lintcn 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,14 +1,18 @@
-## 0.4.0
+## 0.5.0
 
-1. **Simpler rule imports** — rules now import from `pkg/rule`, `pkg/utils`, etc. instead of `internal/rule`. The `internal/` child-module-path hack is gone. Your `.go` files use clean import paths:
-   ```go
-   import (
-       "github.com/typescript-eslint/tsgolint/pkg/rule"
-       "github.com/typescript-eslint/tsgolint/pkg/utils"
-   )
-   ```
+1. **Security fix — path traversal in `--tsgolint-version`** — the version flag is now validated against a strict pattern. Previously a value like `../../etc` could escape the cache directory.
+
+2. **Fixed intermittent failures with concurrent `lintcn lint` runs** — build workspaces are now per-content-hash instead of shared. Two processes running simultaneously no longer corrupt each other's build.
+
+3. **Cross-platform tar extraction** — replaced shell `tar` command with the npm `tar` package. Works on Windows without needing system tar.
 
-2. **Simpler codegen** — uses a tsgolint fork with `pkg/runner.Run()`, eliminating all regex surgery on main.go. The generated binary entry point is a 15-line template instead of a patched copy of tsgolint's main.go.
+4. **No more `patch` command required** — tsgolint downloads now use a fork with a clean `internal/runner.Run()` entry point. Zero modifications to existing tsgolint files; upstream syncs will never conflict.
+
+5. **Downloads no longer hang** — 120s timeout on all GitHub tarball downloads.
+
+6. **Fixed broken `.tsgolint` symlink** — `lintcn add` now correctly detects and recreates broken symlinks.
+
+## 0.4.0
 
 ## 0.3.0
 

package/README.md

@@ -49,10 +49,12 @@ my-project/
 When you run `npx lintcn lint`, the CLI:
 
 1. Scans `.lintcn/*.go` for rule definitions
-2. Generates a Go workspace with all 50+ built-in tsgolint rules + your custom rules
+2. Generates a Go workspace with your custom rules
 3. Compiles a custom binary (cached — rebuilds only when rules change)
 4. Runs the binary against your project
 
+You can run `lintcn lint` from any subdirectory — it walks up to find `.lintcn/` and lints the cwd project.
+
 ## Writing a rule
 
 Every rule is a Go file with `package lintcn` that exports a `rule.Rule` variable.
@@ -134,7 +136,7 @@ void getUser("id")
 ```json
 {
   "devDependencies": {
-    "lintcn": "0.1.0"
+    "lintcn": "0.4.0"
   }
 }
 ```
@@ -154,8 +156,7 @@ npx lintcn lint --tsgolint-version v0.10.0
 ## Prerequisites
 
 - **Node.js** — for the CLI
-- **Go 1.26+** — for compiling rules (`go.dev/dl`)
-- **Git** — for cloning tsgolint source on first build
+- **Go** — for compiling rules (`go.dev/dl`)
 
 Go is only needed for `lintcn lint` / `lintcn build`. Adding and listing rules works without Go.
 

package/dist/cache.d.ts

@@ -1,9 +1,13 @@
-export declare const DEFAULT_TSGOLINT_VERSION = "a93604379da2631b70332a65bc47eb5ced689a3b";
+export declare const DEFAULT_TSGOLINT_VERSION = "e945641eabec22993eda3e7c101692e80417e0ea";
+/** Validate version string to prevent path traversal attacks.
+ *  Only allows alphanumeric chars, dots, underscores, and hyphens. */
+export declare function validateVersion(version: string): void;
 export declare function getCacheDir(): string;
 export declare function getTsgolintSourceDir(version: string): string;
 export declare function getBinDir(): string;
 export declare function getBinaryPath(contentHash: string): string;
-export declare function getBuildDir(): string;
+/** Per-hash build directory to avoid races between concurrent lintcn processes. */
+export declare function getBuildDir(contentHash: string): string;
 export declare function ensureTsgolintSource(version: string): Promise<string>;
 export declare function cachedBinaryExists(contentHash: string): boolean;
 //# sourceMappingURL=cache.d.ts.map

package/dist/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,wBAAwB,6CAA6C,CAAA;AAQlF,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAqCD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2D3E;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAQ/D"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,wBAAwB,6CAA6C,CAAA;AAUlF;sEACsE;AACtE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAOrD;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEvD;AA0DD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuE3E;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAQ/D"}

