[refactor] 清除 SonarCloud code smells（批次）

.infisical.json

@@ -0,0 +1,5 @@
+{
+  "workspaceId": "3dbddeb7-9e1b-444c-be5a-1dedc702351c",
+  "defaultEnvironment": "dev",
+  "gitBranchToEnvironmentMapping": null
+}

sonar-project.properties

@@ -1,3 +1,4 @@
 sonar.projectKey=pathorsAI_internal
-# 排除產生 / 第三方腳手架的檔案（shadcn UI、drizzle introspect schema、wrangler 型別）
-sonar.exclusions=src/components/ui/**,src/db/schema.ts,cloudflare-env.d.ts,.open-next/**,.next/**,.next-prod/**
+# 排除產生 / 第三方腳手架的檔案（shadcn UI、drizzle introspect schema、wrangler 型別、
+# 已套用且不可改的 forward-only SQL migrations）
+sonar.exclusions=src/components/ui/**,src/db/schema.ts,cloudflare-env.d.ts,.open-next/**,.next/**,.next-prod/**,migrations/**

src/app/(dashboard)/activity/page.tsx

@@ -90,7 +90,7 @@ export default async function ActivityPage() {
                   </TableCell>
                   <TableCell className="whitespace-nowrap">
                     {entityLabel[r.entityType] ?? r.entityType}
-                    {r.entityId != null ? ` #${r.entityId}` : ""}
+                    {r.entityId == null ? "" : ` #${r.entityId}`}
                   </TableCell>
                   <TableCell className="max-w-[28ch] truncate text-muted-foreground" title={r.summary ?? ""}>
                     {r.summary ?? "—"}

src/app/(dashboard)/contracts/page.tsx

@@ -54,6 +54,14 @@ function CollectionCell({
   // 進度條填色依收款狀態:溢收→支出色,已收齊→收入色,進行中→主色;無金額時留一條空軌維持等高。
   const overCollected = total != null && received > total;
   const fullyCollected = total != null && received >= total;
+  let barColor = "bg-primary";
+  if (overCollected) barColor = "bg-expense";
+  else if (fullyCollected) barColor = "bg-income";
+  let remainingLabel: string;
+  if (remaining == null) remainingLabel = "—";
+  else if (remaining > 0) remainingLabel = `未收 ${formatCurrency(remaining, currency)}`;
+  else if (remaining < 0) remainingLabel = `溢收 ${formatCurrency(-remaining, currency)}`;
+  else remainingLabel = "已收齊";
   return (
     <div className="min-w-[170px] space-y-1">
       <div className="flex items-baseline justify-between gap-2 text-sm tabular-nums">
@@ -65,28 +73,13 @@ function CollectionCell({
       <div className="h-1.5 w-full overflow-hidden rounded-full bg-muted">
         {pct != null && (
           <div
-            className={cn(
-              "h-full rounded-full",
-              overCollected
-                ? "bg-expense"
-                : fullyCollected
-                  ? "bg-income"
-                  : "bg-primary",
-            )}
+            className={cn("h-full rounded-full", barColor)}
             style={{ width: `${pct}%` }}
           />
         )}
       </div>
       <div className="flex items-center justify-between gap-2 text-xs text-muted-foreground tabular-nums">
-        <span>
-          {remaining == null
-            ? "—"
-            : remaining > 0
-              ? `未收 ${formatCurrency(remaining, currency)}`
-              : remaining < 0
-                ? `溢收 ${formatCurrency(-remaining, currency)}`
-                : "已收齊"}
-        </span>
+        <span>{remainingLabel}</span>
         {cost > 0 && <span>成本 {formatCurrency(cost, currency)}</span>}
       </div>
     </div>

src/app/(dashboard)/layout.tsx

@@ -9,9 +9,9 @@ import {
 
 export default function DashboardLayout({
   children,
-}: {
+}: Readonly<{
   children: React.ReactNode;
-}) {
+}>) {
   return (
     <SidebarProvider>
       <AppSidebar />

