@jameswyse/oxc-config 0.1.0 → 0.3.0

package/dist/rules/no-hardcoded-credential.js

@@ -0,0 +1,45 @@
+import { defineRule } from "@oxlint/plugins";
+const credentials = [
+    [
+        "private key",
+        /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?(?:-----END|$)/gu,
+    ],
+    ["AWS access key", /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/gu],
+    ["GitHub token", /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{60,})\b/gu],
+    ["Stripe live key", /\b(?:sk|rk)_live_[0-9A-Za-z]{20,}\b/gu],
+    ["Slack token", /\bxox[abposr]-[0-9A-Za-z-]{10,}\b/gu],
+    ["Google API key", /\bAIza[0-9A-Za-z_-]{35}\b/gu],
+    ["Anthropic or OpenAI key", /\bsk-(?:ant-[a-z0-9]+-|proj-)[A-Za-z0-9_-]{32,}/gu],
+];
+const placeholder = /example|fake|dummy|placeholder|redacted|x{6,}|abcdefgh|12345678/iu;
+function credentialIn(text) {
+    return (credentials.find(([, pattern]) => [...text.matchAll(pattern)].some((match) => !placeholder.test(match[0])))?.[0] ?? null);
+}
+export const noHardcodedCredential = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Disallow credentials written into source code." },
+        schema: [],
+        messages: {
+            credential: "This looks like a real {{kind}}. Revoke it, then load the credential from the environment or a secret store.",
+        },
+    },
+    create(context) {
+        function check(node, text) {
+            const kind = credentialIn(text);
+            if (kind !== null) {
+                context.report({ node, messageId: "credential", data: { kind } });
+            }
+        }
+        return {
+            Literal(node) {
+                if (typeof node.value === "string") {
+                    check(node, node.value);
+                }
+            },
+            TemplateElement(node) {
+                check(node, node.value.raw);
+            },
+        };
+    },
+});

package/dist/rules/no-import-time-effects.d.ts

@@ -0,0 +1 @@
+export declare const noImportTimeEffects: import("@oxlint/plugins").Rule;

package/dist/rules/no-import-time-effects.js

@@ -0,0 +1,90 @@
+import { defineRule } from "@oxlint/plugins";
+import { childNodes, isGlobalValue, propertyName, unwrapExpression } from "../shared/index.js";
+const functionTypes = new Set([
+    "ArrowFunctionExpression",
+    "FunctionExpression",
+    "FunctionDeclaration",
+]);
+const startedTimers = ["setInterval", "setTimeout", "fetch"];
+const openedResources = ["BroadcastChannel", "WebSocket", "EventSource", "Worker", "SharedWorker"];
+const registrations = new Set(["addEventListener", "listen"]);
+function isDeferred(node) {
+    return (functionTypes.has(node.type) ||
+        ((node.type === "PropertyDefinition" || node.type === "AccessorProperty") && !node.static));
+}
+function isInsideFunction(node) {
+    for (let ancestor = node.parent; ancestor !== null; ancestor = ancestor.parent) {
+        if (functionTypes.has(ancestor.type)) {
+            return true;
+        }
+    }
+    return false;
+}
+function immediateBody(node) {
+    const callee = node.type === "CallExpression" ? unwrapExpression(node.callee) : null;
+    return callee?.type === "ArrowFunctionExpression" ||
+        (callee?.type === "FunctionExpression" && !callee.generator)
+        ? callee.body
+        : null;
+}
+function effect(sourceCode, node) {
+    if (node.type === "AwaitExpression") {
+        return isInsideFunction(node) ? null : "await";
+    }
+    if (node.type === "NewExpression") {
+        return openedResources.find((name) => isGlobalValue(sourceCode, node.callee, name)) ?? null;
+    }
+    if (node.type !== "CallExpression") {
+        return null;
+    }
+    const timer = startedTimers.find((name) => isGlobalValue(sourceCode, node.callee, name));
+    if (timer !== undefined) {
+        return timer;
+    }
+    const method = node.callee.type === "MemberExpression" ? propertyName(node.callee) : null;
+    if (method !== null && registrations.has(method)) {
+        return method;
+    }
+    return node.callee.type === "MemberExpression" &&
+        (method === "on" || method === "once") &&
+        isGlobalValue(sourceCode, node.callee.object, "process")
+        ? `process.${method}`
+        : null;
+}
+export const noImportTimeEffects = defineRule({
+    meta: {
+        type: "suggestion",
+        docs: {
+            description: "Disallow timers, I/O, open resources and handler registration when a module is imported.",
+        },
+        schema: [],
+        messages: {
+            effect: "`{{effect}}` runs when this module is imported, so every importer starts it, including tests. Move it into a function the entrypoint calls.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        return {
+            Program(program) {
+                const pending = [...program.body];
+                for (let node = pending.pop(); node !== undefined; node = pending.pop()) {
+                    const found = effect(sourceCode, node);
+                    if (found !== null) {
+                        context.report({ node, messageId: "effect", data: { effect: found } });
+                    }
+                    const body = immediateBody(node);
+                    if (body !== null) {
+                        pending.push(body);
+                    }
+                    if (!isDeferred(node)) {
+                        pending.push(...childNodes(node, sourceCode.visitorKeys));
+                    }
+                    else if ((node.type === "PropertyDefinition" || node.type === "AccessorProperty") &&
+                        node.computed) {
+                        pending.push(node.key);
+                    }
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-optional-test-action.d.ts