package/dist/cache.js

@@ -4,21 +4,33 @@
 //
 // Cache layout:
 //   ~/.cache/lintcn/tsgolint/<version>/   — extracted source (read-only)
+//   ~/.cache/lintcn/build/<content-hash>/ — per-hash build workspace (no race)
 //   ~/.cache/lintcn/bin/<content-hash>    — compiled binaries
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import { pipeline } from 'node:stream/promises';
+import { extract } from 'tar';
 import { execAsync } from "./exec.js";
 // Pinned tsgolint fork commit — updated with each lintcn release.
-// Uses remorses/tsgolint fork which exposes pkg/runner.Run() and
-// moves internal/ packages to pkg/ for clean external imports.
-export const DEFAULT_TSGOLINT_VERSION = 'a93604379da2631b70332a65bc47eb5ced689a3b';
+// Uses remorses/tsgolint fork which adds internal/runner.Run().
+// Only 1 commit on top of upstream — zero modifications to existing files.
+export const DEFAULT_TSGOLINT_VERSION = 'e945641eabec22993eda3e7c101692e80417e0ea';
 // Pinned typescript-go base commit from microsoft/typescript-go (before patches).
 // Patches from tsgolint/patches/ are applied on top during setup.
-// This is the upstream commit the tsgolint submodule was forked from.
 // Must be updated when DEFAULT_TSGOLINT_VERSION changes.
 const TYPESCRIPT_GO_COMMIT = '1b7eabe122e1575a0df9c77eccdf4e063c623224';
+// Strict pattern for version strings — prevents path traversal via ../
+const VERSION_PATTERN = /^[a-zA-Z0-9._-]+$/;
+/** Validate version string to prevent path traversal attacks.
+ *  Only allows alphanumeric chars, dots, underscores, and hyphens. */
+export function validateVersion(version) {
+    if (!VERSION_PATTERN.test(version)) {
+        throw new Error(`Invalid tsgolint version "${version}". ` +
+            'Version must only contain alphanumeric characters, dots, underscores, and hyphens.');
+    }
+}
 export function getCacheDir() {
     return path.join(os.homedir(), '.cache', 'lintcn');
 }
@@ -31,24 +43,47 @@ export function getBinDir() {
 export function getBinaryPath(contentHash) {
     return path.join(getBinDir(), contentHash);
 }
-export function getBuildDir() {
-    return path.join(getCacheDir(), 'build');
+/** Per-hash build directory to avoid races between concurrent lintcn processes. */
+export function getBuildDir(contentHash) {
+    return path.join(getCacheDir(), 'build', contentHash);
 }
 /** Download a tarball from URL and extract it to targetDir.
+ *  Uses the `tar` npm package for cross-platform support (no shell tar needed).
  *  GitHub tarballs have a top-level directory like `repo-ref/`,
  *  so we strip the first path component during extraction. */
 async function downloadAndExtract(url, targetDir) {
-    const response = await fetch(url);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => {
+        controller.abort(new Error(`Download timed out after 120s: ${url}`));
+    }, 120_000);
+    let response;
+    try {
+        response = await fetch(url, { signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
     if (!response.ok || !response.body) {
         throw new Error(`Failed to download ${url}: ${response.status} ${response.statusText}`);
     }
-    fs.mkdirSync(targetDir, { recursive: true });
-    const tmpTarGz = path.join(os.tmpdir(), `lintcn-${Date.now()}.tar.gz`);
-    const fileStream = fs.createWriteStream(tmpTarGz);
-    // @ts-ignore ReadableStream vs NodeJS.ReadableStream mismatch
-    await pipeline(response.body, fileStream);
-    await execAsync('tar', ['xzf', tmpTarGz, '--strip-components=1', '-C', targetDir]);
-    fs.rmSync(tmpTarGz, { force: true });
+    // download to temp file with random suffix to avoid collisions
+    const tmpTarGz = path.join(os.tmpdir(), `lintcn-${crypto.randomBytes(8).toString('hex')}.tar.gz`);
+    try {
+        const fileStream = fs.createWriteStream(tmpTarGz);
+        // @ts-ignore ReadableStream vs NodeJS.ReadableStream mismatch
+        await pipeline(response.body, fileStream);
+        // extract with npm tar package (cross-platform, no shell tar needed)
+        fs.mkdirSync(targetDir, { recursive: true });
+        await extract({
+            file: tmpTarGz,
+            cwd: targetDir,
+            strip: 1,
+        });
+    }
+    finally {
+        // always clean up temp file
+        fs.rmSync(tmpTarGz, { force: true });
+    }
 }
 /** Apply git-format patches using `patch -p1` (no git required).
  *  Patches are standard unified diff format, `patch` ignores the git metadata. */
@@ -63,12 +98,17 @@ async function applyPatches(patchesDir, targetDir) {
     return patches.length;
 }
 export async function ensureTsgolintSource(version) {
+    validateVersion(version);
     const sourceDir = getTsgolintSourceDir(version);
     const readyMarker = path.join(sourceDir, '.lintcn-ready');
     if (fs.existsSync(readyMarker)) {
         return sourceDir;
     }
-    // clean up any partial previous attempt so we start fresh
+    // Use a temp directory for the download, then atomic rename on success.
+    // This prevents concurrent processes from seeing partial state, and
+    // avoids the "non-empty dir on retry" problem.
+    const tmpDir = path.join(getCacheDir(), 'tsgolint', `.tmp-${version}-${crypto.randomBytes(4).toString('hex')}`);
+    // clean up any partial previous attempt
     if (fs.existsSync(sourceDir)) {
         fs.rmSync(sourceDir, { recursive: true });
     }
@@ -76,14 +116,14 @@ export async function ensureTsgolintSource(version) {
         // download tsgolint fork tarball
         console.log(`Downloading tsgolint@${version.slice(0, 8)}...`);
         const tsgolintUrl = `https://github.com/remorses/tsgolint/archive/${version}.tar.gz`;
-        await downloadAndExtract(tsgolintUrl, sourceDir);
+        await downloadAndExtract(tsgolintUrl, tmpDir);
         // download typescript-go from microsoft (base commit before patches)
-        const tsGoDir = path.join(sourceDir, 'typescript-go');
+        const tsGoDir = path.join(tmpDir, 'typescript-go');
         console.log('Downloading typescript-go...');
         const tsGoUrl = `https://github.com/microsoft/typescript-go/archive/${TYPESCRIPT_GO_COMMIT}.tar.gz`;
         await downloadAndExtract(tsGoUrl, tsGoDir);
         // apply tsgolint's patches to typescript-go
-        const patchesDir = path.join(sourceDir, 'patches');
+        const patchesDir = path.join(tmpDir, 'patches');
         if (fs.existsSync(patchesDir)) {
             const count = await applyPatches(patchesDir, tsGoDir);
             if (count > 0) {
@@ -91,7 +131,7 @@ export async function ensureTsgolintSource(version) {
             }
         }
         // copy internal/collections from typescript-go (required by tsgolint, done by `just init`)
-        const collectionsDir = path.join(sourceDir, 'internal', 'collections');
+        const collectionsDir = path.join(tmpDir, 'internal', 'collections');
         const tsGoCollections = path.join(tsGoDir, 'internal', 'collections');
         if (fs.existsSync(tsGoCollections)) {
             fs.mkdirSync(collectionsDir, { recursive: true });
@@ -103,13 +143,16 @@ export async function ensureTsgolintSource(version) {
             }
         }
         // write ready marker
-        fs.writeFileSync(readyMarker, new Date().toISOString());
+        fs.writeFileSync(path.join(tmpDir, '.lintcn-ready'), new Date().toISOString());
+        // atomic rename: move completed dir to final location
+        fs.mkdirSync(path.dirname(sourceDir), { recursive: true });
+        fs.renameSync(tmpDir, sourceDir);
         console.log('tsgolint source ready');
     }
     catch (err) {
-        // clean up partial download so next run starts fresh
-        if (fs.existsSync(sourceDir)) {
-            fs.rmSync(sourceDir, { recursive: true });
+        // clean up partial temp directory
+        if (fs.existsSync(tmpDir)) {
+            fs.rmSync(tmpDir, { recursive: true });
         }
         throw err;
     }

