fix(pipes): include the pipe lint in static reports

[erkamyaman]

What and why

A static report (pangular build) stores the results of RPC functions registered with snapshot: true. pipe-lint takes no arguments and only reads source, like get-pipes, but it had no snapshot: true. collectStaticRpcDump skipped it, and the dump client threw DF0025 when the panel called it.

In a shared report the Pipes tab's Lint section always said "Couldn't run the lint check. Try Refresh." Refresh can't help, so none of the four lint rules ever appeared in a report.

The fix adds snapshot: true to the pipe-lint registration.

How it was verified

rpc/__tests__/static-dump.test.ts now lists pipe-lint among the baked-in source scans. A new test builds a dump for a fixture component using | json and reads the json-pipe-in-template finding back through devframe's dump client. Both fail on main (the function is missing, and DF0025) and pass with the fix. All package tests pass.

• pnpm commit:check (commit messages follow the guidelines)
• pnpm format:check
• pnpm typecheck (includes the ngc template checks)
• pnpm test:devtools (all passing)
• pnpm skills:check (when .claude/ changed): not changed
• No docs change needed: the fix makes the code match existing docs (no-docs)
• pnpm extension:build and extension/ui committed (when app/ changed): not changed
• Checked in the browser with axe (when the UI changed): no UI change

Summary by CodeRabbit

• New Features
  • Static RPC exports now include pipe-lint checks, allowing generated exports to report template lint findings such as the use of the json pipe.

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Failed ❌ View logs ↗		3cff5c5	2026-10-11T03:18:13.316Z	View logs ↗

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ba18768c-0289-46f6-bfde-fdb77e12a945

---

📥 Commits

Reviewing files that changed from the base of the PR and between 58273c6 and 3cff5c5.

---

📒 Files selected for processing (2)

• packages/devtools/src/devframe.ts
• packages/devtools/src/rpc/__tests__/static-dump.test.ts

---

Limit details: You’ve used all 10 included reviews currently available.

---

---

📝 Walkthrough

Walkthrough

The pipe-lint RPC query is marked as a snapshot. Static-dump tests check its manifest entry and verify that the dumped function reports the json-pipe-in-template rule.

Changes

Pipe-lint static dump

Layer / File(s)	Summary
Snapshot query and dump coverage packages/devtools/src/devframe.ts, packages/devtools/src/rpc/__tests__/static-dump.test.ts	The pipe-lint query sets snapshot: true. The static RPC manifest includes pangular:pipe-lint, and a test invokes the dumped lint function on a template with the json pipe and checks for the json-pipe-in-template rule.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

---

Merge Risk | ⚪ Minimal · up to 3cff5

Merge Risk: ⚪ Minimal · up to 3cff5

The change exposes pipe-lint to static snapshots and verifies its finding on a fixture. No concrete merge-blocking risk is established; it appears ready for normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 3cff5

The change adds a read-only lint result to existing static reports without adding write capabilities or caller-selected source paths. Existing filesystem and display controls limit the observed exposure. Report-sharing access controls could not be verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The incremental exposure is additional lint metadata in generated reports for the configured workspace. Existing get-pipes snapshots already include pipe names, source locations, purity, and usage locations. The newly included query supplies no caller argument for selecting another workspace or gaining mutation authority; actual report readership remains unverified.

Trust Boundaries and Controls

• observed — Source-controlled paths pass through existing filesystem checks. Source roots are checked by real path for workspace containment and dependency exclusions; the directory walk skips symbolic links. External templates are read only after their resolved real path passes workspace-containment checks. These controls are shared with the existing pipe snapshot scanner.
• observed — The inspected lint display uses Angular text interpolation for rule, pipe, path, message, and fix strings. It does not insert those strings as raw HTML or invoke the suggested fixes.

Resilience and Maintainability Implications

• observed — The newly snapshotted handler constructs invocation-local collections and reads files without changing source files or shared RPC state. Unreadable TypeScript files and external templates are skipped. There is no new reservation, ownership transfer, or mutating recovery transition in the inspected handler.

---

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: including pipe lint results in static reports.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches 💡 1

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Usage-based review receipt

• Mode: Continue automatically
• Reviewed files: 2
• Waived: $0.50 (charged $0.00)
• View usage details

Note

This review exceeded your plan’s limits and used usage-based reviews—free during trial, billed after paid activation unless disabled. Manage usage-based reviews.

---

_{Comment @coderabbitai help to get the list of available commands.}