ci: extend the lint gate beyond src/ so unlinted files cannot land on main

.oxlintrc.json

@@ -122,6 +122,12 @@
     "vue/no-import-compiler-macros": "error"
   },
   "overrides": [
+    {
+      "files": ["scripts/**"],
+      "rules": {
+        "no-console": "allow"
+      }
+    },
     {
       "files": ["**/*.{stories,test,spec}.ts", "**/*.stories.vue"],
       "rules": {

eslint.config.ts

@@ -88,6 +88,8 @@ export default defineConfig([
       'src/types/generatedManagerTypes.ts',
       'src/types/vue-shim.d.ts',
       'packages/design-system/src/css/lucideStrokePlugin.js',
+      // Opt-in strict-audit config; its plugins are intentionally not installed
+      '.agents/checks/eslint.strict.config.js',
       'test-results/*',
       'vitest.setup.ts'
     ]
@@ -102,7 +104,9 @@ export default defineConfig([
         projectService: {
           allowDefaultProject: [
             'vite.electron.config.mts',
-            'vite.types.config.mts'
+            'vite.types.config.mts',
+            'packages/ingest-types/openapi-ts.config.ts',
+            'packages/object-info-parser/vitest.config.ts'
           ]
         }
       }
@@ -348,6 +352,26 @@ export default defineConfig([
       'no-console': 'off'
     }
   },
+  // Root-level scripts reach into workspace packages by path: they run from the
+  // repo root, where the package specifiers those imports would be rewritten to
+  // (`@comfyorg/desktop-ui/...`, `@comfyorg/shared-frontend-utils/src/...`) do
+  // not resolve — desktop-ui is not a root dependency and shared-frontend-utils
+  // exposes no `./src/*` export.
+  {
+    files: ['scripts/**/*.ts'],
+    rules: {
+      'import-x/no-relative-packages': 'off'
+    }
+  },
+  // Dev-only extensions loaded by the ComfyUI backend in a browser page
+  {
+    files: ['tools/devtools/web/**/*.js'],
+    languageOptions: {
+      globals: {
+        ...globals.browser
+      }
+    }
+  },
 
   // Turn off ESLint rules that are already handled by oxlint
   ...oxlint.buildFromOxlintConfigFile(

lint-staged.config.ts

@@ -5,7 +5,7 @@ export default {
     'echo "Files in tests-ui/ are deprecated. Colocate tests with source files." && exit 1',
 
   './**/*.{css,vue}': (stagedFiles: string[]) => {
-    const joinedPaths = toJoinedRelativePaths(stagedFiles)
+    const joinedPaths = quote(toRelativePaths(stagedFiles))
     return [`pnpm exec stylelint --allow-empty-input ${joinedPaths}`]
   },
 
@@ -18,9 +18,7 @@ export default {
 
     const commands = [...formatAndEslint(formattable), 'pnpm typecheck']
 
-    const relativePaths = stagedFiles.map((f) =>
-      path.relative(process.cwd(), f).replace(/\\/g, '/')
-    )
+    const relativePaths = toRelativePaths(stagedFiles)
 
     if (relativePaths.some((f) => f.startsWith('browser_tests/'))) {
       commands.push('pnpm typecheck:browser')
@@ -35,17 +33,27 @@ export default {
 }
 
 function formatAndEslint(fileNames: string[]) {
-  const joinedPaths = toJoinedRelativePaths(fileNames)
-  return [
-    `pnpm exec oxfmt --write ${joinedPaths}`,
-    `pnpm exec oxlint --type-aware --no-error-on-unmatched-pattern --fix ${joinedPaths}`,
-    `pnpm exec eslint --cache --fix --no-warn-ignored ${joinedPaths}`
-  ]
+  const relativePaths = toRelativePaths(fileNames)
+  const commands = [`pnpm exec oxfmt --write ${quote(relativePaths)}`]
+
+  // apps/* have their own lint configs; the root lint scripts skip them too
+  const lintable = relativePaths.filter((f) => !f.startsWith('apps/'))
+  if (lintable.length > 0) {
+    commands.push(
+      `pnpm exec oxlint --type-aware --no-error-on-unmatched-pattern --fix ${quote(lintable)}`,
+      `pnpm exec eslint --cache --fix --no-warn-ignored ${quote(lintable)}`
+    )
+  }
+
+  return commands
 }
 
-function toJoinedRelativePaths(fileNames: string[]) {
-  const relativePaths = fileNames.map((f) =>
+function toRelativePaths(fileNames: string[]) {
+  return fileNames.map((f) =>
     path.relative(process.cwd(), f).replace(/\\/g, '/')
   )
+}
+
+function quote(relativePaths: string[]) {
   return relativePaths.map((p) => `"${p}"`).join(' ')
 }

package.json

@@ -36,15 +36,15 @@
     "json-schema": "tsx scripts/generate-json-schema.ts",
     "knip:no-cache": "knip",
     "knip": "knip --cache",
-    "lint:fix:no-cache": "oxlint src browser_tests --type-aware --fix && eslint src --fix",
-    "lint:fix": "oxlint src browser_tests --type-aware --fix && eslint src --cache --fix",
-    "lint:no-cache": "pnpm exec stylelint '{apps,packages,src}/**/*.{css,vue}' && oxlint src browser_tests --type-aware && eslint src",
-    "lint:unstaged:fix": "git diff --name-only HEAD | grep -E '\\.(js|ts|vue|mts)$' | xargs -r eslint --cache --fix",
-    "lint:unstaged": "git diff --name-only HEAD | grep -E '\\.(js|ts|vue|mts)$' | xargs -r eslint --cache",
-    "lint": "pnpm stylelint && oxlint src browser_tests --type-aware && eslint src --cache",
+    "lint:fix:no-cache": "oxlint . --type-aware --fix --ignore-pattern 'apps/**' && eslint . --fix --ignore-pattern 'apps/**'",
+    "lint:fix": "oxlint . --type-aware --fix --ignore-pattern 'apps/**' && eslint . --cache --fix --ignore-pattern 'apps/**'",
+    "lint:no-cache": "pnpm exec stylelint '{apps,packages,src}/**/*.{css,vue}' && oxlint . --type-aware --ignore-pattern 'apps/**' && eslint . --ignore-pattern 'apps/**'",
+    "lint:unstaged:fix": "git diff --name-only HEAD | grep -E '\\.(js|ts|vue|mts)$' | grep -v '^apps/' | xargs -r eslint --cache --fix",
+    "lint:unstaged": "git diff --name-only HEAD | grep -E '\\.(js|ts|vue|mts)$' | grep -v '^apps/' | xargs -r eslint --cache",
+    "lint": "pnpm stylelint && oxlint . --type-aware --ignore-pattern 'apps/**' && eslint . --cache --ignore-pattern 'apps/**'",
     "lint:desktop": "pnpm --filter @comfyorg/desktop-ui run lint",
     "locale": "lobe-i18n locale",
-    "oxlint": "oxlint src browser_tests --type-aware",
+    "oxlint": "oxlint . --type-aware --ignore-pattern 'apps/**'",
     "prepare": "pnpm exec husky || true && git config blame.ignoreRevsFile .git-blame-ignore-revs || true",
     "preview": "vite preview --config vite.config.mts",
     "storybook": "storybook dev -p 6006",

scripts/size-collect.js

@@ -20,7 +20,10 @@ const sizeDir = path.resolve('temp/size')
  * @property {number} brotli
  */
 
-run()
+run().catch((err) => {
+  console.error(pico.red('Error collecting bundle size data:'), err)
+  process.exit(1)
+})
 
 /**
  * Main function to collect bundle size data

scripts/size-report.js

@@ -67,7 +67,10 @@ import { getCategoryMetadata } from './bundle-categories.js'
 const currDir = path.resolve('temp/size')
 const prevDir = path.resolve('temp/size-prev')
 
-run()
+run().catch((err) => {
+  console.error('Error generating bundle size report:', err)
+  process.exit(1)
+})
 
 /**
  * Main entry for generating the size report

tools/devtools/web/runtimeReflow.js

@@ -1,3 +1,4 @@
+// eslint-disable-next-line import-x/no-unresolved -- import is correct at time of test execution
 import { app } from '../../scripts/app.js'
 
 // 1x1 transparent PNG so `img.onload` fires deterministically in CI.