Enforce cognitive-complexity limit everywhere; narrow scripts biome override

[stefan-burke]

Summary

Removes biome overrides that let parts of the codebase off the hook, and refactors the code that then failed to lint.

Changes

biome.json

• Replaced the blanket scripts/**/*.ts override (which disabled noExcessiveCognitiveComplexity, noAssignInExpressions, noConsole, and noImplicitAnyLet) with one that only keeps noConsole off — console output is intentional in CLI/build/test scripts. (noAssignInExpressions and noImplicitAnyLet are off at the top level, so they remain off everywhere; this override no longer redundantly re-disables them.)
• Removed the test/** override that raised noExcessiveCognitiveComplexity to max 30. Tests now use the base max of 15.

Net effect: noExcessiveCognitiveComplexity (max 15) is now enforced across src, test, and scripts with no exceptions.

Refactors — 20 functions that exceeded complexity 15 were refactored by extracting well-named helpers and flattening nested conditionals, preserving exact behavior:

• scripts/: compact-test-reporter.ts, mutation.ts, mutation/isolation.ts, mutation/runner.ts, safe-upgrade.ts (×2), stripe-mock.ts
• test/: code-quality/detectors.ts (×5), checkout-pricing-consistency.test.ts, code-quality.test.ts, db/migration-restore/helpers.ts, fold-tree.test.ts, i18n-coverage.test.ts, square/client.test.ts, shared/bunny-db.test.ts, test-utils/fake-dom.ts

Verification

• deno task lint:ci — 1919 files, no errors/warnings.
• deno check over the src/test/cli gate — passes.
• Refactored test files run green.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Tightened lint enforcement for suspicious/typing checks and adjusted rule coverage for test and script files.
• Refactor
  • Improved mutation-run supervision and mutant evaluation, refined CLI argument parsing, and reorganized safe-upgrade execution.
  • Streamlined stripe-mock startup/retry behavior and TAP diagnostic parsing.
• Tests
  • Strengthened property tests with deterministic generation.
  • Enhanced code-quality scanning/tokenization utilities, database restore assertions, and other test helper ergonomics.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 96fe2488-4617-4c86-9595-86bff2149d5a

📥 Commits

Reviewing files that changed from the base of the PR and between 32204ad and 055eb23.

📒 Files selected for processing (1)

• TODO.md

---

📝 Walkthrough

Walkthrough

The pull request refactors scripts, mutation execution, test utilities, and code-quality detectors into focused helpers, tightens Biome lint enforcement, and replaces selected assignment expressions with explicit operations while preserving existing behavior.

Changes

Script and source refactoring

Layer / File(s)	Summary
Lint configuration and source cleanup biome.json, src/features/..., src/ui/..., test/test-utils/test-browser.ts	Biome enables additional suspicious rules, while selected source and test code replaces assignment expressions or adds explicit typing.
Diagnostic and CLI parsing helpers scripts/compact-test-reporter.ts, scripts/mutation.ts	YAML diagnostic parsing and mutation CLI argument validation are split into dedicated helpers.
Mutation execution lifecycle scripts/mutation/isolation.ts, scripts/mutation/runner.ts	Mutation supervision, baseline handling, mutant evaluation, progress reporting, and ignore-list checks are extracted into focused functions.
Script workflow refactors scripts/safe-upgrade.ts, scripts/stripe-mock.ts	Upgrade parsing, registry fetching, reporting, Stripe-mock startup, and retry handling are modularized.
Test helper and generator refactors test/lib/checkout-pricing-consistency.test.ts, test/lib/db/..., test/lib/fold-tree.test.ts, test/lib/i18n-coverage.test.ts, test/lib/square/client.test.ts, test/shared/bunny-db.test.ts, test/test-utils/fake-dom.ts	Shared generators, assertions, mock responses, selector matching, schema checks, and scan helpers replace repeated inline logic.
Code-quality scanning and detector refactors test/lib/code-quality.test.ts, test/lib/code-quality/detectors.ts, TODO.md	Line scanning and tokenizer/type-shape parsing are decomposed into reusable helpers, with follow-up gaps documented.

