Tighten frontend TypeScript contracts

[mariusvniekerk]

• Tightens settings API types so generated OpenAPI clients carry the real contract.
• Removes frontend compatibility shims and broad runtime normalization around typed settings data.
• Centralizes async command handling and removes promise-shape probing.
• Adds oxfmt as the explicit frontend formatter without enabling a baseline format check yet.
• Documents frontend TypeScript cleanup rules to avoid defensive casts and fabricated tests.

[roborev-ci]

roborev: Combined Review (140b8f0)

Medium issues found: settings defaults may leak invalid zero/null values, and the formatter dependency is missing from the lockfile.

Medium

• internal/server/settings_handlers.go:56
buildLocalSettingsResponse now returns s.cfg.Terminal directly after the response schema/frontend types were tightened to require full non-null terminal settings. Configs that omit optional terminal fields can still expose font_size: 0, line_height: 0, or cursor_blink: null, which can break the settings UI or terminal defaults.
  Fix: Normalize the response here, or move defaulting into config load/validation so config.Terminal is always fully populated before API responses.

• package.json:6
  The root package adds oxfmt scripts and devDependencies.oxfmt, but the diff does not update bun.lock. Frozen or CI installs using the lockfile may not resolve the declared formatter dependency consistently.
  Fix: Run bun install from the repo root and commit the resulting bun.lock update.

---

Synthesized from 2 reviews (agents: codex | types: default, security)

[roborev-ci]

roborev: Combined Review (ff5e3d7)

Summary verdict: Two medium issues need fixing; no high or critical findings were reported.

Medium

• packages/ui/src/utils/markdown.ts:229
  The extracted listitem renderer calls this.parser.parse(token.tokens) without passing !!token.loose. Marked uses that flag to preserve tight vs loose list output, so tight markdown lists may start rendering with paragraph wrappers.
  Fix: Restore the loose flag: this.parser.parse(token.tokens, !!token.loose).

• package.json:7
  The new fmt / fmt:check scripts depend on oxfmt, but the checked-in Bun lockfile was not updated. Clean or frozen installs may miss the new binary and cause formatter scripts to fail.
  Fix: Run bun install with the repo’s Bun workspace setup and commit the resulting bun.lock changes.

---

Synthesized from 2 reviews (agents: codex | types: default, security)

[roborev-ci]

roborev: Combined Review (4fe1a05)

High-risk settings regression found; dependency lockfiles also need updating before merge.

High

• internal/server/settings_handlers.go:56
GET /settings now returns raw s.cfg.Terminal, while the schema/frontend expect terminal fields to be complete and non-null. Existing/default configs can still have zero or nil terminal values, so the API may emit font_size: 0, line_height: 0, or cursor_blink: null, and the frontend no longer normalizes them.
  Fix: Restore response normalization or apply terminal defaults during config load/validation before serving settings.

Medium

• package.json:7
  The package manifests change Playwright/prettier dependencies and add oxfmt, but the Bun lockfiles are not updated. CI uses bun install --frozen-lockfile, so installs can fail or use stale dependency versions.
  Fix: Regenerate and commit the affected bun.lock files.

---

Synthesized from 2 reviews (agents: codex | types: default, security)