fix(codacy): resolve open code-scanning alerts

.agents/skills/add-endpoint/SKILL.md

@@ -54,10 +54,10 @@ If you have a running SAP system connection:
 If no system connection is available, research the endpoint:
 
 1. **Search SAP ADT documentation and community resources:**
-   - SAP Help Portal: https://help.sap.com/docs/abap-cloud/abap-development-tools-user-guide
-   - abapGit source (has XSD/schema reference implementations): https://github.com/abapGit/abapGit
+   - SAP Help Portal: <https://help.sap.com/docs/abap-cloud/abap-development-tools-user-guide>
+   - abapGit source (has XSD/schema reference implementations): <https://github.com/abapGit/abapGit>
    - SAP ADT API examples: search GitHub for `sap/bc/adt/{your-path}`
-   - Eclipse ADT plugin source: https://github.com/SAP/abap-adt-api
+   - Eclipse ADT plugin source: <https://github.com/SAP/abap-adt-api>
 
 2. **Search for XSD schema definitions:**
    - Look in the existing XSD files under `packages/adt-schemas/` for similar patterns

.agents/skills/add-object-type/SKILL.md

@@ -57,12 +57,12 @@ Before writing code, gather details about the object type from live system or re
 ### Option B: No Live System — Web Research
 
 1. **ADT endpoint details:**
-   - SAP Help Portal: https://help.sap.com/docs/abap-cloud/abap-development-tools-user-guide
+   - SAP Help Portal: <https://help.sap.com/docs/abap-cloud/abap-development-tools-user-guide>
    - Search GitHub for `sap/bc/adt/{path}` to find client implementations
    - Look at `packages/adt-schemas/src/schemas/generated/schemas/sap/` for existing patterns
 
 2. **abapGit serializer and schema:**
-   - abapGit repository: https://github.com/abapGit/abapGit
+   - abapGit repository: <https://github.com/abapGit/abapGit>
    - Look in `src/objects/` for the relevant handler class (`ZCL_ABAPGIT_OBJECT_{TYPE}`)
    - Find `.abap` or `.xml` sample files in abapGit test fixtures
    - Search abapGit issues/PRs for the object type
@@ -446,7 +446,7 @@ The abapGit schema captures the structure of the XML file that abapGit writes fo
 
 Find out what fields the abapGit serializer writes. Resources:
 
-- **abapGit repository**: https://github.com/abapGit/abapGit — look in `src/objects/` for `ZCL_ABAPGIT_OBJECT_{TYPE}.clas.abap`
+- **abapGit repository**: <https://github.com/abapGit/abapGit> — look in `src/objects/` for `ZCL_ABAPGIT_OBJECT_{TYPE}.clas.abap`
 - Look for `CREATE_VSEO*`, `ZIF_ABAPGIT_OBJECT~DESERIALIZE`, or `SERIALIZE` methods
 - Look at `.xml` files in abapGit test repositories
 - Search for `{TYPE}` in abapGit's `docs/` directory

.agents/skills/adt-reverse-engineering/SKILL.md

@@ -280,11 +280,11 @@ grep -r 'xmlns.*sap.com/adt' packages/adt-fixtures/
 
 ### Official sources
 
-| Source               | URL                                                                    | Best For                         |
-| -------------------- | ---------------------------------------------------------------------- | -------------------------------- |
-| SAP Help - ADT API   | https://help.sap.com/docs/abap-cloud/abap-development-tools-user-guide | Official endpoint docs           |
-| SAP Community        | https://community.sap.com                                              | Blog posts with endpoint details |
-| SAP API Business Hub | https://api.sap.com                                                    | Some ADT-related APIs            |
+| Source               | URL                                                                      | Best For                         |
+| -------------------- | ------------------------------------------------------------------------ | -------------------------------- |
+| SAP Help - ADT API   | <https://help.sap.com/docs/abap-cloud/abap-development-tools-user-guide> | Official endpoint docs           |
+| SAP Community        | <https://community.sap.com>                                              | Blog posts with endpoint details |
+| SAP API Business Hub | <https://api.sap.com>                                                    | Some ADT-related APIs            |
 
 ### Web search patterns
 

.agents/skills/nx-import/SKILL.md

@@ -13,8 +13,8 @@ description: Import, merge, or combine repositories into an Nx workspace using n
 
 Primary docs:
 
-- https://nx.dev/docs/guides/adopting-nx/import-project
-- https://nx.dev/docs/guides/adopting-nx/preserving-git-histories
+- <https://nx.dev/docs/guides/adopting-nx/import-project>
+- <https://nx.dev/docs/guides/adopting-nx/preserving-git-histories>
 
 Read the nx docs if you have the tools for it.
 