src/app/(dashboard)/reconciliation/new-reconciliation-dialog.tsx

@@ -30,9 +30,9 @@ const initial: ActionState = { ok: false };
 
 export function NewReconciliationDialog({
   accounts,
-}: {
+}: Readonly<{
   accounts: { id: number; name: string; currency: string }[];
-}) {
+}>) {
   const [open, setOpen] = useState(false);
   const [state, action, pending] = useActionState(createReconciliation, initial);
   const today = new Date().toISOString().slice(0, 10);

src/app/(dashboard)/subscriptions/page.tsx

@@ -48,7 +48,7 @@ const periodStatusVariant: Record<string, "default" | "secondary" | "destructive
   upcoming: "outline",
 };
 
-function PeriodScheduleTable({ schedule }: { schedule: SubscriptionSchedule | null }) {
+function PeriodScheduleTable({ schedule }: Readonly<{ schedule: SubscriptionSchedule | null }>) {
   if (!schedule || schedule.periods.length === 0) {
     return <p className="mt-6 text-sm text-muted-foreground">尚無收款期別</p>;
   }
@@ -91,8 +91,7 @@ function PeriodScheduleTable({ schedule }: { schedule: SubscriptionSchedule | nu
         </Table>
       </div>
       <p className="mt-2 text-right text-sm text-muted-foreground">
-        未收合計：
-        <span className="font-medium text-foreground tabular-nums">
+        未收合計：<span className="font-medium text-foreground tabular-nums">
           {formatCurrency(schedule.totalOutstanding, schedule.currency)}
         </span>
       </p>

src/app/(dashboard)/transactions/page.tsx

@@ -183,15 +183,15 @@ const PAGE_SIZE = 50;
 
 export default async function TransactionsPage({
   searchParams,
-}: {
+}: Readonly<{
   searchParams: Promise<{
     book?: string;
     category?: string;
     account?: string;
     period?: string;
     page?: string;
   }>;
-}) {
+}>) {
   const { orgId } = await requireOrg();
   const { book, category, account, period, page: pageParam } = await searchParams;
   const active = (["internal", "external", "both"].includes(book ?? "") ? book : undefined) as

src/app/onboarding/page.tsx

@@ -21,7 +21,7 @@ function slugify(name: string) {
     .toLowerCase()
     .trim()
     .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "");
+    .replace(/^-|-$/g, "");
 }
 
 type Invite = {
@@ -82,7 +82,8 @@ export default function OnboardingPage() {
   async function onCreate(e: React.FormEvent<HTMLFormElement>) {
     e.preventDefault();
     const form = new FormData(e.currentTarget);
-    const name = String(form.get("name")).trim();
+    const nameField = form.get("name");
+    const name = (typeof nameField === "string" ? nameField : "").trim();
     const slug = slugify(name) || `org-${Date.now()}`;
     setCreating(true);
     const { data: org, error } = await authClient.organization.create({ name, slug });

src/components/book-badge.tsx

@@ -6,7 +6,7 @@ const map: Record<string, { label: string; variant: "default" | "secondary" | "o
   both: { label: "內外", variant: "outline" },
 };
 
-export function BookBadge({ book }: { book: string }) {
+export function BookBadge({ book }: Readonly<{ book: string }>) {
   const cfg = map[book] ?? { label: book, variant: "outline" as const };
   return <Badge variant={cfg.variant}>{cfg.label}</Badge>;
 }

src/components/combobox.tsx

@@ -122,6 +122,7 @@ export function Combobox({
               <div
                 key={item}
                 role="option"
+                tabIndex={-1}
                 aria-selected={idx === activeIndex}
                 className={cn(
                   "cursor-default rounded-sm px-2 py-1.5 outline-none",

src/components/logo.tsx

@@ -1,7 +1,7 @@
 import { cn } from "@/lib/utils";
 
 /** Pathors brand mark — a minimal blue waypoint route. */
-export function LogoMark({ className }: { className?: string }) {
+export function LogoMark({ className }: Readonly<{ className?: string }>) {
   return (
     <svg
       viewBox="0 0 32 32"
@@ -23,7 +23,7 @@ export function LogoMark({ className }: { className?: string }) {
 }
 
 /** Brand mark + app name, used in the sidebar header. */
-export function Logo({ className }: { className?: string }) {
+export function Logo({ className }: Readonly<{ className?: string }>) {
   return (
     <div className={cn("flex items-center gap-2", className)}>
       <LogoMark className="size-6" />

src/components/page-header.tsx

@@ -2,11 +2,11 @@ export function PageHeader({
   title,
   description,
   children,
-}: {
+}: Readonly<{
   title: React.ReactNode;
   description?: string;
   children?: React.ReactNode;
-}) {
+}>) {
   return (
     <div className="flex flex-wrap items-end justify-between gap-4">
       <div className="space-y-1">

src/components/row-dialog.tsx

@@ -18,6 +18,11 @@
 } from "@/components/ui/sheet";
 
 const CloseCtx = React.createContext<() => void>(() => {});
+
+// 點到列裡的按鈕 / 連結 / 輸入等互動元素 → 交給它們自己處理，不開啟編輯
+function hitInteractive(target: EventTarget | null) {
+  return Boolean((target as HTMLElement | null)?.closest("button, a, input, label"));
+}
 /** 在 RowDialog 內的表單可呼叫此 hook，存檔成功後關閉對話框 */
 export function useRowDialogClose() {
   return React.useContext(CloseCtx);
@@ -42,12 +47,7 @@
   const [open, setOpen] = React.useState(false);
   const close = React.useCallback(() => setOpen(false), []);
 
-  // 點到列裡的按鈕 / 連結 / 輸入等互動元素 → 交給它們自己處理，不開啟編輯
-  function hitInteractive(target: EventTarget | null) {
-    return Boolean((target as HTMLElement | null)?.closest("button, a, input, label"));
-  }
-
   function shouldOpen(target: EventTarget | null) {
     // 有對話框正開著 / 正在關閉時（例如點灰色背景關閉發放薪資 dialog，
     // 那個點擊會「穿透」到下面的列）→ 不要開啟這一列的編輯
     if (

src/components/table-skeleton.tsx

@@ -6,17 +6,19 @@ export function TableSkeleton({
   rows = 8,
   cols = 5,
 }: Readonly<{ rows?: number; cols?: number }>) {
+  const rowKeys = Array.from({ length: rows }, (_, i) => `row-${i}`);
+  const colKeys = Array.from({ length: cols }, (_, i) => `col-${i}`);
   return (
     <div className="overflow-hidden rounded-xl border">
       <div className="border-b px-4 py-2.5">
         <Skeleton className="h-4 w-24" />
       </div>
       <div className="divide-y">
-        {Array.from({ length: rows }).map((_, r) => (
-          <div key={r} className="flex items-center gap-4 px-4 py-3.5">
-            {Array.from({ length: cols }).map((_, c) => (
+        {rowKeys.map((rowKey) => (
+          <div key={rowKey} className="flex items-center gap-4 px-4 py-3.5">
+            {colKeys.map((colKey, c) => (
               <Skeleton
-                key={c}
+                key={colKey}
                 className={cn(
                   "h-4",
                   c === 0 && "w-24",

src/db/queries.ts

@@ -938,7 +938,7 @@ export function computeSubscriptionSchedule(
   // 有應收覆寫的期別也一律納入。
   for (const p of explicitPeriods) starts.add(p.periodStart);
 
-  const sorted = [...starts].sort();
+  const sorted = [...starts].sort((a, b) => a.localeCompare(b));
   let totalOutstanding = 0;
   const periods: SubscriptionPeriod[] = sorted.map((periodStart) => {
     const override = overrideByStart.get(periodStart);

src/hooks/use-mobile.ts

@@ -6,12 +6,12 @@ export function useIsMobile() {
   const [isMobile, setIsMobile] = React.useState<boolean | undefined>(undefined)
 