Estimated code review effort: 4 (Complex) | ~45 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 22.22% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: enforcing cognitive-complexity limits broadly and tightening the scripts Biome override.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/biome-ts-scripts-exclusion-jp4auc

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f01ab5c26a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 7

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/mutation.ts`:
- Around line 81-95: Update applyArg so recognized VALUE_FLAGS entries without a
following token immediately raise a clear CLI usage error instead of being added
to positional. Preserve consuming and returning true when a value is present,
and ensure missing values for flags such as --timeout, --jobs, --source, and
--test fail fast consistently.

In `@scripts/safe-upgrade.ts`:
- Around line 270-287: Document the invariant at the non-null assertion in
printUpgrades: add a concise comment explaining that checkUpgrade sets
newVersion and newPublishedAt together and upgrades is filtered by non-null
newVersion, so newPublishedAt is guaranteed present. Keep the existing non-null
assertion and avoid adding a defensive branch.

In `@test/lib/checkout-pricing-consistency.test.ts`:
- Line 158: In the modifier-generation loop, sample rng.randInt(0, 4) once
before the loop and store it in a local count variable, then iterate against
that variable instead of calling rng.randInt repeatedly in the loop condition.
- Around line 113-114: Update the Rng.pick signature and the corresponding
makeRng implementation to accept readonly T[] instead of mutable T[], allowing
as const tuples to type-check while preserving existing behavior.

In `@test/lib/code-quality/detectors.ts`:
- Around line 426-439: The template substitution scanner in
skipTemplateSubstitution must ignore comment contents while tracking brace
depth. Extend its scan to skip line and block comments, then add a direct
regression test for a substitution containing `}` in a comment followed by a
nested template such as `${/* } */ `x,y`}`, verifying parseArgList does not
misinterpret the comma.
- Around line 779-789: Update skipTypeParams to use the existing angleDepthDelta
helper when adjusting angle-bracket depth, so the > in an arrow token (=>) is
not treated as the closing type-parameter delimiter; preserve returning
immediately after depth reaches zero and verify parseTypeAliasBody recognizes
aliases such as type A<T = () => void>.

In `@test/lib/fold-tree.test.ts`:
- Around line 65-77: The fold outcome validation must verify that rejected folds
preserve the quantity from before the fold, not merely differ from the attempted
running total. Update the fold test flow around foldChild and foldOutcomeValid
to capture the pre-fold recorded quantity, pass it into the validator, and
assert exact equality for rejected outcomes while retaining the accepted-case
checks.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 73bac0bc-b53b-4729-af06-500db9171533

📥 Commits

Reviewing files that changed from the base of the PR and between f01ab5c and dd6c1af.

📒 Files selected for processing (16)

• biome.json
• scripts/compact-test-reporter.ts
• scripts/mutation.ts
• scripts/mutation/isolation.ts
• scripts/mutation/runner.ts
• scripts/safe-upgrade.ts
• scripts/stripe-mock.ts
• test/lib/checkout-pricing-consistency.test.ts
• test/lib/code-quality.test.ts
• test/lib/code-quality/detectors.ts
• test/lib/db/migration-restore/helpers.ts
• test/lib/fold-tree.test.ts
• test/lib/i18n-coverage.test.ts
• test/lib/square/client.test.ts
• test/shared/bunny-db.test.ts
• test/test-utils/fake-dom.ts

💤 Files with no reviewable changes (1)

• biome.json

[stefan-burke]

Thanks for the review. Disposition of the 7 comments (this PR's refactors were required to preserve existing behavior, which frames several of these):

Applied:

• checkout-pricing Rng.pick → readonly T[] (widened, harmless).
• safe-upgrade printUpgrades — documented the newPublishedAt! invariant.

Skipped (behavior-preserving — same as pre-PR main, not introduced here):

• mutation.ts applyArg value-flag-without-token → positional: main's original parseArgs used arg === "--source" && next !== undefined, so a missing value already fell through to positional. Fail-fast would be a behavior change beyond this PR's scope.
• checkout-pricing randInt(0, 4) re-evaluated in the loop condition: identical to main (for (let m = 0; m < randInt(0, 4); m++)). Sampling once would change the seeded PRNG sequence and the cases the property test exercises.

Skipped (would regress CI):

• detectors.ts skipTypeParams → reuse angleDepthDelta: the suggested form reintroduces an uncovered return i fall-through, which fails this repo's 100% line/branch coverage gate. Current behavior matches main's original (neither special-cased => in a type-param default), and no such alias exists in the scanned corpus.

Skipped (pre-existing edge case, out of scope):

• detectors.ts skipTemplateSubstitution not skipping comments containing }: this logic is unchanged from main; it's a latent edge case unrelated to the complexity refactor and would need its own regression test.
• fold-tree asserting the exact pre-fold quantity: a test-strengthening beyond the refactor's scope.

Happy to open a follow-up for the fail-fast / comment-aware-tokenizer improvements if you'd like them tracked separately.

---

Generated by Claude Code

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/compact-test-reporter.ts`:
- Around line 140-163: Refactor assignAtField to use a typed Record-based
key-to-handler dispatch, matching the VALUE_FLAGS pattern, with handlers for
file, line, and column that perform the existing assignments and numeric
conversions. Type the key or dispatch access so TypeScript enforces all
supported fields, while preserving current behavior for unknown keys.

In `@scripts/stripe-mock.ts`:
- Around line 307-325: Preserve the first meaningful startup error in
startStripeMock by updating lastStartupError only when result.error is
non-empty, so later retry results with empty errors cannot overwrite accumulated
stderr.

In `@test/lib/checkout-pricing-consistency.test.ts`:
- Around line 119-125: Update the `rand` helper so its returned value is always
strictly less than 1, including when `seed` equals `0x7fffffff`; adjust the
normalization or clamp the result before `pick` and `randInt` consume it. Verify
`pick` cannot select beyond the array and `randInt` never exceeds `hi`.

In `@test/lib/code-quality.test.ts`:
- Around line 401-414: Add a concise comment immediately before
contents.get(file)! in collectLineViolations explaining that ensureLoaded()
populates contents using the same files list, so every requested file is
guaranteed to be present; retain the non-null assertion.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c054351e-20cf-49e0-ab21-b71e53e23ea7

📥 Commits

Reviewing files that changed from the base of the PR and between dd6c1af and 2c0e70f.

📒 Files selected for processing (22)

• biome.json
• scripts/compact-test-reporter.ts
• scripts/mutation.ts
• scripts/mutation/isolation.ts
• scripts/mutation/runner.ts
• scripts/safe-upgrade.ts
• scripts/stripe-mock.ts
• src/features/admin/index.ts
• src/features/api/payment-processing/index.ts
• src/features/public/ticket-form.ts
• src/ui/client/admin/markdown-preview.ts
• src/ui/client/order.ts
• test/lib/checkout-pricing-consistency.test.ts
• test/lib/code-quality.test.ts
• test/lib/code-quality/detectors.ts
• test/lib/db/migration-restore/helpers.ts
• test/lib/fold-tree.test.ts
• test/lib/i18n-coverage.test.ts
• test/lib/square/client.test.ts
• test/shared/bunny-db.test.ts
• test/test-utils/fake-dom.ts
• test/test-utils/test-browser.ts

[stefan-burke]

Applied 3 of 4 in 565ef70:

• compact-test-reporter — assignAtField now uses a typed Record dispatch (matches the VALUE_FLAGS pattern / coding guideline).
• stripe-mock — only overwrite lastStartupError with a non-empty error, so a later empty retry can't drop the first meaningful stderr.
• code-quality.test — documented why contents.get(file)! is safe.

Skipped: the rand() seed / 0x7fffffff "can return 1" point. It's identical to main (pre-existing, not introduced by this refactor), and changing the divisor would alter the seeded PRNG sequence — i.e. change which cases the property test explores. Given the vanishing probability (one specific 31-bit seed value) and that it's out of scope for this PR, I've left it as-is rather than silently shift the deterministic corpus. Happy to fix it in a dedicated follow-up if you'd like it tracked.

---

Generated by Claude Code