From c08dca0087d30aeab7b4b0363f8cc7c61bad1b5c Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 25 Oct 2026 18:58:40 +0000
Subject: [PATCH 1/4] lint: read the directory of a tsconfig.json and of
 --ignore-pattern as a path

With an .oxlintrc.json, a tsconfig.json without `include` applies to the
files below its directory, and an `include` or `exclude` entry that names
a file applies to that file. oxlint compares paths in both cases. `bun
lint` compiled the directory and the entry as one pattern, so a directory
named `[x]` or a file named `[id].ts` was a character class there.

With settings["import/resolver"].typescript, the directory of a
tsconfig.json is a path in its `include` and `exclude` patterns, as in
eslint-import-resolver-typescript.

For the files that go to the installed ESLint, the patterns of
`--ignore-pattern` and of bunfig.toml get their directory as `basePath`
if that ESLint is 9.30 or later, which is what ESLint passes itself. An
older ESLint gets the directory in front of each pattern, as before.
---
 src/lint/driver/for_tests.rs                  |  10 +
 src/lint/glob.rs                              |  27 +
 src/lint/graph/lib.rs                         | 132 +++--
 src/lint/js_plugin/eslint.rs                  |   2 +-
 src/lint/js_plugin/worker/eslint.js           |  24 +-
 src/lint/paths.rs                             |  38 ++
 test/cli/lint/glob.test.ts                    | 463 +++++++++++++++++-
 .../lint/oracle/plugins/oxlint/expected.json  |  18 +-
 .../lint/oracle/plugins/oxlint/projects.ts    |  54 ++
 9 files changed, 715 insertions(+), 53 deletions(-)

diff --git a/src/lint/driver/for_tests.rs b/src/lint/driver/for_tests.rs
index 79cad6b4bc46..ed280cb7ca84 100644
--- a/src/lint/driver/for_tests.rs
+++ b/src/lint/driver/for_tests.rs
@@ -288,6 +288,16 @@ pub fn run_path_tests(args: &[&[u8]]) -> Option<Vec<u8>> {
             b"namespaced" => paths::namespaced(a),
             b"normalize" => paths::normalize(a),
             b"join" => paths::join_normalized(a, b),
+            // `split_joined` with each join that a directory and an option or a `tsconfig.json` entry go through.
+            b"split_resolved" | b"split_joined" | b"split_included" => {
+                let (joined, separators) = match *function {
+                    b"split_resolved" => (paths::resolve_as(style, a, b), style.separators()),
+                    b"split_joined" => (paths::join_normalized(a, b), style.separators()),
+                    _ => (bun_sema::resolve::join(a, b), &b"/\\"[..]),
+                };
+                let (directory, below) = paths::split_joined(a, &[b], separators, &joined);
+                [directory, b" + ", below].concat()
+            }
             _ => return None,
         });
         out.push(b'\n');
diff --git a/src/lint/glob.rs b/src/lint/glob.rs
index 5de78e119c89..10e967dce793 100644
--- a/src/lint/glob.rs
+++ b/src/lint/glob.rs
@@ -235,6 +235,33 @@ impl Minimatch {
     }
 }
 
+/// A pattern for the paths below a directory, with the directory kept out of the pattern. Joined into one pattern, a
+/// directory named `[app]` or `{a,b}` is a class or a group, and matches no path in it. `directory` is compared byte
+/// by byte, and `below` matches the rest of the path.
+pub struct Under<M> {
+    directory: Box<[u8]>,
+    below: M,
+}
+
+impl<M> Under<M> {
+    /// `directory` and the text of `below` are the two parts of [`paths::split_joined`].
+    pub fn new(directory: &[u8], below: M) -> Under<M> {
+        Under {
+            directory: directory.into(),
+            below,
+        }
+    }
+
+    /// The pattern and the part of `path` that it is for, if `path` starts with the directory.
+    pub fn below<'p>(&self, path: &'p [u8]) -> Option<(&M, &'p [u8])> {
+        // Without a directory, `strip_prefix` is a call that compares no bytes.
+        match self.directory.is_empty() {
+            true => Some((&self.below, path)),
+            false => Some((&self.below, path.strip_prefix(&self.directory[..])?)),
+        }
+    }
+}
+
 /// Converts `1..3` from inside braces the way picomatch does. It builds the regex class `[1-3]` from the sorted parts.
 /// If that class is invalid, the text matches literally, without the braces.
 /// Returns `None` unless the parts are letters, digits and `-`.
diff --git a/src/lint/graph/lib.rs b/src/lint/graph/lib.rs
index 2511a465f332..b4219bd3f2c1 100644
--- a/src/lint/graph/lib.rs
+++ b/src/lint/graph/lib.rs
@@ -23,12 +23,13 @@
 use bun_core::strings;
 use bun_glob::{BunGlobWalker, Pattern};
 use bun_lint::ast::File;
+use bun_lint::glob::Under;
 use bun_lint::language::{LanguageOptions, Parser};
 use bun_lint::modules::{
     Declaration, Flavor, Import, ListFiles, Listed, Lookup, MakeRecord, ModuleId, Modules, Reader,
     Record, Request, RequestKind, ResolveBy, Resolved, requests_of,
 };
-use bun_lint::paths::{is_absolute, relative};
+use bun_lint::paths::{is_absolute, relative, split_joined};
 use bun_sema::atom::Interner;
 use bun_sema::bind::{BindOptions, Recycled, bind_for_lint_in};
 use bun_sema::config::{
@@ -146,7 +147,8 @@ struct Caches<'h> {
     resolvers: ShardedMap<Vec<u8>, ProjectResolver<'h>>,
     /// Maps a directory to the `tsconfig.json` path for its files. With [`Store::tsconfig`], the key is a file.
     configs: ShardedMap<Vec<u8>, Vec<u8>>,
-    /// Caches [`Graph::scopes_in`] and [`Graph::scopes_of`].
+    /// Caches [`Graph::scopes_in`] and [`Graph::scopes_of`], and [`Graph::scopes_of_typescript_resolver`] with a NUL
+    /// before the key.
     scopes: ShardedMap<Vec<u8>, Vec<Scope>>,
     /// Caches [`Graph::configs_of_typescript_resolver`], keyed by the directory and the projects, and
     /// [`Graph::listed_projects`], keyed by the projects.
@@ -226,6 +228,34 @@ fn with_file<R>(
 /// Calls the function with every index below the count, on any number of threads.
 pub type Parallel<'p> = &'p dyn Fn(usize, &(dyn Fn(usize) + Sync));
 
+/// How the directory of a `tsconfig.json` is read in an `include` or `exclude` entry that is joined to it.
+#[derive(Copy, Clone)]
+enum Directory {
+    /// As a part of the pattern, like oxc-resolver does. A directory named `[x]` or `{y}` is a class or a group, so
+    /// oxlint applies no `include` pattern in it.
+    Pattern,
+    /// As a path, whatever its name is. For eslint-import-resolver-typescript a `[` or a `{` is no syntax anywhere in
+    /// an entry. Here the rest of the entry is still a pattern as oxc-resolver reads it.
+    Path,
+}
+
+/// An `include` or `exclude` entry of a `tsconfig.json`.
+struct Entry {
+    pattern: Under<Pattern>,
+    /// The entry's path, if the pattern doesn't match it. oxc-resolver compares the two before it matches.
+    path: Option<Box<[u8]>>,
+    /// The pattern ends in a `*`, in which case it only matches JavaScript and TypeScript files.
+    is_for_scripts: bool,
+}
+
+impl Entry {
+    fn has(&self, path: &[u8]) -> bool {
+        let below = self.pattern.below(path);
+        below.is_some_and(|(pattern, rest)| pattern.matches(rest))
+            || self.path.as_deref() == Some(path)
+    }
+}
+
 /// The set of files a `tsconfig.json` applies to, as decided by oxc-resolver, which oxlint uses. TypeScript decides
 /// this differently.
 struct Scope {
@@ -234,10 +264,8 @@ struct Scope {
     /// `baseUrl`, or else the config's directory.
     base: Vec<u8>,
     files: Vec<Vec<u8>>,
-    /// Absolute patterns. The flag is true if the pattern ends in a `*`, in which case it only matches JavaScript and
-    /// TypeScript files.
-    include: Vec<(Pattern, bool)>,
-    exclude: Vec<Pattern>,
+    include: Vec<Entry>,
+    exclude: Vec<Entry>,
     allows_js: bool,
 }
 
@@ -251,32 +279,49 @@ impl Scope {
         allows_js: false,
     };
 
-    fn new(project: &Project) -> Scope {
+    fn new(project: &Project, reads: Directory) -> Scope {
         let directory = directory_of(&project.config_path);
         let absolute = |relative_path: &[u8]| match relative_path.strip_prefix(b"${configDir}") {
             Some(rest) => join(directory, rest.strip_prefix(b"/").unwrap_or(rest)),
             None => join(directory, relative_path),
         };
-        let pattern = |config_glob: &Vec<u8>| {
-            let mut path = absolute(config_glob);
+        let entry = |config_glob: &[u8], reads: Directory| {
+            let path = absolute(config_glob);
+            let written = config_glob
+                .strip_prefix(b"${configDir}")
+                .unwrap_or(config_glob);
+            let (directory, below) = match reads {
+                Directory::Pattern => (&b""[..], &path[..]),
+                // `join` takes both for separators on every system.
+                Directory::Path => split_joined(directory, &[written], b"/\\", &path),
+            };
+            // Only these make a pattern that doesn't match its own text.
+            let is_own_match = !strings::contains_any(below, b"[{\\");
             // A last segment without a `.` or a wildcard is treated as a directory.
             let last = &path[directory_of(&path).len()..];
-            if !strings::contains_any(last, b".*?") {
-                path.extend_from_slice(b"/**/*");
+            let below = match strings::contains_any(last, b".*?") {
+                true => Cow::Borrowed(below),
+                false => Cow::Owned([below, b"/**/*"].concat()),
+            };
+            Entry {
+                pattern: Under::new(
+                    directory,
+                    Pattern::new(&bun_glob::pattern::of_fast_glob(&below)),
+                ),
+                is_for_scripts: below.ends_with(b"*"),
+                path: (!is_own_match).then(|| path[..].into()),
             }
-            (
-                Pattern::new(&bun_glob::pattern::of_fast_glob(&path)),
-                path.ends_with(b"*"),
-            )
         };
-        let patterns =
-            |config_globs: &[Vec<u8>]| config_globs.iter().map(pattern).collect::<Vec<_>>();
+        let entries = |config_globs: &[Vec<u8>]| {
+            let entries = config_globs.iter().map(|it| entry(it, reads));
+            entries.collect::<Vec<_>>()
+        };
         let raw_config = &project.written;
-        let everything = [b"**/*".to_vec()];
         let include = match (&raw_config.include, &raw_config.files) {
-            (Some(include), _) => &include[..],
-            (None, Some(_)) => &[],
-            (None, None) => &everything[..],
+            (Some(include), _) => entries(include),
+            (None, Some(_)) => Vec::new(),
+            // Everything in the directory, which oxc-resolver compares as a path too.
+            (None, None) => vec![entry(b"**/*", Directory::Path)],
         };
         let allow_js = (project.raw_compiler_options.iter()).find(|it| it.0 == b"allowJs");
         let base_url = (project.raw_compiler_options.iter()).find(|it| it.0 == b"baseUrl");
@@ -288,10 +333,8 @@ impl Scope {
             files: (raw_config.files.iter().flatten())
                 .map(|it| absolute(it))
                 .collect(),
-            include: patterns(include),
-            exclude: (patterns(raw_config.exclude.as_deref().unwrap_or_default()).into_iter())
-                .map(|it| it.0)
-                .collect(),
+            include,
+            exclude: entries(raw_config.exclude.as_deref().unwrap_or_default()),
             allows_js: allow_js.is_some_and(|it| it.1 == Json::Bool(true)),
         }
     }
@@ -307,8 +350,8 @@ impl Scope {
             return false;
         }
         let is_script = is_js || matches!(extension, b"ts" | b"tsx" | b"mts" | b"cts");
-        let mut include = self.include.iter().filter(|it| is_script || !it.1);
-        include.any(|it| it.0.matches(path)) && !self.exclude.iter().any(|it| it.matches(path))
+        let mut include = (self.include.iter()).filter(|it| is_script || !it.is_for_scripts);
+        include.any(|it| it.has(path)) && !self.exclude.iter().any(|it| it.has(path))
     }
 }
 
@@ -409,7 +452,10 @@ impl<'h> Graph<'h> {
     fn scopes_in(&self, directory: &[u8]) -> &[Scope] {
         match self.caches().scopes.get_ref(directory) {
             Some(scopes) => scopes,
-            None => self.load_scopes(directory, &join(directory, b"tsconfig.json")),
+            None => {
+                let config = join(directory, b"tsconfig.json");
+                self.load_scopes(directory, &config, Directory::Pattern)
+            }
         }
     }
 
@@ -417,11 +463,21 @@ impl<'h> Graph<'h> {
     fn scopes_of(&self, config: &[u8]) -> &[Scope] {
         match self.caches().scopes.get_ref(config) {
             Some(scopes) => scopes,
-            None => self.load_scopes(config, config),
+            None => self.load_scopes(config, config, Directory::Pattern),
+        }
+    }
+
+    /// The same for eslint-import-resolver-typescript, which applies `include` and `exclude` in a directory of any
+    /// name.
+    fn scopes_of_typescript_resolver(&self, config: &[u8]) -> &[Scope] {
+        let key = [b"\0", config].concat();
+        match self.caches().scopes.get_ref(&key[..]) {
+            Some(scopes) => scopes,
+            None => self.load_scopes(&key, config, Directory::Path),
         }
     }
 
