@vibe-agent-toolkit/utils 0.2.0-rc.7 → 0.2.0-rc.8

package/eslint/rules/no-registry-count-pin.cjs

@@ -0,0 +1,255 @@
+/**
+ * ESLint rule: no-registry-count-pin
+ *
+ * In a test file, flags `expect(<x>).toHaveLength(<n>)` and
+ * `expect(<x>).toBe(<n>)` when `n` is a literal at or above `minLiteral` and
+ * `x` is derived from something the file IMPORTED — a registry, a manifest, a
+ * rule table pulled from src — rather than from a fixture the test built.
+ *
+ * Such a pin is a change detector and only a change detector: it fails on
+ * every legitimate addition, is fixed by retyping the number, and proves
+ * nothing about the set it stands for. The audit found the same four numbers
+ * retyped in two files and a prose sentence, all three wrong at once. The
+ * assertion that means something is the SET — `toEqual([...names].sort())` —
+ * or a derivation from the same source the registry is built from.
+ *
+ * ## The heuristic, and what it deliberately misses
+ *
+ * `x` is registry-derived when its value chain reaches an import binding used
+ * as a VALUE: `REGISTRY`, `REGISTRY.length`, `Object.keys(REGISTRY)`,
+ * `[...REGISTRY]`, `REGISTRY.filter(…)`, a local `const` that holds one of
+ * those, or a call to an imported function whose every argument is itself
+ * registry-derived (so a zero-argument accessor like `allSpecs()` counts).
+ *
+ * An imported function applied to LOCAL data — `parse(fixtureText).links` —
+ * is NOT registry-derived: the count is the fixture's. That includes a literal
+ * argument, so `loadModule('../index.cjs')` is missed on purpose; a literal
+ * module path and a literal fixture are indistinguishable syntactically, and a
+ * rule that fired on `parse('# heading')` would be switched off within a week.
+ * The same holds for a method on an imported receiver: `safePath.join(tmp,
+ * 'x')` is an imported namespace of FUNCTIONS fed local data, so the result is
+ * local — only a method whose arguments are all derived (or callbacks) keeps
+ * the receiver's derivation. Measured on this tree: the receiver-only reading
+ * flagged `hash.toHaveLength(64)` on a hash of a local file.
+ *
+ * Option `minLiteral: number` (default 5) — the smallest literal that reads as
+ * a count of a registry rather than a shape assertion on a small fixture.
+ *
+ * @example
+ * // BAD — fails on every addition, fixed by retyping 27 → 28
+ * expect(Object.keys(plugin.rules)).toHaveLength(27);
+ *
+ * // GOOD — says WHICH, and fails only when the set actually changes
+ * expect(Object.keys(plugin.rules).sort()).toEqual(readdirSync(rulesDir).map(stripExt).sort());
+ */
+
+'use strict';
+
+const { isTestFile } = require('./exempt-path-matcher.cjs');
+
+const COUNT_MATCHERS = new Set(['toHaveLength', 'toBe']);
+const DEFAULT_MIN_LITERAL = 5;
+const FUNCTION_ARGUMENT_TYPES = new Set(['ArrowFunctionExpression', 'FunctionExpression']);
+
+/** The variable an identifier resolves to, walking up the scope chain, or null. */
+function resolveVariable(sourceCode, identifier) {
+  let scope = sourceCode.getScope(identifier);
+  while (scope) {
+    const variable = scope.set.get(identifier.name);
+    if (variable) {
+      return variable;
+    }
+    scope = scope.upper;
+  }
+  return null;
+}
+
+/** Whether `expr` is `expect(...)` or `expect.soft(...)`. */
+function isExpectCall(expr) {
+  if (expr.type !== 'CallExpression') {
+    return false;
+  }
+  const { callee } = expr;
+  if (callee.type === 'Identifier') {
+    return callee.name === 'expect';
+  }
+  return (
+    callee.type === 'MemberExpression' &&
+    callee.object.type === 'Identifier' &&
+    callee.object.name === 'expect' &&
+    callee.property.type === 'Identifier' &&
+    callee.property.name === 'soft'
+  );
+}
+
+/**
+ * The subject of the `expect(...)` a matcher chain hangs off, descending
+ * through modifiers like `.not` / `.resolves`, or null when the chain does not
+ * start at `expect`.
+ */
+function expectSubject(matcherCallee) {
+  let current = matcherCallee.object;
+  while (current.type === 'MemberExpression') {
+    current = current.object;
+  }
+  return isExpectCall(current) ? (current.arguments[0] ?? null) : null;
+}
+
+/** Whether a numeric literal argument at or above `min` was passed. */
+function countLiteral(node, min) {
+  const arg = node.arguments[0];
+  if (node.arguments.length !== 1 || arg.type !== 'Literal' || typeof arg.value !== 'number') {
+    return null;
+  }
+  return arg.value >= min ? arg : null;
+}
+
+/** Whether every element of a call/array/new argument list is registry-derived. */
+function createDerivationCheck(sourceCode) {
+  const visiting = new Set();
+
+  function variableIsDerived(variable) {
+    const def = variable.defs[0];
+    if (!def) {
+      return false;
+    }
+    if (def.type === 'ImportBinding') {
+      return true;
+    }
+    if (def.type !== 'Variable' || !def.node.init || visiting.has(variable)) {
+      return false;
+    }
+    visiting.add(variable);
+    const result = isDerived(def.node.init);
+    visiting.delete(variable);
+    return result;
+  }
+
+  function elementIsDerived(element) {
+    return element?.type === 'SpreadElement' ? isDerived(element.argument) : isDerived(element);
+  }
+
+  /**
+   * Whether no LOCAL data enters a call: every argument is registry-derived,
+   * a callback (`.filter((r) => …)` transforms, it does not supply data), or
+   * absent. A literal counts as local data — see the module comment.
+   */
+  function argumentsCarryNoLocalData(node) {
+    return node.arguments.every(
+      (arg) => FUNCTION_ARGUMENT_TYPES.has(arg.type) || elementIsDerived(arg),
+    );
+  }
+
+  function callIsDerived(node) {
+    const { callee } = node;
+    if (callee.type === 'MemberExpression') {
+      // `Object.keys(x)` — a global transform: look at what went in.
+      // `x.filter(cb)` / `safePath.join(tmp, 'x')` — a method on a value: the
+      // receiver must be derived AND nothing local may enter, or `safePath`
+      // (an imported namespace of FUNCTIONS) would make every path derived.
+      const receiver = callee.object;
+      const receiverVar = receiver.type === 'Identifier' ? resolveVariable(sourceCode, receiver) : null;
+      const receiverIsGlobal = receiver.type === 'Identifier' && (receiverVar?.defs.length ?? 0) === 0;
+      if (receiverIsGlobal) {
+        return node.arguments.some(elementIsDerived);
+      }
+      return isDerived(receiver) && argumentsCarryNoLocalData(node);
+    }
+    if (callee.type !== 'Identifier') {
+      return false;
+    }
+    const variable = resolveVariable(sourceCode, callee);
+    const isImportedFn = variable?.defs[0]?.type === 'ImportBinding';
+    return isImportedFn && argumentsCarryNoLocalData(node);
+  }
+
+  function isDerived(expr) {
+    if (!expr) {
+      return false;
+    }
+    switch (expr.type) {
+      case 'Identifier': {
+        const variable = resolveVariable(sourceCode, expr);
+        return variable !== null && variableIsDerived(variable);
+      }
+      case 'MemberExpression':
+        return isDerived(expr.object);
+      case 'CallExpression':
+        return callIsDerived(expr);
+      case 'NewExpression':
+        return expr.arguments.some(elementIsDerived);
+      case 'ArrayExpression':
+        return expr.elements.some(elementIsDerived);
+      case 'AwaitExpression':
+        return isDerived(expr.argument);
+      case 'ChainExpression':
+      case 'TSAsExpression':
+      case 'TSNonNullExpression':
+        return isDerived(expr.expression);
+      default:
+        return false;
+    }
+  }
+
+  return isDerived;
+}
+
+module.exports = {
+  meta: {
+    type: 'suggestion',
+    docs: {
+      description:
+        'Disallow pinning the size of an imported registry with a literal in tests — ' +
+        'toHaveLength(27) on something pulled from src is a change detector fixed by retyping',
+      recommended: false,
+      recommendedSeverity: 'warn',
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          minLiteral: { type: 'integer', minimum: 0 },
+        },
+        additionalProperties: false,
+      },
+    ],
+    messages: {
+      registryCountPin:
+        'This pins the size of something imported from src to the literal {{literal}}. It fails on ' +
+        'every legitimate addition and is fixed by retyping the number, so it detects change ' +
+        'without checking anything. Assert the SET (toEqual([...names].sort())) or derive the ' +
+        'expected count from the same source the registry is built from.',
+    },
+  },
+
+  create(context) {
+    const filename = context.filename ?? context.getFilename();
+    if (!isTestFile(filename)) {
+      return {};
+    }
+    const sourceCode = context.sourceCode ?? context.getSourceCode();
+    const min = context.options?.[0]?.minLiteral ?? DEFAULT_MIN_LITERAL;
+    const isDerived = createDerivationCheck(sourceCode);
+
+    return {
+      CallExpression(node) {
+        const { callee } = node;
+        if (
+          callee.type !== 'MemberExpression' ||
+          callee.property.type !== 'Identifier' ||
+          !COUNT_MATCHERS.has(callee.property.name)
+        ) {
+          return;
+        }
+        const literal = countLiteral(node, min);
+        if (literal === null) {
+          return;
+        }
+        const subject = expectSubject(callee);
+        if (subject !== null && isDerived(subject)) {
+          context.report({ node, messageId: 'registryCountPin', data: { literal: String(literal.raw) } });
+        }
+      },
+    };
+  },
+};

