merge main

Author: s77rt

.claude/agents/code-inline-reviewer.md

@@ -2,7 +2,7 @@
 
 name: code-inline-reviewer
 description: Reviews code and creates inline comments for specific rule violations.
-tools: Glob, Grep, Read, TodoWrite, Bash, BashOutput, KillBash, mcp__github_inline_comment__create_inline_comment
+tools: Glob, Grep, Read, TodoWrite, Bash, BashOutput, KillBash
 model: inherit
 ---
 
@@ -198,44 +198,12 @@ memo(ReportActionItem, (prevProps, nextProps) =>
 )
 ```
 
----
-
-### [PERF-6] Use specific properties as hook dependencies
-
-- **Search patterns**: `useEffect`, `useMemo`, `useCallback` dependency arrays
-
-- **Condition**: In `useEffect`, `useMemo`, and `useCallback`, specify individual object properties as dependencies instead of passing entire objects.
-- **Reasoning**: Passing entire objects as dependencies causes hooks to re-execute whenever any property changes, even unrelated ones. Specifying individual properties creates more granular dependency tracking, reducing unnecessary hook executions and improving performance predictability.
-
-Good:
-
-```tsx
-const {amountColumnSize, dateColumnSize, taxAmountColumnSize} = useMemo(() => {
-    return {
-        amountColumnSize: transactionItem.isAmountColumnWide ? CONST.SEARCH.TABLE_COLUMN_SIZES.WIDE : CONST.SEARCH.TABLE_COLUMN_SIZES.NORMAL,
-        taxAmountColumnSize: transactionItem.isTaxAmountColumnWide ? CONST.SEARCH.TABLE_COLUMN_SIZES.WIDE : CONST.SEARCH.TABLE_COLUMN_SIZES.NORMAL,
-        dateColumnSize: transactionItem.shouldShowYear ? CONST.SEARCH.TABLE_COLUMN_SIZES.WIDE : CONST.SEARCH.TABLE_COLUMN_SIZES.NORMAL,
-    };
-}, [transactionItem.isAmountColumnWide, transactionItem.isTaxAmountColumnWide, transactionItem.shouldShowYear]);
-```
-
-Bad:
-
-```tsx
-const {amountColumnSize, dateColumnSize, taxAmountColumnSize} = useMemo(() => {
-    return {
-        amountColumnSize: transactionItem.isAmountColumnWide ? CONST.SEARCH.TABLE_COLUMN_SIZES.WIDE : CONST.SEARCH.TABLE_COLUMN_SIZES.NORMAL,
-        taxAmountColumnSize: transactionItem.isTaxAmountColumnWide ? CONST.SEARCH.TABLE_COLUMN_SIZES.WIDE : CONST.SEARCH.TABLE_COLUMN_SIZES.NORMAL,
-        dateColumnSize: transactionItem.shouldShowYear ? CONST.SEARCH.TABLE_COLUMN_SIZES.WIDE : CONST.SEARCH.TABLE_COLUMN_SIZES.NORMAL,
-    };
-}, [transactionItem]);
-```
-
 ## Instructions
 
 1. **First, get the list of changed files and their diffs:**
    - Use `gh pr diff` to see what actually changed in the PR
    - Focus ONLY on the changed lines, not the entire file
+   - **CRITICAL**: Only create inline comments on lines that are part of the diff. Do NOT add comments to lines outside the diff, even if they contain violations. Comments on unchanged lines will fail to be created.
 2. **For analyzing changed files:**
    - **For large files (>5000 lines):** Use the Grep tool to search for specific violation patterns instead of reading the entire file. Focus grep searches on the changed portions shown in the diff.
    - **For smaller files:** You may read the full file using the Read tool
@@ -247,7 +215,7 @@ const {amountColumnSize, dateColumnSize, taxAmountColumnSize} = useMemo(() => {
    - `line`: Line number where the issue occurs
    - `body`: Concise and actionable description of the violation and fix, following the below Comment Format
 6. **Each comment must reference exactly one Rule ID.**
-7. **Output must consist exclusively of calls to mcp__github_inline_comment__create_inline_comment in the required format.** No other text, Markdown, or prose is allowed.
+7. **Output must consist exclusively of calls to createInlineComment.sh in the required format.** No other text, Markdown, or prose is allowed.
 8. **If no violations are found, add a reaction to the PR**:
    Add a 👍 (+1) reaction to the PR using the `addPrReaction` script (available in PATH from `.claude/scripts/`). The script takes ONLY the PR number as argument - it always adds a "+1" reaction, so do NOT pass any reaction type or emoji.
 9. **Add reaction if and only if**:
@@ -263,15 +231,13 @@ const {amountColumnSize, dateColumnSize, taxAmountColumnSize} = useMemo(() => {
 
 ## Tool Usage Example
 
-For each violation, call the mcp__github_inline_comment__create_inline_comment tool like this.
-CRITICAL: **DO NOT** use the Bash tool for inline comments:
+For each violation, call the createInlineComment.sh script like this:
 
+```bash
+createInlineComment.sh 'src/components/ReportActionsList.tsx' '<Body of the comment according to the Comment Format>' 128
 ```
-mcp__github_inline_comment__create_inline_comment:
-  path: 'src/components/ReportActionsList.tsx'
-  line: 128
-  body: '<Body of the comment according to the Comment Format>'
-```
+
+**IMPORTANT**: Always use single quotes around the body argument to properly handle special characters and quotes.
 
