@vibe-agent-toolkit/utils 0.1.42 → 0.2.0-rc.2

package/dist/test-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"test-helpers.js","sourceRoot":"","sources":["../src/test-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,QAA2C,EAC3C,GAAG,OAAiB;IAEpB,iDAAiD;IACjD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;IAEzC,iEAAiE;IACjE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAEpD,kFAAkF;IAClF,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CACjC,WAAW,EACX,UAAU,EACV,WAAW,EACX,cAAc,EACd,QAAQ,EACR,KAAK,EACL,GAAG,OAAO,CACX,CAAC;IAEF,wDAAwD;IAExD,OAAO,aAAa,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IAOnD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,OAAO;QACL,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,WAAW,EAAE,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,CAAC;YACzD,8FAA8F;YAC9F,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,4CAA4C;QAC9C,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAOlD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,OAAO;QACL,SAAS,EAAE,GAAG,EAAE;YACd,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE;YACb,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,UAAU,EAAE,GAAG,EAAE;YACf,WAAW,EAAE,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,CAAC;YACzD,aAAa,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,SAAS,EAAE,GAAG,EAAE;YACd,4CAA4C;QAC9C,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"test-helpers.js","sourceRoot":"","sources":["../src/test-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,QAA2C,EAC3C,GAAG,OAAiB;IAEpB,iDAAiD;IACjD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;IAEzC,iEAAiE;IACjE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAEpD,kFAAkF;IAClF,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CACjC,WAAW,EACX,UAAU,EACV,WAAW,EACX,cAAc,EACd,QAAQ,EACR,KAAK,EACL,GAAG,OAAO,CACX,CAAC;IAEF,wDAAwD;IAExD,OAAO,aAAa,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IAOnD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,OAAO;QACL,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,WAAW,EAAE,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,CAAC;YACzD,8FAA8F;YAC9F,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,4CAA4C;QAC9C,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAOlD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,OAAO;QACL,SAAS,EAAE,GAAG,EAAE;YACd,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE;YACb,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,UAAU,EAAE,GAAG,EAAE;YACf,WAAW,EAAE,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,CAAC;YACzD,aAAa,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,SAAS,EAAE,GAAG,EAAE;YACd,4CAA4C;QAC9C,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC;QACH,gIAAgI;QAChI,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/eslint/README.md

@@ -197,7 +197,7 @@ So the rules now report it themselves, as a separate `deadUnsafeImport` finding
 Deliberately narrow:
 
 - **A closed list of modules** — `node:path`, `node:os`, `node:fs`, `node:fs/promises`, `node:child_process` and their bare spellings. All Node builtins, all side-effect-free with certainty decided when the rule was written. This is *not* a general unused-import rule and will not become one; for blanket cleanup, `eslint-plugin-unused-imports` already exists and already autofixes.
-- **Only in a file these rules migrated** — the safe symbol must already be bound. A dead import in a file this pack never touched is somebody else's business.
+- **Only in a file this rule migrated** — the safe symbol must be bound AND the rule's own replacement must actually be called in the file (`safePath.join(…)`, `normalizedTmpdir()`, `toForwardSlash(…)`). "The safe symbol is in scope" alone is not evidence: `safePath` arrives for reasons that have nothing to do with a call this pack consumed, and an import that was dead already — dead before the pack ever ran — was then deleted as though this fixer had orphaned it. A dead import in a file this pack never touched is somebody else's business.
 - **Only whole declarations, only with zero references left** — evaluated against the source as it stands on that pass, so the removal always lands *after* the rewrite that consumed the last reference, never speculatively beside it. A partially-dead declaration (`import path, { sep }` with `sep` still live) is left alone, as are bare `import 'node:path'` side-effect imports and anything carrying a `type` specifier.
 