package/eslint/rules/no-self-package-import.cjs

@@ -94,7 +94,18 @@ module.exports = {
       description:
         "Disallow importing the enclosing package by its own name; use a relative path so the import does not depend on the package's built `dist/`.",
       category: 'Build correctness',
-      recommended: true,
+      bans: 'importing the enclosing package by its own name',
+      useInstead: 'a relative path to the defining module',
+      // Not in `recommended`, for two reasons either of which would be enough. It
+      // REQUIRES a `packageName` option — it will not read a `package.json` to find
+      // out, because a rule module must require nothing (see `index.cjs`) — and a
+      // rule with a required option cannot ride in a config that supplies none.
+      // And the directories it must not fire in are a property of the adopter's
+      // `tsconfig`: a self-import only breaks the build in files the package
+      // COMPILES, while test and example trees import their own package by name on
+      // purpose. The consuming config knows both; see the README.
+      recommended: false,
+      recommendedSeverity: 'error',
     },
     messages: {
       useRelativeImport:
@@ -143,7 +154,7 @@ module.exports = {
       // The specifier hangs off `source`; typescript-eslint has called this
       // property `parameter` and `argument` in earlier majors, and reading the
       // wrong one costs nothing at lint time — the visitor simply never fires.
-      // The `import() in TYPE position` case in `rules.test.ts` is what turns
+      // The `import() in TYPE position` case in `test/eslint/rules/no-self-package-import.test.ts` is what turns
       // that silence into a red test if a future parser renames it again.
       TSImportType: (node) => check(node.source),
       // `require('x')` in the `.cts`/`.cjs` files this pack also lints.

package/eslint/rules/no-test-scoped-functions.cjs

@@ -68,9 +68,16 @@ module.exports = {
   meta: {
     type: 'suggestion',
     docs: {
-      description: 'Disallow function declarations inside test blocks (SonarQube S1515)',
-      category: 'Best Practices',
-      recommended: true,
+      description:
+        'Disallow function declarations inside test blocks (SonarQube S1515)',
+      category: 'Code and test hygiene',
+      bans: 'helper functions declared inside `describe`/`it`',
+      useInstead: 'module scope',
+      // Not in `recommended`: a position on TEST STYLE, not a portability or
+      // correctness fact. Someone installing this package for `safePath.join()`
+      // should not silently inherit a test convention. Enable it by name.
+      recommended: false,
+      recommendedSeverity: 'error',
     },
     messages: {
       moveToModuleScope:

package/eslint/rules/no-unix-shell-commands.cjs

@@ -85,9 +85,13 @@ module.exports = {
   meta: {
     type: 'problem',
     docs: {
-      description: 'Prevent Unix-specific commands that break Windows compatibility',
-      category: 'Cross-Platform',
+      description:
+        'Prevent Unix-specific commands that break Windows compatibility',
+      category: 'Filesystem and process',
+      bans: '`tar`, `grep`, `rm`, `echo`, … spawned directly',
+      useInstead: 'Node APIs, or a portable script fixture',
       recommended: true,
+      recommendedSeverity: 'error',
     },
     fixable: null, // No auto-fix - requires manual refactoring
     schema: [],

package/eslint/rules/no-unsafe-root-join.cjs

@@ -41,8 +41,29 @@ module.exports = {
     docs: {
       description:
         'Enforce safePath.joinUnderRoot() for joins whose first arg is a security root variable (name ends in "Root").',
-      category: 'Security',
-      recommended: true,
+      category: 'Path handling',
+      bans: '`safePath.join(someRoot, x)` where `x` can escape',
+      useInstead: '`safePath.joinUnderRoot()`',
+      subpath: '/path',
+      // Not in `recommended`: an unsound heuristic, pending a rewrite. It keys on
+      // whether an identifier's NAME ends in `root` rather than on whether any
+      // segment is caller-controlled, so it is noisy and blind at once — measured
+      // on a 4,670-file adopter tree: 108 findings, 0 autofixable, and every one
+      // of these verified by execution:
+      //
+      //   FIRES   safePath.join(repoRoot, 'docs', 'product')  <- all literals, cannot escape
+      //   FIRES   safePath.resolve(packageRoot, '..', '..')   <- escaping IS the intent
+      //   FIRES   safePath.join(repoRoot)                     <- one argument, no segment
+      //   silent  safePath.join(base, userInput)              <- THE dangerous shape, missed
+      //
+      // A rule that misses the case it exists to catch must not ride in a config
+      // named `recommended` at any severity — a safety core that cries wolf
+      // teaches people to ignore it, which costs the true positives too. It still
+      // earns `error` where scoped to directories in which a path escape is a
+      // security boundary (VAT scopes it to the skill-test staging code).
+      // Re-include it when it keys on taint rather than on naming.
+      recommended: false,
+      recommendedSeverity: 'error',
     },
     messages: {
       useJoinUnderRoot:

package/eslint/rules/no-url-pathname-for-fs.cjs

@@ -77,8 +77,12 @@ module.exports = {
     docs: {
       description:
         'Disallow `.pathname` on a URL built from `import.meta.url`; use `fileURLToPath()` instead.',
-      category: 'Cross-platform compatibility',
+      category: 'URLs and dynamic imports',
+      bans: '`new URL(x, import.meta.url).pathname` as a filesystem path',
+      useInstead: '`resolveFromImportMeta()` / `fileURLToPath()`',
+      subpath: '/fs',
       recommended: true,
+      recommendedSeverity: 'error',
     },
     messages: {
       useFileURLToPath:

package/eslint/rules/no-version-literal.cjs

@@ -0,0 +1,151 @@
+/**
+ * ESLint rule: no-version-literal
+ *
+ * The mechanical half of CLAUDE.md's "NO VERSIONS" rule. Flags the two shapes
+ * a hand-maintained version integer takes:
+ *
+ * 1. `z.literal(<number>)` on a schema field named like a version
+ *    (`version`, `schemaVersion`, `formatVersion`, `*_VERSION`, …), with or
+ *    without a trailing `.optional()` / `.describe()`;
+ * 2. a variable, `let`, or class field named `<X>_VERSION`, `<X>_REVISION`,
+ *    `VERSION`, `fooVersion`, … initialised to a numeric literal.
+ *
+ * Both are a number a human must remember to bump for stored data to be
+ * judged valid, and nothing fails when they forget: the number and the shape
+ * it claims to describe drift apart silently, and the failure surfaces later
+ * as a reader confidently mis-parsing data it should have refused. A strict
+ * schema already answers "can I read this?" and moves when the shape moves,
+ * for whoever made the edit; a derived digest answers "did these come from
+ * the same shape?". The integer answers neither and costs a permanent human
+ * obligation.
+ *
+ * ## Not offenders, and why the rule already leaves them alone
+ *
+ * - `ANTHROPIC_VERSION = '2023-06-01'` — a STRING header value, an external
+ *   fact; the rule only fires on a NUMERIC initialiser.
+ * - `SUPPORTED_PYTHON_VERSIONS = [...]` — a real list; the name ends in
+ *   `VERSIONS`, not `VERSION`, and the value is an array.
+ * - a regex that PARSES versions; a `const VERSION = '…'` in a test fixture.
+ * - `version: z.string()` / `z.number()` — a field that CARRIES a version is
+ *   fine; a field pinned to one integer is the offender.
+ *
+ * Option `allowNames: string[]` — identifier / property names exempt from the
+ * rule. Ship it empty: the documented non-offenders need no entry, so any
+ * entry here is a version constant somebody decided to keep, and CLAUDE.md
+ * says there is no such case.
+ *
+ * @example
+ * // BAD — bumped from memory, or not
+ * const CACHE_VERSION = 3;
+ * const Cached = z.object({ version: z.literal(3), … });
+ *
+ * // GOOD — the strict schema IS the validity check
+ * const Cached = z.object({ … }).strict();
+ */
+
+'use strict';
+
+/** A name that reads as a version or revision: `X_VERSION`, `VERSION`, `fooVersion`, `version`. */
+const VERSION_NAME = /(?:^|_)(?:VERSION|REVISION)$|(?:^|[a-z])(?:Version|Revision)$|^(?:version|revision)$/u;
+
+/** The numeric literal an initialiser reduces to, seeing through `as const`, or null. */
+function numericInitialiser(init) {
+  if (!init) {
+    return null;
+  }
+  if (init.type === 'TSAsExpression' || init.type === 'TSSatisfiesExpression') {
+    return numericInitialiser(init.expression);
+  }
+  return init.type === 'Literal' && typeof init.value === 'number' ? init : null;
+}
+
+/** The plain name of a declarator id, property key, or class field key, or null. */
+function keyName(key) {
+  if (key.type === 'Identifier') {
+    return key.name;
+  }
+  return key.type === 'Literal' && typeof key.value === 'string' ? key.value : null;
+}
+
+/** Whether a property value's chain roots at `z.literal(<number>)`. */
+function rootsAtNumericZodLiteral(value) {
+  let current = value;
+  while (current.type === 'CallExpression' && current.callee.type === 'MemberExpression') {
+    const { callee } = current;
+    const isZodLiteral =
+      callee.object.type === 'Identifier' &&
+      callee.object.name === 'z' &&
+      callee.property.type === 'Identifier' &&
+      callee.property.name === 'literal';
+    if (isZodLiteral) {
+      return numericInitialiser(current.arguments[0]) !== null;
+    }
+    current = callee.object;
+  }
+  return false;
+}
+
+module.exports = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Disallow z.literal(<number>) on a version-named field and <X>_VERSION = <number> ' +
+        'constants — a hand-bumped integer deciding data validity is the shape CLAUDE.md bans',
+      recommended: false,
+      recommendedSeverity: 'warn',
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          allowNames: { type: 'array', items: { type: 'string' }, uniqueItems: true },
+        },
+        additionalProperties: false,
+      },
+    ],
+    messages: {
+      versionConstant:
+        '{{name}} is a hand-maintained version integer: nothing fails when it is not bumped, so ' +
+        'the number and the shape drift apart silently. Delete it — a .strict() schema already ' +
+        'refuses data it cannot read, and a digest of the shape answers "same shape?" without ' +
+        'anyone remembering a number.',
+      versionLiteralField:
+        '{{name}}: z.literal(<number>) pins stored data to an integer a human must remember to ' +
+        'bump. Delete the field and let the .strict() schema decide validity, or derive a digest ' +
+        'of the shape instead.',
+    },
+  },
+
+  create(context) {
+    const allow = new Set(context.options?.[0]?.allowNames ?? []);
+
+    function checkNamedInitialiser(node, key, init) {
+      const name = keyName(key);
+      if (name === null || allow.has(name) || !VERSION_NAME.test(name)) {
+        return;
+      }
+      if (numericInitialiser(init) !== null) {
+        context.report({ node, messageId: 'versionConstant', data: { name } });
+      }
+    }
+
+    return {
+      VariableDeclarator(node) {
+        checkNamedInitialiser(node, node.id, node.init);
+      },
+      PropertyDefinition(node) {
+        checkNamedInitialiser(node, node.key, node.value);
+      },
+      Property(node) {
+        const name = keyName(node.key);
+        if (name === null || allow.has(name) || !VERSION_NAME.test(name)) {
+          return;
+        }
+        if (rootsAtNumericZodLiteral(node.value)) {
+          context.report({ node, messageId: 'versionLiteralField', data: { name } });
+        }
+      },
+    };
+  },
+};