-    fn load_scopes(&self, key: &[u8], config: &[u8]) -> &[Scope] {
+    fn load_scopes(&self, key: &[u8], config: &[u8], reads: Directory) -> &[Scope] {
         let caches = self.caches();
         let _loading = self.loading.lock();
         if let Some(scopes) = caches.scopes.get_ref(key) {
@@ -430,7 +486,7 @@ impl<'h> Graph<'h> {
         let disk = WithoutListings(self.store.disk());
         let load = |config: &[u8]| {
             let project = load_overriding(&disk, &self.store.session, config, &|_| Vec::new());
-            project.ok().map(|it| Scope::new(&it))
+            project.ok().map(|it| Scope::new(&it, reads))
         };
         let project = (disk.is_file(config))
             .then(|| load_overriding(&disk, &self.store.session, config, &|_| Vec::new()).ok());
@@ -438,7 +494,7 @@ impl<'h> Graph<'h> {
             let referenced = project.references.iter();
             let referenced =
                 referenced.map(|it| load(&resolve_config_file_name_of_project_reference(&it.path)));
-            let own = Some(Scope::new(&project));
+            let own = Some(Scope::new(&project, reads));
             let all: Option<Vec<Scope>> = referenced.chain([own]).collect();
             all.unwrap_or_else(|| vec![Scope::BROKEN])
         });
@@ -513,8 +569,8 @@ impl<'h> Graph<'h> {
         };
         bun_lint::utils::sort::sort_by_key(&mut listed, distance);
         listed.dedup();
-        let applies_to_file =
-            |it: &Vec<u8>| self.scopes_of(it).last().is_some_and(|own| own.has(from));
+        let scopes_of = |config: &Vec<u8>| self.scopes_of_typescript_resolver(config);
+        let applies_to_file = |it: &Vec<u8>| scopes_of(it).last().is_some_and(|own| own.has(from));
         let chosen = match listed.len() {
             0 if self.store.uses_nearest_tsconfig => {
                 let mut above = bun_lint::paths::ancestors(directory);
@@ -525,6 +581,9 @@ impl<'h> Graph<'h> {
             }
             0 => self.config_in(&self.store.cwd).into_iter().collect(),
             1 => listed,
+            // The closest project that includes the file, alone. The resolver does that once the project has resolved
+            // an import. Before, it also tries the next projects that include the file, so what it reports depends on
+            // the order of the files and of their imports.
             _ => match listed.iter().position(applies_to_file) {
                 Some(at) => vec![listed.swap_remove(at)],
                 None => listed,
@@ -533,10 +592,7 @@ impl<'h> Graph<'h> {
         let mut configs = Vec::new();
         for config in chosen {
             // `references: "auto"`
-            let referenced = self
-                .scopes_of(&config)
-                .split_last()
-                .map_or(&[][..], |it| it.1);
+            let referenced = scopes_of(&config).split_last().map_or(&[][..], |it| it.1);
             let contains_directory = |it: &&Scope| {
                 let rest = directory.strip_prefix(&it.base[..]);
                 !it.config.is_empty() && rest.is_some_and(|it| matches!(it, [] | [b'/', ..]))
diff --git a/src/lint/js_plugin/eslint.rs b/src/lint/js_plugin/eslint.rs
index 538f3e5a5319..5787cde2422f 100644
--- a/src/lint/js_plugin/eslint.rs
+++ b/src/lint/js_plugin/eslint.rs
@@ -135,7 +135,7 @@ impl Host<'_> {
 
     /// Calls ESLint's `Linter.verify`. `run` is JSON with what all files of a config file share: `from`, `basePath`,
     /// `allowInlineConfig`, `onlyErrors`, `aboutLayout`, and for [`Configuration::whole`] `file`, `ignores` and `added`.
-    /// `reviveOverride` in `worker/eslint.js` turns each object in `added` into one that every ESLint 9 and 10 accepts.
+    /// `reviveOverride` in `worker/eslint.js` turns each object in `added` into one that the installed ESLint accepts.
     pub fn lint_with_eslint(
         &self,
         configuration: &Configuration,
diff --git a/src/lint/js_plugin/worker/eslint.js b/src/lint/js_plugin/worker/eslint.js
index ecd6c72c13c8..6eb097bf11f1 100644
--- a/src/lint/js_plugin/worker/eslint.js
+++ b/src/lint/js_plugin/worker/eslint.js
@@ -11,8 +11,9 @@ const CONFIGURE_ESLINT = 21;
 const NEEDS_ESLINT_CONFIGURATION = "4";
 const NOT_INSTALLED = "5";
 
-// By the directory that it is looked for from: `{ Linter, FlatConfigArray }`, or `null` if it is not installed. `FlatConfigArray`,
-// which the package does not export, is `null` if it is not where it has been since ESLint 8.21.
+// By the directory that it is looked for from: `{ Linter, FlatConfigArray, knowsBasePath }`, or `null` if it is not installed.
+// `FlatConfigArray`, which the package does not export, is `null` if it is not where it has been since ESLint 8.21.
+// `knowsBasePath`: a config object can say what its patterns are relative to, since ESLint 9.30. An older one rejects the key.
 const eslintPackages = new Map();
 
 function eslintFrom(directory) {
@@ -26,7 +27,9 @@ function eslintFrom(directory) {
   } catch {}
   found = null;
   if (root !== null) {
-    found = { Linter: from("eslint").Linter, FlatConfigArray: null };
+    found = { Linter: from("eslint").Linter, FlatConfigArray: null, knowsBasePath: false };
+    const [major, minor] = String(found.Linter.version).split(".").map(Number);
+    found.knowsBasePath = major > 9 || (major === 9 && minor >= 30);
     try {
       found.FlatConfigArray =
         require(nodePath.join(root, "lib", "config", "flat-config-array.js")).FlatConfigArray ?? null;
@@ -112,17 +115,18 @@ function movedPattern(pattern, from, to) {
 }
 
 // Prepares a config object that the command line or bunfig.toml adds. Its plugins and parser arrive as names. Its `basePath` says
-// what its patterns are relative to, if that isn't `arrayBase`, the base path of the config array. ESLint only knows `basePath`
-// in config objects since 9.30 and rejects unknown keys, so the key is never passed on.
-async function reviveOverride(object, arrayBase) {
+// what its patterns are relative to, if that isn't `arrayBase`, the base path of the config array. ESLint passes the directory
+// of `--ignore-pattern` that way since 9.30. An older one rejects the key, and wrote the directory in front of each pattern.
+async function reviveOverride(object, arrayBase, knowsBasePath) {
   const resolve = createRequire(nodePath.join(cwd, "noop.js")).resolve;
   const importFrom = async name => load(pathToFileURL(resolve(name)).href);
   const { $globsOfBun: isOfBunfig, $jsPlugins: located = {}, basePath = arrayBase, ...revived } = object;
   if (isOfBunfig) {
     revived.files = [bunfigMatcher(object.files, basePath)];
     if (object.ignores !== undefined) revived.ignores = [bunfigMatcher(object.ignores, basePath)];
-  } else if (object.ignores !== undefined) {
-    revived.ignores = object.ignores.map(it => movedPattern(it, basePath, arrayBase));
+  } else if (object.ignores !== undefined && nodePath.relative(arrayBase, basePath) !== "") {
+    if (knowsBasePath) revived.basePath = basePath;
+    else revived.ignores = object.ignores.map(it => movedPattern(it, basePath, arrayBase));
   }
   if (object.plugins !== undefined) {
     revived.plugins = {};
@@ -157,7 +161,7 @@ async function reviveOverride(object, arrayBase) {
 
 // ESLint's `calculateConfigArray`: all of the configuration file, for a file whose configuration has what only JavaScript can say.
 // `file`: `null` under `--no-config-lookup`.
-async function wholeConfiguration({ FlatConfigArray }, { file, basePath, ignores, added }) {
+async function wholeConfiguration({ FlatConfigArray, knowsBasePath }, { file, basePath, ignores, added }) {
   // Of an array that is only an array the `Linter` makes one for each file.
   const configs = FlatConfigArray === null ? [] : new FlatConfigArray([], { basePath, shouldIgnore: ignores });
   if (file !== null) {
@@ -168,7 +172,7 @@ async function wholeConfiguration({ FlatConfigArray }, { file, basePath, ignores
   }
   // The `Linter` turns a plain array into a config array whose base path is its `cwd`.
   const arrayBase = FlatConfigArray === null ? cwd : basePath;
-  for (const object of added) configs.push(await reviveOverride(object, arrayBase));
+  for (const object of added) configs.push(await reviveOverride(object, arrayBase, knowsBasePath));
   await configs.normalize?.();
   if (configs.getConfig === undefined) return configs;
   return Object.assign([], { getConfig: name => withoutProcessor(configs.getConfig(name)) });
diff --git a/src/lint/paths.rs b/src/lint/paths.rs
index f07df89e6bf5..a786fb40407f 100644
--- a/src/lint/paths.rs
+++ b/src/lint/paths.rs
@@ -30,6 +30,14 @@ impl Style {
             _ => Style::Posix,
         }
     }
+
+    /// What separates the names of a path in this style.
+    pub fn separators(self) -> &'static [u8] {
+        match self {
+            Style::Posix => b"/",
+            Style::Windows => b"/\\",
+        }
+    }
 }
 
 /// Converts a native path or a command-line argument. Replaces `\` with `/` on platforms where `\` is a separator.
@@ -217,6 +225,36 @@ pub fn inside_as<'p>(style: Style, directory: &[u8], path: &'p [u8]) -> Option<&
     }
 }
 
+/// Splits `joined`, which is `texts` joined to `directory` one after the other, into what is left of the directory and
+/// what the texts say. The first part is a path, whatever bytes it has. A `..` that leads out of the texts takes a
+/// name off it. The second part is a pattern if a text is one. Unless the first part is empty, the second is empty or
+/// starts with a `/`, so it matches what it matched as a part of `joined`. `separators` are the bytes that the join
+/// took for separators in the texts.
+pub fn split_joined<'j>(
+    directory: &[u8],
+    texts: &[&[u8]],
+    separators: &[u8],
+    joined: &'j [u8],
+) -> (&'j [u8], &'j [u8]) {
+    let names = texts
+        .iter()
+        .flat_map(|text| strings::split_any(text, separators));
+    let (mut depth, mut left) = (0usize, directory);
+    for name in names {
+        match name {
+            b"" | b"." => {}
+            b".." if depth == 0 => left = dirname(left),
+            b".." => depth -= 1,
+            _ => depth += 1,
+        }
+    }
+    // A root has no name, and only a root ends with a `/`.
+    match joined.strip_prefix(left) {
+        Some([] | [b'/', ..]) if !left.ends_with(b"/") => joined.split_at(left.len()),
+        _ => (b"", joined),
+    }
+}
+
 /// True if `path` is `outer` or inside it. Both must be resolved.
 pub fn is_at_or_inside(outer: &[u8], path: &[u8]) -> bool {
     let is_same = match Style::of(outer) {
diff --git a/test/cli/lint/glob.test.ts b/test/cli/lint/glob.test.ts
index d39e7d5e7c63..c325a1798d53 100644
--- a/test/cli/lint/glob.test.ts
+++ b/test/cli/lint/glob.test.ts
@@ -1,6 +1,7 @@
-import { afterAll, expect, test } from "bun:test";
-import { bunEnv, bunExe, isWindows, tempDir } from "harness";
-import { join, relative } from "node:path";
+import { afterAll, describe, expect, test } from "bun:test";
+import { bunEnv, bunExe, isASAN, isDebug, isWindows, tempDir } from "harness";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, relative } from "node:path";
 import { endChildren, spawn } from "../children";
 
 afterAll(endChildren);
@@ -543,3 +544,459 @@ test.concurrent.each(["{a,", "a{,", "*{a,", "[*", "{*", "a\\"])(
     expect(exitCode).toBe(0);
   },
 );
+
+// Where `bun lint` joins a directory in front of a pattern, the directory is a path, whatever bytes its name has:
+// `[proj]` is no class, `{a,b}` no group and `+(old)` no extglob.
+
+// A debug build takes seconds to lint a project, and more with an ESLint 8 config, with a config file that is a
+// program, or with the installed ESLint.
+const debugTimeout = isDebug || isASAN ? 60_000 : undefined;
+
+type Files = Record<string, string>;
+
+/**
+ * Lints `files` from the directory `cwd`. Returns each report as `file:line rule`, with the file relative to the
+ * directory `root`. `files` can be a function of the directory that they are written to.
+ */
+async function reportedFrom(
+  cwd: string,
+  files: Files | ((directory: string) => Files),
+  args: string[] = [],
+  root = ".",
+) {
+  using dir = tempDir("bun-lint-glob", typeof files === "function" ? {} : files);
+  if (typeof files === "function") {
+    for (const [path, text] of Object.entries(files(String(dir)))) {
+      mkdirSync(dirname(join(String(dir), path)), { recursive: true });
+      writeFileSync(join(String(dir), path), text);
+    }
+  }
+  await using proc = spawn({
+    cmd: [bunExe(), "lint", "-f", "unix", ...args],
+    env,
+    cwd: join(String(dir), cwd),
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  if (exitCode !== 0 && exitCode !== 1) throw new Error(`exit code ${exitCode}\n${stdout}\n${stderr}`);
+  // With an oxlint config the paths are relative to the working directory and a rule is `import(no-cycle)`.
+  return [...stdout.matchAll(/^(.+?):(\d+):\d+: .* \[\w+\/(.+)\]\r?$/gm)]
+    .map(([, path, line, rule]) => {
+      const absolute = isAbsolute(path) ? path : join(String(dir), cwd, path);
+      const file = relative(join(String(dir), root), absolute).replaceAll("\\", "/");
+      return `${file}:${line} ${rule.replace(/^(\w+)\((.+)\)$/, "$1/$2")}`;
+    })
+    .sort();
+}
+
+/** The same for a project that is in a directory named `name`, from its subdirectory `cwd`. */
+function reportedIn(name: string, files: Files, args: string[] = [], cwd = ".") {
+  const inside = Object.fromEntries(Object.entries(files).map(([path, text]) => [`${name}/${path}`, text]));
+  return reportedFrom(join(name, cwd), inside, args, name);
+}
+
+// `bun lint --run-path-tests` is compiled into debug and canary builds only.
+const hasRunner = isDebug || Bun.spawnSync({ cmd: [bunExe(), "--revision"], env: bunEnv }).stdout.includes("canary");
+
+test.skipIf(!hasRunner)("what is joined to a directory is split where the directory ends in it", async () => {
+  // The directory, what is joined to it, and the two parts of the result: what is left of the directory, which is no
+  // pattern, and the rest.
+  const rows = [
+    ["/t/[p]", "src/**", "/t/[p]", "/src/**"],
+    ["/t/[p]", "./src/../lib/*.js", "/t/[p]", "/lib/*.js"],
+    ["/t/[p]", ".", "/t/[p]", ""],
+    // A `..` leaves the directory.
+    ["/t/[p]/app", "../lib/*.js", "/t/[p]", "/lib/*.js"],
+    ["/t/[p]/app", "src/../../lib/*.js", "/t/[p]", "/lib/*.js"],
+    ["/t/[p]", "../../../x/*.js", "", "/x/*.js"],
+    // What comes back into the directory by its name is written, so it is a pattern.
+    ["/t/[p]/app", "../../[p]/app/*.js", "/t", "/[p]/app/*.js"],
+    // A root has no name.
+    ["/", "src/*.js", "", "/src/*.js"],
+    ["/t", "../src/*.js", "", "/src/*.js"],
+  ];
+  // `path.resolve`, `path.join`, and the join of a tsconfig.json entry. Only the last takes a `\` for a separator in a
+  // POSIX path, and the checker writes a drive as `/C:`.
+  const joins = {
+    split_resolved: [...rows, ["/t/[p]", "..\\lib/*.js", "/t/[p]", "/..\\lib/*.js"]],
+    split_joined: [...rows, ["/t/[p]", "/t/[p]/src/**", "/t/[p]", "/t/[p]/src/**"]],
+    split_included: [
+      ...rows,
+      ["/t/[p]/app", "..\\lib/*.js", "/t/[p]", "/lib/*.js"],
+      ["/C:/r/[p]/app", "..\\lib/*.js", "/C:/r/[p]", "/lib/*.js"],
+      // An absolute entry is a pattern, unless it goes through the directory.
+      ["/t/[p]/app", "/t/[p]/lib/*.js", "", "/t/[p]/lib/*.js"],
+      ["/t/[p]", "/t/[p]/src/**", "/t/[p]", "/src/**"],
+    ],
+  };
+  const windows = {
+    split_resolved: [
+      ["C:/r/[p]", "src\\**", "C:/r/[p]", "/src/**"],
+      ["C:/r/[p]/app", "..\\lib/*.js", "C:/r/[p]", "/lib/*.js"],
+      ["C:/r", "../src/*.js", "", "C:/src/*.js"],
+      ["//server/share/[p]", "src/**", "//server/share/[p]", "/src/**"],
+      ["//server/share/[p]", "../x/**", "", "//server/share/x/**"],
+    ],
+  };
+  // Not in a directory whose `package.json` has a `lint` script.
+  using dir = tempDir("bun-lint-glob", {});
+  const run = async (style: string, table: Record<string, string[][]>) => {
+    const calls = Object.entries(table).flatMap(([join, rows]) => rows.flatMap(row => [join, row[0], row[1]]));
+    await using proc = spawn({
+      cmd: [bunExe(), "lint", "--run-path-tests", style, ...calls],
+      env,
+      cwd: String(dir),
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { lines: stdout.split(/\r?\n/).slice(0, -1), stderr, exitCode };
+  };
+  const expected = (table: Record<string, string[][]>) => ({
+    lines: Object.values(table).flatMap(rows => rows.map(([, , directory, rest]) => `${directory} + ${rest}`)),
+    stderr: "",
+    exitCode: 0,
+  });
+  expect(await run("posix", joins)).toEqual(expected(joins));
+  expect(await run("windows", windows)).toEqual(expected(windows));
+});
+
+const oxlintrc = {
+  ".oxlintrc.json": JSON.stringify({
+    plugins: ["import"],
+    categories: { correctness: "off" },
+    rules: { "import/no-cycle": "error" },
+  }),
+};
+const paths = { compilerOptions: { paths: { "@/*": ["./src/*"] } } };
+// `a` imports `other` and `c`, and both import `a`. A cycle is only found where the tsconfig.json applies to both of
+// its files, because only then `@/` means `src/`.
+const cycles = (other: string) => ({
+  ...oxlintrc,
+  "src/a.ts": `import { b } from "@/${other}";\nimport { c } from "@/c";\nexport const a = [b, c];\n`,
+  [`src/${other}.ts`]: `import { a } from "@/a";\nexport const b = a;\n`,
+  "src/c.ts": `import { a } from "@/a";\nexport const c = a;\n`,
+});
+const cycleOfOther = (other: string) => [`src/${other}.ts:1`, "src/a.ts:1"];
+const cycleOfC = ["src/a.ts:2", "src/c.ts:1"];
+
+// The expected reports are those of oxlint 1.89. Its resolver compares the directory of a tsconfig.json as a path
+// where no `include` pattern is joined to it, and it compares an entry with the file before it reads the entry as a
+// pattern. So an entry that names a file applies to it, also if the name or a directory above has a `[` or a `{`.
+// With `include: ["src"]` oxlint applies nothing in a directory named `[proj]`, and neither does `bun lint`.
+test.concurrent.each([
+  ["[proj]", "b", {}, [...cycleOfC, ...cycleOfOther("b")]],
+  ["{a,b}", "b", { include: ["src/a.ts", "src/b.ts", "src/c.ts"] }, [...cycleOfC, ...cycleOfOther("b")]],
+  ["[proj]", "b", { exclude: ["src/b.ts"] }, cycleOfC],
+  ["[proj]", "b", { include: ["src"] }, []],
+  ["proj", "[id]", { include: ["src/a.ts", "src/[id].ts", "src/c.ts"] }, [...cycleOfC, ...cycleOfOther("[id]")]],
+  ["proj", "[id]", { exclude: ["src/[id].ts"] }, cycleOfC],
+])(
+  "with an .oxlintrc.json in a directory named %s and a file %s.ts, a tsconfig.json with %j",
+  async (name, other, scope, expected) => {
+    const files = { ...cycles(other), "tsconfig.json": JSON.stringify({ ...paths, ...scope }) };
+    expect(await reportedIn(name, files)).toEqual(expected.map(it => `${it} import/no-cycle`).sort());
+  },
+  debugTimeout,
+);
+
+// A config that `--tsconfig` names, with a project that it references and that has no `include`.
+test.concurrent.each(["[proj]", "{a,b}"])(
+  "with an .oxlintrc.json, a referenced project without `include` applies in a directory named %s",
+  async name => {
+    const { "src/c.ts": _, ...files } = cycles("b");
+    const configs = {
+      "tsconfig.json": JSON.stringify({ files: [], references: [{ path: "./tsconfig.app.json" }] }),
+      "tsconfig.app.json": JSON.stringify(paths),
+      "src/a.ts": `import { b } from "@/b";\nexport const a = b;\n`,
+    };
+    expect(await reportedIn(name, { ...files, ...configs }, ["--tsconfig", "tsconfig.json"])).toEqual(
+      cycleOfOther("b")
+        .map(it => `${it} import/no-cycle`)
+        .sort(),
+    );
+  },
+  debugTimeout,
+);
+
+/** The reports with `settings["import/resolver"].typescript.project` set to `projects`. */
+function reportedWithProjects(name: string, projects: string[], rule: string, files: Files) {
+  const settings = `"import/resolver" = { typescript = { project = ${JSON.stringify(projects)} } }`;
+  return reportedIn(name, {
+    "package.json": `{ "name": "p", "type": "module" }`,
+    "bunfig.toml": `[lint.rules]\n"${rule}" = "error"\n[lint.settings]\n${settings}\n`,
+    ...files,
+  });
+}
+const aliasedTo = (directory: string) => ({ compilerOptions: { paths: { "@/*": [`./${directory}/*`] } } });
+const exporting = (name: string) => `export const only${name} = 1;\n`;
+const importing = (name: string) => `import { only${name} } from "@/y";\nexport default only${name};\n`;
+
+// `bun lint` uses the closest `project` whose `include` has the file, alone. eslint-import-resolver-typescript 4.4.5
+// does that once the project has resolved an import, and these are its reports. It reads the directory of a
+// tsconfig.json as a path. Like TypeScript, it takes a last name with a `.` for a file, so in `my.app` the entry `.`
+// includes nothing, and the paths of the other project apply.
+test.concurrent.each([
+  ["[proj]", ["b"], "b/u.ts"],
+  ["{a,b}", ["b"], "b/u.ts"],
+  ["[proj]", ["."], "b/u.ts"],
+  ["proj", ["."], "b/u.ts"],
+  ["my.app", ["b"], "b/u.ts"],
+  ["my.app", ["."], "b/t.ts"],
+])(
+  "settings[import/resolver].typescript in a directory named %s, with `include` %j in the second project",
+  async (name, include, reported) => {
+    const files = {
+      "tsconfig.a.json": JSON.stringify({ ...aliasedTo("a"), include: ["a"] }),
+      "tsconfig.b.json": JSON.stringify({ ...aliasedTo("b"), include }),
+      "a/y.ts": exporting("A"),
+      "b/y.ts": exporting("B"),
+      "b/t.ts": importing("B"),
+      "b/u.ts": importing("A"),
+    };
+    const projects = ["tsconfig.a.json", "tsconfig.b.json"];
+    expect(await reportedWithProjects(name, projects, "import/named", files)).toEqual([`${reported}:1 import/named`]);
+  },
+  debugTimeout,
+);
+
+// An entry of the second project leaves its directory, or is excluded there. These are the reports of ESLint 9.39.5
+// with the resolver in every directory.
+const shared = {
+  "tsconfig.a.json": JSON.stringify({ ...aliasedTo("a"), include: ["a"] }),
+  "a/y.ts": exporting("A"),
+  "app/src/y.ts": exporting("App"),
+  "shared/t.ts": importing("App"),
+  "shared/u.ts": importing("A"),
+};
+test.concurrent.each([
+  ["[ws]", ["src", "../shared"]],
+  ["{a,b}", ["${configDir}/src", "${configDir}/../shared"]],
+  ["[ws]", ["src", "..\\shared"]],
+])(
+  "settings[import/resolver].typescript in a directory named %s, with `include` %j in a project below it",
+  async (name, include) => {
+    const files = { ...shared, "app/tsconfig.json": JSON.stringify({ ...aliasedTo("src"), include }) };
+    const projects = ["tsconfig.a.json", "app/tsconfig.json"];
+    expect(await reportedWithProjects(name, projects, "import/named", files)).toEqual(["shared/u.ts:1 import/named"]);
+  },
+  debugTimeout,
+);
+
+test.concurrent(
+  "settings[import/resolver].typescript in a directory named {a,b}, with an `exclude` in the first project",
+  async () => {
+    const files = {
+      "tsconfig.b.json": JSON.stringify({ ...aliasedTo("b"), include: ["b"], exclude: ["b/gen"] }),
+      "tsconfig.a.json": JSON.stringify({ ...aliasedTo("a"), include: ["a", "b/gen"] }),
+      "a/y.ts": exporting("A"),
+      "b/y.ts": exporting("B"),
+      "b/gen/t.ts": importing("A"),
+      "b/gen/u.ts": importing("B"),
+    };
+    const projects = ["tsconfig.b.json", "tsconfig.a.json"];
+    expect(await reportedWithProjects("{a,b}", projects, "import/named", files)).toEqual(["b/gen/u.ts:1 import/named"]);
+  },
+  debugTimeout,
+);
+
+// Both projects include b/t.ts. `bun lint` uses the first one alone, in a directory of any name. The resolver goes on
+// to the second one until the first one has resolved an import. So it reports the same if `./y` comes first, and
+// nothing if `@b/y` does.
+test.concurrent.each([
+  [`import "./y";\nimport "@b/y";\n`, "b/t.ts:2 import/no-unresolved"],
+  [`import "@b/y";\n`, "b/t.ts:1 import/no-unresolved"],
+])(
+  "settings[import/resolver].typescript in a directory named [ws], with two projects for a file that has %j",
+  async (code, reported) => {
+    const files = {
+      "tsconfig.a.json": JSON.stringify({ compilerOptions: { paths: { "@a/*": ["./a/*"] } }, include: ["a", "b"] }),
+      "tsconfig.b.json": JSON.stringify({ compilerOptions: { paths: { "@b/*": ["./b/*"] } }, include: ["b"] }),
+      "b/y.ts": exporting("B"),
+      "b/t.ts": code,
+    };
+    const projects = ["tsconfig.a.json", "tsconfig.b.json"];
+    expect(await reportedWithProjects("[ws]", projects, "import/no-unresolved", files)).toEqual([reported]);
+  },
+  debugTimeout,
+);
+
+// No project includes b/. `bun lint` then tries each one, in a directory of any name. The resolver does that in a
+// directory named `ws`. In one named `[ws]` it takes the path of each project for a pattern, and resolves nothing.
+test.concurrent(
+  "settings[import/resolver].typescript in a directory named [ws], for a file that no project includes",
+  async () => {
+    const files = {
+      "tsconfig.a.json": JSON.stringify({ ...aliasedTo("a"), include: ["a"] }),
+      "tsconfig.b.json": JSON.stringify({ ...aliasedTo("b"), include: ["c"] }),
+      "a/y.ts": exporting("A"),
+      "b/t.ts": importing("A"),
+      "b/u.ts": importing("B"),
+    };
+    const projects = ["tsconfig.a.json", "tsconfig.b.json"];
+    expect(await reportedWithProjects("[ws]", projects, "import/named", files)).toEqual(["b/u.ts:1 import/named"]);
+  },
+  debugTimeout,
+);
+
+// `--ignore-pattern` is relative to the working directory and `ignorePatterns` to bunfig.toml. ESLint passes the
+// directory of its own patterns as their `basePath` since 9.30, and `bun lint` does the same for it. An older ESLint
+// refuses the key. It writes the directory in front of each pattern, and so does `bun lint` for it.
+describe("ignore patterns for the installed ESLint, from another directory than the config file's", () => {
+  // A stand-in for the `eslint` package that ignores like ESLint's config array. The last pattern that matches decides.
+  // An object with a `basePath` is for what is below that directory. Nothing below an ignored directory is linted.
+  const eslintAt = (version: string) => ({
+    "node_modules/eslint/package.json": JSON.stringify({ name: "eslint", version, main: "index.js" }),
+    "node_modules/eslint/lib/config/flat-config-array.js": `
+      const path = require("node:path");
+      const [major, minor] = ${JSON.stringify(version)}.split(".").map(Number);
+      exports.FlatConfigArray = class {
+        #configs = [];
+        constructor(configs, { basePath }) {
+          this.basePath = basePath;
+          this.push(...configs);
+        }
+        push(...configs) {
+          this.#configs.push(...configs);
+        }
+        normalize() {
+          const knowsBasePath = major > 9 || (major === 9 && minor >= 30);
+          if (!knowsBasePath && this.#configs.some(it => "basePath" in it)) throw new Error('Unexpected key "basePath" found.');
+        }
+        #isIgnored(target, slash) {
+          let isIgnored = false;
+          for (const { basePath = this.basePath, ignores = [], ...rest } of this.#configs) {
+            if (Object.keys(rest).length > 0) continue;
+            const relative = path.relative(basePath, target).replaceAll("\\\\", "/");
+            if (relative === "" || relative === ".." || relative.startsWith("../")) continue;
+            for (const it of ignores) {
+              const isNegated = it.startsWith("!");
+              if (new Bun.Glob(isNegated ? it.slice(1) : it).match(relative + slash)) isIgnored = !isNegated;
+            }
+          }
+          return isIgnored;
+        }
+        getConfig(file) {
+          for (let directory = path.dirname(file); directory !== this.basePath; directory = path.dirname(directory)) {
+            if (this.#isIgnored(directory, "/")) return undefined;
+          }
+          return this.#isIgnored(file, "") ? undefined : { hasBasePath: this.#configs.some(it => "basePath" in it) };
+        }
+      };`,
+    "node_modules/eslint/index.js": `
+      exports.Linter = class {
+        static version = ${JSON.stringify(version)};
+        verify(text, configs, { filename }) {
+          const config = configs.getConfig(filename);
+          const message = config === undefined ? "ignored" : config.hasBasePath ? "linted, with a basePath" : "linted";
+          return [{ ruleId: null, severity: 1, message, line: 1, column: 1 }];
+        }
+        getSuppressedMessages() {
+          return [];
+        }
+      };`,
+  });
+  // The parser is an inline object, so the .vue files go to the installed ESLint with the whole config file.
+  const config = `
+    const parser = { meta: { name: "vue-eslint-parser" }, parseForESLint() {} };
+    export default [{ ignores: ["**/dist/**/*"] }, { files: ["**/*.vue"], languageOptions: { parser } }];`;
+
+  /**
+   * Lints the directory `pkg` or `name` from `cwd`, with the config file in the directory `config`. Returns what the
+   * installed ESLint says about each file that `bun lint` sends to it.
+   */
+  async function sent(version: string, args: string[], { name = "pkg", config: at = ".", cwd = name, more = {} } = {}) {
+    using dir = tempDir("bun-lint-glob", {
+      ...eslintAt(version),
+      [join(at, "eslint.config.mjs")]: config,
+      ...Object.fromEntries(
+        ["keep", "dist/keep", "dist/x", "src/y"].map(it => [`${name}/${it}.vue`, "<template />\n"]),
+      ),
+      ...more,
+    });
+    await using proc = spawn({
+      cmd: [bunExe(), "lint", "-f", "json", ...args, relative(cwd, name) || "."],
+      env,
+      cwd: join(String(dir), cwd),
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    if (!stdout.startsWith("[")) throw new Error(`exit code ${exitCode}\n${stdout}\n${stderr}`);
+    const results: { filePath: string; messages: { message: string }[] }[] = JSON.parse(stdout);
+    // The stand-in has a message for each file. `bun lint` has none for the config file, which it lints itself.
+    return Object.fromEntries(
+      results
+        .filter(it => it.messages.length > 0)
+        .map(it => [
+          relative(join(String(dir), name), it.filePath).replaceAll("\\", "/"),
+          it.messages.map(message => message.message).join(),
+        ]),
+    );
+  }
+  const all = (message: string) => ({ "keep.vue": message, "dist/keep.vue": message, "src/y.vue": message });
+  const ignorePatterns = (patterns: string[]) => `[lint]\nignorePatterns = ${JSON.stringify(patterns)}\n`;
+
+  test.concurrent.each([
+    ["9.30.0", "pkg"],
+    ["9.30.0", "[pkg]"],
+    ["10.0.0", "c++(old)"],
+  ])(
+    "with ESLint %s, --ignore-pattern lets a file in from a directory named %s",
+    async (version, name) => {
+      expect(await sent(version, ["--ignore-pattern", "!dist/keep.vue"], { name })).toEqual(
+        all("linted, with a basePath"),
+      );
+    },
+    debugTimeout,
+  );
+
+  // Written in front of `**`, the directory itself is ignored, and then no pattern lets a file in it in.
+  test.concurrent.each([
+    ["--ignore-pattern", () => sent("9.30.0", ["--ignore-pattern", "**", "--ignore-pattern", "!keep.vue"])],
+    ["bunfig.toml", () => sent("10.0.0", [], { more: { "pkg/bunfig.toml": ignorePatterns(["**", "!keep.vue"]) } })],
+  ])(
+    "with ESLint 9.30 or later, %s lets a file in after `**`",
+    async (_, run) => {
+      expect(await run()).toEqual({ "keep.vue": "linted, with a basePath" });
+    },
+    debugTimeout,
+  );
+
+  // The patterns belong to a directory above the config file.
+  test.concurrent.each([
+    ["--ignore-pattern", () => sent("9.30.0", ["--ignore-pattern", "!*/dist/keep.vue"], { config: "pkg", cwd: "." })],
+    [
+      "bunfig.toml",
+      () =>
+        sent("9.30.0", [], { config: "pkg", cwd: ".", more: { "bunfig.toml": ignorePatterns(["!*/dist/keep.vue"]) } }),
+    ],
+  ])(
+    "with ESLint 9.30 or later, %s lets a file in from above the config file",
+    async (_, run) => {
+      expect(await run()).toEqual(all("linted, with a basePath"));
+    },
+    debugTimeout,
+  );
+
+  test.concurrent(
+    "from the directory of the config file, ESLint gets the patterns without a `basePath`",
+    async () => {
+      expect(await sent("10.0.0", ["--ignore-pattern", "!pkg/dist/keep.vue"], { cwd: "." })).toEqual(all("linted"));
+    },
+    debugTimeout,
+  );
+
+  test.concurrent.each(["9.29.0", "8.57.1"])(
+    "ESLint %s gets no `basePath`",
+    async version => {
+      expect(await sent(version, ["--ignore-pattern", "!dist/keep.vue"])).toEqual(all("linted"));
+      // There `[pkg]` is a class in each pattern, so what ESLint gets does not let dist/keep.vue in.
+      expect(await sent(version, ["--ignore-pattern", "!dist/keep.vue"], { name: "[pkg]" })).toMatchObject({
+        "src/y.vue": "linted",
+      });
+    },
+    debugTimeout,
+  );
+});
diff --git a/test/cli/lint/oracle/plugins/oxlint/expected.json b/test/cli/lint/oracle/plugins/oxlint/expected.json
index 2bbf18b4abdc..ed8eb64fb222 100644
--- a/test/cli/lint/oracle/plugins/oxlint/expected.json
+++ b/test/cli/lint/oracle/plugins/oxlint/expected.json
@@ -6095,7 +6095,18 @@
   "h17-include-null/a/use.ts:1:8+3 import(no-named-as-default)",
   "h17-include-null/b/use.ts:1:8+3 import(no-named-as-default)",
   "h18-dotdot-in-pattern/a/use.ts:1:8+3 import(no-named-as-default)",
-  "h19-double-slash/a/use.ts:1:8+3 import(no-named-as-default)"
+  "h19-double-slash/a/use.ts:1:8+3 import(no-named-as-default)",
+  "h21-[x]-no-include/a/use.ts:1:8+3 import(no-named-as-default)",
+  "h22-{y}-no-include/a/use.ts:1:8+3 import(no-named-as-default)",
+  "h23-[x]-file/a/use.ts:1:8+3 import(no-named-as-default)",
+  "h24-[x]-exclude-file/a/use.ts:1:8+3 import(no-named-as-default)",
+  "h25-file-in-brackets/a/[id].ts:1:8+3 import(no-named-as-default)",
+  "h25-file-in-brackets/a/i.ts:1:8+3 import(no-named-as-default)",
+  "h27-[x]-exclude-dir/a/use.ts:1:8+3 import(no-named-as-default)",
+  "h27-[x]-exclude-dir/b/use.ts:1:8+3 import(no-named-as-default)",
+  "h28-[x]-exclude-glob/a/use.ts:1:8+3 import(no-named-as-default)",
+  "h28-[x]-exclude-glob/b/d/use.ts:1:8+3 import(no-named-as-default)",
+  "h28-[x]-exclude-glob/b/use.ts:1:8+3 import(no-named-as-default)"
  ],
  "tsconfig/which-one": [
   "h08/a/use.ts:1:8+3 import(no-named-as-default)",
@@ -6115,6 +6126,11 @@
   "r07/a/use.ts:1:8+3 import(no-named-as-default)",
   "r08/in/a/use.ts:1:8+3 import(no-named-as-default)",
   "r10/a/use.ts:1:8+3 import(no-named-as-default)",
+  "r11-[x]/a/use.ts:1:8+3 import(no-named-as-default)",
+  "r11-[x]/b/use.ts:1:8+3 import(no-named-as-default)",
+  "r12-{y}/a/use.ts:1:8+3 import(no-named-as-default)",
+  "r12-{y}/b/use.ts:1:8+3 import(no-named-as-default)",
+  "r14/[pk]/a/use.ts:1:8+3 import(no-named-as-default)",
   "u01/a/use.ts:1:8+3 import(no-named-as-default)"
  ],
  "tsconfig/extends": [
diff --git a/test/cli/lint/oracle/plugins/oxlint/projects.ts b/test/cli/lint/oracle/plugins/oxlint/projects.ts
index bdab18d51276..c1c4ec1aca5d 100644
--- a/test/cli/lint/oracle/plugins/oxlint/projects.ts
+++ b/test/cli/lint/oracle/plugins/oxlint/projects.ts
@@ -346,6 +346,40 @@ const tsconfigScopeProjects: Project[] = [
       "h19-double-slash/tsconfig.json": '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}, "include": ["a//**/*"]}',
       "h19-double-slash/a/lib.ts": lib,
       "h19-double-slash/a/use.ts": use,
+      "h21-[x]-no-include/tsconfig.json": '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}}',
+      "h21-[x]-no-include/a/lib.ts": lib,
+      "h21-[x]-no-include/a/use.ts": use,
+      "h22-{y}-no-include/tsconfig.json": '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}}',
+      "h22-{y}-no-include/a/lib.ts": lib,
+      "h22-{y}-no-include/a/use.ts": use,
+      "h23-[x]-file/tsconfig.json":
+        '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}, "include": ["a/lib.ts", "a/use.ts"]}',
+      "h23-[x]-file/a/lib.ts": lib,
+      "h23-[x]-file/a/use.ts": use,
+      "h23-[x]-file/a/other.ts": use,
+      "h24-[x]-exclude-file/tsconfig.json": '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}, "exclude": ["a/out.ts"]}',
+      "h24-[x]-exclude-file/a/lib.ts": lib,
+      "h24-[x]-exclude-file/a/use.ts": use,
+      "h24-[x]-exclude-file/a/out.ts": use,
+      "h25-file-in-brackets/tsconfig.json":
+        '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}, "include": ["a/lib.ts", "a/[id].ts"]}',
+      "h25-file-in-brackets/a/lib.ts": lib,
+      "h25-file-in-brackets/a/[id].ts": use,
+      "h25-file-in-brackets/a/i.ts": use,
+      "h26-exclude-file-in-brackets/tsconfig.json":
+        '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}, "exclude": ["a/[id].ts"]}',
+      "h26-exclude-file-in-brackets/a/lib.ts": lib,
+      "h26-exclude-file-in-brackets/a/[id].ts": use,
+      "h26-exclude-file-in-brackets/a/i.ts": use,
+      "h27-[x]-exclude-dir/tsconfig.json": '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}, "exclude": ["b"]}',
+      "h27-[x]-exclude-dir/a/lib.ts": lib,
+      "h27-[x]-exclude-dir/a/use.ts": use,
+      "h27-[x]-exclude-dir/b/use.ts": use,
+      "h28-[x]-exclude-glob/tsconfig.json": '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}, "exclude": ["**/b/**"]}',
+      "h28-[x]-exclude-glob/a/lib.ts": lib,
+      "h28-[x]-exclude-glob/a/use.ts": use,
+      "h28-[x]-exclude-glob/b/use.ts": use,
+      "h28-[x]-exclude-glob/b/d/use.ts": use,
     },
   },
   {
@@ -469,6 +503,26 @@ const tsconfigScopeProjects: Project[] = [
       "h20-node-modules/node_modules/dep/index.ts":
         "import foo from '#/lib';\nexport const bar = 1; export default bar;\n",
       "h20-node-modules/a/use2.ts": "import bar from 'dep';\n",
+      "r11-[x]/tsconfig.json": '{"files": [], "references": [{"path": "./tsconfig.app.json"}]}',
+      "r11-[x]/tsconfig.app.json": '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}}',
+      "r11-[x]/a/lib.ts": lib,
+      "r11-[x]/a/use.ts": use,
+      "r11-[x]/b/use.ts": use,
+      "r12-{y}/tsconfig.json": '{"files": [], "references": [{"path": "./tsconfig.app.json"}]}',
+      "r12-{y}/tsconfig.app.json": '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}}',
+      "r12-{y}/a/lib.ts": lib,
+      "r12-{y}/a/use.ts": use,
+      "r12-{y}/b/use.ts": use,
+      "r13-[x]-include/tsconfig.json": '{"files": [], "references": [{"path": "./tsconfig.app.json"}]}',
+      "r13-[x]-include/tsconfig.app.json": '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}, "include": ["a/**/*"]}',
+      "r13-[x]-include/a/lib.ts": lib,
+      "r13-[x]-include/a/use.ts": use,
+      "r14/tsconfig.json": '{"files": [], "references": [{"path": "./[pk]/tsconfig.lib.json"}]}',
+      "r14/[pk]/tsconfig.lib.json": '{"compilerOptions": {"paths": {"#/*": ["./a/*"]}}}',
+      "r14/[pk]/a/lib.ts": lib,
+      "r14/[pk]/a/use.ts": use,
+      "r14/p/a/lib.ts": lib,
+      "r14/p/a/use.ts": use,
     },
   },
   {

From c33ce1dccf31aa88eff24229c6bb360b0ebc858f Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 25 Oct 2026 18:58:40 +0000
Subject: [PATCH 2/4] lint: without an ESLint or oxlint config, the import
 rules read the working directory as a path

`import/no-restricted-paths`, `import/no-extraneous-dependencies` and
`import/no-unassigned-import` join the working directory in front of the
paths and globs of their options, and compile the result. In a directory
named `[proj]`, `{a,b}` or `c++(old)` a zone then matched no file, and
neither did a glob.

eslint-plugin-import does the same, so with an ESLint or oxlint config
nothing changes. Without one, the working directory is compared as a
path, and only what the options say is a pattern.

The docs examples that are their own project now run below a directory
named `[p]{a,b}+(c)`. The page of `import/no-restricted-paths` says how
a folder named `[id]` is written in a zone.
---
 .../lint/rules/import/no-restricted-paths.mdx |  26 ++
 docs/lint/rules/reports.json                  |   2 +-
 src/codegen/lint-rule-docs.ts                 |   8 +-
 src/lint/plugins/import_minimatch.rs          |  79 +++++-
 .../import_no_extraneous_dependencies.rs      |   7 +-
 .../rules/import_no_restricted_paths.rs       |  41 +--
 .../rules/import_no_unassigned_import.rs      |   4 +-
 test/cli/lint/glob.test.ts                    | 247 ++++++++++++++++++
 8 files changed, 379 insertions(+), 35 deletions(-)

diff --git a/docs/lint/rules/import/no-restricted-paths.mdx b/docs/lint/rules/import/no-restricted-paths.mdx
index df441ae9f0a3..bf252d2f5bbc 100644
--- a/docs/lint/rules/import/no-restricted-paths.mdx
+++ b/docs/lint/rules/import/no-restricted-paths.mdx
@@ -92,6 +92,32 @@ Each zone has these keys:
 
 If `from` is a path, each `except` is a path relative to `from` and must be inside it. If `from` is a glob, each `except` must be a glob too, and it needs to match the file's absolute path, like `**/types.js`.
 
