Final SonarCloud Cleanup

[hevlyo]

Summary

• Zero Complexity Issues: Final refactor of CoreAstRule, git.ts and validators.ts to ensure strict compliance with Cognitive Complexity limits.
• Script Safety: Fixed all [ to [[ constructs in bash scripts and ensured syntax validity (verified with bash -n).
• Code Smells: Resolved remaining issues with String.raw, unnecessary escapes, and control characters.
• Testing: Updated snapshots and fixed minor regressions in test suite.

This PR aims to reach 0 issues on SonarCloud.

Summary by CodeRabbit

• Refactor
  • Improved internal code organization with extracted helpers and consolidated constants for clearer logic and maintenance.
• Chores
  • Modernized shell script checks for more robust condition evaluation and standardized success reporting.
• Style
  • Minor formatting and normalization changes to logging and prompts for more consistent output and behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

Replaces POSIX test expressions with Bash [[...]] in shell scripts, makes small output/return adjustments, and refactors TypeScript by extracting helpers, renaming methods, and tightening regex construction and command-name resolution—no public API changes.

Changes

Cohort / File(s)	Summary
Shell scripts docs/install.sh, scripts/install-hook.sh	Replaced POSIX [ ... ] tests with Bash [[ ... ]] across conditionals; switched some helper output arg expansion from "$@" to "$*" and added explicit return 0 in a few functions.
CLI refactor src/cli.ts	Extracted repeated strings into constants, consolidated prompt/answer handling, added consistent bracing and explicit tty-based color logic; no behavioral changes.
Parser — command checks src/parser/command-checks.ts	Added private helper checkGitIntegration to centralize uncommitted-change detection; simplified checkFindCommand parsing and replaced inline logic with helper calls.
Parser — core rule src/parser/rules/CoreAstRule.ts	Renamed checkProcessSubstitution → checkBashSubshells; added resolveCmdName and checkGitRm helpers; replaced inline command-resolution and git-rm handling with helper calls.
Regex & string handling src/parser/rules/RawThreatRule.ts, src/shell-context.ts, src/integrations/git.ts	Changed RegExp construction to use String.raw where appropriate, introduced local vars for string ops, and normalized command-name extraction to ensure correct escaping and casing.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 I hopped through brackets, old to new,
I tidied helpers, trimmed a few,
Regex now neat, commands resolved,
Small hops that keep the code evolved. 🥕

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The pull request title 'Final SonarCloud Cleanup' is generic and vague, failing to convey the specific nature of the actual changes, which include refactoring for cognitive complexity, bash syntax improvements, and code smell fixes.	Consider a more descriptive title like 'Refactor for SonarCloud compliance: reduce complexity, fix bash syntax, and address code smells' to better reflect the actual changes.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/sonar-perfect-score

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 5

🤖 Fix all issues with AI agents

In `@docs/install.sh`:
- Around line 20-24: In the error() function, the trailing "return 1" is
unreachable because "exit 1" immediately terminates the script; remove the
"return 1" statement from error() (or if you intended the function to return
instead of exiting, replace "exit 1" with "return 1") so the function's control
flow is correct—locate the error() function and either delete the return line or
swap the exit to a return depending on desired behavior.
- Around line 26-38: The info, info_bold, and success functions misuse $@ inside
a quoted string which triggers ShellCheck SC2145 and can split arguments
incorrectly; change the argument expansion so arguments are joined safely (e.g.
replace $@ with "$*" or move "$@" outside the surrounding string) and quote
expansions to preserve whitespace — update the three functions (info, info_bold,
success) to use a safe expansion like echo -e "${Dim}$* ${Color_Off}" (or echo
-e "${Dim}" "$@" "${Color_Off}") so multiple arguments are handled consistently.

In `@src/cli.ts`:
- Around line 161-162: The code uses String.raw for the ANSI escape sequence,
which prevents \x1b from being interpreted so colors print as literal text; in
the console.error call where tty is computed (variable tty and the console.error
line), replace the String.raw template with a normal template literal so the ESC
byte is interpreted (e.g., use `\x1b[32m${msg}\x1b[0m` or
`\u001b[32m${msg}\u001b[0m`) when tty is true, leaving the plain msg when tty is
false.
- Around line 126-128: The prompt uses String.raw which prevents escape
sequences like \n from becoming real newlines; change the promptMsg declaration
to use a normal template literal (remove String.raw) so the leading `\n` and any
other escapes are interpreted as actual newlines and the message displays
correctly; update the const promptMsg used in rl.question accordingly.

In `@src/parser/rules/CoreAstRule.ts`:
- Around line 83-92: resolveCmdName currently treats a leading backslash
specially and keeps the full path (e.g. "/usr/bin/rm") which prevents proper
basename extraction and blocked-command detection; change the logic to first
strip a single leading backslash (if any) into a local variable (e.g. stripped =
entry.startsWith("\\") ? entry.slice(1) : entry), then compute basename =
stripped.split("/").pop() ?? "", call this.resolveVarToken(basename, vars), and
if resolvedVar is returned take resolvedVar.split("/").pop()?.toLowerCase() ??
"" else return basename.toLowerCase(); ensure you update uses of cmdName to use
these variables so both escaped paths and resolved variables are evaluated by
basename extraction and lowercased.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8ea86a377b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud