Merge pull request #86 from CodeDeficient/claude/project-thread-36cl1x-unknown-options

Reject unknown options and warn on unknown severityOverrides keys

Author: CodeDeficient

CHANGELOG.md

@@ -8,6 +8,7 @@ All notable changes will be documented in this file.
 - `swallowed_error` (medium): a `catch` block whose only statements are `console` calls. The error is logged and the code carries on as if the operation succeeded. A comment in the block explaining why that is safe, a rethrow, or any other statement (such as `setError(e)`) means it is not reported, and so does a fallback after the `try`, as for `empty_catch`.
 
 ### Changed
+- An unknown command-line option stops the run with exit 1 and names the option. `--stirct` used to run without strict mode. A `severityOverrides` key that is not a rule id or custom pattern id prints a warning: `type_asertion: "off"` used to do nothing, silently.
 - A `customPatterns` entry whose `id` is a built-in rule id (`empty_catch`) or the id of another custom pattern is an invalid config. A shared id made `severityOverrides` and the exit code treat two rules as one.
 - A run fails (exit 1) on high and critical findings only. Medium findings such as `type_assertion` and `any_type_usage` are still reported but no longer fail a build; every clean repository tested (ky, express, hono, zod, date-fns, TanStack Query) exited 1 before. `--fail-on=<critical|high|medium|low>` sets the threshold.
 - A bundler config marks an import as an alias only when it quotes the whole name (`'@components'`, `'~/lib'`, webpack's `'@acme/ui$'`). A scoped name covers that package only: `'@acme/ui'` in a config or tsconfig `paths` does not cover `@acme/other`. A longer name that starts the same way (`'vite-plugin-pwa'` for `vite-plugin`) used to hide an undeclared or nonexistent package.

README.md

@@ -97,6 +97,8 @@ Create `.karpesloprc.json` in your project root:
 }
 ```
 
+An unknown option on the command line stops the run with exit 1, and a `severityOverrides` key that is not a rule id prints a warning, so a typo never silently changes what is checked.
+
 There are no inline suppression comments. A comment that silences the linter is easy for anyone, or any tool, to add next to the problem it hides. Changing a rule's severity, or turning it off, goes through `severityOverrides`, where it shows up in review.
 
 `customPatterns` are plain regexes matched line by line. Each needs an `id` of its own: a built-in rule id or one used by another pattern is rejected.

ai-slop-detector.ts

@@ -248,6 +248,13 @@ export class ConfigError extends Error {}
 /** A command-line flag with a value KarpeSlop does not accept. */
 export class UsageError extends Error {}
 
+const KNOWN_FLAGS = new Set(['--help', '-h', '/?', '--version', '-v', '--quiet', '-q', '--strict', '-s']);
+
+/** Flags KarpeSlop does not know. A typo such as `--stirct` would otherwise run without the option. */
+export function unknownFlags(flagArgs: readonly string[]): string[] {
+  return flagArgs.filter(arg => !KNOWN_FLAGS.has(arg) && !arg.startsWith('--fail-on='));
+}
+
 /** The severity named by `--fail-on=<severity>`, high when absent. Throws on an unknown value. */
 export function failOnFrom(flagArgs: readonly string[]): Severity {
   const flag = flagArgs.filter(arg => arg.startsWith('--fail-on=')).at(-1);
@@ -414,7 +421,11 @@ class AISlopDetector {
           });
         }
 
+        const knownIds = new Set([...BUILT_IN_RULE_IDS, ...this.customPatterns.map(pattern => pattern.id)]);
         for (const [ruleId, severity] of Object.entries(this.config.severityOverrides ?? {})) {
+          if (!knownIds.has(ruleId)) {
+            console.warn(`${path.basename(configPath)}: severityOverrides.${ruleId} does not name a rule and has no effect. Run karpeslop --help for the rule ids.`);
+          }
           this.severityOverrides.set(ruleId, severity);
         }
 
@@ -1076,6 +1087,13 @@ async function runIfMain() {
     process.exit(0);
   }
 
+  const unknown = unknownFlags(flagArgs);
+  if (unknown.length > 0) {
+    console.error(`KarpeSlop: unknown option${unknown.length === 1 ? '' : 's'} ${unknown.map(flag => `'${flag}'`).join(', ')}. ` +
+      'Run karpeslop --help for the list, or put paths that start with "-" after --.');
+    process.exit(1);
+  }
+
   let detector: AISlopDetector;
   try {
     detector = new AISlopDetector(rootDir, targetPaths.length > 0 ? targetPaths : undefined);

tests/ai-slop-detector.behavior.test.ts

@@ -18,6 +18,7 @@ import {
   shouldAnalyzePathInQuietMode,
   splitCliArgs,
   uniqueRealFiles,
+  unknownFlags,
 } from '../ai-slop-detector.ts';
 import { npmRegistryLookup } from '../imports.ts';
 
@@ -593,6 +594,36 @@ test('exit code: high and critical fail by default, --fail-on moves the threshol
   assert.throws(() => failOnFrom(['--fail-on=warning']), /--fail-on must be one of: critical, high, medium, low/);
 });
 
+test('unknown flags are rejected instead of silently ignored', () => {
+  assert.deepEqual(unknownFlags(['--quiet', '-s', '--fail-on=low']), []);
+  assert.deepEqual(unknownFlags(['--stirct', '--json', '-dash-file.ts']), ['--stirct', '--json', '-dash-file.ts']);
+  const result = spawnSync(
+    process.execPath,
+    ['--import', import.meta.resolve('tsx'), path.resolve(process.cwd(), 'ai-slop-detector.ts'), '--stirct'],
+    { encoding: 'utf-8', cwd: os.tmpdir(), env: { ...process.env, KARPESLOP_OFFLINE: '1' } }
+  );
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /unknown option '--stirct'/);
+  assert.equal(result.stdout.includes('Scanning'), false);
+});
+
+test('a severityOverrides key that is not a rule id is reported as a warning', () => {
+  const projectDir = fs.mkdtempSync(path.join(os.tmpdir(), 'karpeslop-override-'));
+  fs.writeFileSync(path.join(projectDir, '.karpesloprc.json'), JSON.stringify({ severityOverrides: { type_asertion: 'off', type_assertion: 'low' } }), 'utf-8');
+  fs.writeFileSync(path.join(projectDir, 'index.ts'), 'export const n = (v: unknown) => v as number;\n', 'utf-8');
+  const result = spawnSync(
+    process.execPath,
+    ['--import', import.meta.resolve('tsx'), path.resolve(process.cwd(), 'ai-slop-detector.ts')],
+    { encoding: 'utf-8', cwd: projectDir, env: { ...process.env, KARPESLOP_OFFLINE: '1' } }
+  );
+  try {
+    assert.match(result.stderr, /severityOverrides\.type_asertion does not name a rule/);
+    assert.equal(result.stderr.includes('severityOverrides.type_assertion '), false);
+  } finally {
+    fs.rmSync(projectDir, { recursive: true, force: true });
+  }
+});
+
 test('a cast alone does not fail the run unless --fail-on=medium is given', () => {
   const projectDir = fs.mkdtempSync(path.join(os.tmpdir(), 'karpeslop-failon-'));
   fs.writeFileSync(path.join(projectDir, 'index.ts'), 'export const n = (v: unknown) => v as number;\n', 'utf-8');