ff436b0b96
chore: version packages ( #1570 )
2026-08-05 00:42:33 -07:00
d934bf6e3f
docs: remove outdated scan description
2026-08-05 00:39:25 -07:00
1d0e4d6ee9
fix(cli): clean up interactive terminal transitions ( #1582 )
2026-08-05 00:36:12 -07:00
0efadda676
fix(rule): preserve lifecycle synchronization semantics ( #1579 )
2026-08-04 23:54:24 -07:00
274bd39ae7
fix(cli): print cancellation footer once ( #1581 )
2026-08-04 22:39:18 -07:00
459c5d34dc
refactor(cli): remove legacy terminal renderer ( #1580 )
2026-08-04 19:16:34 -07:00
da0647e275
fix(cli): keep interactive scans in Ink ( #1578 )
...
Remove the legacy interactive renderer fallback by preserving scoped scan behavior in the Ink dashboard. Includes workspace dead-code ownership and degraded-baseline gate parity.
2026-08-04 16:45:51 -07:00
60e4d8e102
fix(cli): isolate interactive React runtime ( #1577 )
...
Bundle the Ink and React renderer so inspected projects cannot supply a missing or incompatible React runtime. Exercise the packed CLI in a real PTY against a React 18 fixture.
2026-08-04 15:01:08 -07:00
881ecfe674
fix: exclude setState updater callbacks from zustand-no-fresh-selector-result ( #1576 )
...
Resolve destructured Zustand imperative APIs by binding and property identity while preserving diagnostics for legitimate bound store hooks with API-like names.
2026-08-04 14:55:58 -07:00
bafef41699
RDFPFNFINAL fix benchmark rule precision and async ownership ( #1574 )
...
* chore: start hook diagnostic dedup
* chore: scaffold zod v4 subpath fix
* fix: repair benchmark rule precision
* fix: exclude repeated mount transitions
* fix(rules): require ownership guards to control clears
2026-08-04 14:15:17 -07:00
25dbf6d925
Fix parity regressions in effect ownership and parent sync ( #1573 )
2026-08-04 04:17:07 -07:00
212b8b4113
fix: harden CLI against Sentry crash clusters ( #1572 )
2026-08-04 03:37:33 -07:00
a7e0d1bf8c
test: stabilize cross-platform CI timing ( #1571 )
2026-08-04 02:43:01 -07:00
8b97fdcb40
perf: reduce heavy rule scan overhead ( #1569 )
2026-08-03 21:46:39 -07:00
dcfe06428d
chore: version packages ( #1548 )
2026-08-03 18:25:23 -07:00
c825c59550
Narrow AI training environment detection ( #948 )
...
* fix: narrow AI training environment detection
* fix: remove ambiguous AI training signals
---------
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 17:56:46 -07:00
f958625acb
chore: simplify cleanup architecture hot spots ( #1464 )
...
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 17:39:06 -07:00
4a107ea516
refactor: simplify duplicated rule and deslop internals ( #1066 )
...
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 17:38:42 -07:00
a34d6a159e
fix: cover LegendList content container rules ( #1038 )
...
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 17:38:05 -07:00
45e818a34b
fix: clean up config and telemetry drift ( #1023 )
...
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 17:37:34 -07:00
3acb41bad6
fix: align ESLint rule metadata ( #987 )
...
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 17:37:09 -07:00
3466fe11d7
perf: index effect cleanup analysis ( #1568 )
...
* perf: index effect cleanup analysis
* test: stabilize effect cleanup performance check
* test: support coarse CPU timers
2026-08-03 15:30:29 -07:00
45afa01cc2
refactor: remove stale scan plumbing ( #1565 )
...
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 14:21:14 -07:00
ba04952cb3
fix(cli): preserve scrollback during project selection ( #1566 )
2026-08-03 13:34:40 -07:00
afd60dbe69
fix(effect-needs-cleanup): prove effect-owned cleanup ( #1559 )
...
* fix(effect-needs-cleanup): handle returned identifiers for addEventListener/addListener
Fixes #1558 - Part 1
- Allow returning identifiers bound to addEventListener/addListener results as valid cleanup
- Recognize calling such identifiers (e.g., ) as cleanup
- This fixes false positives for React Native's NetInfo.addEventListener and similar APIs
Remaining work: helper function cleanup and array collection cleanup
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* docs: add changeset for addEventListener cleanup fix
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* fix(effect-needs-cleanup): prove resource ownership
* fix(effect-needs-cleanup): harden ownership proofs
* fix(effect-needs-cleanup): isolate deferred ownership
* fix(effect-needs-cleanup): prove deferred timer ownership
* fix(effect-needs-cleanup): narrow invocation owners
* fix(effect-needs-cleanup): track helper collection mutations
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 13:29:06 -07:00
48ec9a8020
fix(cli): keep large workspace scans responsive ( #1549 )
...
* fix: keep large workspace scans responsive
* fix: harden large workspace scans
* test: normalize workspace path on Windows
* fix: resolve workspace exclusions after root redirects
* fix: honor workspace scan boundaries
* fix: keep bounded workspace scans responsive
* fix: preserve dead-code reachability
* refactor: tighten workspace scan controls
* fix(cli): bound staged workspace scans
* fix: eliminate pathological large-file scans
* fix: handle incomplete and conflicted scans
* test: configure conflict merge identity
* perf: cache repeated module resolution probes
* fix(cli): show all incomplete scan warnings
* fix(core): preserve cooperative scan semantics
* perf(cli): streamline workspace scan startup
* perf(cli): harden large workspace scans
* fix(cli): keep scan progress inline
* fix(scan): correct workspace result completeness
* fix(cli): simplify live scan status
* fix(core): make scan deadlines opt-in
* fix(scan): preserve complete workspace results
* perf(scan): accelerate very large workspaces
* fix(scan): yield CPU to foreground work
* perf(scan): avoid unnecessary project indexing
* fix(cli): keep final report inline
* test(cli): stabilize terminal recording setup
* fix(core): honor scan deadline during index probe
* fix(core): skip lint after incomplete index probe
* fix(core): preserve scoped lint ownership
* fix(cli): restore project picker on cancellation
2026-08-03 04:59:45 -07:00
85e1052289
FPFNFIX82 Detect passive request-owner windows ( #1563 )
...
* feat: detect passively synchronized request owners
* fix: exclude contradictory request-owner paths
* fix: exclude mismatch-branch state updates
* fix(rule): cover passive owner branches
2026-08-03 03:31:34 -07:00
cc2862666b
feat: detect controlled selection focus effects ( #1562 )
2026-08-03 03:03:44 -07:00
44922d6782
FPFNFIX82 Fix form and fragment diagnostics ( #1561 )
...
* fix(rules): correct form and fragment diagnostics
* fix(rules): handle fragment review edge cases
* fix: handle document-top fragment links
* fix(a11y): parse ids from html tags only
* fix(a11y): resolve static fragment aliases
* fix(a11y): retain known fragment targets
* fix(a11y): tokenize html id attributes
* fix: preserve known fragment IDs in mixed spreads
* fix: preserve known fragment ID defaults
2026-08-03 03:03:00 -07:00
3a93a34beb
FPFNFIX82: prove effect cleanup ownership ( #1564 )
2026-08-02 23:39:53 -07:00
02e3188d4b
Add InstancedMesh rules for Three.js and R3F ( #1560 )
2026-08-02 23:01:55 -07:00
4e4740dde3
FPFNFIX82: ignore type-only parent-data references ( #1557 )
...
* fix(no-pass-data-to-parent): ignore type-only refs
* fix(no-pass-data-to-parent): preserve angle assertion flow
2026-08-02 21:49:56 -07:00
4c610803cb
FPFNFIX82: detect stale async request error clears ( #1556 )
...
* feat(rule): detect unowned async error clears
* fix(no-unowned-async-error-clear): require ownership guard
* fix(no-unowned-async-error-clear): preserve keyed component proof
2026-08-02 21:49:37 -07:00
37427c915c
fix(effect-needs-cleanup): recognize reconnect cleanup ( #1555 )
2026-08-02 21:49:15 -07:00
19f2148e00
FPFNFIX82 Fix CSS-reserved image dimensions ( #1550 )
...
* fix(rule): recognize CSS-reserved image layout
* fix(rule): scope static CSS image evidence
* fix(no-img-without-dimensions): compose CSS with classes
* fix(no-img-without-dimensions): parse layered CSS
* fix(no-img-without-dimensions): ignore interaction-only CSS
* fix(no-img-without-dimensions): expand selector functions
* fix(no-img-without-dimensions): parse CSS with Lightning CSS
* fix(no-img-without-dimensions): model flex axes
* test(evals): stabilize manifest verification timeout
* test(evals): reset manifest operation deadlines
* fix(no-img-without-dimensions): honor nested CSS cascade
* fix(no-img-without-dimensions): compose Tailwind with CSS
* fix(no-img-without-dimensions): resolve same-layer cascade
2026-08-02 21:48:52 -07:00
91ebe85fdc
FPFNFIX82 Fix symbol-only control names ( #1554 )
2026-08-02 17:30:49 -07:00
b02bc694f1
FPFNFIX82: RDFPFN82026: preserve mixed effect chains ( #1545 )
...
