ShellCheck cleanup: fix baselined warnings in core CLI (follow-up to #6)

[montoyaedu]

Context

Follow-up to #6. When ShellCheck was introduced (#6), the core CLI had ~60 pre-existing findings. To keep #6 scoped to "add the linter", #6 fixed only the real errors (unquoted $@ arg-resplitting in easy, the broken debug() in proxy.sh) and baselined the remaining warnings/info with file-level # shellcheck disable= directives.

This issue tracks burning down that baseline — fixing the findings for real and removing the disable directives.

Baselined findings to fix

Each file has a # shellcheck disable= directive at the top referencing this issue. Fix the findings, then remove the directive.

File	Baselined codes
easy	SC1001, SC1090, SC2046, SC2086, SC2155, SC2164
configure-local-devenv	SC2155
commands/proxy.sh	SC2046, SC2086, SC2124, SC2155, SC2181
easyhome/add_domain	SC2086
easyhome/add_subdomain_http	SC2086
easyhome/add_subdomain_https	SC2086

What the codes mean

• SC2086 — unquoted variable (globbing/word-splitting risk). The bulk of the noise; mostly mechanical quoting.
• SC2155 — local x=$(...) masks the command's exit code. Split into local x; x=$(...).
• SC2046 — unquoted command substitution needs quoting.
• SC2164 — cd $D without || exit — genuine latent bug (__private_easy_usage in easy lists the wrong dir if cd fails).
• SC2124 — proxy.sh:19 local -r expected="${@}" assigns an array to a string.
• SC2181 — proxy.sh:255 checks $? indirectly; use if cmd; then.
• SC1001 — easy:53 \: in grep is a literal :.
• SC1090 — easy:90 source ${C_SH} — non-constant source; add a # shellcheck source= directive.

Recommended approach

Do this after #7 (bats test harness) lands — the test suite gives a safety net for changes to easy/proxy.sh dispatcher logic. Fix file-by-file; after each, npm run lint should still pass and the file's disable directive should be gone.

Acceptance criteria

• All findings in the table above are fixed (not suppressed).
• Every # shellcheck disable= baseline directive added in Add ShellCheck lint script (unblocks pre-push hook — lint stage) #6 is removed.
• npm run lint exits 0 with no baseline directives remaining.
• No behavior regressions (verified by the Add bats test harness + kcov coverage tooling (unblocks pre-push hook — coverage stage) #7 bats suite + manual smoke tests in CLAUDE.md §6).

🤖 Generated with Claude Code