eslint-plugin-greasemonkey 1.9.0 → 1.10.1

package/src/data/apis.js

@@ -1,54 +1,57 @@
-export const gmLegacyAPIs = new Set([ /* eslint-disable no-secrets/no-secrets */
-    'GM_addElement', 'GM_addStyle', 'GM_addValueChangeListener', 'GM_deleteValue', 'GM_download',
-    'GM_getResourceText', 'GM_getResourceURL', 'GM_getTab', 'GM_getTabs', 'GM_getValue', 'GM_getValues',
-    'GM_info', 'GM_listValues', 'GM_log', 'GM_notification', 'GM_openInTab', 'GM_registerMenuCommand',
-    'GM_removeValueChangeListener', 'GM_saveTab', 'GM_setClipboard', 'GM_setValue', 'GM_setValues',
-    'GM_unregisterMenuCommand', 'GM_webRequest', 'GM_xmlhttpRequest'
-]) /* eslint-enable no-secrets/no-secrets */
-
-export const gmModernAPIs = new Set([
-    'GM.addElement', 'GM.addStyle', 'GM.addValueChangeListener', 'GM.deleteValue', 'GM.download',
-    'GM.getResourceText', 'GM.getResourceUrl', 'GM.getTab', 'GM.getTabs', 'GM.getValue', 'GM.getValues',
-    'GM.info', 'GM.listValues', 'GM.log', 'GM.notification', 'GM.openInTab', 'GM.registerMenuCommand',
-    'GM.removeValueChangeListener', 'GM.saveTab', 'GM.setClipboard', 'GM.setValue', 'GM.setValues',
-    'GM.unregisterMenuCommand', 'GM.webRequest', 'GM.xmlHttpRequest'
-])
-
-export const scAPIs = new Set([
-    'CAT.agent.conversation', 'CAT.agent.dom', 'CAT.agent.mcp', 'CAT.agent.model',
-    'CAT.agent.opfs', 'CAT.agent.skills', 'CAT.agent.task',
-    'CAT_fileStorage', 'CAT_scriptLoaded', 'CAT_userConfig'
-])
-
-const tmAPIs = new Set([
-    'GM_getTab', 'GM_getTabs', 'GM_saveTab', 'GM_webRequest',
-    'GM.getTab', 'GM.getTabs', 'GM.saveTab', 'GM.webRequest'
-])
-
-const agAPIs = new Set([
-    'GM_info', 'GM.info',
-    'GM_setValue', 'GM.setValue',
-    'GM_getValue', 'GM.getValue',
-    'GM_listValues', 'GM.listValues',
-    'GM_deleteValue', 'GM.deleteValue',
-    'GM_getResourceURL', 'GM.getResourceUrl',
-    'GM_setClipboard', 'GM.setClipboard',
-    'GM_xmlhttpRequest', 'GM.xmlHttpRequest',
-    'GM_openInTab', 'GM.openInTab',
-    'GM_notification',
-    'unsafeWindow',
-    'GM_getResourceText',
-    'GM_addStyle',
-    'GM_log',
-    'GM_addElement', 'GM.addElement'
-])
-
-export const allAPIs = new Set([...gmLegacyAPIs, ...gmModernAPIs, ...scAPIs])
-
-export function supportsAPI({ manager, api }) {
-    return !allAPIs.has(api) ? false
-         : api.startsWith('CAT') ? manager == 'scriptcat'
-         : tmAPIs.has(api) ? manager == 'tampermonkey'
-         : manager == 'adguard' ? agAPIs.has(api)
-         : true
+const apis = {
+    ag: new Set([
+        'GM_info', 'GM.info', 'GM_setValue', 'GM.setValue', 'GM_getValue', 'GM.getValue',
+        'GM_listValues', 'GM.listValues', 'GM_deleteValue', 'GM.deleteValue',
+        'GM_getResourceURL', 'GM.getResourceUrl', 'GM_setClipboard', 'GM.setClipboard',
