codedebrief 0.11.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (109) hide show
  1. codedebrief-0.11.0/.gitignore +76 -0
  2. codedebrief-0.11.0/CHANGELOG.md +299 -0
  3. codedebrief-0.11.0/CODE_OF_CONDUCT.md +10 -0
  4. codedebrief-0.11.0/CONTRIBUTING.md +77 -0
  5. codedebrief-0.11.0/LICENSE +176 -0
  6. codedebrief-0.11.0/NOTICE +9 -0
  7. codedebrief-0.11.0/PKG-INFO +426 -0
  8. codedebrief-0.11.0/README.md +378 -0
  9. codedebrief-0.11.0/SECURITY.md +15 -0
  10. codedebrief-0.11.0/frontend/src/ViewerApp.tsx +2517 -0
  11. codedebrief-0.11.0/frontend/src/codedebrief-model.ts +284 -0
  12. codedebrief-0.11.0/frontend/src/flow-detail-layout.ts +247 -0
  13. codedebrief-0.11.0/frontend/src/flowchart-layout.ts +329 -0
  14. codedebrief-0.11.0/frontend/src/index.ts +89 -0
  15. codedebrief-0.11.0/frontend/src/mount.tsx +483 -0
  16. codedebrief-0.11.0/frontend/src/react-flow-adapter.ts +83 -0
  17. codedebrief-0.11.0/frontend/src/standalone.tsx +950 -0
  18. codedebrief-0.11.0/frontend/src/viewer-layout.ts +2634 -0
  19. codedebrief-0.11.0/frontend/src/viewer-store.ts +19 -0
  20. codedebrief-0.11.0/frontend/tests/certifexp-local.test.tsx +115 -0
  21. codedebrief-0.11.0/frontend/tests/codedebrief-model.test.ts +177 -0
  22. codedebrief-0.11.0/frontend/tests/flowchart-layout.test.ts +166 -0
  23. codedebrief-0.11.0/frontend/tests/mount.test.tsx +1052 -0
  24. codedebrief-0.11.0/frontend/tests/node-builtins.d.ts +12 -0
  25. codedebrief-0.11.0/frontend/tests/standalone.test.tsx +1374 -0
  26. codedebrief-0.11.0/frontend/tests/viewer-app.test.tsx +470 -0
  27. codedebrief-0.11.0/frontend/tests/viewer-layout.test.ts +1246 -0
  28. codedebrief-0.11.0/frontend/tsconfig.json +20 -0
  29. codedebrief-0.11.0/frontend/vite.config.ts +27 -0
  30. codedebrief-0.11.0/package-lock.json +2880 -0
  31. codedebrief-0.11.0/package.json +26 -0
  32. codedebrief-0.11.0/pyproject.toml +139 -0
  33. codedebrief-0.11.0/schema/codedebrief.schema.json +449 -0
  34. codedebrief-0.11.0/src/codedebrief/__init__.py +12 -0
  35. codedebrief-0.11.0/src/codedebrief/analysis/__init__.py +16 -0
  36. codedebrief-0.11.0/src/codedebrief/analysis/common.py +527 -0
  37. codedebrief-0.11.0/src/codedebrief/analysis/discovery.py +100 -0
  38. codedebrief-0.11.0/src/codedebrief/analysis/languages/__init__.py +6 -0
  39. codedebrief-0.11.0/src/codedebrief/analysis/languages/_common.py +68 -0
  40. codedebrief-0.11.0/src/codedebrief/analysis/languages/c.py +96 -0
  41. codedebrief-0.11.0/src/codedebrief/analysis/languages/cpp.py +146 -0
  42. codedebrief-0.11.0/src/codedebrief/analysis/languages/csharp.py +137 -0
  43. codedebrief-0.11.0/src/codedebrief/analysis/languages/go.py +157 -0
  44. codedebrief-0.11.0/src/codedebrief/analysis/languages/java.py +158 -0
  45. codedebrief-0.11.0/src/codedebrief/analysis/languages/php.py +83 -0
  46. codedebrief-0.11.0/src/codedebrief/analysis/languages/ruby.py +75 -0
  47. codedebrief-0.11.0/src/codedebrief/analysis/languages/rust.py +96 -0
  48. codedebrief-0.11.0/src/codedebrief/analysis/project.py +373 -0
  49. codedebrief-0.11.0/src/codedebrief/analysis/python.py +939 -0
  50. codedebrief-0.11.0/src/codedebrief/analysis/registry.py +320 -0
  51. codedebrief-0.11.0/src/codedebrief/analysis/treesitter.py +884 -0
  52. codedebrief-0.11.0/src/codedebrief/analysis/typescript.py +1019 -0
  53. codedebrief-0.11.0/src/codedebrief/artifacts.py +49 -0
  54. codedebrief-0.11.0/src/codedebrief/cli.py +585 -0
  55. codedebrief-0.11.0/src/codedebrief/config.py +226 -0
  56. codedebrief-0.11.0/src/codedebrief/doctor.py +175 -0
  57. codedebrief-0.11.0/src/codedebrief/install.py +441 -0
  58. codedebrief-0.11.0/src/codedebrief/mcp_server.py +2720 -0
  59. codedebrief-0.11.0/src/codedebrief/model.py +189 -0
  60. codedebrief-0.11.0/src/codedebrief/py.typed +1 -0
  61. codedebrief-0.11.0/src/codedebrief/quality.py +392 -0
  62. codedebrief-0.11.0/src/codedebrief/query.py +641 -0
  63. codedebrief-0.11.0/src/codedebrief/render/__init__.py +6 -0
  64. codedebrief-0.11.0/src/codedebrief/render/assets/generated/codedebrief-viewer-runtime.iife.js +10 -0
  65. codedebrief-0.11.0/src/codedebrief/render/assets/panels.js +462 -0
  66. codedebrief-0.11.0/src/codedebrief/render/assets/shell.js +1649 -0
  67. codedebrief-0.11.0/src/codedebrief/render/assets/styles.css +1715 -0
  68. codedebrief-0.11.0/src/codedebrief/render/assets/tree.js +616 -0
  69. codedebrief-0.11.0/src/codedebrief/render/html.py +191 -0
  70. codedebrief-0.11.0/src/codedebrief/render/markdown.py +153 -0
  71. codedebrief-0.11.0/src/codedebrief/render/payload.py +326 -0
  72. codedebrief-0.11.0/src/codedebrief/render/snapshot.py +769 -0
  73. codedebrief-0.11.0/src/codedebrief/util.py +65 -0
  74. codedebrief-0.11.0/src/codedebrief/validation.py +214 -0
  75. codedebrief-0.11.0/tests/test_artifacts_query_install.py +446 -0
  76. codedebrief-0.11.0/tests/test_c_rust.py +175 -0
  77. codedebrief-0.11.0/tests/test_call_resolver.py +342 -0
  78. codedebrief-0.11.0/tests/test_certifexp_local.py +50 -0
  79. codedebrief-0.11.0/tests/test_cli.py +380 -0
  80. codedebrief-0.11.0/tests/test_cross_flow_foundation.py +98 -0
  81. codedebrief-0.11.0/tests/test_csharp_php.py +152 -0
  82. codedebrief-0.11.0/tests/test_discovery.py +148 -0
  83. codedebrief-0.11.0/tests/test_doctor.py +51 -0
  84. codedebrief-0.11.0/tests/test_domain_modeling.py +50 -0
  85. codedebrief-0.11.0/tests/test_go.py +213 -0
  86. codedebrief-0.11.0/tests/test_ir_foundation.py +223 -0
  87. codedebrief-0.11.0/tests/test_is_test_classification.py +99 -0
  88. codedebrief-0.11.0/tests/test_java.py +153 -0
  89. codedebrief-0.11.0/tests/test_javascript.py +66 -0
  90. codedebrief-0.11.0/tests/test_markdown_render.py +115 -0
  91. codedebrief-0.11.0/tests/test_match_dispatch.py +90 -0
  92. codedebrief-0.11.0/tests/test_mcp.py +795 -0
  93. codedebrief-0.11.0/tests/test_packaging.py +19 -0
  94. codedebrief-0.11.0/tests/test_project.py +62 -0
  95. codedebrief-0.11.0/tests/test_python_analyzer.py +402 -0
  96. codedebrief-0.11.0/tests/test_quality.py +136 -0
  97. codedebrief-0.11.0/tests/test_query.py +84 -0
  98. codedebrief-0.11.0/tests/test_query_consumption.py +14 -0
  99. codedebrief-0.11.0/tests/test_query_ranking.py +430 -0
  100. codedebrief-0.11.0/tests/test_registry.py +398 -0
  101. codedebrief-0.11.0/tests/test_render_html.py +421 -0
  102. codedebrief-0.11.0/tests/test_render_payload.py +344 -0
  103. codedebrief-0.11.0/tests/test_robustness.py +219 -0
  104. codedebrief-0.11.0/tests/test_ruby.py +62 -0
  105. codedebrief-0.11.0/tests/test_scopes.py +66 -0
  106. codedebrief-0.11.0/tests/test_self_exclude.py +62 -0
  107. codedebrief-0.11.0/tests/test_semantic_precision.py +69 -0
  108. codedebrief-0.11.0/tests/test_snapshots.py +103 -0
  109. codedebrief-0.11.0/tests/test_typescript_analyzer.py +211 -0
@@ -0,0 +1,76 @@
1
+ # OS/editor noise
2
+ .DS_Store
3
+ Thumbs.db
4
+ .idea/
5
+ .vscode/
6
+
7
+ # Secrets and local environment files
8
+ .env
9
+ .env.*
10
+ !.env.example
11
+ .envrc
12
+ .env.codedebrief
13
+
14
+ # Python environments, caches, and build output
15
+ .venv/
16
+ venv/
17
+ env/
18
+ ENV/
19
+ __pycache__/
20
+ *.py[cod]
21
+ *$py.class
22
+ .pytest_cache/
23
+ .mypy_cache/
24
+ .ruff_cache/
25
+ .tox/
26
+ .nox/
27
+ .hypothesis/
28
+ .pyre/
29
+ .pytype/
30
+ .coverage
31
+ .coverage.*
32
+ htmlcov/
33
+ dist/
34
+ build/
35
+ *.egg-info/
36
+ pip-wheel-metadata/
37
+
38
+ # Node/frontend dependencies and build output
39
+ node_modules/
40
+ .next/
41
+ .nuxt/
42
+ .svelte-kit/
43
+ .vite/
44
+ .turbo/
45
+ coverage/
46
+ npm-debug.log*
47
+ yarn-debug.log*
48
+ yarn-error.log*
49
+ pnpm-debug.log*
50
+
51
+ # Logs
52
+ *.log
53
+
54
+ # Local agent/client configuration
55
+ .claude/
56
+ .codex/
57
+ .agents/skills/
58
+ .gemini/settings.json
59
+ .gemini/skills/
60
+ .mcp.json
61
+ .cursor/mcp.json
62
+
63
+ # Local analysis state and generated browser view
64
+ .codedebrief/
65
+ .logicchart/
66
+ **/codedebrief-out/codedebrief.html
67
+ **/codedebrief-out/*/
68
+ **/logicchart-out/
69
+ **/logic-flow.html
70
+
71
+ # Local examples and real-world fixtures
72
+ examples/
73
+
74
+ # Private local real-world fixture. Keep it available for local smoke tests, but
75
+ # never publish its source, generated artifacts, caches, or nested repository data.
76
+ examples/Certifexp/
@@ -0,0 +1,299 @@
1
+ # Changelog
2
+
3
+ All notable changes to CodeDebrief will be documented in this file.
4
+
5
+ The project follows Semantic Versioning.
6
+
7
+ ## Unreleased
8
+
9
+ ## 0.11.0 - 2026-06-21
10
+
11
+ ### Added
12
+
13
+ - Added a README preview image that shows the kind of source-backed visual workflow a
14
+ coding agent can present from CodeDebrief artifacts.
15
+
16
+ ### Changed
17
+
18
+ - Renamed the project, Python package, CLI, MCP server, generated artifacts, viewer runtime,
19
+ and documentation surface to CodeDebrief.
20
+ - Made `examples/` local-only and ignored; the committed dogfood artifact now maps
21
+ `src/codedebrief` instead of relying on tracked demo/shop fixtures.
22
+
23
+ ## 0.10.0 - 2026-06-21
24
+
25
+ ### Changed
26
+
27
+ - Reoriented CodeDebrief around code-logic comprehension instead of review findings:
28
+ MCP workflow slices, agent instructions, Markdown artifacts, and the generated viewer
29
+ now emphasize deterministic flows, decisions, calls, source anchors, visual snapshots,
30
+ and manual exploration through `codedebrief view`.
31
+ - Moved MCP into the default runtime install so release and source-checkout installs include
32
+ the primary agent surface without requiring an optional extra.
33
+ - Updated `codedebrief setup-agent codex|claude|gemini|cursor` so setup writes only the
34
+ requested target's instruction, skill, and MCP files.
35
+ - Added Gemini CLI / Antigravity parity for `setup-agent gemini`: it now writes the
36
+ provider-native CodeDebrief skill and project-scoped `.gemini/settings.json` MCP config,
37
+ including the same Mermaid artifact guidance used by Claude when inline rendering is not
38
+ available.
39
+ - Updated agent guidance so visual workflow answers use the deterministic
40
+ `workflow_slice.presentation.canonical_visual.diagram` first, persist Mermaid `.mmd` /
41
+ Markdown artifacts for clients without inline Mermaid rendering, avoid long raw Mermaid
42
+ code blocks as the primary visual, and reserve SVG snapshots for explicit SVG or
43
+ local-inspection requests.
44
+ - Replaced standalone LLM/viewer docs with the README, generated agent instructions, and
45
+ `CONTRIBUTING.md` as the maintained public guidance surfaces.
46
+
47
+ ### Added
48
+
49
+ - Added `workflow_slice` to MCP `agent_context`, with stable slice handles, ordered
50
+ workflow steps, primary/supporting flows, decisions, calls, domain logic, source ranges,
51
+ visual handles, omissions, guardrails, and next-tool hints.
52
+ - Added MCP `expand_slice`, `workflow_path`, `snapshot_slice`, `explain_flow`,
53
+ `explain_node`, and `explain_edge` for progressive workflow-slice navigation and focused
54
+ source-grounded inspection.
55
+ - Added deterministic visual presentation metadata for workflow slices, including stable
56
+ top-to-bottom Mermaid output, `diagram_hash`, viewer targets, local `.mmd` / Markdown
57
+ snapshot artifacts, and legacy SVG/HTML artifacts for local inspection.
58
+ - Added analyzer quality, skipped-file, language-capability, and parse-warning metadata for
59
+ comprehension-oriented validation and viewer summaries.
60
+
61
+ ### Removed
62
+
63
+ - Removed the public CLI surface for `query`, `impact`, `explain`, `navigate`, and
64
+ `snapshot`; those deterministic capabilities remain internal/MCP-only.
65
+ - Removed `analyze`, `init`, `install`, `llm`, and `enrich` from the public CLI surface;
66
+ `update` owns refresh/full analysis and `setup-agent` owns initialization and agent
67
+ setup.
68
+ - Removed dead internal finding detector modules, diagnostic helpers, gated detector
69
+ configuration, detector-only tests, and obsolete example expected-finding docs.
70
+ - Removed dead provider-managed LLM enrichment code and provider/model configuration.
71
+ - Removed `docs/llm.md`, `docs/viewer.md`, and the obsolete viewer screenshot asset now
72
+ covered by the README and generated agent/setup guidance.
73
+ - Removed findings/review queues from the generated viewer and public MCP workflow path.
74
+ - Removed the legacy `findings` artifact field and moved the canonical model schema to
75
+ `2.0`.
76
+
77
+ ### Fixed
78
+
79
+ - Fixed visual workflow guidance so repeated chat requests prefer vertical/top-to-bottom
80
+ deterministic visuals and offer language-friendly or expanded follow-ups without
81
+ changing graph facts.
82
+ - Fixed stale docs and examples that still described CodeDebrief as a review-signal or
83
+ detector product.
84
+
85
+ ## 0.8.0 - 2026-06-17
86
+
87
+ ### Added
88
+
89
+ - Added dedicated viewer documentation covering the progressive flowchart product shape,
90
+ the static and React runtime split, layout invariants, and browser verification loop.
91
+ - Added React-viewer viewport panning with reset coverage in the frontend test suite.
92
+
93
+ ### Changed
94
+
95
+ - Clarified README and contributor instructions for the framework-backed viewer runtime,
96
+ generated runtime bundle, cache-busted browser checks, and viewer-specific gates.
97
+
98
+ ### Fixed
99
+
100
+ - Fixed the React viewer so clicking empty canvas space clears selected connections, and
101
+ dimmed scope-entry links now fade consistently with dimmed canvas nodes.
102
+
103
+ ## 0.7.0 - 2026-06-16
104
+
105
+ ### Added
106
+
107
+ - Added PNG and JPG export buttons for the currently visible flowchart canvas.
108
+ - Added session-local drag positioning for scope, flow, and inline decision blocks, with
109
+ reset restoring the automatic progressive layout.
110
+
111
+ ### Changed
112
+
113
+ - Reworked the viewer canvas toward a single progressive flowchart: scopes expand into
114
+ entrypoint/call rows, selected decision charts unfold in that same route, and selected
115
+ links highlight their source and target while unrelated blocks dim.
116
+ - Unified scope nodes with the rest of the canvas block styling so top-level areas do not
117
+ read as a separate visual component family.
118
+
119
+ ## 0.6.2 - 2026-06-16
120
+
121
+ ### Changed
122
+
123
+ - Updated the HTML viewer so expanding a scope keeps the whole codebase map visible while
124
+ drawing the active scope's files and flows in place.
125
+ - Added folder/file path focus in the viewer (`#path=...`) so clicking a tree folder
126
+ highlights the matching canvas area without losing global context.
127
+
128
+ ## 0.6.1 - 2026-06-16
129
+
130
+ ### Fixed
131
+
132
+ - Fixed Markdown report rendering for enum-backed finding kinds so reports show public
133
+ values such as `missing_branch` instead of Python enum names.
134
+
135
+ ## 0.6.0 - 2026-06-16
136
+
137
+ ### Added
138
+
139
+ - Added C++ control-flow support for `.cc`, `.cpp`, `.cxx`, `.hh`, `.hpp`, `.hxx`, `.ipp`,
140
+ and `.tpp` files.
141
+
142
+ ### Changed
143
+
144
+ - Improved large-codebase defaults by excluding more common dependency caches, build output,
145
+ and generated-code patterns during discovery.
146
+ - Refined the HTML viewer for broad codebase study with scope/file finding density, a
147
+ responsive details-panel toggle, and an empty state for tree search/filter misses.
148
+ - Restructured the README around project purpose, quick start, scale behavior, viewer usage,
149
+ and supported languages.
150
+
151
+ ## 0.5.0 - 2026-06-16
152
+
153
+ ### Added
154
+
155
+ - Added `codedebrief doctor` to check the active installation, parser grammar imports, and
156
+ repair command for stale editable installs.
157
+
158
+ ### Fixed
159
+
160
+ - Fixed analysis robustness when a lazy language grammar is missing from the active Python
161
+ environment: affected files are now reported as skipped instead of aborting the whole run.
162
+ - Fixed `codedebrief --version` so it follows installed package metadata instead of a stale
163
+ duplicated constant.
164
+
165
+ ## 0.4.1 - 2026-06-16
166
+
167
+ ### Fixed
168
+
169
+ - Fixed packaged `codedebrief validate` so installed wheels include and load the bundled JSON
170
+ Schema outside the source checkout.
171
+
172
+ ## 0.4.0 - 2026-06-16
173
+
174
+ ### Added
175
+
176
+ - Added built-in analysis profiles for the public demo artifact, CodeDebrief self-analysis,
177
+ and a whole-checkout project map without overwriting each other.
178
+ - Added `codedebrief validate`, artifact/schema registry validation, and optional full
179
+ source sync checks for local CI and agent workflows.
180
+ - Added richer query filters and ranking signals (`--language`, `--finding-kind`, scope,
181
+ language, path, decision metadata, and finding text).
182
+ - Added MCP agent tools for prioritized review queues, compact context packs, and artifact
183
+ validation.
184
+ - Added optional `codedebrief install --mcp-config ...` project MCP config generation and
185
+ server instructions for agent workflow guidance.
186
+ - Added viewer flow search and a prioritized review queue in the review-signals panel.
187
+ - Clarified the earlier CLI/MCP agent workflow in the README.
188
+
189
+ ### Changed
190
+
191
+ - Simplified the README Quick Start to the two commands needed for first success:
192
+ `codedebrief analyze --full` and `codedebrief view`.
193
+ - Updated public/package positioning around local-first decision flowcharts for humans and
194
+ coding agents.
195
+ - Removed internal planning/design documents from `docs/`, keeping the public repository
196
+ focused on end-user documentation and README assets.
197
+
198
+ ### Removed
199
+
200
+ - Removed Terraform/HCL support.
201
+ - Removed the `diff` (CI gate) and `hook` (git auto-sync) commands; both are tracked as planned future evolutions.
202
+
203
+ ## 0.3.0
204
+
205
+ Major capability expansion: from a Python/TypeScript analyzer to a polyglot,
206
+ whole-codebase one - 10 control-flow languages plus Terraform, organized by macro-part.
207
+
208
+ ### Languages
209
+
210
+ - Profile-driven tree-sitter engine: a new control-flow language is a `LanguageProfile`
211
+ (grammar vocabulary + a few extractors), not a bespoke analyzer.
212
+ - Added Go, Java, C#, PHP, C, Rust, and Ruby alongside the existing Python and
213
+ TypeScript/JavaScript analyzers - 10 control-flow languages in all.
214
+ - Terraform/HCL support: each `resource` / `module` / `data` / `variable` / `output` block
215
+ becomes a flow and each reference (`aws_vpc.main.id`, `depends_on`) becomes a dependency
216
+ edge, so the IR carries a resource dependency graph.
217
+ - Pluggable language registry keyed by file suffix, with lazy grammar loading.
218
+ - Rust `match` is treated as compiler-exhaustive: a missing `_` arm is no longer flagged as
219
+ a missing fallback.
220
+
221
+ ### Whole codebase and scopes
222
+
223
+ - Macro-part scopes: declare `[codedebrief.scopes]` (or fall back to the inferred top-level
224
+ directory) so one model can be viewed whole or restricted to backend/frontend/infra.
225
+ - `--scope` on `query` and `impact`; scope and language filters in the viewer.
226
+ - Every flow records the scope(s) it belongs to; the Markdown header summarizes the
227
+ per-scope breakdown.
228
+
229
+ ### Viewer
230
+
231
+ - UI refresh: a new logo - a blue entry-node circle, a violet connector, and an amber
232
+ decision diamond in three solid colors with clear spacing (and a matching favicon); a
233
+ light/dark theme toggle (remembered across sessions); refined palette; node hover and
234
+ shadow states; selecting a block now highlights it and its connected edges while dimming
235
+ the rest; and the legend now includes the cyan "outcome" (terminal) node color it was
236
+ missing.
237
+
238
+ ### Examples & fixes
239
+
240
+ - `examples/demo` is now a polyglot "users & orders" platform spanning all 10
241
+ control-flow languages plus Terraform/HCL across backend/frontend/edge/infra scopes.
242
+ - `analyze` summary wording: "{n} finding(s)" instead of the earlier hybrid review
243
+ wording.
244
+
245
+ ## 0.2.1
246
+
247
+ - Interactive viewer: drag any block to rearrange the flowchart by hand; connected edges
248
+ re-route live, hand-placed positions persist per flow, and reset restores the auto layout.
249
+ - README rewritten for clarity: sharper scope, a runnable 30-second example, an outcome-
250
+ focused "Why", a per-command reference with real output, explicit limitations, and the
251
+ agent/MCP integrations moved to an "Advanced" section.
252
+
253
+ ## 0.2.0
254
+
255
+ First tagged release. A deterministic, local, no-API-key static analyzer that turns
256
+ Python and TypeScript source into a versioned logical model plus reviewable
257
+ flowcharts, with evidence-tiered findings (`VERIFIED` / `INFERRED` / `POTENTIAL_GAP`).
258
+
259
+ ### Analysis & IR
260
+
261
+ - Deterministic Python (AST) and TypeScript/TSX (tree-sitter) analyzers producing one
262
+ canonical `codedebrief.json` model (schema 1.1).
