Lint does not refuse browser-native dialogs: enable Biome suspicious/noAlert #23

New Issue

2026-10-14T23:21:35Z

ekklesia-bot commented

2026-10-14 23:21:35 +00:00

What I observed

Signage's biome.json (at origin/main, lines 23–25) enables only the recommended preset:

"rules": {
  "preset": "recommended"
}

Biome's suspicious/noAlert, the rule that refuses alert(), confirm(), and prompt() (bare, through window or globalThis, or by computed member), is not part of the recommended preset. Signage's lint therefore does not stop a browser-native dialog from entering its UI.

DESIGN.md §8.1 prohibits browser-native dialogs in product UI. Core now enforces this across its own repository (Zayin/Ekklesia, Stage 1 PR "shared interaction primitives", ADR 0059): noAlert is an error in Core's root biome.json, and a root test proves it against fixtures. Core's lint cannot reach a module repository, because each module repository carries its own Biome configuration.

I checked Signage's current source with a grep for alert(, confirm(, and prompt(, and found no existing violation. This is a missing guard, not a defect in today's behaviour.

Impact

A future change to Signage could introduce window.confirm (for example for a delete) and pass pnpm lint and CI. Signage is meant to be the reference module that later modules copy (ROADMAP §5.8), so the gap would likely be copied too.

Suggested fix

Add the rule to biome.json:

"rules": {
  "preset": "recommended",
  "suspicious": {
    "noAlert": "error"
  }
}

Run pnpm lint to confirm there are no findings. Optionally, also add a test like Core's tests/native-dialogs.test.ts that lints a fixture, so a later config change cannot silently drop the rule.

What I did not look at

Signage's display (kiosk) artifact separately from its management UI. Both are covered by the same lint configuration.

Found by Claude while building Ekklesia Stage 1 PR 3 (shared UI-state and interaction primitives, including the repository-wide native-dialog guard).

## What I observed Signage's `biome.json` (at `origin/main`, lines 23–25) enables only the recommended preset: ```json "rules": { "preset": "recommended" } ``` Biome's `suspicious/noAlert`, the rule that refuses `alert()`, `confirm()`, and `prompt()` (bare, through `window` or `globalThis`, or by computed member), is **not** part of the recommended preset. Signage's lint therefore does not stop a browser-native dialog from entering its UI. DESIGN.md §8.1 prohibits browser-native dialogs in product UI. Core now enforces this across its own repository (Zayin/Ekklesia, Stage 1 PR "shared interaction primitives", ADR 0059): `noAlert` is an error in Core's root `biome.json`, and a root test proves it against fixtures. Core's lint cannot reach a module repository, because each module repository carries its own Biome configuration. I checked Signage's current source with a grep for `alert(`, `confirm(`, and `prompt(`, and found **no existing violation**. This is a missing guard, not a defect in today's behaviour. ## Impact A future change to Signage could introduce `window.confirm` (for example for a delete) and pass `pnpm lint` and CI. Signage is meant to be the reference module that later modules copy (ROADMAP §5.8), so the gap would likely be copied too. ## Suggested fix Add the rule to `biome.json`: ```json "rules": { "preset": "recommended", "suspicious": { "noAlert": "error" } } ``` Run `pnpm lint` to confirm there are no findings. Optionally, also add a test like Core's `tests/native-dialogs.test.ts` that lints a fixture, so a later config change cannot silently drop the rule. ## What I did not look at Signage's display (kiosk) artifact separately from its management UI. Both are covered by the same lint configuration. --- Found by Claude while building Ekklesia Stage 1 PR 3 (shared UI-state and interaction primitives, including the repository-wide native-dialog guard).

ekklesia-bot added the found-by-claude label 2026-10-14 23:21:35 +00:00

ekklesia-bot referenced this issue from Zayin/Ekklesia

2026-10-14 23:30:44 +00:00

feat(ui): shared confirmation, toasts, error, skeleton, and Back primitives (Stage 1, ADR 0059) #106

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Zayin/Signage#23