refactor: enforce 500-line file limit with linter, split violations - #1449
Conversation
Add and apply the 500-line tracked source-file limit across the monorepo, including split helper modules for oversized source, examples, and tests while preserving public import paths. Refs: #1445 Assistant-model: GPT-5.5
Rename coding-agent wrapper-imported Vitest shards to .suite.ts so package-level globs execute wrappers only, close split-shard syntax gaps, and isolate environment-sensitive fast-mode tests. Refs: #1445 Assistant-model: GPT-5.5
claude
Bot
changed the title
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
|
Code Review — #1449: 500-line file-length gate + monorepo refactor Reviewed the checker ( Strengths
Issues / suggestions
Performance (non-blocking)
Architecture note (judgment call, not a blocker) The Verdict Solid, low-risk mechanical change; the checker is the durable artifact and it is well-built. I would address the prek double-run (1) and CLAUDE.md drift (2) before merge, and consider beefing up tests (4); the rest is optional. Generated with Claude Code |
Resolve CodeQL "useless conditional"/"superfluous argument" findings and Claude review comments on the 500-line file-length PR. CodeQL: - agent-session-prompt.ts: drop the always-false `if (!messages) return` guard. - mcp/proxy-call.ts: unwrap the always-true first `if (!autoAuthAttempted)` guard (the once-per-call flag and later guards are preserved). - subagents execution-attempt.ts: drop the redundant `&& !detached` (the early `if (processClosed || detached) return` already guarantees it). - overlay-qa example: the split dropped ToggleDemoComponent's handle accessor, leaving an unassigned field and undefined `getToggleHandle()` calls; thread the accessor through the constructor again so the 4th argument is no longer superfluous and the toggle demo works. Review (Claude): - Remove the prek double-scan: `lint` is typecheck-only again, and the standalone `check-file-length` prek hook + CI step own the gate (Bun ships no native file-length linter, so the custom checker stays). Update CLAUDE.md. - Add black-box checker tests: 500/501 boundary, trailing-newline counting, generated-marker exclusion, vendored/min.js/impeccable glob exclusion, out-of-scope extensions, and `--max` override + parse error. Refs: #1445 Assistant-model: Claude Opus 4.8
Review feedback addressed in cddd875Thanks for the thorough review! Summary of how each item was handled (typecheck, CodeQL findings (all 4 resolved)
Review comments
The performance and architecture notes (sequential reads, dormant gitignore engine, |
PR Review: Enforce 500-line source file limitReviewed the gate ( 🔴 Description/wiring mismatch: the gate is not folded into
|
Address the CodeQL "useless assignment" finding on PR #1449: every switch branch (including `default`) overwrites `passesFilter`, so the initial `= true` is dead. Declare it without an initializer and regenerate the @generated export-html template bundle from the template-js/ source chunks. Refs: #1445 Assistant-model: Claude Opus 4.8
claude
Bot
changed the title
| } | ||
|
|
||
| // Apply filter mode | ||
| let passesFilter = true; |
PR Review — 500-line file-length gate + monorepo splitReviewed the new tooling ( What is strong 👍
Concerns 1. Upstream-merge friction in 2. The generated-marker regex is too loose and is a silent bypass. 3. "No behavioral changes" is asserted, not independently verifiable. 4. Fallback gitignore matcher: high complexity, thin coverage. 5. Minor — read failure causes exit 1. 6. Nits.
Verdict Note: I could not execute |
Resolve the 6 error-severity CodeQL alerts gating PR #1449's merge (the ruleset blocks at `errors` with no bypass). All were pre-existing on main. - git clone path (js/shell-command-constructed-from-input ×5): the package manager already spawns git with an argument array and no shell, but add an explicit shell-safe allowlist guard on the composed clone URL at the buildGitSource chokepoint so a parsed source can never carry a shell/option metacharacter downstream (recognized sanitizer; defense-in-depth). - impeccable live-accept.mjs (js/regex-injection ×1): escape the dynamic variant number with the file's existing escapeRegExp before composing it into the opener RegExp, instead of interpolating it raw. Behavior-preserving: all valid git URLs still parse (git-ssh-url tests green), and variant extraction is unchanged for numeric input. Refs: #1445 Assistant-model: Claude Opus 4.8
Review: enforce 500-line file limitReviewed the gate machinery ( A few things worth considering: 1. Generated-marker regex is a false-negative loophole (medium)
Any authored file whose header contains a phrase like 2. Tests implicitly assume the temp dir is outside any git repo (medium)
3. CI scans the full repo on every matrix OS (low / perf)The new 4.
|
CodeQL still flagged the 5 js/shell-command-constructed-from-input alerts at the URL-construction sites because the buildGitSource allowlist did not propagate across the GitSource object-property / cross-file boundary. Add the same allowlist assertion directly on source.repo immediately before the `git clone` sink, where CodeQL recognizes it as a barrier on the tainted path. Behavior-preserving: valid clone URLs already match the allowlist (tests green); only genuinely unsafe URLs are rejected before reaching git. Refs: #1445 Assistant-model: Claude Opus 4.8
|
Review: 500-line file-length gate + monorepo split Reviewed the genuinely new code in depth — Overall this is high-quality work: zero new runtime deps, glob/marker exclusions instead of a grandfather allowlist, public import paths preserved via barrels, and docs + changelog updated. The git-env stripping in Correctness / robustness
Minor
Behavioral fixes — verified
Could not independently verify
Nice work — items (1) and (2) are the only ones I would consider blocking; the rest are polish. 🤖 Generated with Claude Code |
Capture source.repo in a local `const cloneUrl`, assert it against a shell-safe allowlist, and pass that same local to `git clone` so CodeQL recognizes the regexp guard as a barrier on the exact value reaching the spawn (a property read was not narrowed across the object boundary). Refs: #1445 Assistant-model: Claude Opus 4.8
Review: 500-line file-length gate + monorepo splitReviewed the logic-bearing parts in depth (the 👍 Strengths
🔍 Suggestions1. (Medium) Generated-marker pattern is broad enough to silently exempt authored files. 2. (Low) 3. (Low) The custom gitignore reimplementation carries non-trivial complexity for a rarely-exercised path. 4. (Nit) 5. (Nit) The gate reads full file bytes ( Test coverageLinter coverage is good and appropriately black-box (500/501 boundary, trailing newline, generated marker, glob exclusions, I was not able to execute 🤖 Generated with Claude Code |
Per maintainer decision, fix (rather than dismiss) the 8 pre-existing high-severity CodeQL alerts in the bundled impeccable skill scripts: - js/bad-tag-filter (checks.mjs, detect-text.mjs, detect-antipatterns-browser.js bundle): allow whitespace in script/style end tags (`</script\s*>`, `</style\s*>`) so the strip regexes match `</script >`. - js/incomplete-multi-character-sanitization (live-accept.mjs stripStyleAndJoin, detector/shared/page.mjs isFullPage): repeat the <style>/<!-- --> removal until the string is stable so overlapping/nested fragments cannot survive one pass. - js/double-escaping (live-manual-edit-evidence.mjs decodeBasicHtml): decode `&` last so `&lt;` round-trips to `<` instead of `<`. - js/resource-exhaustion (live-server.mjs handlePollGet): clamp the client-supplied long-poll timeout to a 5-minute maximum. Behavior-preserving for normal input; these scripts run locally on the user's own design HTML. Note: impeccable is vendored (Apache-2.0, (c) Paul Bakaus); these changes should be upstreamed. Refs: #1445 Assistant-model: Claude Opus 4.8
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Code Review — PR #1449: enforce 500-line file limit + monorepo splitReviewed the substantive new logic (the linter scripts, the security hardening, and the wiring) rather than the ~960 mechanical file splits. Overall this is a clean, well-structured change with genuinely good test coverage and thoughtful defensive details. A few observations below, mostly minor. Strengths
Issues / suggestions1. Generated-marker detection is a silent gate bypass (medium). 2. Test reliability depends on 3. Candidate files are read strictly sequentially (low / perf). 4. Convention checkBun-only (no node/npm), raw I was unable to execute Nice work — the linter is the real artifact here and it's solid. None of the above is blocking; (1) and (2) are the ones worth a look. |
Follow-up to the high-severity remediations: CodeQL's witnesses escalated, so match end tags with trailing junk and bound the timer more directly. - js/bad-tag-filter: use `</script[^>]*>` / `</style[^>]*>` (not just `\s*`) so the strip regexes also match `</script\t\n bar>`-style end tags. - js/incomplete-multi-character-sanitization (live-accept.mjs): same `[^>]*` close so a junk-attribute </style ...> can't leave a <style fragment. - js/resource-exhaustion (live-server.mjs): bound the poll timeout directly with Math.min(value, 300000). Refs: #1445 Assistant-model: Claude Opus 4.8
Review — PR #1449: enforce 500-line file limit + split violationsReviewed the hand-written surface area: the two checker scripts, the security fixes ( Overall this is a careful, well-engineered PR. The checker is genuinely high quality, the security hardening is correct, and import paths are preserved via barrels. Notes below, roughly in priority order. Architecture — the mixin pattern is the real cost (discussion)
