oxlint-plugin-jev

[!WARNING] This package is experimental. Use at your own risk.

Oxlint rules written in plain English, answered by TypeSafe Jev.

A rule is a yes/no question about a function, a call, a JSX element, or a whole file. Each match is sent to Jev with the question, and the plugin reports an error when the yes-probability clears your cutoff.

Install

npm i -D oxlint oxlint-plugin-jev
export TYPESAFE_API_KEY="..."   # https://console.typesafe.ai

In CI, set ci: "fail" so a run that could not reach Jev fails instead of passing quietly.

Config

Add the plugin and its one rule, jev/ask, to .oxlintrc.json. Your English rules go in the options.

{
  "jsPlugins": ["oxlint-plugin-jev"],
  "rules": {
    "jev/ask": [
      "error",
      {
        "rules": [
          {
            "id": "no-pii-in-logs",
            "target": "call",
            "question": "Does this call write personal data, such as an email or phone number, to a log or console?",
            "cutoff": 0.8
          },
          {
            "id": "name-matches-behavior",
            "target": "function",
            "question": "Does this function's name imply it only reads data, while its body also writes or sends something?",
            "cutoff": 0.6
          }
        ]
      }
    ]
  }
}

| Field | What it is | | ---------- | ------------------------------------------------------------ | | id | Shown in the error message. Unique in the list. | | target | "function", "call", "jsx", or "file". | | question | A yes/no question. "Yes" means "report this". | | cutoff | 0 to 1. Report when Jev's yes-probability is at or above it. |

target decides what Jev gets to read. There is no selector syntax and no other target.

| Target | Jev sees | The error underlines | | ------------ | ------------------------------------------------------------------------------------------------------------ | -------------------- | | "function" | The whole function. An arrow or method includes its name, so const getUser = () => ... reads as getUser. | The signature line | | "call" | The whole call expression. | The whole call | | "jsx" | The whole element, children included. | The opening tag | | "file" | The whole file. | The first line |

The wording of the question is the rule, so be precise about what counts. "Does this send personal data" also fires on a legitimate mailer.send(user.email, ...). "To a log or console" does not.

| Setting | Default | Meaning | | ------------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | ci | "skip" | What happens when Jev can't be asked and CI is set. "skip" warns once and reports nothing. "fail" fails the run. Outside CI it always skips. | | timeoutMs | 10000 | Per-file request timeout, retries included. | | maxMatchesPerFile | 25 | Snippets sent per file across all rules. Extra matches are dropped in source order and the file is named on stderr. | | maxSnippetChars | 4000 | Longer snippets are cut and end with /* ...truncated */. | | model | "jev-latest" | TypeSafe model id. Pin a versioned id such as "jev-1.13.0" once your cutoffs are tuned. Each diagnostic names the version that answered. |

TYPESAFE_BASE_URL points the plugin at another host. The tests use it for a mock.

How it works

One request per file, with every match in it.

Answers are cached under node_modules/.cache/oxlint-plugin-jev, keyed by the request. Changing a snippet or a question re-asks that file. Changing a cutoff or an id does not.

The request runs on a worker thread through the official @typesafe-ai/sdk client, which retries rate limits and server errors within timeoutMs.

If Jev can't be asked, because the key is missing, the request times out, or the API errors, the plugin prints one warning and reports nothing for that file. Set ci: "fail" to fail the run instead.

In the editor

The oxlint VS Code extension lints as you type, and every keystroke inside a match is a paid request that blocks the language server until Jev answers.

Keep jev/ask out of the config your editor reads, and put it in an overlay for CI and pre-push. Leave jsPlugins in the base config, since the overlay inherits it.

{
  "extends": [".oxlintrc.json"],
  "rules": {
    "jev/ask": ["error", { "rules": [ ... ] }]
  }
}

oxlint                        # editor and local runs, no Jev
oxlint -c .oxlintrc.ci.json   # CI and pre-push, Jev included

Example

example/ has three rules that a pattern-based linter can't express, a file that fails all three, and a file that passes.

| Rule | Fails on | Passes on | | ----------------------- | ------------------------------------------------------- | ------------------------------------------- | | no-pii-in-logs | console.log("loaded", user.email, user.phone) | console.log("notified", { userId: id }) | | name-matches-behavior | getUser that also sends an email | The same body named notifySignIn | | no-prompt-injection | A customer message pasted into the system prompt string | The message passed as a separate user field |

npm run example

Development

TypeScript, built with Vite+. ESM only.

npm run build
npm run check   # format, lint, typecheck
npm test        # builds first, since the worker tests run against dist/
JEV_LIVE=1 TYPESAFE_API_KEY=... npm test   # also runs example/ against the real API

License

MIT