Code Quality & Linting
Relevant source files
The following files were used as context for generating this wiki page:
Code quality and linting within the SweepBot project are governed by a strict "zero warnings" policy and a multi-layered validation strategy. This system ensures that the monorepo—spanning the Fastify API, React dashboard, and browser extension—maintains high standards of type safety, consistent formatting, and architectural integrity. The project utilizes a combination of TypeScript strict mode, ESLint 9, and pre-commit hooks to enforce these standards across all packages.
The primary objective is to prevent common vulnerabilities, such as unsafe code execution (e.g., new Function() evals) and unhandled errors, while ensuring a unified developer experience. Documentation and quality assurance are primarily managed by a dedicated DevOps and QA specialist (Agent 4), who oversees the CI/CD pipelines and testing infrastructure.
Sources: CLAUDE.md:68-69, AGENTS.md:5-7, AGENT_4_DEVOPS_DOCS.md:10-15
Enforcement Mechanisms
SweepBot employs several automated tools to maintain code health. These tools are integrated into the development workflow via pnpm commands and automated via Husky pre-commit hooks.
Core Quality Tools
| Tool | Purpose | Configuration/Policy |
|---|---|---|
| ESLint | Static code analysis | Version 9 enforcement; 0 warnings policy |
| TypeScript | Type safety | Strict mode everywhere; no any in core logic |
| Prettier | Code formatting | Enforced on TS, JSON, MD, CSS, and YAML |
| Vitest | Unit/Integration testing | Target: 80%+ coverage |
| Husky/lint-staged | Pre-commit validation | Runs linting and formatting on staged files |
Sources: CLAUDE.md:28-36, CLAUDE.md:68-69, CODEBASE_IMPROVEMENTS.md:120-125, PR_CODE_REVIEW_FIXES.md:92-95
Automated Quality Flow
The diagram below illustrates the sequence of checks a code change must pass before it is eligible for merging into the protected main branch.
TypeScript and Schema Validation
The project mandates a strict TypeScript configuration. Developers are prohibited from using the any type in core logic; instead, they must use unknown and perform proper type narrowing.
Zod Integration
To bridge the gap between static types and runtime data, the project uses Zod for all API input validation. This ensures that raw data from request.body is never trusted until it matches a predefined schema. These shared schemas are centrally located in packages/types/ to prevent "schema drift" between the backend and frontend.
Key Validation Patterns
- User Schemas:
userProfileSchema,updateProfileSchema - Session Schemas:
sessionSchema,createSessionSchema - Form Schemas:
loginSchema,signupSchema,changePasswordSchema
Sources: CLAUDE.md:68-71, AGENTS.md:105-108, CODEBASE_IMPROVEMENTS.md:90-105
Error Handling and Observability
A major component of SweepBot's quality strategy is the recent overhaul of error handling and the introduction of structured logging.
Error Boundaries
The React dashboard utilizes custom Error Boundaries to prevent the "white screen of death." These boundaries are integrated with Sentry for automatic production error reporting and provide users with reset/reload actions.
Sources: CODEBASE_IMPROVEMENTS.md:35-42, PR_CODE_REVIEW_FIXES.md:25-30
Structured Logging
SweepBot has moved away from console.log in favor of a centralized logger located in packages/utils/src/logger.ts. This logger supports:
- Environment-based levels: debug, info, warn, error.
- Scoped contexts: module-specific loggers.
- Remote ingestion: support for posting JSON logs to a remote endpoint in production.
Sources: CODEBASE_IMPROVEMENTS.md:25-32, CODEBASE_IMPROVEMENTS.md:130-145
Testing Infrastructure
Testing is segmented into unit, integration, and E2E levels. While some core packages like packages/flows have high coverage (80%+), other areas like the API are undergoing production hardening to address gaps.
Testing Commands
pnpm test # Run all Vitest suites
pnpm test:watch # Watch mode for active development
pnpm test:coverage # Generate coverage reports
pnpm --filter @sweepbot/web test:e2e # Playwright/Puppeteer E2E tests
Sources: CLAUDE.md:21-26, AGENT_4_DEVOPS_DOCS.md:25-30
Quality Improvements Checklist
A "Production-Ready" audit identified several critical fixes implemented to stabilize the codebase:
- Test Infrastructure: Fixed missing testing dependencies for
@testing-library. - Environment Validation: Added Zod-based validation for
.envfiles at startup to "fail fast" if configurations are missing. - API Resilience: Added exponential backoff and request deduplication to the enhanced API client.
Sources: CODEBASE_IMPROVEMENTS.md:12-23, CODEBASE_IMPROVEMENTS.md:50-65, CODEBASE_IMPROVEMENTS.md:75-85
Security Standards
Quality standards extend to security, particularly concerning sensitive data and unsafe code patterns.
- Sensitive Data: Local settings like
.claude/settings.local.jsonare strictly excluded from git tracking. - Unsafe Patterns: The project has actively replaced
new Function()evals with safe arithmetic parsers to mitigate code injection risks. - Audit Logging: Production hardening includes the implementation of audit logging middleware to track client IPs and request timing, though it requires care to prevent IP spoofing via
x-forwarded-forheaders.
Sources: PR_CODE_REVIEW_FIXES.md:10-15, PR_CODE_REVIEW_FIXES.md:92-95, PR_CODE_REVIEW_FIXES.md:105-110
Conclusion
The "Code Quality & Linting" framework in SweepBot is a comprehensive system designed to ensure reliability across a complex monorepo. By combining strict TypeScript enforcement, centralized Zod schemas, and a "zero warnings" ESLint policy, the project minimizes technical debt and runtime failures. Continuous monitoring via structured logging and the ongoing expansion of the Vitest/Playwright test suites remain the cornerstone of the project's path to production readiness.