chore: modernize validation feedback loops

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   validate:
-    name: Validate and prepare hosts
+    name: Format, lint, typecheck, test, and prepare hosts
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -33,8 +33,26 @@ jobs:
       - name: Install locked dependencies
         run: mise run setup
 
-      - name: Validate repository
-        run: mise run validate
+      - name: Check formatting
+        run: mise run format:check
+
+      - name: Lint code, CSS, and Markdown
+        run: mise run lint
+
+      - name: Typecheck all TypeScript projects
+        run: mise run typecheck
+
+      - name: Run Node contract tests
+        run: mise run test:contracts
+
+      - name: Run unit tests with coverage
+        run: mise run test:coverage
+
+      - name: Validate package contents
+        run: mise run package:validate
+
+      - name: Validate GitHub Actions workflows
+        run: mise run ci:workflows
 
       - name: Build host test runners
         run: mise run test:host-runners:build

.oxfmtrc.json

@@ -0,0 +1,21 @@
+{
+	"$schema": "./node_modules/oxfmt/configuration_schema.json",
+	"ignorePatterns": [
+		".vscode-test/**",
+		".vscode-test-web/**",
+		"artifacts/**",
+		"coverage/**",
+		"dist/**",
+		"docs/plans/**",
+		"mise.lock",
+		"mise.toml",
+		"node_modules/**",
+		"out/**",
+		"pnpm-lock.yaml"
+	],
+	"printWidth": 80,
+	"singleQuote": true,
+	"sortPackageJson": false,
+	"trailingComma": "all",
+	"useTabs": true
+}

.oxlintrc.json

@@ -0,0 +1,30 @@
+{
+	"$schema": "./node_modules/oxlint/configuration_schema.json",
+	"categories": {
+		"correctness": "error"
+	},
+	"env": {
+		"browser": true,
+		"mocha": true,
+		"node": true,
+		"vitest": true
+	},
+	"ignorePatterns": [
+		".vscode-test/**",
+		".vscode-test-web/**",
+		"artifacts/**",
+		"coverage/**",
+		"dist/**",
+		"node_modules/**",
+		"out/**"
+	],
+	"rules": {
+		"curly": "error",
+		"eqeqeq": "error",
+		"no-throw-literal": "error",
+		"typescript/await-thenable": "error",
+		"typescript/no-floating-promises": "error",
+		"typescript/no-misused-promises": "error",
+		"typescript/only-throw-error": "error"
+	}
+}

.vscode/extensions.json

@@ -2,11 +2,11 @@
 	// See http://go.microsoft.com/fwlink/?LinkId=827846
 	// for the documentation about the extensions.json format
 	"recommendations": [
-		"dbaeumer.vscode-eslint",
 		"connor4312.esbuild-problem-matchers",
-		"esbenp.prettier-vscode",
 		"ms-vscode.extension-test-runner",
 		"hverlin.mise-vscode",
+		"oxc.oxc-vscode",
+		"stylelint.vscode-stylelint",
 		"swellaby.workspace-config-plus"
 	]
 }

.vscode/settings.shared.json

@@ -2,23 +2,28 @@
 {
 	"editor.formatOnSave": true,
 	"editor.codeActionsOnSave": {
-		"source.fixAll.eslint": "explicit"
+		"source.fixAll.oxc": "explicit"
 	},
+	"oxc.typeAware": true,
 	"[javascript]": {
-		"editor.defaultFormatter": "esbenp.prettier-vscode"
+		"editor.defaultFormatter": "oxc.oxc-vscode"
 	},
 	"[typescript]": {
-		"editor.defaultFormatter": "esbenp.prettier-vscode"
+		"editor.defaultFormatter": "oxc.oxc-vscode"
 	},
 	"[json]": {
-		"editor.defaultFormatter": "esbenp.prettier-vscode"
+		"editor.defaultFormatter": "oxc.oxc-vscode"
 	},
 	"[jsonc]": {
-		"editor.defaultFormatter": "esbenp.prettier-vscode"
+		"editor.defaultFormatter": "oxc.oxc-vscode"
 	},
 	"[markdown]": {
-		"editor.defaultFormatter": "esbenp.prettier-vscode"
+		"editor.defaultFormatter": "oxc.oxc-vscode"
 	},
+	"[css]": {
+		"editor.defaultFormatter": "oxc.oxc-vscode"
+	},
+	"stylelint.validate": ["css"],
 	"files.exclude": {
 		"artifacts": false,
 		"dist": false,

