ci(console-guard): upgrade no-console to error + add baseline guard script (#4233)

- Upgrade eslint no-console rule from warn to error for src/
- Exclude all 34 existing violator files (tracked for future cleanup)
- Add scripts/console-guard.sh — baseline counter that blocks new violations
- Wire console guard into CI lint job
- Goal: zero new console.* in production code; migrate existing to StructuredLogger

Author: OneStepAt4time

.github/workflows/ci.yml

@@ -64,6 +64,8 @@ jobs:
         run: npm run security-check
       - name: Run linter
         run: npm run lint
+      - name: Console.* guard — block new console.log/warn/error in src/
+        run: bash scripts/console-guard.sh
   feat-minor-bump-gate:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest

.gitignore

@@ -84,3 +84,4 @@ wt/
 coverage/
 wt-last-updated
 wt-i18n-sessionboard
+aegis

eslint.config.js

@@ -29,11 +29,57 @@ export default [
       ],
     },
   },
+  // no-console: error for production src/ — existing violators are excluded so CI stays green.
+  // Goal: shrink this list over time by migrating to StructuredLogger.
   {
     files: ['src/**/*.ts'],
-    ignores: ['src/__tests__/**', 'src/cli.ts', 'src/logger.ts'],
+    ignores: [
+      'src/__tests__/**',
+      // Core infra — logger, CLI, startup bootstrap
+      'src/cli.ts',
+      'src/logger.ts',
+      'src/startup.ts',
+      'src/suppress.ts',
+      'src/tracing.ts',
+      // Hooks & permissions
+      'src/hooks.ts',
+      'src/hook.ts',
+      'src/permission-guard.ts',
+      'src/permission-request-manager.ts',
+      // Sessions
+      'src/session.ts',
+      'src/session-discovery.ts',
+      'src/session-transcripts.ts',
+      // ACP
+      'src/services/acp/backend.ts',
+      'src/services/auth/AuthManager.ts',
+      'src/services/state/JsonFileStore.ts',
+      // Channels
+      'src/channels/email.ts',
+      'src/channels/manager.ts',
+      'src/channels/slack.ts',
+      'src/channels/telegram.ts',
+      'src/channels/webhook.ts',
+      // Server & config
+      'src/server.ts',
+      'src/config.ts',
+      'src/events.ts',
+      // Memory & learnings
+      'src/memory-bridge-learning.ts',
+      'src/memory-bridge.ts',
+      'src/structured-learnings.ts',
+      // Misc
+      'src/file-utils.ts',
+      'src/jsonl-watcher.ts',
+      'src/mcp/server.ts',
+      'src/question-manager.ts',
+      'src/signal-cleanup-helper.ts',
+      'src/template-store.ts',
+      'src/transcript.ts',
+      'src/webhook/verify.ts',
+    ],
     rules: {
-      'no-console': 'warn',
+      'no-console': 'error',
     },
   },
   {

scripts/console-guard.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# console-guard.sh — CI guard: fail if production src/ adds new console.* calls
+# Existing exceptions are tracked in eslint.config.js ignores.
+# This script provides a second layer: a baseline count that must not increase.
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel 2>/dev/null || echo .)"
+
+# Count console.* calls in non-test src/ (excluding comments)
+VIOLATIONS=$(grep -rn "console\.\(log\|warn\|error\)" src/ --include="*.ts" \
+  | grep -v "node_modules" \
+  | grep -v "__tests__" \
+  | grep -v "^\s*//" \
+  | grep -v "^\s*\*" \
+  | wc -l)
+
+BASELINE=165
+
+echo "Console.* violations in src/: ${VIOLATIONS}"
+echo "Baseline: ${BASELINE}"
+
+if [ "$VIOLATIONS" -gt "$BASELINE" ]; then
+  DIFF=$((VIOLATIONS - BASELINE))
+  echo ""
+  echo "❌ FAIL: ${DIFF} new console.* call(s) detected in production code."
+  echo "   Use StructuredLogger instead, or add the file to eslint.config.js ignores."
+  echo ""
+  echo "New violations:"
+  grep -rn "console\.\(log\|warn\|error\)" src/ --include="*.ts" \
+    | grep -v "node_modules" \
+    | grep -v "__tests__" \
+    | grep -v "^\s*//" \
+    | grep -v "^\s*\*" \
+    | head -20
+  exit 1
+fi
+
+if [ "$VIOLATIONS" -lt "$BASELINE" ]; then
+  DIFF=$((BASELINE - VIOLATIONS))
+  echo "✅ PASS: ${DIFF} violation(s) removed since baseline — consider updating BASELINE in this script."
+fi
+
+echo "✅ PASS: No new console.* violations."
+exit 0