[joey-huckabee]

Developer scripts now fail when locked local esbuild is missing instead of reaching npm/npx download or lifecycle fallback. Geodata downloads restrict both initial and redirect protocols to HTTPS and fail on HTTP errors. Existing bundle/watch arguments, upstream URLs, output paths and Cargo commands are preserved.

This addresses the seven script vulnerabilities triaged in docs/evals/2026-11-11-sonar-triage.md: S6505 keys AaHGAPksOB7cC4l45FHK, AaHGAPmGOB7cC4l45FHQ; S6506 keys AaHGAPmCOB7cC4l45FHL, AaHGAPmCOB7cC4l45FHM, AaHGAPmCOB7cC4l45FHN, AaHGAPmCOB7cC4l45FHO, AaHGAPmCOB7cC4l45FHP.

Failure behavior deliberately changes: missing/non-executable local tooling exits before Cargo/watch with an install instruction; HTTP 4xx/5xx or a redirect to HTTP stops the download script with a nonzero curl status. No checksum, retry, atomic replacement or mutable-upstream integrity guarantee is added.

Validation on head 446e143, base 287f155:

• Regressions committed before source fixes: 7 failures and 1 passing HTTPS control. Package-manager sentinels demonstrated reachable fallback without actually downloading anything; real curl fixtures reproduced HTTP 503 and downgrade/initial HTTP acceptance.
• After fixes: all 8 focused tests pass. Missing local tools invoke neither npm/npx nor Cargo. Local executables receive exactly the original arguments, including watch. Real loopback HTTPS succeeds for all five assets; HTTP 503 exits 22 after one request; initial HTTP and HTTPS-to-HTTP redirects exit 1 with zero plaintext requests.
• Rust fmt, Clippy with warnings denied, 21 locked Rust tests and locked build pass (max 2 workers).
• Explicit type preparation, strict TypeScript, 52 client tests with 0 failures/0 skips, both required actual Rust-server integration cases, and esbuild build pass. Bash syntax and diff checks pass.
• No dependency/lockfile, runtime frontend, server, protocol or CI changes. Tests use existing Node built-ins and system curl/OpenSSL with ephemeral loopback certificates. No browser/GPU/performance validation is claimed; .mjs tests are executed, not typechecked.

All 23 optional baseline smells remain deferred. No Sonar settings, issue states, credentials or manual analysis were touched. PR #3 independently handles basemap diagnostics: ordinary network failures were already contained by allSettled and silently swallowed; the renderer loader rejection handler is defensive. The separate public/read-only NONE-gate investigation and proposed setup/proof plan remain documented without changes.

Draft for independent exact-head/diff review; coordinator owns any normal merge.

Reviewer follow-up: curl options are defined once in a Bash array; the five calls preserve exact flags, URLs, destinations and ordering. All eight focused tests remain unchanged and pass. Final-head Linux CI run 42975981459 passed the full gate (21 Rust tests; 52 Node tests; zero skips; both real-server integrations). Automatic SonarCloud passed; the public unresolved PR issue query reports zero findings. No suppressions or settings changes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud