release: fix and improve code health and CI from the October 2026 audit #334

Context

This comes from a code audit of code health (file sizes, tests, CI workflows, private Angular API use, any, the compat matrix), done during a comparison with other devtools in October 2026. Roadmap items live in #310, #311, #312 and #313. Items marked (to confirm) were not reproduced.

Problems

High

• compat matrix skips the private-API collectors: pageSide lists 20 tests but leaves out injector-tree, defer-blocks, change-detection, component-tree, host-tree, signal-peek, signal-resources, cd-recorder and http-server, although those tests exist. So ɵgetInjectorResolutionPath, ɵgetInjectorProviders, ɵgetDeferBlocks, ɵgetControlFlowBlocks and ɵsetProfiler never run on Angular 20 or 21. Add them, with *-real variants that boot a real Angular app where the current tests use fakes. Add a pinned 20.3.x entry too, because publishesRouterUtil changes behaviour at 20.3.5 (packages/devtools/vitest.compat.config.ts:8-29, packages/devtools/src/router-setup.ts:66-72).

Medium

• very large files: devframe.ts has 2961 lines, and the panel pages network-inspector.ts (2709), analog-inspector.ts (2645), store-inspector.ts (2139), component-tree.ts (1981), di-inspector.ts (1849), forms-inspector.ts (1666), signal-inspector.ts (1656) and app/src/app.ts (1095) are hard to review. Split devframe.ts into one register module per inspector, like rpc/*-tools.ts, and split the pages into child components (toolbar, list, detail, timeline). Add a CI check for files over about 1000 lines, with an allowlist that only shrinks (packages/devtools/src/devframe.ts, app/src/pages/).
• no linter: there is no ESLint or oxlint config, so the any rule and .claude/rules/angular.md are not enforced. AnyRecord = Record<string, any> is declared in 7 files and used about 529 times; getNg() returns any; collectors use (...args: any[]). Add a typed NgDebugApi interface for window.ng, then typescript-eslint or oxlint with no-explicit-any as a warning, a count ratchet, and angular-eslint template rules, run in ci.yml (packages/devtools/src/analog-runtime.ts:14, pipes-runtime.ts:3, pipes-runtime.ts:256, forms-collector.ts:41, forms-collector.ts:50, overlay.ts:754, ngrx-overlay.ts:14, cd-overlay.ts:13, http-overlay.ts:18).
• no coverage measurement: neither packages/devtools/vitest.config.ts nor app/vitest.config.ts turns coverage on. rpc/injector-tools.ts, rpc/page-sessions.ts and rpc/pipes-agent.ts are not imported by any test, and app/src/pages/coming-soon.ts (494 lines) has no panel test. Turn on @vitest/coverage-v8 for both suites, write a summary to the job summary, set thresholds that may only rise, and add direct tests for injector-tools and page-sessions (pageId expiry).
• no Angular prerelease in the compat matrix: compat.yml covers ~20.0.0, ^21 and ^22 only, and latest.yml uses the peer ranges, so a ɵ rename in the next major shows up only after release. Add an @angular/*@next entry with continue-on-error (.github/workflows/compat.yml:24-32).
• Node and OS coverage does not match engines: engines.node is >=22, but ci.yml runs on Node 24 (.nvmrc) and compat.yml runs Node 22 only for the page side, so server, hub, CLI and Vite plugin tests never run on Node 22. Every job is Linux only, while the CLI, source-scan and analog-scan handle file paths. Add a Node 22 run of pnpm test:devtools and a windows-latest job for the CLI, source-scan and Vite tests (packages/devtools/package.json:119-121, .github/workflows/ci.yml).
• Vite peer range tested at one version: the peer is vite >=5, but the repository pins vite ^8.3.0, so Vite 5, 6 and 7 are never tested; devframe ^1.2.3 is only tested at its newest release. Add a Vite 5, 6, 7 and latest matrix running vite-server, vite-auth, vite-mcp-auth, vite-restart and vite-upgrade-guard, or raise the floor to what is tested (packages/devtools/package.json:92, package.json:89).
• publishing is manual: no workflow runs npm publish, and .github/actions/setup/action.yml:6 says "Only the release sets" registry-url although there is no release workflow. Releases have no npm provenance and no proof the tarball matches CI. Add a tag-triggered release.yml that builds, runs verify:publish and publishes with --provenance through OIDC trusted publishing (package.json:32).

Low

• commit and docs checks only warn: commit-message.yml passes --warn for both the title and the commit range, and docs-check.yml only emits ::warning. Since pull requests are squash merged, make the title check fail and keep the commit range as a warning; optionally fail the docs check unless no-docs is set. Update docs/contributing/commit-message-guidelines.md:8, which says the check only warns (.github/workflows/commit-message.yml, .github/workflows/docs-check.yml).
• axe runs on a static build only: test:axe audits bin.mjs build output, so states that need a live page (tabs, timelines, detail panes with data) are never checked. Add a Playwright run against the SSR demo on port 4000 that connects a page and runs axe on each inspector with data (package.json:19, scripts/panel-axe.mjs).

Improvements

• overlay: replace the scattered ng typings with one debug-api.ts that declares every ɵ member with @since and @minAngular notes, and generate the compat docs page from it (packages/devtools/src/ngrx-collector.ts:30, router.ts:92, injector-tree.ts:24, signal-graph.ts:16, change-detection.ts:4).
• overlay: a private-API canary test that, for each Angular version in the compat matrix, checks every ɵ symbol the package uses still exists, so a rename fails clearly instead of degrading silently (packages/devtools/vitest.compat.config.ts, packages/devtools/src/__tests__/).
• vite: a Vite tab with the module graph, transform timings and Angular compiler diagnostics, in the spirit of vite-plugin-inspect and the Nuxt DevTools Vite tab (packages/devtools/src/vite.ts, app/src/pages/).

Already tracked elsewhere

• Public plugin API for third-party tabs: phase 4 of 4: lead where no Angular devtools goes today #313
• Open in editor from every file:line: phase 1 of 4: safe by default, open in editor and cheap shell wins #310