lintcn 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## 0.5.0
+
+1. **Security fix — path traversal in `--tsgolint-version`** — the version flag is now validated against a strict pattern. Previously a value like `../../etc` could escape the cache directory.
+
+2. **Fixed intermittent failures with concurrent `lintcn lint` runs** — build workspaces are now per-content-hash instead of shared. Two processes running simultaneously no longer corrupt each other's build.
+
+3. **Cross-platform tar extraction** — replaced shell `tar` command with the npm `tar` package. Works on Windows without needing system tar.
+
+4. **No more `patch` command required** — tsgolint downloads now use a fork with a clean `internal/runner.Run()` entry point. Zero modifications to existing tsgolint files; upstream syncs will never conflict.
+
+5. **Downloads no longer hang** — 120s timeout on all GitHub tarball downloads.
+
+6. **Fixed broken `.tsgolint` symlink** — `lintcn add` now correctly detects and recreates broken symlinks.
+
+## 0.4.0
+
 ## 0.3.0
 
 1. **Only custom rules run by default** — previously the binary included all 44 built-in tsgolint rules, producing thousands of noisy errors. Now only your `.lintcn/` rules run. True shadcn model: explicitly add each rule you want.

package/README.md

@@ -49,10 +49,12 @@ my-project/
 When you run `npx lintcn lint`, the CLI:
 
 1. Scans `.lintcn/*.go` for rule definitions
-2. Generates a Go workspace with all 50+ built-in tsgolint rules + your custom rules
+2. Generates a Go workspace with your custom rules
 3. Compiles a custom binary (cached — rebuilds only when rules change)
 4. Runs the binary against your project
 
+You can run `lintcn lint` from any subdirectory — it walks up to find `.lintcn/` and lints the cwd project.
+
 ## Writing a rule
 
 Every rule is a Go file with `package lintcn` that exports a `rule.Rule` variable.
@@ -134,7 +136,7 @@ void getUser("id")
 ```json
 {
   "devDependencies": {
-    "lintcn": "0.1.0"
+    "lintcn": "0.4.0"
   }
 }
 ```
@@ -154,8 +156,7 @@ npx lintcn lint --tsgolint-version v0.10.0
 ## Prerequisites
 
 - **Node.js** — for the CLI
-- **Go 1.26+** — for compiling rules (`go.dev/dl`)
-- **Git** — for cloning tsgolint source on first build
+- **Go** — for compiling rules (`go.dev/dl`)
 
 Go is only needed for `lintcn lint` / `lintcn build`. Adding and listing rules works without Go.
 

package/dist/cache.d.ts

@@ -1,9 +1,13 @@
-export declare const DEFAULT_TSGOLINT_VERSION = "v0.9.2";
+export declare const DEFAULT_TSGOLINT_VERSION = "e945641eabec22993eda3e7c101692e80417e0ea";
+/** Validate version string to prevent path traversal attacks.
+ *  Only allows alphanumeric chars, dots, underscores, and hyphens. */
+export declare function validateVersion(version: string): void;
 export declare function getCacheDir(): string;
 export declare function getTsgolintSourceDir(version: string): string;
 export declare function getBinDir(): string;
 export declare function getBinaryPath(contentHash: string): string;
-export declare function getBuildDir(): string;
+/** Per-hash build directory to avoid races between concurrent lintcn processes. */
+export declare function getBuildDir(contentHash: string): string;
 export declare function ensureTsgolintSource(version: string): Promise<string>;
 export declare function cachedBinaryExists(contentHash: string): boolean;
 //# sourceMappingURL=cache.d.ts.map

package/dist/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,wBAAwB,WAAW,CAAA;AAOhD,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAuCD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2D3E;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAQ/D"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,wBAAwB,6CAA6C,CAAA;AAUlF;sEACsE;AACtE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAOrD;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEvD;AA0DD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuE3E;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAQ/D"}

package/dist/cache.js

@@ -1,24 +1,36 @@
 // Manage cached tsgolint source and compiled binaries.
-// Downloads tsgolint + typescript-go as tarballs from GitHub (no git required),
-// applies patches with `patch -p1`, and copies internal/collections.
+// Downloads tsgolint fork + typescript-go as tarballs from GitHub,
+// applies tsgolint's patches to typescript-go, and copies collections.
 //
 // Cache layout:
 //   ~/.cache/lintcn/tsgolint/<version>/   — extracted source (read-only)
+//   ~/.cache/lintcn/build/<content-hash>/ — per-hash build workspace (no race)
 //   ~/.cache/lintcn/bin/<content-hash>    — compiled binaries
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import { pipeline } from 'node:stream/promises';
+import { extract } from 'tar';
 import { execAsync } from "./exec.js";
-// Pinned tsgolint version — updated with each lintcn release.
-// This ensures reproducible builds: every user on the same lintcn version
-// compiles rules against the same tsgolint API. Changing this is a conscious
-// decision — tsgolint API changes can break user rules.
-export const DEFAULT_TSGOLINT_VERSION = 'v0.9.2';
-// Pinned typescript-go commit that tsgolint v0.9.2 depends on.
-// Found via `git ls-tree HEAD typescript-go` in the tsgolint repo.
+// Pinned tsgolint fork commit — updated with each lintcn release.
+// Uses remorses/tsgolint fork which adds internal/runner.Run().
+// Only 1 commit on top of upstream — zero modifications to existing files.
+export const DEFAULT_TSGOLINT_VERSION = 'e945641eabec22993eda3e7c101692e80417e0ea';
+// Pinned typescript-go base commit from microsoft/typescript-go (before patches).
+// Patches from tsgolint/patches/ are applied on top during setup.
 // Must be updated when DEFAULT_TSGOLINT_VERSION changes.
-const TYPESCRIPT_GO_COMMIT = '2437fa43e85103d2a18e8e41e1a2a994d0708ccf';
+const TYPESCRIPT_GO_COMMIT = '1b7eabe122e1575a0df9c77eccdf4e063c623224';
+// Strict pattern for version strings — prevents path traversal via ../
+const VERSION_PATTERN = /^[a-zA-Z0-9._-]+$/;
+/** Validate version string to prevent path traversal attacks.
+ *  Only allows alphanumeric chars, dots, underscores, and hyphens. */
+export function validateVersion(version) {
+    if (!VERSION_PATTERN.test(version)) {
+        throw new Error(`Invalid tsgolint version "${version}". ` +
+            'Version must only contain alphanumeric characters, dots, underscores, and hyphens.');
+    }
+}
 export function getCacheDir() {
     return path.join(os.homedir(), '.cache', 'lintcn');
 }
@@ -31,25 +43,47 @@ export function getBinDir() {
 export function getBinaryPath(contentHash) {
     return path.join(getBinDir(), contentHash);
 }
-export function getBuildDir() {
-    return path.join(getCacheDir(), 'build');
+/** Per-hash build directory to avoid races between concurrent lintcn processes. */
+export function getBuildDir(contentHash) {
+    return path.join(getCacheDir(), 'build', contentHash);
 }
 /** Download a tarball from URL and extract it to targetDir.
+ *  Uses the `tar` npm package for cross-platform support (no shell tar needed).
  *  GitHub tarballs have a top-level directory like `repo-ref/`,
  *  so we strip the first path component during extraction. */
 async function downloadAndExtract(url, targetDir) {
-    const response = await fetch(url);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => {
+        controller.abort(new Error(`Download timed out after 120s: ${url}`));
+    }, 120_000);
+    let response;
+    try {
+        response = await fetch(url, { signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
     if (!response.ok || !response.body) {
         throw new Error(`Failed to download ${url}: ${response.status} ${response.statusText}`);
     }
-    fs.mkdirSync(targetDir, { recursive: true });
-    // pipe through gunzip, then extract with tar (strip top-level directory)
-    const tmpTarGz = path.join(os.tmpdir(), `lintcn-${Date.now()}.tar.gz`);
-    const fileStream = fs.createWriteStream(tmpTarGz);
-    // @ts-ignore ReadableStream vs NodeJS.ReadableStream mismatch
-    await pipeline(response.body, fileStream);
-    await execAsync('tar', ['xzf', tmpTarGz, '--strip-components=1', '-C', targetDir]);
-    fs.rmSync(tmpTarGz, { force: true });
+    // download to temp file with random suffix to avoid collisions
+    const tmpTarGz = path.join(os.tmpdir(), `lintcn-${crypto.randomBytes(8).toString('hex')}.tar.gz`);
+    try {
+        const fileStream = fs.createWriteStream(tmpTarGz);
+        // @ts-ignore ReadableStream vs NodeJS.ReadableStream mismatch
+        await pipeline(response.body, fileStream);
+        // extract with npm tar package (cross-platform, no shell tar needed)
+        fs.mkdirSync(targetDir, { recursive: true });
+        await extract({
+            file: tmpTarGz,
+            cwd: targetDir,
+            strip: 1,
+        });
+    }
+    finally {
+        // always clean up temp file
+        fs.rmSync(tmpTarGz, { force: true });
+    }
 }
 /** Apply git-format patches using `patch -p1` (no git required).
  *  Patches are standard unified diff format, `patch` ignores the git metadata. */
@@ -59,33 +93,37 @@ async function applyPatches(patchesDir, targetDir) {
         .sort();
     for (const patchFile of patches) {
         const patchPath = path.join(patchesDir, patchFile);
-        // --batch silences interactive prompts, -f forces application
         await execAsync('patch', ['-p1', '--batch', '-i', patchPath], { cwd: targetDir });
     }
     return patches.length;
 }
 export async function ensureTsgolintSource(version) {
+    validateVersion(version);
     const sourceDir = getTsgolintSourceDir(version);
     const readyMarker = path.join(sourceDir, '.lintcn-ready');
     if (fs.existsSync(readyMarker)) {
         return sourceDir;
     }
-    // clean up any partial previous attempt so we start fresh
+    // Use a temp directory for the download, then atomic rename on success.
+    // This prevents concurrent processes from seeing partial state, and
+    // avoids the "non-empty dir on retry" problem.
+    const tmpDir = path.join(getCacheDir(), 'tsgolint', `.tmp-${version}-${crypto.randomBytes(4).toString('hex')}`);
+    // clean up any partial previous attempt
     if (fs.existsSync(sourceDir)) {
         fs.rmSync(sourceDir, { recursive: true });
     }
     try {
-        // download tsgolint source tarball
-        console.log(`Downloading tsgolint@${version}...`);
-        const tsgolintUrl = `https://github.com/oxc-project/tsgolint/archive/refs/tags/${version}.tar.gz`;
-        await downloadAndExtract(tsgolintUrl, sourceDir);
-        // download typescript-go source tarball into tsgolint/typescript-go/
-        const tsGoDir = path.join(sourceDir, 'typescript-go');
+        // download tsgolint fork tarball
+        console.log(`Downloading tsgolint@${version.slice(0, 8)}...`);
+        const tsgolintUrl = `https://github.com/remorses/tsgolint/archive/${version}.tar.gz`;
+        await downloadAndExtract(tsgolintUrl, tmpDir);
+        // download typescript-go from microsoft (base commit before patches)
+        const tsGoDir = path.join(tmpDir, 'typescript-go');
         console.log('Downloading typescript-go...');
         const tsGoUrl = `https://github.com/microsoft/typescript-go/archive/${TYPESCRIPT_GO_COMMIT}.tar.gz`;
         await downloadAndExtract(tsGoUrl, tsGoDir);
-        // apply patches to typescript-go
-        const patchesDir = path.join(sourceDir, 'patches');
+        // apply tsgolint's patches to typescript-go
+        const patchesDir = path.join(tmpDir, 'patches');
         if (fs.existsSync(patchesDir)) {
             const count = await applyPatches(patchesDir, tsGoDir);
             if (count > 0) {
@@ -93,7 +131,7 @@ export async function ensureTsgolintSource(version) {
             }
         }
         // copy internal/collections from typescript-go (required by tsgolint, done by `just init`)
-        const collectionsDir = path.join(sourceDir, 'internal', 'collections');
+        const collectionsDir = path.join(tmpDir, 'internal', 'collections');
         const tsGoCollections = path.join(tsGoDir, 'internal', 'collections');
         if (fs.existsSync(tsGoCollections)) {
             fs.mkdirSync(collectionsDir, { recursive: true });
@@ -105,13 +143,16 @@ export async function ensureTsgolintSource(version) {
             }
         }
         // write ready marker
-        fs.writeFileSync(readyMarker, new Date().toISOString());
+        fs.writeFileSync(path.join(tmpDir, '.lintcn-ready'), new Date().toISOString());
+        // atomic rename: move completed dir to final location
+        fs.mkdirSync(path.dirname(sourceDir), { recursive: true });
+        fs.renameSync(tmpDir, sourceDir);
         console.log('tsgolint source ready');
     }
     catch (err) {
-        // clean up partial download so next run starts fresh
-        if (fs.existsSync(sourceDir)) {
-            fs.rmSync(sourceDir, { recursive: true });
+        // clean up partial temp directory
+        if (fs.existsSync(tmpDir)) {
+            fs.rmSync(tmpDir, { recursive: true });
         }
         throw err;
     }

