fix(audits): close guardrail detector gaps and correct guidance from release review by waleedlatif1 · Pull Request #8571 · simstudioai/sim

waleedlatif1 · 2026-10-02T16:24:39Z

Summary

Fixes the review findings on the release PR that apply to the guardrail and guidance work (#8557, #8559).

Audit detector gaps

check:zustand-v5: partialize must be a real property of the options argument, so a comment, state field, or store name containing the word no longer satisfies it; destructured-rest whole-state partializers (({ ...s }) => ({ ...s })) are now caught
check:client-boundary: env-flags is matched by resolving the import (relative paths included), and a namespace import of env-flags in client code is refused outright, since its reads (flags.x, flags['x'], destructuring) cannot be enumerated
check:utils: .with(i, value) is flagged whenever its second argument is not a function literal, which catches variable indexes while still passing OpenTelemetry's context.with(ctx, () => …)
check:application-graph: a guarded prefix counts as alive only if it still contains a runtime module, so leftover .integration.ts, .d.ts, or test-only folders no longer keep a dead guard green
check:guidance-refs: wildcard export targets substitute every *, matching Node's resolution

Guidance accuracy

babysit: the merge-conflict path now says to rebase onto origin/staging explicitly
add-block / add-connector: the canonicalParamId rule matches blocks.test.ts (only a subblock without its own canonicalParamId may not share the id)
sim-styling inputClassName example points at a file that uses it; add-settings-page's expected grep matches are exactly what the grep returns; sim-settings-pages names where a section's description actually lives; sim-url-state links back to sim-queries; add-block-preview uses the full path

Type of Change

Bug fix

Testing

Each detector change proven with throwaway probes: every newly flagged case was missed by the previous script; legitimate look-alikes (real partialize forms, named env-flags imports, OTel context.with callbacks, Drizzle .with) still pass
bun run lint, block-registry check, bun run check:audits (58), docs-manifest:check, root bun run test

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

vercel · 2026-10-02T16:24:46Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 2, 2026 7:28pm UTC

greptile-apps · 2026-10-02T16:30:30Z

Confidence Score: 5/5

[Low risk] Updates documentation and guidance rules.

The PR appears safe to merge; no new actionable issue or outstanding previous finding remains.

Summary

The PR tightens audit detectors and corrects developer guidance. Since the previous review, the only changes clarify the ES2023 array-method guidance in its Claude and Cursor copies. No new actionable issue was identified.

_{Reviews (9) · Last reviewed commit: "chore(guidance): scope the ES2023 tsc gu..."}

cubic-dev-ai

All reported issues were addressed across 18 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

waleedlatif1 · 2026-10-02T16:44:34Z

@greptile

waleedlatif1 · 2026-10-02T16:44:35Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-02T16:44:41Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 18 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

waleedlatif1 · 2026-10-02T17:15:17Z

@greptile

waleedlatif1 · 2026-10-02T17:15:18Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-02T17:15:25Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 18 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

waleedlatif1 · 2026-10-02T17:30:21Z

@greptile

waleedlatif1 · 2026-10-02T17:30:22Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-02T17:30:29Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 20 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

waleedlatif1 · 2026-10-02T17:45:14Z

@greptile

waleedlatif1 · 2026-10-02T17:45:15Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-02T17:45:21Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 20 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

…release review

….with rule; unwrap cast partialize

…l .with calls and defaulted partialize params

…whole state as leaks

…nts, fix && partialize false positive - check:utils drops the ES2023 call-site detector; every tsconfig keeps lib at ES2022 so tsc rejects toSorted/with by type, and the check now fails a tsconfig that raises lib past it (the #5340 cause) - check:zustand-v5 treats only the right side of && as a returned value - check:explicit-any counts group-level and bare lint biome-ignore suppressions, and no longer pairs a deleted file with an unrelated new one as a rename - check:file-names drops its rule-matched rename hint, which pointed new violations at old baseline entries - check:comment-hygiene skips the parse for files with no possible hit and scans untracked files - inline the single-consumer source-kind helper and two leftover ref aliases - CLAUDE.md naming states the check:file-names scope; /ship runs type-check

waleedlatif1 · 2026-10-02T18:57:53Z

@greptile

waleedlatif1 · 2026-10-02T18:57:54Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-02T18:58:01Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 30 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

