Detect unsafe TypeScript type assertions, including double assertions

Problem

KarpeSlop does not currently report unsafe TypeScript as assertions such as:

value as unknown as Target
value as Target

This is related to the previously closed #10, but the gap is broader: double assertions and ordinary unchecked object/array assertions can bypass structural type safety at database and external-data boundaries without any warning in strict mode.

Expected behavior

Strict analysis should report unsafe TypeScript assertions, including:

value as unknown as Target
Unchecked object assertions such as value as Record<string, unknown>
Unchecked array or domain-row assertions such as data as EventRow[]

The report should include the file, line, assertion form, and severity.

Scope boundaries

Do not report satisfies expressions as assertions.
Avoid false positives for generated declaration files and framework-required boundary declarations where possible.
Preserve the existing any and unsafe-type detectors.

Reproduction

interface EventRow {
  id: string;
}

const value: unknown = getExternalData();
const rows = value as unknown as EventRow[];
const record = value as Record<string, unknown>;

Neither assertion form was reported by npx karpeslop@latest --quiet --strict in the consuming project. Please add fixtures and regression tests for these patterns.

🔗 Related PRs

#9 - fix: resolve all false positives (issues #2, #6, #7, #8) [merged]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Create Plan

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

Merge pull request #23 from CodeDeficient/feat/issue-22-unsafe-assert…

Resolved by PR #24 (merged at 2026-07-27T19:07:54Z). The following AST-based detection is now implemented in findUnsafeAssertions():

unsafe_type_assertion (as any) — AST-based, no regex false positives
unsafe_double_type_assertion — any chained as X as Y, not only as unknown as Y
unsafe_object_assertion — as Record<...> / as { ... }
unsafe_array_assertion — as T[] / as Array

All four forms: per-AST-node precise counts, test-file exclusion, .d.ts exclusion, inline suppression, configurable severityOverrides.

Follow-up items tracked separately:

unsafe_type_assertion column/line uses type-node position instead of expression-start #25 — column/line reporting consistency
Parenthesized chained assertions not detected as unsafe_double_type_assertion #27 — parenthesized chained assertions
Define JavaScript/JSX coverage contract for unsafe_type_assertion #28 — JS/JSX coverage contract
Remove code-level suppression — only config-level severityOverrides may silence findings #29 — directive-aware suppression matching
Add exit-code assertion to excluded test-file fixture test #30 — exit-code assertion for test-file fixture

Navigation Menu

Repository navigation

Detect unsafe TypeScript type assertions, including double assertions #22

Problem

Expected behavior

Scope boundaries

Reproduction

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Detect unsafe TypeScript type assertions, including double assertions #22

Description

Problem

Expected behavior

Scope boundaries

Reproduction

Activity

coderabbitai commented on Jul 22, 2026

CodeDeficient commented on Jul 27, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions