@aurelienbbn/agentlint-plugin-core

25 agentlint reviews for any TypeScript repo: a deterministic trigger finds the spot, an agent or a human settles it.

[!WARNING] Requires the engine @aurelienbbn/agentlint >=0.3.0 <0.9.0 as a peer. Evidence.

strictPreset   █████████████            13  settled rules
starterPreset  ██                        2  boundary-resilience, bounded-work
opt-in         ████████████             12  exported, in no preset: calibrate first

Start with 2 rules, not 25

agentlint init --preset "@aurelienbbn/agentlint-plugin-core#starterPreset"
agentlint rules test
agentlint rules scan --review
agentlint next --format json

init keeps an existing config and prints the install command; never installs. Calibrate bindings before requiring agentlint check --all.

import { defineConfig } from "@aurelienbbn/agentlint";
import { defineFallbackMasksFailure, fakeParity, strictPreset } from "@aurelienbbn/agentlint-plugin-core";

export default defineConfig({
  extends: [strictPreset],
  rules: [fakeParity, defineFallbackMasksFailure({ minFallbacksPerScope: 3 })],
});

Rules

🧪 opt-in: exported, register it yourself · 🔒 only a human can accept a finding. Presets ignore **/*.d.ts.

Promote an opt-in rule only when most of its agentlint rules scan --review findings lead to a change. Each prescribes a fix that is expensive or of unknown volume.

fetch(url);                                                          // ❌ boundary-resilience: no signal/timeout
fetch(url, { signal: AbortSignal.timeout(2_000) });                  // ✅
try { await fetch(url, { signal }); } catch (error) { logger.warn('failed', error); }  // ❌ failure discarded (logging still discards)

expect(applyDiscount(price, pct)).toBe(price - (price * pct) / 100); // ❌ expected-value-recomputed
expect(applyDiscount(200, 15)).toBe(170);                            // ✅ states it

const email = form.get("email") || "";                               // ❌ fallback-masks-failure
<span title={user.email ?? ""}>{user.id ?? ""}</span>               // ✅ JSX display default

A network try/catch returning an empty literal is reported by both fallback-masks-failure and boundary-resilience.

test-behavior-coverage triggers
file-density      ≥ 3 mock constructions, no assertion pins returned state or output
interaction-only  ≥ 2 tests, or ≥ minInteractionShare of a file's tests, assert interactions only
                  (skipped when file-density already fires; lists the doubles per test)
snapshot-only     ≥ 2 tests whose only oracle is a whole-value snapshot,
                  or an inline snapshot > maxInlineSnapshotLines

Ownership: operations stay with their module

operations-stay-with-owner reports a file that calls minOperations (4) or more operations of one other module through its public entry. A module's entry is a relative import resolving to api.ts (entryPattern), or a bare specifier listed in packages (@acme/* for a scope). Operations are the value names starting lowercase; schemas, classes, constants in PascalCase and every type import are vocabulary and never count. Counted per file and per owner, so a read model calling two operations of each of three modules stays silent.

// src/qa/story.ts: ❌ replays takedown's own state moves, so the seed belongs to takedown
import { requestComposed, requestSent, requestBounced, requestReplied } from "../takedown/api.ts";

// src/ops/act.ts: ✅ one outcome the owner offers, plus its vocabulary
import { merchantsStart, type TakedownSource } from "../takedown/api.ts";

The fix is ownership, not a wider entry: move the code into the owner, or let the owner contribute it through a declaration the composition collects (a seed, a handler, a migration). Exclude the composition root (registry/, workers/) in the binding when it legitimately assembles every module. Calibrated on one modular monolith (515 files): 1 finding, the seed that replayed another feature's moves.

🔒 Test drift: the author doesn't accept it

test-expectation-drift authority defaults to "human": the change author is the party tempted to accept a finding about it. defineTestExpectationDrift({ authority: "agent" }) restores the usual default. Don't narrow include to test files: the engine filters the change by the binding before detection, and two kinds depend on source edits.

temporal-coupling signals
guard-throw          throw message says "not initialized/connected/started/configured/ready/loaded/opened",
                     "call x() first/before" or "must call/be initialized"
definite-assignment  undecorated `name!: T` assigned in a method, never in the constructor
nullable-init        `| null`/`| undefined` field set by exactly one init/initialize/setup/connect/open/
                     start/load/configure/bootstrap method, null-checked in ≥ 2 other methods

Declared invariants and hotspots

protected-invariant-change and hotspot-change-review ship empty and stay silent: they fire only on what your repo declares.

Migration: re-review earlier acceptances

Review prompts, not correctness proofs.

⚠️ existing acceptances need a fresh review.

Registered contract inventory

Generated from package exports by pnpm catalog. Rule-specific options and limitations are described above and in the source tests.

Credited concepts

• "Characterization Testing" by Michael Feathers (concept)
• "Choosing properties for property-based testing" by Scott Wlaschin (concept: inverse and idempotence families)
• "ContractTest" by Martin Fowler (concept)
• "Design Smell: Temporal Coupling" by Mark Seemann (concept)
• "Designing with types: Making illegal states unrepresentable" by Scott Wlaschin (concept)
• "Don't Put Logic in Tests" (Google Testing Blog) (concept)
• "Feature Envy" from Martin Fowler's Refactoring (concept, lifted from classes to modules)
• "FlagArgument" by Martin Fowler (concept)
• "Getting Started with Contract Tests" by J. B. Rainsberger (concept)
• "IntegrationTest" by Martin Fowler (concept: narrow integration tests double the remote, not the adapter)
• "Interfaces are not abstractions" by Mark Seemann (concept: header interfaces, Reused Abstractions Principle)
• "Parse, don't validate" by Alexis King (concept)
• "Parse, don't validate" by Alexis King (concept: absence is rejected once, at the boundary)
• "The Wrong Abstraction" by Sandi Metz (concept)
• "When to Mock" by Vladimir Khorikov (concept: interaction assertions belong to unmanaged process boundaries)
• ImpossibleBench (arXiv 2510.20270) (concept: passing by editing the oracle)
• code-slop by asyrafhussin (MIT) + thermos by Cursor (MIT), concepts re-implemented
• code-slop by asyrafhussin (MIT, concept re-implemented)
• code-slop by asyrafhussin (MIT, concept re-implemented; real-defenses checklist)
• https://alexn.org/blog/2026/09/22/ai-has-no-wisdom-and-neither-will-you/ (inspiration; independently implemented)
• https://alexn.org/blog/2026/09/22/ai-has-no-wisdom-and-neither-will-you/#isso-thread (inspiration; independently implemented)