+        'GM_xmlhttpRequest', 'GM.xmlHttpRequest', 'GM_openInTab', 'GM.openInTab',
+        'GM_notification', 'unsafeWindow', 'GM_getResourceText', 'GM_addStyle', 'GM_log',
+        'GM_addElement', 'GM.addElement'
+    ]),
+    gm: {
+        legacy: new Set([
+            'GM_addElement', 'GM_addStyle', 'GM_addValueChangeListener', 'GM_deleteValue', 'GM_download',
+            'GM_getResourceText', 'GM_getResourceURL', 'GM_getTab', 'GM_getTabs', 'GM_getValue', 'GM_getValues',
+            'GM_info', 'GM_listValues', 'GM_log', 'GM_notification', 'GM_openInTab', 'GM_registerMenuCommand',
+            'GM_removeValueChangeListener', // oxlint-disable-line no-secrets/no-secrets
+            'GM_saveTab', 'GM_setClipboard', 'GM_setValue', 'GM_setValues', 'GM_unregisterMenuCommand', 'GM_webRequest',
+            'GM_xmlhttpRequest'
+        ]),
+        modern: new Set([
+            'GM.addElement', 'GM.addStyle', 'GM.addValueChangeListener', 'GM.deleteValue', 'GM.download',
+            'GM.getResourceText', 'GM.getResourceUrl', 'GM.getTab', 'GM.getTabs', 'GM.getValue', 'GM.getValues',
+            'GM.info', 'GM.listValues', 'GM.log', 'GM.notification', 'GM.openInTab', 'GM.registerMenuCommand',
+            'GM.removeValueChangeListener', 'GM.saveTab', 'GM.setClipboard', 'GM.setValue', 'GM.setValues',
+            'GM.unregisterMenuCommand', 'GM.webRequest', 'GM.xmlHttpRequest'
+        ])
+    },
+    sc: new Set([
+        'CAT.agent.conversation', 'CAT.agent.dom', 'CAT.agent.mcp', 'CAT.agent.model', 'CAT.agent.opfs',
+        'CAT.agent.skills', 'CAT.agent.task', 'CAT_fileStorage', 'CAT_scriptLoaded', 'CAT_userConfig'
+    ]),
+    tm: new Set([
+        'GM_getTab', 'GM_getTabs', 'GM_saveTab', 'GM_webRequest',
+        'GM.getTab', 'GM.getTabs', 'GM.saveTab', 'GM.webRequest'
+    ]),
+    sensitive: new Set([
+        'GM_xmlhttpRequest', 'GM.xmlHttpRequest', 'GM_download', 'GM.download',
+        'GM_openInTab', 'GM.openInTab', 'GM_setClipboard', 'GM.setClipboard',
+        'GM_notification', 'GM.notification', 'GM_addValueChangeListener', 'GM.addValueChangeListener',
+        'GM_getResourceURL', 'GM.getResourceUrl', 'unsafeWindow'
+    ]),
+    managerSensitive: new Map([
+        ['tampermonkey', new Set([
+            'GM_webRequest', 'GM.webRequest', 'GM_getTab', 'GM.getTab', 'GM_getTabs', 'GM.getTabs',
+            'GM_saveTab', 'GM.saveTab'
+        ])],
+        ['violentmonkey', new Set([])],
+        ['greasemonkey', new Set([])],
+        ['scriptcat', new Set([
+            'CAT.agent.conversation', 'CAT.agent.dom', 'CAT.agent.mcp', 'CAT.agent.model', 'CAT.agent.opfs',
+            'CAT.agent.skills', 'CAT.agent.task', 'CAT_fileStorage', 'CAT_userConfig'
+        ])],
+        ['adguard', new Set([])]
+    ])
 }
+apis.all = new Set([...apis.gm.legacy, ...apis.gm.modern, ...apis.sc])
+
+export default apis

