scripts/verify_ubuntu_compatibility.py (1)

187-237: verify_security_logic() should return a value + can be split to reduce complexity.
Consider returning final_score (useful for tests/automation) and extracting “compute score/status”, “persist history”, and “apply fixes prompt” into helpers (also resolves the Sonar complexity warning).

cortex/health/checks/disk.py (1)

19-60: Consider extracting the repeated string literal.

The string "Disk Usage" appears 4 times. While this doesn't impact functionality, extracting it as a class constant would improve maintainability.

Apply this diff if you'd like to reduce duplication:

 class DiskCheck(HealthCheck):
     """Check root filesystem disk usage."""
+    CHECK_NAME = "Disk Usage"

     def run(self) -> CheckResult:
         """
         Calculate disk usage percentage.
         
         Returns:
             CheckResult based on usage thresholds.
         """
         try:
             # Use _ for unused variable (free space)
             total, used, _ = shutil.disk_usage("/")
             usage_percent = (used / total) * 100
         except Exception as e:
             return CheckResult(
-                name="Disk Usage",
+                name=self.CHECK_NAME,
                 category="disk",
                 score=0,
                 status="CRITICAL",
                 details=f"Check failed: {e}",
                 recommendation="Check disk mounts and permissions",
                 weight=0.20
             )
         
         # Explicit early returns to avoid static analysis confusion
         if usage_percent > 90:
             return CheckResult(
-                name="Disk Usage",
+                name=self.CHECK_NAME,
                 category="disk",
                 score=0,
                 status="CRITICAL",
                 details=f"{usage_percent:.1f}% used",
                 recommendation="Clean up disk space immediately",
                 weight=0.20
             )
             
         if usage_percent > 80:
             return CheckResult(
-                name="Disk Usage",
+                name=self.CHECK_NAME,
                 category="disk",
                 score=50,
                 status="WARNING",
                 details=f"{usage_percent:.1f}% used",
                 recommendation="Consider cleaning up disk space",
                 weight=0.20
             )

         return CheckResult(
-            name="Disk Usage",
+            name=self.CHECK_NAME,
             category="disk",
             score=100,
             status="OK",
             details=f"{usage_percent:.1f}% used",
             recommendation=None,
             weight=0.20
         )

Based on static analysis hints.

tests/test_optimizer.py (1)

73-96: Consider asserting the items list for consistency.

The test validates type and size_bytes but doesn't check the items list, unlike the similar LogManager test (line 71). While not critical, adding this assertion would make the test more thorough.

Add this assertion for consistency:

         self.assertIsNotNone(opp)
         self.assertEqual(opp.type, "temp")
         self.assertEqual(opp.size_bytes, 50)
+        self.assertIn("/tmp/tempfile", opp.items)

docs/smart_cleanup_optimizer/implementation_plan.md (1)

16-20: Optional: Adjust list indentation for markdown linter compliance.

Markdownlint expects 2-space indentation for nested list items. While this doesn't affect readability, fixing it would eliminate linter warnings.

Based on static analysis hints.

Apply this diff if you'd like to satisfy the linter:

 ### Core Logic (`cortex/optimizer.py` - NEW)
 - Create `CleanupOptimizer` class.
 - **Components**:
-    - `scan()`: Aggregates stats from:
-        - `PackageManager.get_cleanable_items()`
-        - `LogManager.scan_logs()`
-        - `TempCleaner.scan_temp()`
-    - `clean(safe_mode=True)`: Generates commands and executes them using `InstallationCoordinator`.
-    - `LogManager`:
+  - `scan()`: Aggregates stats from:
+    - `PackageManager.get_cleanable_items()`
+    - `LogManager.scan_logs()`
+    - `TempCleaner.scan_temp()`
+  - `clean(safe_mode=True)`: Generates commands and executes them using `InstallationCoordinator`.
+  - `LogManager`:

cortex/health/checks/security.py (1)

5-66: Consider extracting checks into separate methods for lower complexity.

SonarCloud flags cognitive complexity (19 vs. 15 allowed). While the function is readable, extracting the firewall and SSH checks into separate methods would improve testability and reduce complexity.

Example refactor:

 class SecurityCheck(HealthCheck):
+    def _check_firewall(self) -> Tuple[bool, List[str], List[str]]:
+        """Check UFW firewall status. Returns (is_active, issues, recommendations)."""
+        ufw_active = False
+        issues = []
+        recommendations = []
+        
+        try:
+            res = subprocess.run(
+                ["systemctl", "is-active", "ufw"], 
+                capture_output=True, 
+                text=True,
+                timeout=5
+            )
+            if res.returncode == 0 and res.stdout.strip() == "active":
+                ufw_active = True
+        except subprocess.TimeoutExpired:
+            pass
+        except FileNotFoundError:
+            pass
+        except Exception:
+            pass
+
+        if not ufw_active:
+            issues.append("Firewall Inactive")
+            recommendations.append("Enable UFW Firewall")
+        
+        return ufw_active, issues, recommendations
+    
+    def _check_ssh_root_login(self) -> Tuple[int, List[str], List[str]]:
+        """Check SSH root login config. Returns (score_penalty, issues, recommendations)."""
+        penalty = 0
+        issues = []
+        recommendations = []
+        
+        try:
+            ssh_config = "/etc/ssh/sshd_config"
+            if os.path.exists(ssh_config):
+                with open(ssh_config, 'r') as f:
+                    for line in f:
+                        line = line.strip()
+                        if line.startswith("PermitRootLogin") and "yes" in line.split():
+                            penalty = 50
+                            issues.append("Root SSH Allowed")
+                            recommendations.append("Disable SSH Root Login in sshd_config")
+                            break
+        except PermissionError:
+            pass
+        except Exception:
+            pass
+        
+        return penalty, issues, recommendations
+
     def run(self) -> CheckResult:
         score = 100
         issues = []
         recommendations = []
         
-        # 1. Firewall (UFW) Check
-        ufw_active = False
-        try:
-            # Add timeout to prevent hanging (Fixes Reliability Issue)
-            res = subprocess.run(
-                ["systemctl", "is-active", "ufw"], 
-                capture_output=True, 
-                text=True,
-                timeout=5
-            )
-            # Fix: Use exact match to avoid matching "inactive" which contains "active"
-            if res.returncode == 0 and res.stdout.strip() == "active":
-                ufw_active = True
-        except subprocess.TimeoutExpired:
-            pass # Command timed out, treat as inactive or unavailable
-        except FileNotFoundError:
-            pass # Environment without systemctl (e.g., Docker or non-systemd)
-        except Exception:
-            pass # Generic error protection
-
+        # 1. Firewall check
+        ufw_active, fw_issues, fw_recs = self._check_firewall()
         if not ufw_active:
-            score = 0 # Spec: 0 points if Firewall is inactive
-            issues.append("Firewall Inactive")
-            recommendations.append("Enable UFW Firewall")
-
-        # 2. SSH Root Login Check
-        try:
-            ssh_config = "/etc/ssh/sshd_config"
-            if os.path.exists(ssh_config):
-                with open(ssh_config, 'r') as f:
-                    for line in f:
-                        line = line.strip()
-                        # Check for uncommented PermitRootLogin yes
-                        if line.startswith("PermitRootLogin") and "yes" in line.split():
-                            score -= 50
-                            issues.append("Root SSH Allowed")
-                            recommendations.append("Disable SSH Root Login in sshd_config")
-                            break
-        except PermissionError:
-            pass # Cannot read config, skip check
-        except Exception:
-            pass # Generic error protection
+            score = 0
+        issues.extend(fw_issues)
+        recommendations.extend(fw_recs)
+        
+        # 2. SSH root login check
+        ssh_penalty, ssh_issues, ssh_recs = self._check_ssh_root_login()
+        score -= ssh_penalty
+        issues.extend(ssh_issues)
+        recommendations.extend(ssh_recs)

         status = "OK"
         if score < 50: status = "CRITICAL"
         elif score < 100: status = "WARNING"

         return CheckResult(
             name="Security Posture",
             category="security",
             score=max(0, score),
             status=status,
             details=", ".join(issues) if issues else "Secure",
             recommendation=", ".join(recommendations) if recommendations else None,
             weight=0.35
         )

Based on static analysis hints.

cortex/packages.py (1)

453-520: Consider extracting package-manager-specific logic into separate methods.

The method has high cognitive complexity (36 vs. 15 allowed) due to branching logic for different package managers. Extracting helper methods would improve maintainability.

Example refactor:

+    def _get_apt_cleanable_items(self) -> Dict[str, any]:
+        """Get cleanable items for APT package manager."""
+        opportunities = {
+            "cache_size_bytes": 0,
+            "orphaned_packages": [],
+            "orphaned_size_bytes": 0
+        }
+        
+        # Check apt cache size
+        result = subprocess.run(
+            "du -sb /var/cache/apt/archives 2>/dev/null | cut -f1",
+            shell=True, capture_output=True, text=True
+        )
+        if result.returncode == 0 and result.stdout.strip():
+            opportunities["cache_size_bytes"] = int(result.stdout.strip())
+        
+        # Check for autoremovable packages
+        result = subprocess.run(
+            ["apt-get", "--dry-run", "autoremove"],
+            capture_output=True, text=True, env={"LANG": "C"}
+        )
+        
+        if result.returncode == 0:
+            for line in result.stdout.split('\n'):
+                if line.startswith("Remv"):
+                    parts = line.split()
+                    if len(parts) >= 2:
+                        pkg_name = parts[1]
+                        opportunities["orphaned_packages"].append(pkg_name)
+            
+            if opportunities["orphaned_packages"]:
+                cmd = ["dpkg-query", "-W", "-f=${Installed-Size}\n"] + opportunities["orphaned_packages"]
+                size_res = subprocess.run(cmd, capture_output=True, text=True)
+                if size_res.returncode == 0:
+                    total_kb = sum(int(s) for s in size_res.stdout.split() if s.isdigit())
+                    opportunities["orphaned_size_bytes"] = total_kb * 1024
+        
+        return opportunities
+    
+    def _get_yum_cleanable_items(self) -> Dict[str, any]:
+        """Get cleanable items for YUM/DNF package manager."""
+        opportunities = {
+            "cache_size_bytes": 0,
+            "orphaned_packages": [],
+            "orphaned_size_bytes": 0
+        }
+        
+        pm_cmd = "yum" if self.pm_type == PackageManagerType.YUM else "dnf"
+        cache_dir = "/var/cache/dnf" if self.pm_type == PackageManagerType.DNF else "/var/cache/yum"
+        
+        result = subprocess.run(
+            f"du -sb {cache_dir} 2>/dev/null | cut -f1",
+            shell=True, capture_output=True, text=True
+        )
+        if result.returncode == 0 and result.stdout.strip():
+            opportunities["cache_size_bytes"] = int(result.stdout.strip())
+        
+        return opportunities
+
     def get_cleanable_items(self) -> Dict[str, any]:
         """
         Identify cleanable items managed by the package manager.
         
         Returns:
             Dictionary containing cleanup opportunities (cache size, orphaned packages)
         """
-        opportunities = {
-            "cache_size_bytes": 0,
-            "orphaned_packages": [],
-            "orphaned_size_bytes": 0
-        }
-        
         try:
             if self.pm_type == PackageManagerType.APT:
-                # Check apt cache size
-                result = subprocess.run(
-                    "du -sb /var/cache/apt/archives 2>/dev/null | cut -f1",
-                    shell=True, capture_output=True, text=True
-                )
-                if result.returncode == 0 and result.stdout.strip():
-                    opportunities["cache_size_bytes"] = int(result.stdout.strip())
-                
-                # Check for autoremovable packages
-                # This simulates 'apt-get autoremove' to find orphans
-                result = subprocess.run(
-                    ["apt-get", "--dry-run", "autoremove"],
-                    capture_output=True, text=True, env={"LANG": "C"}
-                )
-                
-                if result.returncode == 0:
-                    for line in result.stdout.split('\n'):
-                        if line.startswith("Remv"):
-                            parts = line.split()
-                            if len(parts) >= 2:
-                                pkg_name = parts[1]
-                                opportunities["orphaned_packages"].append(pkg_name)
-                    
-                    # Estimate size (rough estimate based on installed size)
-                    if opportunities["orphaned_packages"]:
-                        cmd = ["dpkg-query", "-W", "-f=${Installed-Size}\n"] + opportunities["orphaned_packages"]
-                        size_res = subprocess.run(cmd, capture_output=True, text=True)
-                        if size_res.returncode == 0:
-                            total_kb = sum(int(s) for s in size_res.stdout.split() if s.isdigit())
-                            opportunities["orphaned_size_bytes"] = total_kb * 1024
-
+                return self._get_apt_cleanable_items()
             elif self.pm_type in (PackageManagerType.YUM, PackageManagerType.DNF):
-                pm_cmd = "yum" if self.pm_type == PackageManagerType.YUM else "dnf"
-                
-                # Check cache size (requires sudo usually, but we try)
-                # DNF/YUM cache location varies, usually /var/cache/dnf or /var/cache/yum
-                cache_dir = "/var/cache/dnf" if self.pm_type == PackageManagerType.DNF else "/var/cache/yum"
-                result = subprocess.run(
-                    f"du -sb {cache_dir} 2>/dev/null | cut -f1",
-                    shell=True, capture_output=True, text=True
-                )
-                if result.returncode == 0 and result.stdout.strip():
-                    opportunities["cache_size_bytes"] = int(result.stdout.strip())
-                
-                # Check for autoremovable packages
-                cmd = [pm_cmd, "autoremove", "--assumeno"]
-                # Note: dnf autoremove output parsing is complex, skipping precise list for now for safety
-                # We can return a generic command advice
-                
+                return self._get_yum_cleanable_items()
         except Exception:
             pass
-            
-        return opportunities
+        
+        return {
+            "cache_size_bytes": 0,
+            "orphaned_packages": [],
+            "orphaned_size_bytes": 0
+        }

Based on static analysis hints.

cortex/optimizer.py (2)

1-16: Avoid logging.basicConfig() in a library module.
Configuring global logging at import-time can break applications embedding Cortex. Prefer leaving configuration to the CLI entrypoint and keep only logger = logging.getLogger(__name__) here.

---

17-23: Rename CleanupOpportunity.type to avoid shadowing built-in type.
This is minor but reduces confusion in stack traces/debugging and avoids accidental shadowing in local scopes.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

docs/smart_cleanup_optimizer/task.md (1)

23-29: Docs claim --safe default and interactive mode, but CLI implementation has issues.

This section documents --safe as default and interactive mode, but per previous review, the CLI implementation at cortex/cli.py ignores the --safe flag (it's always True regardless) and derives safe_mode solely from not args.force. The documentation should be updated to match the actual implementation, or preferably the CLI should be fixed to properly honor --safe/--force as mutually exclusive flags.

cortex/cli.py (3)

272-288: --safe flag is still ignored; fix indentation on dry-run block.

The safe_mode is derived solely from not args.force, completely ignoring args.safe. This was flagged in a previous review. Additionally, line 287 has inconsistent indentation.

     def _cleanup_run(self, args, optimizer):
-        safe_mode = not args.force
+        safe_mode = getattr(args, "safe_mode", True)
         
         self._print_status("🔍", "Preparing cleanup plan...")
         commands = optimizer.get_cleanup_plan()
         
         if not commands:
             self._print_success("Nothing to clean!")
             return 0
             
         console.print("[bold]Proposed Cleanup Operations:[/bold]")
         for i, cmd in enumerate(commands, 1):
             console.print(f"  {i}. {cmd}")
         
         if getattr(args, 'dry_run', False):
-                console.print("\n[dim](Dry run mode - no changes made)[/dim]")
-                return 0
+            console.print("\n[dim](Dry run mode - no changes made)[/dim]")
+            return 0

---

684-685: Add cleanup command to help table.

The help table lists health but omits the new cleanup command group. Users won't discover this feature from the help output.

     table.add_row("notify", "Manage desktop notifications")
     table.add_row("health", "Check system health score")
+    table.add_row("cleanup", "Scan and reclaim disk space")

---

767-771: --safe/--force flags need to be mutually exclusive with shared destination.

The current setup makes args.safe always True (since default=True + action='store_true'), and the flags aren't mutually exclusive. This was flagged in a previous review.

     run_parser = cleanup_subs.add_parser('run', help='Execute cleanup')
-    run_parser.add_argument('--safe', action='store_true', default=True, help='Run safely (with backups)')
-    run_parser.add_argument('--force', action='store_true', help='Force cleanup (no backups)')
+    mode_group = run_parser.add_mutually_exclusive_group()
+    mode_group.add_argument('--safe', dest='safe_mode', action='store_true', help='Run safely (with backups)')
+    mode_group.add_argument('--force', dest='safe_mode', action='store_false', help='Force cleanup (no backups)')
+    run_parser.set_defaults(safe_mode=True)
     run_parser.add_argument('--yes', '-y', action='store_true', help='Skip confirmation')
     run_parser.add_argument('--dry-run', action='store_true', help='Show proposed changes without executing')

cortex/optimizer.py (4)

81-88: Log scan patterns and cleanup commands are inconsistent.

