lintlane 2.5.0 → 4.0.0

package/bin/ui-server.mjs

@@ -1,9 +1,14 @@
+import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { createServer } from "node:http";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
-import { $ } from "bun";
-import { ciStream, detectCiSteps } from "./ci.mjs";
+import { resolveChecks, runCiSteps } from "./checks.mjs";
+import { formatReport, runDoctor } from "./doctor.mjs";
+import { runProcess, spawnPrepared } from "./proc.mjs";
 
 const MAX_FILES = 200;
+const MAX_BODY = 1024 * 1024;
 
 function isInside(root, target) {
   const rel = relative(root, target);
@@ -16,19 +21,48 @@ function safePath(cwd, file) {
   return isInside(cwd, abs) && abs !== cwd ? abs : null;
 }
 
+function tokenMatches(given, expected) {
+  if (typeof given !== "string") return false;
+  const a = Buffer.from(given);
+  const b = Buffer.from(expected);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+// Only answer requests addressed to the loopback name we listen on. A hostile web
+// page can point its own domain at 127.0.0.1 (DNS rebinding); its Host header then
+// names that domain, not us.
+function hostAllowed(hostHeader, port) {
+  if (typeof hostHeader !== "string") return false;
+  return [`127.0.0.1:${port}`, `localhost:${port}`].includes(hostHeader.toLowerCase());
+}
+
+const runBiome = (biome, args, options) =>
+  runProcess(biome[0], [...biome.slice(1), ...args], options);
+
 async function runCheck(cwd, biome) {
   const t0 = performance.now();
   console.log("… running biome check");
-  const result = await $`${biome} check --reporter=json .`.cwd(cwd).quiet().nothrow();
+  const result = await runBiome(biome, ["check", "--reporter=json", "."], { cwd });
   const out = result.stdout.toString().trim();
   console.log(
     `… biome finished in ${((performance.now() - t0) / 1000).toFixed(1)}s (${(out.length / 1024).toFixed(0)} KB of output)`,
   );
   const start = out.indexOf("{");
   if (start === -1) {
-    throw new Error(result.stderr.toString().trim() || "Biome produced no JSON output");
+    const detail = result.error
+      ? `Couldn't start Biome: ${result.error.message}`
+      : result.stderr.toString().trim() ||
+        `Biome exited with code ${result.code} and no JSON output`;
+    throw new Error(detail);
+  }
+  let report;
+  try {
+    report = JSON.parse(out.slice(start));
+  } catch {
+    throw new Error(
+      `Biome's output wasn't valid JSON (exit code ${result.code}). Run \`biome check .\` in a terminal to see the problem.`,
+    );
   }
-  const report = JSON.parse(out.slice(start));
 
   const byFile = new Map();
   for (const d of report.diagnostics ?? []) {
@@ -55,6 +89,8 @@ async function runCheck(cwd, biome) {
     files,
     totalFiles: byFile.size,
     truncated: byFile.size > MAX_FILES,
+    exitCode: result.code,
+    ms: Math.round(performance.now() - t0),
   };
 }
 
@@ -63,11 +99,11 @@ async function runCheck(cwd, biome) {
 async function getDiff(cwd, biome, file) {
   const abs = safePath(cwd, file);
   if (!abs || !existsSync(abs)) throw new Error(`Invalid file: ${file}`);
-  const original = await Bun.file(abs).text();
-  const res = await $`${biome} check --write --stdin-file-path=${file} < ${new Response(original)}`
-    .cwd(cwd)
-    .quiet()
-    .nothrow();
+  const original = await readFile(abs, "utf8");
+  const res = await runBiome(biome, ["check", "--write", `--stdin-file-path=${file}`], {
+    cwd,
+    input: original,
+  });
   const text = res.stdout.toString();
   const fixed = text.length > 0 ? text : null;
   return { original, fixed, fixable: fixed !== null && fixed !== original };
@@ -77,107 +113,224 @@ async function applyFixes(cwd, biome, files) {
   const paths = files.map((file) => {
     const abs = safePath(cwd, file);
     if (!abs || !existsSync(abs)) throw new Error(`Invalid file: ${file}`);
-    return file;
+    return file.startsWith("-") ? `./${file}` : file;
   });
   const CHUNK = 100;
   for (let i = 0; i < paths.length; i += CHUNK) {
-    await $`${biome} check --write ${paths.slice(i, i + CHUNK)}`.cwd(cwd).quiet().nothrow();
+    await runBiome(biome, ["check", "--write", ...paths.slice(i, i + CHUNK)], { cwd });
+  }
+}
+
+class HttpError extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
   }
 }
 