 If ZERO violations are found, use the Bash tool to add a reaction to the PR body:
 
@@ -291,4 +257,4 @@ addPrReaction.sh <PR_NUMBER>
 <Suggested, specific fix preferably with a code snippet>
 ```
 
-**CRITICAL**: You must actually call the mcp__github_inline_comment__create_inline_comment tool for each violation. Don't just describe what you found - create the actual inline comments!
+**CRITICAL**: You must actually call the createInlineComment.sh script for each violation. Don't just describe what you found - create the actual inline comments!

.claude/commands/review-code-pr.md

@@ -1,5 +1,5 @@
 ---
-allowed-tools: Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(addPrReaction.sh:*),mcp__github_inline_comment__create_inline_comment
+allowed-tools: Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(addPrReaction.sh:*),Bash(createInlineComment.sh:*)
 description: Review a code contribution pull request
 ---
 

.claude/scripts/addPrReaction.sh

@@ -8,8 +8,8 @@ if [[ $# -lt 1 ]] || ! [[ "$1" =~ ^[0-9]+$ ]]; then
     exit 1
 fi
 
-PR_NUMBER="$1"
-REPO="${GITHUB_REPOSITORY}"
+readonly PR_NUMBER="$1"
+readonly REPO="${GITHUB_REPOSITORY}"
 
 gh api -X POST "/repos/$REPO/issues/$PR_NUMBER/reactions" -f content="+1"
 

.claude/scripts/createInlineComment.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+
+# Secure proxy script to create an inline comment on a GitHub PR.
+set -eu
+
+readonly ALLOWED_RULES_FILE="${GITHUB_WORKSPACE}/.claude/allowed-rules.txt"
+
+# Print error and exit.
+die() {
+    echo "Error: $*" >&2
+    exit 1
+}
+
+# Usage helper to avoid repeated text.
+usage() {
+    die "Usage: $0 <path> <body> <line>"
+}
+
+COMMENT_STATUS_REASON=""
+
+# Ensure the comment body references an allowed rule tag.
+validate_rule() {
+    local body="$1"
+    local rule
+
+    [[ -f "$ALLOWED_RULES_FILE" ]] || die "Comment rejected: allowed rules file missing at $ALLOWED_RULES_FILE"
+
+    rule=$(echo "$body" | grep -oE '[A-Z]+-[0-9]+' | head -1 || true)
+    [[ -n "$rule" ]] || die "Comment rejected: missing allowed rule reference (e.g. PERF-1)"
+
+    if grep -qF "$rule" "$ALLOWED_RULES_FILE"; then
+        COMMENT_STATUS_REASON="rule $rule validated"
+        return 0
+    fi
+
+    die "Comment rejected: rule $rule not present in allowed list"
+}
+
+readonly PATH_ARG="${1:-}"
+readonly BODY_ARG="${2:-}"
+readonly LINE_ARG="${3:-}"
+
+[[ -z "$PR_NUMBER" ]] && die "Environment variable PR_NUMBER is required"
+[[ -z "$GITHUB_REPOSITORY" ]] && die "Environment variable GITHUB_REPOSITORY is required"
+[[ -z "$PATH_ARG" || -z "$BODY_ARG" || -z "$LINE_ARG" ]] && usage
+
+validate_rule "$BODY_ARG"
+echo "Comment approved: $COMMENT_STATUS_REASON"
+
+COMMIT_ID=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" --jq '.head.sha')
+readonly COMMIT_ID
+
+PAYLOAD=$(jq -n \
+    --arg body "$BODY_ARG" \
+    --arg path "$PATH_ARG" \
+    --argjson line "$LINE_ARG" \
+    --arg commit_id "$COMMIT_ID" \
+    '{body: $body, path: $path, line: $line, side: "RIGHT", commit_id: $commit_id}')
+readonly PAYLOAD
+
+gh api -X POST "/repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/comments" \
+    --input - <<< "$PAYLOAD" || exit 1

.env.example

@@ -14,6 +14,7 @@ USE_REDUX_DEVTOOLS=false
 CAPTURE_METRICS=false
 ONYX_METRICS=false
 USE_THIRD_PARTY_SCRIPTS=false
+IS_EXPENSIFY_EMPLOYEE=false
 
 EXPENSIFY_ACCOUNT_ID_ACCOUNTING=-1
 EXPENSIFY_ACCOUNT_ID_ACCOUNTS_PAYABLE=-1
@@ -42,3 +43,4 @@ GITHUB_TOKEN=YOUR_TOKEN
 OPENAI_API_KEY=YOUR_TOKEN
 
 SENTRY_AUTH_TOKEN=SENTRY_AUTH_TOKEN
+SENTRY_ALLOW_FAILURE=true

.github/ISSUE_TEMPLATE/Standard.md

@@ -10,7 +10,7 @@ ___
 **Version Number:**
 **Reproducible in staging?:**
 **Reproducible in production?:**
-**If this was caught during regression testing, add the test name, ID and link from TestRail:**
