In `@apps/server/src/routes/gemini/index.ts`:
- Around line 35-57: Remove the unsafe (status as any) casts: use the typed
InstallationStatus returned by GeminiProvider.detectInstallation() and compute
authMethod using the existing fields (status.authenticated / status.hasApiKey)
without casting; also remove or type-augment hasCredentialsFile—either add
hasCredentialsFile to the InstallationStatus interface (and populate it in
detectInstallation) or stop returning hasCredentialsFile and default it to false
in the JSON response; update the route in apps/server/src/routes/gemini/index.ts
(references: GeminiProvider, detectInstallation, authMethod, hasCredentialsFile,
InstallationStatus) accordingly.

In `@apps/server/src/routes/zai/index.ts`:
- Around line 63-155: The route handlers for router.post('/configure') and
router.post('/verify') contain business logic
(usageService.setApiToken/setApiHost, settingsService.updateCredentials, fetch
to quota URL and response handling) and must be moved into ZaiUsageService (or a
new service) as methods like configure({apiToken, apiHost}) and
verifyApiKey(apiKey); those service methods should perform the persistence (call
settingsService.updateCredentials), runtime updates (usageService calls),
external fetch, and emit events via the shared emitter from createEventEmitter()
(e.g., emit 'zai.configured' and 'zai.verify.result' with status and error
info). Update the route handlers to simply call ZaiUsageService.configure(...)
and ZaiUsageService.verifyApiKey(...), await results, and return minimal JSON
responses, handling exceptions only to map errors to HTTP responses. Ensure you
reference and replace direct calls to usageService and
settingsService.updateCredentials inside the service and add emitter.emit calls
for UI updates.
- Around line 120-147: The z.ai verification fetch call can hang indefinitely;
update the fetch invocation in the route handler that calls quotaUrl to pass a
signal created via AbortSignal.timeout(timeoutMs) (e.g., const controllerSignal
= AbortSignal.timeout(5000)) in the fetch options so the request auto-aborts
after a reasonable timeout, and enhance the catch block to handle aborts (detect
AbortError / error.name === 'AbortError' and return a clear timeout JSON
response). Ensure you reference the existing fetch call that sets headers
Authorization/Accept and the surrounding try/catch so you only add the signal
option and the abort-specific error branch.

In `@apps/server/src/services/gemini-usage-service.ts`:
- Around line 688-697: The refreshed token is always written to
this.credentialsPath (e.g., in the getValidAccessToken flow) even when
credentials were loaded from a different file (such as
~/.config/gemini/oauth_creds.json), causing divergence; modify the
credential-loading logic (where cachedCredentials is set) to record the actual
source path into a new property (e.g., this.loadedCredentialsPath) and then
change the write path in the save/refresh block to use that recorded
this.loadedCredentialsPath (falling back to this.credentialsPath if not set) so
refreshed tokens are persisted back to the same file they were read from.
- Around line 349-353: The possiblePaths array contains a duplicate because the
constructor already sets this.credentialsPath to the home
'.gemini/oauth_creds.json' path; remove the redundant literal path from
possiblePaths or dedupe the array before use (e.g., filter out duplicates by
keeping only the first occurrence) so possiblePaths only contains unique
entries; update references around possiblePaths and ensure the logic using
possiblePaths still checks the same fallback locations in
GeminiUsageService/constructor.
- Around line 343-384: The cachedCredentials in loadCredentials() is never
invalidated so stale/expired creds persist; modify loadCredentials (and/or
clearCache()) to implement automatic invalidation by adding a TTL (e.g., 5
minutes) or validating the credentials file mtime before returning
cachedCredentials: store a cachedAt timestamp alongside cachedCredentials when
setting it in loadCredentials(), and when loadCredentials is called check if
cachedAt + TTL has expired or if fs.statSync(credPath).mtimeMs is newer than
cachedAt — if expired or file changed, discard cachedCredentials and re-read
from disk (then update cachedAt); ensure clearCache() still exists to allow
explicit invalidation and reference credentialsPath/possiblePaths when comparing
mtimes.
- Around line 557-578: The fallback search in extractOAuthClientCredentials uses
execSync with an interpolated baseDir, creating a command-injection and
quoting/portability risk; change it to only run on POSIX (guard with
process.platform !== 'win32') and replace the string-shell execSync call with a
safe execFileSync/spawnSync invocation that passes 'find' and its arguments as
an array (e.g., args: [ `${baseDir}/..`, '-name', 'oauth2.js', '-path',
'*gemini*', '-path', '*code_assist*' ]) to avoid shell interpolation, keep the
same encoding/timeout options, then proceed to read and pass the result to
parseOAuthCredentialsFromSource and set this.cachedClientCredentials as before.
- Around line 168-202: The external fetch calls in fetchUsageData
(CODE_ASSIST_URL, QUOTA_API_URL, GOOGLE_TOKEN_URL) lack timeouts and can hang;
add an AbortSignal with a timeout for each request (e.g., use
AbortSignal.timeout(timeoutMs) or new AbortController().signal with setTimeout
to abort) and pass the signal option into fetch, catch the resulting
abort/timeout errors and handle/log them similarly to other fetch failures;
ensure each fetch (the code block around CODE_ASSIST_URL, the QUOTA_API_URL
POST, and the GOOGLE_TOKEN_URL call) is updated to create/use a signal and clean
up any controllers if you use AbortController.

In `@apps/server/src/services/zai-usage-service.ts`:
- Around line 165-176: The fetchUsageData method does not emit lifecycle events
for frontend streaming; modify fetchUsageData to call createEventEmitter()
(import from lib/events.ts) at start and emit a "zai.usage.start" event, then
emit "zai.usage.success" with the fetched ZaiUsageData on successful completion,
and emit "zai.usage.error" with error details if any exception occurs (rethrow
after emitting). Use the existing method name fetchUsageData and the same logger
for messages, ensure the emitter is created inside the method and closed/handled
per createEventEmitter's contract so events stream via WebSocket to the
frontend.
- Around line 182-190: The fetch call to quotaUrl currently has no timeout; wrap
it with an AbortController and a timeout like other services (e.g.,
verify-claude-auth.ts/event-hook-service.ts): create an AbortController, start a
setTimeout to call controller.abort() after the configured timeout, pass
controller.signal into the fetch options (where Authorization and Accept headers
are set), and clear the timeout after fetch completes; also handle the abort
error case so the calling function (the code around quotaUrl/token/response)
throws or returns a proper timeout error instead of hanging.

In `@apps/ui/src/components/views/board-view/mobile-usage-bar.tsx`:
- Around line 38-54: The formatResetTime function returns negative "Resets in
-Xm" for past timestamps; update formatResetTime(unixTimestamp, isMilliseconds)
to detect diff <= 0 and return a short message like "Resetting soon" (matching
server-side behavior) before computing minutes/hours/dates, keeping the existing
branches for <1h, <24h and fallback to date; touch the function name
formatResetTime and ensure the diff calculation (const diff = date.getTime() -
now.getTime()) is used to decide the early-return for past/resetting-soon cases.
- Around line 166-167: Add geminiUsage and geminiUsageLastUpdated to the
existing Zustand store alongside the other provider states (the same store that
exposes setClaudeUsage/setCodexUsage/setZaiUsage): add state fields geminiUsage:
GeminiUsage | null and geminiUsageLastUpdated: number | null, and a setter
setGeminiUsage((usage, lastUpdated?) => void) that updates both fields. In
mobile-usage-bar.tsx remove the local useState declarations for geminiUsage and
geminiUsageLastUpdated and replace them with the store selectors/hooks (e.g.,
const { geminiUsage, geminiUsageLastUpdated, setGeminiUsage } = useStore(...))
and update any places that call setGeminiUsage to use the store setter. Ensure
types match the existing GeminiUsage type and that other components (like
UsagePopover) can read the new store fields.