 This cannot be delegated: `@typescript-eslint/no-unused-vars` declares `meta.fixable: 'code'` but emits only a **suggestion** for an unused import, and `--fix` never applies suggestions; `sonarjs/unused-import` declares no fixer at all. Verified with both enabled alongside these rules in one `verifyAndFix` — the import survived. Those rules abstain for a good reason, since removing an import can change behaviour; a rule that *created* the orphan knows it just consumed the last reference and knows the module, so it can act where a generic rule cannot.

package/eslint/rules/dead-import.cjs

@@ -63,9 +63,16 @@ const REMOVABLE_MODULES = new Set([
 ]);
 
 const DEAD_UNSAFE_IMPORT = 'deadUnsafeImport';
+// States what the rule can actually observe, and no more. The earlier wording —
+// "this rule's autofix rewrote the last call that referenced it" — asserted a
+// CAUSE, and the leg cannot see causes: by the time a binding reads as dead the
+// rewrite that killed it is a pass in the past and left no trace naming which
+// import it drew on. On a file with two imports of the same module, one of them
+// dead since before the pack ever ran, that sentence was simply false about one
+// of the two. See `reportDeadUnsafeImports` for what the gate does prove.
 const DEAD_UNSAFE_IMPORT_MESSAGE =
-  "'{{local}}' is no longer used — this rule's autofix rewrote the last call that " +
-  "referenced it. Remove the '{{module}}' import.";
+  "'{{local}}' has no remaining references, and this file already calls the safe " +
+  "replacement this rule's autofix writes. Remove the '{{module}}' import.";
 
 /**
  * Does this declaration bring in anything the type checker alone can see?
@@ -128,12 +135,46 @@ function isDeadRemovableImport(sourceCode, node) {
  * reported. The removal therefore lands on a later pass, after the rewrite that
  * consumed the last reference — never speculatively alongside it.
  *
- * `migrated` gates the whole leg on the safe symbol being bound in the file, and
- * is what keeps this a REPAIR leg rather than a general unused-import rule. It
- * must be read from the SOURCE and never from a flag a `fix()` can flip: ESLint
- * runs `fix()` for a suppressed problem before the `eslint-disable` filter
- * discards it, so any mutable "did I add the import?" flag is already spent and
- * lying by the time this runs.
+ * ## The two-part gate, and the evidence it cannot get
+ *
+ * Both gates keep this a REPAIR leg rather than a general unused-import rule,
+ * and both must be read from the SOURCE, never from a flag a `fix()` can flip:
+ * ESLint runs `fix()` for a suppressed problem before the `eslint-disable`
+ * filter discards it, so any mutable "did I add the import?" flag is already
+ * spent and lying by the time this runs.
+ *
+ * - `safeBoundInSource` — the safe symbol is in scope at all.
+ * - `replacementCalled` — THIS rule's own replacement is actually CALLED in this
+ *   file (`safePath.join(…)`, `normalizedTmpdir()`, `toForwardSlash(…)`), which
+ *   is the text its fixer writes and nothing else does.
+ *
+ * The first alone was the whole gate once, and it let an unrelated coincidence
+ * arm the leg: `safePath` reaches scope for reasons that have nothing to do with
+ * a call this pack consumed, and any `node:path` import that happened to be dead
+ * already — dead before the pack ever ran, for somebody else's reason — was then
+ * deleted under a message claiming this fixer had orphaned it. That is the
+ * general unused-import rule the module docstring above declines to be, reached
+ * by accident. The second gate closes it: no call to this rule's replacement
+ * means this rule rewrote nothing here, whatever else is in scope.
+ *
+ * It does NOT get down to the individual declaration, and it cannot. Per-import
+ * evidence has to name WHICH import a consumed reference belonged to, and the
+ * only pass that knows is the one doing the rewrite — where every reference is
+ * still live and nothing is dead to report. Removing speculatively in that pass
+ * instead is the trap the rest of this pack is built around: a suppressed call
+ * report still runs its `fix()`, so the removal lands while the call it was
+ * paired with survives, and the file is left with a dangling reference (146 of
+ * them, measured, in the defect this file exists to prevent). Latching state
+ * across passes to carry the answer forward is the rejected `WeakMap` approach
+ * for the same reason, one layer worse. So a file holding two imports of one
+ * module, one of them dead all along, still gets both removed and one true
+ * message plus one that merely describes the file rather than the history. The
+ * message is worded to stay true of both; the residual is a redundant deletion,
+ * never a broken one.
+ *
+ * Being over-strict here is cheap by construction: a gate that declines leaves
+ * an unused import, which is a lint finding a human reads. Only firing wrongly
+ * costs anything, and only the CALL rewrite can break a file.
  *
  * Its own report, with its own `fix`, deliberately — so the deletion appears in
  * lint output and can be suppressed at the import line, rather than a rewrite
@@ -161,10 +202,19 @@ function isDeadRemovableImport(sourceCode, node) {
  * @param {object} context - ESLint rule context.
  * @param {object} sourceCode - ESLint `SourceCode` for the file being linted.
  * @param {object[]} importNodes - Unsafe-module `ImportDeclaration`s seen this pass.
- * @param {boolean} migrated - Was the safe symbol already bound in the SOURCE?
+ * @param {boolean} safeBoundInSource - Was the safe symbol already bound in the SOURCE?
+ * @param {boolean} replacementCalled - Does the SOURCE call this rule's own safe
+ *   replacement? Both are required, and both are the caller's to compute from
+ *   source — see the gate discussion above for why neither may be defaulted.
  */
-function reportDeadUnsafeImports(context, sourceCode, importNodes, migrated) {
-  if (!migrated) {
+function reportDeadUnsafeImports(
+  context,
+  sourceCode,
+  importNodes,
+  safeBoundInSource,
+  replacementCalled,
+) {
+  if (!safeBoundInSource || !replacementCalled) {
     return;
   }
   for (const node of importNodes) {

