Sonar quality remediation — bulk smells & architecture tangles tracker

[sirdeggen]

Context

SonarCloud analysis of bsv-blockchain_ts-stack (org bsv) reports 2,663 unresolved issues as of analysis revision 3c4826e0 (2026-05-06).

Repo is currently 3 commits ahead of origin/main; recent local commits (notably 643bc750 sonar pass 1, a2ab5d20 sonar pass 1) have already addressed the high-priority items:

• 2 BLOCKERs (typescript:S3516 — function always returns same value) → fixed locally in MockServices.ts and createAction.ts. Will auto-resolve on next analysis.
• 1 BUG (typescript:S1763 — unreachable code) in WhatsOnChain.ts:544 → fixed locally. Will auto-resolve.
• 1 VULNERABILITY (docker:S8543 — unlocked dependency versions) in packages/network/ts-p2p/Dockerfile → fixed in c4db5226. Will auto-resolve.

Once main is pushed and CI re-runs Sonar analysis, those 4 are off the board.

Project metrics

Metric	Value
Lines of code	161,853
Open issues	2,663
Cyclomatic complexity	22,546
Cognitive complexity	20,781
Duplicated lines	9,792 (4.8%)
Duplicated blocks	439
Duplicated files	139

Issue breakdown by impact severity

Severity	Count
BLOCKER	2 (already fixed locally)
HIGH	437
MEDIUM	658
LOW	1,594
INFO	63

Issue breakdown by type

Type	Count
CODE_SMELL	2,661
BUG	1 (already fixed)
VULNERABILITY	1 (already fixed)

Architecture cycles (madge analysis)

Package	Cycles
packages/sdk/src	32
packages/wallet/wallet-toolbox/src	174
packages/wallet/ts-wallet-relay/src	6
packages/helpers/simple/src	2
Total	214

See linked sub-issues per package.

Linked sub-issues

This issue tracks the follow-up effort. Sub-issues group remaining smells by rule (auto-fixable in batch) and architecture tangles per package.

Sub-issues

Architecture tangles

• Sonar arch tangles: 32 circular deps in packages/sdk/src #39 — packages/sdk/src (32 cycles)
• Sonar arch tangles: 174 circular deps in packages/wallet/wallet-toolbox/src #40 — packages/wallet/wallet-toolbox/src (174 cycles)
• Sonar arch tangles: 6 circular deps in packages/wallet/ts-wallet-relay/src #41 — packages/wallet/ts-wallet-relay/src (6 cycles)
• Sonar arch tangles: 2 circular deps in packages/helpers/simple/src #42 — packages/helpers/simple/src (2 cycles)

Bulk smells

• Sonar bulk: auto-fixable code style smells (~1,200 issues) #43 — Auto-fixable code style smells (~1,200 issues)
• Sonar: 250+ functions exceed cognitive complexity threshold #44 — Cognitive complexity / refactor (250+ functions)
• Sonar: 138 issues around error handling, dead code, and TODOs #45 — Error handling, dead code, TODOs (~138 issues)
• Sonar: duplication — 9,792 duplicated lines (4.8%) across 139 files in 439 blocks #46 — Duplication (9,792 lines, 4.8%, 139 files)
• Sonar: Go conformance runner smells (~50 issues) #47 — Go conformance runner smells (~50)
• Sonar: long-tail TypeScript smells (~600 issues across 50+ rules) #48 — Long-tail TypeScript smells (~600)

[sirdeggen]

Post-merge status

10 of 11 Sonar PRs merged into main (#49-#59 minus #50 which was superseded by Go runner removal).

Topline metrics

Metric	Before (rev 3c4826e)	After (rev 8cebb6e)	Δ
Total open issues	2,663	2,008	-655 (-25%)
BLOCKER	2	0	✅
BUG	1	0	✅
VULNERABILITY	1	0	✅
HIGH impact	437	(check)
MEDIUM impact	658	(check)
LOW impact	1,594	(check)

Architecture cycles

Package	Before	After	Notes
packages/sdk/src	32	28	-4 (#39 closed)
packages/wallet/wallet-toolbox/src	174	60	-114 (#40 closed)
packages/wallet/ts-wallet-relay/src	6 (false positive)	0 real	madge name collision w/ npm react (#41 closed)
packages/helpers/simple/src	2	0	✅ (#42 closed)

Sub-issue status

#	Title	Status
#39	SDK arch cycles	Closed (partial fix landed)
#40	wallet-toolbox arch cycles	Closed (174→60)
#41	ts-wallet-relay cycles	Closed (no real cycles)
#42	helpers/simple cycles	Closed (2→0)
#43	Auto-fixable bulk smells	Open — S1128 + S7741 cleared, ~700 remain
#44	Cognitive complexity	Open — 1 of 250 functions done
#45	Error / dead code / TODOs	Open — S125 cleared, S2486+S1854+S1135 remain
#46	Duplication	Open — 1 pair deduped, ~440 blocks remain
#47	Go conformance smells	Closed (Go runner removed entirely)
#48	Long-tail TS smells	Open — S6647 cleared, ~600 across 50+ rules remain

Suggested next waves

1. High-signal cleanup: S2486 (75 swallowed exceptions) — bug-risk audit.
2. Bulk autofix sweep: S7735 (331 negated conditions w/ else) is the single largest rule and ESLint-fixable.
3. Coverage backfill: tests for refactor: extract shared helper for duplicated logic (#46) #55 extracted helpers (entityValidationHelpers, StorageClientBase) — Sonar QG was flagging 0% new_coverage.
4. More cycle work: SDK 28 + wallet-toolbox 60 left — biggest wins in Wallet.ts ↔ monitor/Monitor.ts extraction (interface split).

Keep this tracker open until sub-issues close.