chore: housekeeping & make eslint happy

.github/scripts/brand-matrix.test.mjs

@@ -26,7 +26,7 @@ const RE_MISMATCHED_PUBLICATION_SOURCE = /must equal sourceGitSha/;
 const RE_LEGACY_DESKTOP_UPLOAD = /"s3:\/\/\$\{R2_BUCKET\}\/\$\{R2_PREFIX\}\/"/;
 const RE_LEGACY_RELEASE_TAG = /must equal refs\/tags\/v1\.2\.3/;
 const RE_SECRETS_EXPRESSION = /secrets(?:\.|\[)/;
-const ACTIONS_EXPRESSION = String.fromCodePoint(36);
+const ACTIONS_EXPRESSION = String.fromCharCode(36);
 
 function sha(character) {
   return character.repeat(64);

.github/scripts/release-inputs.test.mjs

@@ -110,25 +110,26 @@ describe('validateReleaseInputs', () => {
   });
 
   it('rejects malformed desktop notarization key material', () => {
-    const env = Object.fromEntries(
-      [
-        'APPLE_API_KEY_BASE64',
-        'APPLE_API_KEY_ID',
-        'APPLE_API_ISSUER',
-        'APPLE_TEAM_ID',
-        'AZURE_CERTIFICATE_PROFILE',
-        'AZURE_CLIENT_ID',
-        'AZURE_CODE_SIGNING_ACCOUNT',
-        'AZURE_PUBLISHER_NAME',
-        'AZURE_SIGN_ENDPOINT',
-        'AZURE_TENANT_ID',
-        'MACOS_CSC_KEY_PASSWORD',
-        'MACOS_CSC_LINK',
-        'POSTHOG_HOST',
-        'POSTHOG_PROJECT_TOKEN',
-        'SENTRY_DSN_DESKTOP',
-      ].map((name) => [name, 'set']),
-    );
+    const env = [
+      'APPLE_API_KEY_BASE64',
+      'APPLE_API_KEY_ID',
+      'APPLE_API_ISSUER',
+      'APPLE_TEAM_ID',
+      'AZURE_CERTIFICATE_PROFILE',
+      'AZURE_CLIENT_ID',
+      'AZURE_CODE_SIGNING_ACCOUNT',
+      'AZURE_PUBLISHER_NAME',
+      'AZURE_SIGN_ENDPOINT',
+      'AZURE_TENANT_ID',
+      'MACOS_CSC_KEY_PASSWORD',
+      'MACOS_CSC_LINK',
+      'POSTHOG_HOST',
+      'POSTHOG_PROJECT_TOKEN',
+      'SENTRY_DSN_DESKTOP',
+    ].reduce((acc, name) => {
+      acc[name] = 'set';
+      return acc;
+    }, {});
     expect(() => validateReleaseInputs({ env, phase: 'sign', platform: 'desktop' })).toThrow(
       RE_INVALID_KEY,
     );

apps/daemon/e2e/startup.e2e.ts

@@ -120,7 +120,9 @@ async function main(): Promise<void> {
         .map((row) => (row as { name: string }).name),
     );
     sqlite.close();
-    for (const table of ['__drizzle_migrations', 'sessions', 'workspaces', 'schedules', 'loops']) {
+    const expectedTables = ['__drizzle_migrations', 'sessions', 'workspaces', 'schedules', 'loops'];
+    for (let i = 0, len = expectedTables.length; i < len; i++) {
+      const table = expectedTables[i];
       assert(tables.has(table), `missing migrated table ${table}`);
     }
 

apps/daemon/package.json

@@ -32,7 +32,7 @@
     "@sentry/node": "10.62.0",
     "@sentry/profiling-node": "10.62.0",
     "better-sqlite3": "^13.0.2",
-    "foxts": "^5.8.0",
+    "foxts": "^5.9.1",
     "pino": "^10.3.1",
     "zod": "catalog:"
   },

apps/daemon/scripts/dev-clean.mts

@@ -3,4 +3,8 @@ import { databasePath, runtimeFilePath } from '../src/config';
 
