lintcn 0.9.0 → 0.10.1

package/CHANGELOG.md

@@ -1,3 +1,35 @@
+## 0.10.1
+
+1. **Fixed concurrent cache builds** — multiple lintcn processes no longer corrupt each other's build cache. Cache acquisition now uses proper directory-based locking with stale lock detection and retry logic. Thanks @tanishqkancharla for #1!
+2. **Fixed prefer-object-params crash on computed property names** — the rule no longer panics when encountering computed names like `[Symbol.iterator]` or `[EventEmitter.captureRejectionSymbol]`. Diagnostics fall back to a generic message for computed names while keeping specific messages for named declarations.
+3. **Fixed no-unused-top-level-function test flakiness** — test cases now use isolated virtual tsconfig files with unique filenames, preventing cross-test interference when running in parallel.
+4. **Updated tsgolint fork** — bumped to latest `remorses/tsgolint` commit with updated `typescript-go` base. Also fixed `no-redundant-contextual-parameter-type` to use a direct Kind check instead of `ast.IsParameter()` to avoid potential panics on unexpected node kinds.
+
+## 0.10.0
+
+1. **New rule: `prefer-is-truthy` (error)** — errors on inline nullable type guards passed directly to `filter`. When the callback parameter is already `T | null | undefined`, prefer a reusable `isTruthy` helper over an ad hoc predicate at the call site:
+
+   ```ts
+   // flagged — ad hoc inline type guard
+   const active = pokemon.filter(
+     (value): value is Pokemon => value !== null,
+   )
+
+   // preferred — reusable helper
+   const active = pokemon.filter(isTruthy)
+   ```
+
+   Standalone reusable guards, filter callbacks without a type predicate, and other callback sites are exempt.
+
+2. **`no-type-assertion` no longer warns when the source is `any` or `unknown`** — assertions from `any` or `unknown` are now silently allowed since they're the standard pattern for untyped or narrowing contexts. Warnings are still emitted when a typed value is cast to `any`, `unknown`, or an unrelated concrete type:
+
+   ```ts
+   const x = response.data as User  // allowed when response.data is `any`
+   const y = value as unknown        // still warned — escaping a typed value
+   ```
+
+3. **`no-unsafe-unknown` aligns with `no-type-assertion`** — casts from `unknown` into a concrete target type no longer warn (that's a normal narrowing pattern). Warnings are kept for explicit `unknown` targets and assertions that embed `unknown` in a larger type like `Promise<unknown>`.
+
 ## 0.9.0
 
 1. **New rule: `no-redundant-exported-return-type` (warn)** — warns when exported APIs keep spelling `ReturnType<typeof ...>` even though the function already returns a public named type. This keeps public types direct and easier to read:

package/dist/cache.d.ts

@@ -1,4 +1,4 @@
-export declare const DEFAULT_TSGOLINT_VERSION = "427f872946bb413f0e21cff585b6139c986c89d3";
+export declare const DEFAULT_TSGOLINT_VERSION = "c031d7264983dba00bae76eb03532fe3884e5667";
 /** Validate version string to prevent path traversal attacks.
  *  Only allows alphanumeric chars, dots, underscores, and hyphens. */
 export declare function validateVersion(version: string): void;
@@ -8,6 +8,11 @@ export declare function getBinDir(): string;
 export declare function getBinaryPath(contentHash: string): string;
 /** Per-hash build directory to avoid races between concurrent lintcn processes. */
 export declare function getBuildDir(contentHash: string): string;
+/** Per-hash lock directory used while generating and compiling a build workspace. */
+export declare function getBuildLockDir(contentHash: string): string;
+/** Per-version lock directory used while populating cached tsgolint source. */
+export declare function getTsgolintSourceLockDir(version: string): string;
+export declare function acquireCacheLock(lockDir: string, description: string): Promise<string>;
 export declare function ensureTsgolintSource(version: string): Promise<string>;
 export declare function cachedBinaryExists(contentHash: string): boolean;
 //# sourceMappingURL=cache.d.ts.map

package/dist/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,wBAAwB,6CAA6C,CAAA;AAUlF;sEACsE;AACtE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAOrD;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEvD;AA0DD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuE3E;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAQ/D"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,wBAAwB,6CAA6C,CAAA;AAYlF;sEACsE;AACtE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAOrD;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,+EAA+E;AAC/E,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhE;AAQD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB5F;AA0DD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiF3E;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAQ/D"}

package/dist/cache.js

@@ -16,13 +16,15 @@ import { execAsync } from "./exec.js";
 // Pinned tsgolint fork commit — updated with each lintcn release.
 // Uses remorses/tsgolint fork which adds internal/runner.Run() and
 // TSGOLINT_SNAPSHOT_CWD env var for cwd-relative test snapshots.
-export const DEFAULT_TSGOLINT_VERSION = '427f872946bb413f0e21cff585b6139c986c89d3';
+export const DEFAULT_TSGOLINT_VERSION = 'c031d7264983dba00bae76eb03532fe3884e5667';
 // Pinned typescript-go base commit from microsoft/typescript-go (before patches).
 // Patches from tsgolint/patches/ are applied on top during setup.
 // Must be updated when DEFAULT_TSGOLINT_VERSION changes.
-const TYPESCRIPT_GO_COMMIT = 'c0703e66b68b826eedadce353d63fe9f4ea21fb6';
+const TYPESCRIPT_GO_COMMIT = '0970dc40fa8308ca76627ffcc3a992414fdf1cf2';
 // Strict pattern for version strings — prevents path traversal via ../
 const VERSION_PATTERN = /^[a-zA-Z0-9._-]+$/;
+const CACHE_LOCK_RETRY_MS = 100;
+const CACHE_LOCK_TIMEOUT_MS = 10 * 60_000;
 /** Validate version string to prevent path traversal attacks.
  *  Only allows alphanumeric chars, dots, underscores, and hyphens. */
 export function validateVersion(version) {
@@ -47,6 +49,39 @@ export function getBinaryPath(contentHash) {
 export function getBuildDir(contentHash) {
     return path.join(getCacheDir(), 'build', contentHash);
 }
+/** Per-hash lock directory used while generating and compiling a build workspace. */
+export function getBuildLockDir(contentHash) {
+    return path.join(getCacheDir(), 'locks', 'build', contentHash);
+}
+/** Per-version lock directory used while populating cached tsgolint source. */
+export function getTsgolintSourceLockDir(version) {
+    return path.join(getCacheDir(), 'locks', 'tsgolint', version);
+}
+async function wait(ms) {
+    await new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+export async function acquireCacheLock(lockDir, description) {
+    fs.mkdirSync(path.dirname(lockDir), { recursive: true });
+    const startedAt = Date.now();
+    while (true) {
+        try {
+            fs.mkdirSync(lockDir);
+            return lockDir;
+        }
+        catch (error) {
+            if (error?.code !== 'EEXIST') {
+                throw error;
+            }
+            if (Date.now() - startedAt > CACHE_LOCK_TIMEOUT_MS) {
+                throw new Error(`Timed out waiting for ${description}: ${lockDir}. ` +
+                    'If no lintcn process is running, delete this directory and retry.');
+            }
+            await wait(CACHE_LOCK_RETRY_MS);
+        }
+    }
+}
 /** Download a tarball from URL and extract it to targetDir.
  *  Uses the `tar` npm package for cross-platform support (no shell tar needed).
  *  GitHub tarballs have a top-level directory like `repo-ref/`,
@@ -104,57 +139,64 @@ export async function ensureTsgolintSource(version) {
     if (fs.existsSync(readyMarker)) {
         return sourceDir;
     }
-    // Use a temp directory for the download, then atomic rename on success.
-    // This prevents concurrent processes from seeing partial state, and
-    // avoids the "non-empty dir on retry" problem.
-    const tmpDir = path.join(getCacheDir(), 'tsgolint', `.tmp-${version}-${crypto.randomBytes(4).toString('hex')}`);
-    // clean up any partial previous attempt
-    if (fs.existsSync(sourceDir)) {
-        fs.rmSync(sourceDir, { recursive: true });
-    }
+    const sourceLockDir = await acquireCacheLock(getTsgolintSourceLockDir(version), `tsgolint source lock for ${version}`);
     try {
-        // download tsgolint fork tarball
-        console.log(`Downloading tsgolint@${version.slice(0, 8)}...`);
-        const tsgolintUrl = `https://github.com/remorses/tsgolint/archive/${version}.tar.gz`;
-        await downloadAndExtract(tsgolintUrl, tmpDir);
-        // download typescript-go from microsoft (base commit before patches)
-        const tsGoDir = path.join(tmpDir, 'typescript-go');
-        console.log('Downloading typescript-go...');
-        const tsGoUrl = `https://github.com/microsoft/typescript-go/archive/${TYPESCRIPT_GO_COMMIT}.tar.gz`;
-        await downloadAndExtract(tsGoUrl, tsGoDir);
-        // apply tsgolint's patches to typescript-go
-        const patchesDir = path.join(tmpDir, 'patches');
-        if (fs.existsSync(patchesDir)) {
-            const count = await applyPatches(patchesDir, tsGoDir);
-            if (count > 0) {
-                console.log(`Applied ${count} patches`);
+        if (fs.existsSync(readyMarker)) {
+            return sourceDir;
+        }
+        // Use a temp directory for the download, then atomic rename on success.
+        // This prevents concurrent processes from seeing partial state, and
+        // avoids the "non-empty dir on retry" problem.
+        const tmpDir = path.join(getCacheDir(), 'tsgolint', `.tmp-${version}-${crypto.randomBytes(4).toString('hex')}`);
+        // clean up any partial previous attempt
+        fs.rmSync(sourceDir, { recursive: true, force: true });
+        try {
+            // download tsgolint fork tarball
+            console.log(`Downloading tsgolint@${version.slice(0, 8)}...`);
+            const tsgolintUrl = `https://github.com/remorses/tsgolint/archive/${version}.tar.gz`;
+            await downloadAndExtract(tsgolintUrl, tmpDir);
+            // download typescript-go from microsoft (base commit before patches)
+            const tsGoDir = path.join(tmpDir, 'typescript-go');
+            console.log('Downloading typescript-go...');
+            const tsGoUrl = `https://github.com/microsoft/typescript-go/archive/${TYPESCRIPT_GO_COMMIT}.tar.gz`;
+            await downloadAndExtract(tsGoUrl, tsGoDir);
+            // apply tsgolint's patches to typescript-go
+            const patchesDir = path.join(tmpDir, 'patches');
+            if (fs.existsSync(patchesDir)) {
+                const count = await applyPatches(patchesDir, tsGoDir);
+                if (count > 0) {
+                    console.log(`Applied ${count} patches`);
+                }
             }
+            // copy internal/collections from typescript-go (required by tsgolint, done by `just init`)
+            const collectionsDir = path.join(tmpDir, 'internal', 'collections');
+            const tsGoCollections = path.join(tsGoDir, 'internal', 'collections');
+            if (fs.existsSync(tsGoCollections)) {
+                fs.mkdirSync(collectionsDir, { recursive: true });
+                const files = fs.readdirSync(tsGoCollections).filter((f) => {
+                    return f.endsWith('.go') && !f.endsWith('_test.go');
+                });
+                for (const file of files) {
+                    fs.copyFileSync(path.join(tsGoCollections, file), path.join(collectionsDir, file));
+                }
+            }
+            // write ready marker
+            fs.writeFileSync(path.join(tmpDir, '.lintcn-ready'), new Date().toISOString());
+            // atomic rename: move completed dir to final location
+            fs.mkdirSync(path.dirname(sourceDir), { recursive: true });
+            fs.renameSync(tmpDir, sourceDir);
+            console.log('tsgolint source ready');
         }
-        // copy internal/collections from typescript-go (required by tsgolint, done by `just init`)
-        const collectionsDir = path.join(tmpDir, 'internal', 'collections');
-        const tsGoCollections = path.join(tsGoDir, 'internal', 'collections');
-        if (fs.existsSync(tsGoCollections)) {
-            fs.mkdirSync(collectionsDir, { recursive: true });
-            const files = fs.readdirSync(tsGoCollections).filter((f) => {
-                return f.endsWith('.go') && !f.endsWith('_test.go');
-            });
-            for (const file of files) {
-                fs.copyFileSync(path.join(tsGoCollections, file), path.join(collectionsDir, file));
+        catch (err) {
+            // clean up partial temp directory
+            if (fs.existsSync(tmpDir)) {
+                fs.rmSync(tmpDir, { recursive: true });
             }
+            throw err;
         }
-        // write ready marker
-        fs.writeFileSync(path.join(tmpDir, '.lintcn-ready'), new Date().toISOString());
-        // atomic rename: move completed dir to final location
-        fs.mkdirSync(path.dirname(sourceDir), { recursive: true });
-        fs.renameSync(tmpDir, sourceDir);
-        console.log('tsgolint source ready');
     }
-    catch (err) {
-        // clean up partial temp directory
-        if (fs.existsSync(tmpDir)) {
-            fs.rmSync(tmpDir, { recursive: true });
-        }
-        throw err;
+    finally {
+        fs.rmSync(sourceLockDir, { recursive: true, force: true });
     }
     return sourceDir;
 }