package/dist/codegen.d.ts

@@ -1,9 +1,7 @@
 import type { RuleMetadata } from './discover.ts';
 /** Generate .lintcn/go.work and .lintcn/go.mod for editor/gopls support. */
 export declare function generateEditorGoFiles(lintcnDir: string): void;
-/** Generate build workspace for compiling the custom binary.
- *  With pkg/runner.Run(), the generated main.go is a static template —
- *  no regex surgery or file copying needed. */
+/** Generate build workspace for compiling the custom binary. */
 export declare function generateBuildWorkspace({ buildDir, tsgolintDir, lintcnDir, rules, }: {
     buildDir: string;
     tsgolintDir: string;

package/dist/codegen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codegen.d.ts","sourceRoot":"","sources":["../src/codegen.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AA2BjD,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAkC7D;AAED;;+CAE+C;AAC/C,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,WAAW,EACX,SAAS,EACT,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB,GAAG,IAAI,CA2CP"}
+{"version":3,"file":"codegen.d.ts","sourceRoot":"","sources":["../src/codegen.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AA4BjD,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAmC7D;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,WAAW,EACX,SAAS,EACT,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB,GAAG,IAAI,CA2CP"}

package/dist/codegen.js

@@ -1,11 +1,12 @@
 // Generate Go workspace files for building a custom tsgolint binary.
-// With the fork (remorses/tsgolint) exposing pkg/runner.Run(), codegen is
-// minimal: a 10-line main.go template + go.work with shim replaces.
-// No regex surgery, no file copying, no fragile string manipulation.
+// Uses internal/runner.Run() from the fork — codegen is just a static
+// main.go template + go.work with shim replaces.
+//
+// Key: module names must be child paths of github.com/typescript-eslint/tsgolint
+// so Go allows importing internal/ packages across the module boundary.
 import fs from 'node:fs';
 import path from 'node:path';
 // Shim modules that need replace directives in go.work.
-// These redirect module paths to local directories inside the tsgolint source.
 const SHIM_MODULES = [
     'ast',
     'bundled',
@@ -22,6 +23,7 @@ const SHIM_MODULES = [
     'vfs/cachedvfs',
     'vfs/osvfs',
 ];
+const TSGOLINT_MODULE = 'github.com/typescript-eslint/tsgolint';
 function generateReplaceDirectives(tsgolintRelPath) {
     return SHIM_MODULES.map((mod) => {
         return `\tgithub.com/microsoft/typescript-go/shim/${mod} => ${tsgolintRelPath}/shim/${mod}`;
@@ -41,8 +43,9 @@ replace (
 ${generateReplaceDirectives('./.tsgolint')}
 )
 `;
-    // No child-path hack needed — pkg/ is public, any module name works
-    const goMod = `module lintcn-rules
+    // Module name is a child path of tsgolint — this is required so Go allows
+    // importing internal/ packages across the module boundary in a workspace.
+    const goMod = `module ${TSGOLINT_MODULE}/lintcn-rules
 
