fix: resolve all golangci-lint findings and bump grpc for CVE

- wrapcheck: wrap all external/interface errors with context
- noctx: use NewRequestWithContext for production HTTP clients;
  file-level nolint for httptest in test files
- errcheck/errchkjson: check json.Marshal and resp.Body.Close errors
- revive: rename unused BeforeCreate tx params to _
- staticcheck: replace nil contexts with context.Background()
- testifylint: assert.NotEmpty for IDs, require.Error for preconditions,
  assert.InDelta for floats, assert.Positive for > 0
- gosec: nolint for test credentials and weak random in test helpers
- intrange: use range-over-int loops
- ineffassign: remove dead rec assignment
- goconst: extract repeated test string to constant
- Bump google.golang.org/grpc 1.79.2 → 1.79.3 (GHSA-p77j-4mvh-x3m3)
- Fix flaky TestNewIsTimeSorted with 1ms sleep between ULID generations
- Update vendorHash in flake.nix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: cpcloud

cmd/micasa/pro.go

@@ -754,7 +754,10 @@ func runProDevicesList(dbPath string) error {
 
 	enc := json.NewEncoder(os.Stdout)
 	enc.SetIndent("", "  ")
-	return enc.Encode(devices)
+	if err := enc.Encode(devices); err != nil {
+		return fmt.Errorf("encode devices: %w", err)
+	}
+	return nil
 }
 
 func newProDevicesRevokeCmd() *cobra.Command {
@@ -845,5 +848,8 @@ func runProConflicts(w io.Writer, dbPath string) error {
 			return fmt.Errorf("write conflict: %w", err)
 		}
 	}
-	return tw.Flush()
+	if err := tw.Flush(); err != nil {
+		return fmt.Errorf("flush output: %w", err)
+	}
+	return nil
 }

cmd/micasa/pro_test.go

@@ -340,11 +340,11 @@ func TestProStorageCmdWiring(t *testing.T) {
 
 	root := newRootCmd()
 	proCmd, _, err := root.Find([]string{"pro"})
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, proCmd)
 
 	storageCmd, _, err := root.Find([]string{"pro", "storage"})
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.NotNil(t, storageCmd)
 	assert.Equal(t, "storage [database-path]", storageCmd.Use)
 }

flake.nix

@@ -36,7 +36,7 @@
           inherit version;
           src = ./.;
           subPackages = [ "cmd/micasa" ];
-          vendorHash = "sha256-zgOejAAikNcxd3DX1rWLcYiMG/Otg7MsAxUONeNB2tI=";
+          vendorHash = "sha256-31TOXdNeuUaImz9AdwSW6BTJ1PFauww/uWIquJ1roqs=";
           env.CGO_ENABLED = 0;
           preCheck = ''
             export HOME="$(mktemp -d)"

go.mod

@@ -117,7 +117,7 @@ require (
 	golang.org/x/sync v0.20.0 // indirect
 	google.golang.org/genai v1.50.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 // indirect
-	google.golang.org/grpc v1.79.2 // indirect
+	google.golang.org/grpc v1.79.3 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.70.0 // indirect

go.sum

@@ -265,8 +265,8 @@ google.golang.org/genai v1.50.0 h1:yHKV/vjoeN9PJ3iF0ur4cBZco4N3Kl7j09rMq7XSoWk=
 google.golang.org/genai v1.50.0/go.mod h1:A3kkl0nyBjyFlNjgxIwKq70julKbIxpSxqKO5gw/gmk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 h1:aJmi6DVGGIStN9Mobk/tZOOQUBbj0BPjZjjnOdoZKts=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.79.2 h1:fRMD94s2tITpyJGtBBn7MkMseNpOZU8ZxgC3MMBaXRU=
-google.golang.org/grpc v1.79.2/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
+google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/app/dashboard_test.go

@@ -15,6 +15,8 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+const testIncidentID = "01JTEST00000000000000005"
+
 // nonEmptyDashboard returns a minimal dashboardData that is not empty,
 // for tests that just need the dashboard overlay to render.
 func nonEmptyDashboard() dashboardData {
@@ -121,7 +123,7 @@ func TestDashboardNavigation(t *testing.T) {
 		{Tab: tabMaintenance, ID: "01JTEST00000000000000002"},
 		{Tab: tabProjects, ID: "01JTEST00000000000000003"},
 		{Tab: tabAppliances, ID: "01JTEST00000000000000004"},
-		{Tab: tabMaintenance, ID: "01JTEST00000000000000005"},
+		{Tab: tabMaintenance, ID: testIncidentID},
 	}
 	m.dash.cursor = 0
 
@@ -500,7 +502,7 @@ func TestBuildDashNav(t *testing.T) {
 			DaysFromNow: 45,
 		}},
 	}
-	m.dash.data.OpenIncidents[0].ID = "01JTEST00000000000000005"
+	m.dash.data.OpenIncidents[0].ID = testIncidentID
 	// Expand incidents (default) so its data rows appear in nav.
 	m.dash.expanded = map[string]bool{
 		dashSectionIncidents: true,
@@ -515,7 +517,7 @@ func TestBuildDashNav(t *testing.T) {
 	assert.True(t, m.dash.nav[0].IsHeader)
 	assert.Equal(t, dashSectionIncidents, m.dash.nav[0].Section)
 	assert.Equal(t, tabIncidents, m.dash.nav[1].Tab)
-	assert.Equal(t, "01JTEST00000000000000005", m.dash.nav[1].ID)
+	assert.Equal(t, testIncidentID, m.dash.nav[1].ID)
 
