chore(lint): add eslint-plugin-sonarjs (core) — Sonar-grade rules in normal lint, free + local

Brings Sonar's bug/smell detection into ESLint so it runs everywhere — including PRO — with
zero cloud cost and no leak (a private SonarCloud project is paid-by-LOC; core stays on free
public Automatic Analysis, pro is scanned locally by these rules).

- extends plugin:sonarjs/recommended-legacy; most rules at the recommended `error` (forward
  guard on new code). no-duplicate-string OFF (fights RN style literals); five already-tripped
  legacy rules at `warn` with a burn-down + ratchet plan (GAPS_BACKLOG). ESLint v8 has no
  native suppression baseline, hence warn-then-ratchet.
- test override: no-identical-functions + cognitive-complexity off for tests (duplicate
  arrange/act is fine); real-bug rules stay ON for tests.

Real bugs the plugin caught on day one and we FIXED (not warned):
- openAICompatibleProvider.test.ts: `expect(....length >= 0).toBe(true)` tautology (always true)
  → assert the terminal outcome (onComplete fired, no abort).
- streamingStateMachine.test.ts: dead `releasers` collection (declared+reset, never used) → removed.
- pro/ui/McpServerModal.tsx: `borderRadius: open ? 8 : 8` no-op ternary → fixed in the pro repo
  (branch fix/sonarjs-redundant-ternary; pointer bump via pro's own PR).

Also removes the redundant SonarCloud CI job: core uses Automatic Analysis + Codecov (a CI scan
would only duplicate Codecov's coverage). sonar-project.properties already points at the off-grid-ai
org for Automatic Analysis.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: alichherawalla

.eslintrc.js

@@ -1,10 +1,18 @@
 module.exports = {
   root: true,
-  extends: '@react-native',
+  extends: [
+    '@react-native',
+    // SonarJS: Sonar-grade bug/smell detection in normal lint — free, local, and it covers
+    // PRO too (pro has no cloud Sonar project; a private cloud project is paid-by-LOC). Most
+    // rules stay at `error` (recommended default) as a forward guard; the handful already
+    // tripped on legacy code are `warn` below with a logged burn-down (GAPS_BACKLOG).
+    'plugin:sonarjs/recommended-legacy',
+  ],
   plugins: [
     'react-native',
     'react',
     'react-hooks',
+    'sonarjs',
   ],
   env: {
     jest: true,
@@ -43,6 +51,20 @@ module.exports = {
     'react-native/no-color-literals': 'error',
     'react-native/no-raw-text': 'error',
     'react-native/no-single-element-style-arrays': 'error',
+
+    // SonarJS — every rule stays at the recommended `error` (a real forward guard on new code)
+    // EXCEPT the two handled here:
+    //  - no-duplicate-string OFF: it fights RN styling — 'space-between'/'center'/'row' and color
+    //    literals repeat by design across StyleSheet objects; a constant per style value is noise,
+    //    not clarity. The one low-value SonarJS rule for this codebase.
+    //  - the rest are `warn` (already tripped on legacy core; burn-down in docs/GAPS_BACKLOG.md,
+    //    ratchet each back to `error` as its count hits zero).
+    'sonarjs/no-duplicate-string': 'off',
+    'sonarjs/prefer-single-boolean-return': 'warn',
+    'sonarjs/no-nested-template-literals': 'warn',
+    'sonarjs/no-collapsible-if': 'warn',
+    'sonarjs/prefer-immediate-return': 'warn',
+    'sonarjs/no-duplicated-branches': 'warn',
   },
   overrides: [
     {
@@ -56,6 +78,11 @@ module.exports = {
         'react-native/no-inline-styles': 'off',
         'react-native/no-raw-text': 'off',
         'react-native/no-color-literals': 'off',
+        // Duplicate test bodies (identical arrange/act across cases) are acceptable and clearer
+        // than over-DRYing tests; the real-bug SonarJS rules (mischeck, unused-collection, etc.)
+        // stay ON for tests — they caught a tautology assertion + a dead collection here.
+        'sonarjs/no-identical-functions': 'off',
+        'sonarjs/cognitive-complexity': 'off',
       },
     },
   ],

.github/workflows/ci.yml

@@ -195,42 +195,7 @@ jobs:
       - name: Build Android Release
         run: cd android && ./gradlew assembleRelease
 
