eslint.config.mjs

// @ts-check
import eslint from "@eslint/js";
import sonarjs from "eslint-plugin-sonarjs";
import unicorn from "eslint-plugin-unicorn";
import tseslint from "typescript-eslint";

export default [
  eslint.configs.recommended,
  ...tseslint.configs.recommended,
  /** @type {any} */ (sonarjs.configs?.recommended ?? {}),
  unicorn.configs["recommended"],
  {
    languageOptions: {
      parserOptions: {
        projectService: true,
        tsconfigRootDir: import.meta.dirname,
      },
    },
    rules: {
      // === Security (existing) ===
      "no-eval": "error",
      "no-implied-eval": "error",
      "no-new-func": "error",

      // === B1-B7: Basic quality (ts-linter-ruleset-standard) ===
      "no-var": "error", // B1
      "prefer-const": "error", // B2
      // B3/B4: @typescript-eslint/no-unused-vars (below)
      eqeqeq: "error", // B5
      // B6: no-debugger already in eslint.configs.recommended
      "no-console": ["warn", { allow: ["warn", "error"] }], // B7

      // === Guardrail #7: Cognitive Complexity ===
      "sonarjs/cognitive-complexity": ["error", 15],

      // === Guardrail #9: Bit ops / legacy API ===
      "no-bitwise": "error",
      "unicorn/prefer-number-properties": "error",

      // === Guardrail #12: Modern API ===
      "@typescript-eslint/prefer-optional-chain": "error",
      "unicorn/prefer-node-protocol": "error",
      "unicorn/prefer-regexp-test": "error",
      "unicorn/prefer-string-starts-ends-with": "error",

      // === Guardrail #14: Promise quality ===
      "prefer-promise-reject-errors": "error",
      "@typescript-eslint/no-floating-promises": "error",

      // === Guardrail #16: SonarQube patterns ===
      "no-duplicate-imports": "error",
      "unicorn/prefer-string-replace-all": "error",
      "unicorn/prefer-set-has": "error",
      "unicorn/numeric-separators-style": "error",
      "@typescript-eslint/no-unnecessary-type-assertion": "error",

      // === INFO-16: Dangerous child_process imports ===
      "no-restricted-imports": [
        "error",
        {
          paths: [
            {
              name: "node:child_process",
              importNames: ["exec", "execSync"],
              message:
                "exec()/execSync() pass commands through a shell, enabling injection. Use execFile() via security/secureExec.ts instead.",
            },
            {
              name: "child_process",
              importNames: ["exec", "execSync"],
              message:
                "exec()/execSync() pass commands through a shell, enabling injection. Use execFile() via security/secureExec.ts instead.",
            },
          ],
        },
      ],

      // === Project-specific security rules ===
      "no-magic-numbers": [
        "error",
        {
          ignore: [0, 1, -1, 2, 10, 100, 1000],
          ignoreArrayIndexes: true,
          ignoreDefaultValues: true,
        },
      ],
      "no-restricted-syntax": [
        "error",
        {
          selector: "Literal[regex]",
          message:
            "Import pattern constants from core/constants.ts or validators/common.ts instead of inline regex",
        },
      ],
      "@typescript-eslint/no-unsafe-call": "warn",
      "@typescript-eslint/no-unsafe-assignment": "warn",
      "@typescript-eslint/no-unsafe-member-access": "warn",
      "@typescript-eslint/no-explicit-any": "error",
      "@typescript-eslint/explicit-function-return-type": "warn",
      "@typescript-eslint/no-unused-vars": [
        "error",
        {
          argsIgnorePattern: "^_",
          varsIgnorePattern: "^_",
          caughtErrorsIgnorePattern: "^_|^error$",
        },
      ],

      // === Unicorn overrides (disable overly opinionated rules) ===
      "unicorn/no-null": "off",
      "unicorn/prevent-abbreviations": "off",
      // userName/userEmail/userSigningKey mirror git config keys (user.name/user.email/user.signingkey);
      // "username" connotes a login handle, which these display-name values are not
      "unicorn/consistent-compound-words": [
        "error",
        { replacements: { userName: false } },
      ],
      "unicorn/filename-case": "off",
      "unicorn/no-process-exit": "off",
      "unicorn/prefer-module": "off",
      "unicorn/prefer-top-level-await": "off",
      "unicorn/no-abusive-eslint-disable": "off",
      "unicorn/import-style": "off",
      "unicorn/no-useless-undefined": "off", // TypeScript requires explicit undefined arguments (resolve(undefined), update(key, undefined))
      "unicorn/no-useless-error-capture-stack-trace": "off", // V8-specific Error.captureStackTrace is guarded by if-check for non-V8 engines

      // ADR-00240 Phase 1: disable v67 rules that conflict with VS Code extension patterns.
      "unicorn/no-top-level-assignment-in-function": "off",
      "unicorn/no-top-level-side-effects": "off",
      "unicorn/no-non-function-verb-prefix": "off",
      "unicorn/no-error-property-assignment": "off",

