strengthen repo verification and runtime coverage

Add clearer app docs plus targeted desktop, CLI, web, and worker tests so cross-surface regressions are caught earlier and the repo is easier to navigate.

apps/x/packages/core/package.json

@@ -6,7 +6,8 @@
   "types": "./dist/index.d.ts",
   "scripts": {
     "build": "rm -rf dist && tsc",
-    "dev": "tsc -w"
+    "dev": "tsc -w",
+    "test": "npm run build && node ./test/run-tests.mjs"
   },
   "dependencies": {
     "@ai-sdk/anthropic": "^2.0.63",

apps/x/packages/core/src/application/lib/builtin-tools.ts

@@ -561,7 +561,7 @@ export const BuiltinTools: z.infer<typeof BuiltinToolsSchema> = {
                         count: matches.length,
                         tool: 'ripgrep',
                     };
-                } catch (rgError) {
+                } catch {
                     // Fallback to basic grep if ripgrep not available or failed
                     const grepArgs = [
                         '-rn',

apps/x/packages/core/src/config/config.ts

@@ -1,7 +1,6 @@
 import path from "path";
 import fs from "fs";
 import { homedir } from "os";
-import { fileURLToPath } from "url";
 
 function resolveWorkDir(): string {
     const configured = process.env.ROWBOAT_WORKDIR;
@@ -23,10 +22,6 @@ function resolveWorkDir(): string {
 // Normalize to an absolute path so workspace boundary checks behave consistently.
 export const WorkDir = resolveWorkDir();
 
-// Get the directory of this file (for locating bundled assets)
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
 function ensureDirs() {
     const ensure = (p: string) => { if (!fs.existsSync(p)) fs.mkdirSync(p, { recursive: true }); };
     ensure(WorkDir);

apps/x/packages/core/src/config/strictness_analyzer.ts

@@ -390,9 +390,6 @@ export function analyzeEmailsAndRecommend(): AnalysisResult {
     let reason: string;
 
     const totalHumanSenders = lowWouldCreate;
-    const noiseRatio = uniqueSenders.size > 0
-        ? (newsletterSenders.size + automatedSenders.size) / uniqueSenders.size
-        : 0;
     const consumerRatio = totalHumanSenders > 0
         ? consumerServiceSenders.size / totalHumanSenders
         : 0;

apps/x/packages/core/src/knowledge/agent_notes.ts

@@ -193,13 +193,16 @@ function extractConversationMessages(runFilePath: string): { role: string; text:
 // --- Wait for agent run completion ---
 
 async function waitForRunCompletion(runId: string): Promise<void> {
-    return new Promise(async (resolve) => {
-        const unsubscribe = await bus.subscribe('*', async (event) => {
+    return new Promise((resolve, reject) => {
+        let unsubscribe = () => {};
+        bus.subscribe('*', async (event) => {
             if (event.type === 'run-processing-end' && event.runId === runId) {
                 unsubscribe();
                 resolve();
             }
-        });
+        }).then((nextUnsubscribe) => {
+            unsubscribe = nextUnsubscribe;
+        }).catch(reject);
     });
 }
 

apps/x/packages/core/src/knowledge/build_graph.ts

@@ -189,13 +189,16 @@ async function readFileContents(filePaths: string[]): Promise<{ path: string; co
  * Wait for a run to complete by listening for run-processing-end event
  */
 async function waitForRunCompletion(runId: string): Promise<void> {
-    return new Promise(async (resolve) => {
-        const unsubscribe = await bus.subscribe('*', async (event) => {
+    return new Promise((resolve, reject) => {
+        let unsubscribe = () => {};
+        bus.subscribe('*', async (event) => {
             if (event.type === 'run-processing-end' && event.runId === runId) {
                 unsubscribe();
                 resolve();
             }
-        });
+        }).then((nextUnsubscribe) => {
+            unsubscribe = nextUnsubscribe;
+        }).catch(reject);
     });
 }
 