-  sonar:
-    # SonarCloud CI scan for CORE ONLY (org off-grid-ai, project off-grid-ai_off-grid-ai-mobile).
-    # It reads the code and posts findings back to the PR (a check status + a summary comment via
-    # the SonarCloud GitHub App) — it never pushes code.
-    #
-    # PRO IS DELIBERATELY NOT SCANNED HERE. This is a PUBLIC project, and pro/ is private paid
-    # source. Two guardrails keep it out: (1) we do NOT check out the pro submodule in this job
-    # (submodules: false), so pro/ is an empty gitlink with nothing to scan; (2) pro is not in
-    # sonar.sources. Pro gets its own PRIVATE Sonar project in the pro repo — never here.
-    # Requires Automatic Analysis to be OFF (it is) + the SONAR_TOKEN secret + the GitHub App.
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
-    env:
-      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-
-    steps:
-      - name: Checkout code (core only — NO pro submodule)
-        uses: actions/checkout@v4
-        with:
-          submodules: false # never pull private pro/ into this public project
-          fetch-depth: 0 # Sonar needs full history for new-code / blame attribution
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Generate JS coverage (core only — pro not checked out, so excluded)
-        run: npx jest --coverage --forceExit
-
-      - name: SonarCloud scan
-        if: ${{ env.SONAR_TOKEN != '' }}
-        uses: SonarSource/sonarcloud-github-action@master
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  # NOTE: SonarCloud runs via Automatic Analysis (SonarCloud-side, on the public core project) —
+  # no CI job. A CI scan would only add coverage import, which Codecov (in the `test` job) already
+  # does, so it'd be redundant complexity. Pro is scanned locally by eslint-plugin-sonarjs (free,
+  # private, no leak). See docs/GAPS_BACKLOG.md.

__tests__/integration/audio/streamingStateMachine.test.ts

@@ -20,7 +20,6 @@ jest.mock('@offgrid/core/utils/logger', () => ({
 type SpeakMode = 'resolve' | 'hang' | 'throw';
 let speakMode: SpeakMode = 'resolve';
 let enginePhase = 'ready';
-const releasers: Array<() => void> = [];
 const mockEngine = {
   speak: jest.fn(() => {
     if (speakMode === 'throw') return Promise.reject(new Error('std::exception'));
@@ -68,7 +67,6 @@ beforeEach(async () => {
   speakMode = 'resolve';
   enginePhase = 'ready';
   mockCanLoad.mockReturnValue(false);
-  releasers.length = 0;
   // clearAllMocks resets call history but NOT implementations — restore the
   // speakMode-driven impl so a prior test's mockImplementation can't leak in.
   mockEngine.speak.mockImplementation(() => {

__tests__/unit/services/providers/openAICompatibleProvider.test.ts

@@ -443,8 +443,11 @@ describe('OpenAICompatibleProvider', () => {
       // Stop generation (should abort)
       await provider.stopGeneration();
 
-      // Generation should have completed without error
-      expect(wasAborted || onComplete.mock.calls.length >= 0).toBe(true);
+      // Generation completed (fast) before the stop → onComplete fired and the abort never had to
+      // trigger. (The prior assertion `onComplete.mock.calls.length >= 0` was a tautology — always
+      // true — so it proved nothing; assert the real terminal outcome instead.)
+      expect(onComplete).toHaveBeenCalled();
+      expect(wasAborted).toBe(false);
     });
   });
 

docs/GAPS_BACKLOG.md

@@ -15,25 +15,68 @@ Verdict legend:
 
 Added dependency-cruiser as the STANDING GATE for the architectural boundaries we kept
 re-establishing by hand (`.dependency-cruiser.js`; `npm run depcruise`; CI `architecture`
-job + pre-push). Rules are at `error`; the existing debt is captured in
-`.dependency-cruiser-known-violations.json` (68 violations) so the gate PASSES on current
+job + pre-push). AGGRESSIVE ruleset, all at `error`; existing debt captured in
+`.dependency-cruiser-known-violations.json` (66 violations) so the gate PASSES on current
 debt but FAILS on anything NEW. This is the honest register of that baselined debt - burn it
 down, never regenerate the baseline to hide a new violation.
 
 | Rule | Count | Verdict | Note |
 |---|---|---|---|
 | no-circular | 61 | fix-the-guard (own PR) | Mostly cycles routed through barrel `index.ts` files (`services/index`, `stores/index`) + intra-screen hook cycles (HomeScreen hooks ⇄ useHomeScreen). Break by importing the concrete module, not the barrel, and extracting shared hook state down a layer. Large - dedicated PR(s). |
 | utils-stay-pure | 3 | fix-the-guard | `utils/proPrompt→stores/appStore`, `utils/imageModelIntegrity→services/modelLoadErrors`, `utils/downloadAggregate→stores/downloadStore`. A "pure" util reaching into a store/service - move the impure bit up or the shared data down. |
-| no-backward-layering-utils | 1 | fix-the-guard | `services/loadModelWithOverride→components/CustomAlert`: a service imports a UI component to show an alert. Service should return a decision; the caller renders the alert (SoC §A). |
-| no-orphans (warn) | 3 | instrument-and-revisit | `screens/ChatScreen/toolUsage.ts`, `config/revenueCatKeys.ts`, `bootstrap/proStub.js` - grep-verify each is truly unreferenced (proStub is likely a pro-gating shell) before delete. |
+| no-backward-layering-core | 1 | fix-the-guard | `services/loadModelWithOverride→components/CustomAlert`: a service imports a UI component to show an alert. Service should return a decision; the caller renders the alert (SoC §A). |
+| components-are-leaf-ui | 1 | fix-the-guard | `components/models/VoiceModelsSheet→screens/ModelsScreen/VoiceModelsUpsell`: a reusable component imports a screen. Move VoiceModelsUpsell into components/ (or pass it as a prop). |
 
