Replace tsc with oxlint --type-check for unified linting & type-checking - #17
Merged
Conversation
- pnpm up --latest within the 7-day age gate (Babel 8, vite 8.1.5, wrangler 4.112, Sentry 10.66, hono 4.12.31, oxlint 1.74, oxfmt 0.59, @hono/zod-validator 0.9, and friends); build verified. - Drop the expired typescript age-gate exclusion; whitelist oxlint-tsgolint (+ platform binaries) per explicit approval. - Enable options.typeAware in .oxlintrc.json — stable as of 2026-07-22, adds 59 typescript-eslint type-aware rules at ~3.5s for the repo. no-unsafe-type-assertion is off (14 hits, all stylistic). - Fix everything the new rules caught: 4 floating promises (unhandled router.navigate/invalidateQueries), inconsistent returns in effects and auth middleware, unnecessary assertions/conversions. - post-edit hook: fall back to pnpm when the `pn` alias is absent (remote containers); fix useMemo(fn, []) form for react-compiler. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JdivZT1wymu1zuyiVJCXK3
Server (security/bugs review): - MAX_BATCH_IDS 100→90 (+ client DataLoader maxBatchSize) so full batches stay under D1's 100-bound-parameter cap; limit params now require integers (2.5 previously 500'd at SQLite). - syncRoles no longer bumps last_synced_at, which was permanently starving the 30-day profile-staleness refresh for logged-in users. - Sentry beforeSend scrubs lowercase cookie/authorization (the capitalized deletes were a no-op against SDK-normalized headers). - Aggregate integrity check now also verifies user_emoji_counts. - buzzkill documented as a soft limit under concurrent deliveries. Client (bugs review): - Season selector off-by-one: first season derived with the July boundary rule (new shared seasonOf helper). - Season/interval filters lifted to _authed so visiting parrots or members no longer resets them. - Login redirect hardened to same-origin paths and preserved for already-authed visitors and mid-session expiry. - Admin settings form re-keys on background refetch; role-override mutation also invalidates ["me"]; CircuitField redraws after resize under reduced motion; vaporwave textures disposed on unmount; mobile interval select only shows on the trends tab where it has effect. Theme (per DESIGN.md, audit-driven): - Tokens: type scale (--text-label/small/h3/h2/display), density (--pad/--row-gap), --press-offset (loud-only button press), brand-press + font-display bridged into @theme, `label` and `scrollbar-none` utilities, `loud:` custom variant. - Fixed light-theme bugs (chart stroke-white, text-main heading, leaderboard hover) and mood leaks (fixed border-2/rounded-lg/ shadow-xl now token-driven; calm buttons no longer jump). - Avatar fallback matches spec (brand→warn gradient, initials). - DESIGN.md: token→utility naming table, documented new tokens. DX (organization/comments review): - day/week/month union consolidated as PERIODS in @shared (zod enum, Period, ChartInterval all derive); one CHART_PALETTE constant replaces two drifted copies; text-danger standardized. - scripts/sync-emojis.ts imports slackApi instead of duplicating the retry helper; dead exports removed (toSqliteTimestamp, canEditSettings, canViewReactions, unused validation/reconcile exports, unused auth-client re-exports). - Avatar/GlowingText moved to components/ui per the three-tier rule. - Stale comments fixed (hourly→daily cron, dead backfill references, filled-in TODO); doc rot fixed (DEPLOY.md backfill section, CLAUDE.md→PLAN.md pointer, plan 03 path). - mise typecheck depends on generate:types (fresh-clone DX). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JdivZT1wymu1zuyiVJCXK3
One command now covers lint, type-aware rules, and full TS diagnostics for both tsconfig projects (verified: injected type errors in src/ and scripts/ are both caught). verify drops its separate lint step since typecheck subsumes it; the post-edit hook likewise collapses its parallel oxlint+tsc pair into a single oxlint --type-check run. typescript stays as a devDependency for the editor/tsserver and codegen tooling. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JdivZT1wymu1zuyiVJCXK3
Re-enabled as a warning (--deny-warnings makes it enforce) instead of the blanket off: the rule catches casts that can mask real type errors. Fixes at each site rather than suppressions: - New isOneOf type guard narrows Select/Tabs string values properly (chart interval, chart tab, admin role override) — bad values are now ignored instead of blindly cast. - DevLoginPanel narrows the error payload from unknown instead of asserting a shape. - auth.ts reads the Slack team_id claim through Record<string, unknown> instead of asserting the whole SlackProfile. - slack/api.ts goes through unknown so both tsconfig programs agree. Three justified inline disables remain, each with a reason: the Slack response generic (ok/error runtime-checked), hono's typed ok-branch body, and the env-less CLI schema-generation placeholder binding. The shadcn primitives dir keeps the rule off alongside its existing relaxations. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JdivZT1wymu1zuyiVJCXK3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates type-checking and linting into a single
oxlint --type-checkcommand (via the newoxlint-tsgolintplugin), replacing the paralleloxlint+tscworkflow. This simplifies the toolchain, reduces CI/local feedback latency, and unifies diagnostics under one tool.Key changes
.claude/hooks/post-edit.sh): Replaced paralleloxlint+tscwith singleoxlint --type-check --deny-warningscall covering both app and scripts projectspackage.json):typechecknow runsoxlint --deny-warnings --type-checkinstead of dualtscinvocationsoxlint-tsgolint@^7.0.2001(type-aware oxlint plugin); upgradedoxlintto^1.74.0; removed directtscdependency from typecheck flow.oxlintrc.json): EnabledtypeAware: trueoption to activate type-aware rulesmise.toml): Updatedtypechecktask description and addedgenerate:typesdependency (ensuresworker-configuration.d.tsexists before type-checking)docs/DEPLOY.md,DESIGN.md): Updated references to reflect singleoxlint --type-checkcommand instead of separate lint/tsc stepspnpm-workspace.yaml): Approvedoxlint-tsgolint@7.0.2001past the 7-day release gate (paired with TypeScript 7.0.2)Implementation details
pnalias fallback added for remote/CI containers that havepnpmbut not thepnshorthandhttps://claude.ai/code/session_01JdivZT1wymu1zuyiVJCXK3