eslint-plugin-greasemonkey 1.1.0 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-greasemonkey",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "ESLint rules for Greasemonkey/Tampermonkey userscripts",
   "type": "module",
   "engines": {
@@ -12,7 +12,21 @@
     "url": "https://codeberg.org/adamlui"
   },
   "homepage": "https://codeberg.org/adamlui/eslint-plugin-greasemonkey/#readme",
+  "bugs": {
+    "url": "https://codeberg.org/adamlui/eslint-plugin-greasemonkey/issues",
+    "email": "support@adamlui.com"
+  },
   "license": "MIT",
+  "funding": [
+    {
+      "type": "ko-fi",
+      "url": "https://ko-fi.com/adamlui"
+    },
+    {
+      "type": "paypal",
+      "url": "https://paypal.me/adamlui"
+    }
+  ],
   "main": "src/index.js",
   "files": [
     "docs/",
@@ -26,21 +40,28 @@
     "lint:fix": "eslint . --fix --cache",
     "lint:fix-all": "eslint . --fix",
     "test": "node tests/run.js",
-    "demo": "eslint --config demo/eslint.config.js demo/example.user.js",
+    "demo": "node demo/run.js",
     "bump:patch": "bash utils/bump.sh patch",
     "bump:minor": "bash utils/bump.sh minor",
     "bump:feat": "npm run bump:minor",
     "bump:major": "bash utils/bump.sh major"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://codeberg.org/adamlui/eslint-plugin-greasemonkey.git"
+  },
   "keywords": [
-    "greasemonkey",
-    "tampermonkey",
-    "userscript",
     "eslint",
     "eslint-plugin",
     "eslintplugin",
-    "metadata"
+    "greasemonkey",
+    "metadata",
+    "tampermonkey",
+    "userscript"
   ],
+  "peerDependencies": {
+    "eslint": ">=9.0.0"
+  },
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.0",
     "@eslint/js": "^10.0.1",
@@ -48,17 +69,16 @@
     "@eslint/markdown": "^8.0.3",
     "@stylistic/eslint-plugin": "^5.10.0",
     "eslint": "^10.10.0",
-    "eslint-plugin-constructors": "^1.0.2",
+    "eslint-plugin-constructors": "^1.1.1",
     "eslint-plugin-eslint-plugin": "^7.6.2",
     "eslint-plugin-import-x": "^4.17.1",
+    "eslint-plugin-n": "^18.3.0",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-no-unsanitized": "^4.1.5",
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-regexp": "^3.3.0",
+    "eslint-plugin-security": "^4.0.1",
     "globals": "^17.12.0",
     "husky": "^9.1.7"
-  },
-  "peerDependencies": {
-    "eslint": ">=9.0.0"
   }
 }

package/src/apis.js

@@ -0,0 +1,20 @@
+export const gmLegacyAPIs = new Set([ /* eslint-disable no-secrets/no-secrets */
+    'GM_addElement', 'GM_addStyle', 'GM_addValueChangeListener', 'GM_deleteValue', 'GM_download',
+    'GM_getResourceText', 'GM_getResourceURL', 'GM_getTab', 'GM_getTabs', 'GM_getValue', 'GM_getValues',
+    'GM_info', 'GM_listValues', 'GM_log', 'GM_notification', 'GM_openInTab', 'GM_registerMenuCommand',
+    'GM_removeValueChangeListener', 'GM_saveTab', 'GM_setClipboard', 'GM_setValue', 'GM_setValues',
+    'GM_unregisterMenuCommand', 'GM_webRequest', 'GM_xmlhttpRequest'
+]) /* eslint-enable no-secrets/no-secrets */
+
+export const gmModernAPIs = new Set([
+    'GM.addElement', 'GM.addStyle', 'GM.addValueChangeListener', 'GM.deleteValue', 'GM.download',
+    'GM.getResourceText', 'GM.getResourceUrl', 'GM.getValue', 'GM.info', 'GM.listValues', 'GM.log',
+    'GM.notification', 'GM.openInTab', 'GM.registerMenuCommand', 'GM.removeValueChangeListener',
+    'GM.setClipboard', 'GM.setValue', 'GM.unregisterMenuCommand', 'GM.xmlHttpRequest'
+])
+
+export const scAPIs = new Set([
+    'CAT.agent.conversation', 'CAT.agent.dom', 'CAT.agent.mcp', 'CAT.agent.model',
+    'CAT.agent.opfs', 'CAT.agent.skills', 'CAT.agent.task',
+    'CAT_fileStorage', 'CAT_scriptLoaded', 'CAT_userConfig'
+])

package/src/index.js

@@ -1,18 +1,36 @@
 import metaSpacing from './rules/meta-spacing.js'
+import noDuplicateKeys from './rules/no-duplicate-keys.js'
+import noMissingGrants from './rules/no-missing-grants.js'
 import noUnusedGrants from './rules/no-unused-grants.js'
 import noUnusedResources from './rules/no-unused-resources.js'
+import preferMatch from './rules/prefer-match.js'
+import requireHomepagePair from './rules/require-homepage-pair.js'
 import requireMatchingLocalizedFields from './rules/require-matching-localized-fields.js'
+import requireMetaNewline from './rules/require-meta-newline.js'
 import requireRequiredFields from './rules/require-required-fields.js'
+import requireSpaceBeforeMetaKey from './rules/require-space-before-meta-key.js'
+import requireUpdateDownloadPair from './rules/require-update-download-pair.js'
+import requireUserJsFilename from './rules/require-user-js-filename.js'
 import validFieldValues from './rules/valid-field-values.js'
+import validGrants from './rules/valid-grants.js'
 
 const plugin = {
     rules: {
         'meta-spacing': metaSpacing,
+        'no-duplicate-keys': noDuplicateKeys,
+        'no-missing-grants': noMissingGrants,
+        'no-unused-grants': noUnusedGrants,
+        'no-unused-resources': noUnusedResources,
+        'prefer-match': preferMatch,
+        'require-homepage-pair': requireHomepagePair,
         'require-matching-localized-fields': requireMatchingLocalizedFields,
+        'require-meta-newline': requireMetaNewline,
         'require-required-fields': requireRequiredFields,
+        'require-space-before-meta-key': requireSpaceBeforeMetaKey,
+        'require-update-download-pair': requireUpdateDownloadPair,
+        'require-user-js-filename': requireUserJsFilename,
         'valid-field-values': validFieldValues,
-        'no-unused-resources': noUnusedResources,
-        'no-unused-grants': noUnusedGrants
+        'valid-grants': validGrants
     }
 }
 
@@ -21,13 +39,40 @@ plugin.configs = {
         plugins: { greasemonkey: plugin },
         rules: {
             'greasemonkey/meta-spacing': 'error',
+            'greasemonkey/no-duplicate-keys': 'error',
+            'greasemonkey/no-missing-grants': 'error',
+            'greasemonkey/no-unused-grants': 'error',
+            'greasemonkey/no-unused-resources': 'error',
+            'greasemonkey/prefer-match': 'error',
             'greasemonkey/require-matching-localized-fields': 'error',
+            'greasemonkey/require-meta-newline': 'error',
             'greasemonkey/require-required-fields': 'error',
+            'greasemonkey/require-space-before-meta-key': 'error',
+            'greasemonkey/require-user-js-filename': 'error',
             'greasemonkey/valid-field-values': 'error',
+            'greasemonkey/valid-grants': 'error'
+        }
+    },
+    strict: {
+        plugins: { greasemonkey: plugin },
+        rules: {
+            'greasemonkey/meta-spacing': 'error',
+            'greasemonkey/no-duplicate-keys': 'error',
+            'greasemonkey/no-missing-grants': 'error',
+            'greasemonkey/no-unused-grants': 'error',
             'greasemonkey/no-unused-resources': 'error',
-            'greasemonkey/no-unused-grants': 'error'
+            'greasemonkey/prefer-match': 'error',
+            'greasemonkey/require-homepage-pair': 'error',
+            'greasemonkey/require-matching-localized-fields': 'error',
+            'greasemonkey/require-meta-newline': 'error',
+            'greasemonkey/require-required-fields': 'error',
+            'greasemonkey/require-space-before-meta-key': 'error',
+            'greasemonkey/require-update-download-pair': 'error',
+            'greasemonkey/require-user-js-filename': 'error',
+            'greasemonkey/valid-field-values': 'error',
+            'greasemonkey/valid-grants': 'error'
         }
     }
 }
 
