Add code complexity report and quality checks with ratcheting cap

.github/workflows/build-ts.yml

@@ -88,6 +88,52 @@ jobs:
           else
             npm run lint
           fi
+      # Complexity gate (PRs only): the files this PR changes may not add
+      # functions over the cyclomatic/cognitive budget versus the base branch
+      # (a stateless ratchet — the base branch is the baseline, so the count
+      # can only trend down), and any brand-new file is additionally held to a
+      # hard cap.  Tune the thresholds down as hotspots get refactored.
+      - name: Complexity ratchet
+        if: ${{ github.event_name == 'pull_request' && steps.filter.outputs.ts != 'false' }}
+        working-directory: ts
+        shell: bash
+        run: |
+          git fetch --no-tags origin "${{ github.base_ref }}"
+          npm run code-complexity -- --ratchet --base "origin/${{ github.base_ref }}" \
+            --cyclomatic 25 --cognitive 30 \
+            --new-file-cyclomatic 25 --new-file-cognitive 30
+      # Lint ratchet (PRs only): the files this PR changes may not add ESLint
+      # violations (no-explicit-any, no-console, no-unused-vars, ...) versus the
+      # base branch.  Syntactic rules only, so it is fast; the count can only
+      # trend down.  Run `npm run code-lint` locally to see the full report.
+      - name: Lint ratchet
+        if: ${{ github.event_name == 'pull_request' && steps.filter.outputs.ts != 'false' }}
+        working-directory: ts
+        shell: bash
+        run: |
+          git fetch --no-tags origin "${{ github.base_ref }}"
+          npm run code-lint -- --ratchet --base "origin/${{ github.base_ref }}"
+      # Circular-dependency ratchet (PRs only): fail if the change introduces a
+      # runtime import cycle not already present at the base.  Builds the cycle
+      # set for HEAD and for the merge base (via a throwaway git worktree), so
+      # this step is heavier than the others (madge runs twice).
+      - name: Circular dependency ratchet
+        if: ${{ github.event_name == 'pull_request' && steps.filter.outputs.ts != 'false' }}
+        working-directory: ts
+        shell: bash
+        run: |
+          git fetch --no-tags origin "${{ github.base_ref }}"
+          npm run code-circular -- --ratchet --base "origin/${{ github.base_ref }}"
+      # Test-debt gate (PRs only): zero tolerance for focused tests
+      # (.only/fit/fdescribe) and no newly skipped tests (.skip/xit/xdescribe)
+      # in changed files.  A small, fixable problem -> a hard gate, not a ratchet.
+      - name: Test debt gate
+        if: ${{ github.event_name == 'pull_request' && steps.filter.outputs.ts != 'false' }}
+        working-directory: ts
+        shell: bash
+        run: |
+          git fetch --no-tags origin "${{ github.base_ref }}"
+          npm run code-debt -- --gate --base "origin/${{ github.base_ref }}"
       - name: Restore better-sqlite3 for Node.js
         if: ${{ github.event_name != 'pull_request' || steps.filter.outputs.ts != 'false' }}
         working-directory: ts

ts/.gitignore

@@ -23,6 +23,27 @@ examples/schemaStudio/output/
 # Contains actual account names, endpoints, and subdomain names — never commit.
 tools/scripts/pools.inventory.json
 
+# Generated complexity report output (tools/scripts/code/complexityReport.ts).
+tools/scripts/code/complexity-report/
+
+# Generated duplication report output (tools/scripts/code/duplicationReport.ts).
+tools/scripts/code/duplication-report/
+
+# Generated consistency report output (tools/scripts/code/consistencyReport.ts).
+tools/scripts/code/consistency-report/
+
+# Generated lint report output (tools/scripts/code/lintReport.ts).
+tools/scripts/code/lint-report/
+
+# Generated circular-dependency report output (tools/scripts/code/circularDepsReport.ts).
+tools/scripts/code/circular-report/
+
+# Generated dead-code report output (tools/scripts/code/deadCodeReport.ts).
+tools/scripts/code/deadcode-report/
+
+# Generated debt-markers report output (tools/scripts/code/debtMarkersReport.ts).
+tools/scripts/code/debt-report/
+
 # Per-developer YAML config overrides loaded by @typeagent/config.
 # Holds local endpoints, deployment names, and (in Phase 1) secrets.
 # Never commit.

ts/package.json

@@ -25,6 +25,13 @@
     "clean": "fluid-build . -t clean",
     "cli": "pnpm -C packages/cli run start",
     "cli:dev": "pnpm -C packages/cli run start:dev",
+    "code-circular": "npx tsx tools/scripts/code/circularDepsReport.ts",
+    "code-complexity": "npx tsx tools/scripts/code/complexityReport.ts",
+    "code-consistency": "npx tsx tools/scripts/code/consistencyReport.ts",
+    "code-deadcode": "npx tsx tools/scripts/code/deadCodeReport.ts",
+    "code-debt": "npx tsx tools/scripts/code/debtMarkersReport.ts",
+    "code-duplication": "npx tsx tools/scripts/code/duplicationReport.ts",
+    "code-lint": "npx tsx tools/scripts/code/lintReport.ts",
     "copilot": "node packages/copilot-plugin/scripts/launch.mjs",
     "copilot:dev": "node packages/copilot-plugin/scripts/launch-dev.mjs",
     "devtunnel:setup": "node tools/scripts/setup-devtunnel.mjs",
@@ -73,10 +80,16 @@
   "devDependencies": {
     "@fluidframework/build-tools": "^0.57.0",
     "@types/node": "^22.0.0",
+    "eslint": "^10.6.0",
+    "eslint-plugin-sonarjs": "^4.1.0",
+    "jscpd": "^4.2.5",
+    "knip": "^6.24.0",
+    "madge": "^8.0.0",
     "markdown-link-check": "^3.14.2",
     "prettier": "^3.5.3",
     "shx": "^0.4.0",
-    "tsx": "^4.21.0"
+    "tsx": "^4.21.0",
+    "typescript-eslint": "^8.62.1"
   },
   "packageManager": "pnpm@10.34.4+sha512.8768be55200ae3f2226b6527fcca2687e14bc4e5f12d7721a0f25da3df47915177058648db4177baf348120fa0ba2752d8d8d93f6beaf1fe64ae18da8de961af",
   "engines": {
@@ -108,7 +121,6 @@
       "keytar",
       "koffi",
       "onnxruntime-node",
-      "protobufjs",
       "puppeteer",
       "sharp"
     ],