-Engine-DIP violations found by the gate on day one (screens importing concrete `litert`)
-were FIXED in this PR, not baselined (see the Engine DIP section) - the gate proving its value.
+Resolved by the gate on day one (NOT baselined):
+- Engine-DIP: screens importing concrete `litert` → routed through services/engines (see Engine DIP section).
+- Dead code: `screens/ChatScreen/toolUsage.ts` (shouldUseToolsForMessage, zero prod callers) deleted with its test.
+- Phantom-dep false positives excluded (not debt): `whisper.rn` (declared; `.rn` defeats the resolver),
+  `@offgrid/pro` (private open-core submodule wired via metro haste through the one bootstrap loader).
+
+Aggressive rules also active with ZERO current violations (pure forward-guards): not-to-test-from-prod,
+not-to-dev-dep, no-phantom-deps, no-deprecated-core (warn).
 
 NOTE: the gate catches the IMPORT-edge half of the DIP rule. The VALUE-branch half
 (`model.engine === 'litert'` comparing a store value) is not an edge - guard it with an
 ESLint `no-restricted-syntax` rule (follow-up).
 
+## SonarJS in ESLint - burn-down - 2026-07-10 (PR #510)
+
+Added `eslint-plugin-sonarjs` (recommended-legacy) so Sonar-grade bug/smell rules run in normal
+lint - FREE, LOCAL, and it covers PRO too (pro has no cloud Sonar project; a private cloud project
+is paid-by-LOC). Most rules are at the recommended `error` (forward guard on new code). Six rules
+already tripped on legacy core are relaxed to `warn` - ratchet each back to `error` as its count
+hits zero. ESLint v8 has no native suppression baseline, hence warn-then-ratchet rather than a
+baseline file.
+
+Real bugs SonarJS caught immediately and we FIXED (not warned):
+- `openAICompatibleProvider.test.ts`: `expect(... .length >= 0).toBe(true)` - a tautology assertion
+  (always true, could never fail). Rewrote to assert the terminal outcome (onComplete fired, no abort).
+- `streamingStateMachine.test.ts`: `releasers` - a collection declared + reset but never pushed/read
+  (dead). Removed.
+- `pro/ui/McpServerModal.tsx`: `borderRadius: open ? 8 : 8` - redundant ternary (same value both
+  branches). Fixed to `borderRadius: 8`. (Fixed in the pro submodule - the "SonarJS catches pro" win.)
+
+`no-duplicate-string` is OFF (not warn): it fights RN styling — style literals ('space-between',
+'center', color values) repeat by design across StyleSheet objects; a constant per value is noise.
+Also unblocks pro's `--max-warnings=0` pre-commit hook.
+
+Warn-level burn-down (core src, ratchet to error as each hits zero):
+| Rule | Count |
+|---|---|
+| sonarjs/prefer-single-boolean-return | 9 |
+| sonarjs/no-nested-template-literals | 6 |
+| sonarjs/no-collapsible-if | 2 |
+| sonarjs/prefer-immediate-return | 1 |
+| sonarjs/no-duplicated-branches | 1 |
+
+Test override: `no-identical-functions` + `cognitive-complexity` are OFF for test files (duplicate
+arrange/act across cases is clearer than over-DRYed tests); the real-bug rules stay ON for tests.
+
+SonarCloud: CORE uses Automatic Analysis (public project, free) + Codecov for coverage - NO CI
+scan job (it would only duplicate Codecov's coverage). PRO is covered by the SonarJS ESLint rules
+above, locally - never sent to any cloud project.
+
 ---
 
 ## Dead-code recon - 2026-07-06

package-lock.json

@@ -99,6 +99,7 @@
     "dependency-cruiser": "^18.0.0",
     "eslint": "^8.19.0",
     "eslint-plugin-react-compiler": "^19.1.0-rc.2",
+    "eslint-plugin-sonarjs": "^1.0.4",
     "husky": "^9.1.7",
     "jest": "^29.6.3",
     "lint-staged": "^15.5.2",