Repository navigation
Check the trace readers with tsc, not with a regex - #8
Merged
gabe4coding merged 1 commit intoOct 13, 2026
Merged
Conversation
The regex check in tests/contract.check.mjs found a trace read only when the variable had the name `t`. It also accepted a field of a different event (`t.removed` on a listing line). tsc now checks each read against the TraceLine union in types/index.d.ts. - Add `// @ts-check` to tests/session.mjs, tests/smoke.e2e.mjs and evals/impact.mjs. session.mjs gives the trace the type TraceLine[]. - Add tsconfig.scripts.json for the .mjs scripts, with the Node types. tsconfig.json stays without them: the engine runs the hooks without Node, so tsc must reject `process` or `setTimeout` in a hook. - Add package.json with @types/node 24.13.6. Run `npm install` one time before the type check. - Type the eval options and the session settings with Options, so a misspelled option fails. - Fix two reads in smoke.e2e.mjs that did not check the event first. - Fix the eval report for a session that failed with an error: it could crash on `sample.plugins`, and it printed "(undefined)" as the folder. - Remove traceContract and traceReadProblems from contract.check.mjs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gabe4coding
merged commit Oct 13, 2026
ecaf300
into
claude/codebase-hardening-audit-b8e47f
5 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR goes on top of #7. It replaces the regex check of the trace readers in
tests/contract.check.mjswith tsc.The regex check had these problems:
t. Another name passed with no check.TraceLine. A field of a different event (t.removedon alistingline) passed.Now tsc checks each read against the
TraceLineunion intypes/index.d.ts.Changes
// @ts-checkintests/session.mjs,tests/smoke.e2e.mjsandevals/impact.mjs.session.mjsgives the trace the typeTraceLine[].tsconfig.scripts.jsonfor the.mjsscripts, with the Node types.tsconfig.jsonstays without them. The engine runs the hooks without Node, so tsc must rejectprocessorsetTimeoutin a hook.package.jsonwith@types/node24.13.6. Runnpm installone time before the type check.Optionstype, so a misspelled option fails.traceContractandtraceReadProblemsfromcontract.check.mjs.CODING_STANDARDS.mdanddocs/development.mdxdescribe the second type check command.Problems that tsc found
smoke.e2e.mjs: two reads oft.typeandt.isScopeddid not check the event first.evals/impact.mjs: the report could crash onsample.pluginswhen a session failed with an error. The list of failures also printed(undefined)as the folder of such a session.Test plan
npx -p typescript@7.0.2 tsc -p tsconfig.jsonnpx -p typescript@7.0.2 tsc -p tsconfig.scripts.jsonclaude plugin validate .claude plugin test .(57 pass)node tests/docs.check.mjsnode tests/contract.check.mjsnode tests/smoke.e2e.mjs(8 of 8 pass)/verifydrive with 3 prompts: correct cuts, note and server callsNo change to
hooks/,types/or.claude-plugin/plugin.json, so the version stays the same.🤖 Generated with Claude Code