* fix(rules): detect mixed effect chains
* fix(no-effect-chain): preserve channel lifecycles
* fix(no-effect-chain): preserve external sync boundaries
* fix(no-effect-chain): ignore setter value helpers in cleanup
2026-08-02 07:48:32 -07:00
f7dbdfa399
FPFNFIX82: RDFPFN82026: exclude media latches from all-state resets ( #1547 )
...
* fix(rules): exclude media latches from all-state resets
* test(rules): retain editable reset finding
2026-08-02 03:27:12 -07:00
7f29ecaa32
FPFNFIX82: RDFPFN82026: recognize media failure latches ( #1546 )
...
* fix(rules): recognize media failure latches
* fix(rules): tighten media lifecycle proof
2026-08-02 03:14:02 -07:00
8a22de1263
fix(rules): ignore empty ref registries ( #1544 )
2026-08-02 03:13:59 -07:00
c3683a2850
feat(cli): make the interactive report the default ( #1542 )
...
Co-authored-by: Rayhan Noufal Arayilakath <me@rayhanadev.com >
2026-08-02 01:09:19 -07:00
0b673ccb76
chore: version packages ( #1462 )
2026-07-31 22:57:26 -07:00
5268cb4c5d
fix: [server-auth-actions] skip credential-establishing endpoints ( #1540 )
...
* fix(server-auth-actions): skip credential-establishing actions
The server-auth-actions rule now correctly skips server actions that
perform credential-establishing operations (signup, signin, OTP
verification, password reset) by detecting calls to auth SDK methods
like supabase.auth.signUp(), auth.signInWithPassword(), and
auth.verifyOtp().
These actions legitimately run for anonymous callers, so requiring
authentication would be incorrect. This resolves the documented false
positive where credential-establishing endpoints were incorrectly
flagged as unauthenticated privileged operations.
Closes #1538
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* test(server-auth-actions): cover credential SDK boundaries
* fix(server-auth-actions): verify auth provider receivers
* fix(server-auth-actions): require credential action intent
* fix(server-auth-actions): recognize direct auth namespaces
* fix(server-auth-actions): require leading credential intent
* fix(server-auth-actions): cover credential action aliases
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
Co-authored-by: Aiden Bai <aiden.bai05@gmail.com >
2026-07-31 21:01:31 -07:00
a9a1f40c8b
fix(effect-needs-cleanup): recognize Supabase channel cleanup ( #1541 )
...
* fix(effect-needs-cleanup): recognize removeChannel/removeAllChannels/dispose cleanup
- Add removeChannel and removeAllChannels to GLOBAL_RELEASE_METHOD_NAMES
- Add cleanup verbs to .on() paired release verbs for Supabase chains
- Add special case for .on() calls without handles in chains
- Add comprehensive unit tests for Supabase and Jitsi patterns
Fixes #1539
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* chore: add changeset for #1539 fix
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* refactor(rule): localize Supabase cleanup verbs
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
Co-authored-by: Aiden Bai <aiden.bai05@gmail.com >
2026-07-31 20:50:25 -07:00
19387631f2
fix(rule): resolve useCallback pointer capture handlers ( #1524 )
2026-07-31 20:27:27 -07:00
992205a31b
fix(rule): detect default clobbers reaching JSX ( #1526 )
2026-07-31 17:12:25 -07:00
9418a1c01f
RDFPFN792026: recognize external effect synchronization ( #1523 )
...
* fix: recognize external effect synchronization
* test: preserve mixed deferred effect work
2026-07-31 17:12:09 -07:00
b479d7d777
RDFPFN792026: prove ref-owned timer cleanup ( #1522 )
...
* fix(rule): prove ref-owned timer cleanup
* fix(rule): preserve local resource cleanup aliases
* fix(rule): prove socket owner listener cleanup
2026-07-31 17:11:53 -07:00
c672551e42
fix(exhaustive-deps): gate custom hook analysis ( #1509 )
2026-07-31 17:11:38 -07:00
a8115b8257
fix(no-flush-sync): allow awareness selection integrations ( #1508 )
2026-07-31 17:11:22 -07:00
github-actions[bot]