Desktop Sonar

Desktop SonarQube Rules — Yosemite Crew

Description

Use this skill when fixing SonarCloud issues in apps/desktop, or when writing new desktop code that must pass Sonar checks. Covers the rule categories enforced on the desktop project, the accepted deferral, and the fix patterns — plus where the authoritative issue list lives.

TRIGGER: any mention of "sonar", "code quality", or "lint issues" while working in apps/desktop, or when writing new Electron/renderer code.

Surface note: this is the Codex/AGENTS copy. Mandatory checks live in apps/desktop/AGENTS.md; the skill index is in the repo root AGENTS.md. The Claude Code copy is .claude/skills/desktop-sonar/.

Authoritative Source — Do Not Freeze a Snapshot

The single source of truth for open issues is the SonarCloud project yosemitecrew_Yosemite-Crew_Desktop. PR and branch pushes are analyzed in CI by the scan-only _sonar stage of .github/workflows/ci.yaml; .github/workflows/sonar-cloud-analysis.yml is the nightly type-aware backstop. The rule mix changes over time, so check the live project for the current list rather than trusting any static dump. This skill documents the categories and fix patterns that recur on this codebase, not a frozen issue count.

Do not reference the gitignored local-only Sonar tooling in any tracked file — that workflow lives in the gitignored CLAUDE.local.md.

Mandatory Checks — run from apps/desktop/ after every change

pnpm run type-check   # tsc (app) + tsc (tests)
pnpm run lint         # eslint .
pnpm run archlint     # local proxy for complexity / cyclic deps / dead code
pnpm test             # full Jest suite (fast here)

There is no eslint-plugin-sonarjs wired into desktop. The local proxy for cognitive / cyclomatic complexity and dead code is archlint (.archlint.yaml). The authoritative complexity and smell check is still the SonarCloud analysis.

Coverage gate

Desktop is gated by the same aggregate and PR added-line coverage floors defined in .github/workflows/_test.yaml as the rest of the repo; see docs/ci/coverage.md for the full explanation.

Durable caveat (fixed in #2238, kept here so it does not regress): coverageProvider: 'v8' needs source maps to attribute coverage back to your .ts sources. apps/desktop/tsconfig.json sets sourceMap: false, and only tsconfig.test.json overrides it to true. Dropping that override would make v8-to-istanbul report every loaded line as executed, so newly added dead code would measure as fully covered and neither the added-line nor the aggregate floor could catch it.

Canary check if you suspect the source-map wiring broke: append an exported function nothing calls, run coverage, and confirm its body reports zero hits. If it shows as covered, the source maps are off. See the "Running it locally" recipe in that doc.

Accepted Deferral

• Web:S6819 (prefer native <dialog> over role="dialog") is deferred in src/pages/tabbar.html where the overlay is shown/hidden via a CSS class or inline-display toggle rather than showModal(). Converting to a native <dialog> would change show/hide semantics, so these instances are intentionally left as-is. Do not "fix" them blindly — match the existing deferral unless you are also migrating the show/hide mechanism.

Security & Reliability (fix immediately — these are bugs/vulns, not smells)

• Web:S7039 — CSP unsafe-inline. Externalize inline <style>/<script>/style="" to .css/.js files; keep style-src file:; script-src file:;. Register every new file in scripts/copy-static.js pageAssets or it won't ship.
• Web:InputWithoutLabelCheck. Every input needs an associated <label> or an aria-label.

TypeScript / JS Rules (with one-line fixes)

Modern method preferences

| Rule | Fix | | --------- | ------------------------------------------------------------------- | --- | | *:S6557 | String.startsWith(...) over regex/indexOf at position 0. | | *:S7781 | String.replaceAll(...) over global-regex replace. | | *:S7765 | .includes() over indexOf(…) !== -1. | | *:S7758 | codePointAt / String.fromCodePoint over the char-code variants. | | *:S7767 | Math.trunc(x) over x | 0. |

Note: javascript:S3504 ("declare with let/const, not var") has shown up in volume on recent scans of generated/page scripts — replace var with const/let. Always confirm the current top rules against the live SonarCloud project before a cleanup sweep.

Gotchas

• eslint --fix auto-fixes some of these but not CSP, accessibility, or complexity issues — fix those by hand.
• After any fix, re-run pnpm run type-check && pnpm run lint && pnpm run archlint before marking resolved; the final word is the SonarCloud analysis in CI.
• Externalizing a page asset is only half the fix — it must also be added to copy-static.js.