package/dist/codegen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codegen.d.ts","sourceRoot":"","sources":["../src/codegen.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AA4BjD,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAmC7D;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,WAAW,EACX,SAAS,EACT,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB,GAAG,IAAI,CA2CP"}
+{"version":3,"file":"codegen.d.ts","sourceRoot":"","sources":["../src/codegen.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AA4BjD,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAmC7D;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,WAAW,EACX,SAAS,EACT,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB,GAAG,IAAI,CAuCP"}

package/dist/codegen.js

@@ -67,15 +67,11 @@ export function generateBuildWorkspace({ buildDir, tsgolintDir, lintcnDir, rules
     fs.mkdirSync(path.join(buildDir, 'wrapper'), { recursive: true });
     // symlink tsgolint source
     const tsgolintLink = path.join(buildDir, 'tsgolint');
-    if (fs.existsSync(tsgolintLink)) {
-        fs.rmSync(tsgolintLink, { recursive: true });
-    }
+    fs.rmSync(tsgolintLink, { recursive: true, force: true });
     fs.symlinkSync(tsgolintDir, tsgolintLink);
     // symlink user rules
     const rulesLink = path.join(buildDir, 'rules');
-    if (fs.existsSync(rulesLink)) {
-        fs.rmSync(rulesLink, { recursive: true });
-    }
+    fs.rmSync(rulesLink, { recursive: true, force: true });
     fs.symlinkSync(path.resolve(lintcnDir), rulesLink);
     // go.work
     const goWork = `go 1.26

package/dist/commands/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../src/commands/lint.ts"],"names":[],"mappings":"AAwBA,wBAAsB,WAAW,CAAC,EAChC,OAAO,EACP,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkElB;AAED,wBAAsB,IAAI,CAAC,EACzB,OAAO,EACP,eAAe,EACf,eAAe,EACf,WAAW,GACZ,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,WAAW,EAAE,OAAO,CAAA;CACrB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyClB"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../src/commands/lint.ts"],"names":[],"mappings":"AAkCA,wBAAsB,WAAW,CAAC,EAChC,OAAO,EACP,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwFlB;AAED,wBAAsB,IAAI,CAAC,EACzB,OAAO,EACP,eAAe,EACf,eAAe,EACf,WAAW,GACZ,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,WAAW,EAAE,OAAO,CAAA;CACrB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyClB"}