 go 1.26
 `;
@@ -59,9 +62,7 @@ go.sum
         fs.writeFileSync(gitignorePath, gitignore);
     }
 }
-/** Generate build workspace for compiling the custom binary.
- *  With pkg/runner.Run(), the generated main.go is a static template —
- *  no regex surgery or file copying needed. */
+/** Generate build workspace for compiling the custom binary. */
 export function generateBuildWorkspace({ buildDir, tsgolintDir, lintcnDir, rules, }) {
     fs.mkdirSync(path.join(buildDir, 'wrapper'), { recursive: true });
     // symlink tsgolint source
@@ -91,18 +92,17 @@ ${generateReplaceDirectives('./tsgolint')}
 )
 `;
     fs.writeFileSync(path.join(buildDir, 'go.work'), goWork);
-    // wrapper/go.mod — simple module name, no child-path hack needed
-    const wrapperGoMod = `module lintcn-wrapper
+    // wrapper module — child path of tsgolint for internal/ access
+    const wrapperGoMod = `module ${TSGOLINT_MODULE}/lintcn-wrapper
 
 go 1.26
 `;
     fs.writeFileSync(path.join(buildDir, 'wrapper', 'go.mod'), wrapperGoMod);
-    // wrapper/main.go — simple template, no regex or string surgery
+    // wrapper/main.go — static template
     const mainGo = generateMainGo(rules);
     fs.writeFileSync(path.join(buildDir, 'wrapper', 'main.go'), mainGo);
 }
-/** Generate a minimal main.go that imports user rules and calls runner.Run().
- *  This is a static template — no copying or patching of tsgolint source. */
+/** Generate main.go that imports user rules and calls internal/runner.Run(). */
 function generateMainGo(rules) {
     const ruleEntries = rules.map((r) => {
         return `\t\tlintcn.${r.varName},`;
@@ -113,9 +113,9 @@ package main
 import (
 \t"os"
 
-\t"github.com/typescript-eslint/tsgolint/pkg/rule"
-\t"github.com/typescript-eslint/tsgolint/pkg/runner"
-\tlintcn "lintcn-rules"
+\t"${TSGOLINT_MODULE}/internal/rule"
+\t"${TSGOLINT_MODULE}/internal/runner"
+\tlintcn "${TSGOLINT_MODULE}/lintcn-rules"
 )
 
 func main() {

package/dist/commands/add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AA+EA,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDxD"}
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AA+EA,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2DxD"}

package/dist/commands/add.js

@@ -104,11 +104,18 @@ export async function addRule(url) {
     }
     // ensure .tsgolint source is available and generate editor support files
     const tsgolintDir = await ensureTsgolintSource(DEFAULT_TSGOLINT_VERSION);
-    // create .tsgolint symlink inside .lintcn for gopls
+    // create .tsgolint symlink inside .lintcn for gopls.
+    // Use lstatSync to detect broken symlinks (existsSync returns false for broken links)
     const tsgolintLink = path.join(lintcnDir, '.tsgolint');
-    if (!fs.existsSync(tsgolintLink)) {
-        fs.symlinkSync(tsgolintDir, tsgolintLink);
+    try {
+        fs.lstatSync(tsgolintLink);
+        // exists (possibly broken) — remove and recreate
+        fs.rmSync(tsgolintLink, { force: true });
+    }
+    catch {
+        // doesn't exist at all
     }
+    fs.symlinkSync(tsgolintDir, tsgolintLink);
     generateEditorGoFiles(lintcnDir);
     console.log('Editor support files generated (go.work, go.mod)');
 }

package/dist/commands/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../src/commands/lint.ts"],"names":[],"mappings":"AAuBA,wBAAsB,WAAW,CAAC,EAChC,OAAO,EACP,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiDlB;AAED,wBAAsB,IAAI,CAAC,EACzB,OAAO,EACP,eAAe,EACf,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../src/commands/lint.ts"],"names":[],"mappings":"AAuBA,wBAAsB,WAAW,CAAC,EAChC,OAAO,EACP,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkDlB;AAED,wBAAsB,IAAI,CAAC,EACzB,OAAO,EACP,eAAe,EACf,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB"}

package/dist/commands/lint.js

@@ -5,7 +5,7 @@ import { spawn } from 'node:child_process';
 import { requireLintcnDir } from "../paths.js";
 import { discoverRules } from "../discover.js";
 import { generateBuildWorkspace } from "../codegen.js";
-import { ensureTsgolintSource, cachedBinaryExists, getBinaryPath, getBuildDir, getBinDir } from "../cache.js";
+import { ensureTsgolintSource, validateVersion, cachedBinaryExists, getBinaryPath, getBuildDir, getBinDir } from "../cache.js";
 import { computeContentHash } from "../hash.js";
 import { execAsync } from "../exec.js";
 async function checkGoInstalled() {
@@ -13,18 +13,19 @@ async function checkGoInstalled() {
         await execAsync('go', ['version']);
     }
     catch {
-        throw new Error('Go 1.26+ is required to build rules.\n' +
+        throw new Error('Go is required to build rules.\n' +
             'Install from https://go.dev/dl/');
     }
 }
 export async function buildBinary({ rebuild, tsgolintVersion, }) {
+    validateVersion(tsgolintVersion);
     await checkGoInstalled();
     const lintcnDir = requireLintcnDir();
     const rules = discoverRules(lintcnDir);
     if (rules.length === 0) {
         throw new Error('No rules found in .lintcn/. Run `lintcn add <url>` to add rules.');
     }
-    console.log(`Found ${rules.length} custom rule${rules.length === 1 ? '' : 's'} (tsgolint ${tsgolintVersion})`);
+    console.log(`Found ${rules.length} custom rule${rules.length === 1 ? '' : 's'} (tsgolint ${tsgolintVersion.slice(0, 8)})`);
     // ensure tsgolint source
     const tsgolintDir = await ensureTsgolintSource(tsgolintVersion);
     // compute content hash
@@ -37,8 +38,8 @@ export async function buildBinary({ rebuild, tsgolintVersion, }) {
         console.log('Using cached binary');
         return getBinaryPath(contentHash);
     }
-    // generate build workspace
-    const buildDir = getBuildDir();
+    // generate build workspace (per-hash dir to avoid races between concurrent processes)
+    const buildDir = getBuildDir(contentHash);
     console.log('Generating build workspace...');
     generateBuildWorkspace({
         buildDir,

package/dist/index.d.ts

@@ -4,6 +4,6 @@ export { addRule } from './commands/add.ts';
 export { lint, buildBinary } from './commands/lint.ts';
 export { listRules } from './commands/list.ts';
 export { removeRule } from './commands/remove.ts';
-export { DEFAULT_TSGOLINT_VERSION } from './cache.ts';
+export { DEFAULT_TSGOLINT_VERSION, validateVersion } from './cache.ts';
 export { findLintcnDir, getLintcnDir, requireLintcnDir } from './paths.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1E,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1E,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -3,5 +3,5 @@ export { addRule } from "./commands/add.js";
 export { lint, buildBinary } from "./commands/lint.js";
 export { listRules } from "./commands/list.js";
 export { removeRule } from "./commands/remove.js";
-export { DEFAULT_TSGOLINT_VERSION } from "./cache.js";
+export { DEFAULT_TSGOLINT_VERSION, validateVersion } from "./cache.js";
 export { findLintcnDir, getLintcnDir, requireLintcnDir } from "./paths.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lintcn",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "description": "The shadcn for type-aware TypeScript lint rules. Browse, pick, and copy rules into your project.",
   "bin": "dist/cli.js",
@@ -51,11 +51,13 @@
   "license": "MIT",
   "devDependencies": {
     "@types/node": "^22.0.0",
+    "@types/tar": "^7.0.87",
     "typescript": "5.8.2"
   },
   "dependencies": {
     "find-up": "^8.0.0",
-    "goke": "^6.3.0"
+    "goke": "^6.3.0",
+    "tar": "^7.5.12"
   },
   "scripts": {
     "build": "rm -rf dist *.tsbuildinfo && tsc && chmod +x dist/cli.js"

package/src/cache.ts

@@ -4,25 +4,41 @@
 //
 // Cache layout:
 //   ~/.cache/lintcn/tsgolint/<version>/   — extracted source (read-only)
+//   ~/.cache/lintcn/build/<content-hash>/ — per-hash build workspace (no race)
 //   ~/.cache/lintcn/bin/<content-hash>    — compiled binaries
 
 import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
+import crypto from 'node:crypto'
 import { pipeline } from 'node:stream/promises'
+import { extract } from 'tar'
 import { execAsync } from './exec.ts'
 
 // Pinned tsgolint fork commit — updated with each lintcn release.
-// Uses remorses/tsgolint fork which exposes pkg/runner.Run() and
-// moves internal/ packages to pkg/ for clean external imports.
-export const DEFAULT_TSGOLINT_VERSION = 'a93604379da2631b70332a65bc47eb5ced689a3b'
+// Uses remorses/tsgolint fork which adds internal/runner.Run().
+// Only 1 commit on top of upstream — zero modifications to existing files.
+export const DEFAULT_TSGOLINT_VERSION = 'e945641eabec22993eda3e7c101692e80417e0ea'
 
 // Pinned typescript-go base commit from microsoft/typescript-go (before patches).
 // Patches from tsgolint/patches/ are applied on top during setup.
-// This is the upstream commit the tsgolint submodule was forked from.
 // Must be updated when DEFAULT_TSGOLINT_VERSION changes.
 const TYPESCRIPT_GO_COMMIT = '1b7eabe122e1575a0df9c77eccdf4e063c623224'
 
