lintcn 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -1,14 +1,70 @@
-## 0.4.0
+## 0.6.0
+
+1. **Rules now live in subfolders** — each rule is its own Go package under `.lintcn/{rule_name}/`, replacing the old flat `.lintcn/*.go` layout. This eliminates the need to rename `options.go` and `schema.json` companions — they stay in the subfolder with their original names, and the Go package name matches the folder. `lintcn add` now fetches the entire rule folder automatically.
 
-1. **Simpler rule imports** — rules now import from `pkg/rule`, `pkg/utils`, etc. instead of `internal/rule`. The `internal/` child-module-path hack is gone. Your `.go` files use clean import paths:
-   ```go
-   import (
-       "github.com/typescript-eslint/tsgolint/pkg/rule"
-       "github.com/typescript-eslint/tsgolint/pkg/utils"
-   )
    ```
+   .lintcn/
+       no_floating_promises/
+           no_floating_promises.go
+           no_floating_promises_test.go
+           options.go      ← original name, no renaming
+           schema.json
+       my_custom_rule/
+           my_custom_rule.go
+   ```
+
+2. **`lintcn add` fetches whole folders** — both folder URLs (`/tree/`) and file URLs (`/blob/`) now fetch every `.go` and `.json` file in the rule's directory. Passing a file URL auto-detects the parent folder:
 
-2. **Simpler codegen** — uses a tsgolint fork with `pkg/runner.Run()`, eliminating all regex surgery on main.go. The generated binary entry point is a 15-line template instead of a patched copy of tsgolint's main.go.
+   ```bash
+   # folder URL
+   lintcn add https://github.com/oxc-project/tsgolint/tree/main/internal/rules/no_floating_promises
+
+   # file URL — auto-fetches the whole folder
+   lintcn add https://github.com/oxc-project/tsgolint/blob/main/internal/rules/await_thenable/await_thenable.go
+   ```
+
+3. **Error for flat `.go` files in `.lintcn/`** — if leftover flat files from older versions are detected, lintcn now prints a clear migration error with instructions instead of silently ignoring them.
+
+4. **Reproducible builds with `-trimpath`** — the Go binary is now built with `-trimpath`, stripping absolute paths from the output. Binaries are identical across machines for the same rule content + tsgolint version + platform.
+
+5. **Faster cache hits** — Go version removed from the content hash. The compiled binary is a standalone executable with no Go runtime dependency, so the Go version used to build it doesn't affect correctness. Also excludes `_test.go` files from the hash since tests don't affect the binary.
+
+6. **Go compilation output is live** — `go build` now inherits stdio, so compilation progress and errors stream directly to the terminal instead of being silently captured.
+
+7. **First-build guidance** — on first compile (cold Go cache), lintcn explains the one-time 30s cost and shows which directories to cache in CI:
+   ```
+   Compiling custom tsgolint binary (first build — may take 30s+ to compile dependencies)...
+   Subsequent builds will be fast (~1s). In CI, cache ~/.cache/lintcn/ and GOCACHE (run `go env GOCACHE`).
+   ```
+
+8. **GitHub Actions example** — README now includes a copy-paste workflow that caches the compiled binary. Subsequent CI runs take ~12s (vs ~4min cold):
+
+   ```yaml
+   - name: Cache lintcn binary + Go build cache
+     uses: actions/cache@v4
+     with:
+       path: |
+         ~/.cache/lintcn
+         ~/go/pkg
+       key: lintcn-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.lintcn/**/*.go') }}
+       restore-keys: lintcn-${{ runner.os }}-${{ runner.arch }}-
+   ```
+
+## 0.5.0
+
+1. **Security fix — path traversal in `--tsgolint-version`** — the version flag is now validated against a strict pattern. Previously a value like `../../etc` could escape the cache directory.
+
+2. **Fixed intermittent failures with concurrent `lintcn lint` runs** — build workspaces are now per-content-hash instead of shared. Two processes running simultaneously no longer corrupt each other's build.
+
+3. **Cross-platform tar extraction** — replaced shell `tar` command with the npm `tar` package. Works on Windows without needing system tar.
+
+4. **No more `patch` command required** — tsgolint downloads now use a fork with a clean `internal/runner.Run()` entry point. Zero modifications to existing tsgolint files; upstream syncs will never conflict.
+
+5. **Downloads no longer hang** — 120s timeout on all GitHub tarball downloads.
+
+6. **Fixed broken `.tsgolint` symlink** — `lintcn add` now correctly detects and recreates broken symlinks.
+
+## 0.4.0
 
 ## 0.3.0
 

package/README.md

@@ -13,8 +13,11 @@ npm install -D lintcn
 ## Usage
 
 ```bash
-# Add a rule by URL
-npx lintcn add https://github.com/user/repo/blob/main/rules/no_unhandled_error.go
+# Add a rule folder from tsgolint
+npx lintcn add https://github.com/oxc-project/tsgolint/tree/main/internal/rules/no_floating_promises
+
+# Add by file URL (auto-fetches the whole folder)
+npx lintcn add https://github.com/oxc-project/tsgolint/blob/main/internal/rules/await_thenable/await_thenable.go
 
 # Lint your project
 npx lintcn lint
@@ -26,21 +29,33 @@ npx lintcn lint --tsconfig tsconfig.build.json
 npx lintcn list
 
 # Remove a rule
-npx lintcn remove no-unhandled-error
+npx lintcn remove no-floating-promises
+
+# Clean cached tsgolint source + binaries
+npx lintcn clean
 ```
 
+Browse all 50+ available built-in rules in the [tsgolint rules directory](https://github.com/oxc-project/tsgolint/tree/main/internal/rules).
+
 ## How it works
 
-Rules live as `.go` files in `.lintcn/` at your project root. You own the source — edit, customize, delete.
+Each rule lives in its own subfolder under `.lintcn/`. You own the source — edit, customize, delete.
 
 ```
 my-project/
 ├── .lintcn/
-│   ├── .gitignore                      ← ignores generated Go files
-│   ├── no_unhandled_error.go           ← your rule (committed)
-│   └── no_unhandled_error_test.go      ← its tests (committed)
+│   ├── .gitignore                          ← ignores generated Go files
+│   ├── no_floating_promises/
+│   │   ├── no_floating_promises.go         ← rule source (committed)
+│   │   ├── no_floating_promises_test.go    ← tests (committed)
+│   │   ├── options.go                      ← rule options struct
+│   │   └── schema.json                     ← options schema
+│   ├── await_thenable/
+│   │   ├── await_thenable.go
+│   │   └── await_thenable_test.go
+│   └── my_custom_rule/
+│       └── my_custom_rule.go
 ├── src/
-│   ├── index.ts
 │   └── ...
 ├── tsconfig.json
 └── package.json
@@ -48,22 +63,32 @@ my-project/
 
 When you run `npx lintcn lint`, the CLI:
 
-1. Scans `.lintcn/*.go` for rule definitions
-2. Generates a Go workspace with all 50+ built-in tsgolint rules + your custom rules
+1. Scans `.lintcn/*/` subfolders for rule definitions
+2. Generates a Go workspace with your custom rules
 3. Compiles a custom binary (cached — rebuilds only when rules change)
 4. Runs the binary against your project
 
-## Writing a rule
+You can run `lintcn lint` from any subdirectory — it walks up to find `.lintcn/` and lints the cwd project.
+
+## Writing custom rules
+
+To help AI agents write and modify rules, install the lintcn skill:
+
+```bash
+npx skills add remorses/lintcn
+```
 
-Every rule is a Go file with `package lintcn` that exports a `rule.Rule` variable.
+This gives your AI agent the full tsgolint rule API reference — AST visitors, type checker, reporting, fixes, and testing patterns.
 
-Here's a rule that errors when you discard the return value of a function that returns `Error | T` — enforcing the [errore](https://errore.org) pattern:
+Every rule lives in a subfolder under `.lintcn/` with the package name matching the folder:
 
 ```go
+// .lintcn/no_unhandled_error/no_unhandled_error.go
+
 // lintcn:name no-unhandled-error
 // lintcn:description Disallow discarding Error-typed return values
 
-package lintcn
+package no_unhandled_error
 
 import (
     "github.com/microsoft/typescript-go/shim/ast"
@@ -134,7 +159,7 @@ void getUser("id")
 ```json
 {
   "devDependencies": {
-    "lintcn": "0.1.0"
+    "lintcn": "0.5.0"
   }
 }
 ```
@@ -145,17 +170,45 @@ Each lintcn release bundles a specific tsgolint version. Updating lintcn can cha
 2. Run `npx lintcn build` after updating to verify your rules still compile
 3. Fix any compilation errors before committing
 
-You can test against an unreleased tsgolint version without updating lintcn:
-
-```bash
-npx lintcn lint --tsgolint-version v0.10.0
+## CI Setup
+
+The first `lintcn lint` compiles a custom Go binary (~30s). Subsequent runs use the cached binary (<1s). Cache `~/.cache/lintcn/` and Go's build cache to keep CI fast.
+
+```yaml
+# .github/workflows/lint.yml
+name: Lint
+on: [push, pull_request]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Cache lintcn binary + Go build cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/lintcn
+            ~/go/pkg
+          key: lintcn-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('.lintcn/**/*.go') }}
+          restore-keys: |
+            lintcn-${{ runner.os }}-${{ runner.arch }}-
+
+      - run: npm ci
+      - run: npx lintcn lint
 ```
 
+The cache key includes a hash of your rule files — when rules change, the binary is recompiled. The `restore-keys` fallback ensures Go's build cache is still used even when rules change, so recompilation takes ~1s instead of 30s.
+
 ## Prerequisites
 
 - **Node.js** — for the CLI
-- **Go 1.26+** — for compiling rules (`go.dev/dl`)
-- **Git** — for cloning tsgolint source on first build
+- **Go** — for compiling rules (`go.dev/dl`)
 
 Go is only needed for `lintcn lint` / `lintcn build`. Adding and listing rules works without Go.
 

package/dist/cache.d.ts

@@ -1,9 +1,13 @@
-export declare const DEFAULT_TSGOLINT_VERSION = "a93604379da2631b70332a65bc47eb5ced689a3b";
+export declare const DEFAULT_TSGOLINT_VERSION = "e945641eabec22993eda3e7c101692e80417e0ea";
+/** Validate version string to prevent path traversal attacks.
+ *  Only allows alphanumeric chars, dots, underscores, and hyphens. */
+export declare function validateVersion(version: string): void;
 export declare function getCacheDir(): string;
 export declare function getTsgolintSourceDir(version: string): string;
 export declare function getBinDir(): string;
 export declare function getBinaryPath(contentHash: string): string;
-export declare function getBuildDir(): string;
+/** Per-hash build directory to avoid races between concurrent lintcn processes. */
+export declare function getBuildDir(contentHash: string): string;
 export declare function ensureTsgolintSource(version: string): Promise<string>;
 export declare function cachedBinaryExists(contentHash: string): boolean;
 //# sourceMappingURL=cache.d.ts.map

package/dist/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,wBAAwB,6CAA6C,CAAA;AAQlF,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAqCD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2D3E;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAQ/D"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,wBAAwB,6CAA6C,CAAA;AAUlF;sEACsE;AACtE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAOrD;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEvD;AA0DD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuE3E;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAQ/D"}

package/dist/cache.js

@@ -4,21 +4,33 @@
 //
 // Cache layout:
 //   ~/.cache/lintcn/tsgolint/<version>/   — extracted source (read-only)
+//   ~/.cache/lintcn/build/<content-hash>/ — per-hash build workspace (no race)
 //   ~/.cache/lintcn/bin/<content-hash>    — compiled binaries
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import { pipeline } from 'node:stream/promises';
+import { extract } from 'tar';
 import { execAsync } from "./exec.js";
 // Pinned tsgolint fork commit — updated with each lintcn release.
