feat(eslint-plugin): add rules for detecting potential issues by tasshi-me · Pull Request #3616 · kintone/js-sdk

tasshi-me · 2026-02-10T07:54:59Z

Why

Add new ESLint rules to @kintone/eslint-plugin to detect usage of internal APIs and CSS classes that should not be used in kintone customization and plugin development.

These rules are transferred from kintone/cli-kintone#1228 .

What

New Rules

no-cybozu-data: Prevents access to cybozu.data, an internal and unsupported API that may change without notice
no-kintone-internal-selector: Prevents the use of internal kintone UI class names (gaia-argoui-*, *-gaia, ocean-*, kintone-*)

Config Restructuring

recommended: Includes the two new rules (works without manifest file)
manifestV2: Includes only-allowed-js-api rule (for plugins with manifest_version v2, experimental)

Documentation

Added documentation for each rule
Added docs/experimental-new-plugin-system.md
Updated package description to "kintone customization and plugin development"
Added eslint-plugin to the root README package list

How to test

cd packages/eslint-plugin
pnpm test
pnpm lint

Checklist

Read CONTRIBUTING.md
Updated documentation if it is required.
Added tests if it is required.
Passed pnpm lint and pnpm test on the root directory.

Copilot

Pull request overview

Adds new ESLint rules to @kintone/eslint-plugin to flag usage of internal/unsupported kintone APIs and internal UI selectors, along with config/documentation updates.

Changes:

Added two new rules: no-cybozu-data and no-kintone-internal-selector (with tests + docs)
Updated flat configs: recommended (new rules) and manifestV2 (experimental plugin system)
Updated package/README documentation and root package list

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
packages/eslint-plugin/src/rules/no-kintone-internal-selector.ts	Implements rule to detect internal CSS class usage in selectors and string literals
packages/eslint-plugin/src/rules/no-cybozu-data.ts	Implements rule to detect `cybozu.data` access
packages/eslint-plugin/src/rules/index.ts	Exposes the two new rules from the plugin
packages/eslint-plugin/src/index.ts	Extends flat configs to include the new rules and adjusts typing
packages/eslint-plugin/tests/rules/no-kintone-internal-selector.test.ts	Adds test cases for internal selector detection
packages/eslint-plugin/tests/rules/no-cybozu-data.test.ts	Adds test cases for `cybozu.data` access detection
packages/eslint-plugin/docs/rules/no-kintone-internal-selector.md	Documents the selector rule with examples
packages/eslint-plugin/docs/rules/no-cybozu-data.md	Documents the `cybozu.data` rule with examples
packages/eslint-plugin/docs/experimental-new-plugin-system.md	Adds guidance for experimental manifest v2 config
packages/eslint-plugin/README.md	Updates plugin description and rule list; links experimental doc
packages/eslint-plugin/package.json	Updates package description
README.md	Adds eslint-plugin to monorepo package list

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-10T08:08:15Z

packages/eslint-plugin/src/rules/no-cybozu-data.ts

+    // Matches:
+    //   cybozu.data
+    //   cybozu["data"]
+    //   cybozu?.data
+    //   cybozu?.["data"]
+    'MemberExpression[object.type="Identifier"][object.name="cybozu"][property.name="data"]':
+      (node: TSESTree.Node) => {
+        context.report({
+          node,
+          messageId: "forbiddenCybozuDataAccess",
+        });
+      },


The AST selector only matches non-computed cybozu.data member expressions. It will not match cybozu[\"data\"] (where property is a Literal) and typically won’t match optional chaining forms (cybozu?.data, cybozu?.[\"data\"]) because they are wrapped in a ChainExpression. Update the selectors to also cover computed property access and optional chaining so the implementation matches the documented intent.

Copilot · 2026-02-10T08:08:16Z

packages/eslint-plugin/tests/rules/no-cybozu-data.test.ts

+  valid: [`const foo = 123;`, `const foo = foo.bar;`],
+  invalid: [
+    {
+      code: `const foo = cybozu.data`,
+      errors: [{ messageId: "forbiddenCybozuDataAccess" }],
+    },
+    {
+      code: `const foo = cybozu.data.abc`,
+      errors: [{ messageId: "forbiddenCybozuDataAccess" }],
+    },
+    {
+      code: `const foo = cybozu.data['abc']`,
+      errors: [{ messageId: "forbiddenCybozuDataAccess" }],
+    },


The rule docs claim it covers cybozu[\"data\"] and optional chaining (cybozu?.data, cybozu?.[\"data\"]), but the tests don’t include these patterns. Add explicit invalid cases for those forms to prevent regressions and to validate the intended coverage.

Copilot · 2026-02-10T08:08:16Z

packages/eslint-plugin/src/rules/no-kintone-internal-selector.ts

+  /[A-Za-z0-9_-]*-gaia/,
+  /ocean-[A-Za-z0-9_-]*/,
+  /kintone-[A-Za-z0-9_-]*/,


The *-gaia pattern (/[A-Za-z0-9_-]*-gaia/) matches foo-gaia as a substring inside longer class names like foo-gaia-bar, even though the docs describe the forbidden form as a suffix (*-gaia). Consider tightening the regex to require a boundary after -gaia (e.g., negative lookahead for [A-Za-z0-9_-]) so foo-gaia-bar doesn’t get flagged as an unintended false positive.

Suggested change

/[A-Za-z0-9_-]*-gaia/,

/ocean-[A-Za-z0-9_-]*/,

/kintone-[A-Za-z0-9_-]*/,

/[A-Za-z0-9_-]*-gaia(?![A-Za-z0-9_-])/,

/ocean-[A-Za-z0-9_-]*/,

/kintone-[A-Za-z09_-]*/,

Copilot · 2026-02-10T08:08:17Z

packages/eslint-plugin/tests/rules/no-kintone-internal-selector.test.ts

+ruleTester.run("no-kintone-internal-selector", rule, {
+  valid: [
+    `element.querySelector('.foo')`,
+    `element.querySelectorAll('.foo')`,
+    `querySelector('.foo')`,
+    `querySelectorAll('.foo')`,
+    `$('.foo')`,
+    `$(document).on('click', '.foo', handler)`,
+  ],


The rule implementation also targets matches and closest, but the tests don’t include coverage for those call sites (valid/invalid). Adding a couple of cases (e.g., element.closest('.gaia-argoui-foo'), element.matches('.ocean-foo')) would better validate the supported API surface.

Copilot · 2026-02-10T08:08:17Z

packages/eslint-plugin/src/rules/no-kintone-internal-selector.ts

@@ -0,0 +1,102 @@
+// import type { CallExpression, Literal } from "estree";


There’s a commented-out import at the top that looks like leftover scaffolding, and the inline NOTE is in Japanese while the rest of the rule/docs are in English. Removing the unused commented import and translating the NOTE to English would improve consistency and long-term maintainability.

Copilot · 2026-02-10T08:08:17Z

packages/eslint-plugin/src/rules/no-kintone-internal-selector.ts

+        callExp: TSESTree.CallExpression,
+      ) => reportForbiddenSelectorCall(context, callExp, checked),
+
+      // NOTE: jQuery 等を含む「怪しい文字列リテラル」検知


There’s a commented-out import at the top that looks like leftover scaffolding, and the inline NOTE is in Japanese while the rest of the rule/docs are in English. Removing the unused commented import and translating the NOTE to English would improve consistency and long-term maintainability.

tasshi-me

実装メモ

tasshi-me · 2026-02-10T08:10:11Z

packages/eslint-plugin/src/rules/index.ts

+  "no-cybozu-data": noCybozuData,
+  "no-kintone-internal-selector": noKintoneInternalSelector,


ルールの作り方はこちら
https://eslint.org/docs/latest/extend/custom-rules

ですが、型の支援が効く @typescript-eslint/utils を使って作成してます。
https://typescript-eslint.io/developers/custom-rules/