…r any receivers

waleedlatif1 · 2026-10-02T19:12:21Z

@greptile

waleedlatif1 · 2026-10-02T19:12:22Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-02T19:12:29Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 30 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

waleedlatif1 · 2026-10-02T19:25:24Z

@greptile

waleedlatif1 · 2026-10-02T19:25:26Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-02T19:25:33Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 30 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

vercel Bot deployed to Preview October 2, 2026 16:27 View deployment

greptile-apps Bot reviewed Oct 2, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread scripts/check-zustand-v5-selectors.ts Outdated

Comment thread .claude/rules/sim-react-performance.md Outdated

vercel Bot deployed to Preview October 2, 2026 16:46 View deployment

greptile-apps Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread scripts/check-utils-enforcement.ts Outdated

cubic-dev-ai Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread scripts/check-zustand-v5-selectors.ts

vercel Bot deployed to Preview October 2, 2026 17:17 View deployment

greptile-apps Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread scripts/check-utils-enforcement.ts Outdated

cubic-dev-ai Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread .agents/skills/add-block/SKILL.md Outdated

Comment thread scripts/check-utils-enforcement.ts Outdated

Comment thread scripts/check-zustand-v5-selectors.ts

Comment thread scripts/check-utils-enforcement.ts Outdated

waleedlatif1 force-pushed the fix/guardrail-review-followups branch from eb1c59b to 4322e38 Compare October 2, 2026 17:30

vercel Bot deployed to Preview October 2, 2026 17:32 View deployment

cubic-dev-ai Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread scripts/check-zustand-v5-selectors.ts

vercel Bot deployed to Preview October 2, 2026 17:48 View deployment

greptile-apps Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread scripts/check-zustand-v5-selectors.ts

cubic-dev-ai Bot reviewed Oct 2, 2026

View reviewed changes

waleedlatif1 force-pushed the fix/guardrail-review-followups branch from 9e4a00d to eb15627 Compare October 2, 2026 18:25

waleedlatif1 added 7 commits October 2, 2026 11:56

fix(audits): close guardrail detector gaps and correct guidance from …

ded17e2

…release review

fix(audits): detect partialize and .with by AST instead of regex

d5b5572

fix(audits): exempt only the imported OpenTelemetry context from the …

dc13597

….with rule; unwrap cast partialize

fix(audits): drop the OTel exemption for rebound names, catch optiona…

a7050ef

…l .with calls and defaulted partialize params

fix(audits): treat logical and conditional partialize returns of the …

22dbd98

…whole state as leaks

chore(guidance): state the tsconfig lib invariant as at or below ES2022

93ef435

waleedlatif1 force-pushed the fix/guardrail-review-followups branch from eb15627 to 93ef435 Compare October 2, 2026 18:57

vercel Bot deployed to Preview October 2, 2026 19:00 View deployment

greptile-apps Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread scripts/check-utils-enforcement.ts

cubic-dev-ai Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread scripts/check-utils-enforcement.ts

fix(audits): keep matching toSorted/toReversed/toSpliced in source fo…

0db61dd

…r any receivers

vercel Bot deployed to Preview October 2, 2026 19:14 View deployment

greptile-apps Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread scripts/check-utils-enforcement.ts

cubic-dev-ai Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread .cursor/rules/sim-react-performance.mdc Outdated

chore(guidance): scope the ES2023 tsc guarantee to typed receivers

a11e051

cubic-dev-ai Bot reviewed Oct 2, 2026

View reviewed changes

vercel Bot deployed to Preview October 2, 2026 19:28 View deployment

waleedlatif1 merged commit 24b4957 into staging Oct 2, 2026
33 checks passed

waleedlatif1 deleted the fix/guardrail-review-followups branch October 2, 2026 19:38

waleedlatif1 mentioned this pull request Oct 2, 2026

v0.9.12: Power BI integration, library articles, chat fork speedups #8589

Merged

Conversation

waleedlatif1 commented Oct 2, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 2, 2026

Uh oh!

waleedlatif1 commented Oct 2, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 2, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Oct 2, 2026

Uh oh!

waleedlatif1 commented Oct 2, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 2, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 2, 2026

Uh oh!

waleedlatif1 commented Oct 2, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 2, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Oct 2, 2026

Uh oh!

waleedlatif1 commented Oct 2, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 2, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 2, 2026

Uh oh!

waleedlatif1 commented Oct 2, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 2, 2026

vercel Bot commented Oct 2, 2026 •

edited

Loading

greptile-apps Bot commented Oct 2, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading