chore: adopt shared oxlint config

[thymikee]

Summary

• replace the bespoke Oxlint JSON configuration with @nkzw/oxlint-config
• retain only active repository-specific environment, import-boundary, generated-script, React test-app, and wire-hash exceptions
• apply the newly enabled safe fixes across the repository and teach affected-check/Fallow ownership about the new tooling config
• remove inactive type-aware rules and stale configuration discovered during review, and move the child-process boundary to its current host-kit owner

Validation

• pnpm format, pnpm lint, and pnpm typecheck
• planted lint probes: undefined script globals and direct node:child_process imports fail at the intended boundaries
• focused affected-selector suite: 62/62 passed
• isolated replay transaction scenario: 17/17 passed after an unrelated teardown-only broad-run failure
• pnpm check:affected --run at 42b3378: all runnable checks passed, including 974 files and 7,403 graph-selected tests
• exact-head GitHub CI is in progress; GitHub remains authoritative for native, device, coverage, and other CI-only lanes

Scope

218 files changed. The broad source touch set is the safe-fix output required by the lint-policy migration. No docs or skills changed because command behavior is unchanged.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-08-28 09:43 UTC

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	2.48 MB	2.48 MB	+240 B
JS gzip	835.0 kB	835.2 kB	+143 B
npm tarball	958.5 kB	958.6 kB	+153 B
npm unpacked	3.32 MB	3.32 MB	+441 B

npm unpacked components

Component	Base	Current	Diff
JS / dist source	2.64 MB	2.64 MB	+276 B
Apple runner source/project	581.1 kB	581.1 kB	0 B
macOS helper source	54.8 kB	54.8 kB	0 B
Android helper artifacts	0 B	0 B	0 B
Other package files	45.4 kB	45.6 kB	+165 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	31.5 ms	31.5 ms	+0.0 ms
CLI --help	87.3 ms	84.1 ms	-3.2 ms

Top changed chunks:

Chunk	Raw diff	Gzip diff
dist/src/session2.js	+24 B	+11 B
dist/src/runtime2.js	+20 B	+11 B
dist/src/session-store.js	-6 B	-8 B
dist/src/perf-runtime-plan.js	+13 B	+7 B
dist/src/internal/daemon.js	+1 B	+4 B

Top changed packed files

Packed file	Base	Current	Diff
package.json	19.2 kB	19.3 kB	+165 B
dist/src/parser.js	4.7 kB	4.7 kB	-42 B
dist/src/runtime4.js	50.8 kB	50.8 kB	+37 B
dist/src/client-types.d.ts	55.8 kB	55.9 kB	+36 B
dist/src/snapshot-lines.js	5.0 kB	5.1 kB	+28 B
dist/src/runner-client.js	86.2 kB	86.2 kB	+24 B
dist/src/session2.js	216.3 kB	216.3 kB	+24 B
dist/src/sdk-android-adb.js	25.7 kB	25.8 kB	+21 B
dist/src/runtime2.js	44.5 kB	44.5 kB	+20 B
dist/src/snapshot-state.js	20.4 kB	20.4 kB	-20 B

[thymikee]

Re-reviewed 1ec581dc. The shared config is the right owning seam and the broad safe-fix delta appears mechanically behavior-neutral; exact-head lint, guards, type/package, integration, coverage, compatibility, CodeQL, and mutation lanes are green, with only +441 B npm unpacked.

P2 lint-boundary tightening: oxlint.config.ts enables browser globals for the entire repository, whereas the prior config declared only Node/ES globals and this head has no production browser-global use. Scope browser: true to the actual browser/test-app files (or remove it) so accidental window/document usage in daemon/CLI code remains lint-visible.

The failed iOS Smoke fill ended in TEXT_INPUT_COMMIT_NOT_OBSERVED; the touched FormScreen changes are property/prop ordering and equivalent entity spelling, so I found no causal path, but the required lane needs a green rerun before readiness.

[thymikee]

Addressed in 031a697. Browser globals are now scoped to the test app, and TypeScript no-undef is re-enabled so window/document remain lint-visible in daemon and CLI code. I also compared the resolved old config with the shared preset and restored the project-specific no-unused-vars policy plus every legacy correctness rule the preset did not already cover; deprecated typescript/no-var-requires is covered by typescript/no-require-imports. Planted boundary probes confirmed production browser globals and node:child_process imports fail, while the intended test and browser exceptions pass. pnpm check:affected --run is green locally; exact-head CI, including a fresh iOS Smoke run, is now in progress.

[thymikee]

Re-reviewed exact head 031a697846618209a800698d3b75586f59a8ff9e. The prior browser-environment P2 is fixed: browser globals are scoped to the example app, project lint boundaries and no-undef are restored, and the explicit build globals are narrowly declared. I found no remaining code/config issue. All completed checks are green; the remaining mutation/smoke lanes are still running. Code is ready for human review; CI remains authoritative.

[thymikee]

Reconciled the additional review in 42b3378. Removed the 15 type-aware rules that are inactive without oxlint-tsgolint/--type-aware; kept the three TypeScript rules that are active. Narrowed no-undef to scripts, where it supplements incomplete tsc coverage, and removed the resulting browser/build-global overrides. Updated the child-process restriction and exception from the retired capture-kit path to @agent-device/host-kit/command and packages/host-kit/src/internal/exec.ts. Removed the deleted .oxlintrc.json from ROOT_TOOLING and dropped the two zero-violation Perfectionist opt-outs. Planted probes confirmed undefined script globals and direct child-process imports in src/host-kit production fail. The full pnpm check:affected --run rerun passed all runnable checks, including 974 files / 7,403 tests. The PR body now reflects exact head 42b3378; exact-head CI is running.

[thymikee]

Re-reviewed exact head 42b3378. The latest delta only removes duplicated shared Oxlint config and stale affected-check ownership; no code/config finding. All completed checks are green, and ready-for-human remains justified. iOS Smoke plus two mutation cells are still running, so CI remains authoritative.