ne desklet for onocoy stations

[airtkey]

New desklet: Onocoy Monitor

• Monitor multiple Onocoy GNSS stations
• Shows online/offline status
• Displays ONO token price (USD/EUR)
• Auto-refresh every 60 seconds

[github-actions]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

---

Found 24 potential issue(s):

⚠️ sync_spawn_command_line

onocoy-monitor@alexmm/desklet.js:320

try { GLib.spawn_command_line_sync("rm -f " + OUTPUT_FILE); } catch(e) {}

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

onocoy-monitor@alexmm/desklet.js:335

GLib.spawn_command_line_sync("chmod +x " + scriptFile);

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

onocoy-monitor@alexmm/desklet.js:357

GLib.spawn_command_line_sync("rm -f " + OUTPUT_FILE);

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

⚠️ sync_file_get_contents

onocoy-monitor@alexmm/desklet.js:37

let [ok, contents] = GLib.file_get_contents(CONFIG_FILE);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

onocoy-monitor@alexmm/desklet.js:343

let [ok, contents] = GLib.file_get_contents(OUTPUT_FILE);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

⚠️ sync_file_test

onocoy-monitor@alexmm/desklet.js:36

if (GLib.file_test(CONFIG_FILE, GLib.FileTest.EXISTS)) {

file_test() is a synchronous stat call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

onocoy-monitor@alexmm/desklet.js:341

if (GLib.file_test(OUTPUT_FILE, GLib.FileTest.EXISTS)) {

file_test() is a synchronous stat call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

⚠️ hardcoded_config_dir

onocoy-monitor@alexmm/desklet.js:9

const CONFIG_FILE = GLib.get_home_dir() + "/.config/onocoy-monitor/stations.json";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

onocoy-monitor@alexmm/desklet.js:10

const OUTPUT_FILE = GLib.get_home_dir() + "/.config/onocoy-monitor/zenity_out.txt";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

onocoy-monitor@alexmm/desklet.js:35

GLib.mkdir_with_parents(GLib.get_home_dir() + "/.config/onocoy-monitor", 0o755);

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

onocoy-monitor@alexmm/desklet.js:333

let scriptFile = GLib.get_home_dir() + "/.config/onocoy-monitor/add_station.sh";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

⚠️ lang_bind

onocoy-monitor@alexmm/desklet.js:96

currBtn.connect("clicked", Lang.bind(this, function() {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:117

addBtn.connect("clicked", Lang.bind(this, this._addStation));

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:123

refreshBtn.connect("clicked", Lang.bind(this, function() {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:190

delBtn.connect("clicked", Lang.bind(this, function() {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:228

Lang.bind(this, function(sess, result) {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:262

Lang.bind(this, function(sess, result) {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:290

Lang.bind(this, function(sess, result) {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:339

Mainloop.timeout_add_seconds(1, Lang.bind(this, function() {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:366

this._timeout = Mainloop.timeout_add_seconds(UPDATE_INTERVAL, Lang.bind(this, function() {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

ℹ️ shell_string_spawn

onocoy-monitor@alexmm/desklet.js:320

try { GLib.spawn_command_line_sync("rm -f " + OUTPUT_FILE); } catch(e) {}

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

onocoy-monitor@alexmm/desklet.js:335

GLib.spawn_command_line_sync("chmod +x " + scriptFile);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

onocoy-monitor@alexmm/desklet.js:336

GLib.spawn_command_line_async("bash " + scriptFile);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

onocoy-monitor@alexmm/desklet.js:357

GLib.spawn_command_line_sync("rm -f " + OUTPUT_FILE);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

---

Automated pattern check.

[github-actions]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

---

Found 24 potential issue(s):

⚠️ sync_spawn_command_line

onocoy-monitor@alexmm/desklet.js:320

try { GLib.spawn_command_line_sync("rm -f " + OUTPUT_FILE); } catch(e) {}

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

onocoy-monitor@alexmm/desklet.js:335

GLib.spawn_command_line_sync("chmod +x " + scriptFile);

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

onocoy-monitor@alexmm/desklet.js:357

GLib.spawn_command_line_sync("rm -f " + OUTPUT_FILE);

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

⚠️ sync_file_get_contents

onocoy-monitor@alexmm/desklet.js:37

let [ok, contents] = GLib.file_get_contents(CONFIG_FILE);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

onocoy-monitor@alexmm/desklet.js:343

let [ok, contents] = GLib.file_get_contents(OUTPUT_FILE);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

⚠️ sync_file_test

onocoy-monitor@alexmm/desklet.js:36

if (GLib.file_test(CONFIG_FILE, GLib.FileTest.EXISTS)) {

file_test() is a synchronous stat call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

onocoy-monitor@alexmm/desklet.js:341

if (GLib.file_test(OUTPUT_FILE, GLib.FileTest.EXISTS)) {

file_test() is a synchronous stat call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

⚠️ hardcoded_config_dir

onocoy-monitor@alexmm/desklet.js:9

const CONFIG_FILE = GLib.get_home_dir() + "/.config/onocoy-monitor/stations.json";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

onocoy-monitor@alexmm/desklet.js:10

const OUTPUT_FILE = GLib.get_home_dir() + "/.config/onocoy-monitor/zenity_out.txt";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

onocoy-monitor@alexmm/desklet.js:35

GLib.mkdir_with_parents(GLib.get_home_dir() + "/.config/onocoy-monitor", 0o755);

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

onocoy-monitor@alexmm/desklet.js:333

let scriptFile = GLib.get_home_dir() + "/.config/onocoy-monitor/add_station.sh";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

⚠️ lang_bind

onocoy-monitor@alexmm/desklet.js:96

currBtn.connect("clicked", Lang.bind(this, function() {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:117

addBtn.connect("clicked", Lang.bind(this, this._addStation));

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:123

refreshBtn.connect("clicked", Lang.bind(this, function() {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:190

delBtn.connect("clicked", Lang.bind(this, function() {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:228

Lang.bind(this, function(sess, result) {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:262

Lang.bind(this, function(sess, result) {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:290

Lang.bind(this, function(sess, result) {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:339

Mainloop.timeout_add_seconds(1, Lang.bind(this, function() {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

onocoy-monitor@alexmm/desklet.js:366

this._timeout = Mainloop.timeout_add_seconds(UPDATE_INTERVAL, Lang.bind(this, function() {

Lang.bind() is deprecated. Use arrow functions (() => {}) or Function.prototype.bind() instead.

ℹ️ shell_string_spawn

onocoy-monitor@alexmm/desklet.js:320

try { GLib.spawn_command_line_sync("rm -f " + OUTPUT_FILE); } catch(e) {}

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

onocoy-monitor@alexmm/desklet.js:335

GLib.spawn_command_line_sync("chmod +x " + scriptFile);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

onocoy-monitor@alexmm/desklet.js:336

GLib.spawn_command_line_async("bash " + scriptFile);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

onocoy-monitor@alexmm/desklet.js:357

GLib.spawn_command_line_sync("rm -f " + OUTPUT_FILE);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

---

Automated pattern check.