package/src/data/headers.js

@@ -1,41 +1,51 @@
-export const universalHeaders = new Set([
-    'antifeature', 'author', 'compatible', 'connect', 'contributionAmount', 'contributionURL', 'copyright',
-    'defaulticon', 'description', 'downloadURL', 'exclude', 'exclude-match', 'grant', 'homepage', 'homepageURL',
-    'icon', 'icon64', 'include', 'license', 'match', 'name', 'namespace', 'noframes', 'require', 'resource',
-    'run-at', 'source', 'supportURL', 'updateURL', 'version', 'website'
-])
+// oxlint-disable sonarjs/no-clear-text-protocols
 
-export const managerHeaders = new Map([
-    ['unwrap',          ['tampermonkey', 'violentmonkey', 'greasemonkey', 'scriptcat']],
-    ['run-in',          ['tampermonkey', 'scriptcat']],
-    ['nocompat',        ['tampermonkey']],
-    ['sandbox',         ['tampermonkey']],
-    ['user-agent',      ['tampermonkey']],
-    ['webRequest',      ['tampermonkey']],
-    ['inject-into',     ['violentmonkey', 'scriptcat']],
-    ['top-level-await', ['violentmonkey']],
-    ['background',      ['scriptcat']],
-    ['crontab',         ['scriptcat']],
-    ['definition',      ['scriptcat']],
-    ['early-start',     ['scriptcat']],
-    ['require-css',     ['scriptcat']],
-    ['storageName',     ['scriptcat']]
-])
-
-export const localizedHeaders = ['name', 'description', 'antifeature']
-export const managers = ['tampermonkey', 'violentmonkey', 'greasemonkey', 'scriptcat', 'adguard']
-export const validHeaders = new Map()
+const headers = {
+    broadConnect: new Set([
+        '*',
+        '*.com', '*.org', '*.net', '*.io', '*.dev', '*.app', '*.co',
+        'http://*', 'https://*',
+        'http://*/*', 'https://*/*',
+        'http://*/', 'https://*/',
+        'http:*', 'https:*'
+    ]),
+    localized: ['name', 'description', 'antifeature'],
+    manager: new Map([
+        ['unwrap',          ['tampermonkey', 'violentmonkey', 'greasemonkey', 'scriptcat']],
+        ['run-in',          ['tampermonkey', 'scriptcat']],
+        ['nocompat',        ['tampermonkey']],
+        ['sandbox',         ['tampermonkey']],
+        ['user-agent',      ['tampermonkey']],
+        ['webRequest',      ['tampermonkey']],
+        ['inject-into',     ['violentmonkey', 'scriptcat']],
+        ['top-level-await', ['violentmonkey']],
+        ['background',      ['scriptcat']],
+        ['crontab',         ['scriptcat']],
+        ['definition',      ['scriptcat']],
+        ['early-start',     ['scriptcat']],
+        ['require-css',     ['scriptcat']],
+        ['storageName',     ['scriptcat']]
+    ]),
+    managers: ['tampermonkey', 'violentmonkey', 'greasemonkey', 'scriptcat', 'adguard'],
+    universal: new Set([
+        'antifeature', 'author', 'compatible', 'connect', 'contributionAmount', 'contributionURL', 'copyright',
+        'defaulticon', 'description', 'downloadURL', 'exclude', 'exclude-match', 'grant', 'homepage', 'homepageURL',
+        'icon', 'icon64', 'include', 'license', 'match', 'name', 'namespace', 'noframes', 'require', 'resource',
+        'run-at', 'source', 'supportURL', 'updateURL', 'version', 'website'
+    ])
+}
 
-validHeaders.set('all', new Set([...universalHeaders, ...managerHeaders.keys()]))
+const knownHeaders = new Set([...headers.universal, ...headers.manager.keys()])
 
-for (const manager of managers) {
-    const specific = [...managerHeaders]
-        .filter(([, supportedBy]) => supportedBy.includes(manager))
+headers.valid = new Map([['all', knownHeaders]])
+for (const mgr of headers.managers) {
+    const specific = [...headers.manager]
+        .filter(([, supportedBy]) => supportedBy.includes(mgr))
         .map(([header]) => header)
-    validHeaders.set(manager, new Set([...universalHeaders, ...specific]))
+    headers.valid.set(mgr, new Set([...headers.universal, ...specific]))
 }
 