The scan() method includes *.log.old files, but get_cleanup_commands() doesn't generate commands for them. Also, *.1 and *.2 files are gzipped without age filtering in commands, while scan applies different logic. This was flagged in a previous review.

---

98-148: Temp retention is inconsistent (7 vs 10 days) and find commands are risky.

The scan uses a 7-day cutoff (line 102) but cleanup commands use 10 days (line 145). Also, -atime is unreliable on noatime/relatime mounts, and -type d -empty -delete without -mindepth 1 could delete /tmp itself. This was flagged in a previous review.

---

200-214: backup_dir is created but never used in cleanup plan.

The PR description states safe mode backs up files before deletion, but get_cleanup_plan() generates direct cleanup commands without any backup logic. The backup_dir attribute is initialized but never utilized. This was flagged in a previous review.

---

216-234: Cron installation is fragile and lacks proper error handling.

Several issues with schedule_cleanup():

1. shell=True with crontab -l should use list form
2. No handling for "no crontab for user" case (stderr message, empty stdout)
3. No timeout on subprocess calls
4. Blindly appends to crontab without idempotency markers

This was flagged in a previous review.

cortex/packages.py (3)

476-501: Add return type hint and fix any to Any in parameter.

Per coding guidelines, type hints are required. This helper method modifies the passed dict in-place but has no return type annotation.

-    def _get_apt_cleanable_items(self, opportunities: Dict[str, any]):
+    def _get_apt_cleanable_items(self, opportunities: Dict[str, Any]) -> None:

---

503-508: Add return type hint and fix any to Any.

Same type annotation issue as other helper methods.

-    def _estimate_apt_orphans_size(self, opportunities: Dict[str, any]):
+    def _estimate_apt_orphans_size(self, opportunities: Dict[str, Any]) -> None:

---

510-523: Remove unused pm_cmd variable and unneeded pass; add TODO for missing orphan detection.

pm_cmd is assigned but never used since orphan detection is unimplemented. The pass statement is also redundant. Either implement the orphan detection or document the gap with a TODO.

     def _get_yum_cleanable_items(self, opportunities: Dict[str, Any]) -> None:
-        pm_cmd = "yum" if self.pm_type == PackageManagerType.YUM else "dnf"
-        
         # Check cache size
         cache_dir = "/var/cache/dnf" if self.pm_type == PackageManagerType.DNF else "/var/cache/yum"
         result = subprocess.run(
             f"du -sb {cache_dir} 2>/dev/null | cut -f1",
             shell=True, capture_output=True, text=True
         )
         if result.returncode == 0 and result.stdout.strip():
             opportunities["cache_size_bytes"] = int(result.stdout.strip())
         
-        # Check for autoremovable packages - unimplemented logic
-        pass
+        # TODO: Implement orphan detection for YUM/DNF using `{yum|dnf} autoremove --assumeno`

Based on static analysis hints.

cortex/optimizer.py (3)

24-28: Add type hints to __init__ method.

Per coding guidelines, type hints are required. The __init__ method should have return type annotation.

 class LogManager:
     """Manages log file compression and cleanup."""
-    def __init__(self, log_dir: str = "/var/log"):
+    def __init__(self, log_dir: str = "/var/log") -> None:
         self.log_dir = log_dir

---

90-97: Add type hints to __init__ method.

Per coding guidelines, type hints are required.

 class TempCleaner:
     """Manages temporary file cleanup."""
-    def __init__(self, temp_dirs: List[str] = None):
+    def __init__(self, temp_dirs: Optional[List[str]] = None) -> None:
         if temp_dirs is None:
             self.temp_dirs = ["/tmp", "/var/tmp"]
         else:
             self.temp_dirs = temp_dirs

---

150-165: Add type hints to __init__ and _ensure_backup_dir methods.

Per coding guidelines, type hints are required on all methods.

 class CleanupOptimizer:
     """Orchestrator for system cleanup operations."""
-    def __init__(self):
+    def __init__(self) -> None:
         self.pm = PackageManager()
         self.log_manager = LogManager()
         self.temp_cleaner = TempCleaner()
         self.backup_dir = Path("/var/lib/cortex/backups/cleanup")
         self._ensure_backup_dir()

-    def _ensure_backup_dir(self):
+    def _ensure_backup_dir(self) -> None:
         try:
             self.backup_dir.mkdir(parents=True, exist_ok=True)
         except PermissionError:
             self.backup_dir = Path.home() / ".cortex" / "backups" / "cleanup"
             self.backup_dir.mkdir(parents=True, exist_ok=True)

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

docs/smart_cleanup_optimizer/task.md (1)

33-34: Docs mention --safe verification; please re-validate after fixing CLI flag wiring.
As-is, the CLI --safe/--force handling is inconsistent (see cortex/cli.py review).

cortex/cli.py (2)

629-637: Help output should list the new cleanup command group.
Right now it’s not discoverable from the Rich help table.

@@
     table.add_row("rollback <id>", "Undo installation")
     table.add_row("notify", "Manage desktop notifications")
+    table.add_row("cleanup", "Scan and reclaim disk space safely")

---

176-189: Fix cleanup mode flags: --safe is effectively ignored/misdeclared, and safe_mode isn’t reliably derived.
This matches the earlier review: --safe with store_true + default=True makes the flag meaningless, and _cleanup_run derives safe_mode only from --force.

@@
-    def _cleanup_run(self, args, optimizer):
-        safe_mode = not args.force
+    def _cleanup_run(self, args, optimizer):
+        safe_mode = getattr(args, "safe_mode", True)
@@
-        if getattr(args, 'dry_run', False):
-                console.print("\n[dim](Dry run mode - no changes made)[/dim]")
-                return 0
+        if getattr(args, "dry_run", False):
+            console.print("\n[dim](Dry run mode - no changes made)[/dim]")
+            return 0
@@
-    run_parser = cleanup_subs.add_parser('run', help='Execute cleanup')
-    run_parser.add_argument('--safe', action='store_true', default=True, help='Run safely (with backups)')
-    run_parser.add_argument('--force', action='store_true', help='Force cleanup (no backups)')
+    run_parser = cleanup_subs.add_parser('run', help='Execute cleanup')
+    mode_group = run_parser.add_mutually_exclusive_group()
+    mode_group.add_argument('--safe', dest='safe_mode', action='store_true', help='Run safely (with backups)')
+    mode_group.add_argument('--force', dest='safe_mode', action='store_false', help='Force cleanup (no backups)')
+    run_parser.set_defaults(safe_mode=True)
     run_parser.add_argument('--yes', '-y', action='store_true', help='Skip confirmation')
     run_parser.add_argument('--dry-run', action='store_true', help='Show proposed changes without executing')

Also applies to: 223-266, 715-720

cortex/packages.py (1)

453-474: Fix invalid typing: Dict[str, any] should be Dict[str, Any] (and type the helper params too).
This is currently using the built-in any, not typing.Any.

@@
-import re
+import re
 import subprocess
 import platform
-from typing import List, Dict, Optional, Tuple, Set
+from typing import Any, Dict, List, Optional, Set, Tuple
@@
-    def get_cleanable_items(self) -> Dict[str, any]:
+    def get_cleanable_items(self) -> Dict[str, Any]:
@@
-    def _get_apt_cleanable_items(self, opportunities: Dict[str, any]):
+    def _get_apt_cleanable_items(self, opportunities: Dict[str, Any]) -> None:
@@
-    def _estimate_apt_orphans_size(self, opportunities: Dict[str, any]):
+    def _estimate_apt_orphans_size(self, opportunities: Dict[str, Any]) -> None:
@@
-    def _get_yum_cleanable_items(self, opportunities: Dict[str, any]):
+    def _get_yum_cleanable_items(self, opportunities: Dict[str, Any]) -> None:

Also applies to: 476-509

scripts/automation/cortex-master.sh (1)

51-55: Consider hardening gh | jq pipelines (optional).
Right now failures in gh can be masked unless jq errors; consider set -euo pipefail (and/or explicit error handling) if this script is relied on for automation correctness.

Also applies to: 146-147, 156-157

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro