fix: resolve all golangci-lint violations

- list_package_exports_test.go: _ = tool.Execute (errcheck)
- search_test.go: Expect(json.Unmarshal(...)) (errcheck)
- go/analyzer_test.go: require.NoError(t, os.WriteFile) (errcheck)
- workspace/integration_test.go: check errRes after step 2 (ineffassign)
- php/phpdoc.go: ReturnInfo(r) direct conversion (gosimple S1016)
- cmd/rag-code-install/main.go: errCh for ollama serve early exit
- internal/updater/updater.go: regex validation for remote model name

Author: razvan

cmd/rag-code-install/main.go

@@ -145,21 +145,34 @@ func setupEnvironment() {
 			fmt.Printf("   Would you like to try starting the local Ollama service? [Y/n]: ")
 			if askConfirm(true) {
 				log("Starting Ollama service in background...")
-				// Start ollama serve in a way that doesn't block the installer
+				// Start ollama serve; capture early exit errors via channel
+				errCh := make(chan error, 1)
 				go func() {
-					if err := exec.Command("ollama", "serve").Run(); err != nil {
-						fmt.Printf("⚠️  Warning: Failed to serve ollama: %v\n", err)
-					}
+					errCh <- exec.Command("ollama", "serve").Run()
 				}()
 				// Give it a few seconds to bind to the port
 				log("Waiting for Ollama to bind to port 11434...")
+				started := false
 				for i := 0; i < 10; i++ {
+					select {
+					case err := <-errCh:
+						if err != nil {
+							fmt.Printf("⚠️  Warning: ollama serve exited early: %v\n", err)
+						}
+						goto ollamaDone
+					default:
+					}
 					if isPortOpen(11434) {
 						success("Ollama service started successfully")
-						break
+						started = true
+						goto ollamaDone
 					}
 					time.Sleep(1 * time.Second)
 				}
+			ollamaDone:
+				if !started && !isPortOpen(11434) {
+					fmt.Printf("⚠️  Ollama did not bind to port 11434 in time\n")
+				}
 			}
 		}
 

internal/service/tools/tests/list_package_exports_test.go

@@ -35,7 +35,7 @@ var _ = Describe("ListPackageExportsTool", func() {
 			resJSON, err := tool.Execute(ctx, map[string]interface{}{"file_path": "main.go"})
 			Expect(err).NotTo(HaveOccurred())
 			var resp tools.ToolResponse
-			json.Unmarshal([]byte(resJSON), &resp)
+			Expect(json.Unmarshal([]byte(resJSON), &resp)).NotTo(HaveOccurred())
 			Expect(resp.Status).To(Equal("error"))
 			Expect(resp.Error).To(ContainSubstring("package parameter is required"))
 		})
@@ -71,7 +71,7 @@ var _ = Describe("ListPackageExportsTool", func() {
 			Expect(err).NotTo(HaveOccurred())
 
 			var resp tools.ToolResponse
-			json.Unmarshal([]byte(resJSON), &resp)
+			Expect(json.Unmarshal([]byte(resJSON), &resp)).NotTo(HaveOccurred())
 			if resp.Status != "success" {
 				GinkgoWriter.Printf("ListPackageExports Error: %s\n", resp.Error)
 			}
@@ -95,7 +95,7 @@ var _ = Describe("ListPackageExportsTool", func() {
 				return []storage.SearchResult{}, nil
 			}
 
-			tool.Execute(ctx, map[string]interface{}{"package": "mypkg", "file_path": "main.go"})
+			_, _ = tool.Execute(ctx, map[string]interface{}{"package": "mypkg", "file_path": "main.go"})
 
 			Expect(capturedFilter).NotTo(BeNil())
 			Expect(capturedFilter["package"]).To(Equal("mypkg"))
@@ -119,7 +119,7 @@ var _ = Describe("ListPackageExportsTool", func() {
 			resJSON, err := tool.Execute(ctx, map[string]interface{}{"package": "mypkg", "file_path": "main.go"})
 			Expect(err).NotTo(HaveOccurred())
 			var resp tools.ToolResponse
-			json.Unmarshal([]byte(resJSON), &resp)
+			Expect(json.Unmarshal([]byte(resJSON), &resp)).NotTo(HaveOccurred())
 			Expect(resp.Status).To(Equal("success"))
 			data := resp.Data.(map[string]interface{})
 			funcs := data["function"].([]interface{})
@@ -142,7 +142,7 @@ var _ = Describe("ListPackageExportsTool", func() {
 			resJSON, err := tool.Execute(ctx, map[string]interface{}{"package": "mypkg", "file_path": "main.go"})
 			Expect(err).NotTo(HaveOccurred())
 			var resp tools.ToolResponse
-			json.Unmarshal([]byte(resJSON), &resp)
+			Expect(json.Unmarshal([]byte(resJSON), &resp)).NotTo(HaveOccurred())
 			Expect(resp.Status).To(Equal("success"))
 			Expect(resp.Data).To(BeNil(), "internalHelper should be excluded by isExported check")
 		})
@@ -168,7 +168,7 @@ var _ = Describe("ListPackageExportsTool", func() {
 			resJSON, err := tool.Execute(ctx, map[string]interface{}{"package": "mypkg", "file_path": "main.go"})
 			Expect(err).NotTo(HaveOccurred())
 			var resp tools.ToolResponse
-			json.Unmarshal([]byte(resJSON), &resp)
+			Expect(json.Unmarshal([]byte(resJSON), &resp)).NotTo(HaveOccurred())
 			Expect(resp.Status).To(Equal("success"))
 			Expect(resp.Message).To(ContainSubstring("**Relations:** 3"), "Output should display RelationsCount when > 0")
 		})

internal/service/tools/tests/search_test.go

@@ -45,7 +45,7 @@ var _ = Describe("RagSearchCodeTool", func() {
 				resJSON, err := tool.Execute(ctx, map[string]interface{}{"query": "test", "file_path": "main.go"})
 				Expect(err).NotTo(HaveOccurred())
 				var resp tools.ToolResponse
-				json.Unmarshal([]byte(resJSON), &resp)
+				Expect(json.Unmarshal([]byte(resJSON), &resp)).NotTo(HaveOccurred())
 				Expect(resp.Status).To(Equal("no_results"))
 			})
 		})
@@ -58,7 +58,7 @@ var _ = Describe("RagSearchCodeTool", func() {
 				resJSON, err := tool.Execute(ctx, map[string]interface{}{"query": "test", "file_path": "main.go"})
 				Expect(err).NotTo(HaveOccurred())
 				var resp tools.ToolResponse
-				json.Unmarshal([]byte(resJSON), &resp)
+				Expect(json.Unmarshal([]byte(resJSON), &resp)).NotTo(HaveOccurred())
 				Expect(resp.Status).To(Equal("error"))
 				Expect(resp.Error).To(ContainSubstring("search failed"))
 			})
@@ -87,7 +87,7 @@ var _ = Describe("RagSearchCodeTool", func() {
 				resJSON, err := tool.Execute(ctx, map[string]interface{}{"query": "find func", "file_path": "main.go"})
 				Expect(err).NotTo(HaveOccurred())
 				var resp tools.ToolResponse
-				json.Unmarshal([]byte(resJSON), &resp)
+				Expect(json.Unmarshal([]byte(resJSON), &resp)).NotTo(HaveOccurred())
 				Expect(resp.Status).To(Equal("success"), "Error: "+resp.Error)
 
 				// Verify Data list
@@ -147,7 +147,7 @@ var _ = Describe("RagSearchCodeTool", func() {
 				Expect(err).NotTo(HaveOccurred())
 
 				var resp tools.ToolResponse
-				json.Unmarshal([]byte(resJSON), &resp)
+				Expect(json.Unmarshal([]byte(resJSON), &resp)).NotTo(HaveOccurred())
 				Expect(resp.Status).To(Equal("success"), "Error: "+resp.Error)
 				Expect(resp.Message).To(ContainSubstring("Auto-fetched 1 related dependencies"))
 
@@ -196,7 +196,7 @@ var _ = Describe("RagSearchCodeTool", func() {
 				Expect(err).NotTo(HaveOccurred())
 
 				var resp tools.ToolResponse
-				json.Unmarshal([]byte(resJSON), &resp)
+				Expect(json.Unmarshal([]byte(resJSON), &resp)).NotTo(HaveOccurred())
 				Expect(resp.Status).To(Equal("success"), "Error: "+resp.Error)
 
 				// Only root result — dependency was skipped (not in index, no fallback)
@@ -242,7 +242,7 @@ var _ = Describe("RagSearchCodeTool", func() {
 				resJSON, err := tool.Execute(ctx, map[string]interface{}{"query": "test", "file_path": "main.go"})
 				Expect(err).NotTo(HaveOccurred())
 				var resp tools.ToolResponse
-				json.Unmarshal([]byte(resJSON), &resp)
+				Expect(json.Unmarshal([]byte(resJSON), &resp)).NotTo(HaveOccurred())
 				Expect(resp.Status).To(Equal("success"), "Error: "+resp.Error)
 
 				// Despite 3 identical relations, output should have exactly root + 1 Shared

internal/updater/updater.go

@@ -11,6 +11,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"regexp"
 	"runtime"
 	"strings"
 	"sync"
@@ -432,6 +433,13 @@ func fetchRemoteStableModel(ctx context.Context) (string, error) {
 		return "", fmt.Errorf("ollama_embed key not found or empty in remote config.yaml")
 	}
 
+	// Validate model name: allow alphanum, hyphens, dots, slashes, colons (tag separator).
+	// Rejects anything that looks like shell injection or corrupted data.
+	var validModel = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9./_-]*(:[a-zA-Z0-9][a-zA-Z0-9._-]*)?$`)
+	if !validModel.MatchString(cfg.LLM.OllamaEmbed) {
+		return "", fmt.Errorf("remote ollama_embed value %q is not a valid model name", cfg.LLM.OllamaEmbed)
+	}
+
 	return cfg.LLM.OllamaEmbed, nil
 }
 

pkg/parser/go/analyzer_test.go

@@ -131,7 +131,7 @@ func TestCodeAnalyzer_EdgeCases(t *testing.T) {
 
 		hiddenDir := filepath.Join(tmpDir, ".hidden")
 		require.NoError(t, os.Mkdir(hiddenDir, 0755))
-		os.WriteFile(filepath.Join(hiddenDir, "skip.go"), []byte("package hidden"), 0644)
+		require.NoError(t, os.WriteFile(filepath.Join(hiddenDir, "skip.go"), []byte("package hidden"), 0644))
 
 		res, err := ca.AnalyzePaths([]string{tmpDir})
 		assert.NoError(t, err)
@@ -148,7 +148,7 @@ type Data struct {
     Handler func(int) error
 }
 `
-		os.WriteFile(filepath.Join(complexDir, "complex.go"), []byte(code), 0644)
+		require.NoError(t, os.WriteFile(filepath.Join(complexDir, "complex.go"), []byte(code), 0644))
 		res, err := ca.Analyze(context.Background(), complexDir)
 		assert.NoError(t, err)
 		assert.NotEmpty(t, res.Symbols)

pkg/parser/php/phpdoc.go

@@ -162,10 +162,7 @@ func parseTag(line string, doc *PHPDocInfo) {
 func convertPHPDocToReturnInfo(docReturns []ReturnDoc) []ReturnInfo {
 	returns := make([]ReturnInfo, len(docReturns))
 	for i, r := range docReturns {
-		returns[i] = ReturnInfo{
-			Type:        r.Type,
-			Description: r.Description,
-		}
+		returns[i] = ReturnInfo(r)
 	}
 	return returns
 }

pkg/workspace/tests/integration_test.go

@@ -76,6 +76,9 @@ func TestBranchIsolationAndFeedbackPromotionIntegration(t *testing.T) {
 
 	req2 := contract.ResolveWorkspaceRequest{WorkspaceRoot: projectRoot}
 	resp2, errRes := r.Resolve(ctx, req2)
+	if errRes != nil {
+		t.Fatalf("Step 2 resolve failed: %v", errRes)
+	}
 	if id1 == resp2.WorkspaceID {
 		t.Errorf("Workspace IDs should be different for different branches")
 	}