In
`@apps/ui/src/components/views/settings-view/api-keys/hooks/use-api-key-management.ts`:
- Around line 239-259: The code persists the z.ai key to the local store via
setApiKeys before calling api.zai.configure, and uses a loose check
(result.success || result.isAvailable) so the local state can show "Saved" even
if server config failed; either move the setApiKeys call so it runs only after
api.zai.configure succeeds (and then update setZaiAuthStatus and call
queryClient.invalidateQueries), or implement a rollback in the catch where you
remove the stored zai key using the same setApiKeys call; also tighten the
success condition to require result.success (not just isAvailable) when deciding
success for configuring z.ai.
- Around line 246-252: The code in use-api-key-management.ts hardcodes
hasEnvApiKey: false when calling setZaiAuthStatus after saving a UI key, which
can incorrectly clear an existing env-configured key; update the call in the
block that calls setZaiAuthStatus to preserve the current env key flag by
reading the existing apiKeyStatus (e.g., use apiKeyStatus.hasEnvApiKey) and set
hasEnvApiKey to that value instead of false so you only update the fields that
truly change (authenticated, method, hasApiKey) while keeping hasEnvApiKey in
sync.
- Line 1: Remove the top-level "// `@ts-nocheck`" and add explicit TypeScript
typings for the hook and its internal entities: declare interfaces/types such as
ApiKey (id, name, key, createdAt, revoked?), ApiKeyState (array + validation
errors), AuthState (isAuthenticated, userId, token), and ServerConfig
(allowedOrigins, keyPolicy) used by the useApiKeyManagement hook; update
function signatures (useApiKeyManagement, loadApiKeys, saveApiKeys,
validateApiKey, revokeApiKey) and React state hooks to use these types, type any
localStorage/parsing and async calls with proper unions/Optionals, and fix
resulting type errors rather than silencing them so the file compiles with full
type safety.

In `@apps/ui/src/hooks/use-provider-auth-init.ts`:
- Around line 133-138: The code is assigning the wrong field to the CLI path:
update the call to setGeminiCliStatus so the path uses result.path (the actual
filesystem path) instead of result.status; locate the block where
setGeminiCliStatus is called (in use-provider-auth-init.ts) and replace the
path: result.status assignment with path: result.path while keeping installed:
result.installed ?? false and version: result.version unchanged.
- Around line 107-124: The z.ai auth response handler (api.zai.getStatus) can
leave authenticated/hasApiKey undefined; update the logic in the try block that
calls setZaiAuthStatus so it coerces result.available, result.hasApiKey, and
result.hasEnvApiKey to booleans (e.g., using !! or ?? false) and derive method
using those boolean values, and also add a fallback setZaiAuthStatus in the
non-success/exception path to set authenticated: false, method: 'none',
hasApiKey: false, hasEnvApiKey: false; reference setZaiAuthStatus,
api.zai.getStatus, and ZaiAuthMethod when making the changes.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/server/src/lib/permission-enforcer.ts`:
- Around line 15-20: The CursorToolCall interface is currently unexported but
used by exported functions checkToolCallPermission and logPermissionViolation;
either export CursorToolCall from this file now or (preferred) move its minimal
definition into `@automaker/types` and import it here (aligning with
CursorToolCallEvent already in that package). Update the local file to import
the moved CursorToolCall and adjust any references in checkToolCallPermission
and logPermissionViolation to use the shared type; keep the current all-optional
shape for compatibility and do not change the function logic.

In `@apps/server/src/providers/cursor-provider.ts`:
- Line 882: The call to getEffectivePermissions(...) inside executeQuery is dead
I/O because its return value is discarded; either remove the call and its import
(if permissions are not used) or use the returned permissions to enforce checks
before proceeding. If removing, delete the getEffectivePermissions call and
remove its import; if enforcing, assign const permissions = await
getEffectivePermissions(options.cwd || process.cwd()) and use permissions to
validate/deny file writes or shell command spawning in executeQuery (e.g., gate
the subprocess spawn or write operations based on permissions).

In `@apps/server/src/routes/setup/routes/verify-claude-auth.ts`:
- Line 154: The temp env override created by createTempEnvOverride(authEnv) is
never invoked (stored as _cleanupEnv) so process.env retains injected
credentials; ensure you call the returned cleanup function in the verification
flow's finally block: store the result of createTempEnvOverride(authEnv) (e.g.,
const cleanupEnv = createTempEnvOverride(authEnv)) and invoke cleanupEnv()
inside the existing finally block in verify-claude-auth (or wrap the try block
that uses the temp env), guaranteeing the restore runs regardless of success or
error to remove ANTHROPIC_API_KEY/ANTHROPIC_BASE_URL from process.env.

In `@apps/server/src/services/gemini-usage-service.ts`:
- Around line 449-470: The findGeminiBinaryPath implementation currently returns
directory paths because possiblePaths includes directory roots (e.g.,
path.join(os.homedir(), '.nvm', 'versions', 'node') and path.join(os.homedir(),
'.fnm', 'node-versions')), causing extractOAuthClientCredentials to compute the
wrong baseDir and fail OAuth discovery; remove those non-binary directory
entries from possiblePaths (or replace them with explicit versioned binary
paths) so only actual gemini executable paths are checked, or alternatively
change the existence check to confirm the path is a file/executable before
returning (update findGeminiBinaryPath and ensure extractOAuthClientCredentials
still derives baseDir from a confirmed binary path).

In `@apps/server/src/services/zai-usage-service.ts`:
- Around line 189-230: The methods configure, verifyApiKey and fetchUsageData
currently call createEventEmitter() locally which produces a new emitter with no
subscribers, so emitter.emit(...) are no-ops; modify the ZaiUsageService to
accept a shared TypedEventBus (or the shared emitter) via constructor injection
(e.g., constructor(private eventBus: TypedEventBus) {}) and replace local
createEventEmitter() usages with this.eventBus.emit(...) (referencing configure,
verifyApiKey, fetchUsageData and any other methods using createEventEmitter());
ensure the constructor parameter is used throughout and remove the local
createEventEmitter() calls so emitted 'notification:created' events are
delivered to subscribers.
- Around line 172-175: getApiHost() unconditionally prefixes Z_AI_API_HOST with
"https://" which yields double-protocol strings if the env var already contains
a scheme; change the logic so when process.env.Z_AI_API_HOST is present you
first check if it startsWith('http') and return it as-is, otherwise prepend
'https://'; apply the identical pattern to the inline usage of
process.env.Z_AI_API_HOST in verifyApiKey() so both functions (getApiHost and
verifyApiKey) consistently handle full URLs and bare hostnames.

In `@apps/ui/src/components/views/board-view/mobile-usage-bar.tsx`:
- Around line 237-251: fetchZaiUsage currently calls setZaiUsage(data) without a
timestamp so zaiUsageLastUpdated may never be set; mirror fetchGeminiUsage's
behavior by passing a timestamp to the store setter (e.g., call
setZaiUsage(data, Date.now())), and update the setZaiUsage type/signature where
it’s defined to accept the optional/required timestamp (similar to
setGeminiUsage) so the stale-check using zaiUsageLastUpdated works and z.ai
usage is cached for the 2-minute window.

In
`@apps/ui/src/components/views/settings-view/api-keys/hooks/use-api-key-management.ts`:
- Around line 228-251: The code calls getElectronAPI() without guarding for a
null return, so api.zai?.verify can throw; update the verify flow in the
function that contains getElectronAPI() (the block using api.zai?.verify and
calling setZaiTestResult/setTestingZaiConnection) to first check api is present
(e.g., if (!api || !api.zai || typeof api.zai.verify !== 'function') ), and if
missing setZaiTestResult to a clear error about the desktop API not being
available and skip calling verify; keep the existing catch/finally behavior but
ensure you return early when the API is absent to avoid the TypeError.

---

Outside diff comments:
In `@apps/server/src/providers/codex-provider.ts`:
- Around line 769-812: The buildConfigOverrides(overrides) return value is
unused so the CLI never receives the generated --config flags; capture its
returned string[] and include (spread) it into the args array before executing
the Codex CLI. Specifically, after building overrides (the overrides array) call
buildConfigOverrides(overrides), assign the result to a variable (e.g.,
configArgs) and insert/spread those values into the args construction (with
CODEX_EXEC_SUBCOMMAND, CODEX_YOLO_FLAG..., ...preExecArgs, CODEX_MODEL_FLAG,
options.model, CODEX_JSON_FLAG, '-') so that max_turns,
CODEX_REASONING_EFFORT_KEY, approval_policy and features.web_search_request are
passed to the CLI; alternatively, if the CLI no longer accepts --config flags,
remove the overrides building block (overrides and buildConfigOverrides usage)
and associated constants to avoid dead code.

