.sonarcloud.properties

# SonarCloud Automatic Analysis config (scans on push to the default branch, no CI/token needed).
# Exclude vendored deps, build output, generated code, screenshots, and infra glue so analysis
# focuses on the app source. Coverage import is not available in Automatic Analysis mode.
# Source charset — the repo is UTF-8 (emoji, →, ✓, box-drawing all appear in source/comments). Without
# this the scanner falls back to its host default charset and misreads valid multibyte UTF-8, raising a
# spurious "problems with file encoding in the source code" warning in the analysis.
sonar.sourceEncoding=UTF-8
sonar.exclusions=packages/**,public/**,.next/**,coverage/**,node_modules/**,drizzle/**,scripts/**,deploy/**,**/*.d.ts
sonar.tests=test
sonar.test.inclusions=test/**/*.test.ts,test/**/*.test.tsx

# ─── By-design findings — triaged as "Accepted" in the SonarCloud issue list ────────────────────
# NOTE: Automatic Analysis does NOT support `sonar.issue.ignore.multicriteria` (only sonar.sources,
# exclusions, inclusions, tests, sourceEncoding, cpd.exclusions are honored). So these classes are
# cleared via issue TRIAGE in the SonarCloud UI (Open → Accepted), not via this file. This block is
# the reviewed rationale for that triage — each is verified non-security-sensitive by design. Genuine
# security-relevant randomness already moved to the CSPRNG in src/lib/rand.ts (real code fix, not an
# ignore); any NEW instance of these rules outside the paths below is a real finding and must be fixed.
#
#   S2245 (Math.random) — non-security randomness only:
#     • src/components/ui/{particles,dot-pattern}.tsx — decorative animation offsets.
#     • src/db/seed.ts — demo seed rows, no security relevance.
#     • src/lib/agentrun.ts — telemetry trace SAMPLING (`Math.random() > rate`), not a secret.
#   S5332 (clear-text http://) — src/lib/** localhost / internal-service defaults (offgrid-*.local
#     mDNS, *.internal hints) for an on-prem product on a trusted LAN/loopback; no external endpoint.
#   S2871 (sort without comparator) — every flagged call sorts a STRING collection (Object.keys,
#     Set<string>, string[]) where default lexicographic order is correct; no numeric sort is flagged.
#   S1313 (hardcoded IP) — test/support/register-alias.mjs only: the test-fixture fleet topology
#     (private 192.168.x LAN) seeding OFFGRID_FLEET_HOST_MAP for display-host tests. Test glue.