.agents/skills/nx-import/references/GRADLE.md

@@ -9,4 +9,4 @@
 
 Helpful docs:
 
-- https://nx.dev/docs/technologies/java/gradle/introduction
+- <https://nx.dev/docs/technologies/java/gradle/introduction>

.agents/skills/nx-import/references/TURBOREPO.md

@@ -1,7 +1,7 @@
 ## Turborepo
 
 - Nx replaces Turborepo task orchestration, but a clean migration requires handling Turborepo's config packages.
-- Migration guide: https://nx.dev/docs/guides/adopting-nx/from-turborepo#easy-automated-migration-example
+- Migration guide: <https://nx.dev/docs/guides/adopting-nx/from-turborepo>
 - Since Nx replaces Turborepo, all turbo config files and config packages become dead code and should be removed.
 
 ## The Config-as-Package Pattern
@@ -59,4 +59,4 @@ The config package centralizes ESLint plugin dependencies and exports composable
 
 Helpful docs:
 
-- https://nx.dev/docs/guides/adopting-nx/from-turborepo
+- <https://nx.dev/docs/guides/adopting-nx/from-turborepo>

.agents/workflows/lint.md

@@ -2,7 +2,10 @@
 name: lint
 description: Run Nx lint with fix and iterate until clean.
 category: workflow
-tags: [nx, lint, quality]
+tags:
+  - nx
+  - lint
+  - quality
 ---
 
 1. Run lint with fix (Nx `lint` target for affected packages).

.agents/workflows/opsx-apply.md

@@ -2,7 +2,10 @@
 name: opsx-apply
 description: Implement tasks from an OpenSpec change (experimental workflow).
 category: workflow
-tags: [openspec, experimental, implementation]
+tags:
+  - openspec
+  - experimental
+  - implementation
 ---
 
 Implement tasks from an OpenSpec change.

.agents/workflows/opsx-archive.md

@@ -2,7 +2,9 @@
 name: opsx-archive
 description: Archive a completed OpenSpec change (experimental workflow).
 category: workflow
-tags: [openspec, experimental]
+tags:
+  - openspec
+  - experimental
 ---
 
 Archive a completed change in the experimental workflow.

.agents/workflows/opsx-explore.md

@@ -2,7 +2,10 @@
 name: opsx-explore
 description: Enter explore mode — think through ideas, investigate problems, clarify requirements (no implementation).
 category: workflow
-tags: [openspec, experimental, discovery]
+tags:
+  - openspec
+  - experimental
+  - discovery
 ---
 
 Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.

.agents/workflows/opsx-propose.md

@@ -2,7 +2,10 @@
 name: opsx-propose
 description: Propose a new OpenSpec change and generate all artifacts in one step.
 category: workflow
-tags: [openspec, experimental, artifacts]
+tags:
+  - openspec
+  - experimental
+  - artifacts
 ---
 
 Propose a new change - create the change and generate all artifacts in one step.

.claude/commands/opsx/apply.md

@@ -2,7 +2,10 @@
 name: 'OPSX: Apply'
 description: Implement tasks from an OpenSpec change (Experimental)
 category: Workflow
-tags: [workflow, artifacts, experimental]
+tags:
+  - workflow
+  - artifacts
+  - experimental
 ---
 
 **Canonical workflow:** `.agents/workflows/opsx-apply.md`

.claude/commands/opsx/archive.md

@@ -2,7 +2,10 @@
 name: 'OPSX: Archive'
 description: Archive a completed change in the experimental workflow
 category: Workflow
-tags: [workflow, archive, experimental]
+tags:
+  - workflow
+  - archive
+  - experimental
 ---
 