-const urlHeaderTypes = {
+headers.url = new Map(Object.entries({
     connect:         'host-pattern',
     contributionURL: 'url',
     defaulticon:     'url',
@@ -55,6 +65,6 @@ const urlHeaderTypes = {
     supportURL:      'url',
     updateURL:       'url',
     website:         'url'
-}
-const knownHeaders = new Set([...universalHeaders, ...managerHeaders.keys()])
-export const urlHeaders = new Map(Object.entries(urlHeaderTypes).filter(([name]) => knownHeaders.has(name)))
+}).filter(([name]) => knownHeaders.has(name)))
+
+export default headers

package/src/data/regex.js

@@ -0,0 +1,14 @@
+export default {
+    filename: {
+        license: // oxlint-disable-next-line security/detect-unsafe-regex
+            /^(?:[\w.-]*-)?(?:LICEN[SC]E|COPYING)(?:[-.][\w.-]+)?$/i
+    },
+    meta: {
+        block: /\/\/\s*==UserScript==([\s\S]*?)\/\/\s*==\/UserScript==/,
+        license: /^[ \t]*\/\/[ \t]*@license[ \t]+(\S.*)/m
+    },
+    newline: /\r?\n/,
+    specialChars: /[.*+?^${}()|[\]\\]/g,
+    url: /^https?:\/\//,
+    whitespace: { all: /\s+/, leading: /^\s*/ }
+}

package/src/index.d.ts

@@ -29,6 +29,7 @@ interface PluginRule {
 }
 
 declare const plugin: {
+    meta: { name: string }
     rules: Record<string, PluginRule>
     configs: Record<ConfigName, PluginConfig>
 }

package/src/rules/meta-order.js

@@ -12,7 +12,7 @@ function findViolation(entries, keys) {
               const key = entry.key.split(':', 1)[0]
               return { entry, key, rank: ranks.get(key) }
           }).filter(item => item.rank !== undefined)
-    for (let i = 1 ; i < known.length ; i++) // eslint-disable-next-line security/detect-object-injection
+    for (let i = 1 ; i < known.length ; i++) // oxlint-disable-next-line security/detect-object-injection
         if (known[i -1].rank > known[i].rank) return [known[i -1], known[i]]
 }
 
@@ -58,7 +58,7 @@ export default {
                 if (!violation) return
                 const [first, second] = violation
                 const sorted = sortEntries(sortEntries(entries, master), custom)
-                const replacements = // eslint-disable-next-line security/detect-object-injection
+                const replacements = // oxlint-disable-next-line security/detect-object-injection
                     new Map(sorted.map((entry, idx) => [entries[idx], sourceCode.getText(entry.comment)]))
                 const start = entries[0].comment.range[0]
                 const end = entries.at(-1).comment.range[1]

package/src/rules/meta-spacing.js

@@ -1,6 +1,5 @@
 import metadata from '../utils/metadata.js'
-
-const re = { leadingWhitespace: /^\s*/, whitespace: /\s+/ }
+import regex from '../data/regex.js'
 
 export default {
     meta: {
@@ -35,24 +34,26 @@ export default {
                 let targetCol = metaEntries.reduce((max, entry) => Math.max(max, entry.key.length), 0) + minSpaces +4
                 for (const entry of metaEntries)
                     if (entry.key == 'resource' && entry.value.trim()) {
-                        const name = entry.value.trim().split(re.whitespace)[0],
+                        const name = entry.value.trim().split(regex.whitespace.all)[0],
                               requiredCol = 4 + entry.key.length +1 + name.length + minSpaces
                         if (requiredCol > targetCol) targetCol = requiredCol
                     }
                 for (const entry of metaEntries) {
                     if (!entry.value.trim()) continue
                     const commentText = sourceCode.getText(entry.comment),
-                          keyIdx = commentText.indexOf(entry.key) + entry.key.length,
-                          parts = entry.value.trim().split(re.whitespace),
+                          trimmed = commentText.trimEnd(),
+                          trailingWs = commentText.slice(trimmed.length),
+                          keyIdx = trimmed.indexOf(entry.key) + entry.key.length,
+                          parts = entry.value.trim().split(regex.whitespace.all),
                           named = entry.key == 'resource' && parts.length >= 2,
                           prefix = named ? ` ${parts[0]} ` : '',
                           suffix = named ? parts.slice(1).join(' ') : entry.value.trim(),
-                          fixedText = commentText.slice(0, keyIdx) + prefix
+                          fixedText = trimmed.slice(0, keyIdx) + prefix
                                     + ' '.repeat(targetCol - keyIdx - prefix.length) + suffix
-                    if (commentText !== fixedText)
+                    if (trimmed !== fixedText)
                         context.report({
                             node: entry.comment, messageId: 'misaligned', data: { column: targetCol },
-                            fix(fixer) { return fixer.replaceText(entry.comment, fixedText) }
+                            fix(fixer) { return fixer.replaceText(entry.comment, fixedText + trailingWs) }
                         })
                 }
             }