-// Uses remorses/tsgolint fork which exposes pkg/runner.Run() and
-// moves internal/ packages to pkg/ for clean external imports.
-export const DEFAULT_TSGOLINT_VERSION = 'a93604379da2631b70332a65bc47eb5ced689a3b';
+// Uses remorses/tsgolint fork which adds internal/runner.Run().
+// Only 1 commit on top of upstream — zero modifications to existing files.
+export const DEFAULT_TSGOLINT_VERSION = 'e945641eabec22993eda3e7c101692e80417e0ea';
 // Pinned typescript-go base commit from microsoft/typescript-go (before patches).
 // Patches from tsgolint/patches/ are applied on top during setup.
-// This is the upstream commit the tsgolint submodule was forked from.
 // Must be updated when DEFAULT_TSGOLINT_VERSION changes.
 const TYPESCRIPT_GO_COMMIT = '1b7eabe122e1575a0df9c77eccdf4e063c623224';
+// Strict pattern for version strings — prevents path traversal via ../
+const VERSION_PATTERN = /^[a-zA-Z0-9._-]+$/;
+/** Validate version string to prevent path traversal attacks.
+ *  Only allows alphanumeric chars, dots, underscores, and hyphens. */
+export function validateVersion(version) {
+    if (!VERSION_PATTERN.test(version)) {
+        throw new Error(`Invalid tsgolint version "${version}". ` +
+            'Version must only contain alphanumeric characters, dots, underscores, and hyphens.');
+    }
+}
 export function getCacheDir() {
     return path.join(os.homedir(), '.cache', 'lintcn');
 }
@@ -31,24 +43,47 @@ export function getBinDir() {
 export function getBinaryPath(contentHash) {
     return path.join(getBinDir(), contentHash);
 }
-export function getBuildDir() {
-    return path.join(getCacheDir(), 'build');
+/** Per-hash build directory to avoid races between concurrent lintcn processes. */
+export function getBuildDir(contentHash) {
+    return path.join(getCacheDir(), 'build', contentHash);
 }
 /** Download a tarball from URL and extract it to targetDir.
+ *  Uses the `tar` npm package for cross-platform support (no shell tar needed).
  *  GitHub tarballs have a top-level directory like `repo-ref/`,
  *  so we strip the first path component during extraction. */
 async function downloadAndExtract(url, targetDir) {
-    const response = await fetch(url);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => {
+        controller.abort(new Error(`Download timed out after 120s: ${url}`));
+    }, 120_000);
+    let response;
+    try {
+        response = await fetch(url, { signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
     if (!response.ok || !response.body) {
         throw new Error(`Failed to download ${url}: ${response.status} ${response.statusText}`);
     }
-    fs.mkdirSync(targetDir, { recursive: true });
-    const tmpTarGz = path.join(os.tmpdir(), `lintcn-${Date.now()}.tar.gz`);
-    const fileStream = fs.createWriteStream(tmpTarGz);
-    // @ts-ignore ReadableStream vs NodeJS.ReadableStream mismatch
-    await pipeline(response.body, fileStream);
-    await execAsync('tar', ['xzf', tmpTarGz, '--strip-components=1', '-C', targetDir]);
-    fs.rmSync(tmpTarGz, { force: true });
+    // download to temp file with random suffix to avoid collisions
+    const tmpTarGz = path.join(os.tmpdir(), `lintcn-${crypto.randomBytes(8).toString('hex')}.tar.gz`);
+    try {
+        const fileStream = fs.createWriteStream(tmpTarGz);
+        // @ts-ignore ReadableStream vs NodeJS.ReadableStream mismatch
+        await pipeline(response.body, fileStream);
+        // extract with npm tar package (cross-platform, no shell tar needed)
+        fs.mkdirSync(targetDir, { recursive: true });
+        await extract({
+            file: tmpTarGz,
+            cwd: targetDir,
+            strip: 1,
+        });
+    }
+    finally {
+        // always clean up temp file
+        fs.rmSync(tmpTarGz, { force: true });
+    }
 }
 /** Apply git-format patches using `patch -p1` (no git required).