+function sendJson(res, status, body) {
+  const data = JSON.stringify(body);
+  res.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store",
+  });
+  res.end(data);
+}
+
+async function readJson(req) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    size += chunk.length;
+    if (size > MAX_BODY) throw new HttpError(413, "Request body too large");
+    chunks.push(chunk);
+  }
+  if (size === 0) return {};
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new HttpError(400, "Invalid JSON");
+  }
+}
+
+function openBrowser(address) {
+  const [command, args] =
+    process.platform === "darwin"
+      ? ["open", [address]]
+      : process.platform === "win32"
+        ? ["cmd", ["/c", "start", '""', address]]
+        : ["xdg-open", [address]];
+  try {
+    const child = spawnPrepared(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
+}
+
 export async function startUi({ cwd, biome, kitDir, port, open, pmName, pkg }) {
   let ciBusy = false;
-  const token = crypto.randomUUID();
-  const html = await Bun.file(join(kitDir, "ui", "index.html")).text();
-
-  const server = Bun.serve({
-    hostname: "127.0.0.1",
-    port,
-    async fetch(req) {
-      const url = new URL(req.url);
-
-      if (req.method === "GET" && url.pathname === "/") {
-        if (url.searchParams.get("t") !== token) {
-          return new Response("Forbidden: open the URL printed by `lintlane ui`.", {
-            status: 403,
-          });
+  let checkBusy = false;
+  const token = randomUUID();
+  const checksFor = () => resolveChecks({ cwd, biome, pmName, pkg });
+  const html = await readFile(join(kitDir, "ui", "index.html"), "utf8");
+
+  async function handle(req, res) {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+
+    if (!hostAllowed(req.headers.host, server.address().port)) {
+      res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+      res.end("Forbidden: unexpected Host header.");
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/") {
+      if (!tokenMatches(url.searchParams.get("t"), token)) {
+        res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+        res.end("Forbidden: open the URL printed by `lintlane ui`.");
+        return;
+      }
+      const nonce = randomBytes(16).toString("base64");
+      res.writeHead(200, {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store",
+        "x-content-type-options": "nosniff",
+        "referrer-policy": "no-referrer",
+        "cross-origin-resource-policy": "same-origin",
+        "content-security-policy": [
+          "default-src 'none'",
+          `script-src 'nonce-${nonce}'`,
+          "style-src 'unsafe-inline'",
+          "connect-src 'self'",
+          "img-src 'self' data:",
+          "base-uri 'none'",
+          "form-action 'none'",
+          "frame-ancestors 'none'",
+        ].join("; "),
+      });
+      res.end(html.replace("__TOKEN__", token).replaceAll("<script", `<script nonce="${nonce}"`));
+      return;
+    }
+
+    if (url.pathname.startsWith("/api/")) {
+      if (!tokenMatches(req.headers["x-lintlane-token"], token)) {
+        sendJson(res, 401, { error: "Unauthorized" });
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/api/check") {
+        if (checkBusy) {
+          sendJson(res, 409, { error: "A check is already running" });
+          return;
         }
-        return new Response(html.replace("__TOKEN__", token), {
-          headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" },
+        checkBusy = true;
+        try {
+          sendJson(res, 200, await runCheck(cwd, biome));
+        } finally {
+          checkBusy = false;
+        }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/api/fix") {
+        const { files } = await readJson(req);
+        if (!Array.isArray(files) || files.length === 0) {
+          sendJson(res, 400, { error: "No files given" });
+          return;
+        }
+        await applyFixes(cwd, biome, files);
+        sendJson(res, 200, { fixed: files.length });
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/api/ci/steps") {
+        const { steps, problems } = checksFor();
+        sendJson(res, 200, {
+          pmName,
+          problems,
+          busy: ciBusy,
+          steps: steps.map(({ id, label, display, defaultOn, note }) => ({
+            id,
+            label,
