apps/e2e/tests/general/cli.test.ts (2)

163-171: Consider typing the parsed JSON or adding a comment for any.

Line 168 uses any for the project type in the callback. Per coding guidelines, any usage should be explained or avoided where possible.

Proposed fix

    const projects = JSON.parse(stdout);
-    const found = projects.find((p: any) => p.id === createdProjectId);
+    // JSON.parse returns unknown structure; we only need to check the id property
+    const found = projects.find((p: { id: string }) => p.id === createdProjectId);
    expect(found).toBeDefined();

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/e2e/tests/general/cli.test.ts` around lines 163 - 171, The test parses
stdout into projects and currently uses an untyped callback with (p: any);
update the code to avoid raw any by either typing the parsed JSON (e.g. declare
projects as Project[] or a local type/interface matching expected fields) or add
an inline explanatory comment justifying any usage; locate the test that calls
runCli and assigns createdProjectId, then change the line const projects =
JSON.parse(stdout); and the find callback (p: any) => ... to use the proper
Project type (or a TypeScript cast with a short comment) so the find uses (p:
Project) => p.id === createdProjectId and found.displayName is correctly typed.

---

20-26: Add type annotation or comment for any usage.

The as any cast on line 24 bypasses type checking. Per coding guidelines, any usage should include a comment explaining why it's necessary. The ExecException type from child_process already has a code property, so this could be typed more precisely.

Proposed fix

+import { execFile, ExecException } from "child_process";
-import { execFile } from "child_process";
...
    }, (error, stdout, stderr) => {
      resolve({
        stdout: stdout.toString(),
        stderr: stderr.toString(),
-        exitCode: error ? (error as any).code ?? 1 : 0,
+        exitCode: error ? (error as ExecException).code ?? 1 : 0,
      });
    });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/e2e/tests/general/cli.test.ts` around lines 20 - 26, The callback passed
to exec uses an `any` cast for `error`—replace this with the proper
`ExecException | null` type from `child_process` (or type the callback
parameters explicitly) and then use `error?.code ?? 1` when computing exitCode;
update the callback signature where resolve is called so TypeScript knows
`error` has a `code` property instead of using `(error as any)`. Ensure you
import `ExecException` if needed and remove the `as any` cast.

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Configuration used: defaults

Review profile: CHILL

Plan: Pro

apps/e2e/tests/general/cli.test.ts (2)

66-66: Use structured URL construction for the session endpoint.

Avoid raw interpolation for URLs here; use URL/urlString construction for consistency and safer endpoint composition.

Proposed fix

-    const sessionRes = await niceFetch(`${STACK_BACKEND_BASE_URL}/api/v1/auth/sessions`, {
+    const sessionsUrl = new URL("/api/v1/auth/sessions", STACK_BACKEND_BASE_URL);
+    const sessionRes = await niceFetch(sessionsUrl, {

As per coding guidelines, "Use urlString`` or encodeURIComponent()` instead of normal string interpolation for URLs for consistency."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/e2e/tests/general/cli.test.ts` at line 66, The call that builds the
sessions endpoint using string interpolation (the niceFetch invocation that
assigns sessionRes with `${STACK_BACKEND_BASE_URL}/api/v1/auth/sessions`) should
be changed to construct the URL with the URL API (or the project's urlString
helper) instead of raw interpolation; replace the interpolated string with new
URL('/api/v1/auth/sessions', STACK_BACKEND_BASE_URL).toString() (or equivalent
urlString call) so the STACK_BACKEND_BASE_URL and the path are safely composed
and encoded before passing to niceFetch.

---

167-170: Remove any from project lookup assertions.

(p: any) bypasses type checks in a key verification path. Prefer a typed parsed value (or runtime guard) so regressions are caught by TS.

Proposed fix

-    const projects = JSON.parse(stdout);
-    const found = projects.find((p: any) => p.id === createdProjectId);
+    const projects: Array<{ id: string; displayName: string }> = JSON.parse(stdout);
+    const found = projects.find((p) => p.id === createdProjectId);

As per coding guidelines, "Try to avoid the any type" and "Do NOT use as/any/type casts..."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/e2e/tests/general/cli.test.ts` around lines 167 - 170, The test
currently uses an untyped callback `(p: any)` when searching parsed JSON
(variables: stdout, projects, createdProjectId), which bypasses TypeScript
checks; change to parse stdout into a typed array (e.g., const projects:
Project[] = JSON.parse(stdout) or use a runtime guard) and use a properly typed
predicate in the find call (e.g., (p: Project) => p.id === createdProjectId), or
implement a small type-guard function isProject(obj): obj is Project and use it
before asserting found.displayName; ensure you reference the existing Project
interface/type (or declare one in the test) instead of using any.