package/eslint/rules/eslint-rule-factory.cjs

@@ -207,6 +207,11 @@ module.exports = function createNoUnsafeRule(config) {
       // not be armed by a flag a suppressed report can spend — ESLint runs
       // `fix()` before the `eslint-disable` filter discards the problem.
       const safeBoundInSource = hasSafeImport;
+      // The dead-import leg's OTHER gate: does this file actually call `safeFn`,
+      // the free function this fixer writes? "The safe symbol is in scope" alone
+      // let an unrelated coincidence arm the leg — see `dead-import.cjs`. Read
+      // from the source during traversal, never from a `fix()`.
+      let safeReplacementCalled = false;
       let unsafeImportNode = null;
       const unsafeImportNodes = [];
       let safeImportNode = null;
@@ -223,7 +228,13 @@ module.exports = function createNoUnsafeRule(config) {
         },
 
         'Program:exit'() {
-          reportDeadUnsafeImports(context, sourceCode, unsafeImportNodes, safeBoundInSource);
+          reportDeadUnsafeImports(
+            context,
+            sourceCode,
+            unsafeImportNodes,
+            safeBoundInSource,
+            safeReplacementCalled,
+          );
         },
 
         ImportDeclaration(node) {
@@ -281,6 +292,10 @@ module.exports = function createNoUnsafeRule(config) {
         },
 
         CallExpression(node) {
+          if (node.callee.type === 'Identifier' && node.callee.name === safeFn) {
+            safeReplacementCalled = true;
+          }
+
           let isUnsafeCall = false;
 
           // Check for direct function call: unsafeFn()

package/eslint/rules/no-manual-path-normalize.cjs

@@ -57,6 +57,11 @@ module.exports = {
     // Never mutated — the dead-import leg must not be armed by a flag that a
     // suppressed report's `fix()` can spend. See `dead-import.cjs`.
     const safeBoundInSource = hasToForwardSlashImport;
+    // The dead-import leg's OTHER gate: a `toForwardSlash(…)` call is the text
+    // this fixer writes, and the only evidence available that it wrote it here.
+    // Without it, any file with `toForwardSlash` in scope armed the leg — see
+    // `dead-import.cjs`. Read from the source, never from a `fix()`.
+    let safeReplacementCalled = false;
     let utilsImportNode = null;
     // `path.sep` is the last `path.*` reference in plenty of files, and
     // `toForwardSlash(raw)` consumes it — leaving the same dead `node:path`
@@ -65,7 +70,13 @@ module.exports = {
 
     return {
       'Program:exit'() {
-        reportDeadUnsafeImports(context, sourceCode, pathImportNodes, safeBoundInSource);
+        reportDeadUnsafeImports(
+          context,
+          sourceCode,
+          pathImportNodes,
+          safeBoundInSource,
+          safeReplacementCalled,
+        );
       },
 
       ImportDeclaration(node) {
@@ -83,6 +94,10 @@ module.exports = {
       },
 
       CallExpression(node) {
+        if (node.callee.type === 'Identifier' && node.callee.name === SAFE_FN) {
+          safeReplacementCalled = true;
+        }
+
         // Check for .split(...).join('/') pattern
         if (
           node.callee.type === 'MemberExpression' &&
@@ -101,12 +116,18 @@ module.exports = {
           ) {
             const splitArg = splitCall.arguments[0];
 
-            // Check if splitting by path.sep, '\\', or '\\\\'
+            // Split on path.sep, or on a single backslash character
+            // (source literal '\\'). Splitting on a two-backslash SEQUENCE
+            // (source literal '\\\\', decoded value: two backslash characters)
+            // is a different, rarer operation -- e.g. collapsing a UNC path's
+            // leading double-backslash server prefix -- and toForwardSlash()
+            // is not equivalent to it. Autofixing that case would silently
+            // change program behavior, so it is deliberately excluded here.
             const isSplittingByPathSep =
               (splitArg.type === 'MemberExpression' &&
                 splitArg.object.name === 'path' &&
                 splitArg.property.name === 'sep') ||
-              (splitArg.type === 'Literal' && (splitArg.value === '\\' || splitArg.value === '\\\\'));
+              (splitArg.type === 'Literal' && splitArg.value === '\\');
 
             if (isSplittingByPathSep) {
               const variableBeingSplit = splitCall.callee.object;

package/eslint/rules/path-function-rule-factory.cjs

@@ -147,11 +147,38 @@ function isIdentifierBound(sourceCode, node, name) {
   return false;
 }
 
+/**
+ * Is this the call THIS rule's fixer writes — `safePath.<unsafeFn>(…)`?
+ *
+ * The evidence that this rule migrated something in this file, and the reason it
+ * is not enough to ask whether `safePath` is merely in scope. Read by BOTH legs
+ * that would otherwise mistake a file-wide fact for a claim about `unsafeFn`:
+ * the dead-import leg, and the bare-call repair leg in `classifyCall`.
+ * Matched whether or not `safePath` is bound: an ORPHANED `safePath.join(…)` —
+ * the repair leg's own subject — is still this fixer's handiwork.
+ *
+ * @param {object} node - A `CallExpression`.
+ * @param {string} unsafeFn - The member this rule migrates.
+ * @returns {boolean} True if the callee is `safePath.<unsafeFn>`.
+ */
+function isSafeReplacementCall(node, unsafeFn) {
+  return (
+    node.callee.type === 'MemberExpression' &&
+    node.callee.object.type === 'Identifier' &&
+    node.callee.object.name === SAFE_OBJECT &&
+    node.callee.property.type === 'Identifier' &&
+    node.callee.property.name === unsafeFn
+  );
+}
+
 /**
  * Check if a call expression is an unsafe path function call.
  *
  * Returns `{ isNamed }` — or `{ importOnly: true }` for a call that is already
- * correct and merely missing its import — or null if not a match.
+ * correct and merely missing its import — or `{ isRepair: true }` for a bare call
+ * that is ours only if the file also shows THIS function mid-migration, which
+ * `Program:exit` decides once the whole file has been seen — or null if not a
+ * match.
  */
 function classifyCall(node, unsafeFn, state, sourceCode) {
   const isMember = node.callee.type === 'MemberExpression' && node.callee.property.type === 'Identifier';
@@ -166,15 +193,33 @@ function classifyCall(node, unsafeFn, state, sourceCode) {
     // `--fix` reached a stable fixpoint over source that no longer compiles and
     // exited clean.
     //
-    // Gated on `safePath` already being bound, which is what makes it a repair
-    // rather than a second, sloppier detector. An unbound `join` is NOT reliably
-    // our `join`: ESLint scope analysis does not bind `declare global { function
-    // join() }`, and it cannot see an ambient global from a `globals.d.ts`, an
-    // `@types` package, or a bundler — `resolve` and `relative` are entirely
-    // plausible as those. Requiring `safePath` in scope narrows this to the
-    // half-migrated file it exists to finish, where the name really was ours.
+    // An unbound `join` is NOT reliably our `join`: ESLint scope analysis does
+    // not bind `declare global { function join() }`, and it cannot see an ambient
+    // global from a `globals.d.ts`, an `@types` package, or a bundler — `resolve`
+    // and `relative` are entirely plausible as those. So the leg needs a second
+    // condition, and `safePathBoundInSource` alone was the wrong one: it is a
+    // fact about the FILE, not about `unsafeFn`, and a SIBLING instance of this
+    // factory hands it over for free. `no-path-resolve` rewrites a
+    // `path.resolve(...)` and imports `safePath`; on the next `--fix` pass the
+    // `join` instance sees a file with `safePath` bound and an ambient-global
+    // `join(...)` that predates any of this pack's involvement, and rewrites it
+    // to a different function. Measured with both rules enabled over one file.
+    //
+    // So this is only a CANDIDATE. `Program:exit` admits it once the file has
+    // been seen to contain a `safePath.<unsafeFn>(...)` call — the same positive
+    // evidence the dead-import leg reads, and the only in-file signal that THIS
+    // function is mid-migration HERE. Every genuine strand carries it:
+    // `removeSpecifier` only ever ships inside the same report's fix as the
+    // callee rewrite that consumed the specifier, and ESLint merges a report's
+    // fixes into one all-or-nothing range — so a file cannot lose the `node:path`
+    // specifier without gaining a `safePath.<unsafeFn>(` call.
+    //
+    // What this gives up: a file a HUMAN half-migrated by hand — import deleted,
+    // not one call rewritten — is no longer finished by `--fix`. That file is a
+    // loud `no-undef`/`tsc` error rather than a silent one, and it was never this
+    // pack's doing. Silently redirecting a live call to another function is.
     if (state.safePathBoundInSource && !isIdentifierBound(sourceCode, node.callee, unsafeFn)) {
-      return { isNamed: false };
+      return { isNamed: false, isRepair: true };
     }
     return null;
   }
@@ -363,23 +408,58 @@ module.exports = function createPathFunctionRule(config) {
         // in any file that also has a `path.join()` to fix.
         safePathBoundInSource: isNameAlreadyBound(sourceCode, SAFE_OBJECT),
         safeImportNode: null,
+        // Set from the SOURCE as traversal walks it, and read only at
+        // `Program:exit` — so it is a fact about the text being linted, not
+        // about what a `fix()` intends to write. See `dead-import.cjs`, and the
+        // repair leg in `classifyCall`, which gates on the same flag.
+        safeReplacementCalled: false,
+        // Bare unbound calls awaiting that evidence. Held rather than reported,
+        // because a candidate can precede the migrated call that vouches for it.
+        deferredRepairs: [],
         // EVERY path-module declaration, not just the one carrying `unsafeFn`.
         // A file's dead binding is `import path from 'node:path'`, which
         // `trackPathImport` only ever recorded as a NAME. See `dead-import.cjs`.
         pathImportNodes: [],
       };
 
+      const report = (node, classification) => {
+        context.report({
+          node,
+          messageId: 'noUnsafePathFn',
+          // The module name reaches the message through `{{safeModule}}` rather
+          // than being spelled out in each rule's string, so the advice cannot
+          // drift from where the fixer actually writes the import.
+          data: { safeModule: state.safeModule },
+          fix(fixer) {
+            return buildFix(fixer, node, unsafeFn, classification, sourceCode, state);
+          },
+        });
+      };
+
       return {
         Program(node) {
           reportUnanchoredExemptEntries(context, node);
         },
 
