dsh-code-review-graph 0.0.0-stage → 0.1.1

package/package.json

@@ -1,6 +1,40 @@
 {
   "name": "dsh-code-review-graph",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Local code intelligence, review workflows and interactive graphs for DeepSeek Harness",
+  "type": "module",
+  "license": "MIT",
+  "repository": "github:sumingwang233/dsh-code-review-graph",
+  "engines": { "node": ">=22.19" },
+  "exports": { ".": "./dist/index.js", "./client": "./dist/client.js", "./package.json": "./package.json" },
+  "bin": { "dsh-crg": "./dist/setup.js" },
+  "files": ["dist", "cordis.patch.yml", "engine.json", "capabilities.json", "skills", "LICENSE", "NOTICE", "README.md", "README.en.md", "docs/capabilities.md", "docs/validation.md", "docs/release-0.1.1.md"],
+  "dsh": { "bundle": { "patch": "./cordis.patch.yml" }, "client": { "platform": "web", "inject": ["@deepseek-ai/dsh-api-workspace-files", "@deepseek-ai/dsh-client-ui-sidebar-right", "@deepseek-ai/dsh-api-remotes"] } },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "node --test tests/*.test.mjs",
+    "test:integration": "node --test tests/integration.mjs",
+    "test:browser": "node --test tests/browser.mjs",
+    "test:desktop": "node --test tests/desktop.mjs",
+    "test:install": "node --test tests/install.mjs",
+    "test:setup": "node --test tests/setup.mjs",
+    "test:backend": "node --test tests/backend.mjs",
+    "prepare:tests": "node scripts/prepare-test-runtime.mjs",
+    "prepack": "npm run typecheck && npm run build"
+  },
+  "dependencies": { "@modelcontextprotocol/sdk": "1.32.1", "ajv": "8.20.0" },
+  "peerDependencies": { "@deepseek-ai/cordis": "^4.0.0", "@deepseek-ai/schemastery": "^3.18.0", "react": "^18.2.0" },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.4", "@deepseek-ai/schemastery": "3.18.4",
+    "@deepseek-ai/dsh-tools": "0.2.0-rc.2", "@deepseek-ai/dsh-agent": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.0-rc.2", "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.2", "@deepseek-ai/dsh-skill": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-sidebar-right": "0.2.0-rc.2", "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2", "@deepseek-ai/dsh-client-ui-renderer": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-api-remotes": "0.2.0-rc.2", "@deepseek-ai/dsh-client-ui-session": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-api-workspace-files": "0.2.0-rc.2",
+    "@types/node": "^24.0.0", "@types/react": "^18.3.0", "react": "18.3.1", "react-dom": "18.3.1",
+    "typescript": "^5.9.0", "esbuild": "^0.25.0", "@playwright/test": "^1.55.0"
+  }
+}

package/skills/build-graph/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: build-graph
+description: Build or update the code review knowledge graph. Run this first to initialize, or let hooks keep it updated automatically.
+argument-hint: "[full]"
+---
+
+# Build Graph
+
+Build or incrementally update the knowledge graph for this repository.
+
+## Steps
+
+1. Call `list_graph_stats_tool`. If `last_updated` is null, the graph has never been built.
+2. For a first build, or when the argument is `full`, call `build_or_update_graph_tool(full_rebuild=True)`. Otherwise call `build_or_update_graph_tool()` for an incremental update.
+3. Report the response: `status` (`ok`, `partial` or `error`) and `summary`.
+
+## When to Use
+
+- First set-up of a repository, or after a branch switch or large refactor.
+- When the graph looks stale. Hooks installed by `code-review-graph install` run an update after each edit and before each commit, so manual builds are rarely needed.
+
+## Notes
+
+- The database is `.code-review-graph/graph.db` in the repository root.
+- Binary files, dependency and build directories, and patterns in `.code-review-graphignore` are skipped.
+- For the list of supported languages call `get_docs_section_tool(section_name="languages")`.

