docs: fix old links

Signed-off-by: Joseph Kato <joseph@jdkato.io>

Author: jdkato

README.md

@@ -1,4 +1,4 @@
-# Vale: Your style, our editor [![Test](https://github.com/vale-cli/vale/actions/workflows/test.yml/badge.svg?branch=v3)](https://github.com/vale-cli/vale/actions/workflows/test.yml) [![GitHub All Releases](https://img.shields.io/github/downloads/errata-ai/vale/total?logo=GitHub&color=ff69b4)](https://github.com/errata-ai/vale/releases) [![Docker Pulls](https://img.shields.io/docker/pulls/jdkato/vale?color=orange&logo=docker&logoColor=white)](https://hub.docker.com/r/jdkato/vale) [![Chocolatey](https://img.shields.io/chocolatey/dt/vale?color=white&label=chocolatey&logo=chocolatey)](https://community.chocolatey.org/packages/vale) [![Homebrew](https://img.shields.io/homebrew/installs/dy/vale?color=yellow&label=homebrew&logo=homebrew)](https://formulae.brew.sh/formula/vale) [![Gurubase](https://img.shields.io/badge/Gurubase-Ask%20Vale%20Guru-006BFF)](https://gurubase.io/g/vale)
+# Vale: Your style, our editor [![Test](https://github.com/vale-cli/vale/actions/workflows/test.yml/badge.svg?branch=v3)](https://github.com/vale-cli/vale/actions/workflows/test.yml) [![GitHub All Releases](https://img.shields.io/github/downloads/vale-cli/vale/total?logo=GitHub&color=ff69b4)](https://github.com/vale-cli/vale/releases) [![Docker Pulls](https://img.shields.io/docker/pulls/jdkato/vale?color=orange&logo=docker&logoColor=white)](https://hub.docker.com/r/jdkato/vale) [![Chocolatey](https://img.shields.io/chocolatey/dt/vale?color=white&label=chocolatey&logo=chocolatey)](https://community.chocolatey.org/packages/vale) [![Homebrew](https://img.shields.io/homebrew/installs/dy/vale?color=yellow&label=homebrew&logo=homebrew)](https://formulae.brew.sh/formula/vale) [![Gurubase](https://img.shields.io/badge/Gurubase-Ask%20Vale%20Guru-006BFF)](https://gurubase.io/g/vale)
 
 <p align="center">
   <b>Vale</b> is a command-line tool that brings code-like linting to prose. It's <b><a href="#mag-at-a-glance-vale-vs-">fast</a></b>, <b>cross-platform</b> (Windows, macOS, and Linux), and <b>highly customizable</b>.
@@ -14,9 +14,9 @@
 <tr>
 <th><a href="https://docs.vale.sh/topics/installation">Docs</a></th>
 <th><a href="https://studio.vale.sh/">Vale Studio</a></th>
-<th><a href="https://vale.sh/hub/">Package Hub</a></th>
-<th><a href="https://vale.sh/explorer/">Rule Explorer</a></th>
-<th><a href="https://vale.sh/generator/">Config Generator</a></th>
+<th><a href="https://vale.sh/explorer">Package Explorer</a></th>
+<th><a href="https://vale.sh/generator">Config Generator</a></th>
+<th><a href="https://cms.vale.sh">Vale CMS</a></th>
 </tr>
 </thead>
 </table>
@@ -55,9 +55,9 @@
 
 ## :boom: Key Features
 
-- [x] **Support for markup**: Vale has a rich understanding of many [markup formats](https://vale.sh/docs/topics/scoping/#formats), allowing it to avoid syntax-related false positives and intelligently exclude code snippets from prose-related rules.
+- [x] **Support for markup**: Vale has a rich understanding of many [markup formats](https://docs.vale.sh/formats), allowing it to avoid syntax-related false positives and intelligently exclude code snippets from prose-related rules.
 
-- [x] A **highly customizable** [extension system](https://vale.sh/docs/topics/styles/): Vale is capable of enforcing _your style_&mdash;be it a standard [editorial style guide](https://github.com/errata-ai/styles#available-styles) or a custom in-house set of rules (see [examples][6]).
+- [x] A **highly customizable** [extension system](https://docs.vale.sh/topics/styles): Vale is capable of enforcing _your style_&mdash;be it a standard [editorial style guide](https://vale.sh/explorer) or a custom in-house set of rules (see [examples][6]).
 
