chore: tooling refresh (type-aware oxlint, lefthook, CI-gated release, dependency bumps)

[BrainerVirus]

What it does

Slice S7 from docs/workit-next/plan.md: tooling, CI and release refresh. Five focused commits:

1. build(deps): zod 4.5.4 → 4.6.5, @modelcontextprotocol/sdk 1.30.0 → 1.32.0, @opencode-ai/plugin 1.18.30 → 1.18.34 (the support-matrix current and CI env move with it; the 1.18.30 floor stays), oxlint 1.86.0, oxfmt 0.71.0, knip 6.39.0, @semantic-release/npm 13.2.0 and /github 12.0.10. All pins stay exact.
   • conventional-changelog-conventionalcommits goes to 9.3.1, not 10.x. 10.x needs conventional-changelog-writer@9. @semantic-release/release-notes-generator 14.1.1 (the latest) still ships writer@8, so 10.x fails with a "Missing helper" error at render time. I checked this by rendering notes through the generator: 9.3.1 produces the same output as 8.0.0.
   • schema-depth.test.ts passes on zod 4.6.5 with no changes.
2. chore(lint): adds .oxlintrc.json and .oxfmtrc.json, which now hold the list of paths to lint and format. The scripts are just oxlint, oxlint --fix, oxfmt and oxfmt --check. This drops the 4× duplicated path list and adds scripts/ and packages/*/scripts, which were not checked before.
   • Rule categories: correctness = error, suspicious and perf = warn, with denyWarnings on.
   • Type-aware linting uses oxlint-tsgolint 7.0.2003. It bundles typescript-go, so it works with TS 7, and the whole repo lints in about 2 s.
   • Most findings are fixed in code:
     • sort/reverse → toSorted/toReversed (tsconfig target is now ES2023)
     • no-shadow renames, including locals that shadowed the path module
     • filter()[0] → find/findLast
     • unbound methods wrapped in arrows
     • unnecessary awaits, assertions and conversions removed
   • The rules turned off each have a reason written in the config. Globally: no-await-in-loop, consistent-function-scoping, no-unsafe-type-assertion (about 1k casts at JSON boundaries; to tighten later), no-base-to-string (tsgolint does not honor checkUnknown yet) and consistent-return. In tests only: await-thenable (bun-types types .resolves/.rejects as void) and unbound-method.
3. chore(hooks): lefthook, opt-in with bun run hooks:install.
   • pre-commit runs oxfmt and oxlint on staged files in parallel: about 0.8 s.
   • commit-msg runs commitlint with the conventional config: about 0.5 s.
   • no_auto_install: true is set because hooks are shared by every worktree of a clone.
4. chore(ci): react-doctor is now a pinned devDependency (0.9.14). The two obsolete probe workflows are deleted (details under CI notes).
5. chore(ci): CI restructure and a release that waits for CI (see below).

CI and release

• fast checks: one install, then lint, format, knip, typecheck, react-doctor, actionlint and zizmor run in parallel inside one step. Each gate prints its own log section with its exit code and duration.
• test (ubuntu-latest): one build, then a plain bun test. Every test directory runs. I confirmed that test/workit-codex, test/workit-mcp, test/opencode-v2 and test/acceptance were not in any CI job before.
• test (macos-latest) / test (windows-latest): test/workit-core and test/artifacts, same as before.
• Before → after:
  • typecheck: 6 jobs → 1
  • builds: 5 → 3 (one per OS)
  • jobs: 12 → 4, plus the release job
  • The candidate job is gone: it repeated phase-0-candidate, which test/artifacts already runs.
  • The artifacts job's ref: head_ref checkout is no longer needed: the phase-9 test already handles a detached HEAD.
• Hardening:
  • Actions are pinned to commit SHAs.
  • persist-credentials: false everywhere.
  • permissions: {} at the top level, with only what each job needs added per job.
  • PR runs cancel superseded runs. Runs on main are grouped per commit and never cancelled.
• Release (release.yml):
  • It is now a reusable workflow, called from the release job in ci.yml. That job only runs after fast, test and portability pass for the same commit on main.
  • Secrets are passed by name, not with inherit.
  • The job has a concurrency group with cancel-in-progress: false, so two merges cannot race on tags.
  • It runs bun run release, which uses the pinned semantic-release devDependency instead of an unpinned npx download.
  • npm provenance: id-token: write plus NPM_CONFIG_PROVENANCE=true. npm publish still authenticates with NPM_TOKEN; provenance only adds the OIDC attestation. The repo is public and every package's repository.url matches it.

Measured (local, Node 24.20.0, bun 1.4.1)

Gate	Time
fast job gates, run in parallel (same script as CI)	4.6 s wall (lint 4.6 s, typecheck 4.6 s, react-doctor 4.1 s, knip 3.7 s, zizmor 0.5 s, format 0.3 s, actionlint 0.06 s)
oxlint with types, whole repo, run alone	~2.3 s
lefthook pre-commit / commit-msg	0.8 s / 0.5 s
full bun test	1570 pass / 2 fail, 161 s

The 2 local failures are environmental:

• AR-14: the inner bun test picks up the sibling worktree ../s0-docs, which has no node_modules. This also fails on main in this layout.
• Pi stock-supervisor smoke: a metadata.lock timeout under full-suite load. It passes when its file runs alone (3/3). This is the lock contention that S1 fixes.

Also: actionlint reports nothing, and zizmor 1.30.1 (--offline) reports no findings. One finding is ignored on purpose: zizmor suggests the $/ self-repository syntax, which actionlint 1.7.12 rejects. The ignore comment explains this.

CI notes / action needed

• ⚠️ Branch protection still requires the old job names (check (workit-core) (…), check (workit-opencode), check (workit-cursor), check (workit-cli), check (shared)). Those jobs no longer exist, so this PR and the automated manifest-sync PRs will wait on checks that never report. Before merging, change the required checks to fast checks, test (ubuntu-latest), test (macos-latest), test (windows-latest). I did not change repository settings.
• The old react-doctor gate did nothing. Since 0.9.x, npx react-doctor@latest prints "React Doctor is not installed in this project" and exits 0. As a pinned devDependency it now runs the real scan. It currently reports warnings only, no errors.
• bun run check (not plain bun test) puts node_modules/.bin first on PATH. That bin folder contains the npm that @semantic-release/npm pulls in, so 2 packed-CLI tests fail to resolve the npm CLI when run that way. This already happens on main. CI calls bun test directly, so it is not affected. Follow-up for the test helpers.
• Deleted sync-token-probe.yml: its own note said to delete it once the token was stable. The last probe passed on 2026-08-28, and RELEASE_SYNC_TOKEN opened manifest-sync PR chore(release): sync manifests to v2.1.0 #147.
• Deleted windows-inner-suite-probe.yml: it runs handoff.test.ts and sdd.test.ts, which no longer exist.

Review follow-ups (3 more commits)

• Restored strict gates the autofix had loosened. no-unnecessary-boolean-literal-compare changed confirmed !== true checks into plain truthiness checks in three places: requireConfirmed (OpenCode V2 workit_init_apply), migrateLegacyDocs, and YouTrack postUpdate. After that change, confirmed: "false", "no" or 1 would pass.
  • All 46 comparisons and coercions the autofix rewrote are back to how they are on main. That covers === true/!== true/=== false/!== false, String()/Boolean()/${}, and hostingApiHostMatches returning Boolean(...) again.
  • The no-map-spread suggestion had replaced spreads with Object.assign(...), which mutates the original objects (task-engine importedTask plus three tests). Those are restored to spreads.
  • Those four rules are now off, with the reason written in .oxlintrc.json.
  • New regression tests check that the three gates reject "false", "no", "true", 1 and {}. All three tests fail against the loosened code and pass with the fix.
• CI: validate:cursor-marketplace now runs before any build, on a clean checkout (CA-21). The test job now also runs verify:release-candidate (about 1.5 s).
• lefthook postinstall: the npm package's postinstall runs lefthook install, which ignores no_auto_install. It cannot run on dependency install anymore:
  • bun does not trust it (blocks it by default);
  • pnpm skips it via pnpm.neverBuiltDependencies and yarn via dependenciesMeta.built: false;
  • npm cannot install this workspace at all (verified: EUNSUPPORTEDPROTOCOL on workspace:*).
  • A project-config test locks this in.
• Measured after the follow-ups (local, Node 24.20.0):
  • fast gates: 5.7 s wall in parallel; every gate exits 0;
  • full bun test: 1575 pass / 1 fail. The failure is AR-14, the environmental one caused by the sibling worktree, described above;
  • marketplace validation and the release-candidate check both pass;
  • commitlint passes for all commits.

Quality gates

• Tests, typecheck, lint, formatting and isolated release-candidate checks pass locally (Node 24). The exceptions are the environmental failures listed above.
• CONTRIBUTING describes the new checks, hooks and release flow.
• No host behavior changes. The source edits are lint fixes that keep behavior the same.

Checklist

• Existing scoped settings and local/version pins are preserved. The OpenCode floor stays 1.18.30. Pi, ink and @openclaw/fs-safe are not bumped.
• No user-facing behavior change. semantic-release will cut a patch because product paths changed (dependency bumps).

🤖 Generated with Claude Code

[github-actions]

🎉 This PR is included in version 2.1.5 🎉

The release is available on:

• v2.1.5
• GitHub release

Your semantic-release bot 📦🚀