package/skills/debug-issue/SKILL.md

@@ -0,0 +1,23 @@
+---
+name: debug-issue
+description: Systematically debug issues using graph-powered code navigation
+---
+
+## Debug Issue
+
+Trace a bug through the knowledge graph before reading source.
+
+### Steps
+
+1. Call `semantic_search_nodes_tool` to find code related to the issue.
+2. Call `query_graph_tool` with `callers_of` and `callees_of` to trace the call chain in both directions.
+3. Call `get_flow_tool` for the execution path that reaches the suspect code. Its entry point is where the bug is triggered.
+4. Call `detect_changes_tool` to check whether a recent change caused the issue.
+5. Call `get_impact_radius_tool` on the suspect files to see what a fix would affect.
+
+## Token Efficiency Rules
+- Call `get_minimal_context_tool(task="<your task>")` before any other graph tool.
+- Pass `detail_level="minimal"` wherever a tool accepts it. Use "standard" only when minimal is not enough.
+- Prefer a targeted `query_graph_tool` call over a broad listing call.
+- Budget: about five tool calls and 800 tokens of graph output per task.
+- Read the implementation and its tests before changing code. The graph narrows scope; it does not replace the source.

package/skills/explore-codebase/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: explore-codebase
+description: Navigate and understand codebase structure using the knowledge graph
+---
+
+## Explore Codebase
+
+Use the code-review-graph MCP tools to find your way around the codebase.
+
+### Steps
+
+1. Call `get_architecture_overview_tool` for the community structure. Call `list_communities_tool`, then `get_community_tool`, only for the modules you need.
+2. Call `semantic_search_nodes_tool` to find a function or class by name or keyword.
+3. Call `query_graph_tool` with `callers_of`, `callees_of` or `imports_of` to trace relationships. `children_of` on a file lists its functions and classes.
+4. Call `list_flows_tool`, then `get_flow_tool` for one flow, to follow an execution path.
+5. Call `find_large_functions_tool` to find oversized functions.
+6. Call `list_graph_stats_tool` only when you need node, edge and language counts.
+
+## Token Efficiency Rules
+- Call `get_minimal_context_tool(task="<your task>")` before any other graph tool.
+- Pass `detail_level="minimal"` wherever a tool accepts it. Use "standard" only when minimal is not enough.
+- Prefer a targeted `query_graph_tool` call over a broad listing call.
+- Budget: about five tool calls and 800 tokens of graph output per task.
+- Read the implementation and its tests before changing code. The graph narrows scope; it does not replace the source.

package/skills/refactor-safely/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: refactor-safely
+description: Plan and execute safe refactoring using dependency analysis
+---
+
+## Refactor Safely
+
+Plan a refactor from the dependency graph and apply renames from a preview.
+
+### Steps
+
+1. Call `refactor_tool` with `mode="suggest"` for refactoring candidates, or `mode="dead_code"` for unreferenced code.
+2. For a rename, call `refactor_tool` with `mode="rename"`, `old_name` and `new_name`. Check the returned edit list before applying.
+3. Call `apply_refactor_tool` with the returned `refactor_id` to apply the rename.
+4. Before a large refactor, call `get_impact_radius_tool` and `get_affected_flows_tool` to see the dependents and critical paths involved.
+5. Call `find_large_functions_tool` to find functions worth splitting.
+6. After the change, call `detect_changes_tool` to confirm the impact matches the plan.
+
+## Token Efficiency Rules
+- Call `get_minimal_context_tool(task="<your task>")` before any other graph tool.
+- Pass `detail_level="minimal"` wherever a tool accepts it. Use "standard" only when minimal is not enough.
+- Prefer a targeted `query_graph_tool` call over a broad listing call.
+- Budget: about five tool calls and 800 tokens of graph output per task.
+- Read the implementation and its tests before changing code. The graph narrows scope; it does not replace the source.

package/skills/review-changes/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: review-changes
+description: Perform a structured code review using change detection and impact
+---
+
+## Review Changes
+
+Review a change set with risk scores and blast radius from the knowledge graph.
+
+### Steps
+
+1. Call `detect_changes_tool` for risk-scored changed functions, test gaps and affected flows.
+2. Call `get_affected_flows_tool` only when you need the steps of an affected flow.
+3. For each high-risk function, call `query_graph_tool` with `pattern="tests_for"` to check test coverage.
+4. Call `get_impact_radius_tool` when the blast radius is not clear from step 1.
+5. Suggest specific test cases for untested changes.
+
+### Output Format
+
+Group findings by risk level (high, medium, low). For each finding give what changed and why it matters, its test coverage, and the suggested fix. End with a merge recommendation.
+
+## Token Efficiency Rules
+- Call `get_minimal_context_tool(task="<your task>")` before any other graph tool.
+- Pass `detail_level="minimal"` wherever a tool accepts it. Use "standard" only when minimal is not enough.
+- Prefer a targeted `query_graph_tool` call over a broad listing call.
+- Budget: about five tool calls and 800 tokens of graph output per task.
+- Read the implementation and its tests before changing code. The graph narrows scope; it does not replace the source.

package/skills/review-delta/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: review-delta
+description: Review only changes since last commit using impact analysis. Token-efficient delta review with automatic blast-radius detection.
+argument-hint: "[file or function name]"
+---
+
+# Review Delta
+
+Review only the changed code and its blast radius.
+
+## Steps
+
+1. Call `get_minimal_context_tool(task="review changes")`. If it returns `status: not_ready`, call `build_or_update_graph_tool()` and continue.
+2. Call `detect_changes_tool(detail_level="minimal")` for risk-scored changed functions, test gaps and affected flows. Changes come from `git diff` against `HEAD~1`; if the argument names a file, pass it in `changed_files`.
+3. Call `get_review_context_tool(detail_level="minimal")` when you need source snippets for the changed areas and `review_guidance` (untested functions, wide blast radius, inheritance changes).
+4. For each untested high-risk function, confirm with `query_graph_tool(pattern="tests_for", target="<function>")`.
+5. Use `detail_level="standard"` only for a high-risk item the minimal output leaves unclear. Do not load whole files unless a snippet is not enough.
+
+## Report
+
+- Summary: one line
+- Risk: low, medium or high, from the blast radius
+- Issues: bugs, missing tests, style
+- Blast radius: impacted files and functions
+- Recommendations

package/skills/review-pr/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: review-pr
+description: Review a PR or branch diff using the knowledge graph for full structural context. Outputs a structured review with blast-radius analysis.
+argument-hint: "[PR number or branch name]"
+---
+
+# Review PR
+
+Review all commits of a pull request or branch against its base branch.
+
+## Steps
+
+1. Identify the changes. With a branch name run `git diff --name-only main...<branch>`; otherwise diff the current branch against `main` (or `master`). Use that ref as `base` below.
+2. Call `get_minimal_context_tool(task="review PR", base="main")`. If it returns `status: not_ready`, call `build_or_update_graph_tool()` and continue.
+3. Call `detect_changes_tool(base="main", detail_level="minimal")` for risk-scored changed functions, test gaps and affected flows across the whole branch.
+4. For high-risk functions call `query_graph_tool(pattern="callers_of", target="<function>")` and `query_graph_tool(pattern="tests_for", target="<function>")`. Flag public API changes whose callers were not updated.
+5. Call `get_review_context_tool(base="main")` for source snippets, or `get_impact_radius_tool(base="main")` for the full dependent list, only when step 3 leaves a high-risk item unclear.
+6. Read the changed source of the highest-impact files first. Do not load whole files unless the change needs it.
+
+## Output
+
+```
+## PR Review: <title>
+
+### Summary
+<1-3 sentences>
+
+### Risk
+- Overall: Low / Medium / High
+- Blast radius: <n> files, <m> functions
+- Test coverage: <covered> of <changed> changed functions
+
+### Files
+#### <path>
+- Changes: <what>
+- Impact: <who depends on it>
+- Issues: <bugs, style, concerns>
+
+### Missing Tests
+- <function> in <file>
+
+### Recommendations
+1. <action>
+```
+
+## Tips
+
+- Use `semantic_search_nodes_tool` to find related code the PR may have missed.