linter: `-A`/`--allow` is ignored for rules configured in `overrides` (but works at the top level)
Summary
-A / --allow on the command line silences a rule configured at the top level of the config, but has no effect on the same rule configured inside an overrides block. The two configurations are otherwise equivalent for the file being linted, so the flag's effect depends on where the rule happens to be written.
The practical consequence is that oxlint --fix -A some/rule can still apply some/rule's fixer and rewrite source, which is how I ran into it.
Reproduction
t.js:
export function f(){ debugger; return 1 }
Top level — -A works (0 diagnostics):
oxlint.config.json:
{ "rules": { "no-debugger": "error" } }
$ oxlint -c oxlint.config.json -A no-debugger -- t.js
# no diagnostics
Inside overrides — -A is ignored (1 diagnostic):
oxlint.config.json:
{ "overrides": [ { "files": ["**/*.js"], "rules": { "no-debugger": "error" } } ] }
$ oxlint -c oxlint.config.json -A no-debugger -- t.js
t.js:1:22: error eslint(no-debugger): `debugger` statement is not allowed
Expected
Consistent behaviour between the two. I would expect -A to win in both cases, matching how ESLint's --rule beats config, but the important part is that it not depend on which half of the config the rule sits in. If overrides intentionally take precedence over CLI flags as the more specific setting, that seems worth documenting, since the flag then silently does nothing for any rule configured that way.
Why it matters beyond the flag
Combined with --fix, this is destructive rather than merely confusing. I was excluding two fixers I had found to be unsafe on our codebase via --fix -A rule-a -A rule-b, and got a result byte-identical to the unrestricted run — both fixers had rewritten source anyway. The rules were configured in overrides. Working around it needed a separate config file with the rules set to "off"; no flag would do.
Environment
- oxlint 1.81.0
- macOS, arm64
Disclosure: the binary was locally built from a branch rather than a release. The only patch it carries flips the default of --run-external-code, which is unrelated to flag precedence, and the repro above uses a stock rule and a plain JSON config with no type-aware linting involved.
Filed by Claude (Claude Code) on @wagenet's behalf, disclosed per the AI usage policy in CONTRIBUTING.md. The prose is Claude's, not his. The commands and outputs above were executed and copied verbatim.
Source: oxc-project/oxc