[isamu]

Summary

Clears the code scanning (scoria) findings that can be fixed as written, all in one go. Behaviour does not change.

• sort() / reverse() → toSorted() / toReversed(). Every site in src and tests, not only the ones flagged. Every site already sorted a copy, so where a copy was written out ([...x].sort()) it is dropped. tsconfig.json's lib moves from ES2022 to ES2023, so the types are known.
• Shadowed names.
  • The inner _ becomes _cell / _value / _column.
  • In calculator.ts, the sheet that shadowed the argument becomes named / owner.
• Helpers that capture nothing move to module scope. Two in test_forecastEts.ts had the same name formula, so they became tenPointForecast and fourPointForecast.
• Unused exports lose export. collectNumericValues was used nowhere and is deleted.
• The TODO in calculator.ts (dependencies: []) becomes a sentence saying what the field is.
• Spreads:
  • in a map: concat, in group-by-math.ts and three tests;
  • in a reduce accumulator (LET's bindings): push, on the accumulator the reduce created itself.
• await in a loop: the polling and the read-in-turn loop become recursion.
• In tests:
  • the __ names put on globalThis become spreadsheetIfsProbe and the like;
  • a test value close to π moves to 5.14159;
  • the unused pick is removed.

Items to Confirm

• The package now needs an ES2023 runtime. toSorted and toReversed reach the build unchanged. Codex raised this and you decided to require it. README's Installation section says so: Node 22 or later, Chrome 110, Safari 16, Firefox 115 or later.
• The behaviour is unchanged. Old (origin/main) and new were run side by side and every result compared.
  • Corpus: every formula appearing in the tests (corpusdiff.mts), all identical.
  • Generated: random sheets × formulas that use the changed functions (MEDIAN, LARGE, SORT, GROUPBY, PIVOTBY, LINEST, the rank tests, TEXT, LET, MAP, FREQUENCY, FORECAST.ETS and others), all identical.
• yarn lint, yarn typecheck, yarn build, yarn test, yarn test:engine and run-all-fixtures.ts pass. oxlint, run with scoria's settings, reports nothing.
• Not fixed here:
  • jscpd (repeated code; mostly the small helpers each test has): to be handled separately.
  • god-file (calculator.ts, evaluator.ts and View.vue over their size limits): splitting them is a large refactor, out of scope here.
  • style-block in View.vue: replacing it with Tailwind needs a check on screen, so it goes in its own PR.

User Prompt

• https://github.com/receptron/GUIChatPluginSpreadsheet/security/code-scanning — fix whatever can be fixed, all together.
• (Choosing between toSorted and sort) Decide that the package requires ES2023.

🤖 Generated with Claude Code

work in GUIChatPluginSpreadsheet

[isamu]

P2 — should fix: ES2023 array methods are now required at runtime by the published browser bundle.

lib: ["ES2023", ...] only changes type checking; target remains ES2020 and Vite does not polyfill Array.prototype.toSorted/toReversed (or the typed-array variants), so these calls are emitted as-is. The package is a Vue/browser plugin, and this can make calculation fail with TypeError: values.toSorted is not a function in consumers whose browser runtime predates ES2023, even though the previous code worked.

Every source occurrence introduced by this change is: src/core/functionList.ts:9; src/engine/evaluator.ts:198; src/engine/functions/analysis-math.ts:84,103,110; src/engine/functions/array-functions-math.ts:43; src/engine/functions/descriptive-math.ts:18; src/engine/functions/forecast-ets-math.ts:28,65,220; src/engine/functions/group-by-math.ts:54; src/engine/functions/hypothesis-tests-math.ts:90,195,196,248,331; src/engine/functions/linest-math.ts:158,173; src/engine/functions/matrix-math.ts:114,116; src/engine/functions/shape-math.ts:71; src/engine/functions/statistical-math.ts:32; src/engine/nameBinding.ts:159; src/engine/textArithmetic.ts:28; and src/engine/textDateFormat.ts:78.

Smallest fix: keep the non-mutating behavior with the existing ES2020-compatible forms (for example, [...values].sort(...), [...items].reverse(), and Array.from(typedArray).sort()) in library source, or explicitly add/document a supported-runtime/polyfill contract for every published entry point.

What would change my mind: a verified browser support policy that already requires ES2023 built-ins, together with a build/polyfill guarantee for the published bundles; Node >=22 alone does not establish that for the Vue package.

[isamu]

CODEX VERDICT: CHANGES REQUESTED

• P2: The published browser bundle now calls ES2023 toSorted/toReversed APIs, but target remains ES2020 and no polyfill/runtime support contract is present. Older browser consumers can fail at runtime. An inline comment is attached to tsconfig.json:6 and lists every source occurrence.

Axis	Result
correctness and edge cases	none found; the changed implementations preserve the intended copy/non-mutating behavior in the inspected sites
security (injection / path traversal / code evaluation)	none found
tests: does a test go red if the new behaviour breaks	none found in the changed tests; yarn test:engine passed 2216/2216 and yarn typecheck passed. The requested Vitest command could not load this checkout's pre-existing ESM-incompatible vite.config.ts (__dirname is not defined)
API / schema / wire / on-disk compatibility	none found in supported package entry points; removed helpers/constants are not re-exported by the package's public core entry
consistency with the rest of the codebase	none found
i18n lockstep (src/lang has 8 locales)	none; no src/lang changes
TIER C (behaviour preservation across many files; a tsconfig lib change)	finding: the ES2023 lib/API change is a runtime compatibility risk for browser consumers; see P2 above
behaviour preservation: sort/reverse, concat, LET reduce, test recursion, deferred rewrite	none found after tracing each changed site; the LET substitution reads bound before its push, and the concat operands are row/value arrays with the same one-level flattening as the replaced spreads
renames: calculator names, globalThis probes, hoisted helpers	none found
removed exports and deleted collectNumericValues	none found in source/tests/demo/public entry points
tsconfig lib ES2023: runtime support and admitted APIs	finding: lib supplies types only; the new runtime methods are not downlevel-transformed or polyfilled
supplied differentials (corpusdiff.mts, gendiff-cs.mts)	not executable here because .old/src is absent. By inspection they provide partial coverage: quoted test formulas plus rows 0/2/6, and 400 generated cases over a fixed template set; they do not cover all changed helper sites, test-only rewrites, exports, or runtime compatibility, so I would not treat them as covering every changed site

Checks: yarn test:engine passed (2216 tests); yarn typecheck passed; npx vitest run --configLoader runner was blocked before tests by the config error above. No mutation sweep was run.

FINDINGS COMPLETE: I read every hunk of the diff and this is every finding I have.

[isamu]

Codex round 1 raised one P2: the package now needs an ES2023 runtime. The user decided to require it. README's Installation section now says so (3851fcc; no polyfill). Nothing else was raised.

[isamu]

CODEX VERDICT: LGTM

Read SHA: 3851fcc

Axis	Result
correctness and edge cases	none
security (injection / path traversal / code evaluation)	none
tests: does a test go red if the new behaviour breaks	none; yarn test:engine passes 2216/2216 and yarn typecheck passes. npx vitest run --configLoader runner is blocked before collection by the existing ESM __dirname error in vite.config.ts
API / schema / wire / on-disk compatibility	none; removed symbols are not used by source/tests/demo or the package's public entry points
consistency with the rest of the codebase	none
i18n lockstep (src/lang has 8 locales)	none; no locale changes
TIER C (behaviour preservation across many files; a tsconfig lib change)	none; package.json already requires Node >=22, and README now states the ES2023 runtime requirement
behaviour preservation: sort/reverse, concat, LET reduce, test recursion, deferred rewrite	none; every changed site preserves copy semantics/one-level flattening and the LET substitution still reads bound before pushing the new binding
renames: calculator names, globalThis probes, hoisted helpers	none; formula strings and assertions remain paired with the renamed probes, and hoisted helpers have no conflicting names
removed exports and deleted collectNumericValues	none
tsconfig lib ES2023: runtime support and admitted APIs	none; the package explicitly requires an ES2023 runtime and uses the methods unchanged
supplied differentials (corpusdiff.mts, gendiff-cs.mts)	not executable here because .old/src is absent. By inspection they cover the changed formula families and representative engine paths, but not every helper hoist, rename, removed export, or test-only rewrite; those sites were reviewed directly and the full engine suite passed

FINDINGS COMPLETE: I read every hunk of the diff and this is every finding I have.