package/src/rules/no-insecure-fetch.js

@@ -1,14 +1,30 @@
-import { urlHeaders } from '../data/headers.js'
+import headers from '../data/headers.js'
+import regex from '../data/regex.js'
 
 const re = {
     insecureURL: /^http:\/\/(?!localhost\b|127\.0\.0\.1\b|\[::1\])/i,
     meta: {
         end:   /^\/\/\s*==\/UserScript==\s*$/,
-        line:  /^\/\/\s*@([\w-]+)(?::[\w-]+)?\s+(\S.*)$/, // eslint-disable-line security/detect-unsafe-regex
+        line:  /^\/\/\s*@([\w-]+)(?::[\w-]+)?\s+(\S.*)$/, // oxlint-disable-line security/detect-unsafe-regex
         start: /^\/\/\s*==UserScript==\s*$/
-    },
-    newline: /\r?\n/,
-    whitespace: /\s+/
+    }
+}
+
+function isInsecure(url) { return typeof url == 'string' && re.insecureURL.test(url) }
+function urlFromLiteral(node) {
+    return (node?.type == 'Literal'
+        && typeof node.value == 'string'
+        && isInsecure(node.value)
+    ) ? node.value : null
+}
+function urlFromOptions(node) {
+    if (node?.type != 'ObjectExpression') return null
+    for (const prop of node.properties)
+        if (prop.type == 'Property' && (prop.key?.name == 'url' || prop.key?.value == 'url')) {
+            const val = prop.value
+            if (val?.type == 'Literal' && isInsecure(val.value)) return val.value
+        }
+    return null
 }
 
 export default {
@@ -32,9 +48,8 @@ export default {
     create(context) {
         const xhrVars = new Set(),
               sourceCode = context.sourceCode ?? context.getSourceCode()
-        function isInsecure(url) { return typeof url == 'string' && re.insecureURL.test(url) }
         function reportMetadata() {
-            const lines = sourceCode.text.split(re.newline)
+            const lines = sourceCode.text.split(regex.newline)
             let inBlock = false
             for (const [i, rawLine] of lines.entries()) {
                 const line = rawLine.trimEnd()
@@ -43,8 +58,8 @@ export default {
                 if (!inBlock) continue
                 const match = line.match(re.meta.line) ; if (!match) continue
                 const key = match[1]
-                const type = urlHeaders.get(key) ; if (!type) continue
-                const tokens = match[2].split(re.whitespace),
+                const type = headers.url.get(key) ; if (!type) continue
+                const tokens = match[2].split(regex.whitespace.all),
                       url = type == 'named-url' ? tokens[1] : tokens[0]
                 if (!url || !isInsecure(url)) continue
                 const col = line.lastIndexOf(url)
@@ -62,22 +77,6 @@ export default {
                 : node.callee.name
             context.report({ node: node.arguments[0], messageId: 'insecureGMXHR', data: { callee, url }})
         }
-        function urlFromLiteral(node) {
-            return (node?.type == 'Literal'
-                && typeof node.value == 'string'
-                && isInsecure(node.value)
-            ) ? node.value : null
-        }
-        function urlFromOptions(node) {
-            if (node?.type != 'ObjectExpression') return null
-            for (const prop of node.properties)
-                if (prop.type == 'Property' && (prop.key?.name == 'url' || prop.key?.value == 'url')) {
-                    const val = prop.value
-                    if (val?.type == 'Literal' && isInsecure(val.value)) return val.value
-                }
-            return null
-        }
-
         return {
             Program() { reportMetadata() },
             VariableDeclarator(node) {

package/src/rules/no-insecure-messaging.js

@@ -3,6 +3,8 @@ const re = {
     postmsgValidation: /\b\w+\.(?:origin|source)\b/
 }
 
+function isMessageTarget(obj) { return obj?.type == 'Identifier' && re.messageTargets.has(obj.name) }
+
 export default {
     meta: {
         type: 'problem',
@@ -41,9 +43,6 @@ export default {
             if (re.postmsgValidation.test(body)) return
             context.report({ node, messageId: 'unvalidatedPostMessage', data: { target }})
         }
-        function isMessageTarget(obj) {
-            return obj?.type == 'Identifier' && re.messageTargets.has(obj.name)
-        }
         return {
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return

package/src/rules/no-invalid-grants.js

@@ -1,10 +1,11 @@
+import api from '../utils/api.js'
 import metadata from '../utils/metadata.js'
 
-import { allAPIs, supportsAPI } from '../data/apis.js'
+import apis from '../data/apis.js'
+import headers from '../data/headers.js'
 
-const managers = ['tampermonkey', 'violentmonkey', 'greasemonkey', 'scriptcat', 'adguard'],
-      specialGrants = new Set(['none', 'unsafeWindow', 'window.close', 'window.focus', 'window.onurlchange']),
-      allGrants = new Set([...allAPIs, ...specialGrants]),
+const specialGrants = new Set(['none', 'unsafeWindow', 'window.close', 'window.focus', 'window.onurlchange']),
+      allGrants = new Set([...apis.all, ...specialGrants]),
       sortedGrants = new Map(Array.from(allGrants, grant => [grant.toLowerCase(), grant]))
 
 export default {
@@ -20,8 +21,9 @@ export default {
             properties: {
                 target: {
                     anyOf: [
-                        { type: 'string', enum: ['all', ...managers] },
-                        { type: 'array', items: { type: 'string', enum: managers }, minItems: 1, uniqueItems: true }
+                        { type: 'string', enum: ['all', ...headers.managers] },
+                        { type: 'array', items: { type: 'string', enum: headers.managers },
+                            minItems: 1, uniqueItems: true }
                     ],
                     description: 'Manager(s) whose grants to validate against (default: all)'
                 },
@@ -67,9 +69,9 @@ export default {
                         continue
                     }
                     if (!targets.includes('all')
-                        && !targets.some(manager => supportsAPI({ manager, api: grantName }))
+                        && !targets.some(manager => api.supports({ manager, api: grantName }))
                     ) {
-                        const supporting = managers.filter(manager => supportsAPI({ manager, api: grantName }))
+                        const supporting = headers.managers.filter(manager => api.supports({ manager, api: grantName }))
                         context.report({ node: grant.comment, messageId: 'unsupportedGrant',
                             data: { grant: grantName, target: targets.join(', '), supporting: supporting.join(', ') }})
                     }

package/src/rules/no-invalid-headers.js

@@ -1,12 +1,11 @@
 import metadata from '../utils/metadata.js'
-
-import { managerHeaders, managers, localizedHeaders, validHeaders } from '../data/headers.js'
+import headers from '../data/headers.js'
 