package/dist/commands/lint.js

@@ -2,11 +2,12 @@
 // Handles Go workspace generation, compilation with caching, and execution.
 import fs from 'node:fs';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { requireLintcnDir, findLintcnDir } from "../paths.js";
 import { discoverRules } from "../discover.js";
 import { generateBuildWorkspace, generateEditorGoFiles } from "../codegen.js";
-import { ensureTsgolintSource, validateVersion, cachedBinaryExists, getBinaryPath, getBuildDir, getBinDir } from "../cache.js";
+import { ensureTsgolintSource, validateVersion, cachedBinaryExists, getBinaryPath, getBuildDir, getBinDir, getBuildLockDir, acquireCacheLock, } from "../cache.js";
 import { computeContentHash } from "../hash.js";
 import { execAsync } from "../exec.js";
 async function checkGoInstalled() {
@@ -39,40 +40,57 @@ export async function buildBinary({ rebuild, tsgolintVersion, }) {
         console.log('Using cached binary');
         return getBinaryPath(contentHash);
     }
-    // ensure .lintcn/go.mod exists (gitignored, needed by the build workspace symlink)
-    generateEditorGoFiles(lintcnDir);
-    // generate build workspace (per-hash dir to avoid races between concurrent processes)
-    const buildDir = getBuildDir(contentHash);
-    console.log('Generating build workspace...');
-    generateBuildWorkspace({
-        buildDir,
-        tsgolintDir,
-        lintcnDir,
-        rules,
-    });
-    // compile
-    const binDir = getBinDir();
-    fs.mkdirSync(binDir, { recursive: true });
-    const binaryPath = getBinaryPath(contentHash);
-    // Check if any lintcn binary has been built before — if not, this is a cold
-    // build that compiles the full tsgolint + typescript-go dependency tree.
-    const existingBins = fs.existsSync(binDir) ? fs.readdirSync(binDir) : [];
-    if (existingBins.length === 0) {
-        console.log('Compiling custom tsgolint binary (first build — may take 30s+ to compile dependencies)...');
-        console.log('Subsequent builds will be fast (~1s). In CI, cache ~/.cache/lintcn/ and GOCACHE (run `go env GOCACHE`).');
-    }
-    else {
-        console.log('Compiling custom tsgolint binary...');
+    const buildLockDir = await acquireCacheLock(getBuildLockDir(contentHash), `build lock for ${contentHash}`);
+    try {
+        if (!rebuild && cachedBinaryExists(contentHash)) {
+            console.log('Using cached binary');
+            return getBinaryPath(contentHash);
+        }
+        // ensure .lintcn/go.mod exists (gitignored, needed by the build workspace symlink)
+        generateEditorGoFiles(lintcnDir);
+        // generate build workspace (per-hash dir to avoid races between concurrent processes)
+        const buildDir = getBuildDir(contentHash);
+        console.log('Generating build workspace...');
+        generateBuildWorkspace({
+            buildDir,
+            tsgolintDir,
+            lintcnDir,
+            rules,
+        });
+        // compile
+        const binDir = getBinDir();
+        fs.mkdirSync(binDir, { recursive: true });
+        const binaryPath = getBinaryPath(contentHash);
+        // Check if any lintcn binary has been built before — if not, this is a cold
+        // build that compiles the full tsgolint + typescript-go dependency tree.
+        const existingBins = fs.existsSync(binDir) ? fs.readdirSync(binDir) : [];
+        if (existingBins.length === 0) {
+            console.log('Compiling custom tsgolint binary (first build — may take 30s+ to compile dependencies)...');
+            console.log('Subsequent builds will be fast (~1s). In CI, cache ~/.cache/lintcn/ and GOCACHE (run `go env GOCACHE`).');
+        }
+        else {
+            console.log('Compiling custom tsgolint binary...');
+        }
+        const tmpBinaryPath = path.join(binDir, `${contentHash}.tmp-${process.pid}-${crypto.randomBytes(4).toString('hex')}`);
+        try {
+            const { exitCode: buildExitCode } = await execAsync('go', ['build', '-trimpath', '-o', tmpBinaryPath, './wrapper'], {
+                cwd: buildDir,
+                stdio: 'inherit',
+            });
+            if (buildExitCode !== 0) {
+                throw new Error(`Go compilation failed (exit code ${buildExitCode})`);
+            }
+            fs.renameSync(tmpBinaryPath, binaryPath);
+        }
+        finally {
+            fs.rmSync(tmpBinaryPath, { force: true });
+        }
+        console.log('Build complete');
+        return binaryPath;
     }
-    const { exitCode: buildExitCode } = await execAsync('go', ['build', '-trimpath', '-o', binaryPath, './wrapper'], {
-        cwd: buildDir,
-        stdio: 'inherit',
-    });
-    if (buildExitCode !== 0) {
-        throw new Error(`Go compilation failed (exit code ${buildExitCode})`);
+    finally {
+        fs.rmSync(buildLockDir, { recursive: true, force: true });
     }
-    console.log('Build complete');
-    return binaryPath;
 }
 export async function lint({ rebuild, tsgolintVersion, passthroughArgs, allWarnings, }) {
     if (!findLintcnDir()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lintcn",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "type": "module",
   "description": "The shadcn for type-aware TypeScript lint rules. Browse, pick, and copy rules into your project.",
   "bin": "dist/cli.js",
@@ -52,6 +52,8 @@
   "devDependencies": {
     "@types/node": "^22.0.0",
     "@types/tar": "^7.0.87",
+    "rimraf": "^6.0.1",
+    "tsx": "^4.20.6",
     "typescript": "5.8.2"
   },
   "dependencies": {
@@ -60,7 +62,8 @@
     "tar": "^7.5.12"
   },
   "scripts": {
-    "build": "rm -rf dist *.tsbuildinfo && tsc && chmod +x dist/cli.js",
-    "cli": "tsx src/cli"
+    "build": "tsc && chmod +x dist/cli.js",
+    "cli": "tsx src/cli.ts",
+    "test": "cd .lintcn && TSGOLINT_SNAPSHOT_CWD=true go test -count=1 ./..."
   }
 }

package/src/cache.ts

@@ -18,15 +18,17 @@ import { execAsync } from './exec.ts'
 // Pinned tsgolint fork commit — updated with each lintcn release.
 // Uses remorses/tsgolint fork which adds internal/runner.Run() and
 // TSGOLINT_SNAPSHOT_CWD env var for cwd-relative test snapshots.
-export const DEFAULT_TSGOLINT_VERSION = '427f872946bb413f0e21cff585b6139c986c89d3'
+export const DEFAULT_TSGOLINT_VERSION = 'c031d7264983dba00bae76eb03532fe3884e5667'
 
 // Pinned typescript-go base commit from microsoft/typescript-go (before patches).
 // Patches from tsgolint/patches/ are applied on top during setup.
 // Must be updated when DEFAULT_TSGOLINT_VERSION changes.
-const TYPESCRIPT_GO_COMMIT = 'c0703e66b68b826eedadce353d63fe9f4ea21fb6'
+const TYPESCRIPT_GO_COMMIT = '0970dc40fa8308ca76627ffcc3a992414fdf1cf2'
 
 // Strict pattern for version strings — prevents path traversal via ../
 const VERSION_PATTERN = /^[a-zA-Z0-9._-]+$/
+const CACHE_LOCK_RETRY_MS = 100
+const CACHE_LOCK_TIMEOUT_MS = 10 * 60_000
 
 /** Validate version string to prevent path traversal attacks.
  *  Only allows alphanumeric chars, dots, underscores, and hyphens. */
@@ -60,6 +62,45 @@ export function getBuildDir(contentHash: string): string {
   return path.join(getCacheDir(), 'build', contentHash)
 }
 
+/** Per-hash lock directory used while generating and compiling a build workspace. */
+export function getBuildLockDir(contentHash: string): string {
+  return path.join(getCacheDir(), 'locks', 'build', contentHash)
+}
+
+/** Per-version lock directory used while populating cached tsgolint source. */
+export function getTsgolintSourceLockDir(version: string): string {
+  return path.join(getCacheDir(), 'locks', 'tsgolint', version)
+}
+
+async function wait(ms: number): Promise<void> {
+  await new Promise((resolve) => {
+    setTimeout(resolve, ms)
+  })
+}
+
+export async function acquireCacheLock(lockDir: string, description: string): Promise<string> {
+  fs.mkdirSync(path.dirname(lockDir), { recursive: true })
+
+  const startedAt = Date.now()
+  while (true) {
+    try {
+      fs.mkdirSync(lockDir)
+      return lockDir
+    } catch (error) {
+      if (error?.code !== 'EEXIST') {
+        throw error
+      }
+      if (Date.now() - startedAt > CACHE_LOCK_TIMEOUT_MS) {
+        throw new Error(
+          `Timed out waiting for ${description}: ${lockDir}. ` +
+          'If no lintcn process is running, delete this directory and retry.',
+        )
+      }
+      await wait(CACHE_LOCK_RETRY_MS)
+    }
+  }
+}
+
 /** Download a tarball from URL and extract it to targetDir.
  *  Uses the `tar` npm package for cross-platform support (no shell tar needed).
  *  GitHub tarballs have a top-level directory like `repo-ref/`,
@@ -126,64 +167,74 @@ export async function ensureTsgolintSource(version: string): Promise<string> {
     return sourceDir
   }
 
-  // Use a temp directory for the download, then atomic rename on success.
-  // This prevents concurrent processes from seeing partial state, and
-  // avoids the "non-empty dir on retry" problem.
-  const tmpDir = path.join(getCacheDir(), 'tsgolint', `.tmp-${version}-${crypto.randomBytes(4).toString('hex')}`)
-
-  // clean up any partial previous attempt
-  if (fs.existsSync(sourceDir)) {
-    fs.rmSync(sourceDir, { recursive: true })
-  }
-
+  const sourceLockDir = await acquireCacheLock(
+    getTsgolintSourceLockDir(version),
+    `tsgolint source lock for ${version}`,
+  )
   try {
-    // download tsgolint fork tarball
-    console.log(`Downloading tsgolint@${version.slice(0, 8)}...`)
-    const tsgolintUrl = `https://github.com/remorses/tsgolint/archive/${version}.tar.gz`
-    await downloadAndExtract(tsgolintUrl, tmpDir)
-
-    // download typescript-go from microsoft (base commit before patches)
-    const tsGoDir = path.join(tmpDir, 'typescript-go')
-    console.log('Downloading typescript-go...')
-    const tsGoUrl = `https://github.com/microsoft/typescript-go/archive/${TYPESCRIPT_GO_COMMIT}.tar.gz`
-    await downloadAndExtract(tsGoUrl, tsGoDir)
-
-    // apply tsgolint's patches to typescript-go
-    const patchesDir = path.join(tmpDir, 'patches')
-    if (fs.existsSync(patchesDir)) {
-      const count = await applyPatches(patchesDir, tsGoDir)
-      if (count > 0) {
-        console.log(`Applied ${count} patches`)
-      }
+    if (fs.existsSync(readyMarker)) {
+      return sourceDir
     }
 