@@ -0,0 +1 @@
+export declare const noOptionalTestAction: import("@oxlint/plugins").Rule;

package/dist/rules/no-optional-test-action.js

@@ -0,0 +1,45 @@
+import { defineRule } from "@oxlint/plugins";
+import { isShortCircuited, testContext } from "../shared/index.js";
+function isStep(chain) {
+    const step = chain.parent.type === "AwaitExpression" ? chain.parent : chain;
+    const position = step.parent;
+    return (position.type === "ExpressionStatement" ||
+        position.type === "ReturnStatement" ||
+        (position.type === "ArrowFunctionExpression" && position.body === step));
+}
+function enclosingFunction(node) {
+    for (let ancestor = node.parent; ancestor !== null; ancestor = ancestor.parent) {
+        if (ancestor.type === "ArrowFunctionExpression" ||
+            ancestor.type === "FunctionExpression" ||
+            ancestor.type === "FunctionDeclaration") {
+            return ancestor;
+        }
+    }
+    return null;
+}
+export const noOptionalTestAction = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Disallow test steps that an optional call can silently skip." },
+        schema: [],
+        messages: {
+            optional: "This optional call skips the step when its target is missing, so the test can pass without doing it. Get the target with a query that fails when it's absent.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        return {
+            ChainExpression(node) {
+                const call = node.expression;
+                if (call.type !== "CallExpression" || !isShortCircuited(call) || !isStep(node)) {
+                    return;
+                }
+                const test = testContext(sourceCode, node);
+                if ((test?.api.name === "test" || test?.api.name === "it") &&
+                    enclosingFunction(node) === test.callback) {
+                    context.report({ node: call, messageId: "optional" });
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-secret-fallback.d.ts

@@ -0,0 +1 @@
+export declare const noSecretFallback: import("@oxlint/plugins").Rule;

package/dist/rules/no-secret-fallback.js

@@ -0,0 +1,64 @@
+import { defineRule } from "@oxlint/plugins";
+import { isGlobal, staticPropertyName, unwrapExpression } from "../shared/index.js";
+const secretName = /(?:SECRET|TOKEN|PASSWORD|PASSPHRASE|PRIVATE|CREDENTIAL|SALT|SIGNING|API_?KEY|ACCESS_?KEY|_KEY$|^KEY$)/iu;
+function isEnvironment(sourceCode, node) {
+    const environment = unwrapExpression(node);
+    if (environment.type !== "MemberExpression" || staticPropertyName(environment) !== "env") {
+        return false;
+    }
+    return (isGlobal(sourceCode, unwrapExpression(environment.object), "process") ||
+        (environment.object.type === "MetaProperty" && environment.object.property.name === "meta"));
+}
+function secretRead(sourceCode, node) {
+    const read = unwrapExpression(node);
+    const name = read.type === "MemberExpression" ? staticPropertyName(read) : null;
+    return read.type === "MemberExpression" &&
+        name !== null &&
+        secretName.test(name) &&
+        isEnvironment(sourceCode, read.object)
+        ? name
+        : null;
+}
+function isLiteralFallback(node) {
+    const fallback = unwrapExpression(node);
+    return ((fallback.type === "Literal" && typeof fallback.value === "string") ||
+        (fallback.type === "TemplateLiteral" && fallback.expressions.length === 0));
+}
+export const noSecretFallback = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Disallow literal fallbacks for secret environment variables." },
+        schema: [],
+        messages: {
+            fallback: "`{{name}}` falls back to a value written in the source, so a missing secret silently becomes a known one. Fail at startup when it is missing.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        return {
+            LogicalExpression(node) {
+                const name = node.operator === "&&" ? null : secretRead(sourceCode, node.left);
+                if (name !== null && isLiteralFallback(node.right)) {
+                    context.report({ node, messageId: "fallback", data: { name } });
+                }
+            },
+            VariableDeclarator(node) {
+                if (node.id.type !== "ObjectPattern" ||
+                    node.init === null ||
+                    !isEnvironment(sourceCode, node.init)) {
+                    return;
+                }
+                for (const property of node.id.properties) {
+                    const name = property.type === "Property" ? staticPropertyName(property) : null;
+                    if (property.type === "Property" &&
+                        name !== null &&
+                        secretName.test(name) &&
+                        property.value.type === "AssignmentPattern" &&
+                        isLiteralFallback(property.value.right)) {
+                        context.report({ node: property, messageId: "fallback", data: { name } });
+                    }
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-swallowed-errors.js