.vscode/tasks.json

@@ -1,5 +1,3 @@
-// See https://go.microsoft.com/fwlink/?LinkId=733558
-// for the documentation about the tasks.json format
 {
 	"version": "2.0.0",
 	"tasks": [

.vscodeignore

@@ -14,22 +14,23 @@ src/**
 test/**
 .npmrc
 .markdownlint-cli2.jsonc
-.prettierignore
-.prettierrc.json
+.oxfmtrc.json
+.oxlintrc.json
 AGENTS.md
 CLAUDE.md
 .gitignore
 .yarnrc
 esbuild.mts
+lefthook.yml
 mise.lock
 mise.toml
 pnpm-lock.yaml
 pnpm-workspace.yaml
 release.config.mjs
+stylelint.config.mjs
 vsc-extension-quickstart.md
 **/tsconfig.json
 **/tsconfig.*.json
-**/eslint.config.mts
 **/vitest.config.mts
 **/*.map
 **/*.ts

AGENTS.md

@@ -75,6 +75,18 @@ Better Markdown Preview extends VS Code's built-in Markdown preview. Read
   attributes such as `url(#id)` and ARIA ID references.
 - Use `mise run check` during implementation and `mise run verify` on the
   intended final head. Run focused tasks while iterating.
+- Oxlint's type-aware project discovery only associates files with the root
+  conventionally named `tsconfig.json`; keep its type-aware task scoped to that
+  product program. The four explicit TypeScript 7 projects remain the
+  authoritative full-repository typecheck.
+- TypeScript 7's default package export does not provide the legacy compiler
+  API. Keep repository tooling on CLI `tsc` invocations and parse strict JSON
+  directly instead of importing `typescript` for JSONC helpers.
+- Oxfmt owns source, configuration, documentation, and CSS formatting, but
+  `mise.toml` remains excluded because Taplo is the canonical TOML formatter.
+- Oxfmt exits with an error when every explicit path is ignored. Keep
+  Lefthook's staged-format exclusions aligned with `.oxfmtrc.json` so ignored
+  lockfiles and plan documents skip the job instead of blocking commits.
 
 ## Dependencies and Automation
 

README.md

@@ -120,6 +120,7 @@ are:
 - `mise run dev` watches the desktop, web, preview runtime, Mermaid, CSS, and
   TypeScript targets.
 - `mise run check` runs the fast formatter, linter, type, and unit gate.
+- `mise run lint` runs native and type-aware Oxlint, Stylelint, and Markdownlint.
 - `mise run test:coverage` enforces all-files V8 coverage floors.
 - `mise run test:desktop` exercises the engine floor and stable desktop hosts.
 - `mise run test:web:stable` exercises stable VS Code for the Web in Chromium

docs/testing.md

@@ -22,6 +22,21 @@ Use the narrowest task that proves the behavior under development:
   visibility, runner outputs, and workflow orchestration without publishing.
 - `mise run ci:workflows` validates workflow syntax, security, and action pins.
 
+Code quality has distinct, complementary owners. Oxlint runs fast native checks
+across every JavaScript and TypeScript file plus type-aware rules over the
+product program owned by the root `tsconfig.json`. TypeScript 7 remains the
+authoritative compiler gate for the product, desktop tests, web tests, and
+tooling projects. Stylelint checks CSS semantics; Oxfmt owns formatting for CSS,
+JavaScript, TypeScript, JSON, Markdown, and YAML, while Taplo remains the TOML
+formatter.
+
+`mise run setup` also installs Lefthook. Its read-only parallel pre-commit jobs
+check Oxfmt, Taplo, and lint only against matching staged files, then
+conditionally run the fast type-aware product lint, full TypeScript typecheck,
+unit suite, and Node contracts when relevant source, configuration, or
+dependency files are staged. Longer host and package checks remain explicit
+Mise and CI gates.
+
 `mise run check` is the fast handoff gate: formatting, lint, all TypeScript
 projects, Node contracts, and coverage. `mise run validate` adds the package and
 workflow contracts. `mise run verify` prepares one revision and then runs the
@@ -103,12 +118,12 @@ fixture and focused expectations only for accepted compatibility behavior.
 
 ## CI
 
-CI has one broad validation and preparation owner. It runs formatting, lint,
-strict product/desktop/web/tooling typechecks, Node contracts, all-files unit
-coverage, package inventory, and workflow policy once, then uploads `dist/` and
-`out/` for revision-bound host jobs. Desktop floor, desktop stable, and web
-stable jobs install only their runtime dependencies, download those prepared
-artifacts, and run their narrow compatibility consumer.
+CI has one broad validation and preparation owner with individually named
+formatting, lint, TypeScript, Node contract, unit coverage, package inventory,
+and workflow-policy steps, then uploads `dist/` and `out/` for revision-bound
+host jobs. Desktop floor, desktop stable, and web stable jobs install only their
+runtime dependencies, download those prepared artifacts, and run their narrow
+compatibility consumer.
 
 This gives clean-environment evidence for the pushed revision without running
 the complete repository gate in every host job.

lefthook.yml

@@ -0,0 +1,80 @@
+pre-commit:
+  parallel: true
+  jobs:
+    - name: check staged formatting
+      glob: '*.{css,html,js,json,jsonc,md,mjs,mts,ts,yaml,yml}'
+      exclude:
+        - '.vscode-test/**'
+        - '.vscode-test-web/**'
+        - 'artifacts/**'
+        - 'coverage/**'
+        - 'dist/**'
+        - 'docs/plans/**'
+        - 'mise.lock'
+        - 'mise.toml'
+        - 'node_modules/**'
+        - 'out/**'
+        - 'pnpm-lock.yaml'
+      run: pnpm exec oxfmt --check {staged_files}
+
+    - name: check staged TOML formatting
+      glob: 'mise.toml'
+      run: mise exec -- taplo format --check {staged_files}
+
+    - name: lint staged code
+      glob: '*.{js,mjs,mts,ts}'
+      run: pnpm exec oxlint --deny-warnings {staged_files}
+
+    - name: lint staged CSS
+      glob: '*.css'
+      run: pnpm exec stylelint {staged_files}
+
+    - name: lint staged Markdown
+      glob: '*.md'
+      run: pnpm exec markdownlint-cli2 --no-globs {staged_files}
+
+    - name: type-aware product lint
+      glob:
+        - '.oxlintrc.json'
+        - 'package.json'
+        - 'pnpm-lock.yaml'
+        - 'pnpm-workspace.yaml'
+        - 'src/*.{ts,mts}'
+        - 'src/**/*.{ts,mts}'
+        - 'tsconfig.json'
+      run: pnpm run lint:types
+
+    - name: typecheck TypeScript projects
+      glob:
+        - '*.{js,json,mjs,mts,ts}'
+        - 'pnpm-lock.yaml'
+        - 'pnpm-workspace.yaml'
+      run: pnpm run typecheck
+
+    - name: run unit tests
+      glob:
+        - 'package.json'
+        - 'pnpm-lock.yaml'
+        - 'pnpm-workspace.yaml'
+        - 'src/*.{ts,mts}'
+        - 'src/**/*.{ts,mts}'
+        - 'vitest.config.mts'
+      run: pnpm run test:unit
+
+    - name: run Node contract tests
+      glob:
+        - '.github/workflows/*.{yaml,yml}'
+        - '.oxfmtrc.json'
+        - '.vscode/tasks.json'
+        - 'CHANGELOG.md'
+        - 'esbuild.mts'
+        - 'lefthook.yml'
+        - 'media/preview.css'
+        - 'package.json'
+        - 'pnpm-lock.yaml'
+        - 'pnpm-workspace.yaml'
+        - 'scripts/*.{ts,mts}'
+        - 'scripts/**/*.{ts,mts}'
+        - 'test/*.{ts,mts}'
+        - 'test/**/*.{ts,mts}'
+      run: pnpm run test:contracts