WIP cleanup and security updates

Author: jaggederest

TODO.md

@@ -1,180 +1,48 @@
-# VSCode Coder Extension - Next Steps & Improvements
+# VSCode Coder Extension - Next Steps
 
-## Current Status 🎯
+## Current Status ✅
 
-**✅ MAJOR ACCOMPLISHMENTS COMPLETED:**
+**COMPLETED:**
+- Perfect type safety (all lint errors eliminated)
+- Excellent test coverage (420 tests passing)
+- Clean webpack builds (4.52 MiB bundle)
+- Zero lint/formatting issues
 
-- **Perfect Type Safety**: All 279 lint errors eliminated (100% reduction)
-- **Excellent Test Coverage**: 84.5% overall coverage with 420 tests passing
-- **Zero Technical Debt**: Clean, maintainable codebase achieved
+## Priority Tasks
 
----
-
-## Priority 1: Critical Issues (Immediate Action Required) 🔥
-
-### 1. **Build System Failures**
-
-- **Issue**: Webpack build failing with 403 TypeScript errors
-- **Impact**: Cannot create production builds or releases
-- **Task**: Fix webpack configuration to exclude test files from production build
-- **Effort**: ~2-4 hours
-
-### 2. **Security Vulnerabilities**
-
-- **Issue**: 4 high-severity vulnerabilities in dependencies
-- **Impact**: Security risk in development tools
-- **Task**: Run `yarn audit fix` and update vulnerable packages
-- **Effort**: ~1-2 hours
-
-### 3. **Lint Formatting Issues** ✅ COMPLETED
+### 1. **Security Vulnerabilities** 🔥
+- **Issue**: 4 high-severity + 3 moderate vulnerabilities
+- **Task**: `yarn audit fix` and update vulnerable packages
+- **Effort**: 1-2 hours
 
-- **Issue**: 4 Prettier formatting errors preventing clean builds
-- **Task**: Run `yarn lint:fix` to auto-format
-- **Effort**: ~5 minutes
-- **Status**: ✅ All formatting issues resolved
+### 2. **Dependency Updates**
+- **@types/vscode**: 1.74.0 → 1.101.0 (VSCode API access)
+- **vitest**: 0.34.6 → 3.2.3 (performance improvements)
+- **typescript**: 5.4.5 → 5.8.3 (latest features)
+- **Effort**: 4-6 hours
 
----
-
-## Priority 2: Dependency & Security Improvements 📦
+### 3. **Bundle Optimization** 🚀
+- Current: 4.52 MiB bundle
+- Add webpack-bundle-analyzer
+- Target: < 1MB for faster loading
+- **Effort**: 3-4 hours
 
-### 4. **Dependency Updates (Staged Approach)**
+### 4. **Enhanced TypeScript**
+- Enable strict features: `noUncheckedIndexedAccess`, `exactOptionalPropertyTypes`
+- **Effort**: 2-3 hours
 
-- **@types/vscode**: 1.74.0 → 1.101.0 (27 versions behind - access to latest VSCode APIs)
-- **vitest**: 0.34.6 → 3.2.3 (major version - better performance & features)
-- **eslint**: 8.57.1 → 9.29.0 (major version - new rules & performance)
-- **typescript**: 5.4.5 → 5.8.3 (latest features & bug fixes)
-- **Effort**: ~4-6 hours (staged testing required)
+## Lower Priority
 
-### 5. **Package Security Hardening**
+### Developer Experience
+- Pre-commit hooks (husky + lint-staged)
+- E2E testing with Playwright
+- **Effort**: 6-8 hours
 
-- Add `yarn audit` to CI pipeline
-- Clean up package.json resolutions
-- Consider migration to pnpm for better security
-- **Effort**: ~2-3 hours
+### Architecture
+- Dependency injection for testability
+- Centralized configuration management
+- **Effort**: 8-12 hours
 
 ---
 
-## Priority 3: Performance & Quality 🚀
-
-### 6. **Bundle Size Optimization**
-
-- Add webpack-bundle-analyzer for inspection
-- Implement code splitting for large dependencies
-- Target < 1MB bundle size for faster extension loading
-- **Effort**: ~3-4 hours
-- **Impact**: 30%+ performance improvement
-
-### 7. **Enhanced TypeScript Configuration**
-
-- Enable strict mode features: `noUncheckedIndexedAccess`, `exactOptionalPropertyTypes`
-- Add `noImplicitReturns` and `noFallthroughCasesInSwitch`
-- **Effort**: ~2-3 hours
-- **Impact**: Better type safety and developer experience
-
-### 8. **Error Handling Standardization**
-
-- Implement centralized error boundary pattern
-- Standardize error logging with structured format
-- Add error telemetry for production debugging
-- **Effort**: ~4-6 hours
-
----
-
-## Priority 4: Developer Experience 🛠️
-
-### 9. **Development Workflow Improvements**
-
-- **Pre-commit hooks**: Add husky + lint-staged for automatic formatting
-- **Hot reload**: Improve development experience with faster rebuilds
-- **Development container**: Add devcontainer.json for consistent environment
-- **Effort**: ~3-4 hours
-- **Impact**: Significantly improved developer productivity
-
-### 10. **Testing Infrastructure Enhancements**
-
-- **E2E Testing**: Add Playwright for real VSCode extension testing
-- **Performance Benchmarks**: Track extension startup and operation performance
-- **Integration Tests**: Test against different Coder versions
-- **Effort**: ~6-8 hours
-- **Impact**: Higher confidence in releases
-
----
-
-## Priority 5: Architecture & Design 🏗️
-
-### 11. **Module Boundaries & Coupling**
-
-- Implement dependency injection for better testability
-- Extract common interfaces and types
-- Reduce coupling between `remote.ts` and `commands.ts`
-- **Effort**: ~6-8 hours
-- **Impact**: Better maintainability and extensibility
-
-### 12. **Configuration Management**
-
-- Centralized configuration class with validation
-- Schema-based configuration with runtime validation
-- Better defaults and configuration migration support
-- **Effort**: ~4-5 hours
-
----
-
-## Priority 6: Documentation & Observability 📚
-
-### 13. **Documentation Improvements**
-
-- **API Documentation**: Document internal APIs and architecture
-- **Development Guide**: Setup, debugging, and contribution guide
-- **Architecture Decision Records**: Document design decisions
-- **Effort**: ~4-6 hours
-
-### 14. **Monitoring & Observability**
-
-- Performance metrics collection
-- Error reporting and monitoring
-- Health checks for external dependencies
-- **Effort**: ~5-7 hours
-
----
-
-## Recommended Implementation Timeline
-
-### **Week 1: Critical & High-Impact (Priority 1-2)**
-
-1. ⏳ Fix webpack build issues
-2. ⏳ Update security vulnerabilities
-3. ✅ Fix formatting issues - **COMPLETED**
-4. ⏳ Update critical dependencies (TypeScript, Vitest)
-
-### **Week 2: Performance & Quality (Priority 3)**
-
-1. Bundle size optimization
-2. Enhanced TypeScript configuration
-3. Error handling standardization
-
-### **Week 3: Developer Experience (Priority 4)**
-
-1. Pre-commit hooks and workflow improvements
-2. E2E testing infrastructure
-3. Performance benchmarking
-
-### **Week 4: Architecture & Polish (Priority 5-6)**
-
-1. Module boundary improvements
-2. Configuration management
-3. Documentation updates
-4. Monitoring setup
-
----
-
-## Expected Outcomes
-
-**Completing Priority 1-3 tasks will achieve:**
-
-- ✅ **Build Reliability**: 100% successful builds
-- ✅ **Security Posture**: Elimination of known vulnerabilities
-- ✅ **Performance**: 30%+ faster extension loading
-- ✅ **Developer Experience**: Significantly improved workflow
-- ✅ **Code Quality**: Production-ready enterprise standards
-
-**Current codebase is already excellent - these improvements will make it truly exceptional!** 🚀
+**Current Status**: Build system working perfectly, all tests passing. Focus on security fixes first.

eslint.config.js

@@ -0,0 +1,74 @@
+const js = require("@eslint/js")
+const tsParser = require("@typescript-eslint/parser")
+const tsPlugin = require("@typescript-eslint/eslint-plugin")
+const prettierPlugin = require("eslint-plugin-prettier")
+const importPlugin = require("eslint-plugin-import")
+
+module.exports = [
+	{
+		ignores: ["out", "dist", "**/*.d.ts", "**/*.md"]
+	},
+	{
+		files: ["**/*.ts"],
+		languageOptions: {
+			parser: tsParser,
+			parserOptions: {
+				ecmaVersion: 2020,
+				sourceType: "module",
+				project: true
+			},
+			globals: {
+				Buffer: "readonly", 
+				setTimeout: "readonly",
+				clearTimeout: "readonly",
+				setInterval: "readonly",
+				clearInterval: "readonly",
+				setImmediate: "readonly",
+				AbortController: "readonly",
+				URL: "readonly",
+				URLSearchParams: "readonly",
+				ReadableStream: "readonly",
+				ReadableStreamDefaultController: "readonly",
+				MessageEvent: "readonly",
+				global: "readonly",
+				__filename: "readonly",
+				__dirname: "readonly",
+				NodeJS: "readonly",
+				Thenable: "readonly",
+				process: "readonly",
+				fs: "readonly",
+				semver: "readonly"
+			}
+		},
+		plugins: {
+			"@typescript-eslint": tsPlugin,
+			"prettier": prettierPlugin,
+			"import": importPlugin
+		},
+		rules: {
+			...js.configs.recommended.rules,
+			...tsPlugin.configs.recommended.rules,
+			curly: "error",
+			eqeqeq: "error",
+			"no-throw-literal": "error",
+			"no-console": "error",
+			"prettier/prettier": "error",
+			"import/order": [
+				"error",
+				{
+					alphabetize: {
+						order: "asc"
+					},
+					groups: [["builtin", "external", "internal"], "parent", "sibling"]
+				}
+			],
+			"import/no-unresolved": "off",
+			"@typescript-eslint/no-unused-vars": [
+				"error",
+				{
+					varsIgnorePattern: "^_"
+				}
+			]
+		}
+	}
+]

package.json

@@ -288,19 +288,20 @@
 		"@types/glob": "^7.1.3",
 		"@types/node": "^22.14.1",
 		"@types/node-forge": "^1.3.11",
+		"@types/semver": "^7.7.0",
 		"@types/ua-parser-js": "0.7.36",
 		"@types/vscode": "^1.73.0",
 		"@types/ws": "^8.18.1",
-		"@typescript-eslint/eslint-plugin": "^7.0.0",
-		"@typescript-eslint/parser": "^6.21.0",
+		"@typescript-eslint/eslint-plugin": "^8.34.0",
+		"@typescript-eslint/parser": "^8.34.0",
 		"@vitest/coverage-v8": "^0.34.6",
 		"@vitest/ui": "^0.34.6",
 		"@vscode/test-electron": "^2.5.2",
 		"@vscode/vsce": "^2.21.1",
 		"bufferutil": "^4.0.9",
 		"coder": "https://github.com/coder/coder#main",
 		"dayjs": "^1.11.13",
-		"eslint": "^8.57.1",
+		"eslint": "^9.29.0",
 		"eslint-config-prettier": "^9.1.0",
 		"eslint-plugin-import": "^2.31.0",
 		"eslint-plugin-md": "^1.0.19",

src/remote.ts

@@ -149,7 +149,7 @@ export class Remote {
 				const devBinaryPath = path.join(os.tmpdir(), "coder");
 				await fs.stat(devBinaryPath);
 				return devBinaryPath;
-			} catch (ex) {
+			} catch {
 				return await this.storage.fetchBinary(workspaceRestClient, label);
 			}
 		}
@@ -169,7 +169,7 @@ export class Remote {
 		let version: semver.SemVer | null = null;
 		try {
 			version = semver.parse(await cli.version(binaryPath));
-		} catch (e) {
+		} catch {
 			version = semver.parse(buildInfo.version);
 		}
 
@@ -656,7 +656,7 @@ export class Remote {
 				this.storage.getUserSettingsPath(),
 				"utf8",
 			);
-		} catch (ex) {
+		} catch {
 			// Ignore! It's probably because the file doesn't exist.
 		}
 
@@ -1081,7 +1081,7 @@ export class Remote {
 				const parsed = JSON.parse(content);
 				try {
 					updateStatus(parsed);
-				} catch (ex) {
+				} catch {
 					// Ignore
 				}
 			} catch {

src/sshConfig.test.ts

@@ -1,4 +1,3 @@
-/* eslint-disable @typescript-eslint/ban-ts-comment */
 import { it, afterEach, vi, expect } from "vitest";
 import { SSHConfig } from "./sshConfig";
 

src/sshConfig.ts

@@ -107,7 +107,7 @@ export class SSHConfig {
 	async load() {
 		try {
 			this.raw = await this.fileSystem.readFile(this.filePath, "utf-8");
-		} catch (ex) {
+		} catch {
 			// Probably just doesn't exist!
 			this.raw = "";
 		}

src/sshSupport.ts

@@ -6,7 +6,7 @@ export function sshSupportsSetEnv(): boolean {
 		const spawned = childProcess.spawnSync("ssh", ["-V"]);
 		// The version string outputs to stderr.
 		return sshVersionSupportsSetEnv(spawned.stderr.toString().trim());
-	} catch (error) {
+	} catch {
 		return false;
 	}
 }

src/storage.ts

@@ -80,7 +80,7 @@ export class Storage {
 	public async getSessionToken(): Promise<string | undefined> {
 		try {
 			return await this.secrets.get("sessionToken");
-		} catch (ex) {
+		} catch {
 			// The VS Code session store has become corrupt before, and
 			// will fail to get the session token...
 			return undefined;

src/workspacesProvider.ts

@@ -93,7 +93,7 @@ export class WorkspaceProvider
 		let hadError = false;
 		try {
 			this.workspaces = await this.fetch();
-		} catch (error) {
+		} catch {
 			hadError = true;
 			this.workspaces = [];
 		}