@@ -1,5 +1,5 @@
 import { defineRule } from "@oxlint/plugins";
-import { childNodes, isGlobal, propertyName, variableFor } from "../shared/index.js";
+import { childNodes, isEffectModule, isGlobal, propertyName, unwrapExpression, variableFor, } from "../shared/index.js";
 const nestedScopes = new Set([
     "ArrowFunctionExpression",
     "FunctionExpression",
@@ -109,14 +109,31 @@ function onlyProbes(sourceCode, block) {
         nodes.every((node) => (node.type !== "AwaitExpression" && node.type !== "YieldExpression") ||
             (node.argument !== null && containsProbe(sourceCode, node.argument))));
 }
-function isExistingPromise(node) {
+function isSharedBinding(sourceCode, node) {
+    const variable = variableFor(sourceCode, node);
+    return (variable === null ||
+        variable.defs.some((definition) => definition.type !== "Variable") ||
+        variable.references.filter((reference) => reference.isRead()).length > 1);
+}
+function storedValue(sourceCode, node) {
+    const value = unwrapExpression(node);
+    const declarator = value.type === "Identifier" ? variableFor(sourceCode, value)?.defs[0]?.node : undefined;
+    return declarator?.type === "VariableDeclarator" &&
+        declarator.parent.type === "VariableDeclaration" &&
+        declarator.parent.kind === "const" &&
+        declarator.init !== null
+        ? unwrapExpression(declarator.init)
+        : value;
+}
+function isExistingPromise(sourceCode, node) {
     const value = node.type === "ChainExpression" ? node.expression : node;
     if (value.type === "CallExpression" &&
         value.callee.type === "MemberExpression" &&
         propertyName(value.callee) === "finally") {
-        return isExistingPromise(value.callee.object);
+        return isExistingPromise(sourceCode, value.callee.object);
     }
-    return value.type === "Identifier" || value.type === "MemberExpression";
+    return ((value.type === "Identifier" && isSharedBinding(sourceCode, value)) ||
+        value.type === "MemberExpression");
 }
 function swallowingCallback(sourceCode, callback) {
     if (callback.type !== "ArrowFunctionExpression" && callback.type !== "FunctionExpression") {
@@ -128,13 +145,94 @@ function swallowingCallback(sourceCode, callback) {
     }
     return body.body.length === 0 || returnsFallback(sourceCode, body.body);
 }
+function rejectionHandler(node) {
+    if (node.callee.type !== "MemberExpression") {
+        return null;
+    }
+    const name = propertyName(node.callee);
+    const [onFulfilled, onRejected, ...extraArguments] = node.arguments;
+    const handler = name === "catch" && onRejected === undefined
+        ? onFulfilled
+        : name === "then" && extraArguments.length === 0
+            ? onRejected
+            : undefined;
+    return handler === undefined ? null : { promise: node.callee.object, handler };
+}
+const effectRecoveries = new Set(["catchAll", "catchAllCause", "orElse"]);
+function effectMember(sourceCode, node) {
+    return node.type === "MemberExpression" && isEffectModule(sourceCode, node.object, "Effect")
+        ? propertyName(node)
+        : null;
+}
+function isEffectFallback(sourceCode, node) {
+    const value = unwrap(node);
+    if (value === null) {
+        return false;
+    }
+    const member = effectMember(sourceCode, value);
+    if (member === "void" || member === "succeedNone") {
+        return true;
+    }
+    if (value.type !== "CallExpression" || effectMember(sourceCode, value.callee) !== "succeed") {
+        return false;
+    }
+    const [result] = value.arguments;
+    return (result === undefined || (result.type !== "SpreadElement" && isFallback(sourceCode, result)));
+}
+function returnedValue(callback) {
+    if (callback.type !== "ArrowFunctionExpression" && callback.type !== "FunctionExpression") {
+        return undefined;
+    }
+    const body = callback.body;
+    if (body === null) {
+        return undefined;
+    }
+    if (body.type !== "BlockStatement") {
+        return body;
+    }
+    const [statement] = body.body;
+    return body.body.length === 1 && statement?.type === "ReturnStatement"
+        ? statement.argument
+        : undefined;
+}
+function swallowingEffectRecovery(sourceCode, node) {
+    const name = effectMember(sourceCode, node.callee);
+    const handler = node.arguments.at(-1);
+    if (name === null || handler === undefined) {
+        return null;
+    }
+    const value = returnedValue(handler);
+    if (value === undefined) {
+        return null;
+    }
+    if (name === "orElseSucceed") {
+        return isFallback(sourceCode, value) ? handler : null;
+    }
+    return effectRecoveries.has(name) && isEffectFallback(sourceCode, value) ? handler : null;
+}
+function settlement(sourceCode, expression) {
+    let value = expression;
+    while (value.type === "AwaitExpression" ||
+        (value.type === "UnaryExpression" && value.operator === "void")) {
+        value = value.argument;
+    }
+    return value.type === "CallExpression" &&
+        value.callee.type === "MemberExpression" &&
+        propertyName(value.callee) === "allSettled" &&
+        isGlobal(sourceCode, value.callee.object, "Promise")
+        ? value
+        : null;
+}
 export const noSwallowedErrors = defineRule({
     meta: {
         type: "suggestion",
-        docs: { description: "Disallow catch handlers that discard the error and return a fallback." },
+        docs: {
+            description: "Disallow error handlers that discard the error and return a fallback, and unread settled results.",
+        },
         schema: [],
         messages: {
             swallowed: "This handler discards the error and returns a fallback, so callers cannot tell failure from an empty result. Prevent the failure, let it propagate, or return a failure the caller must handle.",
+            settled: "These settled results are never read, so every rejection disappears. Handle the rejected results, or use `Promise.all` so failures propagate.",
         },
     },
     create(context) {
@@ -149,18 +247,35 @@ export const noSwallowedErrors = defineRule({
                 }
             },
             CallExpression(node) {
-                const [callback, ...extraArguments] = node.arguments;
-                if (node.callee.type !== "MemberExpression" ||
-                    propertyName(node.callee) !== "catch" ||
-                    callback === undefined ||
-                    extraArguments.length > 0) {
-                    return;
+                const rejection = rejectionHandler(node);
+                if (rejection !== null &&
+                    !isExistingPromise(sourceCode, rejection.promise) &&
+                    !isProbe(sourceCode, storedValue(sourceCode, rejection.promise)) &&
+                    swallowingCallback(sourceCode, rejection.handler)) {
+                    context.report({ node: rejection.handler, messageId: "swallowed" });
                 }
-                const promise = node.callee.object;
-                if (!isExistingPromise(promise) &&
-                    !isProbe(sourceCode, promise) &&
-                    swallowingCallback(sourceCode, callback)) {
-                    context.report({ node: callback, messageId: "swallowed" });
+                const recovery = swallowingEffectRecovery(sourceCode, node);
+                if (recovery !== null) {
+                    context.report({ node: recovery, messageId: "swallowed" });
+                }
+            },
+            ExpressionStatement(node) {
+                const discarded = settlement(sourceCode, node.expression);
+                if (discarded !== null) {
+                    context.report({ node: discarded, messageId: "settled" });
+                }
+            },
+            VariableDeclarator(node) {
+                const voided = node.init?.type === "UnaryExpression" && node.init.operator === "void";
+                const unread = node.init === null || (!voided && node.parent.parent?.type === "ExportNamedDeclaration")
+                    ? null
+                    : settlement(sourceCode, node.init);
+                if (unread !== null &&
+                    (voided ||
+                        sourceCode
+                            .getDeclaredVariables(node)
+                            .every((variable) => !variable.references.some((reference) => reference.isRead())))) {
+                    context.report({ node: unread, messageId: "settled" });
                 }
             },
         };