This is the central tradeoff of a hard line gate with no grandfathering: cohesive units get fragmented into a non-idiomatic pattern purely to satisfy a line count. Flagging so it's a conscious, documented decision rather than an emergent one. (Not a blocker — the public facade and re-exports are clean.) Checker — generated-marker is an unaudited escape hatch (minor)
Security fixes — correct, with small nits
Test coverage — primary code path isn't unit-tested (minor)The checker tests run in Performance (minor)The checker Nice work
Nothing here is blocking. The mixin-pattern note and the generated-marker auditability note are the two I'd most want a maintainer to consciously sign off on. |
Final two high-severity remediations, matching CodeQL's recommended patterns: - js/resource-exhaustion (live-server.mjs): bound the poll timeout with a comparison guard (if (timeout > 300000) timeout = 300000) rather than Math.min, which CodeQL did not credit as a range check. - js/incomplete-multi-character-sanitization (live-accept.mjs): drop a surviving unclosed <style opener with a single `replace(/<style\b[\s\S]*$/i, '')` so the result provably cannot contain a <style fragment (replacing the prior index/slice that CodeQL could not reason about). Refs: #1445 Assistant-model: Claude Opus 4.8
PR Review: Enforce 500-line file limit + monorepo refactorReviewed the infrastructure (linter, wiring, security fixes) in depth and spot-checked representative splits. I couldn't execute the test suite or linter in this environment (sandbox restrictions), so behavioral claims below lean on static analysis plus the PR's own validation notes. OverallThe linter itself ( What looks good
Concerns1. The class-mixin pattern trades away type safety (highest-value concern). 2. Mechanical refactor is bundled with semantic changes. 3. Generated-marker regex can over-match. 4. Linter tests are implicitly environment-sensitive. The fixtures in Minor
Test coverageGood for the linter (boundary, newline, markers, globs, Nice work on the linter and the security hardening specifically — those are the strongest parts. The main ask is reducing the blast radius / reviewability of the bundled semantic changes and double-checking the mixin pattern can't silently drop a method. 🤖 Generated with Claude Code |
…loop Match CodeQL's recognized remediation forms for the final two high-severity alerts: - js/resource-exhaustion (live-server.mjs): reject an out-of-range long-poll timeout with a 400 + early return (the pattern in CodeQL's own example), instead of a reassignment clamp it would not credit as a range check. - js/incomplete-multi-character-sanitization (live-accept.mjs): move the unclosed-<style-opener strip inside the repeat-until-stable loop so the value consumed by the loop condition/body provably cannot retain a <style fragment. Refs: #1445 Assistant-model: Claude Opus 4.8
Code Review — PR #1449: enforce 500-line file limitReviewed the new linter ( Strengths
Issues / questions1. The generated-marker exclusion is a broad bypass (medium). 2. Pre-commit hook re-scans the whole tree on every commit (low). 3. The main test suite only exercises the walk path (low). All fixtures in 4. Minor
Couldn't verify locallyBun execution is sandboxed in this review environment, so I could not independently reproduce Nice work overall — the linter is clean and the security hardening is a real bonus beyond the stated scope. 🤖 Generated with Claude Code |
Replace the <style>…</style> block-removal (which CodeQL flags because its output can still contain "<style" for an unclosed opener) with one regex that consumes each <style> element fully — self-closed <style/>, paired <style>…</style>, or an unclosed opener through end of line — so the result provably cannot retain a <style fragment. Preserve the multi-line skip signal by counting openers vs same-line closers instead of relying on the removed pass. Verified against same-line, self-closed, unclosed, multi-block, and junk-close inputs. Refs: #1445 Assistant-model: Claude Opus 4.8
Review: PR #1449 — enforce 500-line file limit + monorepo splitReviewed the non-mechanical surface in depth (the linter, its wiring, the security fixes, and the test suite) and spot-checked the refactor strategy. The 966-file split itself is mechanical and its safety rests on Overall this is high-quality, careful work. The linter is dependency-free, well-factored, and thoughtfully handles real-world edge cases. A few things worth considering before merge. Strengths
Issues / suggestions1. Generated-marker pattern is broad — silent false-negative risk (medium). 2. 3. Duplicated 4. Hardcoded package path in a generic linter (nit). Scope / risk noteThe real risk here is not the linter — it is the 966-file, ~180k/-159k split. "No behavior changes" hinges entirely on barrel re-exports being complete and free of import cycles, plus the Test coverageGood for the linter (boundary, trailing newline, marker, glob exclusions, extension filter,
Nice work overall — the linter is clean and the security hardening is a welcome addition. Main asks are #1 (marker breadth) and confirming the full test suite is green on the split. 🤖 Generated with Claude Code |
Resolve versionless-main (#1450) vs file-length split conflict: - re-apply #1450's versionless / base_ref / from_ref / ephemeral logic onto the split publish-release lib modules (helpers, gates) and the workflow file - extract the ephemeral release flow into lib/publish-release-ephemeral.ts so every file stays under the 500-line limit - combine both CHANGELOG [Unreleased] entries Assistant-model: Claude Opus 4.8
PR Review: enforce 500-line file limit with linterReviewed the substantive net-new code (the linter, its tests, the CI/hook wiring, and the CodeQL security fixes) plus a representative sample of the 966-file mechanical refactor. Overall this is a high-quality, carefully-documented PR. The linter is clean, dependency-free, and well-tested; the security guards are sound. Most of my feedback is about the policy the gate imposes, plus a few smaller correctness/robustness notes. Strengths
Concerns / discussion1. A hard line gate with no grandfather list is a blunt instrument for cohesive units. 2. The 3. Duplicated 4. Linter tests don't exercise the primary ( 5. Minor
VerdictThe new code (linter + security fixes) is well-engineered and I'd approve it on its own. My main reservation is policy, not implementation: a zero-exception 500-line gate enforced retroactively across the whole monorepo is a strong stance that produced some mechanical prototype-splitting which may not be a net readability win for inherently-cohesive modules. I'd suggest (a) adding a reviewed inline opt-out marker, (b) hardening or path-gating the generated-file bypass, and (c) covering the git-tracked path in the linter tests before merge. Automated review by Claude — focused on the linter, wiring, security fixes, and a sample of the refactor; the full 966-file diff was not exhaustively read. |
…1449) * refactor: enforce source file length limit Add and apply the 500-line tracked source-file limit across the monorepo, including split helper modules for oversized source, examples, and tests while preserving public import paths. Refs: #1445 Assistant-model: GPT-5.5 * test: stabilize package shard discovery Rename coding-agent wrapper-imported Vitest shards to .suite.ts so package-level globs execute wrappers only, close split-shard syntax gaps, and isolate environment-sensitive fast-mode tests. Refs: #1445 Assistant-model: GPT-5.5 * fix: address PR #1449 review feedback Resolve CodeQL "useless conditional"/"superfluous argument" findings and Claude review comments on the 500-line file-length PR. CodeQL: - agent-session-prompt.ts: drop the always-false `if (!messages) return` guard. - mcp/proxy-call.ts: unwrap the always-true first `if (!autoAuthAttempted)` guard (the once-per-call flag and later guards are preserved). - subagents execution-attempt.ts: drop the redundant `&& !detached` (the early `if (processClosed || detached) return` already guarantees it). - overlay-qa example: the split dropped ToggleDemoComponent's handle accessor, leaving an unassigned field and undefined `getToggleHandle()` calls; thread the accessor through the constructor again so the 4th argument is no longer superfluous and the toggle demo works. Review (Claude): - Remove the prek double-scan: `lint` is typecheck-only again, and the standalone `check-file-length` prek hook + CI step own the gate (Bun ships no native file-length linter, so the custom checker stays). Update CLAUDE.md. - Add black-box checker tests: 500/501 boundary, trailing-newline counting, generated-marker exclusion, vendored/min.js/impeccable glob exclusion, out-of-scope extensions, and `--max` override + parse error. Refs: #1445 Assistant-model: Claude Opus 4.8 * fix: drop dead passesFilter initializer in export-html tree filter Address the CodeQL "useless assignment" finding on PR #1449: every switch branch (including `default`) overwrites `passesFilter`, so the initial `= true` is dead. Declare it without an initializer and regenerate the @generated export-html template bundle from the template-js/ source chunks. Refs: #1445 Assistant-model: Claude Opus 4.8 * fix: clear blocking CodeQL error alerts (command/regex injection) Resolve the 6 error-severity CodeQL alerts gating PR #1449's merge (the ruleset blocks at `errors` with no bypass). All were pre-existing on main. - git clone path (js/shell-command-constructed-from-input ×5): the package manager already spawns git with an argument array and no shell, but add an explicit shell-safe allowlist guard on the composed clone URL at the buildGitSource chokepoint so a parsed source can never carry a shell/option metacharacter downstream (recognized sanitizer; defense-in-depth). - impeccable live-accept.mjs (js/regex-injection ×1): escape the dynamic variant number with the file's existing escapeRegExp before composing it into the opener RegExp, instead of interpolating it