  *  Patches are standard unified diff format, `patch` ignores the git metadata. */
@@ -63,12 +98,17 @@ async function applyPatches(patchesDir, targetDir) {
     return patches.length;
 }
 export async function ensureTsgolintSource(version) {
+    validateVersion(version);
     const sourceDir = getTsgolintSourceDir(version);
     const readyMarker = path.join(sourceDir, '.lintcn-ready');
     if (fs.existsSync(readyMarker)) {
         return sourceDir;
     }
-    // clean up any partial previous attempt so we start fresh
+    // Use a temp directory for the download, then atomic rename on success.
+    // This prevents concurrent processes from seeing partial state, and
+    // avoids the "non-empty dir on retry" problem.
+    const tmpDir = path.join(getCacheDir(), 'tsgolint', `.tmp-${version}-${crypto.randomBytes(4).toString('hex')}`);
+    // clean up any partial previous attempt
     if (fs.existsSync(sourceDir)) {
         fs.rmSync(sourceDir, { recursive: true });
     }
@@ -76,14 +116,14 @@ export async function ensureTsgolintSource(version) {
         // download tsgolint fork tarball
         console.log(`Downloading tsgolint@${version.slice(0, 8)}...`);
         const tsgolintUrl = `https://github.com/remorses/tsgolint/archive/${version}.tar.gz`;
-        await downloadAndExtract(tsgolintUrl, sourceDir);
+        await downloadAndExtract(tsgolintUrl, tmpDir);
         // download typescript-go from microsoft (base commit before patches)
-        const tsGoDir = path.join(sourceDir, 'typescript-go');
+        const tsGoDir = path.join(tmpDir, 'typescript-go');
         console.log('Downloading typescript-go...');
         const tsGoUrl = `https://github.com/microsoft/typescript-go/archive/${TYPESCRIPT_GO_COMMIT}.tar.gz`;
         await downloadAndExtract(tsGoUrl, tsGoDir);
         // apply tsgolint's patches to typescript-go
-        const patchesDir = path.join(sourceDir, 'patches');
+        const patchesDir = path.join(tmpDir, 'patches');
         if (fs.existsSync(patchesDir)) {
             const count = await applyPatches(patchesDir, tsGoDir);
             if (count > 0) {
@@ -91,7 +131,7 @@ export async function ensureTsgolintSource(version) {
             }
         }
         // copy internal/collections from typescript-go (required by tsgolint, done by `just init`)
-        const collectionsDir = path.join(sourceDir, 'internal', 'collections');
+        const collectionsDir = path.join(tmpDir, 'internal', 'collections');
         const tsGoCollections = path.join(tsGoDir, 'internal', 'collections');
         if (fs.existsSync(tsGoCollections)) {
             fs.mkdirSync(collectionsDir, { recursive: true });
@@ -103,13 +143,16 @@ export async function ensureTsgolintSource(version) {
             }
         }
         // write ready marker
-        fs.writeFileSync(readyMarker, new Date().toISOString());
+        fs.writeFileSync(path.join(tmpDir, '.lintcn-ready'), new Date().toISOString());
+        // atomic rename: move completed dir to final location
+        fs.mkdirSync(path.dirname(sourceDir), { recursive: true });
+        fs.renameSync(tmpDir, sourceDir);
         console.log('tsgolint source ready');
     }
     catch (err) {
-        // clean up partial download so next run starts fresh
-        if (fs.existsSync(sourceDir)) {
-            fs.rmSync(sourceDir, { recursive: true });
+        // clean up partial temp directory
+        if (fs.existsSync(tmpDir)) {
+            fs.rmSync(tmpDir, { recursive: true });
         }
         throw err;
     }

package/dist/cli.js

@@ -7,16 +7,17 @@ import { addRule } from "./commands/add.js";
 import { lint, buildBinary } from "./commands/lint.js";
 import { listRules } from "./commands/list.js";
 import { removeRule } from "./commands/remove.js";
+import { clean } from "./commands/clean.js";
 import { DEFAULT_TSGOLINT_VERSION } from "./cache.js";
 const require = createRequire(import.meta.url);
 const packageJson = require('../package.json');
 const cli = goke('lintcn');
 cli
-    .command('add <url>', 'Add a rule by URL. Fetches the .go file and copies it into .lintcn/')