package/eslint/rules/prefer-startswith-over-regex.cjs

@@ -195,7 +195,16 @@ module.exports = {
     docs: {
       description:
         String.raw`Prefer String#startsWith / String#endsWith over /^literal/.test() — including escaped literals such as \/ and \*, and regexes held in a const`,
+      category: 'Code and test hygiene',
+      bans: '`/^foo/.test(s)`, `` /^\\*glob/.test(s) ``, `const RE = /^foo/; RE.test(s)`',
+      useInstead: "`s.startsWith('foo')`",
+      // `error`, deliberately. This rule was briefly graded on a different axis
+      // ("style, not a defect") and demoted to `warn` — wrong twice over: avoiding
+      // a SonarQube S6557 at lint time instead of at merge time is a real saving,
+      // and the matcher rejects any regex containing a metacharacter, so it only
+      // fires on true literal prefixes and has near-zero churn.
       recommended: true,
+      recommendedSeverity: 'error',
     },
     messages: {
       // `{{pattern}}` carries its FLAGS. Rendering `/^abc/` for a source

package/eslint/rules/require-justified-skip.cjs

@@ -253,8 +253,14 @@ module.exports = {
     docs: {
       description:
         'Require a tracking-issue justification for skipped tests, and ban tautological assertions',
-      category: 'Best Practices',
-      recommended: true,
+      category: 'Code and test hygiene',
+      bans: 'unannotated `it.skip`/`it.todo`, tautological assertions, empty test bodies',
+      useInstead: 'a `SKIP(#123): reason` annotation, or a real assertion',
+      // Not in `recommended`: a position on TEST STYLE, not a portability or
+      // correctness fact. Someone installing this package for `safePath.join()`
+      // should not silently inherit a test convention. Enable it by name.
+      recommended: false,
+      recommendedSeverity: 'error',
     },
     schema: [],
     messages: {

