Fix cert bind mount: detect WSL2 and use /tmp elsewhere for staging

Root cause: MSYS2 (Git Bash) cannot resolve 8.3 shortname directories
(e.g. FRANCO~1.MOR) via its POSIX layer, so touch/cp would fail when
cygpath converted Windows TEMP to /c/Users/FRANCO~1.MOR/....

Key insight: in Git Bash, /tmp is MSYS2's mapping of Windows TEMP itself,
so writing to /tmp already creates the file at the Windows TEMP path that
Docker Desktop uses for the bind mount source.

New logic:
- WSL2 (/proc/version contains "microsoft"): wslpath converts Windows TEMP
  to /mnt/c/... so the file is written to the Windows filesystem
- Git Bash + Linux/macOS: write directly to /tmp (Git Bash maps this to
  Windows TEMP; Linux/macOS /tmp is Docker-accessible directly)

Also make postCreateCommand skip the cert file if it is a directory
(defensive against any future bind mount failure).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: francois-mora-sonarsource

.claude/rules.md

@@ -52,3 +52,27 @@ export const rule: Rule.RuleModule = {
   },
 };
 ```
+
+## Testing
+
+### RuleTesters
+
+| RuleTester                 | Use When                                    |
+| -------------------------- | ------------------------------------------- |
+| `DefaultParserRuleTester`  | Pure JavaScript rules, no TS syntax         |
+| `NoTypeCheckingRuleTester` | JS/TS rules that don't need type info       |
+| `RuleTester`               | Rules requiring TypeScript type information |
+
+### Running Tests
+
+```bash
+npx tsx --test packages/jsts/src/rules/S1234/**/*.test.ts
+```
+
+## Shared Helpers
+
+Check `packages/jsts/src/rules/helpers/` before writing utilities:
+
+- `ast.ts` - AST traversal and node type checking
+- `module.ts` - Module detection, `getFullyQualifiedName`
+- `package-jsons/dependencies.ts` - Dependency detection

.claude/skills/build/SKILL.md

@@ -6,6 +6,7 @@ description: Build pipeline for SonarJS. Use when asked to build the project, re
 ## Quick Reference
 
 ```bash
+npm ci                          # Install dependencies
 npm run bbf                     # Fast JS/TS build (no tests): clear lib + generate-meta + compile
 npm run generate-meta           # Regenerate generated-meta.ts files from RSPEC JSON
 npm run generate-java-rule-classes  # Regenerate Java check classes

.claude/skills/ruling/SKILL.md

@@ -6,17 +6,17 @@ disable-model-invocation: true
 
 ## Overview
 
-Ruling tests analyze large third-party codebases and compare issues against expected output. Run them when adding or modifying rules to verify real-world behavior.
+Ruling tests analyze large third-party codebases (JS/TS and CSS) and compare issues against expected output. Run them when adding or modifying rules to verify real-world behavior.
 
 > **Warning:** Running ruling tests removes `node_modules` from the project root. Run `npm ci` afterward.
 
-## JS/TS Ruling
+## Running Ruling
 
 ```bash
 # Prerequisite: rebuild the jar first
 mvn install -DskipTests
 
-# Run ruling
+# Run ruling (JS/TS and CSS)
 npm run ruling
 
 # Sync actual → expected (after reviewing output)
@@ -28,43 +28,31 @@ sh tools/ruling-debug-script.sh
 
 Results:
 - Actual: `packages/ruling/actual/`
-- Expected: `its/ruling/src/test/resources/expected/`
+- Expected: `its/ruling/src/test/expected/`
 
-## CSS Ruling
+## Java Ruling (Old Way)
 
 ```bash
 cd its/ruling
-mvn verify -Dtest=CssRulingTest -Dmaven.test.redirectTestOutputToFile=false
-```
-
-Then copy actual to expected:
-```bash
-cp -R target/actual/css/ src/test/expected/css
-```
-
-## Old JS/TS Way (Maven)
-
-```bash
-cd its/ruling
-mvn verify -Dtest=JsTsRulingTest -Dmaven.test.redirectTestOutputToFile=false
+mvn verify -Dtest=RulingTest -Dmaven.test.redirectTestOutputToFile=false
 ```
 
 Copy actual to expected:
 ```bash
-cp -R target/actual/jsts/ src/test/expected/jsts
+cp -R target/actual/ src/test/expected/
 ```
 
 Review diff:
 ```bash
-diff -rq src/test/expected/jsts target/actual/jsts
+diff -rq src/test/expected target/actual
 ```
 
 ## Custom Source Files for New Rules
 
 If a new rule raises no issues on existing sources, add test code:
 
-- `its/sources/jsts/custom/S1234.js` — regular code
-- `its/sources/jsts/custom/tests/S1234.js` — test code
+- `its/sources/custom/jsts/S1234.js` — regular code
+- `its/sources/custom/jsts/tests/S1234.js` — test code
 
 Copy from RSPEC HTML description (compliant/non-compliant examples).
 

.devcontainer/devcontainer.json

@@ -17,12 +17,13 @@
   "remoteUser": "node",
   // initializeCommand runs on the host before container creation (before the repo is cloned).
   // It stages the corporate CA cert and ~/.npmrc so Docker can bind-mount them.
-  // On Windows (TEMP starts with a drive letter): uses cmd.exe, which resolves 8.3 shortnames
-  // natively via %TEMP% — avoiding the MSYS2 limitation that blocks cygpath-converted paths.
-  // On Linux/macOS (TEMP is a Unix path or unset): uses bash directly with /tmp.
+  // On WSL2: /tmp is the distro's /tmp (not accessible to Docker Desktop), so wslpath converts
+  //   Windows TEMP to a /mnt/c/... path that Docker Desktop can reach.
+  // On Git Bash: /tmp is MSYS2's mapping of Windows TEMP — no conversion needed.
+  // On Linux/macOS: /tmp is directly accessible to Docker.
   "initializeCommand": [
     "bash", "-c",
-    "T='${localEnv:TEMP:/tmp}'; if [[ \"$T\" != /* ]]; then cmd.exe /c \"(if defined NODE_EXTRA_CA_CERTS (copy /Y \\\"%NODE_EXTRA_CA_CERTS%\\\" \\\"%TEMP%\\dc-cert.crt\\\") else (type nul >\\\"%TEMP%\\dc-cert.crt\\\")) & (if exist \\\"%USERPROFILE%\\.npmrc\\\" (copy /Y \\\"%USERPROFILE%\\.npmrc\\\" \\\"%TEMP%\\dc-npmrc\\\") else (type nul >\\\"%TEMP%\\dc-npmrc\\\"))\"; else (cp \"${NODE_EXTRA_CA_CERTS:-}\" \"$T/dc-cert.crt\" 2>/dev/null || touch \"$T/dc-cert.crt\") && (cp ~/.npmrc \"$T/dc-npmrc\" 2>/dev/null || touch \"$T/dc-npmrc\"); fi"
+    "if grep -qi microsoft /proc/version 2>/dev/null; then STAGING=$(wslpath -u '${localEnv:TEMP:/tmp}' 2>/dev/null || echo /tmp); else STAGING=/tmp; fi && (cp \"${NODE_EXTRA_CA_CERTS:-}\" \"$STAGING/dc-cert.crt\" 2>/dev/null || touch \"$STAGING/dc-cert.crt\") && (cp ~/.npmrc \"$STAGING/dc-npmrc\" 2>/dev/null || touch \"$STAGING/dc-npmrc\")"
   ],
   "mounts": [
     "source=${localEnv:TEMP:/tmp}/dc-cert.crt,target=/tmp/corporate-ca.crt,type=bind,consistency=cached,readonly",