That state is recoverable rather than permanent ONLY because `classifyCall`
+ * has a repair leg for an orphaned `safePath.join(...)`. Without it the file
+ * stays broken through every subsequent `--fix`, because no report is left to
+ * carry the import — measured, not reasoned about. An earlier draft of this
+ * comment asserted the recovery came free from `hasSafePathImport` being seeded
+ * from scope; that was wrong, and an adversarial run produced the stable broken
+ * fixpoint to prove it.
+ *
+ * The shared edits still cannot be hoisted onto their own report: removing
+ * `join` from the import while a suppressed `join(...)` call survives is the
+ * same broken output reached a different way. `exemptFiles` opts a whole file
+ * out.
  */
-function buildFix(fixer, node, unsafeFn, isNamed, sourceCode, state) {
+function importSafePath(fixer, sourceCode, state) {
+  if (state.safeImportNode) {
+    const lastSpec = state.safeImportNode.specifiers.at(-1);
+    return fixer.insertTextAfter(lastSpec, `, ${SAFE_OBJECT}`);
+  }
+  const targetNode = state.namedImportNode || sourceCode.ast.body[0];
+  const declaration = `import { ${SAFE_OBJECT} } from '${state.safeModule}';`;
+  // Land the new import next to the imports, not after arbitrary code. A file
+  // reported only through a repair leg may have no path import at all, and
+  // `insertTextAfter(body[0])` would push the declaration below the statement
+  // that needs it — legal, since imports hoist, but it reads as though the
+  // fixer lost track of the file.
+  return targetNode.type === 'ImportDeclaration'
+    ? fixer.insertTextAfter(targetNode, `\n${declaration}`)
+    : insertAboveWithComments(fixer, sourceCode, targetNode, `${declaration}\n`);
+}
+
+function buildFix(fixer, node, unsafeFn, classification, sourceCode, state) {
+  // REPAIR: an orphaned `safePath.join(...)` is already the call we want, and
+  // the only thing missing is the import that a discarded report was carrying.
+  //
+  // This deliberately ignores `state.hasSafePathImport`. That flag is mutated
+  // inside `fix()`, and ESLint runs `fix()` for a SUPPRESSED problem before the
+  // disable filter throws it away — so on every pass the suppressed report
+  // spends the flag first and the repair emits nothing. The file then never
+  // recovers, which is precisely the stable broken fixpoint this leg exists to
+  // break. The gate that makes ignoring the flag safe is immutable: this
+  // classification is only reached when `safePath` is unbound in the SOURCE.
+  //
+  // Several orphaned calls yield the identical insert at the identical anchor,
+  // so ESLint applies one and drops the rest as overlapping — which is the
+  // desired outcome, not a hazard.
+  if (classification.importOnly) {
+    return [importSafePath(fixer, sourceCode, state)];
+  }
+
   const fixes = [fixer.replaceText(node.callee, `${SAFE_OBJECT}.${unsafeFn}`)];
 
   if (!state.hasSafePathImport) {
-    if (state.safeImportNode) {
-      const lastSpec = state.safeImportNode.specifiers.at(-1);
-      fixes.push(fixer.insertTextAfter(lastSpec, `, ${SAFE_OBJECT}`));
-    } else {
-      const targetNode = state.namedImportNode || sourceCode.ast.body[0];
-      fixes.push(fixer.insertTextAfter(targetNode, `\nimport { ${SAFE_OBJECT} } from '${state.safeModule}';`));
-    }
+    fixes.push(importSafePath(fixer, sourceCode, state));
     state.hasSafePathImport = true;
   }
 
-  if (isNamed && state.namedImportNode) {
+  if (
+    classification.isNamed &&
+    state.namedImportNode &&
+    !state.namedImportRemoved &&
+    !isReExported(sourceCode, unsafeFn)
+  ) {
     fixes.push(...removeSpecifier(fixer, sourceCode, state.namedImportNode, state.namedImportSpec));
+    state.namedImportRemoved = true;
   }
 
   return fixes;
@@ -148,6 +370,7 @@ module.exports = function createPathFunctionRule(config) {
       schema: [EXEMPT_AND_SAFE_MODULE_SCHEMA],
       messages: {
         noUnsafePathFn: message,
+        [DEAD_UNSAFE_IMPORT]: DEAD_UNSAFE_IMPORT_MESSAGE,
         [UNANCHORED_EXEMPT_FILE]: UNANCHORED_EXEMPT_MESSAGE,
       },
     },
@@ -170,12 +393,47 @@ module.exports = function createPathFunctionRule(config) {
         safeModule: resolveSafeModule(context, SAFE_PATH_MODULE),
         namedImportSpec: null,
         namedImportNode: null,
+        // Both of these guard a SHARED edit against being emitted by more than
+        // one report — see `buildFix` for what ESLint does with the overlap.
+        namedImportRemoved: false,
         defaultImportName: null,
         // Seeded from SCOPE, not from "did I see an import from SAFE_MODULE?".
         // A file already importing `safePath` from the barrel needs the call
         // rewritten but must NOT gain a second binding of the same name.
         hasSafePathImport: isNameAlreadyBound(sourceCode, SAFE_OBJECT),
+        // The SAME question, answered once and never mutated. `hasSafePathImport`
+        // flips to true the moment a fix inserts the import, and gating the
+        // repair leg on a flag that the first report can flip would arm it for
+        // the rest of THIS pass — re-admitting the ambient-global false positive
+        // in any file that also has a `path.join()` to fix.
+        safePathBoundInSource: isNameAlreadyBound(sourceCode, SAFE_OBJECT),
         safeImportNode: null,
+        // Set from the SOURCE as traversal walks it, and read only at
+        // `Program:exit` — so it is a fact about the text being linted, not
+        // about what a `fix()` intends to write. See `dead-import.cjs`, and the
+        // repair leg in `classifyCall`, which gates on the same flag.
+        safeReplacementCalled: false,
+        // Bare unbound calls awaiting that evidence. Held rather than reported,
+        // because a candidate can precede the migrated call that vouches for it.
+        deferredRepairs: [],
+        // EVERY path-module declaration, not just the one carrying `unsafeFn`.
+        // A file's dead binding is `import path from 'node:path'`, which
+        // `trackPathImport` only ever recorded as a NAME. See `dead-import.cjs`.
+        pathImportNodes: [],
+      };
+
+      const report = (node, classification) => {
+        context.report({
+          node,
+          messageId: 'noUnsafePathFn',
+          // The module name reaches the message through `{{safeModule}}` rather
+          // than being spelled out in each rule's string, so the advice cannot
+          // drift from where the fixer actually writes the import.
+          data: { safeModule: state.safeModule },
+          fix(fixer) {
+            return buildFix(fixer, node, unsafeFn, classification, sourceCode, state);
+          },
+        });
       };
 
       return {
@@ -183,8 +441,31 @@ module.exports = function createPathFunctionRule(config) {
           reportUnanchoredExemptEntries(context, node);
         },
 
+        'Program:exit'() {
+          // Holding these back cannot change any FIX, only when it is computed.
+          // A repair candidate is classified only when `safePath` is bound in the
+          // source, so `hasSafePathImport` starts true and `namedImportSpec` is
+          // null: the report carries no import insert and no specifier removal,
+          // and therefore nothing shared that an earlier report could have spent
+          // first. (`importOnly` is the mirror case — it requires `safePath`
+          // UNBOUND — so the two can never arise in the same file.)
+          if (state.safeReplacementCalled) {
+            for (const candidate of state.deferredRepairs) {
+              report(candidate, { isNamed: false });
+            }
+          }
+          reportDeadUnsafeImports(
+            context,
+            sourceCode,
+            state.pathImportNodes,
+            state.safePathBoundInSource,
+            state.safeReplacementCalled,
+          );
+        },
+
         ImportDeclaration(node) {
           if (PATH_MODULES.has(node.source.value)) {
+            state.pathImportNodes.push(node);
             trackPathImport(node, unsafeFn, state);
           }
           if (node.source.value === state.safeModule) {
@@ -193,22 +474,21 @@ module.exports = function createPathFunctionRule(config) {
         },
 
         CallExpression(node) {
-          const classification = classifyCall(node, unsafeFn, state);
+          if (isSafeReplacementCall(node, unsafeFn)) {
+            state.safeReplacementCalled = true;
+          }
+
+          const classification = classifyCall(node, unsafeFn, state, sourceCode);
           if (!classification) {
             return;
           }
 
-          context.report({
-            node,
-            messageId: 'noUnsafePathFn',
-            // The module name reaches the message through `{{safeModule}}` rather
-            // than being spelled out in each rule's string, so the advice cannot
-            // drift from where the fixer actually writes the import.
-            data: { safeModule: state.safeModule },
-            fix(fixer) {
-              return buildFix(fixer, node, unsafeFn, classification.isNamed, sourceCode, state);
-            },
-          });
+          if (classification.isRepair) {
+            state.deferredRepairs.push(node);
+            return;
+          }
+
+          report(node, classification);
         },
       };
     },