feat(lint): make --fix actually fix things

- oxlint --fix now chains into knip --fix: unused dependencies are
  removed from package.json (dead-code fix types require --strict;
  files are never deleted automatically)
- new bombshell-dev/no-console-log rule replaces stock no-console:
  flags console.log with an auto-fixer to console.info (semantically
  neutral in Node — they are the same stdout write)

Author: natemoo-re

oxlintrc.json

@@ -43,7 +43,8 @@
 
 		"unicorn/prefer-node-protocol": "error",
 		"typescript/consistent-type-imports": "error",
-		"no-console": ["warn", { "allow": ["info", "warn", "error", "debug"] }],
+		"no-console": "off",
+		"bombshell-dev/no-console-log": "warn",
 		"prefer-const": "error",
 		"no-var": "error",
 		"max-params": "off",

rules/plugin.js

@@ -70,6 +70,48 @@ const plugin = {
 			},
 		},
 
+		/**
+		 * Ban `console.log` (and other unlisted console methods) in favor of
+		 * leveled output: `console.info`, `console.warn`, `console.error`,
+		 * `console.debug`.
+		 *
+		 * `console.log` is auto-fixable to `console.info` — in Node.js the two
+		 * are aliases for the same stdout write, so the fix is semantically
+		 * neutral.
+		 */
+		'no-console-log': {
+			meta: { fixable: 'code' },
+			create(context) {
+				const ALLOWED = new Set(['info', 'warn', 'error', 'debug']);
+
+				return {
+					CallExpression(node) {
+						const callee = node.callee;
+						if (
+							callee.type !== 'MemberExpression' ||
+							callee.object.type !== 'Identifier' ||
+							callee.object.name !== 'console' ||
+							callee.property.type !== 'Identifier' ||
+							ALLOWED.has(callee.property.name)
+						) {
+							return;
+						}
+						const fixable = callee.property.name === 'log';
+						context.report({
+							node: callee.property,
+							message: fixable
+								? 'Use `console.info` instead of `console.log`.'
+								: `Unexpected \`console.${callee.property.name}\` — use console.info/warn/error/debug.`,
+							...(fixable ? { fix: (fixer) => fixer.replaceText(callee.property, 'info') } : {}),
+						});
+					},
+				};
+			},
+		},
+				};
+			},
+		},
+
 		/**
 		 * Disallow `throw new Error(...)` in favor of custom error classes.
 		 *

src/commands/lint.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { createFixture } from '../test-utils/index.ts';
-import { runOxlint, runKnip } from './lint.ts';
+import { runOxlint, runKnip, runKnipFix } from './lint.ts';
 import { fileURLToPath } from 'node:url';
 
 describe('lint command', () => {
@@ -83,6 +83,21 @@ describe('lint command', () => {
 				[],
 			);
 		});
+
+		it('auto-fixes console.log to console.info', async () => {
+			fixture = await createFixture({
+				src: {
+					'index.ts': 'console.log("hello");\nconsole.info("ok");\n',
+				},
+			});
+			process.chdir(fileURLToPath(fixture.root));
+
+			await runOxlint(['./src'], true);
+
+			expect(await fixture.text('src/index.ts')).toBe(
+				'console.info("hello");\nconsole.info("ok");\n',
+			);
+		});
 	});
 
 	describe('bombshell-dev/max-params', () => {
@@ -121,6 +136,33 @@ describe('lint command', () => {
 		});
 	});
 
+	describe('runKnipFix', () => {
+		it('removes unused dependencies from package.json', async () => {
+			fixture = await createFixture({
+				'package.json': {
+					name: 'test-pkg',
+					version: '1.0.0',
+					type: 'module',
+					exports: './src/index.ts',
+					dependencies: { 'left-pad': '^1.3.0' },
+				},
+				src: {
+					'index.ts': 'export const value = 42;\n',
+				},
+			});
+			process.chdir(fileURLToPath(fixture.root));
+
+			const before = await runKnip();
+			expect(before.some((v) => v.code === 'unused-dependency')).toBe(true);
+
+			await runKnipFix();
+
+			const pkg = (await fixture.json('package.json')) as { dependencies?: unknown };
+			expect(pkg.dependencies ?? {}).toEqual({});
+			expect(await runKnip()).toEqual([]);
+		});
+	});
+
 	describe('runKnip', () => {
 		const knipFixture = () =>
 			createFixture({

src/commands/lint.ts

@@ -102,12 +102,25 @@ export async function runOxlint(targets: string[], fix?: boolean): Promise<Viola
 		} catch {
 			// in some cases, failures or no-ops do not produce valid JSON
 			// fallback to raw output rather than throwing an error
-			console.log(result.stdout);
+			console.info(result.stdout);
 			return [];
 		}
 	});
 }
 
+/**
+ * Mechanically fix knip-reported issues. Dependency hygiene (removing unused
+ * deps from package.json) always runs with `--fix`; dead-code fixes (unused
+ * exports/types) only run in `--strict` mode, matching the report tiers.
+ * Unused files are never deleted automatically.
+ */
+export async function runKnipFix(strict?: boolean): Promise<void> {
+	const types = strict ? 'dependencies,exports,types' : 'dependencies';
+	await x(local('knip'), ['--fix', '--fix-type', types, '--no-progress'], {
+		throwOnError: false,
+	});
+}
+
 /**
  * Knip dead-code issue kinds (unused exports/types/files) fire constantly
  * mid-implementation — an export is "unused" until its consumer exists.
@@ -268,7 +281,6 @@ export function printViolations(violations: Violation[], options?: { warnings?:
 		const key = v.file ?? '(project)';
 		if (!grouped.has(key)) grouped.set(key, []);
 		grouped.get(key)!.push(v);
-	}
 
 	for (const [file, items] of grouped) {
 		console.log(`\n${file}`);
@@ -338,6 +350,7 @@ export async function lint(ctx: CommandContext) {
 
 	if (args.fix) {
 		await runOxlint(targets.length > 0 ? targets : ['.'], true);
+		await runKnipFix(args.strict);
 
 		// Report remaining
 		const remaining = await collectViolations(targets, { strict: args.strict });