+A folder name like `[id]` or `{a,b}` is glob syntax in `target` and `from`, from every directory you run `bun lint` in. So `./src/[id]` doesn't match the folder `src/[id]`. To name that folder, write a glob with the bracket in a set: `./src/[[]id]/**`.
+
+Reported:
+
+{/* file "src/server/db.js" */}
+```js src/server/db.js
+export function query() {}
+```
+
+{/* bad {"filename": "src/[id]/page.js", "root": true, "options": [{"zones": [{"target": "./src/[[]id]/**", "from": "./src/server"}]}]} */}
+```js src/[id]/page.js
+import { query } from "../server/db.js";
+```
+
+Not reported:
+
+{/* file "src/server/db.js" */}
+```js src/server/db.js
+export function query() {}
+```
+
+{/* good {"filename": "src/[id]/page.js", "root": true, "options": [{"zones": [{"target": "./src/[id]", "from": "./src/server"}]}]} */}
+```js src/[id]/page.js
+import { query } from "../server/db.js";
+```
+
 With this zone, `src/client/app.js` can import `../server/types.js` and nothing else from `src/server`:
 
 ```toml bunfig.toml
diff --git a/docs/lint/rules/reports.json b/docs/lint/rules/reports.json
index 7a8b9cf34c1d..feafa209f9a2 100644
--- a/docs/lint/rules/reports.json
+++ b/docs/lint/rules/reports.json
@@ -347,7 +347,7 @@
 "import/no-nodejs-modules": {"0":[[1,1,1,21,"Do not import Node.js builtin module \"fs\""],[2,1,2,34,"Do not import Node.js builtin module \"node:path\""],[4,12,4,25,"Do not import Node.js builtin module \"os\""]],"3":[[1,1,1,29,"Do not import Node.js builtin module \"path\""]]},
 "import/no-relative-packages": {"0":[[1,24,1,41,"Relative import from another package is not allowed. Use `@acme/ui/button.js` instead of `../ui/button.js`"]]},
 "import/no-relative-parent-imports": {"0":[[1,25,1,36,"Relative imports from parent directories are not allowed. Please either pass what you're importing through at runtime (dependency injection), move `home.js` to same directory as `../api.js` or consider making `../api.js` a package."]]},
-"import/no-restricted-paths": {"0":[[1,23,1,40,"Unexpected path \"../server/db.js\" imported in restricted zone."]]},
+"import/no-restricted-paths": {"0":[[1,23,1,40,"Unexpected path \"../server/db.js\" imported in restricted zone."]],"2":[[1,23,1,40,"Unexpected path \"../server/db.js\" imported in restricted zone."]]},
 "import/no-self-import": {"0":[[1,1,1,35,"Module imports itself."]],"1":[[1,21,1,33,"Module imports itself."]]},
 "import/no-unassigned-import": {"0":[[1,1,1,32,"Imported module should be assigned"],[2,1,2,25,"Imported module should be assigned"],[3,1,3,30,"Imported module should be assigned"]],"3":[[1,1,1,32,"Imported module should be assigned"]]},
 "import/no-unresolved": {"0":[[1,28,1,47,"Unable to resolve path to module './utils/fromat.js'."],[2,21,2,54,"Unable to resolve path to module 'a-package-that-is-not-installed'."]]},
diff --git a/src/codegen/lint-rule-docs.ts b/src/codegen/lint-rule-docs.ts
index 7affdd5cac50..53f793a9f313 100644
--- a/src/codegen/lint-rule-docs.ts
+++ b/src/codegen/lint-rule-docs.ts
@@ -441,7 +441,13 @@ export async function lintExamples(dir: string, examples: Example[], byPage: Map
   const nameOf = (it: Example) => `${it.page.replaceAll("/", "__")}__${it.line}`;
   // Those in another language are below an ESLint config of their own.
   const languagesOf = (it: Example) => byPage.get(it.page)!.languages;
-  const directoryOf = (it: Example) => join(dir, ...(languagesOf(it).length ? ["languages"] : []), nameOf(it));
+  // A `root` example has options that are paths. It is below a directory with a name that is a pattern, because the
+  // working directory is a path in each pattern that a rule joins to it.
+  const above = (it: Example) => [
+    ...(languagesOf(it).length ? ["languages"] : []),
+    ...(it.root ? ["[p]{a,b}+(c)"] : []),
+  ];
+  const directoryOf = (it: Example) => join(dir, ...above(it), nameOf(it));
   const put = (path: string, content: string) => (
     mkdirSync(dirname(path), { recursive: true }),
     writeFileSync(path, content)
diff --git a/src/lint/plugins/import_minimatch.rs b/src/lint/plugins/import_minimatch.rs
index ad10a193ef75..f58c5076f807 100644
--- a/src/lint/plugins/import_minimatch.rs
+++ b/src/lint/plugins/import_minimatch.rs
@@ -1,6 +1,8 @@
 //! minimatch as eslint-plugin-import's rules call it.
 
-use bun_lint::glob::{Minimatch, MinimatchOptions};
+use bun_glob::scan::is_glob;
+use bun_lint::ast::File;
+use bun_lint::glob::{Minimatch, MinimatchOptions, Under};
 use bun_lint::options::{Json, Object};
 use bun_lint::paths;
 use std::sync::OnceLock;
@@ -48,32 +50,83 @@ impl Glob {
     }
 }
 
+/// `new Minimatch(joined)` for `texts` that a rule joined to the working directory.
+pub(crate) enum JoinedGlob {
+    /// The working directory is a part of the pattern, as in the plugin. In a directory named `[app]` or `{a,b}` the
+    /// pattern matches no file.
+    Whole(Glob),
+    /// The working directory is a path, whatever its name is, and only what the texts say is a pattern.
+    BelowCwd(Under<Minimatch>),
+}
+
+impl JoinedGlob {
+    /// `cwd` is the working directory if [`reads_cwd_as_path`].
+    pub(crate) fn new(cwd: Option<&[u8]>, texts: &[&[u8]], joined: &[u8]) -> JoinedGlob {
+        let Some(cwd) = cwd else {
+            return JoinedGlob::Whole(Glob::new(joined));
+        };
+        let (directory, below) = Self::split(cwd, texts, joined);
+        JoinedGlob::BelowCwd(Under::new(directory, Minimatch::new(below)))
+    }
+
+    /// `isGlob(joined)`
+    pub(crate) fn is_glob(cwd: Option<&[u8]>, texts: &[&[u8]], joined: &[u8]) -> bool {
+        is_glob(cwd.map_or(joined, |cwd| Self::split(cwd, texts, joined).1))
+    }
+
+    fn split<'j>(cwd: &[u8], texts: &[&[u8]], joined: &'j [u8]) -> (&'j [u8], &'j [u8]) {
+        paths::split_joined(cwd, texts, paths::Style::of(cwd).separators(), joined)
+    }
+
+    /// `path` uses `/` as its separator.
+    pub(crate) fn matches(&self, path: &[u8]) -> bool {
+        match self {
+            JoinedGlob::Whole(glob) => glob.matches(path),
+            JoinedGlob::BelowCwd(glob) => {
+                (glob.below(path)).is_some_and(|(glob, rest)| glob.matches(rest))
+            }
+        }
+    }
+}
+
+/// True if `file` has no ESLint or oxlint config. No rule has to match the plugin then, so the working directory is a
+/// path in each pattern that a rule joins to it, whatever bytes its name has. A glob as written still matches the
+/// whole path of a file.
+pub(crate) fn reads_cwd_as_path(file: &File) -> bool {
+    file.language().has_no_foreign_config
+}
+
 /// `globs.some((glob) => minimatch(path, glob) || minimatch(path, join(process.cwd(), glob)))`
 pub(crate) struct GlobsFromCwd {
     patterns: Vec<Box<[u8]>>,
-    /// Each glob twice: as written, and joined to the cwd. Parsed once, because every file in a run has the same cwd.
-    parsed: OnceLock<Vec<[Glob; 2]>>,
+    /// Each glob twice: as written, and joined to the cwd. Parsed once for a file with [`reads_cwd_as_path`] and once
+    /// for one without, because every file in a run has the same cwd.
+    parsed: [OnceLock<Vec<(Glob, JoinedGlob)>>; 2],
 }
 
 impl GlobsFromCwd {
     pub(crate) fn new(patterns: &[&str]) -> GlobsFromCwd {
         GlobsFromCwd {
             patterns: patterns.iter().map(|it| it.as_bytes().into()).collect(),
-            parsed: OnceLock::new(),
+            parsed: Default::default(),
         }
     }
 
-    /// `path` uses `/` as its separator.
-    pub(crate) fn matches(&self, cwd: &[u8], path: &[u8]) -> bool {
-        let join = paths::join_normalized;
+    /// `path` uses `/` as its separator. `file` is the file that the rule runs for.
+    pub(crate) fn matches(&self, file: &File, cwd: &[u8], path: &[u8]) -> bool {
+        let is_path = reads_cwd_as_path(file);
         let both = |it: &[u8]| {
-            [
-                Glob::new(&paths::portable(cwd, it)),
-                Glob::new(&join(cwd, it)),
-            ]
+            let written = paths::portable(cwd, it);
+            let joined = paths::join_normalized(cwd, it);
+            (
+                Glob::new(&written),
+                JoinedGlob::new(is_path.then_some(cwd), &[&written], &joined),
+            )
         };
         let all = || self.patterns.iter().map(|it| both(it)).collect::<Vec<_>>();
-        let mut globs = self.parsed.get_or_init(all).iter().flatten();
-        globs.any(|it| it.matches(path))
+        let globs = self.parsed[usize::from(is_path)].get_or_init(all);
+        globs
+            .iter()
+            .any(|(written, joined)| written.matches(path) || joined.matches(path))
     }
 }
diff --git a/src/lint/plugins/rules/import_no_extraneous_dependencies.rs b/src/lint/plugins/rules/import_no_extraneous_dependencies.rs
index 70e789d634b5..665b16adccc7 100644
--- a/src/lint/plugins/rules/import_no_extraneous_dependencies.rs
+++ b/src/lint/plugins/rules/import_no_extraneous_dependencies.rs
@@ -87,10 +87,10 @@ impl Config {
     }
 
     /// `testConfig(config, filename) !== false`
-    fn allows(&self, cwd: &[u8], filename: &[u8]) -> bool {
+    fn allows(&self, file: &File, cwd: &[u8], filename: &[u8]) -> bool {
         match self {
             Config::Is(config) => *config,
-            Config::Globs(globs) => globs.matches(cwd, filename),
+            Config::Globs(globs) => globs.matches(file, cwd, filename),
         }
     }
 }
@@ -286,7 +286,8 @@ impl Rule for NoExtraneousDependencies {
             }
             None => self.closest_to(&filename, modules),
         };
-        let allowed = self.configs.iter().filter(|it| it.0.allows(cwd, &filename)).fold(IN_DEPS, |all, it| all | it.1);
+        let allows = |it: &&(Config, u8)| it.0.allows(file, cwd, &filename);
+        let allowed = self.configs.iter().filter(allows).fold(IN_DEPS, |all, it| all | it.1);
         let mut types = None;
         for visited in self.visitor.visit(file) {
             if !self.include_types && is_type_import(visited.importer) {
diff --git a/src/lint/plugins/rules/import_no_restricted_paths.rs b/src/lint/plugins/rules/import_no_restricted_paths.rs
index eaf240ed1cde..5f206a3f4afa 100644
--- a/src/lint/plugins/rules/import_no_restricted_paths.rs
+++ b/src/lint/plugins/rules/import_no_restricted_paths.rs
@@ -1,4 +1,4 @@
-use crate::import_minimatch::Glob;
+use crate::import_minimatch::{Glob, JoinedGlob, reads_cwd_as_path};
 use crate::import_resolve::{Resolved, Resolvers};
 use crate::module_visitor::{self, Systems};
 use bun_glob::scan::is_glob;
@@ -13,8 +13,9 @@ use std::sync::OnceLock;
 pub struct NoRestrictedPaths {
     zones: Vec<ZoneOptions>,
     base_path: Option<Box<[u8]>>,
-    /// The zones with absolute paths. Every file in a run has the same working directory.
-    read: OnceLock<Vec<Zone>>,
+    /// The zones with absolute paths, for a file with [`reads_cwd_as_path`] and for one without. Every file in a run
+    /// has the same working directory.
+    read: [OnceLock<Vec<Zone>>; 2],
 }
 
 /// A zone as it appears in the options.
@@ -37,7 +38,7 @@ const EXCEPTION_IS_NO_GLOB: Message =
     Message::new("", "Restricted path exceptions must be glob patterns when `from` contains glob patterns");
 
 enum Target {
-    Glob(Glob),
+    Glob(JoinedGlob),
     /// The path itself and everything under it.
     Path(Vec<u8>),
 }
@@ -48,7 +49,7 @@ enum Validators {
     Mixed,
     /// `computeGlobPatternPathValidator` for each glob. They all share the exceptions, which are `None` if one of them
     /// isn't a glob.
-    Globs(Vec<Glob>, Option<Vec<Glob>>),
+    Globs(Vec<JoinedGlob>, Option<Vec<Glob>>),
     /// `computeAbsolutePathValidator`: each path with its exceptions, which are `None` if one of them isn't under the
     /// path.
     Paths(Vec<(Vec<u8>, Option<Vec<Vec<u8>>>)>),
@@ -83,9 +84,12 @@ impl Target {
 }
 
 impl Zone {
-    /// `makePathValidators`
-    fn new(zone_options: &ZoneOptions, base_path: &[u8]) -> Zone {
+    /// `makePathValidators`. `base_path` is `base_text` resolved on the working directory, which is `cwd` if
+    /// [`reads_cwd_as_path`].
+    fn new(zone_options: &ZoneOptions, base_text: &[u8], base_path: &[u8], cwd: Option<&[u8]>) -> Zone {
         let absolute = |it: &[u8]| paths::resolve(base_path, it);
+        // An absolute path has nothing of the working directory.
+        let cwd_in = |it: &[u8]| cwd.filter(|_| !paths::is_absolute(base_text) && !paths::is_absolute(it));
         let globs = zone_options.from.iter().filter(|it| is_glob(it)).count();
         let from = if globs == 0 {
             let with_exceptions = |from: &[u8]| {
@@ -99,14 +103,18 @@ impl Zone {
         } else if globs == zone_options.from.len() {
             let are_valid = zone_options.except.iter().all(|it| is_glob(it));
             let exceptions = || zone_options.except.iter().map(|it| Glob::new(it)).collect::<Vec<Glob>>();
-            let from = zone_options.from.iter().map(|it| Glob::new(&absolute(it))).collect();
+            let glob = |it: &[u8]| JoinedGlob::new(cwd_in(it), &[base_text, it], &absolute(it));
+            let from = zone_options.from.iter().map(|it| glob(it)).collect();
             Validators::Globs(from, are_valid.then(exceptions))
         } else {
             Validators::Mixed
         };
-        let to_target = |it: &[u8]| match absolute(it) {
-            target if is_glob(&target) => Target::Glob(Glob::new(&target)),
-            target => Target::Path(target),
+        let to_target = |it: &[u8]| {
+            let (cwd, texts, target) = (cwd_in(it), [base_text, it], absolute(it));
+            match JoinedGlob::is_glob(cwd, &texts, &target) {
+                true => Target::Glob(JoinedGlob::new(cwd, &texts, &target)),
+                false => Target::Path(target),
+            }
         };
         Zone { target: zone_options.target.iter().map(|it| to_target(it)).collect(), from, message: zone_options.message.clone() }
     }
@@ -173,16 +181,19 @@ impl Rule for NoRestrictedPaths {
         NoRestrictedPaths {
             zones: options.array("zones").iter().map(zone).collect(),
             base_path: options.str("basePath").filter(|it| !it.is_empty()).map(|it| it.as_bytes().into()),
-            read: OnceLock::new(),
+            read: Default::default(),
         }
     }
 
     fn start<'a>(&self, file: &'a File<'a>) -> Option<Self::State<'a>> {
         let modules = file.modules().filter(|_| file.path() != b"<text>")?;
-        let zones = self.read.get_or_init(|| {
+        let is_path = reads_cwd_as_path(file);
+        let zones = self.read[usize::from(is_path)].get_or_init(|| {
             let cwd = modules.cwd();
+            let base_text = self.base_path.as_deref().unwrap_or_default();