apps/x/packages/core/src/knowledge/chrome-extension/server/server.ts

@@ -43,7 +43,7 @@ function pathToSlug(url: string): string {
         const parsed = new URL(url);
         const p = parsed.pathname + (parsed.search || '');
         if (!p || p === '/') return 'index';
-        let slug = p.replace(/[^a-zA-Z0-9]+/g, '_').replace(/^_|_$/g, '');
+        const slug = p.replace(/[^a-zA-Z0-9]+/g, '_').replace(/^_|_$/g, '');
         return slug.substring(0, 80) || 'index';
     } catch {
         return 'index';
@@ -184,12 +184,13 @@ function saveConfig(config: Config): void {
     fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), 'utf-8');
 }
 
-function validateConfig(data: any): data is Config {
+function validateConfig(data: unknown): data is Config {
     if (typeof data !== 'object' || data === null) return false;
-    if (data.mode !== 'all' && data.mode !== 'ask') return false;
-    if (!Array.isArray(data.whitelist)) return false;
-    if (!Array.isArray(data.blacklist)) return false;
-    if (typeof data.enabled !== 'boolean') return false;
+    const candidate = data as Partial<Config>;
+    if (candidate.mode !== 'all' && candidate.mode !== 'ask') return false;
+    if (!Array.isArray(candidate.whitelist)) return false;
+    if (!Array.isArray(candidate.blacklist)) return false;
+    if (typeof candidate.enabled !== 'boolean') return false;
     return true;
 }
 

apps/x/packages/core/src/knowledge/inline_tasks.ts

@@ -133,13 +133,16 @@ function scanDirectoryRecursive(dir: string): string[] {
  * Wait for a run to complete by listening for run-processing-end event
  */
 async function waitForRunCompletion(runId: string): Promise<void> {
-    return new Promise(async (resolve) => {
-        const unsubscribe = await bus.subscribe('*', async (event) => {
+    return new Promise((resolve, reject) => {
+        let unsubscribe = () => {};
+        bus.subscribe('*', async (event) => {
             if (event.type === 'run-processing-end' && event.runId === runId) {
                 unsubscribe();
                 resolve();
             }
-        });
+        }).then((nextUnsubscribe) => {
+            unsubscribe = nextUnsubscribe;
+        }).catch(reject);
     });
 }
 

apps/x/packages/core/src/knowledge/label_emails.ts

@@ -66,13 +66,16 @@ function getUnlabeledEmails(state: LabelingState): string[] {
  * Wait for a run to complete by listening for run-processing-end event
  */
 async function waitForRunCompletion(runId: string): Promise<void> {
-    return new Promise(async (resolve) => {
-        const unsubscribe = await bus.subscribe('*', async (event) => {
+    return new Promise((resolve, reject) => {
+        let unsubscribe = () => {};
+        bus.subscribe('*', async (event) => {
             if (event.type === 'run-processing-end' && event.runId === runId) {
                 unsubscribe();
                 resolve();
             }
-        });
+        }).then((nextUnsubscribe) => {
+            unsubscribe = nextUnsubscribe;
+        }).catch(reject);
     });
 }
 

apps/x/packages/core/src/knowledge/sync_calendar.ts

@@ -348,24 +348,6 @@ async function performSync(syncDir: string, lookbackDays: number) {
 
 // --- Composio-based Sync ---
 
-interface ComposioCalendarState {
-    last_sync: string; // ISO string
-}
-
-function loadComposioState(stateFile: string): ComposioCalendarState | null {
-    if (fs.existsSync(stateFile)) {
-        try {
-            const data = JSON.parse(fs.readFileSync(stateFile, 'utf-8'));
-            if (data.last_sync) {
-                return { last_sync: data.last_sync };
-            }
-        } catch (e) {
-            console.error('[Calendar] Failed to load composio state:', e);
-        }
-    }
-    return null;
-}
-
 function saveComposioState(stateFile: string, lastSync: string): void {
     fs.writeFileSync(stateFile, JSON.stringify({ last_sync: lastSync }, null, 2));
 }

apps/x/packages/core/src/knowledge/tag_notes.ts

@@ -79,13 +79,16 @@ function getUntaggedNotes(state: NoteTaggingState): string[] {
  * Wait for a run to complete by listening for run-processing-end event
  */
 async function waitForRunCompletion(runId: string): Promise<void> {
-    return new Promise(async (resolve) => {
-        const unsubscribe = await bus.subscribe('*', async (event) => {
+    return new Promise((resolve, reject) => {
+        let unsubscribe = () => {};
+        bus.subscribe('*', async (event) => {
             if (event.type === 'run-processing-end' && event.runId === runId) {
                 unsubscribe();
                 resolve();
             }
-        });
+        }).then((nextUnsubscribe) => {
+            unsubscribe = nextUnsubscribe;
+        }).catch(reject);
     });
 }
 

apps/x/packages/core/src/pre_built/runner.ts

@@ -22,13 +22,16 @@ const PREBUILT_DIR = path.join(WorkDir, 'pre-built');
  * Wait for a run to complete by listening for run-processing-end event
  */
 async function waitForRunCompletion(runId: string): Promise<void> {
-    return new Promise(async (resolve) => {
-        const unsubscribe = await bus.subscribe('*', async (event) => {
+    return new Promise((resolve, reject) => {
+        let unsubscribe = () => {};
+        bus.subscribe('*', async (event) => {
             if (event.type === 'run-processing-end' && event.runId === runId) {
                 unsubscribe();
                 resolve();
             }
-        });
+        }).then((nextUnsubscribe) => {
+            unsubscribe = nextUnsubscribe;
+        }).catch(reject);
     });
 }
 
@@ -89,8 +92,6 @@ Process new items and use the user context above to identify yourself when draft
  * Check all agents and run those that are due
  */
 async function checkAndRunAgents(): Promise<void> {
-    const config = loadConfig();
-
     for (const agentName of PREBUILT_AGENTS) {
         try {
             if (shouldRunAgent(agentName)) {
@@ -149,7 +150,7 @@ export async function init(): Promise<void> {
  * Manually trigger an agent run (useful for testing)
  */
 export async function triggerAgent(agentName: string): Promise<void> {
-    if (!PREBUILT_AGENTS.includes(agentName as any)) {
+    if (!PREBUILT_AGENTS.includes(agentName as (typeof PREBUILT_AGENTS)[number])) {
         throw new Error(`Unknown agent: ${agentName}. Available: ${PREBUILT_AGENTS.join(', ')}`);
     }
     await runAgent(agentName);

apps/x/packages/core/src/workspace/watcher.ts

@@ -1,12 +1,12 @@
 import chokidar, { type FSWatcher } from 'chokidar';
 import fs from 'node:fs/promises';
+import { workspace } from '@x/shared';
 import { ensureWorkspaceRoot, absToRelPosix } from './workspace.js';
 import { WorkDir } from '../config/config.js';
-import { WorkspaceChangeEvent } from 'packages/shared/dist/workspace.js';
 import z from 'zod';
 import { Stats } from 'node:fs';
 
-export type WorkspaceChangeCallback = (event: z.infer<typeof WorkspaceChangeEvent>) => void;
+export type WorkspaceChangeCallback = (event: z.infer<typeof workspace.WorkspaceChangeEvent>) => void;
 
