Audit unknown-type lint workarounds (Fixes #2159)

[acoliver]

TLDR

Documents the completed unknown-abuse audit for issue #2159. The audit covers 4,359 in-scope rows at the audited commit: 4,340 casts and 19 retained production-state annotations. It classifies 14 rows as ABUSE and 4,345 as LEGITIMATE BOUNDARY.

No production remediation is included. The accepted abuse rows are assigned to existing or new follow-up issues.

Dive Deeper

project-plans/issue2159/PLAN.md now records:

• the executable AST scan and reconciliation procedure
• the correction from the earlier 4,211-cast count, including the 129 casts in files directly under package src directories
• the complete binary classification and the 14 accepted abuse rows
• GitHub publication across the issue summary and 37 inventory comments
• follow-up coverage in Remove CLI/IDE internal unknown widening (Follow-up to #2159) #2194, Parse tool output token limits without re-widening to unknown (Follow-up to #2159) #2195, Make core prompt utility boundaries honest instead of widening to unknown (Follow-up to #2159) #2196, Remove unreachable telemetry decision sentinel widening (Follow-up to #2159) #3396, Parse persisted MCP OAuth expiry values before trusted token use (Follow-up to #2159) #3397, Normalize provider content before TodoContinuationService narrowing (Follow-up to #2159) #3398, and Repair core prompt, history, and shell invocation trust boundaries (Follow-up to #2159) #3399
• the distinction between accepted abuse and separate proxy, formatter, and IDE cleanup work

The issue was closed after the audit, inventory, and follow-up links were visible on GitHub.

Reviewer Test Plan

1. Read the scope and result at the start of project-plans/issue2159/PLAN.md.
2. Run the checked-in audit and reconciliation commands from the plan.
3. Confirm the reconciliation output reports audit=4359, inventory=4359, unique=4359, abuse=14, legitimate=4345, and zero missing, extra, duplicate, invalid-verdict, or empty-justification rows.
4. Open Audit codebase for unknown-type abuse used to silence lint rules #2159 and confirm the summary plus all 37 inventory comments are present.
5. Confirm each accepted abuse cluster is linked to one of the listed follow-up issues.

Local verification passed on macOS:

• npm run test
• npm run lint
• npm run typecheck
• npm run format
• npm run build
• bun scripts/start.ts --profile-load stepfun-37 "write me a haiku and nothing else"
• final Open Code Review with zai-coding-plan/glm-4.7

Testing Matrix

	🍏	🪟	🐧
npm run	✅	❓	❓
npx	-	-	-
Docker	-	-	-
Podman	-	-	-
Seatbelt	-	-	-

Linked issues / bugs

Fixes #2159

Follow-up remediation: #2194, #2195, #2196, #3396, #3397, #3398, and #3399.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• project-plans/issue2159/INVENTORY.md is excluded by !project-plans/**
• project-plans/issue2159/PLAN.md is excluded by !project-plans/**

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0b4ae98b-1dd6-4b37-a331-cc83691ab6bf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[acoliver]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

No files to review.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[github-actions]

OpenCodeReview — PR #3405

• Reviewed head SHA: 0cfd4ef0dda69b3cf90af94a272aafbac9fa8bed
• Merge base: 2fadb59ac222308eee31e367a1c5b736f9ee7871
• Range: full from 2fadb59ac222308eee31e367a1c5b736f9ee7871
• Range fallback: none
• Scope: selected 2 file(s), +5001/-0; cumulative 2 file(s), +5001/-0
• Tokens: 0 total (0 input, 0 output, 0 cache)
• OCR version: open-code-review v1.8.4 (e78474478) linux/amd64 built at: 2026-08-01T03:27:37Z https://github.com/alibaba/open-code-review
• Phase: no-reviewable-files
• Exit code: 0
• Run: https://github.com/vybestack/llxprt-code/actions/runs/33167836406
• Partial review: 0 of 0 files completed (0 failed).
• Artifacts: ocr-review-output contains raw JSON, stdout, stderr, preview, phase, and exit-code diagnostics.

[github-actions]

Walkthrough

Before this PR, issue #2159 identified a codebase-wide anti-pattern where internal values were widened to unknown solely to silence TypeScript/lint checks, but the repo lacked a durable, reviewable record of every audited site and how it was classified. After this PR, the audit is captured in project-plans/issue2159/PLAN.md and project-plans/issue2159/INVENTORY.md: the scan and reconciliation methodology are documented, the 4,359-row inventory is preserved, 14 rows are classified as ABUSE and 4,345 as LEGITIMATE BOUNDARY, and each accepted abuse cluster is linked to a follow-up issue for later remediation.

Release Notes

Documentation

• Added the completed issue Audit codebase for unknown-type abuse used to silence lint rules #2159 audit record, including the executable AST scan/reconciliation methodology, scope decisions, and final 4,359-row inventory.
• Documented the binary classification outcome: 14 accepted ABUSE rows and 4,345 LEGITIMATE BOUNDARY rows, with clarifications for test fixtures, mocks, and retained production-state annotations.
• Recorded the follow-up remediation plan and issue links for Remove CLI/IDE internal unknown widening (Follow-up to #2159) #2194, Parse tool output token limits without re-widening to unknown (Follow-up to #2159) #2195, Make core prompt utility boundaries honest instead of widening to unknown (Follow-up to #2159) #2196, Remove unreachable telemetry decision sentinel widening (Follow-up to #2159) #3396, Parse persisted MCP OAuth expiry values before trusted token use (Follow-up to #2159) #3397, Normalize provider content before TodoContinuationService narrowing (Follow-up to #2159) #3398, and Repair core prompt, history, and shell invocation trust boundaries (Follow-up to #2159) #3399.
• Clarified that this change is analysis/tracking only and does not modify production code, tests, dependencies, workflows, settings, quality tools, or lint policy.

Changes

Layer	File(s)	Summary
docs	project-plans/issue2159/INVENTORY.md, project-plans/issue2159/PLAN.md	Documents the audit methodology, inventory reconciliation, and abuse verdicts for TypeScript unknown casts in issue #2159.

Magnitude

🎯 3 (L)
5001 additions, 0 deletions, 2 changed files across 0 packages, 9 acceptance criteria

Related

• Audit codebase for unknown-type abuse used to silence lint rules #2159: related because it is the root audit issue whose unknown-type inventory and abuse verdicts PR Audit unknown-type lint workarounds (Fixes #2159) #3405 documents
• Remove CLI/IDE internal unknown widening (Follow-up to #2159) #2194: related because it is a direct follow-up that removes the CLI/IDE internal unknown-widening rows classified as abuse in Audit codebase for unknown-type abuse used to silence lint rules #2159
• Parse tool output token limits without re-widening to unknown (Follow-up to #2159) #2195: related because it is a direct follow-up that fixes the tool-output limiter re-widening-to-unknown pattern identified in Audit codebase for unknown-type abuse used to silence lint rules #2159
• Make core prompt utility boundaries honest instead of widening to unknown (Follow-up to #2159) #2196: related because it is a direct follow-up that makes core prompt-loader boundaries honest instead of widening to unknown, per Audit codebase for unknown-type abuse used to silence lint rules #2159
• Remove unreachable telemetry decision sentinel widening (Follow-up to #2159) #3396: related because it is a direct follow-up that removes an unreachable telemetry decision sentinel widening flagged in Audit codebase for unknown-type abuse used to silence lint rules #2159
• Parse persisted MCP OAuth expiry values before trusted token use (Follow-up to #2159) #3397: related because it is a direct follow-up that parses persisted MCP OAuth expiry values before trusted token use, fixing an abuse row from Audit codebase for unknown-type abuse used to silence lint rules #2159
• Normalize provider content before TodoContinuationService narrowing (Follow-up to #2159) #3398: related because it is a direct follow-up that normalizes provider content before TodoContinuationService narrowing, addressing an abuse row from Audit codebase for unknown-type abuse used to silence lint rules #2159
• Repair core prompt, history, and shell invocation trust boundaries (Follow-up to #2159) #3399: related because it is a direct follow-up that repairs core prompt, history, and shell invocation trust boundaries identified in Audit codebase for unknown-type abuse used to silence lint rules #2159
• PR Type internal profile and IDE context state honestly (Fixes #2194) #3316: related because it implements the CLI/IDE internal unknown-widening cleanup tracked by Remove CLI/IDE internal unknown widening (Follow-up to #2159) #2194
• PR Make core prompt utility boundaries honest instead of widening to unknown (Fixes #2196) #3280: related because it implements the core prompt-loader and adjacent utility review tracked by Make core prompt utility boundaries honest instead of widening to unknown (Follow-up to #2159) #2196

Pre-merge Checks

Check	Status	Note
Title	✅	Clear and descriptive: it states the audit scope and the issue being fixed.
Description	✅	Includes the expected template sections: TLDR, Dive Deeper, Reviewer Test Plan, Testing Matrix, and Linked issues / bugs.
Linked Issues	❌	The PR claims to fulfill #2159, but the referenced plan/inventory artifacts under project-plans/issue2159 are not present in the working tree, so the documented audit deliverables cannot be verified from the actual code changes.
Out of Scope	—	The actual changes are documentation-only (PLAN.md and INVENTORY.md); no production code, tests, or dependency changes are included. The PR description lists local verification commands, but those are not represented in the supplied actual code changes.

---

Walkthrough generated by LLxprt PR Review. Planner issue: #2256

[acoliver]

Correction to the automated walkthrough: this PR changes only project-plans/issue2159/PLAN.md and project-plans/issue2159/INVENTORY.md. It does not modify lint guards, directive scanning, or runtime behavior. The PR description and linked issue state the intended audit-and-tracking scope.