+**If this was caught during regression testing, add the test name, ID and link from BrowserStack:**
 **Email or phone of affected tester (no customers):**
 **Logs:** https://stackoverflow.com/c/expensify/questions/4856
 **Expensify/Expensify Issue URL:**
@@ -38,29 +38,8 @@ Select the officially supported platforms where the issue was reproduced:
 - [ ] iOS: mWeb Chrome
 - [ ] Windows: Chrome
 - [ ] MacOS: Chrome / Safari
-- [ ] MacOS: Desktop
-
-<details>
-  <summary>Platforms Tested:</summary>
-On which of our officially supported platforms was this issue tested:
-
-- [ ] Android: App
-- [ ] Android: mWeb Chrome
-- [ ] iOS: App
-- [ ] iOS: mWeb Safari
-- [ ] iOS: mWeb Chrome
-- [ ] Windows: Chrome
-- [ ] MacOS: Chrome / Safari
-- [ ] MacOS: Desktop
-
-</details>
 
 ## Screenshots/Videos
 
-<details>
-  <summary>Add any screenshot/video evidence</summary>
-
-
-</details>
 
 [View all open jobs on GitHub](https://github.com/Expensify/App/issues?q=is%3Aopen+is%3Aissue+label%3A%22Help+Wanted%22)

.github/actions/composite/getJavaVersion/action.yml

@@ -0,0 +1,15 @@
+name: Get Java version
+description: Reads the Java version from .java-version file
+
+outputs:
+  version:
+    description: The Java version from .java-version file
+    value: ${{ steps.getVersion.outputs.VERSION }}
+
+runs:
+  using: composite
+  steps:
+    - name: Get Java version
+      id: getVersion
+      shell: bash
+      run: echo "VERSION=$(cat .java-version | tr -d '\n')" >> "$GITHUB_OUTPUT"

.github/actions/composite/setupNode/action.yml

@@ -6,6 +6,10 @@ inputs:
     description: "Indicates if node is set up for hybrid app"
     required: false
     default: 'false'
+  IS_DESKTOP_BUILD:
+    description: "Indicates if node is set up for desktop app"
+    required: false
+    default: 'false'
 
 outputs:
   cache-hit:
@@ -23,7 +27,9 @@ runs:
       with:
         node-version-file: '.nvmrc'
         cache: npm
-        cache-dependency-path: normalized-package-lock.json
+        cache-dependency-path: |
+          normalized-package-lock.json
+          desktop/package-lock.json
 
     - id: cache-node-modules
       # v4
@@ -40,6 +46,14 @@ runs:
         path: Mobile-Expensify/node_modules
         key: ${{ runner.os }}-node-modules-${{ hashFiles('Mobile-Expensify/package-lock.json', 'Mobile-Expensify/patches/**') }}
 
+    - id: cache-desktop-node-modules
+      if: inputs.IS_DESKTOP_BUILD == 'true'
+      # v4
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
+      with:
+        path: desktop/node_modules
+        key: ${{ runner.os }}-desktop-node-modules-${{ hashFiles('desktop/package-lock.json', 'desktop/patches/**') }}
+
     - name: Remove ND node_modules if needed for hybrid app build
       if: inputs.IS_HYBRID_BUILD == 'true' && steps.cache-node-modules.outputs.cache-hit == 'true' && steps.cache-old-dot-node-modules.outputs.cache-hit != 'true'
       shell: bash
@@ -51,4 +65,12 @@ runs:
       with:
         timeout_minutes: 30
         max_attempts: 3
-        command: npm ci
+        command: npm ci
+
+    - name: Install node packages for desktop submodule
+      if: inputs.IS_DESKTOP_BUILD == 'true' && steps.cache-desktop-node-modules.outputs.cache-hit != 'true'
+      uses: nick-fields/retry@3f757583fb1b1f940bc8ef4bf4734c8dc02a5847
+      with:
+        timeout_minutes: 30
+        max_attempts: 3
+        command: cd desktop && npm ci

.github/actions/javascript/createOrUpdateStagingDeploy/createOrUpdateStagingDeploy.ts

@@ -164,23 +164,21 @@ async function run(): Promise<IssuesCreateResponse | void> {
             });
 
             // Then make sure we include any demoted or closed blockers as well, and just check them off automatically
-            // eslint-disable-next-line unicorn/no-array-for-each
-            currentChecklistData?.deployBlockers.forEach((deployBlocker) => {
+            for (const deployBlocker of currentChecklistData?.deployBlockers ?? []) {
                 const isResolved = deployBlockers.findIndex((openBlocker) => openBlocker.number === deployBlocker.number) < 0;
                 deployBlockers.push({
                     ...deployBlocker,
                     isResolved,
                 });
-            });
+            }
 
             // Include any existing Mobile-Expensify PRs from the current checklist that aren't in the new merged list
-            // eslint-disable-next-line unicorn/no-array-for-each
-            currentChecklistData?.PRListMobileExpensify.forEach((existingPR) => {
+            for (const existingPR of currentChecklistData?.PRListMobileExpensify ?? []) {
                 const isAlreadyIncluded = PRListMobileExpensify.findIndex((pr) => pr.number === existingPR.number) >= 0;
                 if (!isAlreadyIncluded) {
                     PRListMobileExpensify.push(existingPR);
                 }
-            });
+            }
 
             const didVersionChange = newVersion !== currentChecklistData?.version;
             const stagingDeployCashBodyAndAssignees = await GithubUtils.generateStagingDeployCashBodyAndAssignees(

.github/actions/javascript/createOrUpdateStagingDeploy/index.js

@@ -11674,22 +11674,20 @@ async function run() {
                 };
             });
             // Then make sure we include any demoted or closed blockers as well, and just check them off automatically
-            // eslint-disable-next-line unicorn/no-array-for-each
-            currentChecklistData?.deployBlockers.forEach((deployBlocker) => {
+            for (const deployBlocker of currentChecklistData?.deployBlockers ?? []) {
                 const isResolved = deployBlockers.findIndex((openBlocker) => openBlocker.number === deployBlocker.number) < 0;
                 deployBlockers.push({
                     ...deployBlocker,
                     isResolved,
                 });
-            });
+            }
             // Include any existing Mobile-Expensify PRs from the current checklist that aren't in the new merged list
-            // eslint-disable-next-line unicorn/no-array-for-each
-            currentChecklistData?.PRListMobileExpensify.forEach((existingPR) => {
+            for (const existingPR of currentChecklistData?.PRListMobileExpensify ?? []) {
                 const isAlreadyIncluded = PRListMobileExpensify.findIndex((pr) => pr.number === existingPR.number) >= 0;
                 if (!isAlreadyIncluded) {
                     PRListMobileExpensify.push(existingPR);
                 }
-            });
+            }
             const didVersionChange = newVersion !== currentChecklistData?.version;
             const stagingDeployCashBodyAndAssignees = await GithubUtils_1.default.generateStagingDeployCashBodyAndAssignees(newVersion, PRList.map((pr) => pr.url), PRListMobileExpensify.map((pr) => pr.url), PRList.filter((pr) => pr.isVerified).map((pr) => pr.url), PRListMobileExpensify.filter((pr) => pr.isVerified).map((pr) => pr.url), deployBlockers.map((blocker) => blocker.url), deployBlockers.filter((blocker) => blocker.isResolved).map((blocker) => blocker.url), currentChecklistData?.internalQAPRList.filter((pr) => pr.isResolved).map((pr) => pr.url), didVersionChange ? false : currentChecklistData.isFirebaseChecked, didVersionChange ? false : currentChecklistData.isGHStatusChecked);
             if (stagingDeployCashBodyAndAssignees) {