             let base_path = self.base_path.as_ref().map_or_else(|| cwd.to_vec(), |it| paths::resolve(cwd, it));
-            self.zones.iter().map(|it| Zone::new(it, &base_path)).collect()
+            let zone = |it: &ZoneOptions| Zone::new(it, base_text, &base_path, is_path.then_some(cwd));
+            self.zones.iter().map(zone).collect()
         });
         let filename = paths::portable(file.path(), file.path());
         let is_target = |zone: &Zone| zone.target.iter().any(|it| it.has(&filename));
@@ -192,7 +203,7 @@ impl Rule for NoRestrictedPaths {
 
     fn finish(&self, cx: &mut Cx<'_, Self>) {
         let file = cx.file();
-        let Some(zones) = self.read.get() else {
+        let Some(zones) = self.read[usize::from(reads_cwd_as_path(file))].get() else {
             return;
         };
         let (Some(resolvers), Some(modules)) = (Resolvers::of(file.settings()), file.modules()) else {
diff --git a/src/lint/plugins/rules/import_no_unassigned_import.rs b/src/lint/plugins/rules/import_no_unassigned_import.rs
index e98363e2a2e2..574d4401cac6 100644
--- a/src/lint/plugins/rules/import_no_unassigned_import.rs
+++ b/src/lint/plugins/rules/import_no_unassigned_import.rs
@@ -86,10 +86,10 @@ impl NoUnassignedImport {
         };
         let cwd = modules.cwd();
         if !matches!(source.first(), Some(b'.' | b'/')) {
-            return self.allow.matches(cwd, source);
+            return self.allow.matches(file, cwd, source);
         }
         let filename = paths::portable(file.path(), file.path());
         let directory = paths::resolve(cwd, paths::dirname(&filename));
-        self.allow.matches(cwd, &paths::resolve(&directory, source))
+        self.allow.matches(file, cwd, &paths::resolve(&directory, source))
     }
 }
diff --git a/test/cli/lint/glob.test.ts b/test/cli/lint/glob.test.ts
index c325a1798d53..cb851c389d96 100644
--- a/test/cli/lint/glob.test.ts
+++ b/test/cli/lint/glob.test.ts
@@ -1000,3 +1000,250 @@ describe("ignore patterns for the installed ESLint, from another directory than
     debugTimeout,
   );
 });
+
+// The import rules join the working directory in front of their patterns. Without an ESLint or oxlint config, no rule
+// has to match eslint-plugin-import, and the working directory is a path. On POSIX a name can also have a `|` or a `*`.
+const oddNames = ["[proj]", "{a,b}", "c++(old)", "app@(v2)", ...(isWindows ? [] : ["a(b|c)", "s*"])];
+// A class, an extglob group, and a name that only is-glob takes for a pattern.
+const someOddNames = ["[proj]", "c++(old)", ...(isWindows ? [] : ["a(b|c)"])];
+
+const devDependency = {
+  "package.json": JSON.stringify({ name: "p", type: "module", devDependencies: { dev: "1.0.0" } }),
+  "node_modules/dev/package.json": JSON.stringify({ name: "dev", version: "1.0.0", main: "index.js" }),
+  "node_modules/dev/index.js": "module.exports = 1;\n",
+};
+// Every option that the import rules join to the working directory: a path and a glob as `target` and as `from`, and
+// the globs of the two other rules.
+const zonedOptions = {
+  "import/no-restricted-paths": {
+    zones: [
+      { target: "./src/client", from: "./src/server" },
+      { target: "./src/pages/**", from: "./src/db/**", except: ["**/types.js"] },
+    ],
+  },
+  "import/no-extraneous-dependencies": { devDependencies: ["test/**"] },
+  "import/no-unassigned-import": { allow: ["src/client/*.css"] },
+};
+const zonedFiles = {
+  ...devDependency,
+  "src/server/db.js": "export function query() {}\n",
+  "src/client/style.css": "a {}\n",
+  "src/client/other.scss": "a {}\n",
+  "src/client/app.js": `import "./style.css";\nimport "./other.scss";\nimport { query } from "../server/db.js";\nimport dev from "dev";\nquery(dev);\n`,
+  "src/db/q.js": "export const q = 1;\n",
+  "src/db/types.js": "export const T = 1;\n",
+  "src/pages/p.js": `import { q } from "../db/q.js";\nimport { T } from "../db/types.js";\nexport const p = [q, T];\n`,
+  "test/a.test.js": `import dev from "dev";\nexport default dev;\n`,
+};
+// A JSON object is an inline table.
+const toml = (value: unknown): string =>
+  Array.isArray(value)
+    ? `[${value.map(toml).join(", ")}]`
+    : typeof value === "object" && value !== null
+      ? `{ ${Object.entries(value)
+          .map(([key, it]) => `${key} = ${toml(it)}`)
+          .join(", ")} }`
+      : JSON.stringify(value);
+const zonedProject = {
+  ...zonedFiles,
+  "bunfig.toml": `[lint.rules]\n${Object.entries(zonedOptions)
+    .map(([rule, options]) => `"${rule}" = ["error", ${toml(options)}]\n`)
+    .join("")}`,
+};
+const zonedReports = [
+  "src/client/app.js:2 import/no-unassigned-import",
+  "src/client/app.js:3 import/no-restricted-paths",
+  "src/client/app.js:4 import/no-extraneous-dependencies",
+  "src/pages/p.js:1 import/no-restricted-paths",
+];
+
+test.concurrent.each(["proj", ...oddNames])(
+  "the import rules report the same in a working directory named %s",
+  async name => {
+    expect(await reportedIn(name, zonedProject)).toEqual(zonedReports);
+  },
+  debugTimeout,
+);
+
+// There the globs get a `../` in front, and so does the `basePath` of the zones. From `test` no zone is below the
+// working directory.
+test.concurrent.each([...someOddNames.map(name => [name, "src"]), ["[proj]", "test"]])(
+  "the import rules report the same in a directory named %s, from its directory %s",
+  async (name, cwd) => {
+    expect(await reportedIn(name, zonedProject, [".."], cwd)).toEqual(zonedReports);
+  },
+  debugTimeout,
+);
+
+const importingQuery = (path: string) => `import { query } from "${path}";\nquery();\n`;
+
+test.concurrent.each(someOddNames)(
+  "import/no-restricted-paths: a zone next to the working directory, below a directory named %s",
+  async name => {
+    const files = {
+      "app/src/server/db.js": "export function query() {}\n",
+      "app/bunfig.toml": `[lint.rules]\n"import/no-restricted-paths" = ["error", { zones = [{ target = "../lib/src", from = "./src/server" }] }]\n`,
+      "lib/src/x.js": importingQuery("../../app/src/server/db.js"),
+    };
+    expect(await reportedIn(name, files, [".", "../lib"], "app")).toEqual([
+      "lib/src/x.js:1 import/no-restricted-paths",
+    ]);
+  },
+  debugTimeout,
+);
+
+// The `..` is in `basePath`, and what the zones say follows it.
+test.concurrent.each(["ws", ...someOddNames])(
+  "import/no-restricted-paths: a `basePath` next to the working directory, below a directory named %s",
+  async name => {
+    const zones = [
+      `{ target = "./src/client", from = "./src/server" }`,
+      `{ target = "./src/client/**", from = "./src/server/**" }`,
+    ];
+    const files = {
+      "app/bunfig.toml": `[lint.rules]\n"import/no-restricted-paths" = ["error", { basePath = "../lib", zones = [${zones.join(", ")}] }]\n`,
+      "lib/src/server/db.js": "export function query() {}\n",
+      "lib/src/client/c.js": importingQuery("../server/db.js"),
+    };
+    const reported = "lib/src/client/c.js:1 import/no-restricted-paths";
+    expect(await reportedIn(name, files, ["../lib"], "app")).toEqual([reported, reported]);
+  },
+  debugTimeout,
+);
+
+// With an ESLint config the rules are those of the plugin, which compiles the working directory with each pattern.
+// These are the reports of ESLint 9.39.5 and 10.13.0 with eslint-plugin-import 2.32.0 for this project.
+test.concurrent(
+  "with an ESLint config, the import rules report what eslint-plugin-import reports in a directory named [proj]",
+  async () => {
+    const rule = `{ meta: { schema: false }, create() { return {}; } }`;
+    const rules = Object.entries(zonedOptions).map(([id, options]) => [id, ["error", options]]);
+    const files = {
+      ...zonedFiles,
+      "package.json": JSON.stringify({
+        name: "p",
+        type: "module",
+        dependencies: { "eslint-plugin-import": "2.32.0" },
+        devDependencies: { dev: "1.0.0" },
+      }),
+      "node_modules/eslint-plugin-import/package.json": JSON.stringify({
+        name: "eslint-plugin-import",
+        version: "2.32.0",
+        main: "index.js",
+      }),
+      "node_modules/eslint-plugin-import/index.js": `module.exports = { meta: { name: "eslint-plugin-import" }, rules: { ${Object.keys(
+        zonedOptions,
+      )
+        .map(id => `"${id.slice("import/".length)}": ${rule}`)
+        .join(", ")} } };\n`,
+      "eslint.config.mjs": `import plugin from "eslint-plugin-import";\nexport default [{ plugins: { import: plugin }, rules: ${JSON.stringify(
+        Object.fromEntries(rules),
+      )} }];\n`,
+    };
+    expect(await reportedIn("[proj]", files)).toEqual([
+      "src/client/app.js:1 import/no-unassigned-import",
+      "src/client/app.js:2 import/no-unassigned-import",
+      "src/client/app.js:4 import/no-extraneous-dependencies",
+      "test/a.test.js:1 import/no-extraneous-dependencies",
+    ]);
+  },
+  debugTimeout,
+);
+
+// One rule, with the same options, is for the files of both kinds in a run. In a directory named `[proj]`, ESLint
+// 8.57.1 with eslint-plugin-import 2.32.0 reports no zone in the package, and both globs match no file there.
+test.concurrent.each(["proj", "[proj]"])(
+  "in a directory named %s, a package with an ESLint config gets the reports of eslint-plugin-import",
+  async name => {
+    const roots = ["", "pkg/"];
+    const zones = roots.map(it => `{ target = "./${it}src/client", from = "./${it}src/server" }`);
+    const globs = (below: string) => roots.map(it => JSON.stringify(`${it}${below}`)).join(", ");
+    const files = {
+      ...devDependency,
+      "bunfig.toml": `[lint.rules]
+"import/no-restricted-paths" = ["error", { zones = [${zones.join(", ")}] }]
+"import/no-extraneous-dependencies" = ["error", { devDependencies = [${globs("test/**")}] }]
+"import/no-unassigned-import" = ["error", { allow = [${globs("src/client/*.css")}] }]
+`,
+      "pkg/.eslintrc.json": JSON.stringify({
+        root: true,
+        parserOptions: { ecmaVersion: 2022, sourceType: "module" },
+        plugins: ["import"],
+      }),
+      ...Object.fromEntries(
+        roots.flatMap(it => [
+          [`${it}src/server/db.js`, "export function query() {}\n"],
+          [`${it}src/client/style.css`, "a {}\n"],
+          [`${it}src/client/c.js`, `import "./style.css";\n${importingQuery("../server/db.js")}`],
+          [`${it}test/a.test.js`, `import dev from "dev";\nexport default dev;\n`],
+        ]),
+      ),
+    };
+    const inPackage =
+      name === "proj"
+        ? ["pkg/src/client/c.js:2 import/no-restricted-paths"]
+        : [
+            "pkg/src/client/c.js:1 import/no-unassigned-import",
+            "pkg/test/a.test.js:1 import/no-extraneous-dependencies",
+          ];
+    expect(await reportedIn(name, files)).toEqual([...inPackage, "src/client/c.js:2 import/no-restricted-paths"]);
+  },
+  debugTimeout,
+);
+
+// Only the directory that `bun lint` joins is a path. What the options say is a pattern, `basePath` too.
+test.concurrent(
+  "import/no-restricted-paths: a `basePath` with a wildcard is a pattern",
+  async () => {
+    const files = {
+      "bunfig.toml": `[lint.rules]\n"import/no-restricted-paths" = ["error", { basePath = "./packages/*", zones = [{ target = "./src/client/**", from = "./src/server/**" }] }]\n`,
+      "packages/one/src/server/db.js": "export function query() {}\n",
+      "packages/one/src/client/c.js": importingQuery("../server/db.js"),
+    };
+    expect(await reportedIn("proj", files)).toEqual(["packages/one/src/client/c.js:1 import/no-restricted-paths"]);
+  },
+  debugTimeout,
+);
+
+// An absolute path in the options is a pattern as a whole, also where it goes through the working directory.
+test.concurrent.each([
+  ["proj", ["src/client/c.js:1 import/no-restricted-paths"]],
+  ["[proj]", []],
+])(
+  "import/no-restricted-paths: an absolute `target` in a directory named %s",
+  async (name, expected) => {
+    const files = (directory: string) => ({
+      [`${name}/bunfig.toml`]: `[lint.rules]\n"import/no-restricted-paths" = ["error", { zones = [{ target = ${JSON.stringify(
+        join(directory, name, "src/client").replaceAll("\\", "/"),
+      )}, from = "./src/server" }] }]\n`,
+      [`${name}/src/server/db.js`]: "export function query() {}\n",
+      [`${name}/src/client/c.js`]: importingQuery("../server/db.js"),
+    });
+    expect(await reportedFrom(name, files, [], name)).toEqual(expected);
+  },
+  debugTimeout,
+);
+
+// So a folder that the options name reads the same from every directory, also from inside that folder.
+test.concurrent.each([".", "app", "app/[locale]", "app/[locale]/client"])(
+  "the import rules read a folder that bunfig.toml names as a pattern, from the directory %s",
+  async cwd => {
+    const files = {
+      ...devDependency,
+      "bunfig.toml": `[lint.rules]
+"import/no-restricted-paths" = ["error", { zones = [{ target = "./app/[locale]/client", from = "./app/[locale]/server" }] }]
+"import/no-extraneous-dependencies" = ["error", { devDependencies = ["app/[locale]/test/**"] }]
+"import/no-unassigned-import" = ["error", { allow = ["app/[locale]/client/*.css"] }]
+`,
+      "app/[locale]/server/db.js": "export function query() {}\n",
+      "app/[locale]/client/style.css": "a {}\n",
+      "app/[locale]/client/c.js": `import "./style.css";\nimport { query } from "../server/db.js";\nquery();\n`,
+      "app/[locale]/test/a.test.js": `import dev from "dev";\nexport default dev;\n`,
+    };
+    expect(await reportedFrom(cwd, files, [relative(cwd, "app/[locale]") || "."])).toEqual([
+      "app/[locale]/client/c.js:1 import/no-unassigned-import",
+      "app/[locale]/test/a.test.js:1 import/no-extraneous-dependencies",
+    ]);
+  },
+  debugTimeout,
+);

From 71f0895aa673ac5781afa96cc42b3c95f8f8d69a Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 25 Oct 2026 20:06:43 +0000
Subject: [PATCH 3/4] lint tests: write the config file of the stand-in project
 with a `/` in its path

On Windows `path.join` makes `pkg\eslint.config.mjs` of it, and the
harness only makes the directory of a file whose path has a `/`.
---
 test/cli/lint/glob.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/cli/lint/glob.test.ts b/test/cli/lint/glob.test.ts
index cb851c389d96..e4c9de17e740 100644
--- a/test/cli/lint/glob.test.ts
+++ b/test/cli/lint/glob.test.ts
@@ -909,7 +909,7 @@ describe("ignore patterns for the installed ESLint, from another directory than
   async function sent(version: string, args: string[], { name = "pkg", config: at = ".", cwd = name, more = {} } = {}) {
     using dir = tempDir("bun-lint-glob", {
       ...eslintAt(version),