package/eslint/rules/safe-import.cjs

@@ -106,7 +106,7 @@ function insertAboveWithComments(fixer, sourceCode, node, text) {
  * PER-RULE rather than one shared `settings` key, because a seam does not have
  * to split its symbols the way this package does. The same adopter's narrow
  * entry carries `normalizedTmpdir`/`mkdirSyncReal` but NOT `safePath`, so their
- * `no-os-tmpdir` and `no-path-join` need different targets — the exact "path
+ * `no-os-tmpdir` and `no-raw-node-path` need different targets — the exact "path
  * rules here, fs rules there" case a single key cannot express.
  */
 const SAFE_MODULE_PROPERTY = Object.freeze({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-agent-toolkit/utils",
-  "version": "0.2.0-rc.7",
+  "version": "0.2.0-rc.8",
   "type": "module",
   "description": "Core utility functions shared across the vibe-agent-toolkit packages",
   "sideEffects": [
@@ -90,19 +90,19 @@
     "README.md"
   ],
   "scripts": {
-    "build": "rimraf --glob dist \"*.tsbuildinfo\" && tsc",
+    "build": "tsx ../dev-tools/src/tsc-clean-build.ts",
     "test:unit": "vitest run",
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
-    "clean": "rimraf dist *.tsbuildinfo"
+    "clean": "rimraf --glob dist \"*.tsbuildinfo\" .tsc-staging"
   },
   "dependencies": {
     "@vibe-validate/git": "0.20.1",
     "ignore": "^7.0.5",
     "picomatch": "^4.0.3",
     "which": "^5.0.0",
-    "yaml": "^2.6.1"
+    "yaml": "^2.9.0"
   },
   "peerDependencies": {
     "eslint": ">=9.0.0"
@@ -113,12 +113,7 @@
     }
   },
   "devDependencies": {
-    "@types/picomatch": "^4.0.2",
     "@types/which": "^3.0.4",
-    "eslint": "^9.39.5",
-    "rimraf": "^6.0.1",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.11",
     "zod": "^3.25.0"
   },
   "publishConfig": {

package/eslint/rules/no-path-join.cjs

@@ -1,14 +0,0 @@
-/**
- * ESLint rule: no-path-join
- *
- * Bans path.join() from node:path. Use safePath.join() from `@vibe-agent-toolkit/utils/path`.
- * safePath.join() wraps path.join() + toForwardSlash() to prevent Windows backslash bugs.
- */
-const factory = require('./path-function-rule-factory.cjs');
-
-module.exports = factory({
-  unsafeFn: 'join',
-  message:
-    'Use safePath.join() from {{safeModule}} instead of path.join(). ' +
-    'path.join() returns backslashes on Windows, causing Map key mismatches and path comparison bugs.',
-});

package/eslint/rules/no-path-relative.cjs

@@ -1,14 +0,0 @@
-/**
- * ESLint rule: no-path-relative
- *
- * Bans path.relative() from node:path. Use safePath.relative() from `@vibe-agent-toolkit/utils/path`.
- * safePath.relative() wraps path.relative() + toForwardSlash() to prevent Windows backslash bugs.
- */
-const factory = require('./path-function-rule-factory.cjs');
-
-module.exports = factory({
-  unsafeFn: 'relative',
-  message:
-    'Use safePath.relative() from {{safeModule}} instead of path.relative(). ' +
-    'path.relative() returns backslashes on Windows, causing Map key mismatches and path comparison bugs.',
-});

package/eslint/rules/no-path-resolve.cjs

@@ -1,14 +0,0 @@
-/**
- * ESLint rule: no-path-resolve
- *
- * Bans path.resolve() from node:path. Use safePath.resolve() from `@vibe-agent-toolkit/utils/path`.
- * safePath.resolve() wraps path.resolve() + toForwardSlash() to prevent Windows backslash bugs.
- */
-const factory = require('./path-function-rule-factory.cjs');
-
-module.exports = factory({
-  unsafeFn: 'resolve',
-  message:
-    'Use safePath.resolve() from {{safeModule}} instead of path.resolve(). ' +
-    'path.resolve() returns backslashes on Windows, causing Map key mismatches and path comparison bugs.',
-});