| name | fix-sonar |
| description | Fetch SonarCloud issues and fix them. Use when user wants to fix code smells, bugs, or vulnerabilities reported by SonarCloud. |
Fix SonarCloud issues
Step 1: Fetch issues from SonarCloud API
Get open issues sorted by severity:
curl -s "https://sonarcloud.io/api/issues/search?componentKeys=Llloooggg_LetsFLUTssh&statuses=OPEN,CONFIRMED,REOPENED&ps=100&s=SEVERITY&asc=false" | python3 -c "
import json, sys
d = json.load(sys.stdin)
for i in d.get('issues', []):
comp = i.get('component','').replace('Llloooggg_LetsFLUTssh:','')
print(f\"{i['severity']:12} {i['type']:15} {comp}:{i.get('line','')} — {i['message']}\")
print(f\"\\nTotal: {d.get('total',0)} issues\")
"
If $ARGUMENTS contains a severity (BLOCKER, CRITICAL, MAJOR, MINOR, INFO), filter by it:
curl -s "https://sonarcloud.io/api/issues/search?componentKeys=Llloooggg_LetsFLUTssh&statuses=OPEN,CONFIRMED,REOPENED&severities=$ARGUMENTS&ps=100"
If $ARGUMENTS contains a file path, filter by component:
curl -s "https://sonarcloud.io/api/issues/search?componentKeys=Llloooggg_LetsFLUTssh&statuses=OPEN,CONFIRMED,REOPENED&components=Llloooggg_LetsFLUTssh:$ARGUMENTS&ps=100"
Step 2: Analyze and group issues
Group by file. For each file, read the relevant code sections to understand context.
Step 3: Fix issues
For each issue:
- Read the file and understand the problem. Run
/find-impact <file> when the flagged code is shared — refactors must not break call sites
- Fix the root cause — NEVER use
// ignore:, // NOSONAR, or any suppression
- Follow AGENTS.md "Code Quality — SonarCloud" — the S3776/S3358/S1854/S1192 patterns and shaping rules live there. Don't paraphrase them here
- If a fix changes public API or data flow, update docs (ARCHITECTURE.md)
Step 4: Verify
Run make lint to confirm no new issues were introduced.
Rules
- Fix issues from highest severity to lowest: BLOCKER > CRITICAL > MAJOR > MINOR > INFO
- One logical fix per commit — don't bundle unrelated fixes
- Follow the HARD STOP rule: implement fix → tests → docs →
make lint → commit. Do NOT start the next fix until the current one is committed. Version bumps are automated by dev/scripts/bump-version.sh during /pr
- Never suppress — always fix the root cause (AGENTS.md restates the ban verbatim)