-export default plugin
+export { plugin as default, plugin as greasemonkey }

package/src/rules/meta-spacing.js

@@ -24,30 +24,21 @@ export default {
                       metaEntries = extractMetadata(sourceCode)
                 if (!metaEntries.length) return
                 let targetCol = metaEntries.reduce((max, entry) => Math.max(max, entry.key.length), 0) + minSpaces +4
-                for (const entry of metaEntries) {
+                for (const entry of metaEntries)
                     if (entry.key == 'resource') {
                         const name = entry.value.trim().split(re.whitespace)[0],
-                              requiredColumn = 4 + entry.key.length +1 + name.length + minSpaces
-                        if (requiredColumn > targetCol) targetCol = requiredColumn
+                              requiredCol = 4 + entry.key.length +1 + name.length + minSpaces
+                        if (requiredCol > targetCol) targetCol = requiredCol
                     }
-                }
                 for (const entry of metaEntries) {
                     const commentText = sourceCode.getText(entry.comment),
-                          keyIdx = commentText.indexOf(entry.key) + entry.key.length
-                    let fixedText
-                    if (entry.key == 'resource') {
-                        const parts = entry.value.trim().split(re.whitespace)
-                        if (parts.length >= 2) {
-                            const name = parts[0],
-                                  url = parts.slice(1).join(' '),
-                                  spacesAfterName = targetCol - keyIdx -1 - name.length
-                            fixedText = commentText.slice(0, keyIdx) + ' ' + name + ' '.repeat(spacesAfterName) + url
-                        } else
-                            fixedText = commentText.slice(0, keyIdx) + ' '.repeat(targetCol - keyIdx)
-                                      + entry.value.trim()
-                    } else
-                        fixedText = commentText.slice(0, keyIdx) + ' '.repeat(targetCol - keyIdx)
-                                  + entry.value.trim()
+                          keyIdx = commentText.indexOf(entry.key) + entry.key.length,
+                          parts = entry.value.trim().split(re.whitespace),
+                          named = entry.key == 'resource' && parts.length >= 2,
+                          prefix = named ? ` ${parts[0]} ` : '',
+                          suffix = named ? parts.slice(1).join(' ') : entry.value.trim(),
+                          fixedText = commentText.slice(0, keyIdx) + prefix
+                                    + ' '.repeat(targetCol - keyIdx - prefix.length) + suffix
                     if (commentText !== fixedText)
                         context.report({
                             node: entry.comment, messageId: 'misaligned', data: { column: targetCol },

package/src/rules/no-duplicate-keys.js

@@ -0,0 +1,35 @@
+import { extractMetadata } from '../utils.js'
+
+const multiValKeys = new Set([
+    'compatible', 'connect', 'description', 'exclude', 'exclude-match', 'grant',
+    'homepageURL', 'include', 'license', 'match', 'require', 'resource', 'supportURL'
+])
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow duplicate metadata keys',
+            category: 'Possible Errors',
+            recommended: true
+        },
+        schema: [],
+        messages: { dupeKey: 'Duplicate @{{key}}' }
+    },
+
+    create(context) {
+        return {
+            Program() {
+                const metaEntries = extractMetadata(context.sourceCode),
+                      seen = new Set()
+                for (const entry of metaEntries) {
+                    const baseKey = entry.key.split(':')[0]
+                    if (!entry.key.includes(':') && multiValKeys.has(baseKey)) continue
+                    if (seen.has(entry.key))
+                        context.report({ node: entry.comment, messageId: 'dupeKey', data: { key: entry.key }})
+                    else seen.add(entry.key)
+                }
+            }
+        }
+    }
+}

package/src/rules/no-missing-grants.js

@@ -0,0 +1,51 @@
+import { extractMetadata } from '../utils.js'
+import { gmLegacyAPIs, gmModernAPIs, scAPIs } from '../apis.js'
+
+const apis = new Set([...gmLegacyAPIs, ...gmModernAPIs, ...scAPIs]),
+      grantlessAPIs = new Set(['GM_info', 'GM.info']) // always available, no grant required
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow API calls without a matching @grant',
+            category: 'Possible Errors',
+            recommended: true
+        },
+        schema: [],
+        messages: { missingGrant: 'Missing @grant: "{{api}}"' }
+    },
+
+    create(context) {
+        const usedAPIs = new Map()
+        function record(name, node) { if (apis.has(name) && !usedAPIs.has(name)) usedAPIs.set(name, node) }
+        return {
+            Identifier(node) { record(node.name, node) },
+            MemberExpression(node) {
+                const path = []
+                let current = node
+                while (current.type == 'MemberExpression') {
+                    if (current.property.type != 'Identifier') return
+                    path.unshift(current.property.name)
+                    current = current.object
+                }
+                if (current.type == 'Identifier') {
+                    path.unshift(current.name)
+                    record(path.join('.'), node)
+                }
+            },
+            'Program:exit'() {
+                if (!usedAPIs.size) return
+                const declared = new Set(
+                    extractMetadata(context.sourceCode)
+                        .filter(entry => entry.key == 'grant')
+                        .map(entry => entry.value.trim())
+                )
+                for (const [api, node] of usedAPIs) {
+                    if (grantlessAPIs.has(api) || declared.has(api)) continue
+                    context.report({ node, messageId: 'missingGrant', data: { api }})
+                }
+            }
+        }
+    }
+}

package/src/rules/no-unused-grants.js

@@ -13,18 +13,30 @@ export default {
     },
 
     create(context) {
-        const usedIdentifiers = new Set()
+        const usedGrants = new Set()
         return {
-            Identifier(node) { usedIdentifiers.add(node.name) },
+            Identifier(node) { usedGrants.add(node.name) },
+            MemberExpression(node) {
+                const path = [] ; let current = node
+                while (current.type == 'MemberExpression') {
+                    if (current.property.type != 'Identifier') return
+                    path.unshift(current.property.name)
+                    current = current.object
+                }
+                if (current.type == 'Identifier') {
+                    path.unshift(current.name)
+                    usedGrants.add(path.join('.'))
+                }
+            },
             'Program:exit'() {
                 const sourceCode = context.sourceCode,
                       metaEntries = extractMetadata(sourceCode),
-                      grants = metaEntries.filter(e => e.key == 'grant')
+                      grants = metaEntries.filter(entry => entry.key == 'grant')
                 if (!grants.length) return
                 for (const grant of grants) {
                     const grantName = grant.value.trim()
                     if (['none', 'unsafeWindow'].includes(grantName)) continue
-                    if (!usedIdentifiers.has(grantName))
+                    if (!usedGrants.has(grantName))
                         context.report({ node: grant.comment, messageId: 'unusedGrant', data: { grant: grantName }})
                 }
             }

package/src/rules/no-unused-resources.js

@@ -1,6 +1,7 @@
-import { extractMetadata } from '../utils.js'
+import { extractMetadata, resolveTemplate } from '../utils.js'
 
-const reWhitespace = /\s+/
+const resourceGetterNames = new Set(['GM_getResourceText', 'GM_getResourceURL']),
+      re = { specialChars: /[.*+?^${}()|[\]\\]/g, whitespace: /\s+/ }
 
 export default {
     meta: {
@@ -15,21 +16,30 @@ export default {
     },
 
     create(context) {
+        const usedResources = new Set(),
+              usedPatterns = []
         return {
-            Program() {
-                const sourceCode = context.sourceCode,
-                      metaEntries = extractMetadata(sourceCode),
-                      resources = metaEntries.filter(e => e.key == 'resource')
+            CallExpression(node) {
+                if (!resourceGetterNames.has(node.callee.name)) return
+                const arg = node.arguments[0]
+                if (arg?.type == 'Literal' && typeof arg.value == 'string')
+                    usedResources.add(arg.value)
+                else if (arg?.type == 'TemplateLiteral') {
+                    const resolved = resolveTemplate(arg)
+                    if (resolved)
+                        for (const name of resolved) usedResources.add(name)
+                    else usedPatterns.push(new RegExp( // eslint-disable-line security/detect-non-literal-regexp
+                        `^${arg.quasis.map(quasi => quasi.value.raw.replace(re.specialChars, '\\$&')).join('.*')}$`))
+                }
+            },
+            'Program:exit'() {
+                const metaEntries = extractMetadata(context.sourceCode),
+                      resources = metaEntries.filter(entry => entry.key == 'resource')
                 if (!resources.length) return
-                const text = sourceCode.getText(),
-                      usedResources = new Set(),
-                      regex = /GM_getResource(?:Text|URL)\s*\(\s*['"]([^'"]+)['"]\s*\)/g
-                let match
-                while ((match = regex.exec(text)) !== null) usedResources.add(match[1])
                 for (const res of resources) {
-                    const name = res.value.split(reWhitespace)[0]
-                    if (!usedResources.has(name))
-                        context.report({ node: res.comment, messageId: 'unusedResource', data: { name }})
+                    const name = res.value.trim().split(re.whitespace)[0]
+                    if (usedResources.has(name) || usedPatterns.some(patt => patt.test(name))) continue
+                    context.report({ node: res.comment, messageId: 'unusedResource', data: { name }})
                 }
             }
         }

package/src/rules/prefer-match.js

@@ -0,0 +1,24 @@
+import { extractMetadata } from '../utils.js'
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Prefer @match over @include (see https://developer.chrome.com/docs/extensions/develop/migrate/mv2-deprecation-timeline)',
+            category: 'Best Practices',
+            recommended: true
+        },
+        schema: [],
+        messages: { preferMatch: 'Use @match instead of @include (deprecated in Chrome MV3)' }
+    },
+
+    create(context) {
+        return {
+            Program() {
+                for (const entry of extractMetadata(context.sourceCode))
+                    if (entry.key == 'include')
+                        context.report({ node: entry.comment, messageId: 'preferMatch' })
+            }
+        }
+    }
+}

package/src/rules/require-homepage-pair.js

@@ -0,0 +1,43 @@
+import { extractMetadata } from '../utils.js'
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require @homepage and @homepageURL to be used together',
+            category: 'Best Practices',
+            recommended: false
+        },
+        fixable: 'code',
+        schema: [],
+        messages: { missingPair: 'Missing @{{missing}} (required when @{{present}} is used)' }
+    },
+
+    create(context) {
+        return {
+            Program() {
+                const metaEntries = extractMetadata(context.sourceCode),
+                      homepageEntry = metaEntries.find(entry => entry.key == 'homepage'),
+                      homepageURLEntry = metaEntries.find(entry => entry.key == 'homepageURL')
+                if (homepageEntry && !homepageURLEntry)
+                    context.report({
+                        node: homepageEntry.comment, messageId: 'missingPair',
+                        data: { missing: 'homepageURL', present: 'homepage' },
+                        fix(fixer) {
+                            return fixer.insertTextAfter(homepageEntry.comment,
+                                `\n// @homepageURL ${homepageEntry.value}`)
+                        }
+                    })
+                else if (homepageURLEntry && !homepageEntry)
+                    context.report({
+                        node: homepageURLEntry.comment, messageId: 'missingPair',
+                        data: { missing: 'homepage', present: 'homepageURL' },
+                        fix(fixer) {
+                            return fixer.insertTextAfter(homepageURLEntry.comment,
+                                `\n// @homepage ${homepageURLEntry.value}`)
+                        }
+                    })
+            }
+        }
+    }
+}

package/src/rules/require-matching-localized-fields.js

@@ -14,7 +14,7 @@ export default {
                 ignoreLanguages: {
                     type: 'array',
                     items: { type: 'string' },
-                    description: 'Language codes to ignore (e.g., ["fr", "de"])'
+                    description: 'Language codes to ignore (e.g. ["fr", "de"])'
                 }
             },
             additionalProperties: false
@@ -29,10 +29,10 @@ export default {
         return {
             Program() {
                 const metaEntries = extractMetadata(context.sourceCode),
-                      nameEntries = metaEntries.filter(e => e.key.startsWith('name:')),
-                      descEntries = metaEntries.filter(e => e.key.startsWith('description:')),
-                      nameLangs = new Set(nameEntries.map(e => e.key.split(':')[1])),
-                      descLangs = new Set(descEntries.map(e => e.key.split(':')[1]))
+                      nameEntries = metaEntries.filter(entry => entry.key.startsWith('name:')),
+                      descEntries = metaEntries.filter(entry => entry.key.startsWith('description:')),
+                      nameLangs = new Set(nameEntries.map(entry => entry.key.split(':')[1])),
+                      descLangs = new Set(descEntries.map(entry => entry.key.split(':')[1]))
                 for (const lang of nameLangs)
                     if (!ignoreLanguages.includes(lang) && !descLangs.has(lang))
                         context.report({
@@ -43,7 +43,7 @@ export default {
                 for (const lang of descLangs)
                     if (!ignoreLanguages.includes(lang) && !nameLangs.has(lang))
                         context.report({
-                            node: descEntries.find(e => e.key == `description:${lang}`).comment,
+                            node: descEntries.find(entry => entry.key == `description:${lang}`).comment,
                             messageId: 'missingPair',
                             data: { missing: `name:${lang}`, present: `description:${lang}` }
                         })

package/src/rules/require-meta-newline.js

@@ -0,0 +1,36 @@
+import { extractMetadata } from '../utils.js'
+
+export default {
+    meta: {
+        type: 'layout',
+        docs: {
+            description: 'Require a newline between the metadata and code',
+            category: 'Stylistic Issues',
+            recommended: true
+        },
+        fixable: 'whitespace',
+        schema: [],
+        messages: { missingNewline: 'Missing blank line after metadata block' }
+    },
+
+    create(context) {
+        return {
+            Program() {
+                const sourceCode = context.sourceCode,
+                      comments = sourceCode.getAllComments(),
+                      metaEntries = extractMetadata(sourceCode)
+                if (!metaEntries.length) return
+                const closingComment = comments.find(comment => comment.value.trim() == '==/UserScript==')
+                if (!closingComment) return
+                const tokenAfter = sourceCode.getTokenAfter(closingComment)
+                if (!tokenAfter) return
+                if (tokenAfter.loc.start.line - closingComment.loc.end.line < 2)
+                    context.report({
+                        node: closingComment,
+                        messageId: 'missingNewline',
+                        fix(fixer) { return fixer.insertTextAfter(closingComment, '\n') }
+                    })
+            }
+        }
+    }
+}

package/src/rules/require-required-fields.js

@@ -14,7 +14,7 @@ export default {
                 fields: {
                     type: 'array',
                     items: { type: 'string' },
-                    description: 'Required metadata fields (default: name, namespace, version)'
+                    description: 'Required metadata fields (default: name, version)'
                 }
             },
             additionalProperties: false
@@ -25,11 +25,11 @@ export default {
 
     create(context) {
         const options = context.options[0] || {},
-              requiredFields = options.fields || ['name', 'namespace', 'version']
+              requiredFields = options.fields || ['name', 'version']
         return {
             Program(node) {
                 const metaEntries = extractMetadata(context.sourceCode),
-                      keys = new Set(metaEntries.map(e => e.key))
+                      keys = new Set(metaEntries.map(entry => entry.key))
                 for (const field of requiredFields)
                     if (!keys.has(field))
                         context.report({ node, messageId: 'missingField', data: { field }})

package/src/rules/require-space-before-meta-key.js

@@ -0,0 +1,39 @@
+import { extractMetadata } from '../utils.js'
+
+const re = { leadingWhitespace: /^\s*/ }
+
+export default {
+    meta: {
+        type: 'layout',
+        docs: {
+            description: 'Require exactly one space between // and metadata keys',
+            category: 'Stylistic Issues',
+            recommended: true
+        },
+        fixable: 'whitespace',
+        schema: [],
+        messages: { badPrefix: '`{{actual}}` should be `// @{{key}}`' }
+    },
+
+    create(context) {
+        return {
+            Program() {
+                const sourceCode = context.sourceCode,
+                      metaEntries = extractMetadata(sourceCode)
+                for (const entry of metaEntries) {
+                    const commentText = sourceCode.getText(entry.comment),
+                          afterSlashes = commentText.slice(2)
+                    if (afterSlashes.startsWith(' @')) continue
+                    const rest = afterSlashes.replace(re.leadingWhitespace, ''),
+                          keyIdx = commentText.indexOf(`@${entry.key}`),
+                          actual = commentText.slice(0, keyIdx +1 + entry.key.length),
+                          fixedText = `// ${rest}`
+                    context.report({
+                        node: entry.comment, messageId: 'badPrefix', data: { actual, key: entry.key },
+                        fix(fixer) { return fixer.replaceText(entry.comment, fixedText) }
+                    })
+                }
+            }
+        }
+    }
+}

package/src/rules/require-update-download-pair.js

@@ -0,0 +1,32 @@
+import { extractMetadata } from '../utils.js'
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require @updateURL and @downloadURL to be used together',
+            category: 'Best Practices',
+            recommended: false
+        },
+        schema: [],
+        messages: { missingPair: 'Missing @{{missing}} (required when @{{present}} is used)' }
+    },
+
+    create(context) {
+        return {
+            Program() {
+                const metaEntries = extractMetadata(context.sourceCode),
+                      updateEntry = metaEntries.find(entry => entry.key == 'updateURL'),
+                      downloadEntry = metaEntries.find(entry => entry.key == 'downloadURL')
+                if (updateEntry && !downloadEntry)
+                    context.report({
+                        node: updateEntry.comment, messageId: 'missingPair',
+                        data: { missing: 'downloadURL', present: 'updateURL' }})
+                else if (downloadEntry && !updateEntry)
+                    context.report({
+                        node: downloadEntry.comment, messageId: 'missingPair',
+                        data: { missing: 'updateURL', present: 'downloadURL' }})
+            }
+        }
+    }
+}