 **Canonical workflow:** `.agents/workflows/opsx-archive.md`

.claude/commands/opsx/explore.md

@@ -2,7 +2,11 @@
 name: 'OPSX: Explore'
 description: 'Enter explore mode - think through ideas, investigate problems, clarify requirements'
 category: Workflow
-tags: [workflow, explore, experimental, thinking]
+tags:
+  - workflow
+  - explore
+  - experimental
+  - thinking
 ---
 
 **Canonical workflow:** `.agents/workflows/opsx-explore.md`

.claude/commands/opsx/propose.md

@@ -2,7 +2,10 @@
 name: 'OPSX: Propose'
 description: Propose a new change - create it and generate all artifacts in one step
 category: Workflow
-tags: [workflow, artifacts, experimental]
+tags:
+  - workflow
+  - artifacts
+  - experimental
 ---
 
 **Canonical workflow:** `.agents/workflows/opsx-propose.md`

.claude/hooks/sonar-secrets/build-scripts/prompt-secrets.sh

@@ -17,7 +17,7 @@ fi
 
 # Create temporary file with prompt content (stdin is already occupied by hook input)
 temp_file=$(mktemp)
-trap "rm -f $temp_file" EXIT
+trap 'rm -f "$temp_file"' EXIT
 
 echo -n "$prompt" > "$temp_file"
 

.codacy.yml

@@ -0,0 +1,14 @@
+---
+engines:
+  csslint:
+    exclude_paths:
+      # CSSLint does not support CSS custom properties used by Docusaurus/Infima
+      - 'website/src/css/custom.css'
+  remark-lint:
+    exclude_paths:
+      # Generated release notes contain markdown constructs (e.g. `[bot]`)
+      # that are not intended as reference links
+      - '**/CHANGELOG.md'
+      # Prompt frontmatter uses bracket placeholders that remark-lint treats
+      # as undefined references
+      - '.github/prompts/*.prompt.md'

docs/README.md

@@ -12,7 +12,7 @@ Contents:
 - `examples/` — usage samples
 - `ci-cd-setup.md` — CI/CD configuration notes
 
-For end-user docs visit https://adt-cli.netlify.app (source: `website/docs/`).
+For end-user docs visit <https://adt-cli.netlify.app> (source: `website/docs/`).
 
 ## Specs → OpenSpec
 

docs/planning/abap-code-review.md

@@ -1,7 +1,7 @@
 # ABAP Code Review CI/CD Pipeline - Project Plan
 
 **Specification Reference**: `openspec/specs/cicd/abap-cicd-pipeline.md`  
-**GitHub Project**: https://github.com/orgs/abapify/projects/3  
+**GitHub Project**: <https://github.com/orgs/abapify/projects/3>  
 **Epic Issue**: [#2](https://github.com/abapify/js/issues/2)
 
 ## Project Overview
@@ -20,27 +20,27 @@ Implement a complete CI/CD pipeline for ABAP code review using transport request
 
 ### 🔄 Ready for Implementation
 
-- **[#3] Transport Import Stage** - Extract and serialize transport objects
+- **\[#3] Transport Import Stage** - Extract and serialize transport objects
   - Status: `status:ready`
   - Dependencies: ADT CLI auth, ADK adapters, abapGit format
   - Estimated effort: 2-3 days
-- **[#4] Quality Check Stage** - ATC integration with multi-platform output
+- **\[#4] Quality Check Stage** - ATC integration with multi-platform output
   - Status: `status:ready`
   - Dependencies: Transport import, ATC API integration
   - Estimated effort: 3-4 days
-- **[#5] Reporting Stage** - Comprehensive summary generation
+- **\[#5] Reporting Stage** - Comprehensive summary generation
   - Status: `status:ready`
   - Dependencies: Transport import, Quality check results
   - Estimated effort: 2-3 days
 
 ### 📋 Backlog
 
-- **[#7] CI/CD Platform Templates** - Integration templates for major platforms
+- **\[#7] CI/CD Platform Templates** - Integration templates for major platforms
   - Status: `status:backlog`
   - Dependencies: Core pipeline stages
   - Estimated effort: 1-2 days
 
-- **[#6] Delta Analysis Stage** - Change impact analysis (Future)
+- **\[#6] Delta Analysis Stage** - Change impact analysis (Future)
   - Status: `status:backlog`
   - Dependencies: Transport import, historical data
   - Estimated effort: 4-5 days

docs/planning/current-sprint.md

@@ -42,7 +42,7 @@
 
 ### 🔄 In Progress
 
-- **[#5] Reporting Stage** - Comprehensive summary generation (ON HOLD)
+- **\[#5] Reporting Stage** - Comprehensive summary generation (ON HOLD)
   - Dependencies: Transport import (✅ completed), Quality check (✅ completed)
   - Next: Template engine implementation and markdown report generation
   - Status: Paused pending ADT CLI decoupling completion

docs/roadmap/README.md

@@ -110,7 +110,7 @@ mcp_call_tool(server="deepwiki", tool="devin_session_create",
                           "tags": ["sapcli-parity", "eXX"]})
 ```
 
-Otherwise: open https://app.devin.ai/ → New session → paste the **Devin prompt** block from the epic file.
+Otherwise: open <https://app.devin.ai/> → New session → paste the **Devin prompt** block from the epic file.
 
 ## Conventions enforced across all epics
 

docs/roadmap/epics/e06-gcts-format-plugin.md

@@ -17,7 +17,7 @@ gCTS has its own on-disk layout (different from abapGit). Users on S/4HANA Cloud
 
 - gCTS file format docs: SAP Help → "git-enabled CTS file format". Capture relevant pages locally as references.
 - sapcli gCTS module (for shape, NOT for format — sapcli doesn't serialize, only commands): `tmp/sapcli-ref/sapcli/sap/cli/gcts.py`, `sap/adt/gcts.py`
-- Real gCTS-formatted repo example: see https://github.com/SAP-samples/abap-platform-sample-app or similar; clone to `tmp/gcts-sample/` for reference.
+- Real gCTS-formatted repo example: see <https://github.com/SAP-samples/abap-platform-sample-app> or similar; clone to `tmp/gcts-sample/` for reference.
 - Our abapGit plugin (template to mimic): `packages/adt-plugin-abapgit/src/lib/handlers/`
 
 ## Scope — files

docs/roadmap/epics/e09-acds-parser.md

@@ -17,7 +17,7 @@ We have a starter parser at `packages/acds/`. RAP (E10/E11/E12) needs reliable A
 
 - Existing package: `packages/acds/` (read README/AGENTS.md)
 - ABAP CDS DDL specification: SAP help (download / pin reference grammar locally — `tmp/cds-grammar/`).
-- abaplint CDS support (TS implementation): https://github.com/abaplint/abaplint — for cross-comparison of grammar rules.
+- abaplint CDS support (TS implementation): <https://github.com/abaplint/abaplint> — for cross-comparison of grammar rules.
 
 ## Scope — files
 

docs/roadmap/epics/e13-startrfc.md

@@ -17,7 +17,7 @@ ADT is HTTP REST, but huge swathes of SAP automation still rely on RFC (BAPI cal
 
 - sapcli: `tmp/sapcli-ref/sapcli/sap/cli/startrfc.py` + `sap/rfc/`
 - Two implementation choices:
-  1. Use `node-rfc` (https://github.com/SAP/node-rfc) — official SAP NW RFC SDK binding for Node. Native module; requires SAP NW RFC SDK installed locally. Best fidelity.
+  1. Use `node-rfc` (<https://github.com/SAP/node-rfc>) — official SAP NW RFC SDK binding for Node. Native module; requires SAP NW RFC SDK installed locally. Best fidelity.
   2. Use SOAP-over-HTTP RFC (`/sap/bc/soap/rfc?...`) — REST/SOAP wrapper SAP exposes for some FMs. Doesn't require SDK but is limited.
 
 Recommend: ship Option 2 first (universal, no native deps), keep Option 1 as opt-in plugin (`@abapify/adt-plugin-rfc-native`).

jest.preset.js

@@ -1,3 +1,4 @@
+/* jshint esversion: 9 */
 const nxPreset = require('@nx/jest/preset').default;
 
 module.exports = { ...nxPreset };

openspec/changes/arc-1-feature-parity/design.md

@@ -83,10 +83,10 @@ Not all systems are cloud ABAP; some users want to bypass the gate. Following AR
 
 ## Risks / Trade-offs
 
-- **`@abaplint/core` bundle size** — adds ~2–5 MB to `adt-lint`. [Risk] Tree-shaking may not be effective for the core parser. → Mitigation: lazy-load / dynamic import; measure bundle before shipping.
-- **AST stripping accuracy** — `@abaplint/core` may not parse all ABAP dialects (macros, include forms). [Risk] Stripping produces malformed output on edge cases. → Mitigation: strip operation falls back to returning full source if AST parse fails.
-- **Dump/trace endpoint availability** — `/sap/bc/adt/runtime/dumps` is available on NetWeaver 7.50+ but not on BTP. [Risk] Tool fails on BTP with 404. → Mitigation: graceful error message indicating BTP limitation.
-- **Method surgery cursor errors** — finding the method boundary in the AST requires the method to already exist. [Risk] Editing a non-existent method causes confusing errors. → Mitigation: explicit validation step; return `isError: true` with clear message.
+- **`@abaplint/core` bundle size** — adds ~2–5 MB to `adt-lint`. \[Risk] Tree-shaking may not be effective for the core parser. → Mitigation: lazy-load / dynamic import; measure bundle before shipping.
+- **AST stripping accuracy** — `@abaplint/core` may not parse all ABAP dialects (macros, include forms). \[Risk] Stripping produces malformed output on edge cases. → Mitigation: strip operation falls back to returning full source if AST parse fails.
+- **Dump/trace endpoint availability** — `/sap/bc/adt/runtime/dumps` is available on NetWeaver 7.50+ but not on BTP. \[Risk] Tool fails on BTP with 404. → Mitigation: graceful error message indicating BTP limitation.
+- **Method surgery cursor errors** — finding the method boundary in the AST requires the method to already exist. \[Risk] Editing a non-existent method causes confusing errors. → Mitigation: explicit validation step; return `isError: true` with clear message.
 
 ## Migration Plan
 

packages/adt-client/AGENTS.md

@@ -459,7 +459,7 @@ npx adt fetch /sap/bc/adt/<endpoint> -H "Accept: application/vnd.sap.adt.feature
 - ❌ Real usernames (PPLENKOV)
 - ✅ Mock usernames (TESTUSER)
 - ❌ Real system URLs
-- ✅ Mock URLs (https://mock-system.example.com)
+- ✅ Mock URLs (<https://mock-system.example.com>)
 