 function parseAllowedPattern(entry) {
     if (typeof entry != 'string' || !entry.startsWith('/')) return null
     const lastSlash = entry.lastIndexOf('/')
     if (lastSlash == 0) return null
-    try { /* eslint-disable-next-line security/detect-non-literal-regexp */
+    try { /* oxlint-disable-next-line security/detect-non-literal-regexp */
         return new RegExp(entry.slice(1, lastSlash), entry.slice(lastSlash +1))
     } catch { return null }
 }
@@ -24,8 +23,9 @@ export default {
             properties: {
                 target: {
                     anyOf: [
-                        { type: 'string', enum: ['all', ...managers] },
-                        { type: 'array', items: { type: 'string', enum: managers }, minItems: 1, uniqueItems: true }
+                        { type: 'string', enum: ['all', ...headers.managers] },
+                        { type: 'array', items: {
+                            type: 'string', enum: headers.managers }, minItems: 1, uniqueItems: true }
                     ],
                     description: 'Manager(s) whose headers to validate against (default: all)'
                 },
@@ -50,8 +50,8 @@ export default {
               allowedList = [options.allowedHeaders ?? []].flat(),
               allowedExact = new Set(),
               allowedRegexes = [],
-              validSet = targets.includes('all') ? validHeaders.get('all')
-                       : new Set(targets.flatMap(target => [...validHeaders.get(target)]))
+              validSet = targets.includes('all') ? headers.valid.get('all')
+                       : new Set(targets.flatMap(target => [...headers.valid.get(target)]))
         for (const entry of allowedList) {
             if (entry instanceof RegExp) allowedRegexes.push(entry)
             else if (typeof entry == 'string') {
@@ -66,9 +66,9 @@ export default {
                 for (const entry of metaEntries) {
                     if (allowedExact.has(entry.key)) continue
                     if (allowedRegexes.some(re => re.test(entry.key))) continue
-                    if (localizedHeaders.includes(entry.key.split(':')[0])) continue
+                    if (headers.localized.includes(entry.key.split(':')[0])) continue
                     if (validSet.has(entry.key)) continue
-                    const supporting = managerHeaders.get(entry.key)
+                    const supporting = headers.manager.get(entry.key)
                     if (supporting)
                         context.report({ node: entry.comment, messageId: 'unsupportedHeader',
                             data: { header: entry.key, target: targets.join(', '), supporting: supporting.join(', ') }})

package/src/rules/no-missing-grants.js

@@ -1,9 +1,7 @@
 import metadata from '../utils/metadata.js'
+import apis from '../data/apis.js'
 
-import { gmLegacyAPIs, gmModernAPIs, scAPIs } from '../data/apis.js'
-
-const apis = new Set([...gmLegacyAPIs, ...gmModernAPIs, ...scAPIs]),
-      grantlessAPIs = new Set(['GM_info', 'GM.info']) // always available, no grant required
+apis.grantless = new Set(['GM_info', 'GM.info'])
 
 export default {
     meta: {
@@ -19,7 +17,7 @@ export default {
 
     create(context) {
         const usedAPIs = new Map()
-        function record(name, node) { if (apis.has(name) && !usedAPIs.has(name)) usedAPIs.set(name, node) }
+        function record(name, node) { if (apis.all.has(name) && !usedAPIs.has(name)) usedAPIs.set(name, node) }
         return {
             Identifier(node) { record(node.name, node) },
             MemberExpression(node) {
@@ -42,7 +40,7 @@ export default {
                         .map(entry => entry.value.trim())
                 )
                 for (const [api, node] of usedAPIs) {
-                    if (grantlessAPIs.has(api) || declared.has(api)) continue
+                    if (apis.grantless.has(api) || declared.has(api)) continue
                     context.report({ node, messageId: 'missingGrant', data: { api }})
                 }
             }

package/src/rules/no-missing-resources.js

@@ -1,8 +1,9 @@
 import metadata from '../utils/metadata.js'
 import template from '../utils/template.js'
 
-const resourceGetterNames = new Set(['GM_getResourceText', 'GM_getResourceURL']),
-      re = { specialChars: /[.*+?^${}()|[\]\\]/g, whitespace: /\s+/ }
+import regex from '../data/regex.js'
+
+const resourceGetterNames = new Set(['GM_getResourceText', 'GM_getResourceURL'])
 
 export default {
     meta: {
@@ -29,8 +30,8 @@ export default {
                 if (resolved) usedRefs.push({ names: resolved, pattern: null, node })
                 else usedRefs.push({
                     names: null,
-                    pattern: new RegExp( // eslint-disable-line security/detect-non-literal-regexp
-                        `^${arg.quasis.map(q => q.value.raw.replace(re.specialChars, '\\$&')).join('.*')}$`),
+                    pattern: new RegExp( // oxlint-disable-line security/detect-non-literal-regexp
+                        `^${arg.quasis.map(q => q.value.raw.replace(regex.specialChars, '\\$&')).join('.*')}$`),
                     node
                 })
             }
@@ -45,7 +46,7 @@ export default {
                 const declared = new Set(
                     metadata.extract(context.sourceCode)
                         .filter(entry => entry.key == 'resource')
-                        .map(entry => entry.value.trim().split(re.whitespace)[0])
+                        .map(entry => entry.value.trim().split(regex.whitespace.all)[0])
                 )
                 for (const ref of usedRefs) {
                     if (ref.names) {