263
+ - Framework adapters: FastAPI routes; Next.js route handlers, middleware, server
264
+ actions, pages, and layouts; shallow React components, hooks, and event handlers;
265
+ public/exported functions, CLI commands, and tests.
266
+ - IR enrichment: per-branch outcomes, decision identity (subject/operator/negation/
267
+ value namespace), reachability, side-effect tags, declared enum/union value tables,
268
+ module-level constants, and stable structural finding ids.
269
+ - Import-aware call resolver with `module:symbol` boundary preservation, longest-prefix
270
+ module resolution, submodule-import binding, and per-call link confidence.
271
+
272
+ ### Detectors (11, evidence-tiered)
273
+
274
+ - Single-flow: `missing_branch`, `dead_code`, `broad_except_swallow` (empty **or**
275
+ log-only handlers), `no_op_branch`, `asymmetric_return`, `dead_guard`.
276
+ - Cross-flow: `inconsistent_case_handling` (quorum-aware), `enum_exhaustiveness`,
277
+ `outcome_inconsistency` (HTTP status-aware), `logging_asymmetry`.
278
+ - Gated (opt-in via `gated_detectors`): `auth_divergence`.
279
+
280
+ ### Surfaces
281
+
282
+ - CLI: `init`, `analyze` (`--full`, `--include-gaps`), `update`, `impact`, `query`,
283
+ `view`, `install`, `hook` (install/uninstall/status), `mcp`, and `diff`.
284
+ - CI diff gate: `diff` compares two models by stable finding id and emits a GitHub
285
+ Markdown summary and SARIF (stable `partialFingerprints`), with `--fail-on-introduced`.
286
+ - Markdown report with a signal/noise split - `VERIFIED`/`INFERRED` in the main
287
+ section, `POTENTIAL_GAP` folded under a collapsible review-only block (`--include-gaps`
288
+ to expand) - plus injection-safe escaping of source-derived finding text.
289
+ - Interactive local HTML viewer.
290
+ - MCP server with 11 tools and a `token_budget` cap on every query/list tool.
291
+ - Agent instruction installer (`AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, Cursor rules) and
292
+ managed git auto-sync hooks with a `merge=union` driver for `codedebrief.json`.
293
+
294
+ ### Robustness
295
+
296
+ - Incremental content-hash cache with per-file analysis.
297
+ - Per-file parse isolation: an un-parseable or non-UTF-8 file is skipped and reported
298
+ in `skipped_files` rather than aborting the whole run.
299
+ - Malformed `codedebrief.json` is rejected with a clean error instead of a raw traceback.
@@ -0,0 +1,10 @@
1
+ # Code of Conduct
2
+
3
+ CodeDebrief contributors are expected to communicate respectfully, focus criticism on the
4
+ work, and make participation safe for people of different backgrounds and experience levels.
5
+
6
+ Harassment, personal attacks, discriminatory language, and deliberate disruption are not
7
+ acceptable. Maintainers may edit or remove contributions and restrict participation when
8
+ needed to protect the community.
9
+
10
+ Report conduct concerns privately to the project maintainers.
@@ -0,0 +1,77 @@
1
+ # Contributing to CodeDebrief
2
+
3
+ CodeDebrief welcomes bug reports, language fixtures, framework adapters, documentation, and
4
+ code contributions.
5
+
6
+ ## Development Setup
7
+
8
+ ```bash
9
+ uv sync --extra dev
10
+ uv run pytest
11
+ ```
12
+
13
+ Viewer UI/layout work also uses the frontend workspace:
14
+
15
+ ```bash
16
+ npm install
17
+ npm run viewer:typecheck
18
+ npm run viewer:test
19
+ npm run viewer:build
20
+ ```
21
+
22
+ `npm run viewer:build` writes the offline React runtime to
23
+ `src/codedebrief/render/assets/generated/codedebrief-viewer-runtime.iife.js`; regenerate the
24
+ local HTML before browser checks and open it with `?runtime=react` when testing the typed
25
+ canvas path.
26
+
27
+ Viewer changes should preserve the manual exploration invariants: scope nodes use the same
28
+ node styling family as other blocks, each scope connects to all visible entrypoints,
29
+ expanded details reserve layout space before rendering, selected links dim unrelated
30
+ blocks, and invisible hit paths never become visible bounding boxes.
31
+
32
+ The recommended viewer loop is:
33
+
34
+ ```bash
35
+ npm run viewer:typecheck
36
+ npm run viewer:test
37
+ npm run viewer:build
38
+ UV_CACHE_DIR=/tmp/codedebrief-uv-cache uv run codedebrief update
39
+ UV_CACHE_DIR=/tmp/codedebrief-uv-cache uv run codedebrief view --render-only --no-open
40
+ ```
41
+
42
+ Use a cache-buster when reloading the generated viewer in a browser:
43
+
44
+ ```text
45
+ codedebrief.html?runtime=react&v=<stamp>
46
+ ```
47
+
48
+ Before submitting a pull request:
49
+
50
+ ```bash
51
+ uv run ruff check .
52
+ uv run ruff format --check .
53
+ uv run mypy
54
+ uv run pytest --cov
55
+ npm run viewer:typecheck
56
+ npm run viewer:test
57
+ npm run viewer:build
58
+ npm audit --audit-level=high
59
+ ```
60
+
61
+ ## Analyzer Changes
62
+
63
+ Every analyzer change should include a minimal source fixture and assertions for:
64
+
65
+ - detected entry points;
66
+ - decision nodes and branch labels;
67
+ - source locations;
68
+ - evidence level;
69
+ - call metadata and domain metadata when the fixture exercises them.
70
+
71
+ Keep language-specific extraction separate from the shared logical IR. Framework knowledge
72
+ belongs in a focused adapter or classifier, not in the renderer.
73
+
74
+ ## Compatibility
75
+
76
+ CodeDebrief supports Python 3.10 and later. Avoid changing the canonical JSON schema without
77
+ updating `schema_version`, migration notes, and serialization tests.
@@ -0,0 +1,176 @@
1
+ Apache License
2
+ Version 2.0, January 2004
3
+ http://www.apache.org/licenses/
4
+
5
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6
+
7
+ 1. Definitions.
8
+
9
+ "License" shall mean the terms and conditions for use, reproduction,
10
+ and distribution as defined by Sections 1 through 9 of this document.
11
+
12
+ "Licensor" shall mean the copyright owner or entity authorized by
13
+ the copyright owner that is granting the License.
14
+
15
+ "Legal Entity" shall mean the union of the acting entity and all
16
+ other entities that control, are controlled by, or are under common
17
+ control with that entity. For the purposes of this definition,
18
+ "control" means (i) the power, direct or indirect, to cause the
19
+ direction or management of such entity, whether by contract or
20
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
21
+ outstanding shares, or (iii) beneficial ownership of such entity.
22
+
23
+ "You" (or "Your") shall mean an individual or Legal Entity
24
+ exercising permissions granted by this License.
25
+
26
+ "Source" form shall mean the preferred form for making modifications,
27
+ including but not limited to software source code, documentation
28
+ source, and configuration files.
29
+
30
+ "Object" form shall mean any form resulting from mechanical
31
+ transformation or translation of a Source form, including but
32
+ not limited to compiled object code, generated documentation,
33
+ and conversions to other media types.
34
+
35
+ "Work" shall mean the work of authorship, whether in Source or
36
+ Object form, made available under the License, as indicated by a
37
+ copyright notice that is included in or attached to the work
38
+ (an example is provided in the Appendix below).
39
+
40
+ "Derivative Works" shall mean any work, whether in Source or Object
41
+ form, that is based on (or derived from) the Work and for which the
42
+ editorial revisions, annotations, elaborations, or other modifications
43
+ represent, as a whole, an original work of authorship. For the purposes
44
+ of this License, Derivative Works shall not include works that remain
45
+ separable from, or merely link (or bind by name) to the interfaces of,
46
+ the Work and Derivative Works thereof.
47
+
48
+ "Contribution" shall mean any work of authorship, including
49
+ the original version of the Work and any modifications or additions
50
+ to that Work or Derivative Works thereof, that is intentionally
51
+ submitted to Licensor for inclusion in the Work by the copyright owner
52
+ or by an individual or Legal Entity authorized to submit on behalf of
53
+ the copyright owner. For the purposes of this definition, "submitted"
54
+ means any form of electronic, verbal, or written communication sent
55
+ to the Licensor or its representatives, including but not limited to
56
+ communication on electronic mailing lists, source code control systems,
57
+ and issue tracking systems that are managed by, or on behalf of, the
58
+ Licensor for the purpose of discussing and improving the Work, but
59
+ excluding communication that is conspicuously marked or otherwise
60
+ designated in writing by the copyright owner as "Not a Contribution."
61
+
62
+ "Contributor" shall mean Licensor and any individual or Legal Entity
63
+ on behalf of whom a Contribution has been received by Licensor and
64
+ subsequently incorporated within the Work.
65
+
66
+ 2. Grant of Copyright License. Subject to the terms and conditions of
67
+ this License, each Contributor hereby grants to You a perpetual,
68
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
69
+ copyright license to reproduce, prepare Derivative Works of,
70
+ publicly display, publicly perform, sublicense, and distribute the
71
+ Work and such Derivative Works in Source or Object form.
72
+
73
+ 3. Grant of Patent License. Subject to the terms and conditions of
74
+ this License, each Contributor hereby grants to You a perpetual,
75
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
76
+ (except as stated in this section) patent license to make, have made,
77
+ use, offer to sell, sell, import, and otherwise transfer the Work,
78
+ where such license applies only to those patent claims licensable
79
+ by such Contributor that are necessarily infringed by their
80
+ Contribution(s) alone or by combination of their Contribution(s)
81
+ with the Work to which such Contribution(s) was submitted. If You
82
+ institute patent litigation against any entity (including a
83
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
84
+ or a Contribution incorporated within the Work constitutes direct
85
+ or contributory patent infringement, then any patent licenses
86
+ granted to You under this License for that Work shall terminate
87
+ as of the date such litigation is filed.
