eslint-plugin-no-mistakes 0.95.0 → 0.96.0

package/README.md

@@ -57,3 +57,8 @@ See [options and examples](../../docs/eslint-rules/postgres-no-async-sql-builder
 `require-options-on-imported-call` requires a static options object on configured
 imports, globals with no local binding, and terminal methods with a matching receiver shape.
 See [options and examples](../../docs/eslint-rules/require-options-on-imported-call.md).
+
+`restricted-api-usage` is an opt-in import/export-name and call-name policy.
+See [options and examples](../../docs/eslint-rules/restricted-api-usage.md).
+
+Opt-in client contracts: [`no-consecutive-unbatched-reads`](../../docs/eslint-rules/no-consecutive-unbatched-reads.md) configures adjacent awaited read batching; [`require-top-level-registration`](../../docs/eslint-rules/require-top-level-registration.md) configures owner-module lifecycle registration. Both support ESLint/Oxlint and have no product defaults.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-no-mistakes",
-  "version": "0.95.0",
+  "version": "0.96.0",
   "description": "ESLint and Oxlint rules that keep code static enough for no-mistakes analyzers and coding agents",
   "license": "MIT",
   "repository": {

package/src/index.js

@@ -1,6 +1,9 @@
 "use strict";
 
 const rules = {
+  "restricted-api-usage": require("./rules/restricted-api-usage"),
+  "no-consecutive-unbatched-reads": require("./rules/no-consecutive-unbatched-reads"),
+  "require-top-level-registration": require("./rules/require-top-level-registration"),
   "forbidden-member-chains": require("./rules/forbidden-member-chains"),
   "gh-api-argument-safety": require("./rules/gh-api-argument-safety"),
   "no-argv-main-guard": require("./rules/no-argv-main-guard"),

package/src/rules/argv-main-fragments.js

@@ -0,0 +1,25 @@
+"use strict";
+const ARGV = 1;
+// Strings and [prefix, suffix] fragments stay separate from path identities.
+// Keeping the fragment until the comparison lets nested concatenations fold once.
+function identity(value) {
+  if (Array.isArray(value)) return /^file:\/\/\/?$/i.test(value[0]) && value[1] === "" ? ARGV : 0;
+  return typeof value === "number" ? value : 0;
+}
+function concatenate(left, right) {
+  if (left === ARGV) left = ["", ""];
+  if (right === ARGV) right = ["", ""];
+  // Accepted prefixes have at most eight characters; reject before allocating.
+  if (typeof left === "string" && typeof right === "string")
+    return left.length + right.length <= 8 ? left + right : 0;
+  if (typeof left === "string" && Array.isArray(right))
+    return left.length + right[0].length <= 8 ? [left + right[0], right[1]] : 0;
+  if (Array.isArray(left) && typeof right === "string") return right === "" ? left : 0;
+  return 0;
+}
+function fileUrlArgument(target, read) {
+  if (target?.type !== "NewExpression" || target.arguments.length !== 1) return 0;
+  const argument = read(target.arguments[0]);
+  return Array.isArray(argument) && identity(argument) === ARGV ? argument : 0;
+}
+module.exports = { ARGV, identity, concatenate, fileUrlArgument };

package/src/rules/argv-main-values.js

@@ -2,6 +2,7 @@
 const { unwrapExpression } = require("./async-ast");
 const { resolveVariable, memberPropertyName, isLocalRequire } = require("./async-target-bindings");
 const { literalString, logicalCall } = require("./module-mock-helpers");
+const { ARGV, identity, concatenate, fileUrlArgument } = require("./argv-main-fragments");
 
 function globalName(node, name, context) {
   if (node?.type !== "Identifier" || node.name !== name) return false;
@@ -29,16 +30,18 @@ function nodeProcess(node, context) {
     ["process", "node:process"].includes(literalString(init.arguments[0]))
   );
 }
-const ARGV = 1;
 const MAIN = 2;
 const PROCESS = 3;
 const ARGUMENTS = 4;
 function createClassifier(context, wrappers) {
   const stable = new WeakMap();
   const aliases = new WeakMap();
+  const value = (node, depth) => identity(classify(node, depth));
   function classify(input, depth = 0) {
     const node = unwrapExpression(input);
     if (!node || depth > 32) return 0;
+    const text = literalString(node);
+    if (text !== null) return text;
     if (node.type === "Identifier") {
       const variable = resolveVariable(node, context);
       if (!variable) {
@@ -67,7 +70,7 @@ function createClassifier(context, wrappers) {
         def.node?.id?.type === "ObjectPattern"
       ) {
         const key = objectPatternKey(def.node.id, node.name);
-        if (key === "argv" && classify(def.node.init, depth + 1) === PROCESS) return ARGUMENTS;
+        if (key === "argv" && value(def.node.init, depth + 1) === PROCESS) return ARGUMENTS;
         return 0;
       }
       if (
@@ -83,6 +86,29 @@ function createClassifier(context, wrappers) {
       }
       return aliases.get(variable);
     }
+    if (node.type === "BinaryExpression" && node.operator === "+") {
+      return concatenate(classify(node.left, depth + 1), classify(node.right, depth + 1));
+    }
+    if (
+      node.type === "LogicalExpression" &&
+      node.operator === "??" &&
+      classify(node.right, depth + 1) === ""
+    ) {
+      return classify(node.left, depth + 1);
+    }
+    if (node.type === "TemplateLiteral") {
+      // Only prefix substitutions may be constant; a suffix substitution is not an argv guard.
+      const last = node.expressions.length - 1;
+      const argument = classify(node.expressions[last], depth + 1);
+      if (identity(argument) !== ARGV || node.quasis[last + 1].value.cooked !== "") return 0;
+      let prefix = node.quasis[0].value.cooked;
+      for (let i = 0; i < last; i++) {
+        const part = classify(node.expressions[i], depth + 1);
+        if (typeof part !== "string") return 0;
+        prefix = concatenate(prefix, concatenate(part, node.quasis[i + 1].value.cooked));
+      }
+      return concatenate(prefix, argument);
+    }
     if (node.type === "MemberExpression") {
       const name = memberPropertyName(node);
       if (
@@ -92,7 +118,12 @@ function createClassifier(context, wrappers) {
         ["url", "filename"].includes(name)
       )
         return MAIN;
-      const object = classify(node.object, depth + 1);
+      const target = unwrapExpression(node.object);
+      if (name === "href" && globalName(target?.callee, "URL", context)) {
+        const constructed = fileUrlArgument(target, (argument) => classify(argument, depth + 1));
+        if (constructed) return constructed;
+      }
+      const object = value(node.object, depth + 1);
       if (object === PROCESS && name === "argv") return ARGUMENTS;
       if (object === ARGUMENTS && node.computed && staticIndexOne(node.property)) return ARGV;
       // A URL conversion's href preserves the same module/argv identity.
@@ -110,20 +141,47 @@ function createClassifier(context, wrappers) {
       if (
         callee?.type === "MemberExpression" &&
         memberPropertyName(callee) === "at" &&
-        classify(callee.object, depth + 1) === ARGUMENTS &&
+        value(callee.object, depth + 1) === ARGUMENTS &&
         invoked.arguments.length === 1 &&
         staticIndexOne(invoked.arguments[0])
       )
         return ARGV;
+      if (
+        !invoked.forwarded &&
+        callee?.type === "MemberExpression" &&
+        memberPropertyName(callee) === "toString" &&
+        invoked.arguments.length === 0
+      ) {
+        const url = unwrapExpression(callee.object);
+        if (globalName(url?.callee, "URL", context)) {
+          const constructed = fileUrlArgument(url, (argument) => classify(argument, depth + 1));
+          if (constructed) return constructed;
+        }
+        const classified = classify(callee.object, depth + 1);
+        return typeof classified === "string" || [ARGV, MAIN].includes(identity(classified))
+          ? classified
+          : 0;
+      }
+      if (
+        !invoked.forwarded &&
+        callee?.type === "MemberExpression" &&
+        memberPropertyName(callee) === "concat" &&
+        invoked.arguments.every((argument) => argument.type !== "SpreadElement")
+      )
+        return invoked.arguments.reduce(
+          (folded, argument) => concatenate(folded, classify(argument, depth + 1)),
+          classify(callee.object, depth + 1),
+        );
       if (invoked.arguments.length !== 1 || invoked.arguments[0].type === "SpreadElement") return 0;
+      if (globalName(callee, "String", context)) return classify(invoked.arguments[0], depth + 1);
       if (globalName(callee, "Boolean", context) || wrappers.resolveCallTarget(node)) {
-        const value = classify(invoked.arguments[0], depth + 1);
-        return value === ARGV || value === MAIN ? value : 0;
+        const argument = value(invoked.arguments[0], depth + 1);
+        return argument === ARGV || argument === MAIN ? argument : 0;
       }
     }
     return 0;
   }
-  return (node) => classify(node);
+  return (node) => value(node, 0);
 }
 function staticIndexOne(node) {
   if (!node) return false;

package/src/rules/async-call-disposition.js

@@ -1,166 +1,50 @@
 "use strict";
 
 const { rule } = require("../helpers");
+const { ruleSuppression } = require("../rule-suppression");
 const {
-  findContainingFunction,
-  isFunction,
-  isTransparentExpression,
-  unwrapExpression,
-  unwrapTransparentParent,
-} = require("./async-ast");
+  collectedPromise,
+  isPromiseAllCall,
+  retainedCollection,
+  retainedPromise,
+} = require("./async-disposition-bindings");
+const {
+  directlyDisposed,
+  observedExpression,
+  promiseAllDisposed,
+  mappedPromise,
+} = require("./async-disposition-expressions");
 const { targetOptionsSchema } = require("./async-schema");
-const { createTargetMatcher, memberPropertyName } = require("./async-targets");
+const { createTargetMatcher } = require("./async-targets");
 
-function isPromiseAllCall(node) {
-  const callee = unwrapExpression(node?.callee);
-  const object = unwrapExpression(callee?.object);
+function isDisposed(node, context, seen = new Set()) {
+  if (seen.has(node)) return false;
+  seen.add(node);
+  const observed = observedExpression(node, context);
+  const disposed = (value) => isDisposed(value, context, seen);
   return (
-    node?.type === "CallExpression" &&
-    callee?.type === "MemberExpression" &&
-    object?.type === "Identifier" &&
-    object.name === "Promise" &&
-    memberPropertyName(callee) === "all"
+    directlyDisposed(node, context) ||
+    directlyDisposed(observed, context) ||
+    promiseAllDisposed(observed, context) ||
+    retainedPromise(observed, context, disposed) ||
+    mappedPromise(observed, (value) =>
+      retainedCollection(
+        value,
+        context,
+        (aggregate) => isPromiseAllCall(aggregate, context),
+        disposed,
+      ),
+    ) ||
+    collectedPromise(
+      observed,
+      context,
+      (value) => isPromiseAllCall(value, context),
+      disposed,
+      node.type === "CallExpression",
+    )
   );
 }
 
-function directlyDisposed(node) {
-  const expression = unwrapTransparentParent(node);
-  const parent = expression.parent;
-  if (parent?.type === "ReturnStatement") {
-    const fn = findContainingFunction(parent);
-    return !isCallArgument(fn);
-  }
-  if (parent?.type === "ArrowFunctionExpression" && parent.body === expression) {
-    if (isCallCallee(parent)) return directlyDisposed(parent.parent);
-    return !isCallArgument(parent);
-  }
-  return (
-    parent?.type === "AwaitExpression" ||
-    (parent?.type === "UnaryExpression" && parent.operator === "void")
-  );
-}
-
-function isCallArgument(node) {
-  return Boolean(node?.parent?.type === "CallExpression" && node.parent.arguments.includes(node));
-}
-
-function isCallCallee(node) {
-  return node?.parent?.type === "CallExpression" && node.parent.callee === node;
-}
-
-function isPromiseAllIterable(node, promiseAll) {
-  return promiseAll.arguments[0] === node && (node.type === "ArrayExpression" || isMapCall(node));
-}
-
-function isMapCall(node) {
-  return (
-    node?.type === "CallExpression" &&
-    node.callee.type === "MemberExpression" &&
-    memberPropertyName(node.callee) === "map"
-  );
-}
-
-function isMapCallback(fn) {
-  const call = fn.parent;
-  return isMapCall(call) && call.arguments.includes(fn);
-}
-
-function expressionReturnedFromCallback(node, fn) {
-  let current = node;
-  let returnStatement = null;
-  while (current && current !== fn) {
-    if (current.parent === fn && fn.body === current && fn.body.type !== "BlockStatement") {
-      return true;
-    }
-    if (current.parent?.type === "ReturnStatement") {
-      returnStatement = current.parent;
-    }
-    current = current.parent;
-  }
-  return Boolean(returnStatement);
-}
-
-function canReachPromiseAll(node, promiseAll) {
-  let current = node;
-  while (current && current !== promiseAll) {
-    const parent = current.parent;
-    if (isTransparentExpression(parent)) {
-      current = parent;
-      continue;
-    }
-    if (parent?.type === "MemberExpression") return false;
-    if (parent === promiseAll) return isPromiseAllIterable(current, promiseAll);
-    if (isFunction(parent)) {
-      if (!expressionReturnedFromCallback(node, parent) || !isMapCallback(parent)) {
-        return false;
-      }
-      current = parent.parent;
-      continue;
-    }
-    if (parent?.type === "ArrayExpression") {
-      if (parent.parent !== promiseAll || promiseAll.arguments[0] !== parent) return false;
-      current = parent;
-      continue;
-    }
-    if (parent?.type === "ObjectExpression") return false;
-    if (
-      parent?.type === "CallExpression" &&
-      parent !== promiseAll &&
-      parent.arguments.includes(current)
-    ) {
-      return false;
-    }
-    current = parent;
-  }
-  return current === promiseAll;
-}
-
-function observedExpression(node) {
-  let current = node;
-  while (current.parent) {
-    const parent = current.parent;
-    if (isTransparentExpression(parent)) {
-      current = parent;
-      continue;
-    }
-    if (
-      parent.type === "MemberExpression" &&
-      parent.object === current &&
-      parent.parent?.type === "CallExpression" &&
-      parent.parent.callee === parent
-    ) {
-      current = parent;
-      continue;
-    }
-    if (parent.type === "CallExpression" && parent.callee === current) {
-      current = parent;
-      continue;
-    }
-    break;
-  }
-  return current;
-}
-
-function promiseAllDisposed(node) {
-  let current = node.parent;
-  while (current) {
-    if (isPromiseAllCall(current) && canReachPromiseAll(node, current)) {
-      return (
-        directlyDisposed(current) ||
-        directlyDisposed(observedExpression(current)) ||
-        promiseAllDisposed(current)
-      );
-    }
-    current = current.parent;
-  }
-  return false;
-}
-
-function isDisposed(node) {
-  const observed = observedExpression(node);
-  return directlyDisposed(node) || directlyDisposed(observed) || promiseAllDisposed(node);
-}
-
 module.exports = rule(
   {
     type: "problem",
@@ -178,12 +62,13 @@ module.exports = rule(
   },
   (context) => {
     const matcher = createTargetMatcher(context);
+    const suppressed = ruleSuppression(context, "async-call-disposition");
     if (!matcher.hasTargets) return {};
 
     return {
       ...matcher.visitors,
       CallExpression(node) {
-        if (!matcher.isTargetCall(node) || isDisposed(node)) return;
+        if (!matcher.isTargetCall(node) || suppressed(node) || isDisposed(node, context)) return;
         context.report({
           node,
           messageId: "disposition",

package/src/rules/async-disposition-bindings.js

@@ -0,0 +1,131 @@
+"use strict";
+
+const { unwrapExpression, unwrapTransparentParent } = require("./async-ast");
+const { resolveVariable, stableConstInitializer } = require("./async-target-bindings");
+const { laterDrain, laterInBlock } = require("./async-disposition-flow");
+const { propertiesWritten } = require("./async-disposition-mocks");
+const { memberPropertyName } = require("./async-targets");
+
+function globalPromise(node, context) {
+  const variable = resolveVariable(node, context);
+  return !variable?.defs.length && !propertiesWritten(node, context);
+}
+
+function isPromiseMethodCall(node, context, methods) {
+  const callee = unwrapExpression(node?.callee);
+  const object = unwrapExpression(callee?.object);
+  return (
+    node?.type === "CallExpression" &&
+    callee?.type === "MemberExpression" &&
+    object?.type === "Identifier" &&
+    object.name === "Promise" &&
+    globalPromise(object, context) &&
+    methods.includes(memberPropertyName(callee))
+  );
+}
+
+function isPromiseAllCall(node, context) {
+  return isPromiseMethodCall(node, context, ["all", "allSettled", "race", "any"]);
+}
+
+function standalonePush(call) {
+  return (
+    call.parent.type === "ExpressionStatement" ||
+    (call.parent.type === "ArrowFunctionExpression" && call.parent.body === call)
+  );
+}
+
+function pushedArray(node) {
+  const value = unwrapTransparentParent(node);
+  const push = value.parent;
+  const callee = unwrapExpression(push?.callee);
+  if (
+    push?.type !== "CallExpression" ||
+    !push.arguments.includes(value) ||
+    callee?.type !== "MemberExpression" ||
+    memberPropertyName(callee) !== "push" ||
+    callee.object.type !== "Identifier" ||
+    !standalonePush(push)
+  )
+    return null;
+  return { id: callee.object, push };
+}
+
+function collectedPromise(node, context, isAggregate, disposed, createdHere) {
+  const found = pushedArray(node);
+  if (!found) return false;
+  const init = unwrapExpression(stableConstInitializer(found.id, context, new Set()));
+  if (init?.type !== "ArrayExpression" || init.elements.length !== 0) return false;
+  const variable = resolveVariable(found.id, context);
+  let drained = false;
+  for (const reference of variable.references) {
+    if (reference.init) continue;
+    const id = reference.identifier;
+    const parent = unwrapTransparentParent(id).parent;
+    if (isAggregate(parent) && parent.arguments[0] === id) {
+      if (laterDrain(found.push, parent, createdHere) && disposed(parent)) drained = true;
+      continue;
+    }
+    const member = parent;
+    const call = member?.parent;
+    if (
+      member?.type !== "MemberExpression" ||
+      member.object !== id ||
+      memberPropertyName(member) !== "push" ||
+      call?.type !== "CallExpression" ||
+      call.callee !== member ||
+      !standalonePush(call)
+    )
+      return false;
+    // A sibling push cannot remove values already collected. Its producer
+    // independently proves whether it reaches a handled drain.
+  }
+  return drained;
+}
+
+function retainedCollection(node, context, isAggregate, disposed) {
+  const expression = unwrapTransparentParent(node);
+  const declaration = expression.parent;
+  if (
+    declaration?.type !== "VariableDeclarator" ||
+    declaration.init !== expression ||
+    declaration.id.type !== "Identifier" ||
+    !stableConstInitializer(declaration.id, context, new Set())
+  )
+    return false;
+  const variable = resolveVariable(declaration.id, context);
+  let drained = false;
+  for (const reference of variable.references) {
+    if (reference.init) continue;
+    const id = unwrapTransparentParent(reference.identifier);
+    const parent = id.parent;
+    if (!isAggregate(parent) || parent.arguments[0] !== id) return false;
+    if (laterDrain(node, parent) && disposed(parent)) drained = true;
+  }
+  return drained;
+}
+
+function retainedPromise(node, context, disposed) {
+  const expression = unwrapTransparentParent(node);
+  const declaration = expression.parent;
+  if (
+    declaration?.type !== "VariableDeclarator" ||
+    declaration.init !== expression ||
+    declaration.id.type !== "Identifier"
+  )
+    return false;
+  if (!stableConstInitializer(declaration.id, context, new Set())) return false;
+  const variable = resolveVariable(declaration.id, context);
+  return variable.references.some(
+    (reference) =>
+      !reference.init && laterInBlock(node, reference.identifier) && disposed(reference.identifier),
+  );
+}
+
+module.exports = {
+  collectedPromise,
+  isPromiseAllCall,
+  isPromiseMethodCall,
+  retainedCollection,
+  retainedPromise,
+};