Remove Dead code

.eslintrc.cjs

@@ -8,5 +8,18 @@ module.exports = {
     ecmaVersion: "latest",
     sourceType: "script",
   },
-  rules: {},
+  rules: {
+    // `while (true)` stream-pump/retry loops are idiomatic here.
+    "no-constant-condition": ["error", { checkLoops: false }],
+    // `_`-prefix marks intentionally-unused params/vars (kept for signature
+    // position or documentation).
+    "no-unused-vars": [
+      "error",
+      {
+        argsIgnorePattern: "^_",
+        varsIgnorePattern: "^_",
+        caughtErrorsIgnorePattern: "^_",
+      },
+    ],
+  },
 };

.github/workflows/ci.yml

@@ -30,6 +30,14 @@ jobs:
         run: pnpm install --no-optional --ignore-scripts --no-frozen-lockfile
         timeout-minutes: 5
 
+      - name: Lint (blocking)
+        run: npx eslint src index.js --max-warnings 0
+        timeout-minutes: 3
+
+      - name: Audit (no high/critical)
+        run: npm audit --audit-level=high
+        timeout-minutes: 3
+
       - name: Test
         run: |
           DATABRICKS_API_KEY=test-key DATABRICKS_API_BASE=http://test.com \

.github/workflows/docker-publish.yml

@@ -0,0 +1,62 @@
+name: Publish Docker image
+
+# Builds and pushes the Lynkr image on every version tag, so the Docker side
+# of a release updates itself:
+#   ghcr.io/fast-editor/lynkr:<X.Y.Z>  and  :latest
+#
+# The Dockerfile needs no edits per release — VERSION/VCS_REF/BUILD_DATE are
+# injected as build args (the `ARG VERSION=` default in the Dockerfile is
+# only a fallback for local builds). docker-compose users track a release by
+# setting:  image: ghcr.io/fast-editor/lynkr:9.14.1
+#
+# Auth is the built-in GITHUB_TOKEN — no secrets to configure.
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-qemu-action@v3
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Derive tags and build args
+        id: meta
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "build_date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push (amd64 + arm64)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            ghcr.io/fast-editor/lynkr:${{ steps.meta.outputs.version }}
+            ghcr.io/fast-editor/lynkr:latest
+          build-args: |
+            VERSION=${{ steps.meta.outputs.version }}
+            VCS_REF=${{ github.sha }}
+            BUILD_DATE=${{ steps.meta.outputs.build_date }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/npm-publish.yml

@@ -39,8 +39,17 @@ jobs:
             exit 1
           fi
 
+      # pnpm, mirroring ci.yml: `npm ci` compiles native addons from source
+      # on runners and blows past any sane timeout (v9.14.1: 27 min;
+      # v9.14.2: 5-min timeout hit). The test gate doesn't need natives and
+      # `npm publish` only packs files.
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --no-optional --ignore-scripts --no-frozen-lockfile
+        timeout-minutes: 5
 
       # Gate on the routing regression suite. Widen to `npm run test:unit`
       # once the full suite is green in CI.

.gitignore

@@ -42,3 +42,8 @@ tmp/
 # ai-sdk-provider build output
 packages/ai-sdk-provider/dist/
 .env.bak-*
+
+# local db files
+src/db/*.sqlite
+.DS_Store
+HANDOFF.md

Dockerfile

@@ -12,9 +12,13 @@ RUN apk add --no-cache python3 make g++ git bash
 # Layer cache: install prod deps before copying source so this layer
 # is reused on source-only changes
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev && npm cache clean --force && rm -rf /root/.npm /tmp/*
+# --ignore-scripts: postinstall (scripts/check-native.js) isn't in the image
+# until COPY below — running it here fails the build. Natives are rebuilt
+# after the source lands.
+RUN npm ci --omit=dev --ignore-scripts && npm cache clean --force && rm -rf /root/.npm /tmp/*
 
 COPY . .
+RUN npm rebuild && node scripts/check-native.js || true
 
 ############################
 # Runtime stage