package/dist/rules/no-test-timeout-overrides.js

@@ -1,5 +1,5 @@
 import { defineRule } from "@oxlint/plugins";
-import { isGlobal, propertyName, apiReference, testModules } from "../shared/index.js";
+import { isGlobal, propertyName, apiReference, staticPropertyName, testModules, unwrapExpression, } from "../shared/index.js";
 const optionKeys = new Set(["timeout", "retry", "retries"]);
 const configKeys = new Set(["testTimeout", "hookTimeout", "retry"]);
 const hooks = new Set(["beforeEach", "afterEach", "beforeAll", "afterAll"]);
@@ -20,18 +20,27 @@ function testApi(sourceCode, callee) {
     }
     return null;
 }
+function isZero(node) {
+    const value = node === undefined ? undefined : unwrapExpression(node);
+    return value?.type === "Literal" && value.value === 0;
+}
 function hasOverrideKey(node, keys) {
-    return (node?.type === "ObjectExpression" &&
-        node.properties.some((property) => {
-            const name = property.type === "Property" ? propertyName(property) : null;
-            return name !== null && keys.has(name);
+    const options = node === undefined ? undefined : unwrapExpression(node);
+    return (options?.type === "ObjectExpression" &&
+        options.properties.some((property) => {
+            const name = property.type === "Property" ? staticPropertyName(property) : null;
+            return (property.type === "Property" &&
+                name !== null &&
+                keys.has(name) &&
+                !(name.startsWith("retr") && isZero(property.value)));
         }));
 }
 function timeoutArgument(node) {
-    return (node !== undefined &&
-        node.type !== "ObjectExpression" &&
-        node.type !== "SpreadElement" &&
-        !functionTypes.has(node.type));
+    const value = node === undefined ? undefined : unwrapExpression(node);
+    return (value !== undefined &&
+        value.type !== "ObjectExpression" &&
+        value.type !== "SpreadElement" &&
+        !functionTypes.has(value.type));
 }
 function registrationOverride(sourceCode, node) {
     const name = testApi(sourceCode, node.callee);
@@ -72,6 +81,10 @@ function runnerOverride(sourceCode, node) {
         return (runnerObject(sourceCode, callee.object, "jest", ["@jest/globals"]) ||
             importedTest(sourceCode, callee.object));
     }
+    if (method === "retryTimes") {
+        return (runnerObject(sourceCode, callee.object, "jest", ["@jest/globals"]) &&
+            !isZero(node.arguments[0]));
+    }
     if (method === "slow") {
         return importedTest(sourceCode, callee.object);
     }

package/dist/rules/no-unchecked-fetch-response.d.ts

@@ -0,0 +1 @@
+export declare const noUncheckedFetchResponse: import("@oxlint/plugins").Rule;

