mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-11-05 12:22:06 +00:00
thePR0M3TH3ANandClaude Opus 5
1ff47caf15
Vendors two rules from github.com/dmmulroy/anti-slop into js/tools/oxlint/anti-slop and wires oxlint into the workspace. This is the first JS linter in the repo. TWO of the project's fifteen rules are enabled. The rest were measured against this codebase and rejected, with reasons recorded in oxlint.config.ts, because "why is this off" is the question a future reader will have. Briefly: no-conditional-empty-object-spread has 77 hits that are all correct, since that idiom is REQUIRED by exactOptionalPropertyTypes; no-unsafe-dictionary-type and no-runtime-typeof have 176 hits that are overwhelmingly the agent's untrusted socket protocol, where a precise type would be false confidence and the per-field typeof checks ARE the boundary validation both rules ask for; three more have zero hits because the suite already uses real dependency seams rather than module mocks. The two that are on catch the same move: an assertion that manufactures certainty the code never established. That is the failure mode a vault cannot afford, because a wrong belief about a decrypted record's shape is a wrong belief about someone's secrets. They find 44 sites, and no-widen-then-assert finds none. Deliberately NOT wired into CI yet: a gate that lands red is a gate people learn to ignore. The findings get triaged and fixed first, then the CI step goes in green. Kept deliberately revertible and separate from any change it motivates: nothing under packages/*/src imports it, it is dev-only, and the shipped CLI bundles with no externals so it cannot reach the published artifact — verified, the rebuilt bundle contains no reference to it. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN
73 lines
2.9 KiB
TypeScript
73 lines
2.9 KiB
TypeScript
import { defineConfig } from "oxlint";
|
|
|
|
/**
|
|
* Lint gate for the TypeScript port.
|
|
*
|
|
* WHAT THIS IS AND IS NOT
|
|
*
|
|
* The rules under tools/oxlint/anti-slop are vendored from
|
|
* github.com/dmmulroy/anti-slop, which offers fifteen. TWO are enabled. The
|
|
* rest were measured against this codebase and rejected, and the reasons are
|
|
* worth keeping because "why is this off" is the question a future reader
|
|
* will actually have:
|
|
*
|
|
* no-conditional-empty-object-spread -- 77 hits, all of them correct.
|
|
* `...(x !== undefined && { key: x })` is the idiom REQUIRED by
|
|
* exactOptionalPropertyTypes, which tsconfig.base.json turns on. The rule
|
|
* would fight the compiler settings.
|
|
*
|
|
* no-unsafe-dictionary-type (123 hits) and no-runtime-typeof (53) -- these
|
|
* are overwhelmingly the agent's socket protocol: `Record<string,
|
|
* unknown>` for an untrusted message, then explicit `typeof x !==
|
|
* "string"` checks per field. That IS boundary validation, which is what
|
|
* both rules ask for. Typing the wire message more precisely would be
|
|
* false confidence at the one place honesty about untrusted input matters
|
|
* most.
|
|
*
|
|
* no-module-mocking, no-reflect-get, no-reflect-apply -- zero hits. The
|
|
* suite already uses real dependency seams: real daemons, real sockets,
|
|
* real temp directories. Nothing to enforce.
|
|
*
|
|
* require-safety-comment-for-type-assertion -- 220 hits. Plausible for this
|
|
* codebase, which comments heavily already, but not until the number
|
|
* comes down. Revisit.
|
|
*
|
|
* The two that are on both point at the same thing: an assertion that
|
|
* fabricates certainty the code never established. That is the failure mode
|
|
* this vault cannot afford, because a wrong belief about a decrypted record's
|
|
* shape is a wrong belief about someone's secrets.
|
|
*/
|
|
export default defineConfig({
|
|
ignorePatterns: [
|
|
"**/dist/**",
|
|
"**/node_modules/**",
|
|
"packages/test-vectors/fixtures/**",
|
|
// The vendored rules are third-party source we do not police.
|
|
"tools/oxlint/anti-slop/**",
|
|
],
|
|
jsPlugins: [
|
|
{ name: "anti-slop", specifier: "./tools/oxlint/anti-slop/index.ts" },
|
|
],
|
|
rules: {
|
|
// `x as unknown as T` launders an unproven claim into a certainty. Either
|
|
// the precise type survives, or the value is parsed at its boundary.
|
|
"anti-slop/no-chained-type-assertions": "error",
|
|
// Widening a known value and asserting it back is the same move spread
|
|
// across two statements.
|
|
"anti-slop/no-widen-then-assert": "error",
|
|
},
|
|
overrides: [
|
|
{
|
|
// Tests may construct deliberately malformed values -- that is what a
|
|
// test of a validator IS. Policing them would push toward testing only
|
|
// shapes the type system already permits, which is the opposite of the
|
|
// point.
|
|
files: ["**/test/**", "**/*.test.ts"],
|
|
rules: {
|
|
"anti-slop/no-chained-type-assertions": "off",
|
|
"anti-slop/no-widen-then-assert": "off",
|
|
},
|
|
},
|
|
],
|
|
});
|