chore: re-enable the prefer-const ESLint rule (#250)

* chore: re-enable the prefer-const ESLint rule

prefer-const was disabled in src/eslint.config.mjs under a "TODO: re-enable" comment. Re-enabled with { destructuring: "all" } so it only flags a destructuring declaration when every binding can be const. Most violations were auto-fixed (let -> const); five declare-then-assign cases were merged by hand into a single const declaration. No behavior change — tsc and the tests for the touched modules pass.

* fix(McpHub): pass cancellationDisposable to cleanup() to avoid TDZ on sync cancellation

When CancellationToken.onCancellationRequested() registers a listener
on an already-cancelled token, VS Code fires the callback synchronously
inside the registration call — before the `const cancellationDisposable
= onCancellationRequested(...)` assignment completes. The old `let`-
predeclared shape was no-op-safe via optional chaining, but the
prefer-const consolidation in this PR put `cancellationDisposable`
into the temporal dead zone for the duration of the sync callback,
turning the already-cancelled path into a ReferenceError.

Restructured cleanup() to receive the disposable as a parameter
instead of capturing it from outer scope:
  - cleanup signature now takes `disposable?: vscode.Disposable`
  - non-callback call sites pass cancellationDisposable explicitly
  - the cancellation callback calls cleanup() with no arg; VS Code's
    CancellationToken cleans up its own listener after firing, so
    disposing from inside the listener was already redundant

Keeps cancellationDisposable as a const, so prefer-const remains
satisfied. Includes a regression test that fires the cancellation
listener synchronously during registration and asserts the flow
resolves cleanly.

* fix(McpHub): register the oauth watcher before installing the cancellation callback

The previous TDZ fix made cancellationDisposable safe under
synchronous callback firing, but the _oauthWatchers.set(watcherKey, ...)
call after the onCancellationRequested(...) registration is still
racy. If the token is already cancelled at registration time and
the callback fires synchronously, cleanup() runs (which tries to
_oauthWatchers.delete the entry) before the entry has been added,
leaving an orphan watcher in the map after the flow has otherwise
torn itself down.

Moved the watcher registration above the onCancellationRequested
call so the entry exists in the map before the callback can fire.
A sync-firing cleanup() now finds and deletes it cleanly. Extended
the existing already-cancelled-token regression test to assert
_oauthWatchers is empty after the flow resolves.

* test: increasing coverage of touched files

* fix(vitest): addressing test flake on teardown

---------

Co-authored-by: 0xMink <260166390+0xMink@users.noreply.github.com>
Co-authored-by: Elliott de Launay <edelauna@gmail.com>
Co-authored-by: Elliott de Launay <edelaunay@wealthsimple.com>

Author: 0xMink

.changeset/fix-multiline-quoted-command-parsing.md

@@ -14,4 +14,4 @@ Quote masking is comment-aware: a quote character inside a `#` comment is not pa
 
 **Pattern selector (UI)**: the command pattern breakdown shown after execution now uses the same heredoc- and quote-aware parser (`parseCommand`) before extracting patterns, so an unterminated or terminated heredoc no longer produces spurious tokens like `EOF`, body-line words, or `<<` fragments in the allow/deny selector.
 
-Note: this change only prevents *auto-approval* of fragments from a malformed command; it does not reject malformed commands before execution, which will be addressed in a separate PR to keep the scope focused here.
+Note: this change only prevents _auto-approval_ of fragments from a malformed command; it does not reject malformed commands before execution, which will be addressed in a separate PR to keep the scope focused here.