package/dist/codegen.d.ts

@@ -1,24 +1,11 @@
 import type { RuleMetadata } from './discover.ts';
-/** Generate .lintcn/go.work and .lintcn/go.mod for editor/gopls support.
- *
- *  Key learnings from testing:
- *  - Module name MUST be a child path of github.com/typescript-eslint/tsgolint
- *    so Go allows importing internal/ packages across the module boundary.
- *  - go.work must `use` both .tsgolint AND .tsgolint/typescript-go since
- *    tsgolint's own go.work (which does this) is ignored by the outer workspace.
- *  - go.mod should be minimal (no requires) — the workspace resolves everything. */
+/** Generate .lintcn/go.work and .lintcn/go.mod for editor/gopls support. */
 export declare function generateEditorGoFiles(lintcnDir: string): void;
-/** Generate build workspace in cache dir for compiling the custom binary.
- *  Instead of hardcoding the built-in rule list, we copy tsgolint's actual
- *  main.go and inject custom rule imports + entries. This way the generated
- *  code always matches the pinned tsgolint version. */
+/** Generate build workspace for compiling the custom binary. */
 export declare function generateBuildWorkspace({ buildDir, tsgolintDir, lintcnDir, rules, }: {
     buildDir: string;
     tsgolintDir: string;
     lintcnDir: string;
     rules: RuleMetadata[];
 }): void;
-/** Copy all supporting .go files from cmd/tsgolint/ into the wrapper dir.
- *  main.go is generated separately with custom rules injected. */
-export declare function copyTsgolintCmdFiles(tsgolintDir: string, wrapperDir: string): void;
 //# sourceMappingURL=codegen.d.ts.map

package/dist/codegen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codegen.d.ts","sourceRoot":"","sources":["../src/codegen.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AA2BjD;;;;;;;oFAOoF;AACpF,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAiC7D;AAED;;;uDAGuD;AACvD,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,WAAW,EACX,SAAS,EACT,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB,GAAG,IAAI,CAiDP;AA8DD;kEACkE;AAClE,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAQlF"}
+{"version":3,"file":"codegen.d.ts","sourceRoot":"","sources":["../src/codegen.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AA4BjD,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAmC7D;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,WAAW,EACX,SAAS,EACT,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB,GAAG,IAAI,CA2CP"}

package/dist/codegen.js

@@ -1,14 +1,12 @@
 // Generate Go workspace files for building a custom tsgolint binary.
-// Creates:
-//   .lintcn/go.work       — workspace for gopls (editor support)
-//   .lintcn/go.mod        — module declaration
-//   build/go.work          — build workspace in cache dir
-//   build/wrapper/go.mod   — wrapper module
-//   build/wrapper/main.go  — tsgolint main.go with custom rules appended
+// Uses internal/runner.Run() from the fork — codegen is just a static
+// main.go template + go.work with shim replaces.
+//
+// Key: module names must be child paths of github.com/typescript-eslint/tsgolint
+// so Go allows importing internal/ packages across the module boundary.
 import fs from 'node:fs';
 import path from 'node:path';
-// All replace directives needed from tsgolint's go.mod.
-// These redirect shim module paths to local directories inside the tsgolint source.
+// Shim modules that need replace directives in go.work.
 const SHIM_MODULES = [
     'ast',
     'bundled',
@@ -25,19 +23,13 @@ const SHIM_MODULES = [
     'vfs/cachedvfs',
     'vfs/osvfs',
 ];
+const TSGOLINT_MODULE = 'github.com/typescript-eslint/tsgolint';
 function generateReplaceDirectives(tsgolintRelPath) {
     return SHIM_MODULES.map((mod) => {
         return `\tgithub.com/microsoft/typescript-go/shim/${mod} => ${tsgolintRelPath}/shim/${mod}`;
     }).join('\n');
 }
-/** Generate .lintcn/go.work and .lintcn/go.mod for editor/gopls support.
- *
- *  Key learnings from testing:
- *  - Module name MUST be a child path of github.com/typescript-eslint/tsgolint
- *    so Go allows importing internal/ packages across the module boundary.
- *  - go.work must `use` both .tsgolint AND .tsgolint/typescript-go since
- *    tsgolint's own go.work (which does this) is ignored by the outer workspace.
- *  - go.mod should be minimal (no requires) — the workspace resolves everything. */
+/** Generate .lintcn/go.work and .lintcn/go.mod for editor/gopls support. */
 export function generateEditorGoFiles(lintcnDir) {
     const goWork = `go 1.26
 
@@ -51,7 +43,9 @@ replace (
 ${generateReplaceDirectives('./.tsgolint')}
 )
 `;
-    const goMod = `module github.com/typescript-eslint/tsgolint/lintcn-rules
+    // Module name is a child path of tsgolint — this is required so Go allows
+    // importing internal/ packages across the module boundary in a workspace.
+    const goMod = `module ${TSGOLINT_MODULE}/lintcn-rules
 
 go 1.26
 `;
@@ -68,10 +62,7 @@ go.sum
         fs.writeFileSync(gitignorePath, gitignore);
     }
 }
-/** Generate build workspace in cache dir for compiling the custom binary.
- *  Instead of hardcoding the built-in rule list, we copy tsgolint's actual
- *  main.go and inject custom rule imports + entries. This way the generated
- *  code always matches the pinned tsgolint version. */
+/** Generate build workspace for compiling the custom binary. */
 export function generateBuildWorkspace({ buildDir, tsgolintDir, lintcnDir, rules, }) {
     fs.mkdirSync(path.join(buildDir, 'wrapper'), { recursive: true });
     // symlink tsgolint source
@@ -86,7 +77,7 @@ export function generateBuildWorkspace({ buildDir, tsgolintDir, lintcnDir, rules
         fs.rmSync(rulesLink, { recursive: true });
     }
     fs.symlinkSync(path.resolve(lintcnDir), rulesLink);
-    // go.work — must include typescript-go submodule and use child module paths
+    // go.work
     const goWork = `go 1.26
 
 use (
@@ -101,73 +92,37 @@ ${generateReplaceDirectives('./tsgolint')}
 )
 `;
     fs.writeFileSync(path.join(buildDir, 'go.work'), goWork);
-    // wrapper/go.mod — must be child path of tsgolint for internal/ access.
-    // Minimal: no require block. The workspace resolves all dependencies.
-    // Adding explicit requires with v0.0.0 triggers Go proxy lookups that fail.
-    const wrapperGoMod = `module github.com/typescript-eslint/tsgolint/lintcn-wrapper
+    // wrapper module — child path of tsgolint for internal/ access
+    const wrapperGoMod = `module ${TSGOLINT_MODULE}/lintcn-wrapper
 
 go 1.26
 `;
     fs.writeFileSync(path.join(buildDir, 'wrapper', 'go.mod'), wrapperGoMod);
-    // copy all supporting .go files from cmd/tsgolint/ (headless, payload, etc.)
-    const wrapperDir = path.join(buildDir, 'wrapper');
-    copyTsgolintCmdFiles(tsgolintDir, wrapperDir);
-    // wrapper/main.go — copy from tsgolint and inject custom rules
-    const mainGo = generateMainGoFromSource(tsgolintDir, rules);
-    fs.writeFileSync(path.join(wrapperDir, 'main.go'), mainGo);
+    // wrapper/main.go — static template
+    const mainGo = generateMainGo(rules);
+    fs.writeFileSync(path.join(buildDir, 'wrapper', 'main.go'), mainGo);
 }
-/** Copy tsgolint's main.go and transform it to only include custom rules.
- *  Two targeted string operations on the copied source:
- *  1. Remove all /internal/rules/ import lines (built-in rule packages)
- *  2. Replace allRules body with only custom lintcn.* entries
- *  Everything else (printDiagnostic, runMain, headless) stays untouched. */
-function generateMainGoFromSource(tsgolintDir, customRules) {
-    const mainGoPath = path.join(tsgolintDir, 'cmd', 'tsgolint', 'main.go');
-    const original = fs.readFileSync(mainGoPath, 'utf-8');
-    // 1. Remove built-in rule import lines, add lintcn import
-    const lines = original.split('\n');
-    const filtered = lines.filter((line) => {
-        return !line.includes('/internal/rules/');
-    });
-    // Insert lintcn import before the first shim import (microsoft/typescript-go)
-    const lintcnImport = `\tlintcn "github.com/typescript-eslint/tsgolint/lintcn-rules"`;
-    let shimImportIndex = -1;
-    for (let i = 0; i < filtered.length; i++) {
-        if (filtered[i].includes('microsoft/typescript-go/shim')) {
-            shimImportIndex = i;
-            break;
-        }
-    }
-    if (shimImportIndex === -1) {
-        throw new Error('Failed to find shim import in tsgolint main.go. The source layout may have changed.');
-    }
-    if (customRules.length > 0) {
-        filtered.splice(shimImportIndex, 0, lintcnImport, '');
-    }
-    let mainGo = filtered.join('\n');
-    // 2. Replace allRules body with only custom entries
-    const customEntries = customRules.map((r) => {
-        return `\tlintcn.${r.varName},`;
+/** Generate main.go that imports user rules and calls internal/runner.Run(). */
+function generateMainGo(rules) {
+    const ruleEntries = rules.map((r) => {
+        return `\t\tlintcn.${r.varName},`;
     }).join('\n');
-    const allRulesPattern = /var allRules = \[]rule\.Rule\{[^}]*\}/s;
-    if (!allRulesPattern.test(mainGo)) {
-        throw new Error('Failed to find allRules slice in tsgolint main.go. The source layout may have changed.');
-    }
-    mainGo = mainGo.replace(allRulesPattern, `var allRules = []rule.Rule{\n${customEntries}\n}`);
-    // assertion: verify custom rules are present
-    if (customRules.length > 0 && !mainGo.includes(`lintcn.${customRules[0].varName}`)) {
-        throw new Error('Custom rule injection verification failed.');
-    }
-    return mainGo;
+    return `// Code generated by lintcn. DO NOT EDIT.
+package main
+
+import (
+\t"os"
+
+\t"${TSGOLINT_MODULE}/internal/rule"
+\t"${TSGOLINT_MODULE}/internal/runner"
+\tlintcn "${TSGOLINT_MODULE}/lintcn-rules"
+)
+
+func main() {
+\trules := []rule.Rule{
+${ruleEntries}
+\t}
+\tos.Exit(runner.Run(rules, os.Args[1:]))
 }
-/** Copy all supporting .go files from cmd/tsgolint/ into the wrapper dir.
- *  main.go is generated separately with custom rules injected. */
-export function copyTsgolintCmdFiles(tsgolintDir, wrapperDir) {
-    const cmdDir = path.join(tsgolintDir, 'cmd', 'tsgolint');
-    const files = fs.readdirSync(cmdDir).filter((f) => {
-        return f.endsWith('.go') && f !== 'main.go' && !f.endsWith('_test.go');
-    });
-    for (const file of files) {
-        fs.copyFileSync(path.join(cmdDir, file), path.join(wrapperDir, file));
-    }
+`;
 }

package/dist/commands/add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AA+EA,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDxD"}
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AA+EA,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2DxD"}

package/dist/commands/add.js

@@ -104,11 +104,18 @@ export async function addRule(url) {
     }
     // ensure .tsgolint source is available and generate editor support files
     const tsgolintDir = await ensureTsgolintSource(DEFAULT_TSGOLINT_VERSION);
-    // create .tsgolint symlink inside .lintcn for gopls
+    // create .tsgolint symlink inside .lintcn for gopls.
+    // Use lstatSync to detect broken symlinks (existsSync returns false for broken links)
     const tsgolintLink = path.join(lintcnDir, '.tsgolint');
-    if (!fs.existsSync(tsgolintLink)) {
-        fs.symlinkSync(tsgolintDir, tsgolintLink);
+    try {
+        fs.lstatSync(tsgolintLink);
+        // exists (possibly broken) — remove and recreate
+        fs.rmSync(tsgolintLink, { force: true });
+    }
+    catch {
+        // doesn't exist at all
     }
+    fs.symlinkSync(tsgolintDir, tsgolintLink);
     generateEditorGoFiles(lintcnDir);
     console.log('Editor support files generated (go.work, go.mod)');
 }

package/dist/commands/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../src/commands/lint.ts"],"names":[],"mappings":"AAuBA,wBAAsB,WAAW,CAAC,EAChC,OAAO,EACP,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiDlB;AAED,wBAAsB,IAAI,CAAC,EACzB,OAAO,EACP,eAAe,EACf,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../src/commands/lint.ts"],"names":[],"mappings":"AAuBA,wBAAsB,WAAW,CAAC,EAChC,OAAO,EACP,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkDlB;AAED,wBAAsB,IAAI,CAAC,EACzB,OAAO,EACP,eAAe,EACf,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB"}

package/dist/commands/lint.js

@@ -5,7 +5,7 @@ import { spawn } from 'node:child_process';
 import { requireLintcnDir } from "../paths.js";
 import { discoverRules } from "../discover.js";
 import { generateBuildWorkspace } from "../codegen.js";
-import { ensureTsgolintSource, cachedBinaryExists, getBinaryPath, getBuildDir, getBinDir } from "../cache.js";
+import { ensureTsgolintSource, validateVersion, cachedBinaryExists, getBinaryPath, getBuildDir, getBinDir } from "../cache.js";
 import { computeContentHash } from "../hash.js";
 import { execAsync } from "../exec.js";
 async function checkGoInstalled() {
@@ -13,18 +13,19 @@ async function checkGoInstalled() {
         await execAsync('go', ['version']);
     }
     catch {
-        throw new Error('Go 1.26+ is required to build rules.\n' +
+        throw new Error('Go is required to build rules.\n' +
             'Install from https://go.dev/dl/');
     }
 }
 export async function buildBinary({ rebuild, tsgolintVersion, }) {
+    validateVersion(tsgolintVersion);
     await checkGoInstalled();
     const lintcnDir = requireLintcnDir();
     const rules = discoverRules(lintcnDir);
     if (rules.length === 0) {
         throw new Error('No rules found in .lintcn/. Run `lintcn add <url>` to add rules.');
     }
-    console.log(`Found ${rules.length} custom rule${rules.length === 1 ? '' : 's'} (tsgolint ${tsgolintVersion})`);
+    console.log(`Found ${rules.length} custom rule${rules.length === 1 ? '' : 's'} (tsgolint ${tsgolintVersion.slice(0, 8)})`);
     // ensure tsgolint source
     const tsgolintDir = await ensureTsgolintSource(tsgolintVersion);
     // compute content hash
@@ -37,8 +38,8 @@ export async function buildBinary({ rebuild, tsgolintVersion, }) {
         console.log('Using cached binary');
         return getBinaryPath(contentHash);
     }
-    // generate build workspace
-    const buildDir = getBuildDir();
+    // generate build workspace (per-hash dir to avoid races between concurrent processes)
+    const buildDir = getBuildDir(contentHash);
     console.log('Generating build workspace...');
     generateBuildWorkspace({
         buildDir,

package/dist/index.d.ts

@@ -4,6 +4,6 @@ export { addRule } from './commands/add.ts';
 export { lint, buildBinary } from './commands/lint.ts';
 export { listRules } from './commands/list.ts';
 export { removeRule } from './commands/remove.ts';
-export { DEFAULT_TSGOLINT_VERSION } from './cache.ts';
+export { DEFAULT_TSGOLINT_VERSION, validateVersion } from './cache.ts';
 export { findLintcnDir, getLintcnDir, requireLintcnDir } from './paths.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1E,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1E,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -3,5 +3,5 @@ export { addRule } from "./commands/add.js";
 export { lint, buildBinary } from "./commands/lint.js";
 export { listRules } from "./commands/list.js";
 export { removeRule } from "./commands/remove.js";
-export { DEFAULT_TSGOLINT_VERSION } from "./cache.js";
+export { DEFAULT_TSGOLINT_VERSION, validateVersion } from "./cache.js";
 export { findLintcnDir, getLintcnDir, requireLintcnDir } from "./paths.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lintcn",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "type": "module",
   "description": "The shadcn for type-aware TypeScript lint rules. Browse, pick, and copy rules into your project.",
   "bin": "dist/cli.js",
@@ -51,11 +51,13 @@
   "license": "MIT",
   "devDependencies": {
     "@types/node": "^22.0.0",
+    "@types/tar": "^7.0.87",
     "typescript": "5.8.2"
   },
   "dependencies": {
     "find-up": "^8.0.0",
-    "goke": "^6.3.0"
+    "goke": "^6.3.0",
+    "tar": "^7.5.12"
   },
   "scripts": {
     "build": "rm -rf dist *.tsbuildinfo && tsc && chmod +x dist/cli.js"

package/src/cache.ts

@@ -1,28 +1,43 @@
 // Manage cached tsgolint source and compiled binaries.
-// Downloads tsgolint + typescript-go as tarballs from GitHub (no git required),
-// applies patches with `patch -p1`, and copies internal/collections.
+// Downloads tsgolint fork + typescript-go as tarballs from GitHub,
+// applies tsgolint's patches to typescript-go, and copies collections.
 //
 // Cache layout:
 //   ~/.cache/lintcn/tsgolint/<version>/   — extracted source (read-only)
+//   ~/.cache/lintcn/build/<content-hash>/ — per-hash build workspace (no race)
 //   ~/.cache/lintcn/bin/<content-hash>    — compiled binaries
 
 import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
+import crypto from 'node:crypto'
 import { pipeline } from 'node:stream/promises'
-import { createGunzip } from 'node:zlib'
+import { extract } from 'tar'
 import { execAsync } from './exec.ts'
 
-// Pinned tsgolint version — updated with each lintcn release.
-// This ensures reproducible builds: every user on the same lintcn version
-// compiles rules against the same tsgolint API. Changing this is a conscious
-// decision — tsgolint API changes can break user rules.
-export const DEFAULT_TSGOLINT_VERSION = 'v0.9.2'
+// Pinned tsgolint fork commit — updated with each lintcn release.
+// Uses remorses/tsgolint fork which adds internal/runner.Run().
+// Only 1 commit on top of upstream — zero modifications to existing files.
+export const DEFAULT_TSGOLINT_VERSION = 'e945641eabec22993eda3e7c101692e80417e0ea'
 
-// Pinned typescript-go commit that tsgolint v0.9.2 depends on.
-// Found via `git ls-tree HEAD typescript-go` in the tsgolint repo.
+// Pinned typescript-go base commit from microsoft/typescript-go (before patches).
+// Patches from tsgolint/patches/ are applied on top during setup.
 // Must be updated when DEFAULT_TSGOLINT_VERSION changes.
-const TYPESCRIPT_GO_COMMIT = '2437fa43e85103d2a18e8e41e1a2a994d0708ccf'
+const TYPESCRIPT_GO_COMMIT = '1b7eabe122e1575a0df9c77eccdf4e063c623224'
+
+// Strict pattern for version strings — prevents path traversal via ../
+const VERSION_PATTERN = /^[a-zA-Z0-9._-]+$/
+
+/** Validate version string to prevent path traversal attacks.
+ *  Only allows alphanumeric chars, dots, underscores, and hyphens. */
+export function validateVersion(version: string): void {
+  if (!VERSION_PATTERN.test(version)) {
+    throw new Error(
+      `Invalid tsgolint version "${version}". ` +
+      'Version must only contain alphanumeric characters, dots, underscores, and hyphens.',
+    )
+  }
+}
 
 export function getCacheDir(): string {
   return path.join(os.homedir(), '.cache', 'lintcn')
@@ -40,29 +55,50 @@ export function getBinaryPath(contentHash: string): string {
   return path.join(getBinDir(), contentHash)
 }
 
-export function getBuildDir(): string {
-  return path.join(getCacheDir(), 'build')
+/** Per-hash build directory to avoid races between concurrent lintcn processes. */
+export function getBuildDir(contentHash: string): string {
+  return path.join(getCacheDir(), 'build', contentHash)
 }
 
 /** Download a tarball from URL and extract it to targetDir.
+ *  Uses the `tar` npm package for cross-platform support (no shell tar needed).
  *  GitHub tarballs have a top-level directory like `repo-ref/`,
  *  so we strip the first path component during extraction. */
 async function downloadAndExtract(url: string, targetDir: string): Promise<void> {
-  const response = await fetch(url)
+  const controller = new AbortController()
+  const timeout = setTimeout(() => {
+    controller.abort(new Error(`Download timed out after 120s: ${url}`))
+  }, 120_000)
+
+  let response: Response
+  try {
+    response = await fetch(url, { signal: controller.signal })
+  } finally {
+    clearTimeout(timeout)
+  }
+
   if (!response.ok || !response.body) {
     throw new Error(`Failed to download ${url}: ${response.status} ${response.statusText}`)
   }
 
-  fs.mkdirSync(targetDir, { recursive: true })
-
-  // pipe through gunzip, then extract with tar (strip top-level directory)
-  const tmpTarGz = path.join(os.tmpdir(), `lintcn-${Date.now()}.tar.gz`)
-  const fileStream = fs.createWriteStream(tmpTarGz)
-  // @ts-ignore ReadableStream vs NodeJS.ReadableStream mismatch
-  await pipeline(response.body, fileStream)
-
-  await execAsync('tar', ['xzf', tmpTarGz, '--strip-components=1', '-C', targetDir])
-  fs.rmSync(tmpTarGz, { force: true })
+  // download to temp file with random suffix to avoid collisions
+  const tmpTarGz = path.join(os.tmpdir(), `lintcn-${crypto.randomBytes(8).toString('hex')}.tar.gz`)
+  try {
+    const fileStream = fs.createWriteStream(tmpTarGz)
+    // @ts-ignore ReadableStream vs NodeJS.ReadableStream mismatch
+    await pipeline(response.body, fileStream)
+
+    // extract with npm tar package (cross-platform, no shell tar needed)
+    fs.mkdirSync(targetDir, { recursive: true })
+    await extract({
+      file: tmpTarGz,
+      cwd: targetDir,
+      strip: 1,
+    })
+  } finally {
+    // always clean up temp file
+    fs.rmSync(tmpTarGz, { force: true })
+  }
 }
 
 /** Apply git-format patches using `patch -p1` (no git required).
@@ -74,7 +110,6 @@ async function applyPatches(patchesDir: string, targetDir: string): Promise<numb
 
   for (const patchFile of patches) {
     const patchPath = path.join(patchesDir, patchFile)
-    // --batch silences interactive prompts, -f forces application
     await execAsync('patch', ['-p1', '--batch', '-i', patchPath], { cwd: targetDir })
   }
 
@@ -82,6 +117,8 @@ async function applyPatches(patchesDir: string, targetDir: string): Promise<numb
 }
 
 export async function ensureTsgolintSource(version: string): Promise<string> {
+  validateVersion(version)
+
   const sourceDir = getTsgolintSourceDir(version)
   const readyMarker = path.join(sourceDir, '.lintcn-ready')
 
@@ -89,25 +126,30 @@ export async function ensureTsgolintSource(version: string): Promise<string> {
     return sourceDir
   }
 
-  // clean up any partial previous attempt so we start fresh
+  // Use a temp directory for the download, then atomic rename on success.
+  // This prevents concurrent processes from seeing partial state, and
+  // avoids the "non-empty dir on retry" problem.
+  const tmpDir = path.join(getCacheDir(), 'tsgolint', `.tmp-${version}-${crypto.randomBytes(4).toString('hex')}`)
+
+  // clean up any partial previous attempt
   if (fs.existsSync(sourceDir)) {
     fs.rmSync(sourceDir, { recursive: true })
   }
 
   try {
-    // download tsgolint source tarball
-    console.log(`Downloading tsgolint@${version}...`)
-    const tsgolintUrl = `https://github.com/oxc-project/tsgolint/archive/refs/tags/${version}.tar.gz`
-    await downloadAndExtract(tsgolintUrl, sourceDir)
+    // download tsgolint fork tarball
+    console.log(`Downloading tsgolint@${version.slice(0, 8)}...`)
+    const tsgolintUrl = `https://github.com/remorses/tsgolint/archive/${version}.tar.gz`
+    await downloadAndExtract(tsgolintUrl, tmpDir)
 
-    // download typescript-go source tarball into tsgolint/typescript-go/
-    const tsGoDir = path.join(sourceDir, 'typescript-go')
+    // download typescript-go from microsoft (base commit before patches)
+    const tsGoDir = path.join(tmpDir, 'typescript-go')
     console.log('Downloading typescript-go...')
     const tsGoUrl = `https://github.com/microsoft/typescript-go/archive/${TYPESCRIPT_GO_COMMIT}.tar.gz`
     await downloadAndExtract(tsGoUrl, tsGoDir)
 
-    // apply patches to typescript-go
-    const patchesDir = path.join(sourceDir, 'patches')
+    // apply tsgolint's patches to typescript-go
+    const patchesDir = path.join(tmpDir, 'patches')
     if (fs.existsSync(patchesDir)) {
       const count = await applyPatches(patchesDir, tsGoDir)
       if (count > 0) {
@@ -116,7 +158,7 @@ export async function ensureTsgolintSource(version: string): Promise<string> {
     }
 
     // copy internal/collections from typescript-go (required by tsgolint, done by `just init`)
-    const collectionsDir = path.join(sourceDir, 'internal', 'collections')
+    const collectionsDir = path.join(tmpDir, 'internal', 'collections')
     const tsGoCollections = path.join(tsGoDir, 'internal', 'collections')
     if (fs.existsSync(tsGoCollections)) {
       fs.mkdirSync(collectionsDir, { recursive: true })
@@ -129,12 +171,17 @@ export async function ensureTsgolintSource(version: string): Promise<string> {
     }
 
     // write ready marker
-    fs.writeFileSync(readyMarker, new Date().toISOString())
+    fs.writeFileSync(path.join(tmpDir, '.lintcn-ready'), new Date().toISOString())
+
+    // atomic rename: move completed dir to final location
+    fs.mkdirSync(path.dirname(sourceDir), { recursive: true })
+    fs.renameSync(tmpDir, sourceDir)
+
     console.log('tsgolint source ready')
   } catch (err) {
-    // clean up partial download so next run starts fresh
-    if (fs.existsSync(sourceDir)) {
-      fs.rmSync(sourceDir, { recursive: true })
+    // clean up partial temp directory
+    if (fs.existsSync(tmpDir)) {
+      fs.rmSync(tmpDir, { recursive: true })
     }
     throw err
   }

package/src/codegen.ts

@@ -1,17 +1,15 @@
 // Generate Go workspace files for building a custom tsgolint binary.
-// Creates:
-//   .lintcn/go.work       — workspace for gopls (editor support)
-//   .lintcn/go.mod        — module declaration
-//   build/go.work          — build workspace in cache dir
-//   build/wrapper/go.mod   — wrapper module
-//   build/wrapper/main.go  — tsgolint main.go with custom rules appended
+// Uses internal/runner.Run() from the fork — codegen is just a static
+// main.go template + go.work with shim replaces.
+//
+// Key: module names must be child paths of github.com/typescript-eslint/tsgolint
+// so Go allows importing internal/ packages across the module boundary.
 
 import fs from 'node:fs'
 import path from 'node:path'
 import type { RuleMetadata } from './discover.ts'
 
-// All replace directives needed from tsgolint's go.mod.
-// These redirect shim module paths to local directories inside the tsgolint source.
+// Shim modules that need replace directives in go.work.
 const SHIM_MODULES = [
   'ast',
   'bundled',
@@ -29,20 +27,15 @@ const SHIM_MODULES = [
   'vfs/osvfs',
 ] as const
 
+const TSGOLINT_MODULE = 'github.com/typescript-eslint/tsgolint'
+
 function generateReplaceDirectives(tsgolintRelPath: string): string {
   return SHIM_MODULES.map((mod) => {
     return `\tgithub.com/microsoft/typescript-go/shim/${mod} => ${tsgolintRelPath}/shim/${mod}`
   }).join('\n')
 }
 
-/** Generate .lintcn/go.work and .lintcn/go.mod for editor/gopls support.
- *
- *  Key learnings from testing:
- *  - Module name MUST be a child path of github.com/typescript-eslint/tsgolint
- *    so Go allows importing internal/ packages across the module boundary.
- *  - go.work must `use` both .tsgolint AND .tsgolint/typescript-go since
- *    tsgolint's own go.work (which does this) is ignored by the outer workspace.
- *  - go.mod should be minimal (no requires) — the workspace resolves everything. */
+/** Generate .lintcn/go.work and .lintcn/go.mod for editor/gopls support. */
 export function generateEditorGoFiles(lintcnDir: string): void {
   const goWork = `go 1.26
 
@@ -57,7 +50,9 @@ ${generateReplaceDirectives('./.tsgolint')}
 )
 `
 
-  const goMod = `module github.com/typescript-eslint/tsgolint/lintcn-rules
+  // Module name is a child path of tsgolint — this is required so Go allows
+  // importing internal/ packages across the module boundary in a workspace.
+  const goMod = `module ${TSGOLINT_MODULE}/lintcn-rules
 
 go 1.26
 `
@@ -78,10 +73,7 @@ go.sum
   }
 }
 
-/** Generate build workspace in cache dir for compiling the custom binary.
- *  Instead of hardcoding the built-in rule list, we copy tsgolint's actual
- *  main.go and inject custom rule imports + entries. This way the generated
- *  code always matches the pinned tsgolint version. */
+/** Generate build workspace for compiling the custom binary. */
 export function generateBuildWorkspace({
   buildDir,
   tsgolintDir,
@@ -109,7 +101,7 @@ export function generateBuildWorkspace({
   }
   fs.symlinkSync(path.resolve(lintcnDir), rulesLink)
 
-  // go.work — must include typescript-go submodule and use child module paths
+  // go.work
   const goWork = `go 1.26
 
 use (
@@ -125,92 +117,40 @@ ${generateReplaceDirectives('./tsgolint')}
 `
   fs.writeFileSync(path.join(buildDir, 'go.work'), goWork)
 
-  // wrapper/go.mod — must be child path of tsgolint for internal/ access.
-  // Minimal: no require block. The workspace resolves all dependencies.
-  // Adding explicit requires with v0.0.0 triggers Go proxy lookups that fail.
-  const wrapperGoMod = `module github.com/typescript-eslint/tsgolint/lintcn-wrapper
+  // wrapper module — child path of tsgolint for internal/ access
+  const wrapperGoMod = `module ${TSGOLINT_MODULE}/lintcn-wrapper
 
 go 1.26
 `
   fs.writeFileSync(path.join(buildDir, 'wrapper', 'go.mod'), wrapperGoMod)
 
-  // copy all supporting .go files from cmd/tsgolint/ (headless, payload, etc.)
-  const wrapperDir = path.join(buildDir, 'wrapper')
-  copyTsgolintCmdFiles(tsgolintDir, wrapperDir)
-
-  // wrapper/main.go — copy from tsgolint and inject custom rules
-  const mainGo = generateMainGoFromSource(tsgolintDir, rules)
-  fs.writeFileSync(path.join(wrapperDir, 'main.go'), mainGo)
+  // wrapper/main.go — static template
+  const mainGo = generateMainGo(rules)
+  fs.writeFileSync(path.join(buildDir, 'wrapper', 'main.go'), mainGo)
 }
 
-/** Copy tsgolint's main.go and transform it to only include custom rules.
- *  Two targeted string operations on the copied source:
- *  1. Remove all /internal/rules/ import lines (built-in rule packages)
- *  2. Replace allRules body with only custom lintcn.* entries
- *  Everything else (printDiagnostic, runMain, headless) stays untouched. */
-function generateMainGoFromSource(tsgolintDir: string, customRules: RuleMetadata[]): string {
-  const mainGoPath = path.join(tsgolintDir, 'cmd', 'tsgolint', 'main.go')
-  const original = fs.readFileSync(mainGoPath, 'utf-8')
-
-  // 1. Remove built-in rule import lines, add lintcn import
-  const lines = original.split('\n')
-  const filtered = lines.filter((line) => {
-    return !line.includes('/internal/rules/')
-  })
-
-  // Insert lintcn import before the first shim import (microsoft/typescript-go)
-  const lintcnImport = `\tlintcn "github.com/typescript-eslint/tsgolint/lintcn-rules"`
-  let shimImportIndex = -1
-  for (let i = 0; i < filtered.length; i++) {
-    if (filtered[i].includes('microsoft/typescript-go/shim')) {
-      shimImportIndex = i
-      break
-    }
-  }
-  if (shimImportIndex === -1) {
-    throw new Error(
-      'Failed to find shim import in tsgolint main.go. The source layout may have changed.',
-    )
-  }
-  if (customRules.length > 0) {
-    filtered.splice(shimImportIndex, 0, lintcnImport, '')
-  }
-
-  let mainGo = filtered.join('\n')
-
-  // 2. Replace allRules body with only custom entries
-  const customEntries = customRules.map((r) => {
-    return `\tlintcn.${r.varName},`
+/** Generate main.go that imports user rules and calls internal/runner.Run(). */
+function generateMainGo(rules: RuleMetadata[]): string {
+  const ruleEntries = rules.map((r) => {
+    return `\t\tlintcn.${r.varName},`
   }).join('\n')
 
