refactor: enforce frontend view model boundaries

scripts/test-pre-commit.mjs

@@ -20,23 +20,32 @@ test("pre-commit scans the index, redacts findings and fails closed", () => {
 	const bin = nodePath.join(cwd, "bin");
 	const marker = nodePath.join(cwd, "downstream");
 	const token = `ghp_${randomBytes(GITHUB_TOKEN_RANDOM_BYTES).toString("hex")}`;
-	// eslint-disable-next-line sonarjs/no-os-command-from-path -- Repository checks use the developer/CI Git installation; arguments never invoke a shell.
-	const git = (...arguments_) => execFileSync("git", arguments_, { cwd, stdio: "pipe" });
+
+	const git = (...arguments_) =>
+		execFileSync("git", arguments_, { cwd, stdio: "pipe" }); // eslint-disable-line sonarjs/no-os-command-from-path -- Repository checks use the developer/CI Git installation; arguments never invoke a shell.
+
 	const run = (path = `${bin}${nodePath.delimiter}${process.env.PATH}`) =>
 		spawnSync("/bin/sh", ["-e", hook], {
 			cwd,
 			encoding: "utf8",
 			env: { ...process.env, PATH: path },
 		});
+
 	try {
 		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
 		mkdirSync(bin);
+
 		for (const command of ["npx", "npm"]) {
 			// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
-			writeFileSync(nodePath.join(bin, command), "#!/bin/sh\necho ran >> downstream\n", {
-				mode: 0o755,
-			});
+			writeFileSync(
+				nodePath.join(bin, command),
+				"#!/bin/sh\necho ran >> downstream\n",
+				{
+					mode: 0o755,
+				},
+			);
 		}
+
 		git("init", "--quiet");
 		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
 		writeFileSync(nodePath.join(cwd, "sample.txt"), "safe staged content\n");