refactor(lint): simplify extension metadata analysis phases

[kojiwakayama]

Extension metadata auditing combines source parsing, binding-table construction, object-member admission, and factory scope/return traversal in complex functions. Extract private synchronous analysis phases while preserving conservative rejection, diagnostic text/order, import/export maps, pattern/scope budgets, traversal order, private default-factory checks, and workspace accounting. Clarify the static-binding choice and program guard.

Validation:

• Full-file local Sonar findings reduced from 17 to 7, clearing 10 findings including eight HIGH complexity findings. No new local findings or suppressions.
• Repository test runner: 5 tests with 64 steps passed before and after editing across extension contract and capability audits.
• All 2,927 before/after comparisons matched: 1,415 parsed-source/binding/metadata cases, 120 object-member cases, 1,200 pattern/binding-budget cases, 144 factory scope/return cases, and 48 file-backed resolution/workspace-accounting cases. Includes spreads, dynamic and duplicate keys, getters, aliases/re-exports, shadowing, nested returns, unsupported patterns, invalid syntax, and unresolved imports.
• Affected script typecheck, lint/format checks, anti-slop and await audits, and git diff --check passed.
• Complete branch diff, contract/capability audit callers, module binding order, factory declaration stopping points, named/default export admission, and file resolver/cache/budget consumers reviewed.

Public APIs and asynchronous filesystem resolution are unchanged. CI and Sonar Cloud verification are pending. Keep draft until the current commit passes both.

[github-actions]

📦 Client bundle boundary

Entrypoint	Modules	Source size	Server leaks
src/index.client.ts	65	362 KiB	✅ 0
src/react/components/Head.tsx	5	74 KiB	✅ 0
src/react/router/index.tsx	5	74 KiB	✅ 0
src/react/context/index.tsx	5	74 KiB	✅ 0
src/react/fonts/index.ts	6	81 KiB	✅ 0
src/react/components/ui/index.ts	111	717 KiB	✅ 0
src/react/components/ui/adapter/contract.ts	1	18 KiB	✅ 0
src/react/components/ui/icons/index.ts	3	17 KiB	✅ 0
src/chat/index.ts	301	2017 KiB	✅ 0
src/chat/ag-ui.ts	61	457 KiB	✅ 0
src/chat/protocol.ts	1	11 KiB	✅ 0
src/chat/types.ts	45	242 KiB	✅ 0
src/chat/message-prep.ts	65	509 KiB	✅ 0
src/markdown/index.ts	6	30 KiB	✅ 0
src/mdx/index.ts	2	2 KiB	✅ 0
src/agent/identity-contracts.ts	1	2 KiB	✅ 0
src/schemas/index.ts	42	216 KiB	✅ 0
src/platform/env.ts	5	53 KiB	✅ 0
src/workflow/claude-code/react/index.ts	9	91 KiB	✅ 0
src/events/index.ts	31	568 KiB	✅ 0
src/events/ag-ui/public.ts	30	561 KiB	✅ 0
src/run-events/index.ts	53	317 KiB	✅ 0

A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in scripts/lint/client-bundle-baseline.json to burn down.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T04:16:21.980648Z	64d62cb	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 64d62cb1ad

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud