* refactor: remove unused imports, variables and parameters
Remove the 110 bindings reported by no-unused-vars:
- 78 unused imports. Nine whole value-import statements disappear:
shadcn/ui input, tooltip, button and switch, MobileWebClipCapture,
AccountSecurityModal and @/lib/api in plugin-host. None of these
modules has top-level side effects beyond displayName assignments,
and @/lib/api is still imported by 60 other web modules. The other
removals are type-only imports or bindings from modules that stay
imported, so module evaluation is unchanged.
- Dead helpers: appendResourceMarkdown, handleTogglePin (mobile),
CheckCircleCheck, moveTargetTitle, moveTargetSelectRef,
handleMoveTargetSelectKeyDown (memo list), copiedLabel (share
dialog), and an unused palette and flowchart in the diagram editor.
- Component props that are passed but never read are dropped from the
destructuring only. Their prop types and call sites are unchanged,
so no caller changes behaviour.
- Tests: iterate Object.values() where keys were unused, and drop
unused fixture bindings and callback parameters.
* ci: enforce no-unused-vars in oxlint
Turn the rule on with the conventional escapes: names starting with an
underscore and rest siblings used to omit a property
(`({ id, ...item }) => item`) are allowed.
* refactor: resolve oxlint correctness findings without behavior changes
- Snapshot iterations that mutate their collection with Array.from()
instead of a spread (live childNodes, self-removing disposers, a Set
extended inside its own loop).
- Drop empty spread fallbacks, redundant regex escapes, Boolean() casts
inside negations, a rethrow-only try/catch and statement ternaries.
- Use startsWith/endsWith for anchored literal checks in the extension.
- List U+FE0F explicitly in the mobile attachment emoji class; the
matched set is unchanged.
- Fix the WeChat copy fixture, where \oint in a template literal lost its
backslash and the block formula never exercised \oint.
- Document the intentional control-character regexes (filename
sanitizing and input validation), the throwing provider stream test,
Astro's generated type reference and the mobile auto-sync finally
block with narrow inline exceptions.
* ci: run oxlint correctness rules on pull requests
Pin oxlint 1.88.0 and enable only its correctness category across apps/
and packages/, excluding build output, vendored code and the iOS app.
Findings are errors and the script passes --deny-warnings, so CI fails
on any finding. no-unused-vars stays off until unused code is removed
in a dedicated pass.
WorkBuddy 5.8+ ships only dist/codebuddy-lite-wb.mjs. Its loader picks that
bundle only with CODEBUDDY_FORCE_LITE_WB_BUNDLE=1, otherwise --acp requires the
removed dist/codebuddy and exits. A bare --acp in the lite-wb bundle also runs a
one-shot print session; stdio ACP is served only together with --serve.
When the lite-wb layout is detected, set the bundle variable and launch with
--acp --serve --acp-transport stdio. --serve also starts WorkBuddy's local
gateway, so pin it to loopback with --host 127.0.0.1 and SERVER__HOST, which
overrides an inherited SERVER__HOST; the port stays WorkBuddy's random default.
Older layouts keep the previous launch, and the login flow adds only --port
when the command already serves.
Fixes#584
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The packaged app is named @edgeever/desktop, so Electron stores userData at
<appData>/@edgeever/desktop. The reset guard only accepted a direct child of
appData and therefore always failed with unsafe-data-directory. Also accept a
single @scope/name directory while still rejecting other nested paths.
Fixes#583
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add table context menu with copy and paste
* fix(web): preserve native input and test table context menu regressions
* fix: harden table context actions and desktop clipboard
Track close separately from exit, preserve probe outcomes on cleanup errors, and cover inherited pipes and Windows cwd locks. Add cross-platform CI with the official Codex ACP process chain smoke check.
Refs #523
* fix(api): store LF line breaks for multipart image notes
multipart/form-data encodes line breaks in text fields as CRLF. Browsers
always do so, and Bun 1.4 now does as well, so notes created through
POST /api/v1/memos/with-image (used by the Web Clipper) were stored with
CRLF line breaks, while every other note uses LF. The route now normalizes
the Markdown field to LF before creating the note.
This also fixes the existing route contract test under Bun 1.4, and a new
test sends a CRLF multipart body like a browser does.
* test(desktop): make ACP host tests independent of the machine and Bun version
- The ACP command allow-list test checked that a missing command is not
installed, but on macOS the resolver also looks in /opt/homebrew/bin and
/usr/local/bin, so it failed on any machine with that command installed.
The test now only sees its temporary directory.
- The fake WorkBuddy agent started its account API without a port during
probes and chats. Bun 1.3 then listened on a random port, while Bun 1.4,
like Node, rejects port NaN, so six WorkBuddy session tests hung until
their timeout. Like WorkBuddy itself, the fake agent now serves the
account API only when started with a port.
Record sanitized request URLs, redirects, timing, HTTP errors and proxy resolution from the actual updater session. Include the trace in copyable update diagnostics. Refs #513
Handle asynchronous authentication identity notifications, reject missing credentials before prompting, and preserve sanitized adapter stderr. Document Claude gateway model mapping and add regression coverage for issue #531.
Remove the unused React Native Markdown renderer. Pin safe YAML, shell quoting, tar, and cache dependencies; upgrade npm within the 11 series and apply upstream fixes to its hidden bundled Undici and cache copies.
Add actual-consumer security regressions and an opt-in real npm/ACP upgrade verifier. Typechecks, Web build, Android APK/signature checks, and 2,997 tests passed (23 skipped). Real old-to-new npm installs, ACP initialize, rollback, restart, and fallback retention passed under the desktop Electron runtime.
Android USB-device validation and full desktop automatic-update release gates remain pending. Dependency audit is reduced from 85 to 74 unique advisories; this is not a complete security clearance.
Align editor, AI SDK, query, and Expo SDK 57 dependencies; pin floating versions and rebase the Mermaid and Android sharing patches. Refresh the standalone iOS editor bundle and migrate site content collections while preserving routes.
Validation: typechecks for Web/API, Android, and iOS editor; Web, site, iOS editor, Worker, Docker server, extension, and Android APK builds; 2,994 tests passed, 23 skipped. Built-in browser verified rich-text paste/undo and bilingual site navigation.
USB-device upgrade/data/share verification and desktop cross-version release gates remain pending. Remaining dependency audit advisories are not all resolved.
tianma-if