Add anti-slop Oxlint rules + run against the current codebase

[SlothSoftworks]

Summary

• Vendors dmmulroy/anti-slop's generic Oxlint rule group at tools/oxlint/anti-slop (15 rules targeting low-evidence TS/JS patterns — chained/unjustified type assertions, unknown leaking across function boundaries, ad hoc typeof narrowing, Reflect.get/apply, module mocking in tests, etc.). Dropped the Effect-framework-specific rule group since this project doesn't use Effect. Per upstream's own model this is vendored and meant to be maintained locally, not tracked as a live dependency — see tools/oxlint/anti-slop/VENDORED.md for provenance and how to re-sync later.
• Registers it via oxlint.config.ts and adds npm run lint:anti-slop. oxlint/@oxlint/plugins added as exact-pinned (not caret) dev dependencies at matching versions, per upstream's recommendation to keep them in lockstep.
• Not wired into CI or the existing lint/husky pre-commit hook. This is a brand-new, quite opinionated tool nobody's reviewed the fit of yet — adding it as a gate is a separate decision from having it available to run on demand.

What running it turned up

306 findings from anti-slop + 5 from Oxlint's own bundled unicorn rules, across 37 files. Before reading that as "306 problems," the honest breakdown:

• 235 of the 306 (77%) are one rule (require-safety-comment-for-type-assertion) firing almost entirely on ordinary as casts in test files typing mock data (vitest.setup.ts, testing/mockData/, *.test.tsx). That's normal test-authoring style, not evidence of anything — this rule wants a SAFETY: comment on literally every non-const assertion, which floods test files by design.
• A couple of likely false positives specific to this codebase, worth noting rather than acting on:
  • no-shape-in-symbol-names flags the function reshapeVideoInfo (videoInfo.mjs, main.mjs) purely because it contains the substring "shape" — it's just an ordinary verb here, unrelated to the schema-shape confusion the rule is guarding against.
  • no-known-value-widening flags KNOWN_PLATFORM_LABELS (utils.ts) and COOKIE_BROWSER_LABELS (OptionsScreen.tsx) for being typed as open Record<string, string> dictionaries — but both are intentionally open (arbitrary hostname/browser key → label, with a documented fallback for anything not listed), not a case of discarding known keys.
  • no-runtime-typeof and no-module-mocking reflect an architectural preference (schema-validated boundaries; DI over vi.mock) that doesn't match this app's actual design (no validation-library boundary layer exists) or test setup (mocking Electron's window.electronAPI is central to how the test suite works) — enabling these as hard errors would mean redesigning around the linter rather than the linter catching a real problem.
• A couple of genuinely worth a look:
  • useBulkAddQueue.tsx's extractDownloadErrorMessage(downloadError: unknown) immediately does (downloadError as { payload?: { message?: string } } | null) — accepting unknown and then blindly re-asserting a shape is exactly the pattern this tool exists to catch.
  • LibraryVideoDetail.tsx:228-229 has the ...(condition ? { field } : {}) conditional-spread pattern flagged by no-conditional-empty-object-spread — though arguably fine as written (the intent, "leave the field alone unless repaired," reads clearly from context).

Bottom line: nothing like fabricated APIs, dead code, or actually-unsafe patterns turned up in production code. What surfaced is mostly this tool's own strict take on type-assertion hygiene colliding with normal test-mock typing, plus a couple of debatable-fit rules for this project's actual architecture — not evidence of a systemic AI-slop problem. Worth keeping the tool around and maybe enabling a subset of these rules deliberately (the two "genuinely worth a look" items above are a reasonable starting point) rather than turning all 15 on as blocking errors as-is.

Test plan

• npx tsc -b still passes with the same single pre-existing, unrelated error it has on master (a window.electronAPI mock-shape mismatch in App.tsx — confirmed via git stash that it predates this change).
• git diff package-lock.json is purely additive (21 new 1.81.0 entries for oxlint + its per-platform optional binaries; no existing package's resolved version changed).
• npm run lint:anti-slop runs cleanly (exits with findings as documented above, not a crash).

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01Wnz52wfC7mGqEGfrpeBRdY

---

Generated by Claude Code