package/src/rules/no-sensitive-grants.js

@@ -0,0 +1,81 @@
+import apis from '../data/apis.js'
+import headers from '../data/headers.js'
+import regex from '../data/regex.js'
+
+const re = { connect: /^\s*\/\/\s*@connect\s+(\S+)/, grant: /^\s*\/\/\s*@grant\s+(\S+)/ }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flags security-sensitive `@grant` values and overbroad `@connect` patterns',
+            category: 'Possible Errors',
+            recommended: false,
+            security: true
+        },
+        defaultOptions: [{ target: 'all', allowedGrants: [], allowBroadConnect: false }],
+        schema: [{
+            type: 'object',
+            properties: {
+                target: {
+                    oneOf: [
+                        { type: 'string', enum: ['all', ...headers.managers], description: 'Single manager (or "all")' },
+                        { type: 'array', items: { type: 'string', enum: headers.managers },
+                            description: 'Multiple managers' }
+                    ],
+                    description: 'Manager(s) whose sensitive-grant set to check against'
+                },
+                allowedGrants: {
+                    oneOf: [
+                        { type: 'string', description: 'Single sensitive grant to allow' },
+                        { type: 'array', items: { type: 'string' }, description: 'Multiple sensitive grants to allow' }
+                    ],
+                    description: 'Sensitive grants to explicitly allow'
+                },
+                allowBroadConnect: { type: 'boolean', description: 'Permit @connect * and wildcard-domain patterns' }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            sensitiveGrant: '`@grant {{grant}}` is security-sensitive. Review whether it\'s needed'
+                          + ' or add it to `allowedGrants`.',
+            broadConnect:   '`@connect {{pattern}}` allows `GM_xmlhttpRequest` to reach arbitrary hosts.'
+                          + ' Scope it to specific hosts or enable `allowBroadConnect`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] ?? {},
+              target = opts.target ?? 'all',
+              allowBroadConnect = opts.allowBroadConnect === true,
+              allowed = new Set(typeof opts.allowedGrants == 'string' ? [opts.allowedGrants]
+                      : opts.allowedGrants ?? []),
+              sourceCode = context.sourceCode ?? context.getSourceCode(),
+              managers = target == 'all' ? [...apis.managerSensitive.keys()]
+                       : Array.isArray(target) ? target : [target]
+        const isSensitive = grant => apis.sensitive.has(grant)
+            || managers.some(mgr => apis.managerSensitive.get(mgr)?.has(grant))
+        const report = (line, messageId, data, col, len) => context.report({
+            loc: { start: { line, column: col }, end: { line, column: col + len }}, messageId, data })
+        return {
+            Program() {
+                const match = sourceCode.text.match(regex.meta.block) ; if (!match) return
+                const lines = match[1].split(regex.newline),
+                      baseLine = sourceCode.text.slice(0, match.index).split(regex.newline).length,
+                      lineData = lines.map(line => ({
+                          grant: line.match(re.grant)?.[1],
+                          connect: line.match(re.connect)?.[1]
+                      })),
+                      hasXHR = lineData.some(d => d.grant == 'GM_xmlhttpRequest' || d.grant == 'GM.xmlHttpRequest')
+                for (const [i, { grant, connect }] of lineData.entries()) {
+                    const lineNo = baseLine + i +1,
+                          raw = lines[i] // oxlint-disable-line security/detect-object-injection
+                    if (grant && !allowed.has(grant) && isSensitive(grant))
+                        report(lineNo, 'sensitiveGrant', { grant }, raw.indexOf(grant), grant.length)
+                    if (connect && hasXHR && !allowBroadConnect && headers.broadConnect.has(connect))
+                        report(lineNo, 'broadConnect', { pattern: connect }, raw.indexOf(connect), connect.length)
+                }
+            }
+        }
+    }
+}