@voltlaunchrr/eslint-plugin 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. Please also get an in-touch
+      with us so we can add your project to our list of projects
+      using the Apache License.
+
+   Copyright 2026 VoltLaunchr Contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,22 @@
+# Volt ESLint Plugin
+
+Rules for Volt extension authors.
+
+```js
+import volt from "@voltlaunchrr/eslint-plugin";
+
+export default [
+  ...volt.configs.recommended,
+];
+```
+
+## Rules
+
+- `@voltlaunchrr/no-tauri-api-import`
+- `@voltlaunchrr/require-manifest-permission`
+- `@voltlaunchrr/no-secret-in-storage`
+- `@voltlaunchrr/no-unsafe-open-url`
+- `@voltlaunchrr/no-broad-system-action`
+- `@voltlaunchrr/prefer-hud-for-silent-action`
+- `@voltlaunchrr/manifest-valid-permissions`
+- `@voltlaunchrr/manifest-title-description-quality`

package/dist/ast.d.ts

@@ -0,0 +1,7 @@
+import { type TSESTree } from '@typescript-eslint/utils';
+export declare function getStaticPropertyName(node: TSESTree.Node): string | null;
+export declare function getMemberPath(node: TSESTree.Node): string[] | null;
+export declare function getCallPath(node: TSESTree.CallExpression): string[] | null;
+export declare function pathStartsWith(path: readonly string[], prefix: readonly string[]): boolean;
+export declare function isIdentifierLike(node: TSESTree.Node, pattern: RegExp): boolean;
+export declare function containsCallPath(node: TSESTree.Node, predicate: (path: readonly string[]) => boolean): boolean;

package/dist/ast.js

@@ -0,0 +1,77 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+export function getStaticPropertyName(node) {
+    if (node.type === AST_NODE_TYPES.Identifier) {
+        return node.name;
+    }
+    if (node.type === AST_NODE_TYPES.Literal && typeof node.value === 'string') {
+        return node.value;
+    }
+    return null;
+}
+export function getMemberPath(node) {
+    if (node.type === AST_NODE_TYPES.Identifier) {
+        return [node.name];
+    }
+    if (node.type !== AST_NODE_TYPES.MemberExpression) {
+        return null;
+    }
+    const objectPath = getMemberPath(node.object);
+    if (!objectPath) {
+        return null;
+    }
+    const propertyName = getStaticPropertyName(node.property);
+    if (!propertyName) {
+        return null;
+    }
+    return [...objectPath, propertyName];
+}
+export function getCallPath(node) {
+    return getMemberPath(node.callee);
+}
+export function pathStartsWith(path, prefix) {
+    return prefix.every((part, index) => path[index] === part);
+}
+export function isIdentifierLike(node, pattern) {
+    if (node.type === AST_NODE_TYPES.Identifier) {
+        return pattern.test(node.name);
+    }
+    if (node.type === AST_NODE_TYPES.MemberExpression) {
+        const path = getMemberPath(node);
+        return path ? pattern.test(path.join('.')) : false;
+    }
+    return false;
+}
+export function containsCallPath(node, predicate) {
+    if (node.type === AST_NODE_TYPES.CallExpression) {
+        const path = getCallPath(node);
+        if (path && predicate(path)) {
+            return true;
+        }
+    }
+    for (const [key, value] of Object.entries(node)) {
+        if (key === 'parent' || key === 'loc' || key === 'range' || key === 'tokens' || key === 'comments') {
+            continue;
+        }
+        if (!value) {
+            continue;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (isNode(item) && containsCallPath(item, predicate)) {
+                    return true;
+                }
+            }
+            continue;
+        }
+        if (isNode(value) && containsCallPath(value, predicate)) {
+            return true;
+        }
+    }
+    return false;
+}
+function isNode(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'type' in value &&
+        typeof value.type === 'string');
+}

package/dist/create-rule.d.ts

@@ -0,0 +1,4 @@
+import { ESLintUtils } from '@typescript-eslint/utils';
+export declare const createRule: <Options extends readonly unknown[], MessageIds extends string>({ meta, name, ...rule }: Readonly<ESLintUtils.RuleWithMetaAndName<Options, MessageIds, unknown>>) => ESLintUtils.RuleModule<MessageIds, Options, unknown, ESLintUtils.RuleListener> & {
+    name: string;
+};

package/dist/create-rule.js

@@ -0,0 +1,2 @@
+import { ESLintUtils } from '@typescript-eslint/utils';
+export const createRule = ESLintUtils.RuleCreator((name) => `https://github.com/VoltLaunchr/Volt/tree/dev/packages/eslint-plugin/docs/rules/${name}.md`);

package/dist/index.d.ts

@@ -0,0 +1,30 @@
+import type { TSESLint } from '@typescript-eslint/utils';
+declare const rules: {
+    'no-tauri-api-import': TSESLint.RuleModule<"forbidden", [], unknown, TSESLint.RuleListener> & {
+        name: string;
+    };
+    'require-manifest-permission': TSESLint.RuleModule<"missing" | "manifestMissing", [import("./manifest.js").ManifestRuleOptions?], unknown, TSESLint.RuleListener> & {
+        name: string;
+    };
+    'no-secret-in-storage': TSESLint.RuleModule<"secret", [], unknown, TSESLint.RuleListener> & {
+        name: string;
+    };
+    'no-unsafe-open-url': TSESLint.RuleModule<"unsafe", [], unknown, TSESLint.RuleListener> & {
+        name: string;
+    };
+    'no-broad-system-action': TSESLint.RuleModule<"confirm", [], unknown, TSESLint.RuleListener> & {
+        name: string;
+    };
+    'prefer-hud-for-silent-action': TSESLint.RuleModule<"hud", [], unknown, TSESLint.RuleListener> & {
+        name: string;
+    };
+    'manifest-valid-permissions': TSESLint.RuleModule<"invalid", [], unknown, TSESLint.RuleListener> & {
+        name: string;
+    };
+    'manifest-title-description-quality': TSESLint.RuleModule<"genericName" | "emptyDescription" | "badCasing", [], unknown, TSESLint.RuleListener> & {
+        name: string;
+    };
+};
+declare const plugin: TSESLint.FlatConfig.Plugin;
+export default plugin;
+export { rules };

package/dist/index.js

@@ -0,0 +1,48 @@
+import { manifestTitleDescriptionQuality } from './rules/manifest-title-description-quality.js';
+import { manifestValidPermissions } from './rules/manifest-valid-permissions.js';
+import { noBroadSystemAction } from './rules/no-broad-system-action.js';
+import { noSecretInStorage } from './rules/no-secret-in-storage.js';
+import { noTauriApiImport } from './rules/no-tauri-api-import.js';
+import { noUnsafeOpenUrl } from './rules/no-unsafe-open-url.js';
+import { preferHudForSilentAction } from './rules/prefer-hud-for-silent-action.js';
+import { requireManifestPermission } from './rules/require-manifest-permission.js';
+const rules = {
+    'no-tauri-api-import': noTauriApiImport,
+    'require-manifest-permission': requireManifestPermission,
+    'no-secret-in-storage': noSecretInStorage,
+    'no-unsafe-open-url': noUnsafeOpenUrl,
+    'no-broad-system-action': noBroadSystemAction,
+    'prefer-hud-for-silent-action': preferHudForSilentAction,
+    'manifest-valid-permissions': manifestValidPermissions,
+    'manifest-title-description-quality': manifestTitleDescriptionQuality,
+};
+const plugin = {
+    meta: {
+        name: '@voltlaunchrr/eslint-plugin',
+        namespace: '@voltlaunchrr',
+        version: '0.1.0',
+    },
+    rules,
+    configs: {},
+};
+plugin.configs = {
+    recommended: [
+        {
+            plugins: {
+                '@voltlaunchrr': plugin,
+            },
+            rules: {
+                '@voltlaunchrr/no-tauri-api-import': 'error',
+                '@voltlaunchrr/require-manifest-permission': 'error',
+                '@voltlaunchrr/no-secret-in-storage': 'error',
+                '@voltlaunchrr/no-unsafe-open-url': 'warn',
+                '@voltlaunchrr/no-broad-system-action': 'warn',
+                '@voltlaunchrr/prefer-hud-for-silent-action': 'warn',
+                '@voltlaunchrr/manifest-valid-permissions': 'error',
+                '@voltlaunchrr/manifest-title-description-quality': 'warn',
+            },
+        },
+    ],
+};
+export default plugin;
+export { rules };

