fix-sonar

name	fix-sonar
description	Fetch SonarCloud issues and fix them. Use when user wants to fix code smells, bugs, or vulnerabilities reported by SonarCloud.

Fix SonarCloud issues

Step 1: Fetch issues from SonarCloud API

Get open issues sorted by severity:

curl -s "https://sonarcloud.io/api/issues/search?componentKeys=Llloooggg_LetsFLUTssh&statuses=OPEN,CONFIRMED,REOPENED&ps=100&s=SEVERITY&asc=false" | python3 -c "
import json, sys
d = json.load(sys.stdin)
for i in d.get('issues', []):
    comp = i.get('component','').replace('Llloooggg_LetsFLUTssh:','')
    print(f\"{i['severity']:12} {i['type']:15} {comp}:{i.get('line','')} — {i['message']}\")
print(f\"\\nTotal: {d.get('total',0)} issues\")
"

If $ARGUMENTS contains a severity (BLOCKER, CRITICAL, MAJOR, MINOR, INFO), filter by it:

curl -s "https://sonarcloud.io/api/issues/search?componentKeys=Llloooggg_LetsFLUTssh&statuses=OPEN,CONFIRMED,REOPENED&severities=$ARGUMENTS&ps=100"

If $ARGUMENTS contains a file path, filter by component:

curl -s "https://sonarcloud.io/api/issues/search?componentKeys=Llloooggg_LetsFLUTssh&statuses=OPEN,CONFIRMED,REOPENED&components=Llloooggg_LetsFLUTssh:$ARGUMENTS&ps=100"

Step 2: Analyze and group issues

Group by file. For each file, read the relevant code sections to understand context.

Step 3: Fix issues

For each issue:

1. Read the file and understand the problem. Run /find-impact <file> when the flagged code is shared — refactors must not break call sites
2. Fix the root cause — NEVER use // ignore:, // NOSONAR, or any suppression
3. Follow AGENTS.md "Code Quality — SonarCloud" — the S3776/S3358/S1854/S1192 patterns and shaping rules live there. Don't paraphrase them here
4. If a fix changes public API or data flow, update docs (ARCHITECTURE.md)

Step 4: Verify

Run make lint to confirm no new issues were introduced.

Rules

• Fix issues from highest severity to lowest: BLOCKER > CRITICAL > MAJOR > MINOR > INFO
• One logical fix per commit — don't bundle unrelated fixes
• Follow the HARD STOP rule: implement fix → tests → docs → make lint → commit. Do NOT start the next fix until the current one is committed. Version bumps are automated by dev/scripts/bump-version.sh during /pr
• Never suppress — always fix the root cause (AGENTS.md restates the ban verbatim)