From the 2026-07-06 codebase audit (docs/audits/codebase-audit-2026-07-06.md, in-repo). Finding IDs are stable — cite them in fixes.
Severity: High (C30) + Medium (C60, C61, C66) · Status: CONFIRMED
C30 — bun run dev:react is broken (root package.json:11): invokes "dev": "vite" — vite is in no package.json, bun.lock, or node_modules/.bin (a fossil from a removed playground). Fresh-clone contributor gets error: script "dev" exited with code 127. Also: workspace packages lack "private": true (accidental-publish risk), and packages/react carries a self-referential peer dep on the very package it's bundled into — the reason npm 0.0.14 gets installed (see the website-consumption issue).
C60 — publish pipeline unguarded (package.json:17-19): no prepublishOnly/prepack — whatever dist is on disk gets published; bun run build's first step (clean) deletes the committed dist, so a failed build leaves a gutted tracked directory; npm latest currently points at 1.0.0-dev (published 2026-01-30) even though publish:dev exists precisely to prevent that. Edit source → forget build → bun run publish → stale dist ships under a bumped version.
C61 — three git-hook systems, all dead, one dangerous: .husky/pre-commit (npx lint-staged — not installed), .husky/post-merge (npx vc env pull — vc is not Vercel's package name; if husky were ever activated this executes whatever vc is on npm at that moment, on every merge), root lefthook.yml (100% commented out), website/lefthook.yml (bunx tsgo — not a dependency). Neither husky nor lefthook is installed; core.hooksPath unset. Three configs promise pre-commit checks; nothing runs — and there's no CI behind it either (C7).
C66 — root lint/format configs target a stack this repo doesn't have: .eslintrc.json extends next/storybook/useLenis configs (none installed at root); .prettierrc with no prettier; root .vscode/settings.json mandates prettier+eslint while website/.vscode/settings.json mandates Biome — open the monorepo root in VS Code and the two fight over website files.
Direction
Point dev at rollup -c -w; mark workspace packages private; add prepublishOnly: bun run build:engine && bun run build:react; move the dev line off the latest tag; pick ONE hook manager installed as a real devDependency (delete the other two configs, and kill npx vc regardless); delete root eslint/prettier or extend Biome to packages/.
Severity: High (C30) + Medium (C60, C61, C66) · Status: CONFIRMED
C30 —
bun run dev:reactis broken (root package.json:11): invokes"dev": "vite"— vite is in no package.json, bun.lock, or node_modules/.bin (a fossil from a removed playground). Fresh-clone contributor getserror: script "dev" exited with code 127. Also: workspace packages lack"private": true(accidental-publish risk), and packages/react carries a self-referential peer dep on the very package it's bundled into — the reason npm 0.0.14 gets installed (see the website-consumption issue).C60 — publish pipeline unguarded (package.json:17-19): no
prepublishOnly/prepack— whatever dist is on disk gets published;bun run build's first step (clean) deletes the committed dist, so a failed build leaves a gutted tracked directory; npmlatestcurrently points at 1.0.0-dev (published 2026-01-30) even thoughpublish:devexists precisely to prevent that. Edit source → forget build →bun run publish→ stale dist ships under a bumped version.C61 — three git-hook systems, all dead, one dangerous:
.husky/pre-commit(npx lint-staged— not installed),.husky/post-merge(npx vc env pull—vcis not Vercel's package name; if husky were ever activated this executes whatevervcis on npm at that moment, on every merge), rootlefthook.yml(100% commented out),website/lefthook.yml(bunx tsgo— not a dependency). Neither husky nor lefthook is installed;core.hooksPathunset. Three configs promise pre-commit checks; nothing runs — and there's no CI behind it either (C7).C66 — root lint/format configs target a stack this repo doesn't have:
.eslintrc.jsonextends next/storybook/useLenis configs (none installed at root);.prettierrcwith no prettier; root.vscode/settings.jsonmandates prettier+eslint whilewebsite/.vscode/settings.jsonmandates Biome — open the monorepo root in VS Code and the two fight over website files.Direction
Point
devatrollup -c -w; mark workspace packages private; addprepublishOnly: bun run build:engine && bun run build:react; move the dev line off thelatesttag; pick ONE hook manager installed as a real devDependency (delete the other two configs, and killnpx vcregardless); delete root eslint/prettier or extend Biome to packages/.