-    .example('# Add a rule from GitHub')
-    .example('lintcn add https://github.com/user/repo/blob/main/rules/no_floating_promises.go')
-    .example('# Add from raw URL')
-    .example('lintcn add https://raw.githubusercontent.com/user/repo/main/rules/no_unused_result.go')
+    .command('add <url>', 'Add a rule by GitHub URL. Fetches the whole folder into .lintcn/{rule}/')
+    .example('# Add a rule folder')
+    .example('lintcn add https://github.com/oxc-project/tsgolint/tree/main/internal/rules/no_floating_promises')
+    .example('# Add by file URL (auto-fetches the whole folder)')
+    .example('lintcn add https://github.com/oxc-project/tsgolint/blob/main/internal/rules/await_thenable/await_thenable.go')
     .action(async (url) => {
     await addRule(url);
 });
@@ -67,6 +68,11 @@ cli
     const binaryPath = await buildBinary({ rebuild: !!options.rebuild, tsgolintVersion });
     console.log(binaryPath);
 });
+cli
+    .command('clean', 'Remove cached tsgolint source and compiled binaries to free disk space')
+    .action(() => {
+    clean();
+});
 cli.help();
 cli.version(packageJson.version);
 cli.parse();

package/dist/codegen.d.ts

@@ -1,9 +1,7 @@
 import type { RuleMetadata } from './discover.ts';
 /** Generate .lintcn/go.work and .lintcn/go.mod for editor/gopls support. */
 export declare function generateEditorGoFiles(lintcnDir: string): void;
-/** Generate build workspace for compiling the custom binary.
- *  With pkg/runner.Run(), the generated main.go is a static template —
- *  no regex surgery or file copying needed. */
+/** Generate build workspace for compiling the custom binary. */
 export declare function generateBuildWorkspace({ buildDir, tsgolintDir, lintcnDir, rules, }: {
     buildDir: string;
     tsgolintDir: string;

package/dist/codegen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codegen.d.ts","sourceRoot":"","sources":["../src/codegen.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AA2BjD,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAkC7D;AAED;;+CAE+C;AAC/C,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,WAAW,EACX,SAAS,EACT,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB,GAAG,IAAI,CA2CP"}
+{"version":3,"file":"codegen.d.ts","sourceRoot":"","sources":["../src/codegen.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AA4BjD,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAmC7D;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,WAAW,EACX,SAAS,EACT,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB,GAAG,IAAI,CA2CP"}

package/dist/codegen.js

@@ -1,11 +1,12 @@
 // Generate Go workspace files for building a custom tsgolint binary.
-// With the fork (remorses/tsgolint) exposing pkg/runner.Run(), codegen is
-// minimal: a 10-line main.go template + go.work with shim replaces.
-// No regex surgery, no file copying, no fragile string manipulation.
+// Uses internal/runner.Run() from the fork — codegen is just a static
+// main.go template + go.work with shim replaces.
+//
+// Key: module names must be child paths of github.com/typescript-eslint/tsgolint
+// so Go allows importing internal/ packages across the module boundary.
 import fs from 'node:fs';
 import path from 'node:path';
 // Shim modules that need replace directives in go.work.
-// These redirect module paths to local directories inside the tsgolint source.
 const SHIM_MODULES = [
     'ast',
     'bundled',
@@ -22,6 +23,7 @@ const SHIM_MODULES = [
     'vfs/cachedvfs',
     'vfs/osvfs',
 ];
+const TSGOLINT_MODULE = 'github.com/typescript-eslint/tsgolint';
 function generateReplaceDirectives(tsgolintRelPath) {
     return SHIM_MODULES.map((mod) => {
         return `\tgithub.com/microsoft/typescript-go/shim/${mod} => ${tsgolintRelPath}/shim/${mod}`;
@@ -41,8 +43,9 @@ replace (
 ${generateReplaceDirectives('./.tsgolint')}
 )
 `;
-    // No child-path hack needed — pkg/ is public, any module name works
-    const goMod = `module lintcn-rules
+    // Module name is a child path of tsgolint — this is required so Go allows
+    // importing internal/ packages across the module boundary in a workspace.
+    const goMod = `module ${TSGOLINT_MODULE}/lintcn-rules
 
 go 1.26
 `;
@@ -59,9 +62,7 @@ go.sum
         fs.writeFileSync(gitignorePath, gitignore);
     }
 }
-/** Generate build workspace for compiling the custom binary.
- *  With pkg/runner.Run(), the generated main.go is a static template —
- *  no regex surgery or file copying needed. */
+/** Generate build workspace for compiling the custom binary. */
 export function generateBuildWorkspace({ buildDir, tsgolintDir, lintcnDir, rules, }) {
     fs.mkdirSync(path.join(buildDir, 'wrapper'), { recursive: true });
     // symlink tsgolint source
@@ -91,21 +92,37 @@ ${generateReplaceDirectives('./tsgolint')}
 )
 `;
     fs.writeFileSync(path.join(buildDir, 'go.work'), goWork);
-    // wrapper/go.mod — simple module name, no child-path hack needed
-    const wrapperGoMod = `module lintcn-wrapper
+    // wrapper module — child path of tsgolint for internal/ access
+    const wrapperGoMod = `module ${TSGOLINT_MODULE}/lintcn-wrapper
 
 go 1.26
 `;
     fs.writeFileSync(path.join(buildDir, 'wrapper', 'go.mod'), wrapperGoMod);
-    // wrapper/main.go — simple template, no regex or string surgery
+    // wrapper/main.go — static template
     const mainGo = generateMainGo(rules);
     fs.writeFileSync(path.join(buildDir, 'wrapper', 'main.go'), mainGo);
 }
-/** Generate a minimal main.go that imports user rules and calls runner.Run().
- *  This is a static template — no copying or patching of tsgolint source. */
+/** Sanitize a package name into a valid Go identifier for use as an import alias.
+ *  Replaces hyphens/dots with underscores, prepends _ if starts with a digit. */
+function toGoAlias(pkg) {
+    let alias = pkg.replace(/[^a-zA-Z0-9_]/g, '_');
+    if (/^[0-9]/.test(alias)) {
+        alias = '_' + alias;
+    }
+    return alias;
+}
+/** Generate main.go that imports user rules and calls internal/runner.Run().
+ *  Each rule subfolder is its own Go package, imported by package name. */
 function generateMainGo(rules) {
+    // Deduplicate imports by package name (in case a subfolder has multiple rules)
+    const uniquePackages = [...new Set(rules.map((r) => { return r.packageName; }))];
+    const imports = uniquePackages.map((pkg) => {
+        const alias = toGoAlias(pkg);
+        return `\t${alias} "${TSGOLINT_MODULE}/lintcn-rules/${pkg}"`;
+    }).join('\n');
     const ruleEntries = rules.map((r) => {
-        return `\t\tlintcn.${r.varName},`;
+        const alias = toGoAlias(r.packageName);
+        return `\t\t${alias}.${r.varName},`;
     }).join('\n');
     return `// Code generated by lintcn. DO NOT EDIT.
 package main
@@ -113,9 +130,9 @@ package main
 import (
 \t"os"
 
-\t"github.com/typescript-eslint/tsgolint/pkg/rule"
-\t"github.com/typescript-eslint/tsgolint/pkg/runner"
-\tlintcn "lintcn-rules"
+\t"${TSGOLINT_MODULE}/internal/rule"
+\t"${TSGOLINT_MODULE}/internal/runner"
+${imports}
 )
 
 func main() {

package/dist/commands/add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AA+EA,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDxD"}
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAwHA,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4ExD"}