chore: enable additional correctness lint rules (#4672)

## Summary

Enable additional lint rules that catch unsafe optional-chain
assertions, inherited-property iteration, anonymous symbols, and unsafe
external links.

The existing violations now use explicit values and own-property checks,
so the rules can prevent those patterns from returning.

Author: carderne

.oxlintrc.json

@@ -34,7 +34,7 @@
     ],
     "no-empty-pattern": "off",
     "no-control-regex": "off",
-    "typescript/no-non-null-asserted-optional-chain": "off",
+    "typescript/no-non-null-asserted-optional-chain": "error",
     "no-unused-expressions": [
       "error",
       {
@@ -47,6 +47,9 @@
     "import/namespace": "off",
     "react-hooks/exhaustive-deps": "off",
     "react-hooks/rules-of-hooks": "off",
+    "guard-for-in": "error",
+    "symbol-description": "error",
+    "react/jsx-no-target-blank": "error",
     "trigger/no-thrown-unawaited-redirect": "error",
     "trigger-prisma/no-unbounded-list-filter": "error",
     "trigger-prisma/no-unbounded-list-filter-in-args-helper": "error"

apps/webapp/app/components/primitives/Callout.tsx

@@ -92,6 +92,7 @@ export function Callout({
         <a
           href={to}
           target="_blank"
+          rel="noreferrer"
           className={cn(
             `flex w-full items-start justify-between gap-2.5 rounded-md border py-2 pl-2 pr-3 shadow-md backdrop-blur-xs`,
             variantDefinition.className,

apps/webapp/app/services/metadata/updateMetadata.server.ts

@@ -589,7 +589,7 @@ export class UpdateMetadataService {
       await this._runStore.updateMetadata(
         runId,
         {
-          metadata: metadataPacket?.data!,
+          metadata: metadataPacket.data!,
           metadataType: metadataPacket?.dataType,
           metadataVersion: {
             increment: 1,

apps/webapp/app/services/routeBuilders/permissions.server.ts

@@ -29,6 +29,7 @@ export function checkPermissions<K extends string>(
 ): Record<K, boolean> {
   const result = {} as Record<K, boolean>;
   for (const key in checks) {
+    if (!Object.hasOwn(checks, key)) continue;
     const check = checks[key];
     result[key] =
       "requireSuper" in check ? ability.canSuper() : ability.can(check.action, check.resource);

apps/webapp/server.ts

@@ -37,6 +37,7 @@ function installPrimarySignalHandlers() {
 
   const forward = (signal: NodeJS.Signals) => {
     for (const id in cluster.workers) {
+      if (!Object.hasOwn(cluster.workers, id)) continue;
       const w = cluster.workers[id];
       if (w?.process?.pid) {
         try {

packages/core/src/v3/apiClient/core.ts

@@ -605,7 +605,9 @@ async function waitForRetry(
 // https://stackoverflow.com/a/34491287
 export function isEmptyObj(obj: object | null | undefined): boolean {
   if (!obj) return true;
-  for (const _k in obj) return false;
+  for (const key in obj) {
+    if (Object.hasOwn(obj, key)) return false;
+  }
   return true;
 }
 

packages/core/src/v3/errors.ts

@@ -1172,6 +1172,7 @@ export function createTaskMetadataFailedErrorStack(
   const groupedIssues = groupTaskMetadataIssuesByTask(data.tasks, data.zodIssues);
 
   for (const key in groupedIssues) {
+    if (!Object.hasOwn(groupedIssues, key)) continue;
     const taskWithIssues = groupedIssues[key];
 
     if (!taskWithIssues) {

packages/core/src/v3/locals/manager.ts

@@ -3,7 +3,7 @@ import type { LocalsKey, LocalsManager } from "./types.js";
 export class NoopLocalsManager implements LocalsManager {
   createLocal<T>(id: string): LocalsKey<T> {
     return {
-      __type: Symbol(),
+      __type: Symbol(id),
       id,
     };
   }

packages/core/src/v3/serverOnly/httpServer.ts

@@ -346,6 +346,7 @@ export class HttpServer {
 
   private findRoute(url: string): string | null {
     for (const route in this.routes) {
+      if (!Object.hasOwn(this.routes, route)) continue;
       const routeParts = route.split("/");
       const urlWithoutQueryParams = url.split("?")[0];
 

packages/core/src/v3/utils/flattenAttributes.ts

@@ -346,6 +346,7 @@ export function unflattenAttributes(
     const maxIndex = Math.max(...Object.keys(result).map((k) => parseInt(k)));
     const arrayResult = Array(maxIndex + 1);
     for (const key in result) {
+      if (!Object.hasOwn(result, key)) continue;
       arrayResult[parseInt(key)] = result[key];
     }
     return arrayResult as any;