package/dist/manifest.d.ts

@@ -0,0 +1,30 @@
+export declare const allowedPermissions: readonly ["clipboard", "network", "notifications", "openUrl", "oauth", "ai", "system"];
+export type VoltPermission = (typeof allowedPermissions)[number];
+export interface ManifestData {
+    readonly name?: string | undefined;
+    readonly title?: string | undefined;
+    readonly description?: string | undefined;
+    readonly permissions: readonly string[];
+    readonly commands: readonly ManifestCommand[];
+}
+export interface ManifestCommand {
+    readonly name?: string | undefined;
+    readonly title?: string | undefined;
+    readonly description?: string | undefined;
+}
+export interface ManifestRuleOptions {
+    readonly manifestPath?: string;
+    readonly manifest?: {
+        readonly permissions?: readonly string[];
+    };
+}
+interface RuleContextWithFile {
+    readonly cwd: string;
+    readonly filename: string;
+}
+export declare function isAllowedPermission(permission: string): permission is VoltPermission;
+export declare function isManifestFile(filename: string): boolean;
+export declare function parseManifestText(text: string): ManifestData | null;
+export declare function readManifestForRule(context: RuleContextWithFile, options: ManifestRuleOptions | undefined): ManifestData | null;
+export declare function getDeclaredPermissions(context: RuleContextWithFile, options: ManifestRuleOptions | undefined): ReadonlySet<string> | null;
+export {};

package/dist/manifest.js

@@ -0,0 +1,103 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export const allowedPermissions = [
+    'clipboard',
+    'network',
+    'notifications',
+    'openUrl',
+    'oauth',
+    'ai',
+    'system',
+];
+const manifestCache = new Map();
+export function isAllowedPermission(permission) {
+    return allowedPermissions.includes(permission);
+}
+export function isManifestFile(filename) {
+    return normalizePath(filename).endsWith('/manifest.json');
+}
+export function parseManifestText(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (!isRecord(parsed)) {
+            return null;
+        }
+        const permissions = Array.isArray(parsed.permissions)
+            ? parsed.permissions.filter((permission) => typeof permission === 'string')
+            : [];
+        const commands = Array.isArray(parsed.commands)
+            ? parsed.commands.filter(isRecord).map((command) => ({
+                name: typeof command.name === 'string' ? command.name : undefined,
+                title: typeof command.title === 'string' ? command.title : undefined,
+                description: typeof command.description === 'string' ? command.description : undefined,
+            }))
+            : [];
+        return {
+            name: typeof parsed.name === 'string' ? parsed.name : undefined,
+            title: typeof parsed.title === 'string' ? parsed.title : undefined,
+            description: typeof parsed.description === 'string' ? parsed.description : undefined,
+            permissions,
+            commands,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function readManifestForRule(context, options) {
+    if (options?.manifest) {
+        return {
+            permissions: options.manifest.permissions ?? [],
+            commands: [],
+        };
+    }
+    const configuredPath = options?.manifestPath;
+    if (configuredPath) {
+        const absolutePath = path.isAbsolute(configuredPath)
+            ? configuredPath
+            : path.resolve(context.cwd, configuredPath);
+        return readManifestFile(absolutePath);
+    }
+    return findNearestManifest(context.filename);
+}
+export function getDeclaredPermissions(context, options) {
+    const manifest = readManifestForRule(context, options);
+    return manifest ? new Set(manifest.permissions) : null;
+}
+function findNearestManifest(filename) {
+    if (filename === '<input>' || filename.startsWith('<')) {
+        return null;
+    }
+    let current = path.dirname(filename);
+    const root = path.parse(current).root;
+    while (current && current !== root) {
+        const candidate = path.join(current, 'manifest.json');
+        if (fs.existsSync(candidate)) {
+            return readManifestFile(candidate);
+        }
+        current = path.dirname(current);
+    }
+    return null;
+}
+function readManifestFile(filename) {
+    const cached = manifestCache.get(filename);
+    if (cached !== undefined) {
+        return cached;
+    }
+    try {
+        const text = fs.readFileSync(filename, 'utf8');
+        const parsed = parseManifestText(text);
+        manifestCache.set(filename, parsed);
+        return parsed;
+    }
+    catch {
+        manifestCache.set(filename, null);
+        return null;
+    }
+}
+function normalizePath(filename) {
+    return filename.replace(/\\/g, '/');
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/dist/rules/manifest-title-description-quality.d.ts

@@ -0,0 +1,4 @@
+import type { TSESLint } from '@typescript-eslint/utils';
+export declare const manifestTitleDescriptionQuality: TSESLint.RuleModule<"genericName" | "emptyDescription" | "badCasing", [], unknown, TSESLint.RuleListener> & {
+    name: string;
+};

package/dist/rules/manifest-title-description-quality.js

@@ -0,0 +1,67 @@
+import { createRule } from '../create-rule.js';
+import { isManifestFile, parseManifestText } from '../manifest.js';
+const genericNamePattern = /^(extension|plugin|tool|utility|app|my extension|new extension|test|demo|sample|untitled)$/i;
+export const manifestTitleDescriptionQuality = createRule({
+    name: 'manifest-title-description-quality',
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Flag generic Volt extension names, weak titles, and empty descriptions.',
+        },
+        messages: {
+            genericName: 'Manifest {{field}} "{{value}}" is too generic for the Volt extension store.',
+            emptyDescription: 'Manifest description should be specific and non-empty.',
+            badCasing: 'Manifest {{field}} "{{value}}" should use readable title casing, not snake_case, kebab-case, or all lowercase.',
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        return {
+            Program(node) {
+                if (!isManifestFile(context.filename)) {
+                    return;
+                }
+                const manifest = parseManifestText(context.sourceCode.getText());
+                if (!manifest) {
+                    return;
+                }
+                const topLevelName = manifest.title ?? manifest.name;
+                if (topLevelName) {
+                    reportWeakLabel(context, node, 'name', topLevelName);
+                }
+                if (!manifest.description || manifest.description.trim().length < 12) {
+                    context.report({ node, messageId: 'emptyDescription' });
+                }
+                for (const command of manifest.commands) {
+                    if (command.title) {
+                        reportWeakLabel(context, node, 'command title', command.title);
+                    }
+                }
+            },
+        };
+    },
+});
+function reportWeakLabel(context, node, field, value) {
+    const trimmed = value.trim();
+    if (genericNamePattern.test(trimmed)) {
+        context.report({
+            node,
+            messageId: 'genericName',
+            data: { field, value: trimmed },
+        });
+        return;
+    }
+    if (hasBadCasing(trimmed)) {
+        context.report({
+            node,
+            messageId: 'badCasing',
+            data: { field, value: trimmed },
+        });
+    }
+}
+function hasBadCasing(value) {
+    return (value.includes('_') ||
+        value.includes('-') ||
+        (/^[a-z\s]+$/.test(value) && value.split(/\s+/).filter(Boolean).length > 1));
+}

package/dist/rules/manifest-valid-permissions.d.ts

@@ -0,0 +1,3 @@
+export declare const manifestValidPermissions: import("@typescript-eslint/utils/ts-eslint").RuleModule<"invalid", [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
+    name: string;
+};

package/dist/rules/manifest-valid-permissions.js

@@ -0,0 +1,41 @@
+import { createRule } from '../create-rule.js';
+import { allowedPermissions, isAllowedPermission, isManifestFile, parseManifestText, } from '../manifest.js';
+export const manifestValidPermissions = createRule({
+    name: 'manifest-valid-permissions',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Validate Volt extension manifest permissions.',
+        },
+        messages: {
+            invalid: 'Invalid Volt extension permission "{{permission}}". Allowed permissions: {{allowed}}.',
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        return {
+            Program(node) {
+                if (!isManifestFile(context.filename)) {
+                    return;
+                }
+                const manifest = parseManifestText(context.sourceCode.getText());
+                if (!manifest) {
+                    return;
+                }
+                for (const permission of manifest.permissions) {
+                    if (!isAllowedPermission(permission)) {
+                        context.report({
+                            node,
+                            messageId: 'invalid',
+                            data: {
+                                permission,
+                                allowed: allowedPermissions.join(', '),
+                            },
+                        });
+                    }
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-broad-system-action.d.ts

@@ -0,0 +1,3 @@
+export declare const noBroadSystemAction: import("@typescript-eslint/utils/ts-eslint").RuleModule<"confirm", [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
+    name: string;
+};

package/dist/rules/no-broad-system-action.js

@@ -0,0 +1,30 @@
+import { getCallPath, pathStartsWith } from '../ast.js';
+import { createRule } from '../create-rule.js';
+export const noBroadSystemAction = createRule({
+    name: 'no-broad-system-action',
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Require confirmation before broad or destructive system actions.',
+        },
+        messages: {
+            confirm: 'Call VoltAPI.confirm before VoltAPI.system.moveToTrash.',
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        return {
+            CallExpression(node) {
+                const path = getCallPath(node);
+                if (!pathStartsWith(path ?? [], ['VoltAPI', 'system', 'moveToTrash'])) {
+                    return;
+                }
+                const textBeforeCall = context.sourceCode.getText().slice(0, node.range[0]);
+                if (!/\bVoltAPI\.confirm\s*\(/.test(textBeforeCall)) {
+                    context.report({ node, messageId: 'confirm' });
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-secret-in-storage.d.ts

@@ -0,0 +1,3 @@
+export declare const noSecretInStorage: import("@typescript-eslint/utils/ts-eslint").RuleModule<"secret", [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
+    name: string;
+};

package/dist/rules/no-secret-in-storage.js

@@ -0,0 +1,85 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import { getCallPath, isIdentifierLike, pathStartsWith } from '../ast.js';
+import { createRule } from '../create-rule.js';
+const secretPattern = /api[_-]?key|token|secret|password|passwd|bearer|jwt|credential|client[_-]?secret|access[_-]?token|refresh[_-]?token|auth/i;
+export const noSecretInStorage = createRule({
+    name: 'no-secret-in-storage',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow storing API keys and tokens in plain extension storage.',
+        },
+        messages: {
+            secret: 'Do not store secrets in localStorage, sessionStorage, or VoltAPI.storage. Use VoltAPI.secrets or a secret preference.',
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        function reportIfSecret(node, values) {
+            if (values.some(isSecretLikeNode)) {
+                context.report({ node, messageId: 'secret' });
+            }
+        }
+        return {
+            CallExpression(node) {
+                const path = getCallPath(node);
+                if (!path) {
+                    return;
+                }
+                const isPlainStorageSet = pathStartsWith(path, ['localStorage', 'setItem']) ||
+                    pathStartsWith(path, ['sessionStorage', 'setItem']) ||
+                    pathStartsWith(path, ['VoltAPI', 'storage', 'set']);
+                if (isPlainStorageSet) {
+                    reportIfSecret(node, node.arguments.filter(isExpression));
+                }
+            },
+            AssignmentExpression(node) {
+                const leftPath = getCallPathLike(node.left);
+                if (!leftPath) {
+                    return;
+                }
+                if (leftPath[0] === 'localStorage' || leftPath[0] === 'sessionStorage') {
+                    reportIfSecret(node, [node.left, node.right]);
+                }
+            },
+        };
+    },
+});
+function isSecretLikeNode(node) {
+    if (node.type === AST_NODE_TYPES.Literal && typeof node.value === 'string') {
+        return secretPattern.test(node.value);
+    }
+    if (node.type === AST_NODE_TYPES.TemplateLiteral) {
+        return node.quasis.some((quasi) => secretPattern.test(quasi.value.raw));
+    }
+    return isIdentifierLike(node, secretPattern);
+}
+function isExpression(node) {
+    return node.type !== AST_NODE_TYPES.SpreadElement;
+}
+function getCallPathLike(node) {
+    if (node.type !== AST_NODE_TYPES.MemberExpression) {
+        return null;
+    }
+    const parts = [];
+    let current = node;
+    while (current.type === AST_NODE_TYPES.MemberExpression) {
+        const property = current.property;
+        if (property.type === AST_NODE_TYPES.Identifier) {
+            parts.unshift(property.name);
+        }
+        else if (property.type === AST_NODE_TYPES.Literal && typeof property.value === 'string') {
+            parts.unshift(property.value);
+        }
+        else {
+            return null;
+        }
+        current = current.object;
+    }
+    if (current.type !== AST_NODE_TYPES.Identifier) {
+        return null;
+    }
+    parts.unshift(current.name);
+    return parts;
+}

package/dist/rules/no-tauri-api-import.d.ts

@@ -0,0 +1,3 @@
+export declare const noTauriApiImport: import("@typescript-eslint/utils/ts-eslint").RuleModule<"forbidden", [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
+    name: string;
+};

package/dist/rules/no-tauri-api-import.js

@@ -0,0 +1,67 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import { createRule } from '../create-rule.js';
+function isTauriSpecifier(value) {
+    return value === '@tauri-apps/api' || value.startsWith('@tauri-apps/api/');
+}
+export const noTauriApiImport = createRule({
+    name: 'no-tauri-api-import',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow direct Tauri API imports in Volt extensions.',
+        },
+        messages: {
+            forbidden: 'Do not import {{specifier}} from a Volt extension. Use VoltAPI instead.',
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        function reportSpecifier(node) {
+            if (typeof node.value === 'string' && isTauriSpecifier(node.value)) {
+                context.report({
+                    node,
+                    messageId: 'forbidden',
+                    data: { specifier: node.value },
+                });
+            }
+        }
+        return {
+            Identifier(node) {
+                if (node.name === '__TAURI__') {
+                    context.report({
+                        node,
+                        messageId: 'forbidden',
+                        data: { specifier: '__TAURI__' },
+                    });
+                }
+            },
+            ImportDeclaration(node) {
+                reportSpecifier(node.source);
+            },
+            ExportAllDeclaration(node) {
+                reportSpecifier(node.source);
+            },
+            ExportNamedDeclaration(node) {
+                if (node.source) {
+                    reportSpecifier(node.source);
+                }
+            },
+            CallExpression(node) {
+                if (node.callee.type === AST_NODE_TYPES.Identifier &&
+                    node.callee.name === 'require' &&
+                    isStringLiteral(node.arguments[0])) {
+                    reportSpecifier(node.arguments[0]);
+                }
+            },
+            ImportExpression(node) {
+                if (isStringLiteral(node.source)) {
+                    reportSpecifier(node.source);
+                }
+            },
+        };
+    },
+});
+function isStringLiteral(node) {
+    return node?.type === AST_NODE_TYPES.Literal && typeof node.value === 'string';
+}

package/dist/rules/no-unsafe-open-url.d.ts

@@ -0,0 +1,3 @@
+export declare const noUnsafeOpenUrl: import("@typescript-eslint/utils/ts-eslint").RuleModule<"unsafe", [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
+    name: string;
+};

package/dist/rules/no-unsafe-open-url.js

@@ -0,0 +1,74 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import { getCallPath, pathStartsWith } from '../ast.js';
+import { createRule } from '../create-rule.js';
+const validatedNamePattern = /safe|trusted|validated|allowed|saniti[sz]ed/i;
+const validatorNamePattern = /validate|assert|safe|trusted|allow|saniti[sz]e/i;
+export const noUnsafeOpenUrl = createRule({
+    name: 'no-unsafe-open-url',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require Volt openUrl calls to use explicit or validated URLs.',
+        },
+        messages: {
+            unsafe: 'openUrl must receive an explicit URL literal or a value that is visibly validated before opening.',
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        return {
+            CallExpression(node) {
+                if (!isOpenUrlCall(node)) {
+                    return;
+                }
+                const firstArg = node.arguments[0];
+                if (!firstArg || firstArg.type === AST_NODE_TYPES.SpreadElement || !isSafeUrlArgument(firstArg)) {
+                    context.report({ node, messageId: 'unsafe' });
+                }
+            },
+        };
+    },
+});
+function isOpenUrlCall(node) {
+    const path = getCallPath(node);
+    if (!path) {
+        return false;
+    }
+    return (pathStartsWith(path, ['VoltAPI', 'utils', 'openUrl']) ||
+        (path.length === 1 && path[0] === 'openUrl'));
+}
+function isSafeUrlArgument(node) {
+    if (node.type === AST_NODE_TYPES.Literal && typeof node.value === 'string') {
+        return hasExplicitSafeScheme(node.value);
+    }
+    if (node.type === AST_NODE_TYPES.Identifier) {
+        return validatedNamePattern.test(node.name);
+    }
+    if (node.type === AST_NODE_TYPES.CallExpression) {
+        const path = getCallPath(node);
+        if (path && validatorNamePattern.test(path.join('.'))) {
+            return true;
+        }
+        if (node.callee.type === AST_NODE_TYPES.MemberExpression &&
+            node.callee.property.type === AST_NODE_TYPES.Identifier &&
+            node.callee.property.name === 'toString' &&
+            node.callee.object.type === AST_NODE_TYPES.NewExpression) {
+            return isNewUrlWithLiteral(node.callee.object);
+        }
+    }
+    if (node.type === AST_NODE_TYPES.NewExpression) {
+        return isNewUrlWithLiteral(node);
+    }
+    return false;
+}
+function isNewUrlWithLiteral(node) {
+    return (node.callee.type === AST_NODE_TYPES.Identifier &&
+        node.callee.name === 'URL' &&
+        node.arguments[0]?.type === AST_NODE_TYPES.Literal &&
+        typeof node.arguments[0].value === 'string' &&
+        hasExplicitSafeScheme(node.arguments[0].value));
+}
+function hasExplicitSafeScheme(value) {
+    return /^(https?|mailto):/i.test(value);
+}

package/dist/rules/prefer-hud-for-silent-action.d.ts

@@ -0,0 +1,3 @@
+export declare const preferHudForSilentAction: import("@typescript-eslint/utils/ts-eslint").RuleModule<"hud", [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
+    name: string;
+};

package/dist/rules/prefer-hud-for-silent-action.js

@@ -0,0 +1,71 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import { containsCallPath, getCallPath, pathStartsWith } from '../ast.js';
+import { createRule } from '../create-rule.js';
+export const preferHudForSilentAction = createRule({
+    name: 'prefer-hud-for-silent-action',
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Prefer VoltAPI.showHUD after silent copy, save, and delete actions.',
+        },
+        messages: {
+            hud: 'Silent {{action}} actions should call VoltAPI.showHUD so the user gets feedback.',
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        return {
+            CallExpression(node) {
+                const action = getSilentAction(node);
+                if (!action) {
+                    return;
+                }
+                const scopeNode = findNearestFunctionOrProgram(context.sourceCode.getAncestors(node));
+                if (!scopeNode || !containsCallPath(scopeNode, isHudPath)) {
+                    context.report({
+                        node,
+                        messageId: 'hud',
+                        data: { action },
+                    });
+                }
+            },
+        };
+    },
+});
+function getSilentAction(node) {
+    const path = getCallPath(node);
+    if (!path) {
+        return null;
+    }
+    if (pathStartsWith(path, ['VoltAPI', 'utils', 'copyToClipboard']) ||
+        pathStartsWith(path, ['VoltAPI', 'utils', 'pasteText']) ||
+        (path.length === 1 && (path[0] === 'copyToClipboard' || path[0] === 'pasteText'))) {
+        return 'copy';
+    }
+    if (pathStartsWith(path, ['VoltAPI', 'storage', 'set']) ||
+        pathStartsWith(path, ['VoltAPI', 'storage', 'remove']) ||
+        pathStartsWith(path, ['VoltAPI', 'storage', 'clear'])) {
+        return 'save/delete';
+    }
+    if (pathStartsWith(path, ['VoltAPI', 'system', 'moveToTrash'])) {
+        return 'delete';
+    }
+    return null;
+}
+function isHudPath(path) {
+    return pathStartsWith(path, ['VoltAPI', 'showHUD']);
+}
+function findNearestFunctionOrProgram(ancestors) {
+    for (let index = ancestors.length - 1; index >= 0; index -= 1) {
+        const node = ancestors[index];
+        if (node &&
+            (node.type === AST_NODE_TYPES.FunctionDeclaration ||
+                node.type === AST_NODE_TYPES.FunctionExpression ||
+                node.type === AST_NODE_TYPES.ArrowFunctionExpression ||
+                node.type === AST_NODE_TYPES.Program)) {
+            return node;
+        }
+    }
+    return null;
+}

package/dist/rules/require-manifest-permission.d.ts

@@ -0,0 +1,4 @@
+import { type ManifestRuleOptions } from '../manifest.js';
+export declare const requireManifestPermission: import("@typescript-eslint/utils/ts-eslint").RuleModule<"missing" | "manifestMissing", [ManifestRuleOptions?], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
+    name: string;
+};

package/dist/rules/require-manifest-permission.js

@@ -0,0 +1,116 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import { getCallPath, pathStartsWith } from '../ast.js';
+import { createRule } from '../create-rule.js';
+import { getDeclaredPermissions, } from '../manifest.js';
+export const requireManifestPermission = createRule({
+    name: 'require-manifest-permission',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require manifest permissions for privileged VoltAPI and Web API usage.',
+        },
+        messages: {
+            missing: '{{reason}} requires the "{{permission}}" permission in manifest.json.',
+            manifestMissing: '{{reason}} requires the "{{permission}}" permission, but no manifest.json could be resolved.',
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    manifestPath: { type: 'string' },
+                    manifest: {
+                        type: 'object',
+                        properties: {
+                            permissions: {
+                                type: 'array',
+                                items: { type: 'string' },
+                            },
+                        },
+                        additionalProperties: true,
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [{}],
+    create(context, [options]) {
+        const declared = getDeclaredPermissions(context, options);
+        const reported = new WeakSet();
+        function reportIfMissing(node, use) {
+            if (reported.has(node)) {
+                return;
+            }
+            if (!declared) {
+                reported.add(node);
+                context.report({
+                    node,
+                    messageId: 'manifestMissing',
+                    data: { permission: use.permission, reason: use.reason },
+                });
+                return;
+            }
+            if (!declared.has(use.permission)) {
+                reported.add(node);
+                context.report({
+                    node,
+                    messageId: 'missing',
+                    data: { permission: use.permission, reason: use.reason },
+                });
+            }
+        }
+        return {
+            CallExpression(node) {
+                const required = getRequiredPermissionUse(node);
+                if (required) {
+                    reportIfMissing(node, required);
+                }
+            },
+        };
+    },
+});
+function getRequiredPermissionUse(node) {
+    const path = getCallPath(node);
+    if (!path) {
+        return null;
+    }
+    if (path[0] === 'fetch') {
+        const firstArg = node.arguments[0];
+        if (firstArg?.type === AST_NODE_TYPES.Literal &&
+            typeof firstArg.value === 'string' &&
+            !hasNetworkUrl(firstArg.value)) {
+            return null;
+        }
+        return { permission: 'network', reason: 'fetch()' };
+    }
+    if (pathStartsWith(path, ['navigator', 'clipboard'])) {
+        return { permission: 'clipboard', reason: 'navigator.clipboard' };
+    }
+    if (pathStartsWith(path, ['VoltAPI', 'oauth'])) {
+        return { permission: 'oauth', reason: 'VoltAPI.oauth' };
+    }
+    if (pathStartsWith(path, ['VoltAPI', 'ai'])) {
+        return { permission: 'ai', reason: 'VoltAPI.ai' };
+    }
+    if (pathStartsWith(path, ['VoltAPI', 'system'])) {
+        return { permission: 'system', reason: 'VoltAPI.system' };
+    }
+    if (pathStartsWith(path, ['VoltAPI', 'utils', 'copyToClipboard']) ||
+        pathStartsWith(path, ['VoltAPI', 'utils', 'pasteText'])) {
+        return { permission: 'clipboard', reason: `VoltAPI.utils.${path[2]}()` };
+    }
+    if (pathStartsWith(path, ['VoltAPI', 'utils', 'openUrl'])) {
+        return { permission: 'openUrl', reason: 'VoltAPI.utils.openUrl()' };
+    }
+    if (pathStartsWith(path, ['VoltAPI', 'notify'])) {
+        return { permission: 'notifications', reason: 'VoltAPI.notify()' };
+    }
+    if (node.callee.type === AST_NODE_TYPES.Identifier &&
+        (node.callee.name === 'copyToClipboard' || node.callee.name === 'pasteText')) {
+        return { permission: 'clipboard', reason: `${node.callee.name}()` };
+    }
+    return null;
+}
+function hasNetworkUrl(value) {
+    return /^[a-z][a-z0-9+.-]*:\/\//i.test(value) || /^\/\//.test(value);
+}

