chore: track pnpm lockfile, add workspace; fix MDX env; adjust tests and tsconfig

[PaulJPhilp]

This PR standardizes installs with pnpm, fixes effect-mdx env provision, and adjusts tests/tsconfig.\n\nChanges:\n- Track pnpm-lock.yaml; add pnpm-workspace.yaml; remove bun.lock & package-lock.json\n- Provide NodeFileSystem.layer and reorder Effect.provide for effect-mdx in scripts:\n - scripts/ingest/ingest-pipeline-improved.ts\n - scripts/publish/rules.ts\n - scripts/publish/validate-improved.ts\n- Exclude content/new/** from typecheck; skip runtime tests for content/new/src/** while keeping tsc\n\nVerification:\n- pnpm install --frozen-lockfile: up to date\n- pnpm run typecheck: passes\n- pnpm run test: passes (runtime excluded for content/new/src/**)\n\nFollow-ups:\n- Add CI steps: install --frozen-lockfile, typecheck, test\n- Optional: make runtime exclusion toggleable via env flag

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
effect-patterns	Error			Oct 17, 2025 9:51pm
effect-patterns-mcp-server	Ready	Preview	Comment	Oct 17, 2025 9:51pm

💡 Enable Vercel Agent with $100 free credit for automated AI reviews

To resolve this issue, simply remove the declaration of the unused variable commentLines from line 452 within the file packages/toolkit/tests/template.test.ts. Nothing else in the snippet refers to this variable, so its removal will not alter existing functionality. Only a single line needs to be deleted; no changes to imports, function parameters, or other code sections are necessary.

The best way to fix the problem is to remove the unused TEST_FILE variable declaration from the script. Specifically, in the file scripts/ep-rules-add.test.ts, remove the line:

55: const TEST_FILE = path.join(TEST_DIR, 'rules.md');

No additional code, imports, or variable definitions are needed. The rest of the script remains unchanged.

To fix the issue, remove the initial assignment of 'success' to executionStatus in its declaration. Instead, declare the variable with its type but without assigning a value (let executionStatus: 'success' | 'failure';). This ensures that the variable is only given a value in the relevant execution branches, eliminating the useless assignment. Only edit the line in scripts/ingest/populate-expectations.ts that declares executionStatus. No other code, imports, or definitions are needed for implementing the change.

To fix the problem, simply remove the unnecessary assignment to endFound = true; on line 82. Only the break; statement is needed to terminate the inner loop when the condition is met. You do not need any additional imports, methods, or definitions. No other changes are required, as endFound is neither read nor otherwise used in the function. Make sure to only remove the line with the assignment that is never used. The definition of let endFound = false; can technically also be removed, since endFound has no effect, but since we're operating only on visible code blocks and it's harmless, it can be left unless explicitly required by a further lint rule.

To correctly escape the string for use as a shell argument to node -e "...code...", all meta-characters that could affect shell or JavaScript parsing must be safely handled. Currently, only double quotes and newlines are escaped. The fix is to also escape backslashes (\), since if one appears before a double quote or another escape sequence, it could result in syntactically invalid code or broken escaping within the string.

The single best way is to replace every backslash (\) with a double backslash (\\), before replacing double quotes, to avoid a double-escaping problem. Specifically:

• Escape backslashes: .replace(/\\/g, '\\\\')
• Then escape double quotes: .replace(/"/g, '\\"')
• Then replace newlines (optional, but you may want to preserve formatting): .replace(/\n/g, ' ')

Thus, in file scripts/publish/test-behavioral.ts, line 145 should be updated so that the .replace chain first escapes backslashes, then double quotes, then newlines.

No external libraries are needed — use native .replace with regular expressions.

The best way to resolve this issue is to remove the unused variable definition for execAsync on line 13. This improves code clarity, avoids confusion for future maintainers, and eliminates the possibility of mistakenly thinking this variable is used by the code. The change should only remove the definition line, and no other region or code needs to be updated since execAsync is never used elsewhere in the snippet.

---

To resolve this issue, we should remove the unused class ServerError from the code. This means deleting lines 46 to 50, corresponding to the entirety of the ServerError class definition. No additional changes (such as changes to imports or other variable definitions) are required, as the class is not referenced elsewhere in the shown code. Care should be taken to preserve surrounding comments and whitespace for readability.

To fix the problem, we should remove the unused loadPatternsFromJsonRunnable from the import list from '@effect-patterns/toolkit' on line 20 in services/mcp-server-stdio/src/index.ts. It does not affect current functionality since the identifier is not used anywhere else in the provided code. Simply deleting this specific entry from the multiline import will make the code cleaner and easier to maintain. No other code changes, imports, or definitions are necessary.

To fix this error, the unused import should be removed entirely. Specifically, delete the line import { Effect } from 'effect'; (line 24 in services/mcp-server-stdio/src/index.ts). This change will not affect any functionality since Effect is never utilized in the provided snippet.

---

To eliminate the risk, do not log the API key or any portion of it to the console (or logs), even in informational messages.

• The best way is to remove or redact the log statement on line 108:
  • Option 1 (recommended): Delete the line that logs the API key entirely so it's not written to logs.
  • Option 2: If logging is required for debugging (NOT recommended for general use), print a redacted string such as "API Key: [REDACTED]" or "[hidden]" so the presence of a key is shown, but the value is never revealed.
• Changes required:
  • Edit services/mcp-server/smoke-test.ts: remove or replace line 108.
  • No extra imports, as no external libraries are needed for redaction.
  • If replacing rather than deleting, retain formatting and color, but change the string to "[REDACTED]".

---

The best fix is to remove the declaration of the unused variable program. Specifically:

• In file content/new/src/test-pattern-1.ts, remove the line that declares program (line 3).
• No further changes or imports are required, as the variable is not used in any fashion in the shown code.

To fix this problem, it is best to remove the unused variable program from the code. This involves deleting the declaration and initialization statement for program. Only lines within the provided snippet should be changed, and no other logic should be altered, as nothing else references or uses program. No additional methods, imports, or variable definitions are needed.

The best way to fix the problem is to remove the declaration of the unused variable program. Specifically, delete line 3 which declares and initializes program. No other changes are necessary, as there are no usages, exports, or references to the variable in the provided code. No imports or additional definitions are required; the rest of the code can remain untouched.