      // ADR-00240 Phase 1: keep remaining v67 findings visible while unblocking CI.
      "unicorn/prefer-await": "warn",
      "unicorn/max-nested-calls": "warn",
      "unicorn/consistent-boolean-name": "warn",
      "unicorn/no-computed-property-existence-check": "warn",
      "unicorn/consistent-class-member-order": "warn",
      "unicorn/no-break-in-nested-loop": "warn",
      "unicorn/no-unsafe-string-replacement": "warn",
      "unicorn/prefer-unicode-code-point-escapes": "warn",
      "unicorn/prefer-early-return": "warn",
      "unicorn/prefer-number-coercion": "warn",
      "unicorn/no-declarations-before-early-exit": "warn",
      "unicorn/no-incorrect-template-string-interpolation": "warn",
      "unicorn/no-unreadable-array-destructuring": "warn",
      "unicorn/number-literal-case": "warn",
      "unicorn/require-array-sort-compare": "warn",
      "unicorn/no-optional-chaining-on-undeclared-variable": "warn",
      "unicorn/prefer-iterator-to-array": "warn",
      "unicorn/prefer-minimal-ternary": "warn",
      "unicorn/prefer-uint8array-base64": "warn",
      "unicorn/prefer-private-class-fields": "warn",
    },
    linterOptions: {
      reportUnusedDisableDirectives: "warn",
    },
  },
  {
    files: ["**/*.test.ts"],
    rules: {
      "@typescript-eslint/no-explicit-any": "off",
      "@typescript-eslint/no-unsafe-assignment": "off",
      "@typescript-eslint/no-unsafe-member-access": "off",
      "@typescript-eslint/no-unsafe-call": "off",
      "@typescript-eslint/explicit-function-return-type": "off",
      "no-magic-numbers": "off",
      "no-restricted-syntax": "off",
      "no-console": "off",
      "no-bitwise": "off",

      // === sonarjs overrides (test-inappropriate rules) ===
      "sonarjs/no-empty-test-file": "off", // sonarjs doesn't detect mocha describe/it blocks
      "sonarjs/publicly-writable-directories": "off", // tests legitimately use /tmp paths
      "sonarjs/no-hardcoded-passwords": "off", // tests contain test credentials by design
      "sonarjs/file-permissions": "off", // tests validate permission behavior
      "sonarjs/no-os-command-from-path": "off", // tests validate command execution
      "sonarjs/deprecation": "off", // tests may exercise deprecated APIs intentionally
      "sonarjs/no-nested-functions": "off", // helpers inside describe blocks are idiomatic
      "sonarjs/no-redundant-jump": "off", // mock functions need explicit return for TS types
      "sonarjs/no-redundant-optional": "off", // test type definitions use explicit | undefined
      "sonarjs/prefer-regexp-exec": "off", // match() is readable in test assertions
      "sonarjs/different-types-comparison": "off", // tests verify cross-type behavior
      "sonarjs/no-alphabetical-sort": "off", // alphabetical sort in test assertions is intentional
      "sonarjs/slow-regex": "off", // tests may mirror production regex patterns
      "sonarjs/no-unused-collection": "off", // test setup arrays may appear unused

      // === unicorn overrides (test-inappropriate rules) ===
      "unicorn/consistent-function-scoping": "off", // helpers inside describe blocks are idiomatic
      "unicorn/no-array-sort": "off", // toSorted() requires ES2023+ lib not in tsconfig
      "unicorn/prefer-number-properties": "off", // isNaN() is clearer in test assertions
      "unicorn/text-encoding-identifier-case": "off", // tests may use 'utf-8' matching external APIs
      "unicorn/prefer-code-point": "off", // charCodeAt() in tests mirrors production code
      "unicorn/no-this-outside-of-class": "off", // mocha function-style hooks use this.timeout()
      "unicorn/prefer-https": "off", // http:// URLs are intentional test data for URL validation
    },
  },
  {
    files: [
      "**/validators/common.ts",
      "**/core/constants.ts",
      "**/ui/htmlTemplates/csp.ts",
      "**/ui/htmlTemplates/shell.ts",
    ],
    rules: {
      "no-restricted-syntax": "off",
      "no-magic-numbers": "off",
    },
  },
  // Temporary: existing files with patterns/magic numbers to be refactored
  // Remove files from this list after refactoring (Issue-00071)
  {
    files: [
      "**/core/errors.ts",
      "**/core/submodule.ts",
      "**/logging/fileLogWriter.ts",
      "**/logging/logTypes.ts",
      "**/security/binaryResolver.ts",
      "**/security/flagValidator.ts",
      "**/security/pathSanitizer.ts",
      "**/security/pathTraversalDetector.ts",
      "**/security/pathValidator.ts",
      "**/security/secureExec.ts",
      "**/security/securityLogger.ts",
      "**/security/sensitiveDataDetector.ts",
      "**/ssh/sshAgent.ts",
      "**/ui/documentationInternal.ts",
      "**/ui/documentationPublic.ts",
      "**/ui/webview.ts",
    ],
    rules: {
      "no-magic-numbers": "off",
      "no-restricted-syntax": "off",
    },
  },
  {
    files: ["**/test/run*.ts"],
    rules: {
      "no-console": "off",
    },
  },
  {
    ignores: [
      "out/**",
      "node_modules/**",
      "coverage/**",
      "scripts/**",
      ".vscode-test/**",
      "*.js",
      "*.mjs",
    ],
  },
];