README.md

@@ -89,7 +89,7 @@ for this exact support, so if you are having problems or if you have question, j
 - [简体中文](locales/zh-CN/README.md)
 - [繁體中文](locales/zh-TW/README.md)
 - ...
-      </details>
+  </details>
 
 ---
 

src/api/providers/__tests__/unbound.spec.ts

@@ -181,4 +181,24 @@ describe("UnboundHandler", () => {
 			}),
 		)
 	})
+
+	it("completePrompt returns the response text", async () => {
+		const mockCreate = (OpenAI as unknown as any)().chat.completions.create
+		mockCreate.mockResolvedValue({
+			choices: [{ message: { content: "completed text" } }],
+		})
+
+		const handler = new UnboundHandler({
+			unboundApiKey: "test-key",
+			unboundModelId: "openai/gpt-4o",
+		})
+
+		const result = await handler.completePrompt("Write a haiku")
+		expect(result).toBe("completed text")
+		expect(mockCreate).toHaveBeenCalledWith(
+			expect.objectContaining({
+				messages: [{ role: "system", content: "Write a haiku" }],
+			}),
+		)
+	})
 })

src/api/providers/anthropic-vertex.ts

@@ -71,7 +71,7 @@ export class AnthropicVertexHandler extends BaseProvider implements SingleComple
 		messages: Anthropic.Messages.MessageParam[],
 		metadata?: ApiHandlerCreateMessageMetadata,
 	): ApiStream {
-		let { id, info, temperature, maxTokens, reasoning: thinking, betas } = this.getModel()
+		const { id, info, temperature, maxTokens, reasoning: thinking, betas } = this.getModel()
 
 		const { supportsPromptCache } = info
 
@@ -210,7 +210,7 @@ export class AnthropicVertexHandler extends BaseProvider implements SingleComple
 
 	getModel() {
 		const modelId = this.options.apiModelId
-		let id = modelId && modelId in vertexModels ? (modelId as VertexModelId) : vertexDefaultModelId
+		const id = modelId && modelId in vertexModels ? (modelId as VertexModelId) : vertexDefaultModelId
 		let info: ModelInfo = vertexModels[id]
 
 		// Check if 1M context beta should be enabled for supported models
@@ -270,7 +270,7 @@ export class AnthropicVertexHandler extends BaseProvider implements SingleComple
 
 	async completePrompt(prompt: string) {
 		try {
-			let {
+			const {
 				id,
 				info: { supportsPromptCache },
 				temperature,

src/api/providers/anthropic.ts

@@ -54,7 +54,7 @@ export class AnthropicHandler extends BaseProvider implements SingleCompletionHa
 	): ApiStream {
 		let stream: AnthropicStream<Anthropic.Messages.RawMessageStreamEvent>
 		const cacheControl: CacheControlEphemeral = { type: "ephemeral" }
-		let {
+		const {
 			id: modelId,
 			betas = ["fine-grained-tool-streaming-2025-05-14"],
 			maxTokens,
@@ -352,7 +352,7 @@ export class AnthropicHandler extends BaseProvider implements SingleCompletionHa
 
 	getModel() {
 		const modelId = this.options.apiModelId
-		let id = modelId && modelId in anthropicModels ? (modelId as AnthropicModelId) : anthropicDefaultModelId
+		const id = modelId && modelId in anthropicModels ? (modelId as AnthropicModelId) : anthropicDefaultModelId
 		let info: ModelInfo = anthropicModels[id]
 
 		// If 1M context beta is enabled for supported models, update the model info
@@ -398,7 +398,7 @@ export class AnthropicHandler extends BaseProvider implements SingleCompletionHa
 	}
 
 	async completePrompt(prompt: string) {
-		let { id: model, temperature } = this.getModel()
+		const { id: model, temperature } = this.getModel()
 
 		let message
 		try {

src/api/providers/bedrock.ts

@@ -216,7 +216,7 @@ export class AwsBedrockHandler extends BaseProvider implements SingleCompletionH
 	constructor(options: ProviderSettings) {
 		super()
 		this.options = options
-		let region = this.options.awsRegion
+		const region = this.options.awsRegion
 
 		// process the various user input options, be opinionated about the intent of the options
 		// and determine the model to use during inference and for cost calculations
@@ -591,8 +591,11 @@ export class AwsBedrockHandler extends BaseProvider implements SingleCompletionH
 						//so that pricing, context window, caching etc have values that can be used
 						//However, we want to keep the id of the model to be the ID for the router for
 						//subsequent requests so they are sent back through the router
-						let invokedArnInfo = this.parseArn(streamEvent.trace.promptRouter.invokedModelId)
-						let invokedModel = this.getModelById(invokedArnInfo.modelId as string, invokedArnInfo.modelType)
+						const invokedArnInfo = this.parseArn(streamEvent.trace.promptRouter.invokedModelId)
+						const invokedModel = this.getModelById(
+							invokedArnInfo.modelId as string,
+							invokedArnInfo.modelType,
+						)
 						if (invokedModel) {
 							invokedModel.id = modelConfig.id
 							this.costModelConfig = invokedModel
@@ -934,7 +937,7 @@ export class AwsBedrockHandler extends BaseProvider implements SingleCompletionH
 		}
 
 		// Get cache point placements
-		let strategy = new MultiPointStrategy(config)
+		const strategy = new MultiPointStrategy(config)
 		const cacheResult = strategy.determineOptimalCachePoints()
 
 		// Store cache point placements for future use if conversation ID is provided
@@ -998,7 +1001,7 @@ export class AwsBedrockHandler extends BaseProvider implements SingleCompletionH
 		 */
 
 		const arnRegex = /^arn:[^:]+:(?:bedrock|sagemaker):([^:]+):([^:]*):(?:([^\/]+)\/([\w\.\-:]+)|([^\/]+))$/
-		let match = arn.match(arnRegex)
+		const match = arn.match(arnRegex)
 
 		if (match && match[1] && match[3] && match[4]) {
 			// Create the result object
@@ -1025,7 +1028,7 @@ export class AwsBedrockHandler extends BaseProvider implements SingleCompletionH
 			// Check if the original model ID had a region prefix
 			if (originalModelId && result.modelId !== originalModelId) {
 				// If the model ID changed after parsing, it had a region prefix
-				let prefix = originalModelId.replace(result.modelId, "")
+				const prefix = originalModelId.replace(result.modelId, "")
 				result.crossRegionInference = AwsBedrockHandler.isSystemInferenceProfile(prefix)
 			}
 

src/api/providers/fake-ai.ts

@@ -38,7 +38,7 @@ interface FakeAI {
  *
  * We use the ID to lookup the original FakeAI object in the mapping.
  */
-let fakeAiMap: Map<string, FakeAI> = new Map()
+const fakeAiMap: Map<string, FakeAI> = new Map()
 
 export class FakeAIHandler implements ApiHandler, SingleCompletionHandler {
 	private ai: FakeAI

src/api/providers/fetchers/ollama.ts

@@ -81,7 +81,7 @@ export async function getOllamaModels(
 
 		const response = await axios.get<OllamaModelsResponse>(`${baseUrl}/api/tags`, { headers })
 		const parsedResponse = OllamaModelsResponseSchema.safeParse(response.data)
-		let modelInfoPromises = []
+		const modelInfoPromises = []
 
 		if (parsedResponse.success) {
 			for (const ollamaModel of parsedResponse.data.models) {

src/api/providers/fetchers/opencode-go.ts

@@ -72,7 +72,9 @@ export async function getOpencodeGoModels(apiKey?: string): Promise<Record<strin
 		const data = Array.isArray(rawData) ? rawData : []
 
 		if (!result.success) {
-			console.warn(`Opencode Go models response did not match expected schema; falling back to per-item parsing: ${JSON.stringify(result.error.format())}`)
+			console.warn(
+				`Opencode Go models response did not match expected schema; falling back to per-item parsing: ${JSON.stringify(result.error.format())}`,
+			)
 		}
 
 		for (const rawModel of data) {

src/api/providers/gemini.ts

@@ -678,7 +678,7 @@ export class GeminiHandler extends BaseProvider implements SingleCompletionHandl
 		// Bill both completion and reasoning ("thoughts") tokens as output.
 		const billedOutputTokens = outputTokens + reasoningTokens
 
-		let cacheReadCost = cacheReadTokens > 0 ? cacheReadsPrice * (cacheReadTokens / 1_000_000) : 0
+		const cacheReadCost = cacheReadTokens > 0 ? cacheReadsPrice * (cacheReadTokens / 1_000_000) : 0
 
 		const inputTokensCost = inputPrice * (uncachedInputTokens / 1_000_000)
 		const outputTokensCost = outputPrice * (billedOutputTokens / 1_000_000)