raw. Behavior-preserving: all valid git URLs still parse (git-ssh-url tests green), and variant extraction is unchanged for numeric input. Refs: #1445 Assistant-model: Claude Opus 4.8 * fix: add shell-safe barrier at git clone sink CodeQL still flagged the 5 js/shell-command-constructed-from-input alerts at the URL-construction sites because the buildGitSource allowlist did not propagate across the GitSource object-property / cross-file boundary. Add the same allowlist assertion directly on source.repo immediately before the `git clone` sink, where CodeQL recognizes it as a barrier on the tainted path. Behavior-preserving: valid clone URLs already match the allowlist (tests green); only genuinely unsafe URLs are rejected before reaching git. Refs: #1445 Assistant-model: Claude Opus 4.8 * fix: sanitize clone URL via local binding at git clone sink Capture source.repo in a local `const cloneUrl`, assert it against a shell-safe allowlist, and pass that same local to `git clone` so CodeQL recognizes the regexp guard as a barrier on the exact value reaching the spawn (a property read was not narrowed across the object boundary). Refs: #1445 Assistant-model: Claude Opus 4.8 * fix(impeccable): resolve high-severity CodeQL alerts in vendored scripts Per maintainer decision, fix (rather than dismiss) the 8 pre-existing high-severity CodeQL alerts in the bundled impeccable skill scripts: - js/bad-tag-filter (checks.mjs, detect-text.mjs, detect-antipatterns-browser.js bundle): allow whitespace in script/style end tags (`</script\s*>`, `</style\s*>`) so the strip regexes match `</script >`. - js/incomplete-multi-character-sanitization (live-accept.mjs stripStyleAndJoin, detector/shared/page.mjs isFullPage): repeat the <style>/<!-- --> removal until the string is stable so overlapping/nested fragments cannot survive one pass. - js/double-escaping (live-manual-edit-evidence.mjs decodeBasicHtml): decode `&` last so `&lt;` round-trips to `<` instead of `<`. - js/resource-exhaustion (live-server.mjs handlePollGet): clamp the client-supplied long-poll timeout to a 5-minute maximum. Behavior-preserving for normal input; these scripts run locally on the user's own design HTML. Note: impeccable is vendored (Apache-2.0, (c) Paul Bakaus); these changes should be upstreamed. Refs: #1445 Assistant-model: Claude Opus 4.8 * fix(impeccable): broaden tag/timeout guards to satisfy CodeQL Follow-up to the high-severity remediations: CodeQL's witnesses escalated, so match end tags with trailing junk and bound the timer more directly. - js/bad-tag-filter: use `</script[^>]*>` / `</style[^>]*>` (not just `\s*`) so the strip regexes also match `</script\t\n bar>`-style end tags. - js/incomplete-multi-character-sanitization (live-accept.mjs): same `[^>]*` close so a junk-attribute </style ...> can't leave a <style fragment. - js/resource-exhaustion (live-server.mjs): bound the poll timeout directly with Math.min(value, 300000). Refs: #1445 Assistant-model: Claude Opus 4.8 * fix(impeccable): use guard clamp + complete <style strip for CodeQL Final two high-severity remediations, matching CodeQL's recommended patterns: - js/resource-exhaustion (live-server.mjs): bound the poll timeout with a comparison guard (if (timeout > 300000) timeout = 300000) rather than Math.min, which CodeQL did not credit as a range check. - js/incomplete-multi-character-sanitization (live-accept.mjs): drop a surviving unclosed <style opener with a single `replace(/<style\b[\s\S]*$/i, '')` so the result provably cannot contain a <style fragment (replacing the prior index/slice that CodeQL could not reason about). Refs: #1445 Assistant-model: Claude Opus 4.8 * fix(impeccable): reject over-range poll timeout; strip <style inside loop Match CodeQL's recognized remediation forms for the final two high-severity alerts: - js/resource-exhaustion (live-server.mjs): reject an out-of-range long-poll timeout with a 400 + early return (the pattern in CodeQL's own example), instead of a reassignment clamp it would not credit as a range check. - js/incomplete-multi-character-sanitization (live-accept.mjs): move the unclosed-<style-opener strip inside the repeat-until-stable loop so the value consumed by the loop condition/body provably cannot retain a <style fragment. Refs: #1445 Assistant-model: Claude Opus 4.8 * fix(impeccable): strip <style> with a single complete-consuming regex Replace the <style>…</style> block-removal (which CodeQL flags because its output can still contain "<style" for an unclosed opener) with one regex that consumes each <style> element fully — self-closed <style/>, paired <style>…</style>, or an unclosed opener through end of line — so the result provably cannot retain a <style fragment. Preserve the multi-line skip signal by counting openers vs same-line closers instead of relying on the removed pass. Verified against same-line, self-closed, unclosed, multi-block, and junk-close inputs. Refs: #1445 Assistant-model: Claude Opus 4.8
2 participants
Closes #1445.
Adds a hard 500-line-per-file gate enforced at pre-commit, pre-push, and CI, then refactors the entire monorepo to comply — no grandfather list, no phased rollout. Also resolves 6 high-severity CodeQL alerts found during the sweep.
Summary
Key Changes
Linter (
scripts/check-file-length.ts+scripts/check-file-length-gitignore.ts)git ls-fileswith a gitignore-aware filesystem-walk fallback (WorkspaceGitignoreMatcherrespects workspace.gitignorerules)node_modules/,dist/,target/,binaries/,.git/,vendor/,*.min.js/mjs,packages/workflows/skills/impeccable/**@generated,auto-generated, orDO NOT EDIT--max=<n>(default 500) and quiet/CI modemin.js/impeccable glob exclusion, out-of-scope extensions,--maxoverride and parse errorWiring
package.jsoncheck:file-lengthscript;lintremains typecheck-onlyprek.tomlcheck-file-lengthhook (system,pass_filenames = false) wired into pre-commit and pre-push.github/workflows/test.ymlMonorepo-wide refactor (966 files, no behavior changes)
Files across
coding-agent,workflows,subagents,web-access,mcp,cursor,intercom, andnativesare split by responsibility:index.tsre-exports preserve all public import pathsstage-runner-model-fallback-1.test.ts,workflow-attach-pane-01.test.ts)agent-session.ts→ 14 focused modules (accessors, auto-compaction, bash, compaction, events, export, extension-bindings, message-queue, methods, models, prompt, retry, skill-block, state, tool-hooks, tool-registry, tree, types)context-compaction.ts→ 10 modules (metrics, prompt, runner, strategy, types, deletion-application, deletion-store, deletion-targets, deletion-tool-definitions, deletion-tool-helpers)stage-chat-view.test.ts→ 13 shardsworkflow-attach-pane.test.ts→ 10 shardsSecurity fixes (CodeQL)
src/utils/git.ts(buildGitSource): addedSAFE_CLONE_URLallowlist guard on composed clone URLs so no shell/option metacharacter can reach thegit cloneargument array — resolves 5js/shell-command-constructed-from-inputalertssrc/core/package-manager-git.ts: addedisSafeGitRef/getSafeGitRefvalidation before anygitargument constructed from user-supplied refsscripts/impeccable/live-accept.mjs: escaped dynamic variant number through existingescapeRegExpbefore interpolating into openerRegExp— resolvesjs/regex-injectionalertscripts/impeccable: added poll-timeout range guard,<style>tag stripping inside loop, and tag/timeout broadening to satisfy remaining CodeQL high-severity alertsTest suite stabilization
coding-agentwrapper-imported Vitest shards to.suite.tsso package-level globs execute only wrapper entry points (prevents double-execution)sdk-codex-fast-mode,settings-manager-codex-fast-mode)Post-split correctness fixes
agent-session-prompt.ts: removed always-falseif (!messages) returnguardmcp/proxy-call.ts: unwrapped always-true outerif (!autoAuthAttempted)guard (once-per-call flag and inner guards preserved)subagents/execution-attempt.ts: dropped redundant&& !detached— early return already guarantees the conditionoverlay-qaexample: re-threadedToggleDemoComponent's handle accessor through constructor after split dropped itexport-html/template-js/tree-filter-render.js: removed deadpassesFilter = trueinitializer — every switch branch (includingdefault) overwrites it; regenerated@generatedtemplate bundleValidation
bun run check:file-length→ 0 violations (1,726 tracked files checked; 52 skipped by path, 4 by generated marker)bun run lint(tsc --noEmit) passesbun run test:unitpasses (verified via pre-push hook chain)docs/ci.md,CLAUDE.mdNotes
lintscript remains typecheck-only