88
+
89
+ 4. Redistribution. You may reproduce and distribute copies of the
90
+ Work or Derivative Works thereof in any medium, with or without
91
+ modifications, and in Source or Object form, provided that You
92
+ meet the following conditions:
93
+
94
+ (a) You must give any other recipients of the Work or
95
+ Derivative Works a copy of this License; and
96
+
97
+ (b) You must cause any modified files to carry prominent notices
98
+ stating that You changed the files; and
99
+
100
+ (c) You must retain, in the Source form of any Derivative Works
101
+ that You distribute, all copyright, patent, trademark, and
102
+ attribution notices from the Source form of the Work,
103
+ excluding those notices that do not pertain to any part of
104
+ the Derivative Works; and
105
+
106
+ (d) If the Work includes a "NOTICE" text file as part of its
107
+ distribution, then any Derivative Works that You distribute must
108
+ include a readable copy of the attribution notices contained
109
+ within such NOTICE file, excluding those notices that do not
110
+ pertain to any part of the Derivative Works, in at least one
111
+ of the following places: within a NOTICE text file distributed
112
+ as part of the Derivative Works; within the Source form or
113
+ documentation, if provided along with the Derivative Works; or,
114
+ within a display generated by the Derivative Works, if and
115
+ wherever such third-party notices normally appear. The contents
116
+ of the NOTICE file are for informational purposes only and
117
+ do not modify the License. You may add Your own attribution
118
+ notices within Derivative Works that You distribute, alongside
119
+ or as an addendum to the NOTICE text from the Work, provided
120
+ that such additional attribution notices cannot be construed
121
+ as modifying the License.
122
+
123
+ You may add Your own copyright statement to Your modifications and
124
+ may provide additional or different license terms and conditions
125
+ for use, reproduction, or distribution of Your modifications, or
126
+ for any such Derivative Works as a whole, provided Your use,
127
+ reproduction, and distribution of the Work otherwise complies with
128
+ the conditions stated in this License.
129
+
130
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
131
+ any Contribution intentionally submitted for inclusion in the Work
132
+ by You to the Licensor shall be under the terms and conditions of
133
+ this License, without any additional terms or conditions.
134
+ Notwithstanding the above, nothing herein shall supersede or modify
135
+ the terms of any separate license agreement you may have executed
136
+ with Licensor regarding such Contributions.
137
+
138
+ 6. Trademarks. This License does not grant permission to use the trade
139
+ names, trademarks, service marks, or product names of the Licensor,
140
+ except as required for reasonable and customary use in describing the
141
+ origin of the Work and reproducing the content of the NOTICE file.
142
+
143
+ 7. Disclaimer of Warranty. Unless required by applicable law or
144
+ agreed to in writing, Licensor provides the Work (and each
145
+ Contributor provides its Contributions) on an "AS IS" BASIS,
146
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147
+ implied, including, without limitation, any warranties or conditions
148
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149
+ PARTICULAR PURPOSE. You are solely responsible for determining the
150
+ appropriateness of using or redistributing the Work and assume any
151
+ risks associated with Your exercise of permissions under this License.
152
+
153
+ 8. Limitation of Liability. In no event and under no legal theory,
154
+ whether in tort (including negligence), contract, or otherwise,
155
+ unless required by applicable law (such as deliberate and grossly
156
+ negligent acts) or agreed to in writing, shall any Contributor be
157
+ liable to You for damages, including any direct, indirect, special,
158
+ incidental, or consequential damages of any character arising as a
159
+ result of this License or out of the use or inability to use the
160
+ Work (including but not limited to damages for loss of goodwill,
161
+ work stoppage, computer failure or malfunction, or any and all
162
+ other commercial damages or losses), even if such Contributor
163
+ has been advised of the possibility of such damages.
164
+
165
+ 9. Accepting Warranty or Additional Liability. While redistributing
166
+ the Work or Derivative Works thereof, You may choose to offer,
167
+ and charge a fee for, acceptance of support, warranty, indemnity,
168
+ or other liability obligations and/or rights consistent with this
169
+ License. However, in accepting such obligations, You may act only
170
+ on Your own behalf and on Your sole responsibility, not on behalf
171
+ of any other Contributor, and only if You agree to indemnify,
172
+ defend, and hold each Contributor harmless for any liability
173
+ incurred by, or claims asserted against, such Contributor by reason
174
+ of your accepting any such warranty or additional liability.
175
+
176
+ END OF TERMS AND CONDITIONS
@@ -0,0 +1,9 @@
1
+ CodeDebrief
2
+ Copyright 2026 Ferdinando Bonsegna
3
+
4
+ Created and maintained by Ferdinando Bonsegna.
5
+ https://github.com/ferdinandobons/CodeDebrief
6
+
7
+ Licensed under the Apache License, Version 2.0 (see the LICENSE file). If you
8
+ redistribute CodeDebrief or a work derived from it, you must retain this NOTICE
9
+ file and the attribution above, per Section 4(d) of the License.