improvement(audits): lint tracked uploads source, reject any/! suppressions, name-check root scripts

Anchor biome's build/out/uploads ignores to the real output and runtime
dirs so apps/sim/lib/uploads and the uploads API routes are linted and
counted by check:explicit-any (baseline grows only under those paths).
check:explicit-any fails on biome-ignore comments for its two rules.
check:file-names scans root scripts/ and vitest.shared.ts, allows Next.js
interception segments and dot-prefixed names, ignores the old path of an
unstaged mv, and points tool-mandated names at its allowlist. All three
ratchets print a rename hint instead of only the shrink instruction.

Author: waleedlatif1

apps/sim/lib/uploads/contexts/workspace/workspace-file-manager-errors.test.ts

@@ -1,5 +1,5 @@
 import { dbChainMockFns, queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing'
-import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterAll, beforeEach, describe, expect, it } from 'vitest'
 import { listWorkspaceFiles } from './workspace-file-manager'
 
 afterAll(resetDbChainMock)

apps/sim/lib/uploads/server/markdown-export.test.ts

@@ -40,7 +40,7 @@ describe('Markdown export image rewriting', () => {
 
   it('returns large documents verbatim before parsing or fetching assets', async () => {
     const content = Buffer.from(
-      '![image](/api/files/view/image-1)\n' + 'a'.repeat(MAX_EXPORT_MARKDOWN_PARSE_BYTES)
+      `![image](/api/files/view/image-1)\n${'a'.repeat(MAX_EXPORT_MARKDOWN_PARSE_BYTES)}`
     )
     const result = await createMarkdownExport({
       content,

biome.json

@@ -8,9 +8,13 @@
       "!**/.next",
       "!**/.next",
       "!**/next-env.d.ts",
-      "!**/out",
+      "!out",
+      "!apps/*/out",
+      "!packages/*/out",
       "!**/dist",
-      "!**/build",
+      "!build",
+      "!apps/*/build",
+      "!packages/*/build",
       "!**/node_modules",
       "!**/.bun",
       "!**/.cache",
@@ -32,7 +36,8 @@
       "!**/apps/desktop/release",
       "!**/venv",
       "!**/.venv",
-      "!**/uploads",
+      "!uploads",
+      "!apps/*/uploads",
       "!**/apps/sim/lib/execution/sandbox/bundles/*.cjs",
       "!**/test-results",
       "!**/playwright-report"

scripts/check-explicit-any.baseline.json

@@ -251,6 +251,7 @@
     "apps/sim/lib/table/llm/enrichment.ts": 2,
     "apps/sim/lib/table/snapshot-cache.test.ts": 1,
     "apps/sim/lib/tokenization/utils.ts": 1,
+    "apps/sim/lib/uploads/archive.test.ts": 1,
     "apps/sim/lib/webhooks/providers/sendblue.test.ts": 2,
     "apps/sim/lib/webhooks/providers/twilio.test.ts": 5,
     "apps/sim/lib/webhooks/providers/vercel.test.ts": 2,
@@ -1690,6 +1691,13 @@
     "apps/sim/lib/table/validation.ts": 3,
     "apps/sim/lib/table/workflow-groups/service.ts": 2,
     "apps/sim/lib/tokenization/accurate.ts": 1,
+    "apps/sim/lib/uploads/archive.test.ts": 1,
+    "apps/sim/lib/uploads/client/download.test.ts": 1,
+    "apps/sim/lib/uploads/contexts/copilot/copilot-file-manager.test.ts": 1,
+    "apps/sim/lib/uploads/contexts/organization-logo/application.integration.ts": 1,
+    "apps/sim/lib/uploads/contexts/workspace/workspace-file-manager-page.test.ts": 1,
+    "apps/sim/lib/uploads/server/markdown-export.test.ts": 1,
+    "apps/sim/lib/uploads/server/markdown-export.ts": 3,
     "apps/sim/lib/users/application/authorized-apps.test.ts": 4,
     "apps/sim/lib/webhooks/pending-verification.test.ts": 2,
     "apps/sim/lib/webhooks/polling/google-calendar.ts": 1,

scripts/check-explicit-any.ts

@@ -6,12 +6,14 @@
  * `suspicious/noExplicitAny` and `style/noNonNullAssertion` are off repo-wide because thousands of
  * existing hits predate the rule. With the rules off nothing stops a new one, and an agent copying
  * a nearby `as any` has no signal it is wrong. This check runs exactly those two Biome rules (the
- * same parser, ignore list, and `any` forms Biome knows: `: any`, `as any`, `<any>`, `any[]`) and
- * compares per-file counts with `scripts/check-explicit-any.baseline.json`.
+ * same parser and `any` forms Biome knows: `: any`, `as any`, `<any>`, `any[]`) and compares
+ * per-file counts with `scripts/check-explicit-any.baseline.json`. It uses Biome's file list, so it
+ * inherits every ignore in `biome.json`.
  *
  * - A file whose count rises, or a file that gains its first hit, fails.
  * - A file whose count drops fails until the baseline is rewritten, so the baseline only shrinks
  *   and a fix cannot be silently spent on a new `any` elsewhere in the same file.
+ * - A `biome-ignore` comment for either rule fails outright: it would hide a hit from the count.
  *
  * Regenerate after removing hits: `bun run scripts/check-explicit-any.ts --update`.
  *
@@ -75,6 +77,21 @@ function collect(): Baseline {
   return counts
 }
 
+/** `biome-ignore` comments for either rule, which would hide a hit from Biome's count. */
+function suppressions(): string[] {
+  const pattern = `biome-ignore(-all|-start)?[[:space:]]+(${Object.values(METRICS).join('|')})`
+  const result = Bun.spawnSync(
+    ['git', 'grep', '-nE', '--untracked', pattern, '--', 'apps', 'packages', 'scripts'],
+    { cwd: ROOT, stdout: 'pipe', stderr: 'pipe' }
+  )
+  // git grep exits 1 when nothing matches.
+  if (result.exitCode > 1) {
+    console.error(`git grep failed:\n${result.stderr.toString()}`)
+    process.exit(1)
+  }
+  return result.stdout.toString().split('\n').filter(Boolean)
+}
+
 function sorted(counts: Counts): Counts {
   return Object.fromEntries(
     Object.keys(counts)
@@ -141,6 +158,17 @@ if (process.argv.includes('--update')) {
 
 let regressed = 0
 let stale = 0
+/** A vanished baselined file next to a new file with no more hits: likely a rename. */
+const renames = new Set<string>()
+
+const suppressed = suppressions()
+if (suppressed.length) {
+  console.error(
+    `✗ ${suppressed.length} biome-ignore comment(s) hide an \`any\` or \`!\` from this check:`
+  )
+  for (const line of suppressed) console.error(`  ${line}`)
+  console.error('  Delete the suppression and fix the type instead.\n')
+}
 
 for (const metric of Object.keys(METRICS) as Metric[]) {
   const before = baseline[metric] ?? {}
@@ -153,6 +181,13 @@ for (const metric of Object.keys(METRICS) as Metric[]) {
   const shrunk = Object.entries(before)
     .filter(([file, count]) => (after[file] ?? 0) < count)
     .map(([file, count]) => `  ${file}: ${after[file] ?? 0} (baseline ${count})`)
+  for (const [oldFile, oldCount] of Object.entries(before)) {
+    if (oldFile in after) continue
+    const renamed = Object.entries(after).find(
+      ([file, count]) => !(file in before) && count <= oldCount
+    )
+    if (renamed) renames.add(`${oldFile} → ${renamed[0]}`)
+  }
   if (regressions.length) {
     console.error(`✗ ${metric}: ${regressions.length} file(s) gained ${METRICS[metric]} hits`)
     console.error(regressions.sort().join('\n'))
@@ -169,14 +204,20 @@ for (const metric of Object.keys(METRICS) as Metric[]) {
   stale += shrunk.length
 }
 
-if (regressed || stale) {
+if (regressed || stale || suppressed.length) {
   if (stale) {
     console.error(
       '\nCounts dropped — shrink the baseline so they cannot creep back: ' +
         'bun run scripts/check-explicit-any.ts --update'
     )
   }
   if (regressed) console.error('\nNever raise the baseline to make a new `any` or `!` pass.')
+  for (const rename of renames) {
+    console.error(
+      `\nLooks like a rename: ${rename}. Move its baseline entries to the new path in ` +
+        `${path.relative(ROOT, BASELINE)} (debt carries over; it may not grow).`
+    )
+  }
   process.exit(1)
 }
 

scripts/check-file-names.ts

@@ -1,20 +1,22 @@
 #!/usr/bin/env bun
 /**
- * Enforces the file-naming conventions in `CLAUDE.md` ("files kebab-case") and
- * `.claude/rules/sim-architecture.md`, so an agent can predict a module's path from its role and
- * never has to guess between `workflowList.ts`, `workflow_list.ts`, and `workflow-list.ts`.
+ * Enforces the file-naming conventions in `CLAUDE.md` "Naming" ("files kebab-case"), so an agent
+ * can predict a module's path from its role and never has to guess between `workflowList.ts`,
+ * `workflow_list.ts`, and `workflow-list.ts`.
  *
- * Rules, over every JS/TS source file under `apps/` and `packages/` (tracked or untracked, never
- * gitignored, so a file is checked before it is staged):
+ * Rules, over every JS/TS source file under `apps/`, `packages/`, root `scripts/`, and
+ * `vitest.shared.ts` (tracked or untracked, never gitignored, so a file is checked before it is
+ * staged). Dot-prefixed folders and files (`.well-known`, `.eslintrc.cjs`) are exempt: their names
+ * are mandated by the tool that reads them.
  *
  * - `kebab-case`: every path segment below the workspace root is kebab-case. Dotted suffixes
  *   (`.test.ts`, `.server.ts`, `.d.ts`, `.config.ts`) are kebab segments too. Allowed exceptions,
  *   each forced by something outside our control:
  *     - Next.js routing segments: `[param]`, `[...slug]`, `[[...slug]]`, `(group)`, `@slot`,
- *       `_private` folders, and metadata route folders named after their URL (`robots.txt`).
+ *       interception routes (`(.)x`, `(..)x`, `(..)(..)x`, `(...)x`), `_private` folders, and
+ *       metadata route folders named after their URL (`robots.txt`).
  *     - Vitest/fixture folders wrapped in double underscores (`__integration__`, `__fixtures__`).
- *     - `.well-known`, and the SCIM v2 resource folders (`Users`, `Groups`, …) whose casing is
- *       fixed by RFC 7644.
+ *     - The SCIM v2 resource folders (`Users`, `Groups`, …) whose casing is fixed by RFC 7644.
  *     - Integration folders (`apps/sim/{tools,triggers}/**`, `apps/sim/blocks/blocks/*`) may be
  *       snake_case: a tool file and its service folder are named after the snake_case tool or
  *       block id (`tools/google_sheets/append_row.ts`), and that id is the integration's identity.
@@ -45,6 +47,7 @@ const KEBAB = /^[a-z0-9]+(?:-[a-z0-9]+)*$/
 const KEBAB_OR_SNAKE = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/
 const NEXT_DYNAMIC = /^\[{1,2}(?:\.\.\.)?[A-Za-z][A-Za-z0-9]*\]{1,2}$/
 const NEXT_GROUP = /^\([a-z0-9]+(?:-[a-z0-9]+)*\)$/
+const NEXT_INTERCEPT = /^(?:\(\.{1,3}\)|(?:\(\.\.\))+)[a-z0-9]+(?:-[a-z0-9]+)*$/
 const NEXT_SLOT = /^@[a-z0-9]+(?:-[a-z0-9]+)*$/
 const NEXT_PRIVATE = /^_[a-z0-9]+(?:-[a-z0-9]+)*$/
 const DUNDER = /^__[a-z0-9]+(?:-[a-z0-9]+)*__$/
@@ -81,10 +84,24 @@ interface Violation {
 function sourceFiles(): string[] {
   const output = execFileSync(
     'git',
-    ['ls-files', '--cached', '--others', '--exclude-standard', '-z', 'apps', 'packages'],
+    [
+      'ls-files',
+      '--cached',
+      '--others',
+      '--exclude-standard',
+      '-z',
+      'apps',
+      'packages',
+      'scripts',
+      'vitest.shared.ts',
+    ],
     { cwd: ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }
   )
-  return [...new Set(output.split('\0'))].filter((file) => SOURCE_FILE.test(file)).sort()
+  // existsSync drops the old path of an unstaged `mv`, which `--cached` still lists.
+  return [...new Set(output.split('\0'))]
+    .filter((file) => SOURCE_FILE.test(file) && !path.basename(file).startsWith('.'))
+    .filter((file) => existsSync(path.join(ROOT, file)))
+    .sort()
 }
 
 function toKebab(name: string): string {
@@ -101,10 +118,11 @@ function isAllowedFolder(segment: string, file: string, inIntegration: boolean):
   if (
     NEXT_DYNAMIC.test(segment) ||
     NEXT_GROUP.test(segment) ||
+    NEXT_INTERCEPT.test(segment) ||
     NEXT_SLOT.test(segment) ||
     NEXT_PRIVATE.test(segment) ||
     DUNDER.test(segment) ||
-    segment === '.well-known'
+    segment.startsWith('.')
   ) {
     return true
   }
@@ -132,7 +150,8 @@ function check(file: string): Violation[] {
   const violations: Violation[] = []
   const segments = file.split('/')
   const name = segments[segments.length - 1]
-  const folders = segments.slice(2, -1)
+  // Root `scripts/` belongs to the root workspace; apps/<name>/ and packages/<name>/ are roots.
+  const folders = segments.slice(segments[0] === 'scripts' ? 1 : 2, -1)
   const inIntegration = INTEGRATION_PREFIXES.some((prefix) => file.startsWith(prefix))
 
   if (!SCRIPT_MIGRATION.test(file)) {
@@ -184,7 +203,8 @@ const HOW_TO_FIX: Record<Rule, string> = {
   'redundant-suffix':
     'The utils/ or helpers/ folder already names the role; drop the suffix from the file name.',
   stutter:
-    'The parent folder already names the domain; drop the repeated prefix (lib/logs/log-views.ts → lib/logs/views.ts). If the short name collides, pick a more specific one.',
+    'The parent folder already names the domain; drop the repeated prefix (lib/logs/log-views.ts → lib/logs/views.ts). If the short name collides, pick a more specific one. ' +
+    'Existing `handlers/<x>/<x>-handler.ts` files are baselined debt, not a convention to copy.',
 }
 
 function key(violation: Violation): string {
@@ -239,7 +259,8 @@ if (added.length || stale.length) {
   if (added.length) {
     console.error(
       `\n${added.length} new file-name violation(s). Rename the file and update its importers; ` +
-        'never add a new file to the baseline.'
+        'never add a new file to the baseline. A name mandated by an outside tool goes in the ' +
+        'allowlist at the top of scripts/check-file-names.ts with a comment saying why.'
     )
   }
   if (stale.length) {
@@ -249,6 +270,15 @@ if (added.length || stale.length) {
         'baseline: bun run scripts/check-file-names.ts --update'
     )
   }
+  for (const entry of added) {
+    const old = stale.find((s) => s.split('\t')[0] === entry.split('\t')[0])
+    if (old) {
+      console.error(
+        `\nLooks like a rename: ${old.split('\t')[1]} → ${entry.split('\t')[1]}. Move its baseline ` +
+          `entry to the new path in ${path.relative(ROOT, BASELINE)} (debt carries over; it may not grow).`
+      )
+    }
+  }
   process.exit(1)
 }