DollhouseMCP

# SonarCloud Issues Analysis *Date: September 27, 2025* *Total Issues: 2,468* ## Executive Summary SonarCloud found 2,468 issues total, but the project still gets a green check because: - Most issues (67.7%) are MINOR severity - 97% are Code Smells (not bugs or vulnerabilities) - Only 16 BLOCKER issues and 14 vulnerabilities total ## Issue Breakdown by Severity | Severity | Count | Percentage | |----------|-------|------------| | MINOR | 1,670 | 67.7% | | MAJOR | 531 | 21.5% | | CRITICAL | 235 | 9.5% | | BLOCKER | 16 | 0.6% | | INFO | 16 | 0.6% | ## Issue Breakdown by Type | Type | Count | Percentage | |---------------|-------|------------| | CODE_SMELL | 2,396 | 97.1% | | BUG | 58 | 2.4% | | VULNERABILITY | 14 | 0.6% | ## Critical Issues That Need Immediate Attention ### 1. BLOCKER Vulnerability - GitHub Token in Code **Location**: `run-sync-test-with-pat.sh:7` **Issue**: "Make sure this Github token gets revoked, changed, and removed from the code" **Action Required**: IMMEDIATE - Remove any hardcoded tokens ### 2. High Cognitive Complexity Functions These functions are too complex and should be refactored: - `index.ts:1630` - Complexity: 94 (limit: 15) - `index.ts:2053` - Complexity: 87 (limit: 15) - `MemorySearchIndex.ts:502` - Complexity: 48 (limit: 15) - `test-element-lifecycle.js:383` - Complexity: 31 (limit: 15) ### 3. Deep Nesting in Tests Multiple test files have functions nested more than 4 levels deep: - `portfolio-single-upload.qa.test.ts` - Multiple locations - `PortfolioSyncComparer.test.ts` - Multiple locations - `BaseElement.test.ts:160` ## Top 10 Most Common Issues 1. **typescript:S7772** (305 issues) - Unnecessary imports or declarations 2. **typescript:S7728** (191 issues) - Missing explicit type annotations 3. **typescript:S2933** (150 issues) - Fields that could be readonly 4. **typescript:S2004** (132 issues) - Functions returning collections instead of arrays 5. **typescript:S1128** (125 issues) - Unnecessary imports 6. **javascript:S7772** (123 issues) - Unnecessary imports (JS files) 7. **typescript:S7781** (109 issues) - Missing return type on functions 8. **typescript:S7773** (88 issues) - Unused type parameters 9. **typescript:S7778** (88 issues) - Redundant type annotations 10. **typescript:S1854** (87 issues) - Dead stores (unused assignments) ## Recommendations ### Must Fix (BLOCKER/CRITICAL with actual impact) 1. **Remove GitHub token from `run-sync-test-with-pat.sh`** - Security vulnerability 2. **Refactor high complexity functions in `index.ts`** - Lines 1630 and 2053 3. **Address memory-related complexity** in MemoryManager and MemorySearchIndex ### Should Fix (Quality improvements) 1. **Add explicit type annotations** - 191 instances where types could be more explicit 2. **Mark fields as readonly** - 150 fields that don't change after initialization 3. **Remove unused imports** - 248 total unused imports across TS and JS files 4. **Add return types to functions** - 109 functions missing return types ### Can Accept (Low impact) 1. **Dead stores** - Variables assigned but not used (often in error handling) 2. **Redundant type annotations** - TypeScript can infer these 3. **Test file complexity** - Tests often need complex setup ## Why the Project Still Passes Despite 2,468 issues, the project passes because: 1. **Quality Gate focuses on new code** - Not all historical issues 2. **Most issues are minor** - 67.7% are MINOR severity 3. **Code Smells don't fail builds** - 97% are code smells, not bugs 4. **Configured thresholds** - The quality gate allows some issues ## Action Items for v1.9.10 Release ### Critical for Release - [ ] Remove GitHub token from `run-sync-test-with-pat.sh` - [ ] Review other BLOCKER issues (16 total) ### Post-Release Improvements - [ ] Create refactoring tickets for high-complexity functions - [ ] Set up auto-fix for simple issues (unused imports, readonly fields) - [ ] Configure SonarCloud to be stricter on new code ## SonarCloud Configuration Learned 1. **Duplication exclusions work** - Successfully excluded suppressions.ts 2. **Quality gate is configurable** - Can adjust thresholds 3. **New code vs overall code** - Focus on new code quality 4. **Issue types matter** - Bugs and vulnerabilities are weighted more than code smells ## Next Steps 1. Fix the GitHub token issue immediately 2. Review the 14 vulnerabilities and 58 bugs 3. Consider creating a technical debt backlog for the code smells 4. Set up stricter rules for new code going forward