 // Resolves through config.ts so a fork's renamed state dir, the resolved channel, or an active
 // LINKCODE_PROFILE cleans the same universe the dev daemon will actually use.
-for (const path of [databasePath(), runtimeFilePath()]) rmSync(path, { force: true });
+const devStatePaths = [databasePath(), runtimeFilePath()];
+for (let i = 0, len = devStatePaths.length; i < len; i++) {
+  const path = devStatePaths[i];
+  rmSync(path, { force: true });
+}

apps/daemon/scripts/package-daemon.mts

@@ -61,10 +61,13 @@ run('pnpm', ['--filter', '@linkcode/daemon', '--prod', 'deploy', '--legacy', out
 rmSync(join(outDir, 'dist'), { recursive: true, force: true });
 cpSync(join(daemonDir, 'dist'), join(outDir, 'dist'), { recursive: true });
 
-for (const [scope, prefix] of PRUNE) {
+for (let i = 0, len = PRUNE.length; i < len; i++) {
+  const [scope, prefix] = PRUNE[i];
   const scopeDir = join(outDir, 'node_modules', scope);
   if (!existsSync(scopeDir)) continue;
-  for (const entry of readdirSync(scopeDir)) {
+  const scopeEntries = readdirSync(scopeDir);
+  for (let j = 0, entryCount = scopeEntries.length; j < entryCount; j++) {
+    const entry = scopeEntries[j];
     if (entry.startsWith(prefix)) rmSync(join(scopeDir, entry), { recursive: true, force: true });
   }
 }
@@ -74,7 +77,9 @@ console.log(`daemon packaged at ${outDir} (${Math.round(bytes / 1e6)} MB)`);
 
 function dirSize(dir: string): number {
   let total = 0;
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+  const entries = readdirSync(dir, { withFileTypes: true });
+  for (let i = 0, len = entries.length; i < len; i++) {
+    const entry = entries[i];
     const full = join(dir, entry.name);
     if (entry.isDirectory()) total += dirSize(full);
     else if (entry.isFile()) total += statSync(full).size;

apps/daemon/src/__tests__/ai-gateway.test.ts

@@ -47,13 +47,22 @@ class FakeChild implements SidecarChildProcess {
     this.signal = signal;
   }
   emitStdout(text: string): void {
-    for (const listener of this.dataListeners) listener(text);
+    for (let i = 0, len = this.dataListeners.length; i < len; i++) {
+      const listener = this.dataListeners[i];
+      listener(text);
+    }
   }
   emitError(error: Error): void {
-    for (const listener of this.errorListeners) listener(error);
+    for (let i = 0, len = this.errorListeners.length; i < len; i++) {
+      const listener = this.errorListeners[i];
+      listener(error);
+    }
   }
   emitExit(code: number | null): void {
-    for (const listener of this.exitListeners) listener(code);
+    for (let i = 0, len = this.exitListeners.length; i < len; i++) {
+      const listener = this.exitListeners[i];
+      listener(code);
+    }
   }
 }
 

apps/daemon/src/__tests__/secrets-vault.test.ts

@@ -25,8 +25,9 @@ const noKeyring = (): MasterKey | null => null;
  * Secrets are only reachable through a namespace, so every case goes through one. On disk the same
  * entry is the full `cloud:session` ref — asserting against that is what proves the prefixing.
  */
-const open = (file: string, loadKey: () => MasterKey | null): SecretStore =>
-  createSecretVault(file, loadKey).namespace('cloud');
+function open(file: string, loadKey: () => MasterKey | null): SecretStore {
+  return createSecretVault(file, loadKey).namespace('cloud');
+}
 
 let file: string;
 const realPlatform = process.platform;

apps/daemon/src/ai-gateway.ts

@@ -172,7 +172,10 @@ export function createAiGatewaySidecar(options: AiGatewaySidecarOptions = {}): T
     },
     async closeAll() {
       const entries = [...running.values()];
-      for (const entry of entries) entry.close();
+      for (let i = 0, len = entries.length; i < len; i++) {
+        const entry = entries[i];
+        entry.close();
+      }
       await Promise.allSettled(entries.map((entry) => entry.ready));
     },
   };

apps/daemon/src/config.ts

@@ -206,7 +206,8 @@ function parseAccounts(store: SecretStore, raw: unknown): Parsed<Accounts> {
   }
   const accounts: Accounts = [];
   let migrated = false;
-  for (const value of raw) {
+  for (let i = 0, len = raw.length; i < len; i++) {
+    const value = raw[i];
     // The credential secret lives in the vault (CODE-371); merge it back before validating, so a
     // secret that is gone fails the schema and lands in the same drop-and-log path as a malformed one.
     const attached = withAccountSecret(store, value);
@@ -267,7 +268,8 @@ function parseCustomMcpServers(store: SecretStore, raw: unknown): Parsed<CustomM
   }
   const servers: CustomMcpServer[] = [];
   let migrated = false;
-  for (const value of snapshot.servers) {
+  for (let i = 0, len = snapshot.servers.length; i < len; i++) {
+    const value = snapshot.servers[i];
     const attached = withCustomMcpSecrets(store, value, snapshot.generation);
     migrated ||= attached.migrated;
     const server = CustomMcpServerSchema.safeParse(attached.value);
@@ -292,7 +294,9 @@ function parseProviders(store: SecretStore, raw: unknown): Parsed<ProvidersConfi
   }
   const providers: ProvidersConfig = {};
   let migrated = false;
-  for (const [key, value] of Object.entries(raw)) {
+  const entries = Object.entries(raw);
+  for (let i = 0, len = entries.length; i < len; i++) {
+    const [key, value] = entries[i];
     const kind = AgentKindSchema.safeParse(key);
     if (!kind.success) {
       logger.warn(

apps/daemon/src/diagnostic-sanitizer.ts

@@ -40,7 +40,9 @@ function sanitizeValue(value: unknown, seen: WeakMap<object, unknown>): unknown
     seen.set(value, sanitized);
     const cause = Reflect.get(value, 'cause');
     if (cause !== undefined) sanitized.cause = sanitizeValue(cause, seen);
-    for (const [key, entry] of Object.entries(value)) {
+    const errorEntries = Object.entries(value);
+    for (let i = 0, len = errorEntries.length; i < len; i++) {
+      const [key, entry] = errorEntries[i];
       sanitized[key] = SENSITIVE_KEY.test(key) ? REDACTED : sanitizeValue(entry, seen);
     }
     return sanitized;
@@ -49,7 +51,10 @@ function sanitizeValue(value: unknown, seen: WeakMap<object, unknown>): unknown
   if (Array.isArray(value)) {
     const sanitized: unknown[] = [];
     seen.set(value, sanitized);
-    for (const entry of value) sanitized.push(sanitizeValue(entry, seen));
+    for (let i = 0, len = value.length; i < len; i++) {
+      const entry = value[i];
+      sanitized.push(sanitizeValue(entry, seen));
+    }
     return sanitized;
   }
 
@@ -59,7 +64,9 @@ function sanitizeValue(value: unknown, seen: WeakMap<object, unknown>): unknown
 
   const sanitized: Record<string, unknown> = {};
   seen.set(value, sanitized);
-  for (const [key, entry] of Object.entries(value)) {
+  const entries = Object.entries(value);
+  for (let i = 0, len = entries.length; i < len; i++) {
+    const [key, entry] = entries[i];
     sanitized[key] = SENSITIVE_KEY.test(key) ? REDACTED : sanitizeValue(entry, seen);
   }
   return sanitized;

apps/daemon/src/index.ts

@@ -43,6 +43,7 @@ import {
 } from './config';
 import { DaemonLoggerLive, logger } from './logger';
 import { createLoopStore } from './loop-store';
+import type { ManagedAgentKind } from './managed-agent-refresh';
 import { agentsToRefresh, consentedManagedAgents } from './managed-agent-refresh';
 import { daemonStateDir } from './paths';
 import { createProviderConfigStore } from './provider-store';
@@ -187,6 +188,23 @@ async function main(): Promise<void> {
       );
       const assets = new AssetManager();
       const consentedAgents = consentedManagedAgents(assets);
+      const refreshAgentRuntime = (kind: ManagedAgentKind): Promise<void> =>
+        assets
+          .ensure(managedAgentAssetId(kind))
+          .catch((err) => {
+            logger.warn(
+              { err, agentKind: kind, operation: 'asset.ensure' },
+              'Managed agent install failed',
+            );
+          })
+          .then((installed) => {
+            if (installed) {
+              logger.info(
+                { agentKind: kind, operation: 'asset.ensure' },
+                'Managed agent runtime ready',
+              );
+            }
+          });
       const gc = assets.gcAtBoot();
       if (gc.removed.length > 0) {
         yield* Effect.logInfo('Removed superseded managed assets', {
@@ -285,23 +303,9 @@ async function main(): Promise<void> {
           const engine = yield* EngineService;
           void agentRuntimesReady
             .then((agentRuntimes) => {
-              for (const kind of agentsToRefresh(consentedAgents, agentRuntimes, assets)) {
-                void assets
-                  .ensure(managedAgentAssetId(kind))
-                  .catch((err) => {
-                    logger.warn(
-                      { err, agentKind: kind, operation: 'asset.ensure' },
-                      'Managed agent install failed',
-                    );
-                  })
-                  .then((installed) => {
-                    if (installed) {
-                      logger.info(
-                        { agentKind: kind, operation: 'asset.ensure' },
-                        'Managed agent runtime ready',
-                      );
-                    }
-                  });
+              const refreshable = agentsToRefresh(consentedAgents, agentRuntimes, assets);
+              for (let i = 0, len = refreshable.length; i < len; i++) {
+                void refreshAgentRuntime(refreshable[i]);
               }
             })
             .catch((err) => {

apps/daemon/src/logger.ts

@@ -56,7 +56,7 @@ export function createDaemonLogger(
       name: 'linkcode-daemon',
       hooks: {
         logMethod(args, method) {
-          for (let index = 0; index < args.length; index += 1) {
+          for (let index = 0, len = args.length; index < len; index += 1) {
             args[index] = sanitizeDiagnostic(args[index]);
           }
           method.apply(this, args);
@@ -78,9 +78,11 @@ export const logger = createDaemonLogger();
 
 function effectBindings(messages: readonly unknown[]): Record<string, string | number> {
   const bindings: Record<string, string | number> = { source: 'effect' };
-  for (const message of messages) {
+  for (let i = 0, len = messages.length; i < len; i++) {
+    const message = messages[i];
     if (typeof message !== 'object' || message === null) continue;
-    for (const key of EFFECT_BINDING_KEYS) {
+    for (let j = 0, keyCount = EFFECT_BINDING_KEYS.length; j < keyCount; j++) {
+      const key = EFFECT_BINDING_KEYS[j];
       const value = Reflect.get(message, key);
       if (typeof value === 'string' || typeof value === 'number') bindings[key] = value;
     }

apps/daemon/src/loop-store.ts

@@ -77,7 +77,8 @@ export function createLoopStore(dbPath: string): LoopStore {
 /** Parse each row through its schema; drop and log a row that fails rather than failing the load. */
 function parseAll<Row, T>(rows: Row[], parse: (row: Row) => T): T[] {
   const parsed: T[] = [];
-  for (const row of rows) {
+  for (let i = 0, len = rows.length; i < len; i++) {
+    const row = rows[i];
     try {
       parsed.push(parse(row));
     } catch {

apps/daemon/src/pty/bench-throughput.mts

@@ -67,7 +67,9 @@ async function runLinkCodePty(
   const pending = new Map<string, { resolve(ms: number): void; reject(error: Error): void }>();
 
   child.stdout.on('data', (chunk: Buffer) => {
-    for (const frame of decoder.feed(chunk)) {
+    const frames = decoder.feed(chunk);
+    for (let i = 0, len = frames.length; i < len; i++) {
+      const frame = frames[i];
       switch (frame.type) {
         case OPENED:
         case OUTPUT:

apps/daemon/src/pty/sidecar.ts

@@ -135,7 +135,11 @@ export class SidecarPtyBackend implements PtyBackend {
     this.child = child;
     child.stdout.on('data', (chunk: Buffer) => {
       try {
-        for (const frame of this.decoder.feed(chunk)) this.handleFrame(frame);
+        const frames = this.decoder.feed(chunk);
+        for (let i = 0, len = frames.length; i < len; i++) {
+          const frame = frames[i];
+          this.handleFrame(frame);
+        }
       } catch (err) {
         logger.error(
           {
@@ -219,7 +223,10 @@ export class SidecarPtyBackend implements PtyBackend {
         const unsub = terminal.exited ? noop : terminal.data.add(cb);
         if (!terminal.dataSubscribed) {
           terminal.dataSubscribed = true;
-          for (const data of terminal.bufferedData) cb(data);
+          for (let i = 0, len = terminal.bufferedData.length; i < len; i++) {
+            const data = terminal.bufferedData[i];
+            cb(data);
+          }
           terminal.bufferedData.length = 0;
         }
         return unsub;
@@ -271,7 +278,10 @@ export class SidecarPtyBackend implements PtyBackend {
     }
     this.pending.clear();
     const terminalIds = Array.from(this.terminals.keys());
-    for (const terminalId of terminalIds) this.finish(terminalId, null, false);
+    for (let i = 0, len = terminalIds.length; i < len; i++) {
+      const terminalId = terminalIds[i];
+      this.finish(terminalId, null, false);
+    }
   }
 }
 

apps/daemon/src/schedule-store.ts

@@ -92,7 +92,8 @@ export function createScheduleStore(dbPath: string): ScheduleStore {
 /** Parse each row through its schema; drop and log a row that fails rather than failing the load. */
 function parseAll<Row, T>(rows: Row[], parse: (row: Row) => T): T[] {
   const parsed: T[] = [];
-  for (const row of rows) {
+  for (let i = 0, len = rows.length; i < len; i++) {
+    const row = rows[i];
     try {
       parsed.push(parse(row));
     } catch {

apps/daemon/src/secrets/custom-mcp-credentials.ts

@@ -28,7 +28,9 @@ export function withCustomMcpSecrets(
   }
   const values = { ...(server[field] as Record<string, unknown>) };
   let migrated = false;
-  for (const [key, value] of Object.entries(values)) {
+  const valueEntries = Object.entries(values);
+  for (let i = 0, len = valueEntries.length; i < len; i++) {
+    const [key, value] = valueEntries[i];
     if (typeof value === 'string') {
       store.set(secretKey(generation, entry.id, field, key), value);
       migrated = true;
@@ -52,7 +54,9 @@ export function detachCustomMcpSecrets(
     const values = entry.server.type === 'stdio' ? entry.server.env : entry.server.headers;
     if (values === undefined) return entry;
     const placeholders: Record<string, null> = {};
-    for (const [key, value] of Object.entries(values)) {
+    const valueEntries = Object.entries(values);
+    for (let i = 0, len = valueEntries.length; i < len; i++) {
+      const [key, value] = valueEntries[i];
       secrets.set(secretKey(generation, entry.id, field, key), value);
       placeholders[key] = null;
     }