+// Strict pattern for version strings — prevents path traversal via ../
+const VERSION_PATTERN = /^[a-zA-Z0-9._-]+$/
+
+/** Validate version string to prevent path traversal attacks.
+ *  Only allows alphanumeric chars, dots, underscores, and hyphens. */
+export function validateVersion(version: string): void {
+  if (!VERSION_PATTERN.test(version)) {
+    throw new Error(
+      `Invalid tsgolint version "${version}". ` +
+      'Version must only contain alphanumeric characters, dots, underscores, and hyphens.',
+    )
+  }
+}
+
 export function getCacheDir(): string {
   return path.join(os.homedir(), '.cache', 'lintcn')
 }
@@ -39,28 +55,50 @@ export function getBinaryPath(contentHash: string): string {
   return path.join(getBinDir(), contentHash)
 }
 
-export function getBuildDir(): string {
-  return path.join(getCacheDir(), 'build')
+/** Per-hash build directory to avoid races between concurrent lintcn processes. */
+export function getBuildDir(contentHash: string): string {
+  return path.join(getCacheDir(), 'build', contentHash)
 }
 
 /** Download a tarball from URL and extract it to targetDir.
+ *  Uses the `tar` npm package for cross-platform support (no shell tar needed).
  *  GitHub tarballs have a top-level directory like `repo-ref/`,
  *  so we strip the first path component during extraction. */
 async function downloadAndExtract(url: string, targetDir: string): Promise<void> {
-  const response = await fetch(url)
+  const controller = new AbortController()
+  const timeout = setTimeout(() => {
+    controller.abort(new Error(`Download timed out after 120s: ${url}`))
+  }, 120_000)
+
+  let response: Response
+  try {
+    response = await fetch(url, { signal: controller.signal })
+  } finally {
+    clearTimeout(timeout)
+  }
+
   if (!response.ok || !response.body) {
     throw new Error(`Failed to download ${url}: ${response.status} ${response.statusText}`)
   }
 
-  fs.mkdirSync(targetDir, { recursive: true })
-
-  const tmpTarGz = path.join(os.tmpdir(), `lintcn-${Date.now()}.tar.gz`)
-  const fileStream = fs.createWriteStream(tmpTarGz)
-  // @ts-ignore ReadableStream vs NodeJS.ReadableStream mismatch
-  await pipeline(response.body, fileStream)
-
-  await execAsync('tar', ['xzf', tmpTarGz, '--strip-components=1', '-C', targetDir])
-  fs.rmSync(tmpTarGz, { force: true })
+  // download to temp file with random suffix to avoid collisions
+  const tmpTarGz = path.join(os.tmpdir(), `lintcn-${crypto.randomBytes(8).toString('hex')}.tar.gz`)
+  try {
+    const fileStream = fs.createWriteStream(tmpTarGz)
+    // @ts-ignore ReadableStream vs NodeJS.ReadableStream mismatch
+    await pipeline(response.body, fileStream)
+
+    // extract with npm tar package (cross-platform, no shell tar needed)
+    fs.mkdirSync(targetDir, { recursive: true })
+    await extract({
+      file: tmpTarGz,
+      cwd: targetDir,
+      strip: 1,
+    })
+  } finally {
+    // always clean up temp file
+    fs.rmSync(tmpTarGz, { force: true })
+  }
 }
 
 /** Apply git-format patches using `patch -p1` (no git required).
@@ -79,6 +117,8 @@ async function applyPatches(patchesDir: string, targetDir: string): Promise<numb
 }
 
 export async function ensureTsgolintSource(version: string): Promise<string> {
+  validateVersion(version)
+
   const sourceDir = getTsgolintSourceDir(version)
   const readyMarker = path.join(sourceDir, '.lintcn-ready')
 
@@ -86,7 +126,12 @@ export async function ensureTsgolintSource(version: string): Promise<string> {
     return sourceDir
   }
 
-  // clean up any partial previous attempt so we start fresh
+  // Use a temp directory for the download, then atomic rename on success.
+  // This prevents concurrent processes from seeing partial state, and
+  // avoids the "non-empty dir on retry" problem.
+  const tmpDir = path.join(getCacheDir(), 'tsgolint', `.tmp-${version}-${crypto.randomBytes(4).toString('hex')}`)
+
+  // clean up any partial previous attempt
   if (fs.existsSync(sourceDir)) {
     fs.rmSync(sourceDir, { recursive: true })
   }
@@ -95,16 +140,16 @@ export async function ensureTsgolintSource(version: string): Promise<string> {
     // download tsgolint fork tarball
     console.log(`Downloading tsgolint@${version.slice(0, 8)}...`)
     const tsgolintUrl = `https://github.com/remorses/tsgolint/archive/${version}.tar.gz`
-    await downloadAndExtract(tsgolintUrl, sourceDir)
+    await downloadAndExtract(tsgolintUrl, tmpDir)
 
     // download typescript-go from microsoft (base commit before patches)
-    const tsGoDir = path.join(sourceDir, 'typescript-go')
+    const tsGoDir = path.join(tmpDir, 'typescript-go')
     console.log('Downloading typescript-go...')
     const tsGoUrl = `https://github.com/microsoft/typescript-go/archive/${TYPESCRIPT_GO_COMMIT}.tar.gz`
     await downloadAndExtract(tsGoUrl, tsGoDir)
 
     // apply tsgolint's patches to typescript-go
-    const patchesDir = path.join(sourceDir, 'patches')
+    const patchesDir = path.join(tmpDir, 'patches')
     if (fs.existsSync(patchesDir)) {
       const count = await applyPatches(patchesDir, tsGoDir)
       if (count > 0) {
@@ -113,7 +158,7 @@ export async function ensureTsgolintSource(version: string): Promise<string> {
     }
 
     // copy internal/collections from typescript-go (required by tsgolint, done by `just init`)
-    const collectionsDir = path.join(sourceDir, 'internal', 'collections')
+    const collectionsDir = path.join(tmpDir, 'internal', 'collections')
     const tsGoCollections = path.join(tsGoDir, 'internal', 'collections')
     if (fs.existsSync(tsGoCollections)) {
       fs.mkdirSync(collectionsDir, { recursive: true })
@@ -126,12 +171,17 @@ export async function ensureTsgolintSource(version: string): Promise<string> {
     }
 
     // write ready marker
-    fs.writeFileSync(readyMarker, new Date().toISOString())
+    fs.writeFileSync(path.join(tmpDir, '.lintcn-ready'), new Date().toISOString())
+
+    // atomic rename: move completed dir to final location
+    fs.mkdirSync(path.dirname(sourceDir), { recursive: true })
+    fs.renameSync(tmpDir, sourceDir)
+
     console.log('tsgolint source ready')
   } catch (err) {
-    // clean up partial download so next run starts fresh
-    if (fs.existsSync(sourceDir)) {
-      fs.rmSync(sourceDir, { recursive: true })
+    // clean up partial temp directory
+    if (fs.existsSync(tmpDir)) {
+      fs.rmSync(tmpDir, { recursive: true })
     }
     throw err
   }

package/src/codegen.ts

@@ -1,14 +1,15 @@
 // Generate Go workspace files for building a custom tsgolint binary.
-// With the fork (remorses/tsgolint) exposing pkg/runner.Run(), codegen is
-// minimal: a 10-line main.go template + go.work with shim replaces.
-// No regex surgery, no file copying, no fragile string manipulation.
+// Uses internal/runner.Run() from the fork — codegen is just a static
+// main.go template + go.work with shim replaces.
+//
+// Key: module names must be child paths of github.com/typescript-eslint/tsgolint
+// so Go allows importing internal/ packages across the module boundary.
 
 import fs from 'node:fs'
 import path from 'node:path'
 import type { RuleMetadata } from './discover.ts'
 
 // Shim modules that need replace directives in go.work.
-// These redirect module paths to local directories inside the tsgolint source.
 const SHIM_MODULES = [
   'ast',
   'bundled',
@@ -26,6 +27,8 @@ const SHIM_MODULES = [
   'vfs/osvfs',
 ] as const
 
+const TSGOLINT_MODULE = 'github.com/typescript-eslint/tsgolint'
+
 function generateReplaceDirectives(tsgolintRelPath: string): string {
   return SHIM_MODULES.map((mod) => {
     return `\tgithub.com/microsoft/typescript-go/shim/${mod} => ${tsgolintRelPath}/shim/${mod}`
@@ -47,8 +50,9 @@ ${generateReplaceDirectives('./.tsgolint')}
 )
 `
 
-  // No child-path hack needed — pkg/ is public, any module name works
-  const goMod = `module lintcn-rules
+  // Module name is a child path of tsgolint — this is required so Go allows
+  // importing internal/ packages across the module boundary in a workspace.
+  const goMod = `module ${TSGOLINT_MODULE}/lintcn-rules
 
 go 1.26
 `
@@ -69,9 +73,7 @@ go.sum
   }
 }
 
-/** Generate build workspace for compiling the custom binary.
- *  With pkg/runner.Run(), the generated main.go is a static template —
- *  no regex surgery or file copying needed. */
+/** Generate build workspace for compiling the custom binary. */
 export function generateBuildWorkspace({
   buildDir,
   tsgolintDir,
@@ -115,20 +117,19 @@ ${generateReplaceDirectives('./tsgolint')}
 `
   fs.writeFileSync(path.join(buildDir, 'go.work'), goWork)
 
-  // wrapper/go.mod — simple module name, no child-path hack needed
-  const wrapperGoMod = `module lintcn-wrapper
+  // wrapper module — child path of tsgolint for internal/ access
+  const wrapperGoMod = `module ${TSGOLINT_MODULE}/lintcn-wrapper
 
 go 1.26
 `
   fs.writeFileSync(path.join(buildDir, 'wrapper', 'go.mod'), wrapperGoMod)
 
-  // wrapper/main.go — simple template, no regex or string surgery
+  // wrapper/main.go — static template
   const mainGo = generateMainGo(rules)
   fs.writeFileSync(path.join(buildDir, 'wrapper', 'main.go'), mainGo)
 }
 
-/** Generate a minimal main.go that imports user rules and calls runner.Run().
- *  This is a static template — no copying or patching of tsgolint source. */
+/** Generate main.go that imports user rules and calls internal/runner.Run(). */
 function generateMainGo(rules: RuleMetadata[]): string {
   const ruleEntries = rules.map((r) => {
     return `\t\tlintcn.${r.varName},`
@@ -140,9 +141,9 @@ package main
 import (
 \t"os"
 
-\t"github.com/typescript-eslint/tsgolint/pkg/rule"
-\t"github.com/typescript-eslint/tsgolint/pkg/runner"
-\tlintcn "lintcn-rules"
+\t"${TSGOLINT_MODULE}/internal/rule"
+\t"${TSGOLINT_MODULE}/internal/runner"
+\tlintcn "${TSGOLINT_MODULE}/lintcn-rules"
 )
 
 func main() {

package/src/commands/add.ts

@@ -122,11 +122,17 @@ export async function addRule(url: string): Promise<void> {
   // ensure .tsgolint source is available and generate editor support files
   const tsgolintDir = await ensureTsgolintSource(DEFAULT_TSGOLINT_VERSION)
 
-  // create .tsgolint symlink inside .lintcn for gopls
+  // create .tsgolint symlink inside .lintcn for gopls.
+  // Use lstatSync to detect broken symlinks (existsSync returns false for broken links)
   const tsgolintLink = path.join(lintcnDir, '.tsgolint')
-  if (!fs.existsSync(tsgolintLink)) {
-    fs.symlinkSync(tsgolintDir, tsgolintLink)
+  try {
+    fs.lstatSync(tsgolintLink)
+    // exists (possibly broken) — remove and recreate
+    fs.rmSync(tsgolintLink, { force: true })
+  } catch {
+    // doesn't exist at all
   }
+  fs.symlinkSync(tsgolintDir, tsgolintLink)
 
   generateEditorGoFiles(lintcnDir)
   console.log('Editor support files generated (go.work, go.mod)')

package/src/commands/lint.ts

@@ -6,7 +6,7 @@ import { spawn } from 'node:child_process'
 import { requireLintcnDir } from '../paths.ts'
 import { discoverRules } from '../discover.ts'
 import { generateBuildWorkspace } from '../codegen.ts'
-import { ensureTsgolintSource, DEFAULT_TSGOLINT_VERSION, cachedBinaryExists, getBinaryPath, getBuildDir, getBinDir } from '../cache.ts'
+import { ensureTsgolintSource, validateVersion, cachedBinaryExists, getBinaryPath, getBuildDir, getBinDir } from '../cache.ts'
 import { computeContentHash } from '../hash.ts'
 import { execAsync } from '../exec.ts'
 
@@ -15,7 +15,7 @@ async function checkGoInstalled(): Promise<void> {
     await execAsync('go', ['version'])
   } catch {
     throw new Error(
-      'Go 1.26+ is required to build rules.\n' +
+      'Go is required to build rules.\n' +
       'Install from https://go.dev/dl/',
     )
   }
@@ -28,6 +28,7 @@ export async function buildBinary({
   rebuild: boolean
   tsgolintVersion: string
 }): Promise<string> {
+  validateVersion(tsgolintVersion)
   await checkGoInstalled()
 
   const lintcnDir = requireLintcnDir()
@@ -37,7 +38,7 @@ export async function buildBinary({
     throw new Error('No rules found in .lintcn/. Run `lintcn add <url>` to add rules.')
   }
 
-  console.log(`Found ${rules.length} custom rule${rules.length === 1 ? '' : 's'} (tsgolint ${tsgolintVersion})`)
+  console.log(`Found ${rules.length} custom rule${rules.length === 1 ? '' : 's'} (tsgolint ${tsgolintVersion.slice(0, 8)})`)
 
   // ensure tsgolint source
   const tsgolintDir = await ensureTsgolintSource(tsgolintVersion)
@@ -54,8 +55,8 @@ export async function buildBinary({
     return getBinaryPath(contentHash)
   }
 
-  // generate build workspace
-  const buildDir = getBuildDir()
+  // generate build workspace (per-hash dir to avoid races between concurrent processes)
+  const buildDir = getBuildDir(contentHash)
   console.log('Generating build workspace...')
   generateBuildWorkspace({
     buildDir,

package/src/index.ts

@@ -4,5 +4,5 @@ export { addRule } from './commands/add.ts'
 export { lint, buildBinary } from './commands/lint.ts'
 export { listRules } from './commands/list.ts'
 export { removeRule } from './commands/remove.ts'
-export { DEFAULT_TSGOLINT_VERSION } from './cache.ts'
+export { DEFAULT_TSGOLINT_VERSION, validateVersion } from './cache.ts'
 export { findLintcnDir, getLintcnDir, requireLintcnDir } from './paths.ts'

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2025 Kimaki
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.