         'Program:exit'() {
+          // Holding these back cannot change any FIX, only when it is computed.
+          // A repair candidate is classified only when `safePath` is bound in the
+          // source, so `hasSafePathImport` starts true and `namedImportSpec` is
+          // null: the report carries no import insert and no specifier removal,
+          // and therefore nothing shared that an earlier report could have spent
+          // first. (`importOnly` is the mirror case — it requires `safePath`
+          // UNBOUND — so the two can never arise in the same file.)
+          if (state.safeReplacementCalled) {
+            for (const candidate of state.deferredRepairs) {
+              report(candidate, { isNamed: false });
+            }
+          }
           reportDeadUnsafeImports(
             context,
             sourceCode,
             state.pathImportNodes,
             state.safePathBoundInSource,
+            state.safeReplacementCalled,
           );
         },
 
@@ -394,22 +474,21 @@ module.exports = function createPathFunctionRule(config) {
         },
 
         CallExpression(node) {
+          if (isSafeReplacementCall(node, unsafeFn)) {
+            state.safeReplacementCalled = true;
+          }
+
           const classification = classifyCall(node, unsafeFn, state, sourceCode);
           if (!classification) {
             return;
           }
 
-          context.report({
-            node,
-            messageId: 'noUnsafePathFn',
-            // The module name reaches the message through `{{safeModule}}` rather
-            // than being spelled out in each rule's string, so the advice cannot
-            // drift from where the fixer actually writes the import.
-            data: { safeModule: state.safeModule },
-            fix(fixer) {
-              return buildFix(fixer, node, unsafeFn, classification, sourceCode, state);
-            },
-          });
+          if (classification.isRepair) {
+            state.deferredRepairs.push(node);
+            return;
+          }
+
+          report(node, classification);
         },
       };
     },

package/eslint/rules/prefer-startswith-over-regex.cjs

@@ -92,6 +92,29 @@ function literalEquivalent(patternBody) {
   return literal;
 }
 
+/**
+ * Count the run of consecutive `\\` characters immediately preceding `index`
+ * in `text`.
+ *
+ * Used to decide whether a trailing `$` is an anchor or an escaped literal
+ * dollar sign: an EVEN run (including zero) means the `$` itself is
+ * unescaped — a genuine end-of-string anchor. An ODD run means the last of
+ * those backslashes escapes the `$`, making it a literal character. Looking
+ * only at the last two characters of the pattern (`\\$`) gets this wrong for
+ * two or more consecutive backslashes: `/\\\\$/` (an escaped backslash `\\\\`
+ * followed by an unescaped `$` anchor) also ends in the two characters `\\$`,
+ * but the `$` there IS an anchor.
+ */
+function countTrailingBackslashes(text, index) {
+  let count = 0;
+  let position = index - 1;
+  while (position >= 0 && text[position] === '\\') {
+    count += 1;
+    position -= 1;
+  }
+  return count;
+}
+
 /**
  * Find the variable `identifier` resolves to, searching outward from its scope.
  */
@@ -245,7 +268,7 @@ module.exports = {
           }
         }
 
-        if (pattern.endsWith('$') && !pattern.endsWith(String.raw`\$`)) {
+        if (pattern.endsWith('$') && countTrailingBackslashes(pattern, pattern.length - 1) % 2 === 0) {
           const literal = literalEquivalent(pattern.slice(0, -1));
           if (literal !== null && literal !== '') {
             report('preferEndsWith', literal);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-agent-toolkit/utils",
-  "version": "0.1.42",
+  "version": "0.2.0-rc.2",
   "type": "module",
   "description": "Core utility functions shared across the vibe-agent-toolkit packages",
   "sideEffects": false,
@@ -84,7 +84,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc && tsx ../dev-tools/src/copy-yaml-assets.ts",
+    "build": "rimraf --glob dist \"*.tsbuildinfo\" && tsc && tsx ../dev-tools/src/copy-yaml-assets.ts",
     "test:unit": "vitest run",
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "test:system": "vitest run --config vitest.system.config.ts",