fix(eslint-rules): make base-hook runtime reach cycle-safe

Cache in-progress reach results to preserve transitive closure across import cycles, normalize diagnostic paths cross-platform, and add cyclic regression fixtures/tests.

Author: Hotell

tools/eslint-rules/rules/__fixtures__/base-hook-no-forbidden-runtime/stubs/cyclic-heavy-pkg/a.ts

@@ -0,0 +1,7 @@
+import { useB } from './b';
+import { runHeavy } from 'heavy-runtime';
+
+export function useA(): number {
+  runHeavy();
+  return useB() + 1;
+}

tools/eslint-rules/rules/__fixtures__/base-hook-no-forbidden-runtime/stubs/cyclic-heavy-pkg/b.ts

@@ -0,0 +1,6 @@
+import { useA } from './a';
+
+export function useB(): number {
+  // Keep the static import cycle while avoiding direct execution recursion.
+  return (useA as unknown as () => number).length;
+}

tools/eslint-rules/rules/__fixtures__/base-hook-no-forbidden-runtime/stubs/cyclic-heavy-pkg/index.ts

@@ -0,0 +1,3 @@
+// Cyclic graph where `a` imports a forbidden runtime and `b` reaches it only transitively.
+export { useA } from './a';
+export { useB } from './b';

tools/eslint-rules/rules/__fixtures__/base-hook-no-forbidden-runtime/tsconfig.json

@@ -14,7 +14,8 @@
       "watched-pkg/*": ["./stubs/watched-pkg/*"],
       "heavy-runtime": ["./stubs/heavy-runtime/index.ts"],
       "light-helper": ["./stubs/light-helper/index.ts"],
-      "cyclic-pkg": ["./stubs/cyclic-pkg/index.ts"]
+      "cyclic-pkg": ["./stubs/cyclic-pkg/index.ts"],
+      "cyclic-heavy-pkg": ["./stubs/cyclic-heavy-pkg/index.ts"]
     }
   },
   "include": ["src/**/*.ts", "src/**/*.tsx", "stubs/**/*.ts"]

tools/eslint-rules/rules/base-hook-no-forbidden-runtime.spec.ts

@@ -241,6 +241,36 @@ typedRuleTester.run(`${RULE_NAME} (typed)`, rule, {
         },
       ],
     },
+    // Regression: when the defining symbol lives on one node of a cycle, forbidden runtime
+    // imported by another node in that cycle must still appear in transitive reach.
+    {
+      languageOptions: typedLanguageOptions,
+      filename: TYPED_FILENAME,
+      options: [
+        {
+          watchedPackages: ['cyclic-heavy-pkg'],
+          forbiddenRuntimes: ['heavy-runtime'],
+        },
+      ],
+      code: `
+          import { useB } from 'cyclic-heavy-pkg';
+          export const useThingBase_unstable = (props: { a: number }, ref) => {
+            return { props, ref, value: useB() };
+          };
+        `,
+      errors: [
+        {
+          messageId: 'forbiddenRuntimeReach',
+          data: {
+            hookName: 'useThingBase_unstable',
+            importedName: 'useB',
+            package: 'cyclic-heavy-pkg',
+            runtime: 'heavy-runtime',
+            viaFile: 'rules/__fixtures__/base-hook-no-forbidden-runtime/stubs/cyclic-heavy-pkg/b.ts',
+          },
+        },
+      ],
+    },
     // Aliased import from a forbidden-runtime package is still flagged on the alias use site.
     {
       languageOptions: typedLanguageOptions,

tools/eslint-rules/rules/base-hook-no-forbidden-runtime.ts

@@ -1,5 +1,6 @@
 import type { TSESTree, TSESLint, ParserServicesWithTypeInformation } from '@typescript-eslint/utils';
 import { ESLintUtils, AST_NODE_TYPES } from '@typescript-eslint/utils';
+import * as path from 'node:path';
 import * as ts from 'typescript';
 
 // NOTE: The rule will be available in ESLint configs as "@nx/workspace-base-hook-no-forbidden-runtime"
@@ -100,8 +101,6 @@ interface Reach {
   all: ReadonlySet<string>;
 }
 
