chore: Enable "curly" rule to avoid single-statement if confusion/errors.

src/security/windows-acl.ts

@@ -42,7 +42,9 @@ const normalize = (value: string) => value.trim().toLowerCase();
 
 export function resolveWindowsUserPrincipal(env?: NodeJS.ProcessEnv): string | null {
   const username = env?.USERNAME?.trim() || os.userInfo().username?.trim();
-  if (!username) return null;
+  if (!username) {
+    return null;
+  }
   const domain = env?.USERDOMAIN?.trim();
   return domain ? `${domain}\\${username}` : username;
 }
@@ -54,7 +56,9 @@ function buildTrustedPrincipals(env?: NodeJS.ProcessEnv): Set<string> {
     trusted.add(normalize(principal));
     const parts = principal.split("\\");
     const userOnly = parts.at(-1);
-    if (userOnly) trusted.add(normalize(userOnly));
+    if (userOnly) {
+      trusted.add(normalize(userOnly));
+    }
   }
   return trusted;
 }
@@ -65,10 +69,12 @@ function classifyPrincipal(
 ): "trusted" | "world" | "group" {
   const normalized = normalize(principal);
   const trusted = buildTrustedPrincipals(env);
-  if (trusted.has(normalized) || TRUSTED_SUFFIXES.some((s) => normalized.endsWith(s)))
+  if (trusted.has(normalized) || TRUSTED_SUFFIXES.some((s) => normalized.endsWith(s))) {
     return "trusted";
-  if (WORLD_PRINCIPALS.has(normalized) || WORLD_SUFFIXES.some((s) => normalized.endsWith(s)))
+  }
+  if (WORLD_PRINCIPALS.has(normalized) || WORLD_SUFFIXES.some((s) => normalized.endsWith(s))) {
     return "world";
+  }
   return "group";
 }
 
@@ -89,7 +95,9 @@ export function parseIcaclsOutput(output: string, targetPath: string): WindowsAc
 
   for (const rawLine of output.split(/\r?\n/)) {
     const line = rawLine.trimEnd();
-    if (!line.trim()) continue;
+    if (!line.trim()) {
+      continue;
+    }
     const trimmed = line.trim();
     const lower = trimmed.toLowerCase();
     if (
@@ -107,10 +115,14 @@ export function parseIcaclsOutput(output: string, targetPath: string): WindowsAc
     } else if (lower.startsWith(quotedLower)) {
       entry = trimmed.slice(quotedTarget.length).trim();
     }
-    if (!entry) continue;
+    if (!entry) {
+      continue;
+    }
 
     const idx = entry.indexOf(":");
-    if (idx === -1) continue;
+    if (idx === -1) {
+      continue;
+    }
 
     const principal = entry.slice(0, idx).trim();
     const rawRights = entry.slice(idx + 1).trim();
@@ -119,9 +131,13 @@ export function parseIcaclsOutput(output: string, targetPath: string): WindowsAc
         .match(/\(([^)]+)\)/g)
         ?.map((token) => token.slice(1, -1).trim())
         .filter(Boolean) ?? [];
-    if (tokens.some((token) => token.toUpperCase() === "DENY")) continue;
+    if (tokens.some((token) => token.toUpperCase() === "DENY")) {
+      continue;
+    }
     const rights = tokens.filter((token) => !INHERIT_FLAGS.has(token.toUpperCase()));
-    if (rights.length === 0) continue;
+    if (rights.length === 0) {
+      continue;
+    }
     const { canRead, canWrite } = rightsFromTokens(rights);
     entries.push({ principal, rights, rawRights, canRead, canWrite });
   }
@@ -138,9 +154,13 @@ export function summarizeWindowsAcl(
   const untrustedGroup: WindowsAclEntry[] = [];
   for (const entry of entries) {
     const classification = classifyPrincipal(entry.principal, env);
-    if (classification === "trusted") trusted.push(entry);
-    else if (classification === "world") untrustedWorld.push(entry);
-    else untrustedGroup.push(entry);
+    if (classification === "trusted") {
+      trusted.push(entry);
+    } else if (classification === "world") {
+      untrustedWorld.push(entry);
+    } else {
+      untrustedGroup.push(entry);
+    }
   }
   return { trusted, untrustedWorld, untrustedGroup };
 }
@@ -169,9 +189,13 @@ export async function inspectWindowsAcl(
 }
 
 export function formatWindowsAclSummary(summary: WindowsAclSummary): string {
-  if (!summary.ok) return "unknown";
+  if (!summary.ok) {
+    return "unknown";
+  }
   const untrusted = [...summary.untrustedWorld, ...summary.untrustedGroup];
-  if (untrusted.length === 0) return "trusted-only";
+  if (untrusted.length === 0) {
+    return "trusted-only";
+  }
   return untrusted.map((entry) => `${entry.principal}:${entry.rawRights}`).join(", ");
 }
 
@@ -189,7 +213,9 @@ export function createIcaclsResetCommand(
   opts: { isDir: boolean; env?: NodeJS.ProcessEnv },
 ): { command: string; args: string[]; display: string } | null {
   const user = resolveWindowsUserPrincipal(opts.env);
-  if (!user) return null;
+  if (!user) {
+    return null;
+  }
   const grant = opts.isDir ? "(OI)(CI)F" : "F";
   const args = [
     targetPath,