fix(OSQUERY-007): CU-86akhf8u2 3 review findings across 3 files

[flamingo]

Closes 3 review findings across 3 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 90 high	File-scope helper functions in homebrew_packages.cpp are not anonymous-namespace or static	osquery/tables/system/darwin/homebrew_packages.cpp:41
2	🟢 90 high	shimcache.cpp declares file-scope constants and struct outside any namespace	osquery/tables/system/windows/shimcache.cpp:25
3	🟡 85 medium	appendQuotedString is unused and placed at exported namespace scope instead of anonymous namespace	osquery/events/darwin/es_utils.cpp:165

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 46e37628-c6c9-49a4-aa29-9b30b2c8be3f

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akhf8u2 Osquery review findings sweep (15 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

3 finding(s) fixed in this draft — 3 explained inline on the diff.

[flamingo]

🦩 🟠 File-scope helper functions in homebrew_packages.cpp are not anonymous-namespace or static

Wrapped all file-local helper functions (getHomebrewAppInfoPlistPaths, getHomebrewNameFromInfoPlistPath, getHomebrewVersionsFromInfoPlistPath, checkAutoUpdatesInRubyFile, getBooleanValueFromJsonFile, getAppNameFromJsonManifest, getAppNameFromRubyManifest, getMetadataFileForCask, getHomebrewAutoUpdate, getInstalledAppNameFromMetadata, computeVersionsForFormulas, computeVersionsForCasks, packagesFromPrefix) inside an anonymous namespace { ... } block within namespace osquery { namespace tables { ... } } in osquery/tables/system/darwin/homebrew_packages.cpp, giving them internal linkage. The exported entry point genHomebrewPackages remains outside the anonymous namespace with external linkage, unchanged, and no header declares these helpers so no external caller is affected.

🤖 Prompt for AI agents

In osquery/tables/system/darwin/homebrew_packages.cpp around line 41, review and complete this code-review fix: File-scope helper functions in homebrew_packages.cpp are not anonymous-namespace or static.
What the draft fix changed: Wrapped all file-local helper functions (getHomebrewAppInfoPlistPaths, getHomebrewNameFromInfoPlistPath, getHomebrewVersionsFromInfoPlistPath, checkAutoUpdatesInRubyFile, getBooleanValueFromJsonFile, getAppNameFromJsonManifest, getAppNameFromRubyManifest, getMetadataFileForCask, getHomebrewAutoUpdate, getInstalledAppNameFromMetadata, computeVersionsForFormulas, computeVersionsForCasks, packagesFromPrefix) inside an anonymous `namespace { ... }` block within `namespace osquery { namespace tables { ... } }` in osquery/tables/system/darwin/homebrew_packages.cpp, giving them internal linkage. The exported entry point `genHomebrewPackages` remains outside the anonymous namespace with external linkage, unchanged, and no header declares these helpers so no external caller is affected.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 shimcache.cpp declares file-scope constants and struct outside any namespace

Moved kWin8, kWin10PreCreator, kWin10Creator, kWin8Start, kWin10Start, kWin10CreatorStart, kWin8110ShimcacheDelimiter, kShimcacheControlset, and struct ShimcacheData from true global (file) scope into an anonymous namespace { ... } block nested inside namespace osquery { namespace tables { ... } }, matching the established pattern used elsewhere in the codebase. No usages of these names elsewhere in the file needed changes since they are used only within functions already defined inside osquery::tables.

🤖 Prompt for AI agents

In osquery/tables/system/windows/shimcache.cpp around line 25, review and complete this code-review fix: shimcache.cpp declares file-scope constants and struct outside any namespace.
What the draft fix changed: Moved `kWin8`, `kWin10PreCreator`, `kWin10Creator`, `kWin8Start`, `kWin10Start`, `kWin10CreatorStart`, `kWin8110ShimcacheDelimiter`, `kShimcacheControlset`, and `struct ShimcacheData` from true global (file) scope into an anonymous `namespace { ... }` block nested inside `namespace osquery { namespace tables { ... } }`, matching the established pattern used elsewhere in the codebase. No usages of these names elsewhere in the file needed changes since they are used only within functions already defined inside `osquery::tables`.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 appendQuotedString is unused and placed at exported namespace scope instead of anonymous namespace

Removed the unused, exported appendQuotedString function from osquery/events/darwin/es_utils.cpp (previously defined at file scope in namespace osquery, near the end of the file after getProcessProperties). Since the finding confirms zero callers anywhere in the org, deletion (the "remove if leftover scaffolding" option offered) is the minimal fix rather than adding an anonymous namespace around dead code; this also removes the now-unneeded <iomanip> usage site (header left in place since it's still a plausible general-purpose include, and removing it is out of scope for this finding).

🤖 Prompt for AI agents

In osquery/events/darwin/es_utils.cpp around line 165, review and complete this code-review fix: appendQuotedString is unused and placed at exported namespace scope instead of anonymous namespace.
What the draft fix changed: Removed the unused, exported `appendQuotedString` function from `osquery/events/darwin/es_utils.cpp` (previously defined at file scope in `namespace osquery`, near the end of the file after `getProcessProperties`). Since the finding confirms zero callers anywhere in the org, deletion (the "remove if leftover scaffolding" option offered) is the minimal fix rather than adding an anonymous namespace around dead code; this also removes the now-unneeded `<iomanip>` usage site (header left in place since it's still a plausible general-purpose include, and removing it is out of scope for this finding).
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer