@timmo001/oxlint-rules 0.3.4 → 0.3.6

package/README.md

@@ -5,12 +5,21 @@ Shared Oxlint plugins and configs built around the unchanged
 locally owned generic rules under `timmo` and Effect rules under
 `timmo-effect`.
 
-Oxlint's JavaScript plugin API is alpha. Consumers must keep `oxlint` and
-`@oxlint/plugins` on the exact peer versions declared by this package.
+This package targets the latest stable Oxlint toolchain. Oxlint's
+[JavaScript plugin API is alpha](https://oxc.rs/docs/guide/usage/linter/config.html)
+and is outside its semver guarantees, so each rules release declares the exact
+`oxlint` and `@oxlint/plugins` versions it has validated. Older toolchains and
+untested future versions are not part of the support contract.
 
 ## Install
 
-Install from npm with the package manager already used by the repository:
+Check the published rules package's `peerDependencies` against the official npm
+`latest` versions of `oxlint` and `@oxlint/plugins`. If they differ, a validated
+rules release is needed before upgrading. Do not bypass peer checks or override
+Vite Plus's bundled dependencies to make an unsupported version fit.
+
+Once the versions match, install from npm with the package manager already used
+by the repository:
 
 ```sh
 bun add --dev --exact @timmo001/oxlint-rules oxlint @oxlint/plugins
@@ -42,6 +51,11 @@ Both configs can be installed from JSR with its npm compatibility support.
 npmjs.org remains the default for package managers that resolve ordinary
 package names from `node_modules`.
 
+For type-aware linting, also pin the latest `oxlint-tsgolint` version that meets
+Oxlint's declared peer requirement and has passed the package check. Enable
+`options: { typeAware: true }` in the consumer's config. The shared configs do
+not enable type-aware linting themselves.
+
 ## Copy rules
 
 Copy a reviewed snapshot when a repository should own the rule source:
@@ -83,10 +97,45 @@ Initialise the upstream source and run the package checks:
 git submodule update --init --recursive
 mise run check
 mise run build
+mise run test:package
 npm pack --dry-run
-bunx jsr publish --dry-run
+bunx jsr@0.14.3 publish --dry-run --allow-dirty
 ```
 