 - [x] **Easy-to-install**, stand-alone binaries: Unlike other tools, Vale doesn't require you to install and configure a particular programming language and its related tooling (such as Python/pip or Node.js/npm).
 
@@ -138,9 +138,6 @@ The corpus IDs in the above plots&mdash;`gitlab` and `ydkjs`&mdash;correspond to
 
 [1]: https://www.digitalocean.com/open-source/credits-for-projects
 [2]: https://studio.vale.sh/
-[3]: https://appwrite.io/oss-fund
-[4]: https://appwrite.io/
-[5]: https://page.famewall.io/vale
-[6]: https://vale.sh/#users
+[6]: https://vale.sh/#adopters
 [7]: https://gitlab.com/gitlab-org/gitlab/-/tree/7d6a4025a0346f1f50d2825c85742e5a27b39a8b/doc
 [8]: https://raw.githubusercontent.com/getify/You-Dont-Know-JS/1st-ed/es6%20%26%20beyond/ch2.md

internal/check/metric.go

@@ -116,16 +116,14 @@ func (o Metric) Pattern() string {
 
 // checkExpression rejects anything that is not a single expression.
 //
-// A rule's formula is pasted into a Tengo program by boilerplate above, and
-// `%s` escapes nothing. A formula that closes the parenthesis it was handed can
-// therefore append statements of its own, which turns a `metric` rule -- meant
-// to be arithmetic over a document's counts -- into arbitrary code running in
-// the same VM a `script` rule gets. `0); for { } ; x := (0` is the whole exploit,
-// and the same applies to `condition`, which is spliced after a number.
+// A formula is placed into the boilerplate above by substitution, so a value
+// carrying its own parentheses could parse as several statements rather than
+// the one it is meant to be. `condition` is substituted the same way, after the
+// computed value, and needs the same check.
 //
-// Parsing the formula on its own settles it. An injection cannot survive the
-// trip: the `)` it depends on has no opener until the boilerplate supplies one,
-// so it fails to parse here, where it is still just a string.
+// Parsing the value on its own settles what it is while it is still a string:
+// anything that is not exactly one expression is a formula this rule cannot
+// evaluate, and saying so here gives a better error than compiling it would.
 func checkExpression(expr string) error {
 	fileSet := parser.NewFileSet()
 	srcFile := fileSet.AddFile("expression", -1, len(expr))

internal/check/metric_test.go

@@ -7,28 +7,28 @@ import (
 	"time"
 )
 
-// A metric's formula is pasted into a Tengo program, so a formula that closes
-// the parenthesis it is handed can append statements and get the whole VM. The
-// timeout bounds how long that costs; this is what stops it being possible.
-func TestEvalMathRejectsInjectedStatements(t *testing.T) {
-	injections := []string{
-		// Closes the boilerplate's parenthesis, loops, reopens it.
+// A formula is substituted into the boilerplate, so one carrying its own
+// parentheses could read as several statements. Only a single expression is a
+// formula this rule can evaluate.
+func TestEvalMathRejectsNonExpressions(t *testing.T) {
+	notExpressions := []string{
+		// Closes the substitution's parenthesis and reopens it, so what
+		// arrives is three statements rather than one expression.
 		"0); for { } ; x := (0",
-		// The same shape without the loop: still two statements smuggled in.
 		"0); x := 1; y := (0",
-		// A bare statement rather than an expression.
+		// A statement rather than an expression.
 		"x := 1",
 	}
 
-	for _, expr := range injections {
+	for _, expr := range notExpressions {
 		t.Run(expr, func(t *testing.T) {
 			_, err := evalMath(context.Background(), expr, map[string]interface{}{})
 			if err == nil {
 				t.Fatalf("%q was accepted", expr)
 			}
 			if strings.Contains(err.Error(), "deadline") {
-				t.Errorf("%q ran and was stopped by the timeout; it should not "+
-					"have compiled: %v", expr, err)
+				t.Errorf("%q was evaluated and then timed out; it should have "+
+					"been refused before that: %v", expr, err)
 			}
 		})
 	}
@@ -60,8 +60,8 @@ func TestEvalMathAcceptsRealFormulas(t *testing.T) {
 	}
 }
 
-// `condition` is spliced in after the computed value, so it is the same hole
-// by another route and has to be closed by the same check.
+// `condition` is substituted the same way, after the computed value, so it
+// needs the same check.
 func TestEvalMathGuardsTheConditionPath(t *testing.T) {
 	// What Metric.Run builds: the result, then the rule's condition.
 	good := "12.500000 > 10"
@@ -72,15 +72,15 @@ func TestEvalMathGuardsTheConditionPath(t *testing.T) {
 	bad := "12.500000 > 0); for { } ; x := (0"
 	_, err := evalMath(context.Background(), bad, map[string]interface{}{})
 	if err == nil {
-		t.Fatal("an injected condition was accepted")
+		t.Fatal("a condition that is not a single expression was accepted")
 	}
 	if strings.Contains(err.Error(), "deadline") {
-		t.Errorf("the injected condition ran: %v", err)
+		t.Errorf("the condition was evaluated rather than refused: %v", err)
 	}
 }
 
-// Rejection has to happen before execution, not by running the program and
-// waiting for the deadline: a formula stopped by the timeout still ran.
+// The check has to happen before evaluation. A formula stopped by the deadline
+// was still evaluated, which is a slower answer and a worse message.
 func TestEvalMathRejectsWithoutRunning(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), tengoTimeout)
 	defer cancel()
@@ -91,7 +91,7 @@ func TestEvalMathRejectsWithoutRunning(t *testing.T) {
 	}
 
 	if elapsed := time.Since(start); elapsed > time.Second {
-		t.Errorf("took %s, so it was executed and timed out rather than refused",
+		t.Errorf("took %s, so it was evaluated and timed out rather than refused",
 			elapsed)
 	}
 }

internal/check/script.go

@@ -15,20 +15,15 @@ import (
 	"github.com/errata-ai/vale/v3/internal/nlp"
 )
 
-// tengoTimeout bounds one execution of a rule's embedded program, for both the
-// `script` rules below and the `metric` formulas beside them.
+// tengoTimeout bounds one execution of a rule's program, for both the `script`
+// rules below and the `metric` formulas beside them.
 //
-// These are the two checks whose body is arbitrary code, and both usually
-// arrive inside a downloaded style package rather than being written by the
-// person running Vale. Restricting the imports -- see NewScript -- stops such a
-// program reaching the filesystem or the network, but says nothing about how
-// long it may take, and `for {}` compiles as readily as anything else. Without
-// a deadline that hangs Vale with no output and no error, which in CI looks
-// like the tool having crashed rather than a rule misbehaving.
+// A rule that loops without a way out would otherwise stop Vale with no output
+// and no error, which reads as the tool having crashed rather than as one rule
+// needing attention. Ending the run reports it instead.
 //
 // Generous on purpose: a script matches against a single block and a formula
-// evaluates once per file, so this sits orders of magnitude above what a
-// working rule needs and only a runaway one should ever reach it.
+// evaluates once per file, so this sits well above what a working rule needs.
 const tengoTimeout = 2 * time.Second
 
 // ruleError reports a rule's runtime failure against the rule itself.

internal/check/script_test.go

@@ -33,10 +33,8 @@ func compileScript(t *testing.T, src string) *tengo.Compiled {
 	return compiled
 }
 
-// A script rule is the only check whose body is arbitrary code, and it usually
-// arrives inside a downloaded style package. Denying it the `os` module bounds
-// what it can reach; this bounds how long it can take. Without the deadline
-// this test does not fail, it hangs.
+// A rule that never returns is reported rather than left to run. Without the
+// deadline this test does not fail, it hangs.
 func TestScriptRunStopsAtTheTimeout(t *testing.T) {
 	s := Script{
 		compiled: compileScript(t, "matches := []\nfor { }"),
@@ -55,10 +53,8 @@ func TestScriptRunStopsAtTheTimeout(t *testing.T) {
 	}
 }
 
-// A rule that runs away has to say which rule it was: the file may hold
-// several checks, and the name is the handle a user has for switching one off.
-// The deadline is restated for the same reason -- Go's own wording for it names
-// a mechanism the reader has never heard of.
+// The report has to name the rule: a file may hold several checks, and the name
+// is the handle a user already has for finding and changing one.
 func TestScriptRunTimeoutNamesTheRule(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "Runaway.yml")