Detect unsafe TypeScript type assertions, including double assertions

[CodeDeficient]

Problem

KarpeSlop does not currently report unsafe TypeScript as assertions such as:

value as unknown as Target
value as Target

This is related to the previously closed #10, but the gap is broader: double assertions and ordinary unchecked object/array assertions can bypass structural type safety at database and external-data boundaries without any warning in strict mode.

Expected behavior

Strict analysis should report unsafe TypeScript assertions, including:

• value as unknown as Target
• Unchecked object assertions such as value as Record<string, unknown>
• Unchecked array or domain-row assertions such as data as EventRow[]

The report should include the file, line, assertion form, and severity.

Scope boundaries

• Do not report satisfies expressions as assertions.
• Avoid false positives for generated declaration files and framework-required boundary declarations where possible.
• Preserve the existing any and unsafe-type detectors.

Reproduction

interface EventRow {
  id: string;
}

const value: unknown = getExternalData();
const rows = value as unknown as EventRow[];
const record = value as Record<string, unknown>;

Neither assertion form was reported by npx karpeslop@latest --quiet --strict in the consuming project. Please add fixtures and regression tests for these patterns.

[coderabbitai]

🔗 Related PRs

#9 - fix: resolve all false positives (issues #2, #6, #7, #8) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[CodeDeficient]

Resolved by PR #24 (merged at 2026-07-27T19:07:54Z). The following AST-based detection is now implemented in findUnsafeAssertions():

• unsafe_type_assertion (as any) — AST-based, no regex false positives
• unsafe_double_type_assertion — any chained as X as Y, not only as unknown as Y
• unsafe_object_assertion — as Record<...> / as { ... }
• unsafe_array_assertion — as T[] / as Array

All four forms: per-AST-node precise counts, test-file exclusion, .d.ts exclusion, inline suppression, configurable severityOverrides.

Follow-up items tracked separately:

• unsafe_type_assertion column/line uses type-node position instead of expression-start #25 — column/line reporting consistency
• Parenthesized chained assertions not detected as unsafe_double_type_assertion #27 — parenthesized chained assertions
• Define JavaScript/JSX coverage contract for unsafe_type_assertion #28 — JS/JSX coverage contract
• Remove code-level suppression — only config-level severityOverrides may silence findings #29 — directive-aware suppression matching
• Add exit-code assertion to excluded test-file fixture test #30 — exit-code assertion for test-file fixture