+`bun run lint` builds the local plugins before linting all maintained code,
+including tests, tooling, the root config and packaged skill scripts. The root
+config extends the local `recommended-effect` source config, enabling every
+registered rule in `anti-slop`, `timmo`, `anti-slop-effect` and `timmo-effect`.
+Plugin imports resolve through this package's exports to the fresh `dist` build.
+
+Lint disables nested configs so the vendored submodule's config cannot override
+the root exclusions. Generated output, vendored source and agent directories
+remain excluded. RuleTester fixture strings retain their intentional violations;
+the surrounding test code is linted with the full rule set.
+
+`mise run test:package` builds and packs once, then installs the tarball in an
+isolated consumer using the exact toolchain pins from `package.json` and strict
+peer checks. It verifies both recommended configs, diagnostics from all four
+shared namespaces, and valid and invalid type-aware examples. CI runs this
+through the existing package workflow's build step. It also requires matching,
+exact Oxlint development and peer versions.
+
+### Toolchain updates and releases
+
+Renovate's shared preset groups Oxlint, `@oxlint/plugins` and `oxlint-tsgolint`.
+The local rule keeps both development and peer dependencies pinned instead of
+widening peer ranges. For each update:
+
+1. Verify the official npm `latest` versions and Oxlint's tsgolint peer
+   requirement. Keep Oxlint and plugins on the same latest version and regenerate
+   the lockfile with the selected tsgolint version.
+2. Run the checks and package dry-runs above. Fix any API incompatibility before
+   accepting the new pins; do not disable rules or bypass peer failures.
+3. Review and merge the validated update. Consumers need a separately approved
+   version bump and release to receive the new peer contract. Publishing a
+   GitHub release triggers the existing npm and JSR workflows; both must succeed
+   before the update is available to consumers.
+
 Advance `vendor/anti-slop` only by updating its Git submodule commit. Keep its
 source and MIT licence unchanged, then run the full package checks so both
 upstream exports and composed configs are verified.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timmo001/oxlint-rules",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Shared Oxlint plugins and configs with optional Effect rules.",
   "type": "module",
   "license": "Apache-2.0",
@@ -36,22 +36,24 @@
   ],
   "scripts": {
     "build": "bun run scripts/build.ts",
-    "check": "bun run build && bun run test && bun run lint && bun run typecheck && bun run format:check && bun run skills:validate",
-    "format": "prettier --write \"{src,scripts}/**/*.ts\" \"skills/**/*.{md,mjs}\" \"*.md\" \"*.json\"",
-    "format:check": "prettier --check \"{src,scripts}/**/*.ts\" \"skills/**/*.{md,mjs}\" \"*.md\" \"*.json\"",
-    "lint": "oxlint src scripts",
+    "check": "bun run lint && bun run test && bun run typecheck && bun run format:check && bun run skills:validate",
+    "format": "prettier --write \"{src,scripts}/**/*.ts\" \"skills/**/*.{md,mjs}\" \"*.ts\" \"*.md\" \"*.json\"",
+    "format:check": "prettier --check \"{src,scripts}/**/*.ts\" \"skills/**/*.{md,mjs}\" \"*.ts\" \"*.md\" \"*.json\"",
+    "lint": "bun run build && oxlint --disable-nested-config .",
     "skills:validate": "bunx skills-ref validate skills/install-timmo-oxlint-rules && bunx skills-ref validate skills/add-oxlint-rule && bunx skills-ref validate skills/release-oxlint-rules",
     "test": "node --experimental-strip-types scripts/test.ts",
+    "test:package": "node --experimental-strip-types scripts/test-package.ts",
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@oxlint/plugins": "1.83.0",
-    "oxlint": "1.83.0"
+    "@oxlint/plugins": "1.85.0",
+    "oxlint": "1.85.0"
   },
   "devDependencies": {
-    "@oxlint/plugins": "1.83.0",
+    "@oxlint/plugins": "1.85.0",
     "@types/bun": "^1.3.14",
-    "oxlint": "1.83.0",
+    "oxlint": "1.85.0",
+    "oxlint-tsgolint": "7.0.2002",
     "prettier": "^3.9.5",
     "skills-ref": "0.1.5",
     "typescript": "^7.0.0"

package/skills/install-timmo-oxlint-rules/SKILL.md

@@ -14,8 +14,12 @@ description: >-
    instructions, and normal checks. Use the current working directory unless
    the user names another target.
 3. Preserve existing ignores, overrides, plugins, and repository-owned rules.
-   Confirm `oxlint` and `@oxlint/plugins` use the same exact version supported
-   by the selected package version.
+   Verify the official npm `latest` versions of `oxlint` and `@oxlint/plugins`.
+   They must match each other and the exact peers of the selected rules release.
+   Support is latest-only: if the published peer contract has not caught up,
+   report the pending rules release instead of widening peers or bypassing
+   package-manager failures. Do not force upgrades of Vite Plus's transitive
+   dependencies or assume its bundled plugins satisfy this contract.
 
 ## Package
 
@@ -28,6 +32,10 @@ description: >-
    instead only when `effect` is a direct dependency or the user explicitly
    requests it.
 4. Keep dependency and config edits visible. Do not delegate them to a script.
+5. For type-aware linting, explicitly pin the latest `oxlint-tsgolint` that
+   satisfies Oxlint's peer requirement and was validated with the rules release.
+   Enable `options.typeAware` in the target config and verify type-aware linting
+   alongside the shared rules.
 
 ## Copy rules
 
@@ -43,6 +51,8 @@ description: >-
    output as authoritative rather than maintaining plugin or rule inventories
    in this skill.
 
-Run the target repository's normal lint, typecheck, tests, and build. Report
+Run the target repository's lint command to verify the configuration loads, plus
+any checks explicitly required by that repository. Run typechecks, tests, or a
+build only when code or dependencies changed in a way those checks cover. Report
 package-manager changes, preserved local configuration, enabled rule groups,
 and checks.

package/skills/install-timmo-oxlint-rules/scripts/copy.mjs

@@ -2,7 +2,9 @@
 import { spawnSync } from "node:child_process";
 
 const [runner, ...copyArguments] = process.argv.slice(2);
+
 const packageName = "@timmo001/oxlint-rules";
+
 const commands = {
   bun: ["bunx", packageName, "copy", ...copyArguments],
   npm: [
@@ -20,11 +22,14 @@ const commands = {
 };
 
 const command = commands[runner];
+
 if (!command) {
   console.error("Usage: copy.mjs <bun|npm|pnpm|yarn> <destination> [--force]");
   process.exit(1);
 }
 
 const result = spawnSync(command[0], command.slice(1), { stdio: "inherit" });
+
 if (result.error) throw result.error;
+
 process.exit(result.status ?? 1);

package/skills/release-oxlint-rules/SKILL.md

@@ -17,22 +17,34 @@ description: >-
    its release exists. Resolve the next version from the requested major,
    minor, patch, or exact version. Ask only when the release level is missing.
    Do not add a `v` prefix when the repository's existing tags omit it.
-3. Update the version in `package.json` and `jsr.json`. Before committing, run
-   `mise run check`, `mise run build`, `npm pack --dry-run`, and
+3. Verify official npm `latest` metadata for `oxlint`, `@oxlint/plugins` and
+   `oxlint-tsgolint`. Support is latest-only: keep Oxlint and plugins on the same
+   latest version, pin their development and peer dependencies exactly, and
+   select the latest tsgolint satisfying Oxlint's peer requirement. Regenerate
+   `bun.lock`. The shared Renovate preset groups this toolchain; the local rule
+   keeps peers pinned. Resolve compatibility failures before releasing, without
+   widening peers, disabling rules or forcing transitive dependency upgrades.
+4. Update the version in `package.json` and `jsr.json` only when a version bump
+   is requested. Before committing, run `mise run check`, `mise run build`,
+   `mise run test:package`, `npm pack --dry-run`, and
    `bunx jsr@0.14.3 publish --dry-run --allow-dirty`. The dirty-tree flag is
-   required because the intended version bump is not committed yet.
-4. Treat a direct request to create or publish the release as authorisation for
+   required because the intended changes are not committed yet. The package
+   check installs packed output with strict peers and verifies both recommended
+   configs, actual shared-rule diagnostics and type-aware linting.
+5. Treat a direct request to create or publish the release as authorisation for
    its version commit, push, and GitHub release. Follow the active environment's
    guarded commit and push workflow, committing only the release metadata with
    `Release Oxlint rules <version>`. A request to prepare or plan a release does
    not authorise publication.
-5. Resolve the target only after the push with `git rev-parse HEAD`. Pass the
+6. Resolve the target only after the push with `git rev-parse HEAD`. Pass the
    resulting full 40-character SHA as the `--target` value when running
    `gh release create`. Never pass an abbreviated SHA as `target_commitish`.
-6. Create the release before resolving workflow targets because publication is
+7. Create the release before resolving workflow targets because publication is
    triggered by the `release.published` event. Watch only the release commit's
    exact workflow runs and require both `Publish to npm` and `Publish to JSR` to
    succeed.
-7. Report the release URL, version commit, validation results, and npm and JSR
+8. Report the release URL, version commit, validation results, and npm and JSR
    publication conclusions. Do not report the release as complete while either
-   publication job is pending or failed.
+   publication job is pending or failed. A merged toolchain update alone does
+   not deliver its peer contract to consumers; preparation ends with publication
+   pending until a version bump and release are approved.

package/src/effect/rules/no-try-catch-in-effect-generators.ts

@@ -9,16 +9,20 @@ function resolveVariable(
   identifier: ESTree.IdentifierReference,
 ): Variable | null {
   let scope: Scope | null = sourceCode.getScope(identifier);
+
   while (scope) {
     const variable = scope.set.get(identifier.name);
+
     if (variable) return variable;
     scope = scope.upper;
   }
+
   return null;
 }
 
 function nearestEnclosingFunction(node: ESTree.Node): FunctionNode | null {
   let current: ESTree.Node | null = node.parent;
+
   while (current) {
     if (
       current.type === "FunctionDeclaration" ||
@@ -27,13 +31,16 @@ function nearestEnclosingFunction(node: ESTree.Node): FunctionNode | null {
     ) {
       return current;
     }
+
     current = current.parent;
   }
+
   return null;
 }
 
 function staticMemberName(node: ESTree.Expression): string | null {
   if (node.type !== "MemberExpression" || node.computed) return null;
+
   return node.property.type === "Identifier" ? node.property.name : null;
 }
 
@@ -43,6 +50,7 @@ function isEffectImport(
   namespace: boolean,
 ): boolean {
   const variable = resolveVariable(sourceCode, identifier);
+
   return (
     variable?.defs.some((definition) => {
       if (
@@ -52,9 +60,12 @@ function isEffectImport(
       ) {
         return false;
       }
+
       if (namespace) return definition.node.type === "ImportNamespaceSpecifier";
+
       if (definition.node.type !== "ImportSpecifier") return false;
       const imported = definition.node.imported;
+
       return (
         (imported.type === "Identifier" ? imported.name : imported.value) ===
         "Effect"
@@ -71,10 +82,13 @@ function isEffectMethod(
   if (staticMemberName(node) !== method || node.type !== "MemberExpression") {
     return false;
   }
+
   const object = node.object;
+
   if (object.type === "Identifier") {
     return isEffectImport(sourceCode, object, false);
   }
+
   if (
     staticMemberName(object) !== "Effect" ||
     object.type !== "MemberExpression" ||
@@ -82,6 +96,7 @@ function isEffectMethod(
   ) {
     return false;
   }
+
   return isEffectImport(sourceCode, object.object, true);
 }
 
@@ -97,12 +112,15 @@ function isRecognisedEffectGenerator(
   owner: FunctionNode,
 ): boolean {
   const parent = owner.parent;
+
   if (parent.type !== "CallExpression" || !isDirectArgument(owner, parent)) {
     return false;
   }
+
   if (isEffectMethod(sourceCode, parent.callee, "gen")) return true;
 
   const factoryCall = parent.callee;
+
   return (
     factoryCall.type === "CallExpression" &&
     isEffectMethod(sourceCode, factoryCall.callee, "fn")
@@ -127,12 +145,14 @@ export const noTryCatchInEffectGeneratorsRule = defineRule({
       TryStatement(node) {
         if (!node.handler) return;
         const owner = nearestEnclosingFunction(node);
+
         if (
           !owner?.generator ||
           !isRecognisedEffectGenerator(context.sourceCode, owner)
         ) {
           return;
         }
+
         context.report({ node, messageId: "useEffectErrorChannel" });
       },
     };

package/src/generic/rules/prefer-event-parameter-type.ts

@@ -3,10 +3,12 @@ import { defineRule } from "@oxlint/plugins";
 import type { ESTree } from "@oxlint/plugins";
 
 type FunctionNode = ESTree.Function | ESTree.ArrowFunctionExpression;
+
 type TypeAssertion = ESTree.TSAsExpression | ESTree.TSTypeAssertion;
 
 function nearestEnclosingFunction(node: ESTree.Node): FunctionNode | null {
   let current: ESTree.Node | null = node.parent;
+
   while (current) {
     if (
       current.type === "FunctionDeclaration" ||
@@ -15,8 +17,10 @@ function nearestEnclosingFunction(node: ESTree.Node): FunctionNode | null {
     ) {
       return current;
     }
+
     current = current.parent;
   }
+
   return null;
 }
 
@@ -25,6 +29,7 @@ function assertedEventParameter(node: TypeAssertion): {
   readonly property: "currentTarget" | "target";
 } | null {
   const expression = node.expression;
+
   if (
     expression.type !== "MemberExpression" ||
     expression.computed ||
@@ -35,9 +40,11 @@ function assertedEventParameter(node: TypeAssertion): {
   ) {
     return null;
   }
+
   const parameterName = expression.object.name;
   const property = expression.property.name;
   const owner = nearestEnclosingFunction(node);
+
   if (
     !owner?.params.some(
       (parameter) =>
@@ -46,6 +53,7 @@ function assertedEventParameter(node: TypeAssertion): {
   ) {
     return null;
   }
+
   return {
     parameter: parameterName,
     property,
@@ -68,6 +76,7 @@ export const preferEventParameterTypeRule = defineRule({
   create(context) {
     const checkAssertion = (node: TypeAssertion) => {
       const eventParameter = assertedEventParameter(node);
+
       if (!eventParameter) return;
       context.report({
         node,
@@ -75,6 +84,7 @@ export const preferEventParameterTypeRule = defineRule({
         data: eventParameter,
       });
     };
+
     return {
       TSAsExpression: checkAssertion,
       TSTypeAssertion: checkAssertion,