Configuration used: defaults

Review profile: CHILL

Plan: Pro

apps/e2e/tests/general/cli.test.ts (2)

82-86: ⚠️ Potential issue | 🟠 Major

Assert session response body shape before assigning refreshToken.

A 200 status alone does not guarantee refresh_token exists and is valid.

Proposed fix

     if (sessionRes.status !== 200) {
       throw new Error(`Failed to create session: ${sessionRes.status} ${JSON.stringify(sessionRes.body)}`);
     }
-    refreshToken = sessionRes.body.refresh_token;
+    if (
+      sessionRes.body == null ||
+      typeof sessionRes.body !== "object" ||
+      !("refresh_token" in sessionRes.body) ||
+      typeof sessionRes.body.refresh_token !== "string" ||
+      sessionRes.body.refresh_token.length === 0
+    ) {
+      throw new Error(`Session response missing refresh_token: ${JSON.stringify(sessionRes.body)}`);
+    }
+    refreshToken = sessionRes.body.refresh_token;

As per coding guidelines, "Any assumption you make should either be validated..." and "Fail early, fail loud."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/e2e/tests/general/cli.test.ts` around lines 82 - 86, The test assumes
sessionRes.body.refresh_token exists after a 200 but doesn't validate the
response shape; before assigning refreshToken, explicitly assert that
sessionRes.body is an object and contains a non-empty string refresh_token
(e.g., check typeof sessionRes.body.refresh_token === 'string' &&
sessionRes.body.refresh_token.length > 0) and throw a clear Error including
sessionRes.status and JSON.stringify(sessionRes.body) if the check fails; update
the assignment site where refreshToken is set from sessionRes.body.refresh_token
so it only occurs after this validation.

---

20-25: ⚠️ Potential issue | 🟠 Major

Remove any cast in runCli and normalize exitCode explicitly.

The cast bypasses type safety in a core test helper and can hide malformed process-error shapes.

Proposed fix

-    }, (error, stdout, stderr) => {
+    }, (error: NodeJS.ErrnoException | null, stdout, stderr) => {
+      const exitCode =
+        error == null
+          ? 0
+          : typeof error.code === "number"
+            ? error.code
+            : 1;
       resolve({
         stdout: stdout.toString(),
         stderr: stderr.toString(),
-        exitCode: error ? (error as any).code ?? 1 : 0,
+        exitCode,
       });
     });

As per coding guidelines, "Try to avoid the any type...".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/e2e/tests/general/cli.test.ts` around lines 20 - 25, The test helper
that resolves spawn results currently uses an unsafe any cast to extract
exitCode; update the resolution in runCli (the callback that receives error,
stdout, stderr) to remove the any cast and normalize exitCode via a proper
type-guard: inspect error (typed as unknown or Error | null), check for presence
of a numeric code (e.g., (error as NodeJS.ErrnoException).code) with typeof
checks, coerce string codes to numbers when appropriate (parseInt) and fall back
to 1 when absent, then return the normalized number along with stdout/stderr.

packages/stack-cli/src/commands/exec.ts (1)

36-47: ⚠️ Potential issue | 🟠 Major

Narrow broad catches in exec compile/execute flow and avoid implicit any-typed control flow.

Both catch blocks are catch-all wrappers; the compile path should only wrap syntax errors, and non-expected runtime throwables should be rethrown.

Proposed fix

-      let fn;
+      let fn: (stackServerApp: unknown) => Promise<unknown>;
       try {
         fn = new AsyncFunction("stackServerApp", javascript);
       } catch (err: unknown) {
-        throw new CliError(`Syntax error in exec code: ${getErrorMessage(err)}`);
+        if (err instanceof SyntaxError) {
+          throw new CliError(`Syntax error in exec code: ${getErrorMessage(err)}`);
+        }
+        throw err;
       }
-      let result;
+      let result: unknown;
       try {
         result = await fn(project.app);
       } catch (err: unknown) {
-        throw new CliError(`Exec error: ${getErrorMessage(err)}`);
+        if (err instanceof Error || typeof err === "string" || (typeof err === "object" && err !== null)) {
+          throw new CliError(`Exec error: ${getErrorMessage(err)}`);
+        }
+        throw err;
       }

Based on learnings, for **/*.{ts,tsx} you should "NEVER try-catch-all" and "Code defensively. Prefer ?? throwErr(...) over non-null assertions with good error messages explicitly stating the assumption."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/stack-cli/src/commands/exec.ts` around lines 36 - 47, The
compile/execute try-catches are too broad: when constructing
AsyncFunction("stackServerApp", javascript) only catch and wrap actual syntax
errors (use err: unknown and check instanceof SyntaxError, otherwise rethrow),
and when invoking fn(project.app) only catch expected runtime errors you intend
to wrap (use err: unknown, narrow via instanceof or custom type guards,
otherwise rethrow); replace any implicit assumptions with explicit checks or a
small helper like throwErr(...) so you never swallow unexpected
throwables—reference the AsyncFunction creation block, the two catch clauses
around fn = new AsyncFunction(...) and result = await fn(project.app),
getErrorMessage, and CliError when implementing these narrower catches.

packages/stack-cli/src/lib/config.ts (1)

9-14: ⚠️ Potential issue | 🟠 Major

Do not swallow all config read/parse failures; only treat missing file as empty and validate JSON shape.

Current behavior hides permission/corruption issues and silently continues with {}.

Proposed fix

+function isErrnoException(error: unknown): error is NodeJS.ErrnoException {
+  return typeof error === "object" && error !== null && "code" in error;
+}
+
 function readConfigJson(): Record<string, string> {
+  let raw: string;
   try {
-    return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf-8"));
-  } catch {
-    return {};
+    raw = fs.readFileSync(CONFIG_PATH, "utf-8");
+  } catch (error: unknown) {
+    if (isErrnoException(error) && error.code === "ENOENT") {
+      return {};
+    }
+    throw error;
+  }
+
+  const parsed: unknown = JSON.parse(raw);
+  if (parsed == null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`Invalid config JSON in ${CONFIG_PATH}: expected an object`);
+  }
+
+  const normalized: Record<string, string> = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (typeof value !== "string") {
+      throw new Error(`Invalid config value for '${key}' in ${CONFIG_PATH}: expected string`);
+    }
+    normalized[key] = value;
   }
+  return normalized;
 }

As per coding guidelines, "NEVER try-catch-all", "Fail early, fail loud", and "NEVER silently use fallback values when type errors occur."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/stack-cli/src/lib/config.ts` around lines 9 - 14, The readConfigJson
function currently swallows all errors; change it to only treat a missing file
(fs.readFileSync error with code === 'ENOENT') as returning {} and rethrow any
other fs errors; parse JSON separately and rethrow JSON.parse errors; finally
validate the parsed value is an object mapping string->string (throw a TypeError
if not) so the function still returns Record<string,string> when valid.
Reference function: readConfigJson, constants: CONFIG_PATH, calls:
fs.readFileSync and JSON.parse.

apps/e2e/tests/general/cli.test.ts (1)

167-170: Avoid any in project lookup; validate parsed output shape first.

This keeps failures explicit when CLI output changes unexpectedly.

Proposed fix

     const projects = JSON.parse(stdout);
-    const found = projects.find((p: any) => p.id === createdProjectId);
+    if (!Array.isArray(projects)) {
+      throw new Error(`Expected projects array, got: ${JSON.stringify(projects)}`);
+    }
+    const found = projects.find(
+      (p): p is { id: string; displayName: string } =>
+        p != null &&
+        typeof p === "object" &&
+        "id" in p &&
+        "displayName" in p &&
+        typeof p.id === "string" &&
+        typeof p.displayName === "string" &&
+        p.id === createdProjectId,
+    );

As per coding guidelines, "Try to avoid the any type..." and "Fail early, fail loud."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@apps/e2e/tests/general/cli.test.ts` around lines 167 - 170, The test
currently parses CLI JSON into an untyped value and uses (p: any) in the lookup;
change it to parse into unknown, validate the shape (ensure parsed value is an
array and each item has id and displayName) before casting to a typed Project[],
then use that Project[] in the find (referencing projects, createdProjectId, and
found) so the test fails early if the CLI output shape changes; implement a
runtime check (Array.isArray and typeof checks for id/displayName) or a small
type guard to avoid using any and then assert found.displayName === "CLI Test".

Configuration used: defaults

Review profile: CHILL

Plan: Pro