package/docs/rules/manifest-title-description-quality.md

@@ -0,0 +1,3 @@
+# manifest-title-description-quality
+
+Warns on generic extension names, weak command titles, and empty or too-short descriptions.

package/docs/rules/manifest-valid-permissions.md

@@ -0,0 +1,3 @@
+# manifest-valid-permissions
+
+Validates `manifest.json` permissions against Volt's public extension permission allowlist.

package/docs/rules/no-broad-system-action.md

@@ -0,0 +1,3 @@
+# no-broad-system-action
+
+Warns when `VoltAPI.system.moveToTrash` is called without a nearby `VoltAPI.confirm`.

package/docs/rules/no-secret-in-storage.md

@@ -0,0 +1,3 @@
+# no-secret-in-storage
+
+Disallows storing token, API key, password, and credential-like values in `localStorage`, `sessionStorage`, or `VoltAPI.storage`.

package/docs/rules/no-tauri-api-import.md

@@ -0,0 +1,3 @@
+# no-tauri-api-import
+
+Disallows `@tauri-apps/api/*` imports in Volt extensions. Extensions must use `VoltAPI` so permission checks stay enforceable.

package/docs/rules/no-unsafe-open-url.md

@@ -0,0 +1,3 @@
+# no-unsafe-open-url
+
+Warns when `openUrl` receives a dynamic value that is not visibly validated.

package/docs/rules/prefer-hud-for-silent-action.md

@@ -0,0 +1,3 @@
+# prefer-hud-for-silent-action
+
+Warns when silent copy, save, or delete actions do not call `VoltAPI.showHUD`.

package/docs/rules/require-manifest-permission.md

@@ -0,0 +1,3 @@
+# require-manifest-permission
+
+Requires the extension manifest to declare permissions used by privileged APIs such as `VoltAPI.oauth`, `VoltAPI.ai`, `VoltAPI.system`, `fetch`, clipboard helpers, notifications, and `openUrl`.

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@voltlaunchrr/eslint-plugin",
+  "version": "0.1.0",
+  "description": "ESLint plugin for Volt extension authors",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/VoltLaunchr/eslint-plugin.git",
+    "directory": "packages/eslint-plugin"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "docs",
+    "README.md"
+  ],
+  "dependencies": {
+    "@typescript-eslint/utils": "^8.59.3"
+  },
+  "peerDependencies": {
+    "eslint": "^9.0.0 || ^10.0.0",
+    "typescript": ">=5.4 <6.1"
+  },
+  "devDependencies": {
+    "@typescript-eslint/parser": "^8.59.3",
+    "@types/node": "^26.0.1",
+    "eslint": "^10.5.0",
+    "jsonc-eslint-parser": "^2.4.1",
+    "typescript": "~6.0.3",
+    "vitest": "^4.1.6"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run"
+  }
+}