fix(types): align with fleet-strict flags (unused/indexed/verbatim/exact)

Fixes 157 type errors surfaced by the flipped flags in the fleet-canonical
tsconfig.base.json:

- noUnusedLocals / noUnusedParameters: drop unused destructure targets,
  prefix VS Code API callback params with `_`, replace assign-and-discard
  `const x = stack.pop()!` with a bare `stack.pop()` when only the
  side-effect matters.
- noUncheckedIndexedAccess: add `!` to bounded for-loop array indexing,
  ?? fallbacks where index is past-end is possible, narrow optional chain
  results with explicit `if (!x) continue`.
- noPropertyAccessFromIndexSignature: switch `match.groups.target` and
  `globPatterns.npm.packagejson.pattern` style accesses to bracket form
  (factored into a `globPattern(eco, file)` helper for parse-externals).
- exactOptionalPropertyTypes: drop explicit `undefined` values from
  optional-property object literals (auth settings, fs-watch handler).
- verbatimModuleSyntax: split mixed value/type imports — `SimPURL`,
  `PackageScoreAndAlerts`, `PURL_Type` now import via `import type`.
- noPropertyAccessFromIndexSignature on `match.groups`, drop unused
  `json` and `getDefaultLogger` imports.

Also fixes `flattenGlob` returning `string | undefined` (was
`parts[0]` with `noUncheckedIndexedAccess` active, now `parts[0] ?? ''`)
and stops the wasm-executor's `++goRefCount[id]` / `!--goRefCount[id]`
from silently producing NaN by reading-then-writing via `(x ?? 0) + 1`.

Author: jdalton

src/auth.ts

@@ -106,9 +106,7 @@ export async function activate(
     return {}
   }
   async function syncLiveSessionFromDisk() {
-    let settings_on_disk: { apiKey?: string } = {
-      apiKey: undefined,
-    }
+    let settings_on_disk: { apiKey?: string } = {}
     try {
       const fromDisk = JSON.parse(
         Buffer.from(
@@ -197,14 +195,14 @@ export async function activate(
         return diskSessionsChanges.event(fn)
       },
       async getSessions(
-        scopes: readonly string[] | undefined,
-        options: vscode.AuthenticationProviderSessionOptions,
+        _scopes: readonly string[] | undefined,
+        _options: vscode.AuthenticationProviderSessionOptions,
       ): Promise<vscode.AuthenticationSession[]> {
         return Array.from(liveSessions.values())
       },
       async createSession(
-        scopes: readonly string[],
-        options: vscode.AuthenticationProviderSessionOptions,
+        _scopes: readonly string[],
+        _options: vscode.AuthenticationProviderSessionOptions,
       ): Promise<vscode.AuthenticationSession> {
         let organizations: OrganizationsRecord
         const apiKey: string =
@@ -223,6 +221,9 @@ export async function activate(
           throw new Error('User did not want to provide an API key')
         }
         const org = Object.values(organizations!.organizations)[0]
+        if (!org) {
+          throw new Error('No organization found for the provided API key')
+        }
         const session = sessionFromAPIKey(apiKey, org)
         const oldSessions = Array.from(liveSessions.values())
         await syncLiveSessionToDisk(session)
@@ -273,13 +274,12 @@ export async function activate(
   )
   context.subscriptions.push(service)
   vscode.commands.registerCommand(`${EXTENSION_PREFIX}.login`, async () => {
-    const session = await vscode.authentication.getSession(
-      `${EXTENSION_PREFIX}`,
-      [],
-      {
-        createIfNone: true,
-      },
-    )
+    // The getSession call is intentionally side-effect-only: passing
+    // `createIfNone: true` triggers the login flow if no session
+    // exists; we don't need the returned session here.
+    await vscode.authentication.getSession(`${EXTENSION_PREFIX}`, [], {
+      createIfNone: true,
+    })
   })
   try {
     await syncLiveSessionFromDisk()

src/data/editor-config.ts

@@ -71,7 +71,7 @@ export function activate(context: vscode.ExtensionContext) {
         fn,
       }
       for (let i = 0, { length } = sections; i < length; i += 1) {
-        const section = sections[i]
+        const section = sections[i]!
         const list = watchers.get(section) ?? new Set()
         list.add(listener)
         watchers.set(section, list)
@@ -83,7 +83,7 @@ export function activate(context: vscode.ExtensionContext) {
         currentValues: getValuesForListener(listener),
         dispose() {
           for (let i = 0, { length } = sections; i < length; i += 1) {
-            const section = sections[i]
+            const section = sections[i]!
             const list = watchers.get(section)
             if (!list) {
               continue

src/data/github.ts

@@ -9,7 +9,7 @@ export function orgOrUserFromString(url: string): string | undefined {
     /^(?:git(?:\+ssh)?:\/\/)?(?<user>[^@]+@)?github.com[/:](?<target>[^/?#]*)(?=\/|$)/u // socket-hook: allow regex-alternation-order
   const match = ghHTTP.exec(url) || ghGit.exec(url)
   if (match) {
-    return match.groups?.target || match.groups?.user
+    return match.groups?.['target'] || match.groups?.['user']
   }
 }
 
@@ -78,9 +78,9 @@ export async function sniffForGithubOrgOrUser(
     )
     const keys = Object.keys(gitConfig)
     for (let i = 0, { length } = keys; i < length; i += 1) {
-      const key = keys[i]
+      const key = keys[i]!
       if (key.startsWith('remote ')) {
-        const url = gitConfig[key].url
+        const url = gitConfig[key]?.url
         if (url) {
           const found = orgOrUserFromString(url)
           if (found) return found

src/data/glob-patterns.ts

@@ -34,14 +34,17 @@ export async function getGlobPatterns() {
           throw new Error(result.error.message)
         }
         for (const eco in result) {
-          for (const name in result[eco]) {
-            const target = result[eco][name]
+          const bucket = result[eco]
+          if (!bucket) continue
+          for (const name in bucket) {
+            const target = bucket[name]
+            if (!target) continue
             target.pattern = caseDesensitize(flattenGlob(target.pattern))
           }
         }
         return result
       })
-      .catch(err => {
+      .catch(_err => {
         // allow retry
         globPatternsPromise = undefined
         // snapshot of supported patterns

src/data/go/wasm-executor.ts

@@ -265,7 +265,7 @@ export class GoExecutor<
         goKeys!.set(v, id)
         goRefCount![id] = 0
       }
-      ++goRefCount![id]
+      goRefCount![id] = (goRefCount![id] ?? 0) + 1
 
       let typeFlag = 0
       switch (typeof v) {
@@ -371,7 +371,9 @@ export class GoExecutor<
       'syscall/js.finalizeRef': (sp: number) => {
         sp >>>= 0
         const id = this.mem!.getUint32(sp + 8, true)
-        if (!--goRefCount![id]) {
+        const next = (goRefCount![id] ?? 0) - 1
+        goRefCount![id] = next
+        if (next === 0) {
           const v = goValues!.get(id)
           goValues!.delete(id)
           goKeys!.delete(v)
@@ -563,7 +565,7 @@ export class GoExecutor<
 
     const argv = offset
     for (let i = 0, { length } = argvPtrs; i < length; i += 1) {
-      const ptr = argvPtrs[i]
+      const ptr = argvPtrs[i]!
       this.mem!.setUint32(offset, ptr, true)
       this.mem!.setUint32(offset + 4, 0, true)
       offset += 8

src/data/python/interpreter.ts

@@ -286,7 +286,7 @@ export async function getPythonInterpreter(
 export async function initPython(): Promise<vscode.Disposable> {
   const ext = await getPythonExtension()
   if (ext) {
-    return ext.environments.onDidChangeActiveEnvironmentPath((e: unknown) => {
+    return ext.environments.onDidChangeActiveEnvironmentPath((_e: unknown) => {
       changeMSPython.fire()
     })
   }

src/extension.ts

@@ -25,10 +25,10 @@ export async function activate(context: vscode.ExtensionContext) {
       )
     const provider: vscode.McpServerDefinitionProvider<vscode.McpHttpServerDefinition> =
       {
-        provideMcpServerDefinitions(token) {
+        provideMcpServerDefinitions(_token) {
           return [definition]
         },
-        resolveMcpServerDefinition(definition, token) {
+        resolveMcpServerDefinition(definition, _token) {
           return definition
         },
       }

src/fs-watch.ts

@@ -42,11 +42,10 @@ class SharedFilesystemWatcher {
   }
   watch(partial: SharedFilesystemWatcherHandler): vscode.Disposable {
     // avoid double push issue by making new identity
-    const handler = {
-      onDidChange: partial.onDidChange,
-      onDidCreate: partial.onDidCreate,
-      onDidDelete: partial.onDidDelete,
-    }
+    const handler: SharedFilesystemWatcherHandler = {}
+    if (partial.onDidChange) handler.onDidChange = partial.onDidChange
+    if (partial.onDidCreate) handler.onDidCreate = partial.onDidCreate
+    if (partial.onDidDelete) handler.onDidDelete = partial.onDidDelete
     this.handlers.add(handler)
     return new vscode.Disposable(() => {
       this.handlers.delete(handler)
@@ -60,9 +59,12 @@ export function watch(
   pattern: string,
   handler: SharedFilesystemWatcherHandler,
 ) {
-  if (!watched[pattern])
-    watched[pattern] = new SharedFilesystemWatcher(
+  let existing = watched[pattern]
+  if (!existing) {
+    existing = new SharedFilesystemWatcher(
       vscode.workspace.createFileSystemWatcher(`**/${pattern}`),
     )
-  return watched[pattern].watch(handler)
+    watched[pattern] = existing
+  }
+  return existing.watch(handler)
 }

src/ui/decorations.ts

@@ -1,22 +1,22 @@
 // max-file-lines: legitimate parser — VSCode-decoration manager for per-document PURL hover/decoration rendering; the per-eco classification, per-PURL alert grouping, and per-editor decoration pipeline are tightly coupled and split poorly.
 import * as vscode from 'vscode'
-import { SimPURL, parseExternals } from './externals/parse-externals'
+import { parseExternals } from './externals/parse-externals'
+import type { SimPURL } from './externals/parse-externals'
 import { PURLDataCache } from './purl-alerts-and-scores/manager'
-import { PackageScoreAndAlerts } from './purl-alerts-and-scores/manager'
+import type { PackageScoreAndAlerts } from './purl-alerts-and-scores/manager'
 import { isGoBuiltin } from '../data/go/builtins'
 import { logger } from '../infra/log'
 import { PURLPackageData } from './purl-alerts-and-scores/manager'
 import { SUPPORTED_LSP_LANGUAGE_IDS_TO_PARSER } from './languages'
 import { isPythonBuiltin } from '../data/python/interpreter'
 import * as Module from 'node:module'
 import { getGlobPatterns } from '../data/glob-patterns'
-import { getDefaultLogger } from '@socketsecurity/lib/logger'
 
 export async function activate(context: vscode.ExtensionContext) {
   const decoManager = new DecorationManager(context)
   const langs = Object.keys(SUPPORTED_LSP_LANGUAGE_IDS_TO_PARSER)
   for (let i = 0, { length } = langs; i < length; i += 1) {
-    const lang = langs[i]
+    const lang = langs[i]!
     vscode.languages.registerHoverProvider(
       {
         language: lang,
@@ -33,14 +33,14 @@ export async function activate(context: vscode.ExtensionContext) {
   const patterns = await getGlobPatterns()
   const groupEntries = Object.entries(patterns)
   for (let i = 0, { length } = groupEntries; i < length; i += 1) {
-    const patternsForGroup = groupEntries[i][1]
+    const patternsForGroup = groupEntries[i]![1]
     const groupEntryRows = Object.entries(patternsForGroup)
     for (
       let j = 0, { length: rowLength } = groupEntryRows;
       j < rowLength;
       j += 1
     ) {
-      const { pattern } = groupEntryRows[j][1]
+      const { pattern } = groupEntryRows[j]![1]
       vscode.languages.registerHoverProvider(
         {
           // language: 'json',
@@ -127,7 +127,7 @@ class DecorationManager {
     }
     const visibleEditors = vscode.window.visibleTextEditors
     for (let i = 0, { length } = visibleEditors; i < length; i += 1) {
-      const editor = visibleEditors[i]
+      const editor = visibleEditors[i]!
       const docURI = editor.document.uri.toString() as TextDocumentURIString
       const manager = managerForDoc(docURI)
       manager.update(editor.document)
@@ -137,7 +137,7 @@ class DecorationManager {
       if (!hasMeaningfulChange) {
         const { contentChanges } = doc
         for (let i = 0, { length } = contentChanges; i < length; i += 1) {
-          const docChange = contentChanges[i]
+          const docChange = contentChanges[i]!
           if (docChange.rangeLength !== 0) {
             hasMeaningfulChange = true
             break
@@ -164,7 +164,7 @@ class DecorationManager {
     this.editorChangeWatchers = vscode.window.onDidChangeVisibleTextEditors(
       editors => {
         for (let i = 0, { length } = editors; i < length; i += 1) {
-          const editor = editors[i]
+          const editor = editors[i]!
           const docURI = editor.document.uri.toString() as TextDocumentURIString
           const manager = managerForDoc(docURI)
           manager.decorateEditor(editor)
@@ -222,10 +222,12 @@ export function isLocalPackage(name: string, eco: string): boolean {
   if (eco === 'pypi') return name.startsWith('.')
   if (eco === 'go') {
     const parts = name.split('/')
+    const first = parts[0]
+    if (!first) return false
     return (
       parts.some(p => p.startsWith('.')) ||
-      !parts[0].includes('.') ||
-      !/[a-z0-9][a-z0-9.-]*/.test(parts[0])
+      !first.includes('.') ||
+      !/[a-z0-9][a-z0-9.-]*/.test(first)
     )
   }
   return false
@@ -325,7 +327,7 @@ class DecorationManagerForPURL {
     const {
       score: { overall: depscore },
     } = pkgData
-    const { eco, name } = getPURLParts(this.purl)!
+    const { eco } = getPURLParts(this.purl)!
     const depscoreStr = (depscore * 100).toFixed(0)
     const groupedAlerts = Object.groupBy(pkgData.alerts, alert => alert.action)
 
@@ -341,7 +343,7 @@ class DecorationManagerForPURL {
       // grouping is intentionally lossy — fewer dedup buckets keeps the hover readable when many alerts share a type.
       const typesListed = new Set<string>()
       for (let i = 0, { length } = actionGroupedAlertSet; i < length; i += 1) {
-        const alert = actionGroupedAlertSet[i]
+        const alert = actionGroupedAlertSet[i]!
         // vscode markdown wants some kind of text for the table layout
         const extra = []
         const alternatePackage = alert.props?.alternatePackage
@@ -433,7 +435,7 @@ ${(['error', 'warn', 'monitor', 'ignore'] as const)
     const { alerts } = pkgData
     this.decorationType = decorationTypes.informativeDecoration
     for (let i = 0, { length } = alerts; i < length; i += 1) {
-      const { action } = alerts[i]
+      const { action } = alerts[i]!
       if (action === 'error') {
         this.decorationType = decorationTypes.errorDecoration
         break
@@ -453,13 +455,13 @@ class DecorationManagerForDocument {
   // parameterized, shared across all instances
   purlManagers: DecorationManagerForPURLCache
   async provideHover(
-    document: vscode.TextDocument,
+    _document: vscode.TextDocument,
     position: vscode.Position,
   ): Promise<vscode.Hover | undefined> {
     // oxlint-disable-next-line socket/prefer-cached-for-loop -- iterating a Map.
     for (const [purl, { ranges }] of this.externalRefs) {
       for (let i = 0, { length } = ranges; i < length; i += 1) {
-        const range = ranges[i]
+        const range = ranges[i]!
         const intersects = range.contains(position)
         // logger.warn(document.getText(range), 'hovering over range', range, 'for purl', purl, 'intersects:', intersects, 'at position', position);
         if (intersects) {
@@ -528,7 +530,7 @@ class DecorationManagerForDocument {
           break
         }
         for (let i = 0, { length } = existing.ranges; i < length; i += 1) {
-          if (!ranges[i].isEqual(existing.ranges[i])) {
+          if (!ranges[i]!.isEqual(existing.ranges[i]!)) {
             isDirty = true
             break check_each_purl_is_same_ranges
           }
@@ -592,7 +594,7 @@ class DecorationManagerForDocument {
     )
     const visibleEditors = vscode.window.visibleTextEditors
     for (let i = 0, { length } = visibleEditors; i < length; i += 1) {
-      const editor = visibleEditors[i]
+      const editor = visibleEditors[i]!
       const editorURI = editor.document.uri.toString() as TextDocumentURIString
       if (editorURI === this.docURI) {
         logger.debug(`Matching editor ${editorURI} for decoration update`)