feat(tools): add a real typecheck step (bun build does not typecheck)

bun build bundles without checking types, so a field that is read but never
declared compiles cleanly and stays broken silently. Typecheck.ts runs
tsc --noEmit over two roots: hooks/ + LIFEOS/TOOLS/, and the Pulse server,
which needs its own pass because its dependencies live in its own tree.

The tsconfigs are generated into a non-standard filename and deleted at the
end of the run, so no file named tsconfig.json ever lands at the install
root, where Bun would read it at runtime and a single resolution field
would move live hook and Pulse behaviour.

Requested in #1614.

Author: xmasyx

LifeOS/install/LIFEOS/TOOLS/Typecheck.ts

@@ -0,0 +1,142 @@
+#!/usr/bin/env bun
+/**
+ * Typecheck.ts — `bun build` does not typecheck. This does.
+ *
+ * WHY IT EXISTS. Bun bundles without checking types, so a field that is read but
+ * never declared bundles cleanly and therefore "compiles". The build was answering
+ * a weaker question than the one we thought we were asking, and code stayed broken
+ * for days while every signal stayed green.
+ *
+ * TWO PASSES, NOT ONE:
+ *   1. root   — hooks/ + LIFEOS/TOOLS/
+ *   2. Pulse  — LIFEOS/PULSE/**
+ *
+ * They are two passes rather than one wider `include` because Pulse has its own
+ * dependencies and its own node_modules; folding it into the root pass makes both
+ * resolve against the wrong tree.
+ *
+ * THE CONFIGS ARE GENERATED AND THROWN AWAY, ON PURPOSE. A file literally named
+ * `tsconfig.json` at the install root would be read by BUN AT RUNTIME for module
+ * resolution: a single `paths` / `baseUrl` / `jsx` field in it would silently move
+ * the behaviour of every live hook and of the running Pulse server. Writing the
+ * configs under a non-standard name, and deleting them at the end, makes runtime
+ * invariance true BY CONSTRUCTION rather than by discipline — only `tsc -p` ever
+ * opens them.
+ *
+ * THE TOMBSTONE IS LOUD ON PURPOSE. A silent exclusion is a false green with a UI:
+ * after a while nobody remembers that some code is not being looked at, and "the
+ * typecheck passes" starts to mean less than it appears to. Every run says it out
+ * loud. Excluded does not mean healthy — it means NOT LOOKED AT.
+ *
+ * USAGE  bun LIFEOS/TOOLS/Typecheck.ts
+ * EXIT   0 = both passes clean · 1 = at least one pass has type errors
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, writeFileSync, rmSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+/** This file lives at <configRoot>/LIFEOS/TOOLS/, so the root is two levels up.
+ *  Derived from the script's own location rather than assumed to be ~/.claude:
+ *  the install root is configurable and hardcoding it makes the tool lie on any
+ *  install that put it elsewhere. */
+const ROOT = resolve(import.meta.dir, "..", "..");
+const PULSE = join(ROOT, "LIFEOS", "PULSE");
+
+const COMPILER_OPTIONS = {
+  target: "ESNext",
+  module: "ESNext",
+  moduleResolution: "bundler",
+  types: ["bun"],
+  strict: true,
+  noEmit: true,
+  skipLibCheck: true,
+  esModuleInterop: true,
+  allowImportingTsExtensions: true,
+  resolveJsonModule: true,
+  forceConsistentCasingInFileNames: true,
+};
+
+interface Pass {
+  label: string;
+  /** Directory the generated config is written into; `include` is relative to it. */
+  cwd: string;
+  include: string[];
+  exclude: string[];
+  /** Printed when the pass is skipped because `cwd` does not exist. */
+  absentNote: string;
+}
+
+const PASSES: Pass[] = [
+  {
+    label: "root (hooks/ + LIFEOS/TOOLS/)",
+    cwd: ROOT,
+    include: ["hooks/**/*.ts", "LIFEOS/TOOLS/**/*.ts"],
+    exclude: ["node_modules", "**/node_modules/**", "LIFEOS/PULSE/**"],
+    absentNote: "install root not found",
+  },
+  {
+    label: "Pulse server (LIFEOS/PULSE/**)",
+    cwd: PULSE,
+    include: ["**/*.ts"],
+    // Observability is a self-contained Next.js app with its own package.json,
+    // node_modules, next.config.ts and `@/` alias. It deserves its own pass with
+    // its own dependencies; folding it in here would only produce noise.
+    exclude: ["node_modules", "**/node_modules/**", "Observability/**"],
+    absentNote: "LIFEOS/PULSE not present in this install",
+  },
+];
+
+console.log("─".repeat(72));
+console.log("⚠  TOMBSTONE — not everything is being looked at:");
+console.log("   • LIFEOS/PULSE/Observability/**  (standalone Next.js app, own deps)");
+console.log("   Excluded does NOT mean healthy. It means NOT LOOKED AT.");
+console.log("─".repeat(72));
+
+let failed = 0;
+let ran = 0;
+
+for (const p of PASSES) {
+  console.log(`\n▶ ${p.label}`);
+
+  if (!existsSync(p.cwd)) {
+    // Loud, and counted as neither pass nor fail: "I could not look" is a
+    // different statement from "I looked and it was clean".
+    console.log(`⏭  skipped — ${p.absentNote}`);
+    continue;
+  }
+
+  const configPath = join(p.cwd, ".typecheck.generated.json");
+  try {
+    writeFileSync(
+      configPath,
+      JSON.stringify(
+        {
+          "//": "GENERATED by LIFEOS/TOOLS/Typecheck.ts and deleted at the end of the run. Never named tsconfig.json: Bun reads that name at runtime and a resolution field here would move live behaviour.",
+          compilerOptions: COMPILER_OPTIONS,
+          include: p.include,
+          exclude: p.exclude,
+        },
+        null,
+        2,
+      ),
+    );
+
+    const r = spawnSync("bunx", ["tsc", "--noEmit", "-p", configPath], {
+      stdio: "inherit",
+      cwd: p.cwd,
+    });
+    const status = r.status ?? 1;
+    ran++;
+    if (status !== 0) failed++;
+    console.log(status === 0 ? `✅ ${p.label}: clean` : `❌ ${p.label}: type errors`);
+  } finally {
+    // Always remove it, including when tsc throws or the run is interrupted, so a
+    // stray config can never be left behind where Bun might grow to read it.
+    rmSync(configPath, { force: true });
+  }
+}
+
+// Every pass always runs, even after a failure: stopping at the first one would
+// hide the second one's errors, and seeing ALL of them is the entire point.
+console.log(`\n${failed === 0 ? "✅" : "❌"} ${ran} pass(es) run · ${failed} with type errors`);
+process.exit(failed > 0 ? 1 : 0);