fix: slim CLI package and enforce clean linting

.github/workflows/ci.yml

@@ -15,6 +15,7 @@ jobs:
           node-version: "22"
           cache: npm
       - run: npm install
+      - run: npm run lint
       - run: npm run build
       - run: npm test
       - name: Umami proxy tests

biome.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.5.10/schema.json",
+  "files": {
+    "includes": [
+      "**",
+      "!packages/cli/dist",
+      "!website/.docusaurus",
+      "!website/build",
+      "!coverage"
+    ]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "preset": "recommended"
+    }
+  },
+  "overrides": [
+    {
+      "includes": ["website/static/img/logo.svg"],
+      "linter": {
+        "rules": {
+          "a11y": {
+            "noSvgWithoutTitle": "off"
+          }
+        }
+      }
+    }
+  ],
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "double",
+      "trailingCommas": "all"
+    }
+  }
+}

infra/umami-proxy/src/index.ts

@@ -10,7 +10,6 @@
  */
 
 import {
-  COLLECT_PATH,
   ORIGIN_COLLECT,
   ORIGIN_SCRIPT,
   matchProxyPath,

package.json

@@ -11,6 +11,9 @@
     "prepare": "node scripts/link-skills.mjs && node scripts/sync-hooks.mjs",
     "build": "npm run build -w @chtnnh/know-code",
     "build:docs": "npm run build -w website",
+    "lint": "biome lint .",
+    "lint:fix": "biome lint --write .",
+    "format:check": "biome format .",
     "test": "npm run test -w @chtnnh/know-code",
     "smoke": "bash scripts/smoke-enforcement.sh",
     "smoke:verify": "bash scripts/smoke-verify-ci.sh",
@@ -26,5 +29,8 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/chtnnh/know-code.git"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.10"
   }
 }

packages/cli/package.json

@@ -11,6 +11,9 @@
   "files": [
     "bin",
     "dist",
+    "!dist/**/*.test.*",
+    "!dist/test-helpers.*",
+    "!dist/**/*.map",
     "hooks",
     "README.md",
     "LICENSE"

packages/cli/src/cli-surface.test.ts

@@ -192,7 +192,7 @@ describe("cli surface (spawned)", () => {
       assert.equal(r.status, 0);
       const session = readRangeSession(root);
       assert.ok(session, "expected a new range session");
-      assert.equal(session!.fromOid, head);
+      assert.equal(session?.fromOid, head);
     } finally {
       cleanup();
     }

packages/cli/src/commands-core.test.ts

@@ -283,7 +283,7 @@ describe("commands: config / init / quiz / doctor / reset / ship", () => {
     assert.match(workflow, /github\.event\.before/);
     assert.match(workflow, /github\.event\.pull_request\.head\.sha \|\| github\.sha/);
     assert.match(workflow, /new branch push/);
-    assert.match(workflow, /else\n            know-code verify\n/);
+    assert.match(workflow, /else\n {12}know-code verify\n/);
 
     const action = readFileSync(join(repoRoot, "action", "action.yml"), "utf8");
     assert.match(action, /actions\/setup-node@v5/);
@@ -333,10 +333,12 @@ describe("commands: config / init / quiz / doctor / reset / ship", () => {
       const checks = await runDoctor(root);
       const hooks = checks.find((c) => c.name === "git-hooks");
       assert.ok(hooks);
-      assert.equal(hooks!.ok, false);
+      assert.equal(hooks.ok, false);
       installGitHooks(root);
       const after = await runDoctor(root);
-      assert.equal(after.find((c) => c.name === "git-hooks")!.ok, true);
+      const hooksAfterInstall = after.find((c) => c.name === "git-hooks");
+      assert.ok(hooksAfterInstall);
+      assert.equal(hooksAfterInstall.ok, true);
     } finally {
       cleanup();
     }

packages/cli/src/commands/amend.ts

@@ -21,7 +21,7 @@ export function buildAmendArgs(
 ): string[] {
   const noTrailer = rawArgs.includes("--no-trailer");
   const gitArgs = rawArgs.filter((a) => a !== "--no-trailer");
-  let finalArgs = ["--amend", ...gitArgs];
+  const finalArgs = ["--amend", ...gitArgs];
 
   if (noTrailer) return finalArgs;
 

packages/cli/src/commands/check.ts

@@ -128,19 +128,20 @@ export function cmdCheck(opts: RunCheckOptions = {}): never {
         "know-code: KNOW_CODE_OVERRIDE=1 — check passed via human override (logged).",
       );
     } else if (isSealedRewriteRangeOpen(repoRoot)) {
-      const seal = readRangeSeal(repoRoot)!;
+      const seal = readRangeSeal(repoRoot);
+      if (!seal) throw new Error("sealed rewrite range missing seal");
       console.error(
         `know-code: gate open (sealed rewrite range) for ${seal.diffHash.slice(0, 12)}…`,
       );
     } else {
       const receipt = readGateSafe(repoRoot);
       if (commitDrift) {
         console.error(
-          `know-code: gate open (${receipt!.level}, ${ctx.scope}) — tree unchanged since pass (${effectiveHash.slice(0, 12)}…)`,
+          `know-code: gate open (${receipt?.level}, ${ctx.scope}) — tree unchanged since pass (${effectiveHash.slice(0, 12)}…)`,
         );
       } else {
         console.error(
-          `know-code: gate open (${receipt!.level}, ${ctx.scope}) for ${ctx.diffHash.slice(0, 12)}…`,
+          `know-code: gate open (${receipt?.level}, ${ctx.scope}) for ${ctx.diffHash.slice(0, 12)}…`,
         );
       }
     }

packages/cli/src/commands/config.ts

@@ -1,4 +1,4 @@
-import { readConfig, setConfigValue, writeConfig } from "../config.js";
+import { readConfig, setConfigValue } from "../config.js";
 import { resolveQuizContext } from "../hash.js";
 import {
   findGitRoot,