#36 · stacks/analyticshq

After the stx-native migration (3efbb06) the whole app is clean except one file:

$ grep -rnE 'window\.(confirm|alert|prompt)\(|(setTimeout|setInterval)\(|document\.(createElement|querySelector|getElementById|addEventListener)\(' resources/views/ resources/components/
   3 resources/views/dashboard.stx: setTimeout()
   2 resources/views/dashboard.stx: window.confirm()
   1 resources/views/dashboard.stx: setInterval()
   1 resources/views/dashboard.stx: document.createElement()

Every one is on stx's own prohibited list (PROHIBITED_DOM_PATTERNS in script-validation.js), which this app has enabled in warn-only mode.

The one with a real bug attached

The setInterval drives the live-visitor poll. It is cleared by the onMount teardown, but a full-document swap does not run that teardown — so on SPA navigation the timer survives and keeps polling /api/sites/:id/realtime for a dashboard that is no longer on screen. useInterval is lifecycle-aware and fixes this, so it is a behaviour change, not a lint fix.

The rest are straight swaps

window.confirm ×2 → stxConfirm, which already ships in the runtime this page loads (exposed as window.stx.confirm, promise-returning). Both call sites are already async, so it is an await.
setTimeout ×3 → useTimeout.

Deliberately staying

window.location.origin in shareLinkFor — useRoute() exposes only path/fullPath/hash/query, and the alternative (APP_URL) would hand a developer on localhost a share link pointing at production. Commented in place.
document.createElement('a') in the CSV export — that is the download-anchor trick; there is no stx primitive for it.

Note

This was never in 3efbb06's scope — that commit deliberately covered window.location and document.cookie only. Not a regression.