-    // copy internal/collections from typescript-go (required by tsgolint, done by `just init`)
-    const collectionsDir = path.join(tmpDir, 'internal', 'collections')
-    const tsGoCollections = path.join(tsGoDir, 'internal', 'collections')
-    if (fs.existsSync(tsGoCollections)) {
-      fs.mkdirSync(collectionsDir, { recursive: true })
-      const files = fs.readdirSync(tsGoCollections).filter((f) => {
-        return f.endsWith('.go') && !f.endsWith('_test.go')
-      })
-      for (const file of files) {
-        fs.copyFileSync(path.join(tsGoCollections, file), path.join(collectionsDir, file))
+    // Use a temp directory for the download, then atomic rename on success.
+    // This prevents concurrent processes from seeing partial state, and
+    // avoids the "non-empty dir on retry" problem.
+    const tmpDir = path.join(getCacheDir(), 'tsgolint', `.tmp-${version}-${crypto.randomBytes(4).toString('hex')}`)
+
+    // clean up any partial previous attempt
+    fs.rmSync(sourceDir, { recursive: true, force: true })
+
+    try {
+      // download tsgolint fork tarball
+      console.log(`Downloading tsgolint@${version.slice(0, 8)}...`)
+      const tsgolintUrl = `https://github.com/remorses/tsgolint/archive/${version}.tar.gz`
+      await downloadAndExtract(tsgolintUrl, tmpDir)
+
+      // download typescript-go from microsoft (base commit before patches)
+      const tsGoDir = path.join(tmpDir, 'typescript-go')
+      console.log('Downloading typescript-go...')
+      const tsGoUrl = `https://github.com/microsoft/typescript-go/archive/${TYPESCRIPT_GO_COMMIT}.tar.gz`
+      await downloadAndExtract(tsGoUrl, tsGoDir)
+
+      // apply tsgolint's patches to typescript-go
+      const patchesDir = path.join(tmpDir, 'patches')
+      if (fs.existsSync(patchesDir)) {
+        const count = await applyPatches(patchesDir, tsGoDir)
+        if (count > 0) {
+          console.log(`Applied ${count} patches`)
+        }
+      }
+
+      // copy internal/collections from typescript-go (required by tsgolint, done by `just init`)
+      const collectionsDir = path.join(tmpDir, 'internal', 'collections')
+      const tsGoCollections = path.join(tsGoDir, 'internal', 'collections')
+      if (fs.existsSync(tsGoCollections)) {
+        fs.mkdirSync(collectionsDir, { recursive: true })
+        const files = fs.readdirSync(tsGoCollections).filter((f) => {
+          return f.endsWith('.go') && !f.endsWith('_test.go')
+        })
+        for (const file of files) {
+          fs.copyFileSync(path.join(tsGoCollections, file), path.join(collectionsDir, file))
+        }
       }
-    }
 
-    // write ready marker
-    fs.writeFileSync(path.join(tmpDir, '.lintcn-ready'), new Date().toISOString())
+      // write ready marker
+      fs.writeFileSync(path.join(tmpDir, '.lintcn-ready'), new Date().toISOString())
 
-    // atomic rename: move completed dir to final location
-    fs.mkdirSync(path.dirname(sourceDir), { recursive: true })
-    fs.renameSync(tmpDir, sourceDir)
+      // atomic rename: move completed dir to final location
+      fs.mkdirSync(path.dirname(sourceDir), { recursive: true })
+      fs.renameSync(tmpDir, sourceDir)
 
-    console.log('tsgolint source ready')
-  } catch (err) {
-    // clean up partial temp directory
-    if (fs.existsSync(tmpDir)) {
-      fs.rmSync(tmpDir, { recursive: true })
+      console.log('tsgolint source ready')
+    } catch (err) {
+      // clean up partial temp directory
+      if (fs.existsSync(tmpDir)) {
+        fs.rmSync(tmpDir, { recursive: true })
+      }
+      throw err
     }
-    throw err
+  } finally {
+    fs.rmSync(sourceLockDir, { recursive: true, force: true })
   }
 
   return sourceDir

package/src/codegen.ts

@@ -89,16 +89,12 @@ export function generateBuildWorkspace({
 
   // symlink tsgolint source
   const tsgolintLink = path.join(buildDir, 'tsgolint')
-  if (fs.existsSync(tsgolintLink)) {
-    fs.rmSync(tsgolintLink, { recursive: true })
-  }
+  fs.rmSync(tsgolintLink, { recursive: true, force: true })
   fs.symlinkSync(tsgolintDir, tsgolintLink)
 
   // symlink user rules
   const rulesLink = path.join(buildDir, 'rules')
-  if (fs.existsSync(rulesLink)) {
-    fs.rmSync(rulesLink, { recursive: true })
-  }
+  fs.rmSync(rulesLink, { recursive: true, force: true })
   fs.symlinkSync(path.resolve(lintcnDir), rulesLink)
 
   // go.work

package/src/commands/lint.ts

@@ -3,11 +3,21 @@
 
 import fs from 'node:fs'
 import path from 'node:path'
+import crypto from 'node:crypto'
 import { spawn } from 'node:child_process'
 import { requireLintcnDir, findLintcnDir } from '../paths.ts'
 import { discoverRules, type RuleMetadata } from '../discover.ts'
 import { generateBuildWorkspace, generateEditorGoFiles } from '../codegen.ts'
-import { ensureTsgolintSource, validateVersion, cachedBinaryExists, getBinaryPath, getBuildDir, getBinDir } from '../cache.ts'
+import {
+  ensureTsgolintSource,
+  validateVersion,
+  cachedBinaryExists,
+  getBinaryPath,
+  getBuildDir,
+  getBinDir,
+  getBuildLockDir,
+  acquireCacheLock,
+} from '../cache.ts'
 import { computeContentHash } from '../hash.ts'
 import { execAsync } from '../exec.ts'
 
@@ -56,44 +66,66 @@ export async function buildBinary({
     return getBinaryPath(contentHash)
   }
 
-  // ensure .lintcn/go.mod exists (gitignored, needed by the build workspace symlink)
-  generateEditorGoFiles(lintcnDir)
+  const buildLockDir = await acquireCacheLock(
+    getBuildLockDir(contentHash),
+    `build lock for ${contentHash}`,
+  )
+  try {
+    if (!rebuild && cachedBinaryExists(contentHash)) {
+      console.log('Using cached binary')
+      return getBinaryPath(contentHash)
+    }
 
-  // generate build workspace (per-hash dir to avoid races between concurrent processes)
-  const buildDir = getBuildDir(contentHash)
-  console.log('Generating build workspace...')
-  generateBuildWorkspace({
-    buildDir,
-    tsgolintDir,
-    lintcnDir,
-    rules,
-  })
+    // ensure .lintcn/go.mod exists (gitignored, needed by the build workspace symlink)
+    generateEditorGoFiles(lintcnDir)
+
+    // generate build workspace (per-hash dir to avoid races between concurrent processes)
+    const buildDir = getBuildDir(contentHash)
+    console.log('Generating build workspace...')
+    generateBuildWorkspace({
+      buildDir,
+      tsgolintDir,
+      lintcnDir,
+      rules,
+    })
 
-  // compile
-  const binDir = getBinDir()
-  fs.mkdirSync(binDir, { recursive: true })
-  const binaryPath = getBinaryPath(contentHash)
-
-  // Check if any lintcn binary has been built before — if not, this is a cold
-  // build that compiles the full tsgolint + typescript-go dependency tree.
-  const existingBins = fs.existsSync(binDir) ? fs.readdirSync(binDir) : []
-  if (existingBins.length === 0) {
-    console.log('Compiling custom tsgolint binary (first build — may take 30s+ to compile dependencies)...')
-    console.log('Subsequent builds will be fast (~1s). In CI, cache ~/.cache/lintcn/ and GOCACHE (run `go env GOCACHE`).')
-  } else {
-    console.log('Compiling custom tsgolint binary...')
-  }
+    // compile
+    const binDir = getBinDir()
+    fs.mkdirSync(binDir, { recursive: true })
+    const binaryPath = getBinaryPath(contentHash)
+
+    // Check if any lintcn binary has been built before — if not, this is a cold
+    // build that compiles the full tsgolint + typescript-go dependency tree.
+    const existingBins = fs.existsSync(binDir) ? fs.readdirSync(binDir) : []
+    if (existingBins.length === 0) {
+      console.log('Compiling custom tsgolint binary (first build — may take 30s+ to compile dependencies)...')
+      console.log('Subsequent builds will be fast (~1s). In CI, cache ~/.cache/lintcn/ and GOCACHE (run `go env GOCACHE`).')
+    } else {
+      console.log('Compiling custom tsgolint binary...')
+    }
 
-  const { exitCode: buildExitCode } = await execAsync('go', ['build', '-trimpath', '-o', binaryPath, './wrapper'], {
-    cwd: buildDir,
-    stdio: 'inherit',
-  })
-  if (buildExitCode !== 0) {
-    throw new Error(`Go compilation failed (exit code ${buildExitCode})`)
-  }
+    const tmpBinaryPath = path.join(
+      binDir,
+      `${contentHash}.tmp-${process.pid}-${crypto.randomBytes(4).toString('hex')}`,
+    )
+    try {
+      const { exitCode: buildExitCode } = await execAsync('go', ['build', '-trimpath', '-o', tmpBinaryPath, './wrapper'], {
+        cwd: buildDir,
+        stdio: 'inherit',
+      })
+      if (buildExitCode !== 0) {
+        throw new Error(`Go compilation failed (exit code ${buildExitCode})`)
+      }
+      fs.renameSync(tmpBinaryPath, binaryPath)
+    } finally {
+      fs.rmSync(tmpBinaryPath, { force: true })
+    }
 
-  console.log('Build complete')
-  return binaryPath
+    console.log('Build complete')
+    return binaryPath
+  } finally {
+    fs.rmSync(buildLockDir, { recursive: true, force: true })
+  }
 }
 
 export async function lint({