fix: clear pre-existing lint debt and unbreak the pre-commit workflow

[trillium]

Two CI checks fail on the command-visualizer base branch for reasons unrelated to any PR diff, and reproduce on the base branch itself. This fixes both.

1. Lint — 194 oxlint warnings + ~25 unformatted files

pnpm lint failed on the base branch: oxlint --deny-warnings reported 194 warnings across 24 files in packages/command-visualizer/src/, and lint:fmt (oxfmt) flagged ~25 files.

Every warning is fixed as a real code change, not a rule disable:

Rule	Fix
unicorn/no-array-for-each	forEach → for..of (10 sites)
unicorn/prefer-string-replace-all, eslint/require-unicode-regexp	replaceAll, /u flag on every regex
unicorn/consistent-function-scoping	hoisted pct100, toPos, pctc, snapshot to module scope
unicorn/custom-error-definition	ChainContinuityError now sets .name
node/no-process-env, unicorn/import-style	import { env } from "node:process", namespace path import
import/no-duplicates	merged split value/type imports (5 files)
eslint/no-inline-comments	trailing comments moved above their line or turned into JSDoc
eqeqeq, no-unused-vars, no-nested-ternary	fixed at the source

One real architectural fix: render/css-cascade.ts and render/css-cascade-flash.ts were in an import cycle over the pct helper. It's extracted into a new dependency-free leaf module render/css-shared.ts, mirroring the existing jumbotron-shared.ts precedent.

The one scoped exception — and a repo-wide conflict worth a decision

model/columns.ts holds the East_Asian_Width WIDE_RANGES table. It carries a two-rule block disable, justified in place:

• unicorn/numeric-separators-style would write these as 0x1_F300. They're Unicode code points and have to stay readable as the U+XXXX values the Unicode charts publish; a grouped form corresponds to nothing you can look up.

• unicorn/number-literal-case wants uppercase hex digits (0x115F), but pnpm lint:fmt runs oxfmt, which rewrites hex digits to lowercase. Verified in isolation:

  $ printf 'export const X = [0xABCD, 0x1F300];' > hexcase.ts && oxfmt hexcase.ts
  $ cat hexcase.ts
  export const X = [0xabcd, 0x1f300];
  

  The two halves of pnpm lint disagree, so no spelling of a hex literal containing an a–f digit passes both.

I scoped the disable to this one table to honor "scope the exception narrowly," but the number-literal-case half of that conflict is repo-wide, not specific to this package. Any file that gains a hex literal with a–f digits will hit the same wall. Worth deciding separately whether to disable unicorn/number-literal-case globally in oxlint.config.mts; happy to do it in this PR if you'd rather.

2. Pre-commit — npm error EALLOWGIT

The Pre-commit workflow failed on every run of this branch:

command: (..., npm, 'install', '--allow-git=root', '-g',
          'git+file:///home/runner/.cache/pre-commit/repodwzk4_3s')
npm error code EALLOWGIT
npm error Fetching non-root packages from git has been disabled
npm error Refusing to fetch "@cursorless/talon-tools@git+file:///..."

pre-commit/action@v3.0.1 installs whatever pre-commit is latest, and pre-commit 4.6 rewrote the language: node installer:

pre-commit	how it installs a node hook repo
4.5.1	local npm install, then npm pack, then npm install -g <tarball>
4.6.x	npm install --allow-git=root -g git+file://<clone>

The 4.6 form is what npm's allow-git hardening refuses. This hits talon-fmt / tree-sitter-fmt, our only node-language hooks.

This is upstream's own fix, from cursorless-dev/cursorless 603c4ffdc ("Update dependency versions", #3295), which this branch predates. Taking just the workflow hunk leaves .github/workflows/pre-commit.yml byte-identical to upstream/main, so the branch rebases cleanly.

Why not bump Node instead (a dead end I ruled out)

My first attempt was to bump .nvmrc past the broken npm. That does clear EALLOWGIT — I bisected it by installing talon-tools v0.9.0 exactly the way pre-commit does:

npm	result
11.9.0 (bundled with Node 24.14.0, our pin)	EALLOWGIT
11.12.1	EALLOWGIT
11.13.0 (first in Node 24.16.0)	ok
11.15.0	ok

But CI then failed one step later with Executable 'talon-fmt' not found — npm accepts the git spec on the newer npm yet still doesn't link the hook's bins under pre-commit 4.6. So the Node bump treats a symptom; the pre-commit version is the actual cause. That commit is dropped and .nvmrc stays at upstream's v24.14.0.

talon-tools stays at rev: v0.9.0 deliberately: later revs change formatter output and would rewrite .talon/.scm files across the repo, which is a separate change and not needed here.

Verification

• oxlint -c oxlint.config.mts --deny-warnings . → exits 0
• oxfmt --check . → "All matched files use the correct format", 1255 files
• tsc in packages/command-visualizer → exits 0
• pre-commit ran clean on both commits locally (all hooks Passed/Skipped)
• Lint check is already green on this PR; Pre-commit re-run pending on this push

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 60d8e39c-8621-4332-be2b-a4e5ba91c46e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[trillium]

Both checks this PR targets are now green: Lint ✅ and Pre-commit ✅.

Test (macos-latest, stable) still fails, but not from this diff — it is a separate pre-existing failure on the base branch:

- Downloading (300.42 MB)
Test error: Error: spawn .../.vscode-test/vscode-darwin-arm64-1.131.0/Visual Studio Code.app/Contents/MacOS/Electron ENOENT

@vscode/test-electron pulls VS Code 1.131.0 for darwin-arm64 and the extracted app has no Electron binary, so the harness never starts. Reproduced on a clean re-run of just that job. Nothing in this PR touches the VS Code extension test path — packages/command-visualizer is not loaded by it, and the other change is a workflow-only pin.

For contrast, on the earlier attempt at this work (fm/cursorless-lint-debt) the ubuntu, windows and macOS test jobs all failed; on this branch ubuntu (stable + legacy), windows and neovim all pass and only the macOS download is broken. Left alone as out of scope — happy to open a separate issue for it.