desktop-sonar

name	desktop-sonar
description	Use when fixing SonarCloud issues in apps/desktop or writing Sonar-clean Electron and renderer code. Covers the enforced rule categories, the accepted role=dialog deferral, CSP and page-asset rules, and links the live SonarCloud project.

Desktop SonarQube Rules — Yosemite Crew

Description

Use this skill when fixing SonarCloud issues in apps/desktop, or when writing new desktop code that must pass Sonar checks. Covers the rule categories enforced on the desktop project, the accepted deferral, and the fix patterns — plus where the authoritative issue list lives.

TRIGGER: any mention of "sonar", "code quality", or "lint issues" while working in apps/desktop, or when writing new Electron/renderer code.

Surface note: this is the Codex/AGENTS copy. Mandatory checks live in apps/desktop/AGENTS.md; the skill index is in the repo root AGENTS.md. The Claude Code copy is .claude/skills/desktop-sonar/.

---

Authoritative Source — Do Not Freeze a Snapshot

The single source of truth for open issues is the SonarCloud project yosemitecrew_Yosemite-Crew_Desktop. PR and branch pushes are analyzed in CI by the scan-only _sonar stage of .github/workflows/ci.yaml; .github/workflows/sonar-cloud-analysis.yml is the nightly type-aware backstop. The rule mix changes over time, so check the live project for the current list rather than trusting any static dump. This skill documents the categories and fix patterns that recur on this codebase, not a frozen issue count.

Do not reference the gitignored local-only Sonar tooling in any tracked file — that workflow lives in the gitignored CLAUDE.local.md.

---

Mandatory Checks — run from apps/desktop/ after every change

pnpm run type-check   # tsc (app) + tsc (tests)
pnpm run lint         # eslint .
pnpm run archlint     # local proxy for complexity / cyclic deps / dead code
pnpm test             # full Jest suite (fast here)

There is no eslint-plugin-sonarjs wired into desktop. The local proxy for cognitive / cyclomatic complexity and dead code is archlint (.archlint.yaml). The authoritative complexity and smell check is still the SonarCloud analysis.

---

Accepted Deferral

• Web:S6819 (prefer native <dialog> over role="dialog") is deferred in src/pages/tabbar.html where the overlay is shown/hidden via a CSS class or inline-display toggle rather than showModal(). Converting to a native <dialog> would change show/hide semantics, so these instances are intentionally left as-is. Do not "fix" them blindly — match the existing deferral unless you are also migrating the show/hide mechanism.

---

Security & Reliability (fix immediately — these are bugs/vulns, not smells)

• Web:S7039 — CSP unsafe-inline. Externalize inline <style>/<script>/style="" to .css/.js files; keep style-src file:; script-src file:;. Register every new file in scripts/copy-static.js pageAssets or it won't ship.
• Web:InputWithoutLabelCheck. Every input needs an associated <label> or an aria-label.

---

TypeScript / JS Rules (with one-line fixes)

Rule	Fix
typescript:S1874	Deprecated webContents.goBack()/goForward() → webContents.navigationHistory.goBack()/goForward() (also canGoBack/canGoForward).
*:S7764	Prefer globalThis over bare window in renderer page scripts.
*:S7761	Prefer .dataset over get/set/removeAttribute('data-…').
*:S6582	Optional chaining: a && a.b → a?.b.
typescript:S6606	Nullish coalescing: || → ??/??= when the left side can be 0/''.
typescript:S7741	=== undefined over typeof x === 'undefined'.
*:S7735	Invert unexpected negated conditions (if(!x){A}else{B}) or use an early return.
*:S3358	Extract nested ternaries into a named helper.
typescript:S3776	Cognitive complexity > 15 → extract helper functions.
typescript:S2004	Functions nested > 4 levels → extract.
typescript:S4325	Remove unnecessary type assertions.
typescript:S7748	No zero-fraction numbers (1.0 → 1).
typescript:S6564	Remove redundant type alias.
typescript:S6598	Type literal with only a call signature → function type.
typescript:S6551	Robust error stringify: error instanceof Error ? error.message : String(error).

Modern method preferences

| Rule | Fix | | --------- | ------------------------------------------------------------------- | --- | | *:S6557 | String.startsWith(...) over regex/indexOf at position 0. | | *:S7781 | String.replaceAll(...) over global-regex replace. | | *:S7765 | .includes() over indexOf(…) !== -1. | | *:S7758 | codePointAt / String.fromCodePoint over the char-code variants. | | *:S7767 | Math.trunc(x) over x | 0. |

Note: javascript:S3504 ("declare with let/const, not var") has shown up in volume on recent scans of generated/page scripts — replace var with const/let. Always confirm the current top rules against the live SonarCloud project before a cleanup sweep.

---

Gotchas

• eslint --fix auto-fixes some of these but not CSP, accessibility, or complexity issues — fix those by hand.
• After any fix, re-run pnpm run type-check && pnpm run lint && pnpm run archlint before marking resolved; the final word is the SonarCloud analysis in CI.
• Externalizing a page asset is only half the fix — it must also be added to copy-static.js.