 /**
  * Create a workspace watcher

apps/x/packages/core/src/workspace/workspace.ts

@@ -3,7 +3,6 @@ import type { Stats } from 'node:fs';
 import path from 'node:path';
 import { workspace } from '@x/shared';
 import { z } from 'zod';
-import { RemoveOptions, WriteFileOptions, WriteFileResult } from 'packages/shared/dist/workspace.js';
 import { WorkDir } from '../config/config.js';
 import { rewriteWikiLinksForRenamedKnowledgeFile } from './wiki-link-rewrite.js';
 import { commitAll } from '../knowledge/version_history.js';
@@ -237,8 +236,8 @@ function scheduleKnowledgeCommit(filename: string): void {
 export async function writeFile(
   relPath: string,
   data: string,
-  opts?: z.infer<typeof WriteFileOptions>
-): Promise<z.infer<typeof WriteFileResult>> {
+  opts?: z.infer<typeof workspace.WriteFileOptions>
+): Promise<z.infer<typeof workspace.WriteFileResult>> {
   const filePath = resolveWorkspacePath(relPath);
   const encoding = opts?.encoding || 'utf8';
   const atomic = opts?.atomic !== false; // default true
@@ -381,7 +380,7 @@ export async function copy(
 
 export async function remove(
   relPath: string,
-  opts?: z.infer<typeof RemoveOptions>
+  opts?: z.infer<typeof workspace.RemoveOptions>
 ): Promise<{ ok: true }> {
   const filePath = resolveWorkspacePath(relPath);
   const trash = opts?.trash !== false; // default true

apps/x/packages/core/test/run-tests.mjs

@@ -0,0 +1,31 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const packageDir = path.resolve(__dirname, "..");
+const tempRoot = await mkdtemp(path.join(tmpdir(), "rowboat-core-test-"));
+const testWorkDir = path.join(tempRoot, "workspace");
+
+try {
+  const exitCode = await new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, ["--test", "./test/workspace-path-safety.test.mjs"], {
+      cwd: packageDir,
+      stdio: "inherit",
+      env: {
+        ...process.env,
+        ROWBOAT_WORKDIR: testWorkDir,
+      },
+    });
+
+    child.on("error", reject);
+    child.on("exit", (code) => resolve(code ?? 1));
+  });
+
+  process.exitCode = Number(exitCode);
+} finally {
+  await rm(tempRoot, { recursive: true, force: true });
+}

apps/x/packages/core/test/workspace-path-safety.test.mjs

@@ -0,0 +1,44 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import path from "node:path";
+
+import { WorkDir } from "../dist/config/config.js";
+import {
+  absToRelPosix,
+  assertSafeRelPath,
+  resolveWorkspacePath,
+} from "../dist/workspace/workspace.js";
+
+test("uses ROWBOAT_WORKDIR override for test isolation", () => {
+  assert.equal(WorkDir, process.env.ROWBOAT_WORKDIR);
+});
+
+test("assertSafeRelPath allows simple relative paths", () => {
+  assert.doesNotThrow(() => assertSafeRelPath("notes/today.md"));
+});
+
+test("assertSafeRelPath rejects absolute paths", () => {
+  assert.throws(() => assertSafeRelPath("/tmp/notes.md"), /Absolute paths are not allowed/);
+});
+
+test("assertSafeRelPath rejects traversal attempts", () => {
+  assert.throws(() => assertSafeRelPath("../notes.md"), /Path traversal/);
+  assert.throws(() => assertSafeRelPath("notes/../secret.md"), /Path traversal|Invalid path/);
+});
+
+test("resolveWorkspacePath returns the configured root for empty path", () => {
+  assert.equal(resolveWorkspacePath(""), WorkDir);
+});
+
+test("resolveWorkspacePath resolves safe relative paths inside the workspace", () => {
+  assert.equal(resolveWorkspacePath("knowledge/alpha.md"), path.join(WorkDir, "knowledge", "alpha.md"));
+});
+
+test("absToRelPosix returns POSIX relative paths inside the workspace", () => {
+  const absolutePath = path.join(WorkDir, "knowledge", "nested", "alpha.md");
+  assert.equal(absToRelPosix(absolutePath), "knowledge/nested/alpha.md");
+});
+
+test("absToRelPosix rejects paths outside the workspace", () => {
+  assert.equal(absToRelPosix("/tmp/outside.md"), null);
+});