 	// Collapsed sections: just headers.
 	assert.True(t, m.dash.nav[2].IsHeader)
@@ -818,7 +820,7 @@ func TestDashboardExpandCollapseWithEKey(t *testing.T) {
 			DaysFromNow: daysUntil(now, overdueDue),
 		}},
 	}
-	m.dash.data.OpenIncidents[0].ID = "01JTEST00000000000000005"
+	m.dash.data.OpenIncidents[0].ID = testIncidentID
 	m.dash.expanded = map[string]bool{dashSectionIncidents: true}
 	m.prepareDashboardView()
 
@@ -864,7 +866,7 @@ func TestDashboardSectionNavWithShiftJK(t *testing.T) {
 		}},
 		ActiveProjects: []data.Project{{ID: "01JTEST00000000000000020", Title: "Deck"}},
 	}
-	m.dash.data.OpenIncidents[0].ID = "01JTEST00000000000000005"
+	m.dash.data.OpenIncidents[0].ID = testIncidentID
 	m.dash.expanded = map[string]bool{dashSectionIncidents: true}
 	m.buildDashNav()
 
@@ -943,7 +945,7 @@ func TestDashboardEnterKeyJumpsToExpiring(t *testing.T) {
 			DaysFromNow: daysUntil(now, expiry),
 		}},
 	}
-	m.dash.data.OpenIncidents[0].ID = "01JTEST00000000000000005"
+	m.dash.data.OpenIncidents[0].ID = testIncidentID
 	m.dash.data.ExpiringWarranties[0].Appliance.ID = "01JTEST00000000000000099"
 	m.dash.expanded = map[string]bool{dashSectionIncidents: true}
 	m.buildDashNav()
@@ -993,7 +995,7 @@ func TestDashboardExpiringNavWithInsuranceOnly(t *testing.T) {
 			DaysFromNow: 60,
 		},
 	}
-	m.dash.data.OpenIncidents[0].ID = "01JTEST00000000000000005"
+	m.dash.data.OpenIncidents[0].ID = testIncidentID
 	m.dash.expanded = map[string]bool{dashSectionIncidents: true}
 	m.buildDashNav()
 

internal/app/handler_crud_test.go

@@ -1083,7 +1083,7 @@ func TestApplianceMaintenanceHandlerLoad(t *testing.T) {
 	rows, meta, _, err := h.Load(m.store, false)
 	require.NoError(t, err)
 	require.Len(t, rows, 1)
-	assert.NotZero(t, meta[0].ID)
+	assert.NotEmpty(t, meta[0].ID)
 }
 
 func TestApplianceMaintenanceInlineEditSeasonDispatchesCorrectly(t *testing.T) {

internal/app/model.go

@@ -337,7 +337,7 @@ func (m *Model) Init() tea.Cmd {
 	cmds := []tea.Cmd{m.formInitCmd(), tea.RequestBackgroundColor}
 	if m.syncEngine != nil {
 		m.syncStatus = syncSyncing
-		cmds = append(cmds, doSync(m.syncEngine, m.syncCtx), syncTick())
+		cmds = append(cmds, doSync(m.syncCtx, m.syncEngine), syncTick())
 	}
 	return tea.Batch(cmds...)
 }
@@ -495,13 +495,13 @@ func (m *Model) update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			return m, syncTick()
 		}
 		m.syncStatus = syncSyncing
-		return m, tea.Batch(doSync(m.syncEngine, m.syncCtx), syncTick())
+		return m, tea.Batch(doSync(m.syncCtx, m.syncEngine), syncTick())
 	case syncDebounceMsg:
 		if typed.gen != m.syncDebounceGen || m.syncEngine == nil || m.syncStatus == syncSyncing {
 			return m, nil
 		}
 		m.syncStatus = syncSyncing
-		return m, doSync(m.syncEngine, m.syncCtx)
+		return m, doSync(m.syncCtx, m.syncEngine)
 	case editorFinishedMsg:
 		return m, m.handleEditorFinished(typed)
 	}

internal/app/sync.go

@@ -51,7 +51,7 @@ type syncDebounceMsg struct{ gen int }
 
 // --- tea.Cmd constructors ---
 
-func doSync(engine *sync.Engine, ctx context.Context) tea.Cmd {
+func doSync(ctx context.Context, engine *sync.Engine) tea.Cmd {
 	return func() tea.Msg {
 		result, err := engine.Sync(ctx)
 		if err != nil {

internal/crypto/box_test.go

@@ -77,7 +77,7 @@ func TestBoxTooShort(t *testing.T) {
 	t.Parallel()
 	var priv, pub [KeySize]byte
 	_, err := BoxOpen(priv, pub, make([]byte, NonceSize))
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "too short")
 }