package/dist/rules/no-unchecked-fetch-response.js

@@ -0,0 +1,91 @@
+import { defineRule } from "@oxlint/plugins";
+import { isGlobal, isGlobalValue, outermostExpression, staticPropertyName, unwrapExpression, } from "../shared/index.js";
+const bodyReaders = new Set(["json", "text", "arrayBuffer", "blob", "formData", "bytes"]);
+const statusChecks = new Set(["ok", "status"]);
+const metadata = new Set(["headers", "url", "redirected", "type"]);
+function unwrap(node) {
+    const value = unwrapExpression(node);
+    return value.type === "AwaitExpression" ? unwrap(value.argument) : value;
+}
+function isFetch(sourceCode, node) {
+    const value = node === null ? null : unwrap(node);
+    return value?.type === "CallExpression" && isGlobalValue(sourceCode, value.callee, "fetch");
+}
+function isLogged(sourceCode, node) {
+    const position = node.parent;
+    return (position?.type === "TemplateLiteral" ||
+        (position?.type === "CallExpression" &&
+            position.arguments.some((argument) => argument === node) &&
+            position.callee.type === "MemberExpression" &&
+            isGlobal(sourceCode, position.callee.object, "console")));
+}
+function use(sourceCode, reference) {
+    const response = outermostExpression(reference.identifier);
+    const member = response.parent;
+    if (member?.type !== "MemberExpression" || member.object !== response) {
+        return "other";
+    }
+    const name = staticPropertyName(member);
+    if (name !== null && statusChecks.has(name)) {
+        return isLogged(sourceCode, outermostExpression(member)) ? "metadata" : "check";
+    }
+    if (name !== null && metadata.has(name)) {
+        return "metadata";
+    }
+    return name !== null &&
+        bodyReaders.has(name) &&
+        member.parent.type === "CallExpression" &&
+        member.parent.callee === member
+        ? "body"
+        : "other";
+}
+function readsBodyUnchecked(sourceCode, variables) {
+    const uses = variables.flatMap((variable) => variable.references
+        .filter((reference) => reference.isRead())
+        .map((reference) => use(sourceCode, reference)));
+    return uses.includes("body") && uses.every((item) => item === "body" || item === "metadata");
+}
+export const noUncheckedFetchResponse = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Require a status check before reading a fetch response body." },
+        schema: [],
+        messages: {
+            unchecked: "This reads the response body without checking `ok` or `status`, so an error response is treated as data. Check the status first.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        return {
+            VariableDeclarator(node) {
+                if (node.id.type === "Identifier" &&
+                    isFetch(sourceCode, node.init) &&
+                    readsBodyUnchecked(sourceCode, sourceCode.getDeclaredVariables(node))) {
+                    context.report({ node, messageId: "unchecked" });
+                }
+            },
+            CallExpression(node) {
+                const member = node.callee;
+                const name = member.type === "MemberExpression" ? staticPropertyName(member) : null;
+                if (member.type !== "MemberExpression" || name === null) {
+                    return;
+                }
+                if (bodyReaders.has(name) && isFetch(sourceCode, member.object)) {
+                    context.report({ node, messageId: "unchecked" });
+                    return;
+                }
+                const [callback] = node.arguments;
+                if (name === "then" &&
+                    isFetch(sourceCode, member.object) &&
+                    (callback?.type === "ArrowFunctionExpression" ||
+                        callback?.type === "FunctionExpression") &&
+                    callback.params[0]?.type === "Identifier" &&
+                    readsBodyUnchecked(sourceCode, sourceCode
+                        .getDeclaredVariables(callback)
+                        .filter((variable) => variable.defs.some((definition) => definition.type === "Parameter")))) {
+                    context.report({ node: callback, messageId: "unchecked" });
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-unchecked-index-search.d.ts

@@ -0,0 +1 @@
+export declare const noUncheckedIndexSearch: import("@oxlint/plugins").Rule;

package/dist/rules/no-unchecked-index-search.js

@@ -0,0 +1,41 @@
+import { defineRule } from "@oxlint/plugins";
+import { staticPropertyName, unwrapExpression } from "../shared/index.js";
+const searches = new Set(["indexOf", "lastIndexOf", "findIndex", "findLastIndex"]);
+const indexedArguments = new Map([
+    ["splice", 1],
+    ["toSpliced", 1],
+    ["with", 1],
+    ["at", 1],
+    ["slice", 2],
+]);
+function searchCall(node) {
+    const call = unwrapExpression(node);
+    const name = call.type === "CallExpression" && call.callee.type === "MemberExpression"
+        ? staticPropertyName(call.callee)
+        : null;
+    return name !== null && searches.has(name) ? name : null;
+}
+export const noUncheckedIndexSearch = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Require a missing-item check before using a searched index." },
+        schema: [],
+        messages: {
+            unchecked: "`{{search}}` returns -1 when nothing matches, and here -1 counts from the end, so a missing item silently targets the last element. Store the index and handle -1 first.",
+        },
+    },
+    create(context) {
+        return {
+            CallExpression(node) {
+                const method = node.callee.type === "MemberExpression" ? staticPropertyName(node.callee) : null;
+                const count = method === null ? undefined : indexedArguments.get(method);
+                for (const argument of node.arguments.slice(0, count ?? 0)) {
+                    const search = searchCall(argument);
+                    if (search !== null) {
+                        context.report({ node: argument, messageId: "unchecked", data: { search } });
+                    }
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-uncontrolled-test-clock.d.ts

@@ -0,0 +1 @@
+export declare const noUncontrolledTestClock: import("@oxlint/plugins").Rule;