+            display,
+            defaultOn,
+            note,
+          })),
         });
+        return;
       }
-
-      if (url.pathname.startsWith("/api/")) {
-        if (req.headers.get("x-lintlane-token") !== token) {
-          return Response.json({ error: "Unauthorized" }, { status: 401 });
+      if (req.method === "POST" && url.pathname === "/api/ci/run") {
+        if (ciBusy) {
+          sendJson(res, 409, { error: "A CI run is already in progress" });
+          return;
         }
+        const { steps: ids, stopOnFail } = await readJson(req);
+        const known = checksFor().steps;
+        const steps = Array.isArray(ids) ? known.filter((step) => ids.includes(step.id)) : [];
+        if (steps.length === 0) {
+          sendJson(res, 400, { error: "No steps selected" });
+          return;
+        }
+        ciBusy = true;
+        const controller = new AbortController();
+        // The browser's Stop button (or closing the tab) ends the response early.
+        res.on("close", () => {
+          if (!res.writableFinished) controller.abort();
+        });
+        res.writeHead(200, { "content-type": "application/x-ndjson", "cache-control": "no-store" });
         try {
-          if (req.method === "POST" && url.pathname === "/api/check") {
-            return Response.json(await runCheck(cwd, biome));
-          }
-          if (req.method === "POST" && url.pathname === "/api/fix") {
-            const { files } = await req.json();
-            if (!Array.isArray(files) || files.length === 0) {
-              return Response.json({ error: "No files given" }, { status: 400 });
-            }
-            await applyFixes(cwd, biome, files);
-            return Response.json({ fixed: files.length });
-          }
-          if (req.method === "POST" && url.pathname === "/api/ci/steps") {
-            const steps = detectCiSteps({ cwd, biome, pmName, pkg });
-            return Response.json({
-              pmName,
-              steps: steps.map(({ id, label, display, defaultOn, note }) => ({
-                id,
-                label,
-                display,
-                defaultOn,
-                note,
-              })),
-            });
-          }
-          if (req.method === "POST" && url.pathname === "/api/ci/run") {
-            if (ciBusy)
-              return Response.json({ error: "A CI run is already in progress" }, { status: 409 });
-            const { steps: ids, stopOnFail } = await req.json();
-            const known = detectCiSteps({ cwd, biome, pmName, pkg });
-            const steps = Array.isArray(ids) ? known.filter((step) => ids.includes(step.id)) : [];
-            if (steps.length === 0)
-              return Response.json({ error: "No steps selected" }, { status: 400 });
-            ciBusy = true;
-            const stream = ciStream({
-              cwd,
-              steps,
-              stopOnFail: stopOnFail !== false,
-              release: () => {
-                ciBusy = false;
-              },
-            });
-            return new Response(stream, {
-              headers: { "content-type": "application/x-ndjson", "cache-control": "no-store" },
-            });
-          }
-          if (req.method === "POST" && url.pathname === "/api/diff") {
-            const { file } = await req.json();
-            return Response.json(await getDiff(cwd, biome, file));
-          }
-        } catch (error) {
-          return Response.json({ error: error.message }, { status: 500 });
+          await runCiSteps({
+            cwd,
+            steps,
+            stopOnFail: stopOnFail !== false,
+            signal: controller.signal,
+            send: (event) => {
+              if (!res.destroyed) res.write(`${JSON.stringify(event)}\n`);
+            },
+          });
+        } finally {
+          ciBusy = false;
+          if (!res.destroyed) res.end();
         }
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/api/doctor") {
+        const report = await runDoctor({ cwd, kitDir });
+        sendJson(res, 200, { ...report, text: formatReport(report) });
+        return;
+      }
+      if (req.method === "POST" && url.pathname === "/api/diff") {
+        const { file } = await readJson(req);
+        sendJson(res, 200, await getDiff(cwd, biome, file));
+        return;
       }
+    }
 
-      return new Response("Not found", { status: 404 });
-    },
+    res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+    res.end("Not found");
+  }
+
+  const server = createServer((req, res) => {
+    handle(req, res).catch((error) => {
+      if (res.headersSent) {
+        res.destroy();
+        return;
+      }
+      sendJson(res, error instanceof HttpError ? error.status : 500, { error: error.message });
+    });
   });
 
-  const address = `http://127.0.0.1:${server.port}/?t=${token}`;
+  await new Promise((resolveListen, rejectListen) => {
+    server.once("error", (error) => {
+      rejectListen(
+        error.code === "EADDRINUSE"
+          ? new Error(`Port ${port} is already in use. Pick another with --port <n>.`)
+          : error,
+      );
+    });
+    server.listen(port, "127.0.0.1", resolveListen);
+  });
+
+  const address = `http://127.0.0.1:${server.address().port}/?t=${token}`;
   console.log(`✔ Lintlane dashboard running at ${address}`);
   console.log("  Press Ctrl+C to stop.");
 
-  if (open) {
-    const opener =
-      process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-    await $`${opener} ${address}`.quiet().nothrow();
-  }
+  if (open) openBrowser(address);
   return server;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "lintlane",
-  "version": "2.5.0",
-  "description": "Pre-push checks for React apps: shared Biome preset, local lint and CI dashboard",
+  "version": "4.0.0",
+  "description": "Code-quality workflow for JavaScript, React and Next.js: orchestrates Biome, lint-staged, Husky, Commitizen and commitlint, with a local dashboard and CI",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -11,7 +11,9 @@
     "./biome": "./presets/base.json",
     "./biome/strict": "./presets/strict.json",
     "./biome/next": "./presets/next.json",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./commitlint": "./presets/commitlint.mjs",
+    "./commitizen": "./presets/commitizen.cjs"
   },
   "files": [
     "bin",
@@ -22,7 +24,9 @@
   ],
   "scripts": {
     "check": "biome check .",
-    "check:fix": "biome check --write ."
+    "check:fix": "biome check --write .",
+    "test": "node --test \"test/*.test.mjs\"",
+    "test:e2e": "LINTLANE_E2E=1 node --test \"test/e2e.test.mjs\""
   },
   "peerDependencies": {
     "@biomejs/biome": ">=2.2.0 <3"
@@ -34,14 +38,25 @@
     "access": "public"
   },
   "engines": {
-    "bun": ">=1.2"
+    "node": ">=22"
   },
   "keywords": [
     "lintlane",
     "biome",
     "react",
     "lint",
-    "format"
+    "format",
+    "lint-staged",
+    "husky",
+    "commitlint",
+    "commitizen"
   ],
-  "author": "Expo2Dev"
+  "author": "Expo2Dev",
+  "dependencies": {
+    "@commitlint/cli": "19.8.1",
+    "@commitlint/config-conventional": "19.8.1",
+    "commitizen": "4.3.2",
+    "cz-conventional-changelog": "3.3.0",
+    "lint-staged": "16.4.0"
+  }
 }

package/presets/commitizen.cjs

@@ -0,0 +1,4 @@
+// Commitizen adapter: the standard Conventional Commits prompt, resolved from
+// lintlane's own dependencies so it works under every package manager.
+// package.json: "config": { "commitizen": { "path": "lintlane/presets/commitizen.cjs" } }
+module.exports = require("cz-conventional-changelog");