-const EMPTY_REACH: Reach = { value: new Set(), all: new Set() };
-
 /**
  * Per-Program cache: source file path → reach sets transitively computed from that file.
  * Both `value` and `all` sets are filled in a single DFS pass to share resolution work.
@@ -497,58 +496,60 @@ function transitiveReach(program: ts.Program, sourceFile: ts.SourceFile): Reach
 /**
  * Recursive worker for `transitiveReach`. Walks the import graph DFS, recording every bare
  * specifier encountered (separately for value-only vs value+type follow modes) and recursing into
- * each resolved source file. Uses `inProgress` to break cycles (cycle hits return empty sets
- * without caching, so the originating call still commits the complete result).
+ * each resolved source file. Uses `inProgress` to break cycles by returning the already-cached,
+ * in-progress reach object for the cycle participant.
  */
 function computeReach(
   program: ts.Program,
   sourceFile: ts.SourceFile,
   cache: Map<string, Reach>,
   inProgress: Set<string>,
 ): Reach {
-  const cached = cache.get(sourceFile.fileName);
+  const fileName = sourceFile.fileName;
+  const cached = cache.get(fileName);
   if (cached) {
     return cached;
   }
-  if (inProgress.has(sourceFile.fileName)) {
-    // Cycle: return empty sets without caching so the eventual full result is committed by the originator.
-    return EMPTY_REACH;
-  }
-  inProgress.add(sourceFile.fileName);
-
   const value = new Set<string>();
   const all = new Set<string>();
-  for (const imp of collectImports(sourceFile)) {
-    if (isBareSpecifier(imp.specifier)) {
-      const pkg = packageNameOf(imp.specifier);
-      all.add(pkg);
-      if (!imp.typeOnly) {
-        value.add(pkg);
+  const result: Reach = { value, all };
+  cache.set(fileName, result);
+  if (inProgress.has(fileName)) {
+    return result;
+  }
+  inProgress.add(fileName);
+
+  try {
+    for (const imp of collectImports(sourceFile)) {
+      if (isBareSpecifier(imp.specifier)) {
+        const pkg = packageNameOf(imp.specifier);
+        all.add(pkg);
+        if (!imp.typeOnly) {
+          value.add(pkg);
+        }
       }
-    }
-    const resolved = resolveModule(program, sourceFile, imp.specifier, imp.literal);
-    if (!resolved) {
-      continue;
-    }
-    const childSourceFile = program.getSourceFile(resolved);
-    if (!childSourceFile) {
-      continue;
-    }
-    const childReach = computeReach(program, childSourceFile, cache, inProgress);
-    for (const pkg of childReach.all) {
-      all.add(pkg);
-    }
-    if (!imp.typeOnly) {
-      // A type-only edge does not propagate runtime reach: it can only widen the `all` set.
-      for (const pkg of childReach.value) {
-        value.add(pkg);
+      const resolved = resolveModule(program, sourceFile, imp.specifier, imp.literal);
+      if (!resolved) {
+        continue;
+      }
+      const childSourceFile = program.getSourceFile(resolved);
+      if (!childSourceFile) {
+        continue;
+      }
+      const childReach = computeReach(program, childSourceFile, cache, inProgress);
+      for (const pkg of childReach.all) {
+        all.add(pkg);
+      }
+      if (!imp.typeOnly) {
+        // A type-only edge does not propagate runtime reach: it can only widen the `all` set.
+        for (const pkg of childReach.value) {
+          value.add(pkg);
+        }
       }
     }
+  } finally {
+    inProgress.delete(fileName);
   }
-
-  inProgress.delete(sourceFile.fileName);
-  const result: Reach = { value, all };
-  cache.set(sourceFile.fileName, result);
   return result;
 }
 
@@ -691,14 +692,22 @@ function packageNameOf(specifier: string): string {
  * path workspace-relative when inside the current working directory.
  */
 function shortenPath(absolute: string): string {
-  const marker = '/node_modules/';
-  const idx = absolute.lastIndexOf(marker);
-  if (idx !== -1) {
-    return absolute.slice(idx + marker.length);
+  const resolvedAbsolute = path.resolve(absolute);
+  const normalizedAbsolute = toPosixPath(resolvedAbsolute);
+  const segments = normalizedAbsolute.split('/');
+  const nodeModulesIdx = segments.lastIndexOf('node_modules');
+  if (nodeModulesIdx !== -1 && nodeModulesIdx + 1 < segments.length) {
+    return segments.slice(nodeModulesIdx + 1).join('/');
   }
-  const cwd = process.cwd();
-  if (absolute.startsWith(cwd)) {
-    return absolute.slice(cwd.length + 1);
+
+  const relative = path.relative(path.resolve(process.cwd()), resolvedAbsolute);
+  if (relative.length > 0 && !relative.startsWith('..') && !path.isAbsolute(relative)) {
+    return toPosixPath(relative);
   }
-  return absolute;
+
+  return normalizedAbsolute;
+}
+
+function toPosixPath(value: string): string {
+  return value.replace(/\\/g, '/');
 }