-      [join(at, "eslint.config.mjs")]: config,
+      [`${at}/eslint.config.mjs`]: config,
       ...Object.fromEntries(
         ["keep", "dist/keep", "dist/x", "src/y"].map(it => [`${name}/${it}.vue`, "<template />\n"]),
       ),

From 10ac5fb32680e3c22414c6635816d5507ae5ea3b Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 25 Oct 2026 20:35:43 +0000
Subject: [PATCH 4/4] lint: keep each new comment to one line

The worker reads the ESLint version in `reviveOverride`, where it writes `basePath`. The record of `eslintFrom` is as on main.
---
 src/codegen/lint-rule-docs.ts                 |  3 +--
 src/lint/glob.rs                              |  4 +--
 src/lint/graph/lib.rs                         | 16 ++++-------
 src/lint/js_plugin/worker/eslint.js           | 27 ++++++++++---------
 src/lint/paths.rs                             |  6 +----
 src/lint/plugins/import_minimatch.rs          | 10 +++----
 .../rules/import_no_restricted_paths.rs       |  6 ++---
 7 files changed, 28 insertions(+), 44 deletions(-)

diff --git a/src/codegen/lint-rule-docs.ts b/src/codegen/lint-rule-docs.ts
index 53f793a9f313..9e0e7a6b7f65 100644
--- a/src/codegen/lint-rule-docs.ts
+++ b/src/codegen/lint-rule-docs.ts
@@ -441,8 +441,7 @@ export async function lintExamples(dir: string, examples: Example[], byPage: Map
   const nameOf = (it: Example) => `${it.page.replaceAll("/", "__")}__${it.line}`;
   // Those in another language are below an ESLint config of their own.
   const languagesOf = (it: Example) => byPage.get(it.page)!.languages;
-  // A `root` example has options that are paths. It is below a directory with a name that is a pattern, because the
-  // working directory is a path in each pattern that a rule joins to it.
+  // A `root` example has options that are paths, so it runs below a directory with a name that is a pattern.
   const above = (it: Example) => [
     ...(languagesOf(it).length ? ["languages"] : []),
     ...(it.root ? ["[p]{a,b}+(c)"] : []),
diff --git a/src/lint/glob.rs b/src/lint/glob.rs
index 10e967dce793..52908e423076 100644
--- a/src/lint/glob.rs
+++ b/src/lint/glob.rs
@@ -235,9 +235,7 @@ impl Minimatch {
     }
 }
 
-/// A pattern for the paths below a directory, with the directory kept out of the pattern. Joined into one pattern, a
-/// directory named `[app]` or `{a,b}` is a class or a group, and matches no path in it. `directory` is compared byte
-/// by byte, and `below` matches the rest of the path.
+/// A pattern for the paths below `directory`, which is compared byte by byte: a name like `[app]` is no class there.
 pub struct Under<M> {
     directory: Box<[u8]>,
     below: M,
diff --git a/src/lint/graph/lib.rs b/src/lint/graph/lib.rs
index b4219bd3f2c1..54c73c888edf 100644
--- a/src/lint/graph/lib.rs
+++ b/src/lint/graph/lib.rs
@@ -147,8 +147,7 @@ struct Caches<'h> {
     resolvers: ShardedMap<Vec<u8>, ProjectResolver<'h>>,
     /// Maps a directory to the `tsconfig.json` path for its files. With [`Store::tsconfig`], the key is a file.
     configs: ShardedMap<Vec<u8>, Vec<u8>>,
-    /// Caches [`Graph::scopes_in`] and [`Graph::scopes_of`], and [`Graph::scopes_of_typescript_resolver`] with a NUL
-    /// before the key.
+    /// Caches [`Graph::scopes_in`], [`Graph::scopes_of`] and, after a NUL, [`Graph::scopes_of_typescript_resolver`].
     scopes: ShardedMap<Vec<u8>, Vec<Scope>>,
     /// Caches [`Graph::configs_of_typescript_resolver`], keyed by the directory and the projects, and
     /// [`Graph::listed_projects`], keyed by the projects.
@@ -231,11 +230,9 @@ pub type Parallel<'p> = &'p dyn Fn(usize, &(dyn Fn(usize) + Sync));
 /// How the directory of a `tsconfig.json` is read in an `include` or `exclude` entry that is joined to it.
 #[derive(Copy, Clone)]
 enum Directory {
-    /// As a part of the pattern, like oxc-resolver does. A directory named `[x]` or `{y}` is a class or a group, so
-    /// oxlint applies no `include` pattern in it.
+    /// As a part of the pattern, like oxc-resolver: in a directory named `[x]` oxlint applies no `include` pattern.
     Pattern,
-    /// As a path, whatever its name is. For eslint-import-resolver-typescript a `[` or a `{` is no syntax anywhere in
-    /// an entry. Here the rest of the entry is still a pattern as oxc-resolver reads it.
+    /// As a path, whatever its name is, like eslint-import-resolver-typescript. The rest of an entry stays a pattern.
     Path,
 }
 
@@ -467,8 +464,7 @@ impl<'h> Graph<'h> {
         }
     }
 
-    /// The same for eslint-import-resolver-typescript, which applies `include` and `exclude` in a directory of any
-    /// name.
+    /// The same with [`Directory::Path`], for eslint-import-resolver-typescript.
     fn scopes_of_typescript_resolver(&self, config: &[u8]) -> &[Scope] {
         let key = [b"\0", config].concat();
         match self.caches().scopes.get_ref(&key[..]) {
@@ -581,9 +577,7 @@ impl<'h> Graph<'h> {
             }
             0 => self.config_in(&self.store.cwd).into_iter().collect(),
             1 => listed,
-            // The closest project that includes the file, alone. The resolver does that once the project has resolved
-            // an import. Before, it also tries the next projects that include the file, so what it reports depends on
-            // the order of the files and of their imports.
+            // The closest project that includes the file, alone, as the resolver does once it has resolved an import.
             _ => match listed.iter().position(applies_to_file) {
                 Some(at) => vec![listed.swap_remove(at)],
                 None => listed,
diff --git a/src/lint/js_plugin/worker/eslint.js b/src/lint/js_plugin/worker/eslint.js
index 6eb097bf11f1..09ea86ea1a1e 100644
--- a/src/lint/js_plugin/worker/eslint.js
+++ b/src/lint/js_plugin/worker/eslint.js
@@ -11,9 +11,8 @@ const CONFIGURE_ESLINT = 21;
 const NEEDS_ESLINT_CONFIGURATION = "4";
 const NOT_INSTALLED = "5";
 
-// By the directory that it is looked for from: `{ Linter, FlatConfigArray, knowsBasePath }`, or `null` if it is not installed.
-// `FlatConfigArray`, which the package does not export, is `null` if it is not where it has been since ESLint 8.21.
-// `knowsBasePath`: a config object can say what its patterns are relative to, since ESLint 9.30. An older one rejects the key.
+// By the directory that it is looked for from: `{ Linter, FlatConfigArray }`, or `null` if it is not installed. `FlatConfigArray`,
+// which the package does not export, is `null` if it is not where it has been since ESLint 8.21.
 const eslintPackages = new Map();
 
 function eslintFrom(directory) {
@@ -27,9 +26,7 @@ function eslintFrom(directory) {
   } catch {}
   found = null;
   if (root !== null) {
-    found = { Linter: from("eslint").Linter, FlatConfigArray: null, knowsBasePath: false };
-    const [major, minor] = String(found.Linter.version).split(".").map(Number);
-    found.knowsBasePath = major > 9 || (major === 9 && minor >= 30);
+    found = { Linter: from("eslint").Linter, FlatConfigArray: null };
     try {
       found.FlatConfigArray =
         require(nodePath.join(root, "lib", "config", "flat-config-array.js")).FlatConfigArray ?? null;
@@ -114,10 +111,16 @@ function movedPattern(pattern, from, to) {
   return rest.startsWith(up) ? bang + rest.slice(up.length) : `${bang}${down}/${rest}`;
 }
 
+// A config object can have a `basePath` since ESLint 9.30, where ESLint passes its own `--ignore-pattern` that way.
+function knowsBasePath(Linter) {
+  const [major, minor] = String(Linter.version).split(".").map(Number);
+  return major > 9 || (major === 9 && minor >= 30);
+}
+
 // Prepares a config object that the command line or bunfig.toml adds. Its plugins and parser arrive as names. Its `basePath` says
-// what its patterns are relative to, if that isn't `arrayBase`, the base path of the config array. ESLint passes the directory
-// of `--ignore-pattern` that way since 9.30. An older one rejects the key, and wrote the directory in front of each pattern.
-async function reviveOverride(object, arrayBase, knowsBasePath) {
+// what its patterns are relative to, if that isn't `arrayBase`, the base path of the config array. ESLint only knows `basePath`
+// in config objects since 9.30 and rejects unknown keys, so the key is only passed on to a `Linter` that knows it.
+async function reviveOverride(object, arrayBase, Linter) {
   const resolve = createRequire(nodePath.join(cwd, "noop.js")).resolve;
   const importFrom = async name => load(pathToFileURL(resolve(name)).href);
   const { $globsOfBun: isOfBunfig, $jsPlugins: located = {}, basePath = arrayBase, ...revived } = object;
@@ -125,7 +128,7 @@ async function reviveOverride(object, arrayBase, knowsBasePath) {
     revived.files = [bunfigMatcher(object.files, basePath)];
     if (object.ignores !== undefined) revived.ignores = [bunfigMatcher(object.ignores, basePath)];
   } else if (object.ignores !== undefined && nodePath.relative(arrayBase, basePath) !== "") {
-    if (knowsBasePath) revived.basePath = basePath;
+    if (knowsBasePath(Linter)) revived.basePath = basePath;
     else revived.ignores = object.ignores.map(it => movedPattern(it, basePath, arrayBase));
   }
   if (object.plugins !== undefined) {
@@ -161,7 +164,7 @@ async function reviveOverride(object, arrayBase, knowsBasePath) {
 
 // ESLint's `calculateConfigArray`: all of the configuration file, for a file whose configuration has what only JavaScript can say.
 // `file`: `null` under `--no-config-lookup`.
-async function wholeConfiguration({ FlatConfigArray, knowsBasePath }, { file, basePath, ignores, added }) {
+async function wholeConfiguration({ Linter, FlatConfigArray }, { file, basePath, ignores, added }) {
   // Of an array that is only an array the `Linter` makes one for each file.
   const configs = FlatConfigArray === null ? [] : new FlatConfigArray([], { basePath, shouldIgnore: ignores });
   if (file !== null) {
@@ -172,7 +175,7 @@ async function wholeConfiguration({ FlatConfigArray, knowsBasePath }, { file, ba
   }
   // The `Linter` turns a plain array into a config array whose base path is its `cwd`.
   const arrayBase = FlatConfigArray === null ? cwd : basePath;
-  for (const object of added) configs.push(await reviveOverride(object, arrayBase, knowsBasePath));
+  for (const object of added) configs.push(await reviveOverride(object, arrayBase, Linter));
   await configs.normalize?.();
   if (configs.getConfig === undefined) return configs;
   return Object.assign([], { getConfig: name => withoutProcessor(configs.getConfig(name)) });
diff --git a/src/lint/paths.rs b/src/lint/paths.rs
index a786fb40407f..4f2950e4cf0d 100644
--- a/src/lint/paths.rs
+++ b/src/lint/paths.rs
@@ -225,11 +225,7 @@ pub fn inside_as<'p>(style: Style, directory: &[u8], path: &'p [u8]) -> Option<&
     }
 }
 
-/// Splits `joined`, which is `texts` joined to `directory` one after the other, into what is left of the directory and
-/// what the texts say. The first part is a path, whatever bytes it has. A `..` that leads out of the texts takes a
-/// name off it. The second part is a pattern if a text is one. Unless the first part is empty, the second is empty or
-/// starts with a `/`, so it matches what it matched as a part of `joined`. `separators` are the bytes that the join
-/// took for separators in the texts.
+/// Splits `joined`, `texts` joined to `directory`, after the directory less a name for each `..` that leaves the texts.
 pub fn split_joined<'j>(
     directory: &[u8],
     texts: &[&[u8]],
diff --git a/src/lint/plugins/import_minimatch.rs b/src/lint/plugins/import_minimatch.rs
index f58c5076f807..bdace4e9a0c6 100644
--- a/src/lint/plugins/import_minimatch.rs
+++ b/src/lint/plugins/import_minimatch.rs
@@ -52,8 +52,7 @@ impl Glob {
 
 /// `new Minimatch(joined)` for `texts` that a rule joined to the working directory.
 pub(crate) enum JoinedGlob {
-    /// The working directory is a part of the pattern, as in the plugin. In a directory named `[app]` or `{a,b}` the
-    /// pattern matches no file.
+    /// The working directory is a part of the pattern, as in the plugin: in one named `[app]` it matches no file.
     Whole(Glob),
     /// The working directory is a path, whatever its name is, and only what the texts say is a pattern.
     BelowCwd(Under<Minimatch>),
@@ -89,9 +88,7 @@ impl JoinedGlob {
     }
 }
 
-/// True if `file` has no ESLint or oxlint config. No rule has to match the plugin then, so the working directory is a
-/// path in each pattern that a rule joins to it, whatever bytes its name has. A glob as written still matches the
-/// whole path of a file.
+/// True without an ESLint or oxlint config: no rule has to match the plugin, so a joined working directory is a path.
 pub(crate) fn reads_cwd_as_path(file: &File) -> bool {
     file.language().has_no_foreign_config
 }
@@ -99,8 +96,7 @@ pub(crate) fn reads_cwd_as_path(file: &File) -> bool {
 /// `globs.some((glob) => minimatch(path, glob) || minimatch(path, join(process.cwd(), glob)))`
 pub(crate) struct GlobsFromCwd {
     patterns: Vec<Box<[u8]>>,
-    /// Each glob twice: as written, and joined to the cwd. Parsed once for a file with [`reads_cwd_as_path`] and once
-    /// for one without, because every file in a run has the same cwd.
+    /// Each glob as written and joined to the cwd, parsed once for each answer of [`reads_cwd_as_path`].
     parsed: [OnceLock<Vec<(Glob, JoinedGlob)>>; 2],
 }
 
diff --git a/src/lint/plugins/rules/import_no_restricted_paths.rs b/src/lint/plugins/rules/import_no_restricted_paths.rs
index 5f206a3f4afa..0007f5429531 100644
--- a/src/lint/plugins/rules/import_no_restricted_paths.rs
+++ b/src/lint/plugins/rules/import_no_restricted_paths.rs
@@ -13,8 +13,7 @@ use std::sync::OnceLock;
 pub struct NoRestrictedPaths {
     zones: Vec<ZoneOptions>,
     base_path: Option<Box<[u8]>>,
-    /// The zones with absolute paths, for a file with [`reads_cwd_as_path`] and for one without. Every file in a run
-    /// has the same working directory.
+    /// The zones with absolute paths, built once for each answer of [`reads_cwd_as_path`].
     read: [OnceLock<Vec<Zone>>; 2],
 }
 
@@ -84,8 +83,7 @@ impl Target {
 }
 
 impl Zone {
-    /// `makePathValidators`. `base_path` is `base_text` resolved on the working directory, which is `cwd` if
-    /// [`reads_cwd_as_path`].
+    /// `makePathValidators`. `base_path` is `base_text` resolved on the cwd, which is `cwd` if [`reads_cwd_as_path`].
     fn new(zone_options: &ZoneOptions, base_text: &[u8], base_path: &[u8], cwd: Option<&[u8]>) -> Zone {
         let absolute = |it: &[u8]| paths::resolve(base_path, it);
         // An absolute path has nothing of the working directory.