[kojiwakayama]

The npm build validators combine selector resolution, module graph traversal, package-root import classification, and AST walking inside complex functions. Extract private validation phases for declaration references, binding collection, conditional/member/URL selectors, reference collection, entry-point and target validation, unreachable-directory removal, runtime helper checks, and meta-property child traversal. Clarify two small expression/regex decisions.

Preserve conservative uncertain-graph handling, declaration-file fallback, package containment, reference and diagnostic order, helper accounting, parse-failure rejection, and sequential filesystem operations. Directory deletion still starts only after the graph is complete.

Validation:

• Full-file local Sonar findings reduced from 13 to 3 across the three scripts, clearing 10 findings including all seven HIGH complexity findings. No new local findings or suppressions. The three remaining findings describe existing sequential awaits.
• Repository test runner: 3 tests with 49 steps passed before and after the refactor, covering emitted extension graph pruning, runtime helper contracts, and DNT meta-property safety.
• All 13,035 before/after comparisons matched: 12,800 selector/reference cases (10,934 uncertain), 75 meta-property/parse-failure cases, 96 runtime helper diagnostic cases, and 64 filesystem graph/cleanup cases.
• Affected scripts typechecked with the scripts config. Affected lint/format checks, anti-slop and await audits, and git diff --check passed.
• Complete branch diff and extension-package cleanup, package-root helper validation, shipped-source scanning, error paths, graph completeness, and declaration fallback callers reviewed.

The original direct Deno.stat await remains inside the import loop; synchronous failure recording preserves missing-file handling. All current-commit CI workflows pass. Sonar Cloud quality gate passes with zero new open issues and 0.0% new duplication.

Public APIs are unchanged.

[github-actions]

📦 Client bundle boundary

Entrypoint	Modules	Source size	Server leaks
src/index.client.ts	65	362 KiB	✅ 0
src/react/components/Head.tsx	5	74 KiB	✅ 0
src/react/router/index.tsx	5	74 KiB	✅ 0
src/react/context/index.tsx	5	74 KiB	✅ 0
src/react/fonts/index.ts	6	81 KiB	✅ 0
src/react/components/ui/index.ts	111	717 KiB	✅ 0
src/react/components/ui/adapter/contract.ts	1	18 KiB	✅ 0
src/react/components/ui/icons/index.ts	3	17 KiB	✅ 0
src/chat/index.ts	301	2017 KiB	✅ 0
src/chat/ag-ui.ts	61	457 KiB	✅ 0
src/chat/protocol.ts	1	11 KiB	✅ 0
src/chat/types.ts	45	242 KiB	✅ 0
src/chat/message-prep.ts	65	509 KiB	✅ 0
src/markdown/index.ts	6	30 KiB	✅ 0
src/mdx/index.ts	2	2 KiB	✅ 0
src/agent/identity-contracts.ts	1	2 KiB	✅ 0
src/schemas/index.ts	42	216 KiB	✅ 0
src/platform/env.ts	5	53 KiB	✅ 0
src/workflow/claude-code/react/index.ts	9	91 KiB	✅ 0
src/events/index.ts	31	568 KiB	✅ 0
src/events/ag-ui/public.ts	30	561 KiB	✅ 0
src/run-events/index.ts	53	317 KiB	✅ 0

A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in scripts/lint/client-bundle-baseline.json to burn down.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T03:32:27.430497Z	85f4ca5	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 85f4ca5af5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud