Proposal: lint agent and human code with oxlint + anti-slop

[SaulMoro]

The problem

The only automated check on the code is tsc, which checks types and nothing else. The Code Erosion report gives each PR a score, but it doesn't say which line to change. At least 38% of commits come from coding agents, and apart from the tests, only a reviewer reads what they write.

The history shows what gets past review:

• Bugs that tsc can't see. In fix(tgit): correct REST auth scheme and rename TGit token to TGIT_TOKEN #210, String(m.id) !== undefined was always true, so the MR lookup always returned the first MR. In fix(contribute-check): five root causes preventing hint from ever firing #160 and fix(recall): gate the CLAUDE.md recall block on enabledAgents #535, a parameter or variable was declared and never used, and that was the bug. The code never did what it was for.
• Fixes piling up in the same few places. Ten of the 266 source files hold 13.5% of the production code but received 28% of all fix commits. Those files read agent payloads with ad hoc typeof checks instead of validating them, and several fixes added more of the same checks.
• Dead code. Production code has 62 unused variables and imports today, and [chore] 死代码与重复实现清理（manifest-compiler / doc-graph-extractor / utils 垫片 / legacy hook 子命令等） #86 had to clean up an earlier batch by hand.

How a linter solves it

I ran oxlint with the recommended rules from anti-slop on main at ec56a67c. The Effect rules are left out because this repo doesn't use Effect.

Problem	What the linter does
Bugs tsc can't see	It reports all three bugs above on the exact line, before their fixes. I re-ran it on the code before each of the 361 fix commits to check this.
Fixes piling up in a few files	57% of its warnings about unvalidated input fall in those same ten files. Each warning names the fix, for example "parse external payloads before insertion". zod is already a dependency.
Dead code	It reports every unused variable and import.
Cost	It checks all of src/ in 1.1 s, while tsc takes 3.1 s. oxlint --fix clears 11,104 of the 14,715 current warnings, and that change only adds blank lines.

The three bugs come from oxlint's default rules. The anti-slop rules did not flag any of them directly. They show where bugs cluster and what to change there.

Where it helps

The same npm run lint command works in three places.

• Local development. A full run takes about a second, and --fix handles most of the formatting warnings automatically.
• Agents before they open a PR. If the command is listed in CLAUDE.md and AGENTS.md, the agent runs it and fixes what it reports. The warning text tells the agent what to change, so a reviewer doesn't have to.
• CI. The default rules can fail the build from day one. The anti-slop rules can start as a count that must not go up, so new code has to be clean while the existing warnings get fixed over time.

Details behind the numbers

Replaying the linter on past fixes

I ran the linter on each file as it was before its fix commit, and kept the warnings that fall on lines the fix changed.

flowchart LR
    A["361 fix commits<br/>touching src/"] --> B["252 with a warning<br/>on a changed line"]
    B --> C["100 without counting<br/>blank-line warnings"]
    C --> D["19 from oxlint<br/>default rules"]
    C --> E["41 from anti-slop<br/>input-validation rules"]
    D --> F["3 confirmed bugs<br/>#210 #160 #535"]

Loading

I checked the 19 by hand. Apart from the three bugs, they were cleanups made alongside the fix, mostly unused imports removed in passing. #606 also shows up, but tsc catches it too.

Files where the fixes pile up

File	Lines	Input-validation warnings	Fix commits
local-agent.ts	3,506	47	49
hook-handlers.ts	876	19	28
dashboard-collector.ts	1,975	52	19
contribute-check.ts	726	20	18
usage-tracker.ts	545	15	12
transcript-parser.ts	822	28	5
votes.ts	516	9	5
resources/agent-format.ts	904	48	3
models/switch.ts	940	44	0
utils/iwiki-client.ts	364	15	0

The first four files read hook and agent payloads, and 93 fix commits touched at least one of them, a quarter of all fixes to src/. models/switch.ts and utils/iwiki-client.ts have many warnings but no fixes yet.

Today's warnings

pie showData
    title 14,715 warnings on main
    "Blank lines, fixed by --fix" : 11104
    "Type assertions without a SAFETY comment" : 1634
    "vi.mock in tests" : 482
    "Unvalidated input" : 1042
    "Other anti-slop rules" : 305
    "oxlint default rules" : 148

Loading

Where	Warnings	Per 1,000 lines
Production code (82.7k lines)	1,709	20.7
Tests (99.6k lines)	1,878	18.9

These counts are after --fix.

[jeff-r2026]

Thanks for the detailed analysis! I agree we should add oxlint and make its default rules part of CI. For anti-slop, let’s review the warning quality first and introduce rules gradually. Would you like to take the first PR?

[SaulMoro]

Yes. #839 adds oxlint with its default rules and fails CI on any warning. It fixes all 145 current warnings without suppression comments and changes no runtime behavior.

Two bugs the linter found, plus two found while triaging its warnings, ship separately so they get their own CHANGELOG entries:

• fix(tags,roles): honor --dry-run and count namespaced skills in tags list (#836) #837: tags subscribe, tags unsubscribe and roles set ignored --dry-run, and tags list counted namespaces as skills. Please merge it before ci(lint): add oxlint and fail CI on any warning (#828) #839, which carries a copy of its first commit until I rebase.
• fix(cache,import): print cache and import review output in English (#836) #840: import --cache-status, --cache-gc and the interactive import review printed Chinese.

#836 tracks those and the next rules, measured on this codebase: anti-slop one rule at a time, the suspicious + perf categories, and type-aware no-floating-promises / no-misused-promises.