In `@apps/server/src/routes/app-spec/common.ts`:
- Around line 50-55: getRunningProjectPath currently checks the truthiness of
the map value (RunningGeneration) so it always returns the first map entry;
update it to inspect the actual running flag (e.g., running.isRunning) when
iterating runningProjects so it only returns the path for entries where
RunningGeneration.isRunning is true; ensure you reference the RunningGeneration
shape and preserve behavior of setRunningState (which may delete entries) so
this becomes a correct explicit check rather than relying on that invariant.

In `@apps/server/src/routes/models/routes/providers.ts`:
- Around line 15-27: The providers response currently only returns "anthropic"
and "cursor" from the statuses map; update the providers Record in
apps/server/src/routes/models/routes/providers.ts (the providers variable
created from checkAllProviders()'s statuses) to include all registered providers
returned by checkAllProviders() — e.g., claude, cursor, codex, opencode, gemini,
copilot (and any others your registry returns) with appropriate fields
(available, version, path, method, authenticated and hasApiKey where relevant);
also correct the mapping for "anthropic" if it mistakenly reads statuses.claude
(ensure anthropic reads statuses.anthropic) so the frontend can discover all
providers via the /providers endpoint.

In `@apps/server/src/services/recovery-service.ts`:
- Around line 297-329: The early return in resumeInterruptedFeatures exits when
allInterruptedFeatures is empty and never calls clearExecutionState, leaving the
execution-state file on disk; update resumeInterruptedFeatures so that when
allInterruptedFeatures.length === 0 it still awaits
this.clearExecutionState(projectPath) before returning (or move the
clearExecutionState call earlier, e.g., immediately after computing
allInterruptedFeatures and before the return), ensuring
clearExecutionState(projectPath) is always invoked even on the empty-list path;
keep references to the allInterruptedFeatures variable and clearExecutionState
method in your change so reviewers can easily locate the fix.

---

Duplicate comments:
In `@apps/ui/src/components/views/board-view/mobile-usage-bar.tsx`:
- Around line 38-59: formatResetTime now correctly guards against past
timestamps by returning 'Resetting soon' when diff <= 0; mark the earlier review
thread as resolved and remove any duplicate/commented-out legacy implementations
related to formatResetTime to avoid confusion. Locate the helper function
formatResetTime in mobile-usage-bar.tsx and delete any redundant duplicate code
blocks or commented alternatives, then resolve the review conversation so only
the updated implementation remains.
- Around line 188-191: The code currently calls useAppStore() four times to pull
claudeUsage, codexUsage, zaiUsage and geminiUsage (and their
LastUpdated/setters); consolidate these into a single destructuring call to
useAppStore() to return { claudeUsage, claudeUsageLastUpdated, setClaudeUsage,
codexUsage, codexUsageLastUpdated, setCodexUsage, zaiUsage, zaiUsageLastUpdated,
setZaiUsage, geminiUsage, geminiUsageLastUpdated, setGeminiUsage } so the
component subscribes once and avoids duplicate hooks/subscriptions; update the
references in mobile-usage-bar.tsx to use that single destructured object and
remove the multiple useAppStore() calls.

In
`@apps/ui/src/components/views/settings-view/api-keys/hooks/use-api-key-management.ts`:
- Around line 284-303: The failure and catch branches call setApiKeys with zai:
zaiKey which persists a z.ai key locally even though api.zai.configure() failed;
change those branches (where result.success is false and in the catch) to avoid
persisting the failed zaiKey by either omitting zai from the payload and using
the existing apiKeys.zai value or explicitly setting zai: '' (depending on
desired UX), i.e., update the setApiKeys calls inside the error branch and catch
block so they do not write zai: zaiKey and instead reference apiKeys.zai or ''
while leaving anthropic/google/openai as-is; also keep or improve the
logger.error calls around api.zai.configure for clarity.

---

Nitpick comments:
In `@apps/server/src/lib/cli-detection.ts`:
- Around line 24-28: The CliDetectionOptions interface exposes unused properties
includeWsl and wslDistribution which are dead API; remove these two fields from
the CliDetectionOptions declaration and update any related docs/comments to
reflect the reduced shape, and verify there are no references in detectCli or
detectAllCLis (and remove any unused destructuring or parameter defaults there
if present) so the public API only includes timeout as used by the
implementation.

In `@apps/server/src/providers/codex-provider.ts`:
- Around line 1020-1025: The call to getCodexAuthIndicators() inside
detectInstallation() is unused and creates unnecessary I/O; remove the dead
await call and let detectInstallation() rely on hasApiKey and
checkCodexAuthentication() for auth state instead (update any docs/comments if
present). Specifically, delete the await getCodexAuthIndicators() invocation
from the detectInstallation function and ensure checkCodexAuthentication() (and
hasApiKey) remain the source of authentication status.

In `@apps/server/src/routes/app-spec/generate-features-from-spec.ts`:
- Around line 29-33: Remove the unused JSDoc and constant
_CODEX_FEATURE_GENERATION_TIMEOUT_MS from the file; locate the declaration of
the constant named _CODEX_FEATURE_GENERATION_TIMEOUT_MS and delete both its
comment block and the const line, leaving the rest of the file (including the
existing Codex handling via effectiveReasoningEffort = 'xhigh') unchanged.

In `@apps/server/src/routes/features/routes/generate-title.ts`:
- Around line 17-20: The interface GenerateTitleRequestBody currently declares
an unused optional field projectPath; remove the projectPath property from the
GenerateTitleRequestBody interface so the type only contains description:
string, and search for/remediate any remaining references to
GenerateTitleRequestBody.projectPath (e.g., in request destructuring or docs) to
avoid stale or misleading API typings.

In `@apps/server/src/routes/models/routes/providers.ts`:
- Around line 9-34: The route handler createProvidersHandler should delegate
provider-check logic to a new service function (e.g.,
services/providersService.getAllProvidersStatus) instead of calling
ProviderFactory.checkAllProviders() directly; move the call to
ProviderFactory.checkAllProviders() into that service, build the providers
object there, and have the service emit the result via createEventEmitter()
(from lib/events.ts) so the status is streamed to the frontend; then update
createProvidersHandler to call getAllProvidersStatus(), return its result in the
JSON response, and handle errors as before.

In `@apps/server/src/services/gemini-usage-service.ts`:
- Around line 247-299: The current use of apiBuckets.map in the Gemini quota
computation mixes returning a GeminiQuotaBucket[] with mutating external
tracking variables (overallLowestRemaining, constrainedModel, overallResetTime,
flashLowestRemaining, flashResetTime, hasFlashModels, pro equivalents), which is
non-idiomatic; refactor by first iterating over apiBuckets with a forEach (or a
single reduce) to compute the tracking variables (update overallLowestRemaining,
constrainedModel, overallResetTime, hasFlashModels, flashLowestRemaining,
flashResetTime, hasProModels, proLowestRemaining, proResetTime) and then create
the quotaBuckets array with a pure map that only returns { modelId,
remainingFraction, resetTime } (or do the whole thing in one reduce that returns
both the tracking summary and the array), updating code in
gemini-usage-service.ts around the apiBuckets.map usage and referencing the same
variable names used now.

In `@apps/server/src/services/zai-usage-service.ts`:
- Around line 349-383: The code calls clearTimeout(timeoutId) twice inside
fetchUsageData: once inside the inner try after await fetch and again in the
finally block; remove the redundant inner clearTimeout call (the finally block
that clears timeoutId using the AbortController/timeoutId already guarantees
cleanup) so only the finally retains clearTimeout(timeoutId) and the
AbortController usage remains unchanged.

In `@apps/server/src/tests/cli-integration.test.ts`:
- Around line 273-278: The loop currently uses the unused destructured key name
_provider correctly, but the inner assertion
expect(result.issues.length).toBeGreaterThan(0) is tautological because the if
guard already checks result.issues.length > 0; remove that redundant assertion
and keep only the meaningful check (e.g., assert the first issue is truthy)
inside the for-each over Object.entries(results). Maintain the destructured
parameter name _provider and the variable result to locate the loop and update
its body accordingly.

In
`@apps/ui/src/components/views/board-view/components/kanban-card/card-actions.tsx`:
- Around line 129-166: Duplicate JSX for the Logs and Stop buttons appears in
both the isCurrentAutoTask branch and the alternate branch; extract these into
two small stateless components (e.g., LogsButton and StopButton) that accept the
needed props (onViewOutput, onForceStop, shortcutKey, feature.id) and preserve
the existing handlers (e.stopPropagation in onClick and onPointerDown), testids
(`view-output-${feature.id}`, `shortcut-key-${feature.id}`,
`force-stop-${feature.id}`) and classes; then replace the four duplicated blocks
with <LogsButton .../> and <StopButton .../> calls so styling/behavior stays
centralized and future updates are applied in one place (ensure prop names match
the existing onViewOutput/onForceStop handlers).
- Line 1: The file currently uses a blanket "@ts-nocheck" which hides real
typing issues; remove that and replace it with a discriminated-union props type
that uses feature.status as the discriminant so TypeScript can narrow allowed
optional callbacks per state. Update the CardActions component props (e.g., the
Props / CardActionsProps interface and any Feature type) to declare unions like
{ feature: { status: "open"; ... }; onOpenAction?: (...) => void } | { feature:
{ status: "closed"; ... }; onCloseAction?: (...) => void } (adjust callback
names to match existing callbacks in this file) so inside CardActions you can
switch/if on feature.status and call only the callbacks valid for that branch
without type errors; also update any usages to satisfy the new prop shape.
Ensure you remove "@ts-nocheck" after types compile.

In
`@apps/ui/src/components/views/board-view/components/kanban-card/kanban-card.tsx`:
- Around line 115-123: Extract the duplicated execution-state logic into a
single exported helper (e.g., isFeatureInExecutionState) and replace the inline
`isInExecutionState` checks in both the Kanban card and List row with a call to
that helper; specifically, create a function (exported from a shared utils
module) that accepts the feature status string and returns true for `status ===
'in_progress' || status.startsWith('pipeline_')`, then update the
`isInExecutionState` usage in the kanban-card component (where
`isActivelyRunning` is computed) and the corresponding `list-row` computation to
call this helper so the guard logic is centralized and reused.

In
`@apps/ui/src/components/views/board-view/components/list-view/row-actions.tsx`:
- Around line 489-499: The inner guard `{handlers.onForceStop && (...)}` is
redundant because the outer branch already ensures `handlers.onForceStop` is
truthy; remove the inner conditional and directly render the Separator and
MenuItem (using StopCircle, MenuItem, DropdownMenuSeparator and
onClick={withClose(handlers.onForceStop)}) to simplify the JSX and avoid
duplicate checks.
- Around line 503-507: The conditional rendering uses a confusing
double-negation: replace the expression "!(!feature.error &&
handlers.onForceStop)" with the clearer equivalent "(feature.error ||
!handlers.onForceStop)" so the full condition becomes: !isCurrentAutoTask &&
feature.status === 'in_progress' && (feature.error || !handlers.onForceStop);
update the condition where it's used in row-actions.tsx (around the block
guarded by isCurrentAutoTask, feature.status, feature.error, and
handlers.onForceStop) to improve readability while preserving logic.

In
`@apps/ui/src/components/views/settings-view/api-keys/hooks/use-api-key-management.ts`:
- Around line 10-11: The module-level `import { getElectronAPI }` is placed
after the executable statement `const logger =
createLogger('ApiKeyManagement')`; move the `getElectronAPI` import (and any
other imports) above any executable code so all imports appear at the top of the
file, e.g. place `import { getElectronAPI } from '@/lib/electron';` before the
`const logger = createLogger('ApiKeyManagement');` line and group it with the
other imports to satisfy the `import/first` lint rule.