 ```bash
 # Create fixture directory structure matching endpoint path

packages/ts-xsd/AGENTS.md

@@ -186,7 +186,7 @@ type SchemaLike = {
 
 ### Adding a New XSD Type
 
-1. **Find in W3C spec**: https://www.w3.org/TR/xmlschema11-1/XMLSchema.xsd
+1. **Find in W3C spec**: <https://www.w3.org/TR/xmlschema11-1/XMLSchema.xsd>
 2. **Add interface** to `src/xsd/types.ts`:
    ```typescript
    export interface NewType extends Annotated {

website/docs/cli/import.md

@@ -46,16 +46,16 @@ support.
 
 ### `transport`
 
-| Flag                          | Description                                                 |
-| ----------------------------- | ----------------------------------------------------------- |
-| `<transportNumber>`           | Transport request number to import.                         |
-| `[targetFolder]`              | Target folder for output.                                   |
-| `-o, --output <path>`         | Output directory (overrides `targetFolder`).                |
-| `-t, --object-types <types>`  | Comma-separated object types.                               |
-| `--format <format>`           | Output format. Default: `abapgit`.                          |
-| `--format-option <key=value>` | Repeatable format option.                                   |
-| `--folder-logic <logic>`      | **[DEPRECATED]** Use `--format-option folderLogic=<logic>`. |
-| `--debug`                     | Enable debug output.                                        |
+| Flag                          | Description                                               |
+| ----------------------------- | --------------------------------------------------------- |
+| `<transportNumber>`           | Transport request number to import.                       |
+| `[targetFolder]`              | Target folder for output.                                 |
+| `-o, --output <path>`         | Output directory (overrides `targetFolder`).              |
+| `-t, --object-types <types>`  | Comma-separated object types.                             |
+| `--format <format>`           | Output format. Default: `abapgit`.                        |
+| `--format-option <key=value>` | Repeatable format option.                                 |
+| `--folder-logic <logic>`      | **DEPRECATED** Use `--format-option folderLogic=<logic>`. |
+| `--debug`                     | Enable debug output.                                      |
 
 ## Examples