-  const allRulesPattern = /var allRules = \[]rule\.Rule\{[^}]*\}/s
-  if (!allRulesPattern.test(mainGo)) {
-    throw new Error(
-      'Failed to find allRules slice in tsgolint main.go. The source layout may have changed.',
-    )
-  }
+  return `// Code generated by lintcn. DO NOT EDIT.
+package main
 
-  mainGo = mainGo.replace(
-    allRulesPattern,
-    `var allRules = []rule.Rule{\n${customEntries}\n}`,
-  )
+import (
+\t"os"
 
-  // assertion: verify custom rules are present
-  if (customRules.length > 0 && !mainGo.includes(`lintcn.${customRules[0].varName}`)) {
-    throw new Error('Custom rule injection verification failed.')
-  }
+\t"${TSGOLINT_MODULE}/internal/rule"
+\t"${TSGOLINT_MODULE}/internal/runner"
+\tlintcn "${TSGOLINT_MODULE}/lintcn-rules"
+)
 
-  return mainGo
+func main() {
+\trules := []rule.Rule{
+${ruleEntries}
+\t}
+\tos.Exit(runner.Run(rules, os.Args[1:]))
 }
-
-/** Copy all supporting .go files from cmd/tsgolint/ into the wrapper dir.
- *  main.go is generated separately with custom rules injected. */
-export function copyTsgolintCmdFiles(tsgolintDir: string, wrapperDir: string): void {
-  const cmdDir = path.join(tsgolintDir, 'cmd', 'tsgolint')
-  const files = fs.readdirSync(cmdDir).filter((f) => {
-    return f.endsWith('.go') && f !== 'main.go' && !f.endsWith('_test.go')
-  })
-  for (const file of files) {
-    fs.copyFileSync(path.join(cmdDir, file), path.join(wrapperDir, file))
-  }
+`
 }

package/src/commands/add.ts

@@ -122,11 +122,17 @@ export async function addRule(url: string): Promise<void> {
   // ensure .tsgolint source is available and generate editor support files
   const tsgolintDir = await ensureTsgolintSource(DEFAULT_TSGOLINT_VERSION)
 
-  // create .tsgolint symlink inside .lintcn for gopls
+  // create .tsgolint symlink inside .lintcn for gopls.
+  // Use lstatSync to detect broken symlinks (existsSync returns false for broken links)
   const tsgolintLink = path.join(lintcnDir, '.tsgolint')
-  if (!fs.existsSync(tsgolintLink)) {
-    fs.symlinkSync(tsgolintDir, tsgolintLink)
+  try {
+    fs.lstatSync(tsgolintLink)
+    // exists (possibly broken) — remove and recreate
+    fs.rmSync(tsgolintLink, { force: true })
+  } catch {
+    // doesn't exist at all
   }
+  fs.symlinkSync(tsgolintDir, tsgolintLink)
 
   generateEditorGoFiles(lintcnDir)
   console.log('Editor support files generated (go.work, go.mod)')

package/src/commands/lint.ts

@@ -6,7 +6,7 @@ import { spawn } from 'node:child_process'
 import { requireLintcnDir } from '../paths.ts'
 import { discoverRules } from '../discover.ts'
 import { generateBuildWorkspace } from '../codegen.ts'
-import { ensureTsgolintSource, DEFAULT_TSGOLINT_VERSION, cachedBinaryExists, getBinaryPath, getBuildDir, getBinDir } from '../cache.ts'
+import { ensureTsgolintSource, validateVersion, cachedBinaryExists, getBinaryPath, getBuildDir, getBinDir } from '../cache.ts'
 import { computeContentHash } from '../hash.ts'
 import { execAsync } from '../exec.ts'
 
@@ -15,7 +15,7 @@ async function checkGoInstalled(): Promise<void> {
     await execAsync('go', ['version'])
   } catch {
     throw new Error(
-      'Go 1.26+ is required to build rules.\n' +
+      'Go is required to build rules.\n' +
       'Install from https://go.dev/dl/',
     )
   }
@@ -28,6 +28,7 @@ export async function buildBinary({
   rebuild: boolean
   tsgolintVersion: string
 }): Promise<string> {
+  validateVersion(tsgolintVersion)
   await checkGoInstalled()
 
   const lintcnDir = requireLintcnDir()
@@ -37,7 +38,7 @@ export async function buildBinary({
     throw new Error('No rules found in .lintcn/. Run `lintcn add <url>` to add rules.')
   }
 
-  console.log(`Found ${rules.length} custom rule${rules.length === 1 ? '' : 's'} (tsgolint ${tsgolintVersion})`)
+  console.log(`Found ${rules.length} custom rule${rules.length === 1 ? '' : 's'} (tsgolint ${tsgolintVersion.slice(0, 8)})`)
 
   // ensure tsgolint source
   const tsgolintDir = await ensureTsgolintSource(tsgolintVersion)
@@ -54,8 +55,8 @@ export async function buildBinary({
     return getBinaryPath(contentHash)
   }
 
-  // generate build workspace
-  const buildDir = getBuildDir()
+  // generate build workspace (per-hash dir to avoid races between concurrent processes)
+  const buildDir = getBuildDir(contentHash)
   console.log('Generating build workspace...')
   generateBuildWorkspace({
     buildDir,

package/src/index.ts

@@ -4,5 +4,5 @@ export { addRule } from './commands/add.ts'
 export { lint, buildBinary } from './commands/lint.ts'
 export { listRules } from './commands/list.ts'
 export { removeRule } from './commands/remove.ts'
-export { DEFAULT_TSGOLINT_VERSION } from './cache.ts'
+export { DEFAULT_TSGOLINT_VERSION, validateVersion } from './cache.ts'
 export { findLintcnDir, getLintcnDir, requireLintcnDir } from './paths.ts'

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2025 Kimaki
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.