   React.useEffect(() => {
-    const mql = window.matchMedia(`(max-width: ${MOBILE_BREAKPOINT - 1}px)`)
+    const mql = globalThis.matchMedia(`(max-width: ${MOBILE_BREAKPOINT - 1}px)`)
     const onChange = () => {
-      setIsMobile(window.innerWidth < MOBILE_BREAKPOINT)
+      setIsMobile(globalThis.innerWidth < MOBILE_BREAKPOINT)
     }
     mql.addEventListener("change", onChange)
-    setIsMobile(window.innerWidth < MOBILE_BREAKPOINT)
+    setIsMobile(globalThis.innerWidth < MOBILE_BREAKPOINT)
     return () => mql.removeEventListener("change", onChange)
   }, [])
 

src/lib/mcp/handler.ts

@@ -81,6 +81,48 @@ function categoryTag(a: ToolAnnotations): string {
   return "[write]";
 }
 
+async function handleToolCall(
+  id: JsonRpcId,
+  params: Record<string, unknown> | undefined,
+  ctx: ToolContext,
+): Promise<object> {
+  const name = params?.name as string | undefined;
+  const args = (params?.arguments as Record<string, unknown>) ?? {};
+  const tool = name ? tools[name] : undefined;
+  if (!tool) {
+    return ok(id, {
+      content: [{ type: "text", text: `Unknown tool: ${name}` }],
+      isError: true,
+    });
+  }
+  try {
+    const out = await tool.execute(args, ctx);
+    // Best-effort audit log for MCP writes (never affects the response).
+    const audit = name ? deriveMcpAudit(name, out) : null;
+    if (audit) {
+      try {
+        const orgId = await resolveOrg(args, ctx);
+        await logMcp(orgId, ctx.userId, audit.action, audit.entityType, audit.entityId, name);
+      } catch {
+        // ignore audit failures
+      }
+    }
+    return ok(id, {
+      content: [{ type: "text", text: JSON.stringify(out, null, 2) }],
+    });
+  } catch (err) {
+    return ok(id, {
+      content: [
+        {
+          type: "text",
+          text: `Error: ${err instanceof Error ? err.message : String(err)}`,
+        },
+      ],
+      isError: true,
+    });
+  }
+}
+
 async function handleMessage(
   msg: JsonRpcMessage,
   ctx: ToolContext,
@@ -118,43 +160,8 @@ async function handleMessage(
         }),
       });
 
-    case "tools/call": {
-      const name = msg.params?.name as string | undefined;
-      const args = (msg.params?.arguments as Record<string, unknown>) ?? {};
-      const tool = name ? tools[name] : undefined;
-      if (!tool) {
-        return ok(id, {
-          content: [{ type: "text", text: `Unknown tool: ${name}` }],
-          isError: true,
-        });
-      }
-      try {
-        const out = await tool.execute(args, ctx);
-        // Best-effort audit log for MCP writes (never affects the response).
-        const audit = name ? deriveMcpAudit(name, out) : null;
-        if (audit) {
-          try {
-            const orgId = await resolveOrg(args, ctx);
-            await logMcp(orgId, ctx.userId, audit.action, audit.entityType, audit.entityId, name);
-          } catch {
-            // ignore audit failures
-          }
-        }
-        return ok(id, {
-          content: [{ type: "text", text: JSON.stringify(out, null, 2) }],
-        });
-      } catch (err) {
-        return ok(id, {
-          content: [
-            {
-              type: "text",
-              text: `Error: ${err instanceof Error ? err.message : String(err)}`,
-            },
-          ],
-          isError: true,
-        });
-      }
-    }
+    case "tools/call":
+      return handleToolCall(id, msg.params, ctx);
 
     default:
       if (isNotification) return null;