Ruleを作るに当たって大きく3つのファイルが必要です。

ルールの実装

ルールのドキュメント（.md）

ルールのテスト

tasshi-me · 2026-02-10T08:11:57Z

packages/eslint-plugin/docs/rules/no-cybozu-data.md

@@ -0,0 +1,30 @@
+# Disallow access to the kintone internal API (`no-cybozu-data`)
+


ルールの説明
例: https://typescript-eslint.io/rules/no-unused-vars/

tasshi-me · 2026-02-10T08:13:04Z

packages/eslint-plugin/src/rules/no-cybozu-data.ts

+/**
+ * Disallow cybozu.data access
+ */
+export const rule = createRule<Options, MessageIds>({


createRuleというヘルパーを使って作成してます。
（ドキュメント周りのリンクなどをルールに追加したりするのを自動でやってくれるヘルパーです。）

tasshi-me · 2026-02-10T08:13:25Z

packages/eslint-plugin/src/rules/no-cybozu-data.ts

+ */
+export const rule = createRule<Options, MessageIds>({
+  name: "no-cybozu-data",
+  meta: {


ルールの詳細はESLintおよびtypescript-eslintのドキュメントを見てください

tasshi-me · 2026-02-10T08:15:11Z

packages/eslint-plugin/src/rules/no-cybozu-data.ts

+    schema: [],
+  },
+  defaultOptions: [],
+  create: (context) => ({


このあたりが実装です。

estreeというASTを使っています。
https://sosukesuzuki.dev/advent/2022/06/

tasshi-me · 2026-02-10T08:23:14Z

packages/eslint-plugin/src/rules/no-kintone-internal-selector.ts

+    },
+    messages: {
+      forbiddenClassname:
+        "Using internal kintone UI class name `{{className}}` is not allowed.",


context.reportの際に任意のデータをメッセージに含めることができて、今回の場合{{className}}がデータです。

tasshi-me · 2026-02-10T08:23:32Z

packages/eslint-plugin/src/rules/no-kintone-internal-selector.ts

+            context.report({
+              node: literal,
+              messageId: "suspiciousClassnameLiteral",
+              data: { className: match[0] },


メッセージに含めるデータはここで指定しています。

tasshi-me · 2026-02-10T08:25:57Z

packages/eslint-plugin/src/index.ts


 const configs = {
  recommended: {
+    files: ["**/*.{js,cjs,mjs,ts,cts,mts,jsx,tsx}"],


ここはプリセットの設定です。
よくeslintのプラグインをインストールしたら、.recommendedみたいな設定をeslint.config.jsで読み込むと思いますがそれです。
もともとはonly-allowed-apiというmanifest_version: 2のときのためのルールが入っていたんですけど、それをmanifestV2というプリセットに待避して、recommendedには今回作成したDOMの非推奨操作に関するルールを入れています。
プリセットは今後ルールが増えてきたら適切な粒度で増やしてあげる良さそうです。

tasshi-me · 2026-02-10T08:26:28Z

packages/eslint-plugin/tests/rules/no-cybozu-data.test.ts

+import { RuleTester } from "@typescript-eslint/rule-tester";
+import { rule } from "../../src/rules/no-cybozu-data.js";
+
+const ruleTester = new RuleTester();


ここで作ったルールのテストをしています。
詳細は https://typescript-eslint.io/packages/rule-tester/ を参照。

tasshi-me · 2026-02-10T08:27:16Z

packages/eslint-plugin/README.md

-| Name                                                       | Description                                                              |
-| ---------------------------------------------------------- | ------------------------------------------------------------------------ |
-| [`only-allowed-js-api`](docs/rules/only-allowed-js-api.md) | Only allow the kintone JS APIs listed in permissions.js_api in manifest. |
+See [docs/experimental-new-plugin-system.md](docs/experimental-new-plugin-system.md) for rules supporting plugins with `manifest_version` set to `2`.


manifest_version: 2向けのルールは、当面実環境で利用できないので、別ページに移動しました。

nameless-mc

一旦途中まで

nameless-mc · 2026-02-10T09:05:01Z

packages/eslint-plugin/src/rules/no-cybozu-data.ts

+    //   cybozu["data"]
+    //   cybozu?.data
+    //   cybozu?.["data"]
+    'MemberExpression[object.type="Identifier"][object.name="cybozu"][property.name="data"]':


#3616 (comment)
copilot の指摘に加えて、window.cybozu.dataも検出できなそう

（どこまで検出するかですが追加で、）一度cybozuを別の変数に格納されると無理そう

nameless-mc · 2026-02-10T09:16:24Z

packages/eslint-plugin/src/rules/no-kintone-internal-selector.ts

+      ) => reportForbiddenSelectorCall(context, callExp, checked),
+
+      // NOTE: jQuery 等を含む「怪しい文字列リテラル」検知
+      Literal: (literal: TSESTree.Literal) => {


Literalしか見てないので`.gaia-argoui-foo`みたいなテンプレートリテラルの場合検出できなそう

nameless-mc · 2026-02-10T09:23:33Z

packages/eslint-plugin/src/index.ts

+    languageOptions: {
+      parserOptions: {
+        projectService: true,
+        tsconfigRootDir: dirname(fileURLToPath(import.meta.url)),
+      },
+    },


requiresTypeChecking: falseしかないので不要そう?

Suggested change

languageOptions: {

parserOptions: {

projectService: true,

tsconfigRootDir: dirname(fileURLToPath(import.meta.url)),

},

},

nameless-mc · 2026-02-10T09:31:02Z

packages/eslint-plugin/src/rules/no-kintone-internal-selector.ts

+  checked: WeakSet<TSESTree.Literal>,
+) => {
+  for (const arg of node.arguments) {
+    if (arg.type === "Literal" && typeof arg.value === "string") {


https://github.com/kintone/js-sdk/pull/3616/changes#r2786760657 と同様

nameless-mc · 2026-02-10T09:34:21Z

packages/eslint-plugin/tests/rules/no-kintone-internal-selector.test.ts

+          messageId: "forbiddenClassname",
+
+          data: { className: `gaia-argoui-foo` },


Suggested change

messageId: "forbiddenClassname",

data: { className: `gaia-argoui-foo` },

messageId: "forbiddenClassname",

data: { className: `gaia-argoui-foo` },

feat(eslint-plugin): add rules for unrecommendable operations

9dec2ba

tasshi-me self-assigned this Feb 10, 2026

tasshi-me marked this pull request as ready for review February 10, 2026 08:06

tasshi-me requested a review from a team as a code owner February 10, 2026 08:06

tasshi-me requested review from a team, chihiro-adachi, Copilot and shabaraba and removed request for a team February 10, 2026 08:06

Copilot AI reviewed Feb 10, 2026

View reviewed changes

tasshi-me commented Feb 10, 2026

View reviewed changes

tasshi-me mentioned this pull request Feb 10, 2026

feat: add plugin check command (Experimental) kintone/cli-kintone#1228

Draft

4 tasks

nameless-mc reviewed Feb 10, 2026

View reviewed changes

tasshi-me changed the title ~~feat(eslint-plugin): add rules for unrecommendable operations~~ feat(eslint-plugin): add rules for detecting potential issues Feb 12, 2026

		@@ -0,0 +1,102 @@
		// import type { CallExpression, Literal } from "estree";

		"no-cybozu-data": noCybozuData,
		"no-kintone-internal-selector": noKintoneInternalSelector,

		@@ -0,0 +1,30 @@
		# Disallow access to the kintone internal API (`no-cybozu-data`)

		messageId: "forbiddenClassname",

		data: { className: `gaia-argoui-foo` },

Conversation

tasshi-me commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

New Rules

Config Restructuring

Documentation

How to test

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

tasshi-me left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nameless-mc left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

tasshi-me commented Feb 10, 2026 •

edited

Loading