package/presets/commitlint.mjs

@@ -0,0 +1,47 @@
+// Shared commitlint config: Conventional Commits, tuned by the optional
+// "lintlane.commit" block in package.json:
+//
+//   "lintlane": { "commit": { "types": ["feat", "fix"], "messageLengthLimit": 72,
+//                             "allowedPrefixes": ["WIP"] } }
+//
+// A project's commitlint.config.mjs can be just:
+//   export { default } from "lintlane/commitlint";
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+
+const require = createRequire(import.meta.url);
+
+function readOptions() {
+  try {
+    const pkg = JSON.parse(readFileSync(join(process.cwd(), "package.json"), "utf8"));
+    const commit = pkg?.lintlane?.commit;
+    return commit && typeof commit === "object" ? commit : {};
+  } catch {
+    return {};
+  }
+}
+
+const options = readOptions();
+const rules = {};
+
+if (Array.isArray(options.types) && options.types.length > 0) {
+  rules["type-enum"] = [2, "always", options.types.map((t) => String(Array.isArray(t) ? t[0] : t))];
+} else if (options.types && typeof options.types === "object" && !Array.isArray(options.types)) {
+  rules["type-enum"] = [2, "always", Object.keys(options.types)];
+}
+
+const limit = Number(options.messageLengthLimit);
+if (options.messageLengthLimit !== undefined && Number.isFinite(limit) && limit >= 0) {
+  rules["header-max-length"] = limit === 0 ? [0] : [2, "always", limit];
+}
+
+const prefixes = Array.isArray(options.allowedPrefixes) ? options.allowedPrefixes.map(String) : [];
+
+export default {
+  extends: [require.resolve("@commitlint/config-conventional")],
+  rules,
+  ...(prefixes.length > 0
+    ? { ignores: [(message) => prefixes.some((prefix) => String(message).startsWith(prefix))] }
+    : {}),
+};

package/templates/commit-msg

@@ -1,2 +1,2 @@
-[ -f node_modules/lintlane/bin/commit-msg.mjs ] || exit 0
-node node_modules/lintlane/bin/commit-msg.mjs "$1"
+[ -f node_modules/lintlane/bin/cli.mjs ] || { echo "lintlane: node_modules/lintlane not found; skipping commit-msg. Run your package manager's install." >&2; exit 0; }
+node node_modules/lintlane/bin/cli.mjs hook commit-msg "$@"

package/templates/pre-commit

@@ -1,2 +1,2 @@
-./node_modules/.bin/biome check --write --staged --no-errors-on-unmatched --files-ignore-unknown=true
-git update-index --again
+[ -f node_modules/lintlane/bin/cli.mjs ] || { echo "lintlane: node_modules/lintlane not found; skipping pre-commit. Run your package manager's install." >&2; exit 0; }
+node node_modules/lintlane/bin/cli.mjs hook pre-commit "$@"

package/templates/pre-push

@@ -1,2 +1,2 @@
-[ -f node_modules/lintlane/bin/pre-push-check.mjs ] || exit 0
-node node_modules/lintlane/bin/pre-push-check.mjs "$1" "$2"
+[ -f node_modules/lintlane/bin/cli.mjs ] || { echo "lintlane: node_modules/lintlane not found; skipping pre-push. Run your package manager's install." >&2; exit 0; }
+node node_modules/lintlane/bin/cli.mjs hook pre-push "$@"

package/templates/prepare-commit-msg

@@ -1,2 +1,2 @@
-[ -f node_modules/lintlane/bin/prepare-commit-msg.mjs ] || exit 0
-node node_modules/lintlane/bin/prepare-commit-msg.mjs "$1" "$2"
+[ -f node_modules/lintlane/bin/cli.mjs ] || { echo "lintlane: node_modules/lintlane not found; skipping prepare-commit-msg. Run your package manager's install." >&2; exit 0; }
+node node_modules/lintlane/bin/cli.mjs hook prepare-commit-msg "$@"