codedebrief 0.11.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- codedebrief-0.11.0/.gitignore +76 -0
- codedebrief-0.11.0/CHANGELOG.md +299 -0
- codedebrief-0.11.0/CODE_OF_CONDUCT.md +10 -0
- codedebrief-0.11.0/CONTRIBUTING.md +77 -0
- codedebrief-0.11.0/LICENSE +176 -0
- codedebrief-0.11.0/NOTICE +9 -0
- codedebrief-0.11.0/PKG-INFO +426 -0
- codedebrief-0.11.0/README.md +378 -0
- codedebrief-0.11.0/SECURITY.md +15 -0
- codedebrief-0.11.0/frontend/src/ViewerApp.tsx +2517 -0
- codedebrief-0.11.0/frontend/src/codedebrief-model.ts +284 -0
- codedebrief-0.11.0/frontend/src/flow-detail-layout.ts +247 -0
- codedebrief-0.11.0/frontend/src/flowchart-layout.ts +329 -0
- codedebrief-0.11.0/frontend/src/index.ts +89 -0
- codedebrief-0.11.0/frontend/src/mount.tsx +483 -0
- codedebrief-0.11.0/frontend/src/react-flow-adapter.ts +83 -0
- codedebrief-0.11.0/frontend/src/standalone.tsx +950 -0
- codedebrief-0.11.0/frontend/src/viewer-layout.ts +2634 -0
- codedebrief-0.11.0/frontend/src/viewer-store.ts +19 -0
- codedebrief-0.11.0/frontend/tests/certifexp-local.test.tsx +115 -0
- codedebrief-0.11.0/frontend/tests/codedebrief-model.test.ts +177 -0
- codedebrief-0.11.0/frontend/tests/flowchart-layout.test.ts +166 -0
- codedebrief-0.11.0/frontend/tests/mount.test.tsx +1052 -0
- codedebrief-0.11.0/frontend/tests/node-builtins.d.ts +12 -0
- codedebrief-0.11.0/frontend/tests/standalone.test.tsx +1374 -0
- codedebrief-0.11.0/frontend/tests/viewer-app.test.tsx +470 -0
- codedebrief-0.11.0/frontend/tests/viewer-layout.test.ts +1246 -0
- codedebrief-0.11.0/frontend/tsconfig.json +20 -0
- codedebrief-0.11.0/frontend/vite.config.ts +27 -0
- codedebrief-0.11.0/package-lock.json +2880 -0
- codedebrief-0.11.0/package.json +26 -0
- codedebrief-0.11.0/pyproject.toml +139 -0
- codedebrief-0.11.0/schema/codedebrief.schema.json +449 -0
- codedebrief-0.11.0/src/codedebrief/__init__.py +12 -0
- codedebrief-0.11.0/src/codedebrief/analysis/__init__.py +16 -0
- codedebrief-0.11.0/src/codedebrief/analysis/common.py +527 -0
- codedebrief-0.11.0/src/codedebrief/analysis/discovery.py +100 -0
- codedebrief-0.11.0/src/codedebrief/analysis/languages/__init__.py +6 -0
- codedebrief-0.11.0/src/codedebrief/analysis/languages/_common.py +68 -0
- codedebrief-0.11.0/src/codedebrief/analysis/languages/c.py +96 -0
- codedebrief-0.11.0/src/codedebrief/analysis/languages/cpp.py +146 -0
- codedebrief-0.11.0/src/codedebrief/analysis/languages/csharp.py +137 -0
- codedebrief-0.11.0/src/codedebrief/analysis/languages/go.py +157 -0
- codedebrief-0.11.0/src/codedebrief/analysis/languages/java.py +158 -0
- codedebrief-0.11.0/src/codedebrief/analysis/languages/php.py +83 -0
- codedebrief-0.11.0/src/codedebrief/analysis/languages/ruby.py +75 -0
- codedebrief-0.11.0/src/codedebrief/analysis/languages/rust.py +96 -0
- codedebrief-0.11.0/src/codedebrief/analysis/project.py +373 -0
- codedebrief-0.11.0/src/codedebrief/analysis/python.py +939 -0
- codedebrief-0.11.0/src/codedebrief/analysis/registry.py +320 -0
- codedebrief-0.11.0/src/codedebrief/analysis/treesitter.py +884 -0
- codedebrief-0.11.0/src/codedebrief/analysis/typescript.py +1019 -0
- codedebrief-0.11.0/src/codedebrief/artifacts.py +49 -0
- codedebrief-0.11.0/src/codedebrief/cli.py +585 -0
- codedebrief-0.11.0/src/codedebrief/config.py +226 -0
- codedebrief-0.11.0/src/codedebrief/doctor.py +175 -0
- codedebrief-0.11.0/src/codedebrief/install.py +441 -0
- codedebrief-0.11.0/src/codedebrief/mcp_server.py +2720 -0
- codedebrief-0.11.0/src/codedebrief/model.py +189 -0
- codedebrief-0.11.0/src/codedebrief/py.typed +1 -0
- codedebrief-0.11.0/src/codedebrief/quality.py +392 -0
- codedebrief-0.11.0/src/codedebrief/query.py +641 -0
- codedebrief-0.11.0/src/codedebrief/render/__init__.py +6 -0
- codedebrief-0.11.0/src/codedebrief/render/assets/generated/codedebrief-viewer-runtime.iife.js +10 -0
- codedebrief-0.11.0/src/codedebrief/render/assets/panels.js +462 -0
- codedebrief-0.11.0/src/codedebrief/render/assets/shell.js +1649 -0
- codedebrief-0.11.0/src/codedebrief/render/assets/styles.css +1715 -0
- codedebrief-0.11.0/src/codedebrief/render/assets/tree.js +616 -0
- codedebrief-0.11.0/src/codedebrief/render/html.py +191 -0
- codedebrief-0.11.0/src/codedebrief/render/markdown.py +153 -0
- codedebrief-0.11.0/src/codedebrief/render/payload.py +326 -0
- codedebrief-0.11.0/src/codedebrief/render/snapshot.py +769 -0
- codedebrief-0.11.0/src/codedebrief/util.py +65 -0
- codedebrief-0.11.0/src/codedebrief/validation.py +214 -0
- codedebrief-0.11.0/tests/test_artifacts_query_install.py +446 -0
- codedebrief-0.11.0/tests/test_c_rust.py +175 -0
- codedebrief-0.11.0/tests/test_call_resolver.py +342 -0
- codedebrief-0.11.0/tests/test_certifexp_local.py +50 -0
- codedebrief-0.11.0/tests/test_cli.py +380 -0
- codedebrief-0.11.0/tests/test_cross_flow_foundation.py +98 -0
- codedebrief-0.11.0/tests/test_csharp_php.py +152 -0
- codedebrief-0.11.0/tests/test_discovery.py +148 -0
- codedebrief-0.11.0/tests/test_doctor.py +51 -0
- codedebrief-0.11.0/tests/test_domain_modeling.py +50 -0
- codedebrief-0.11.0/tests/test_go.py +213 -0
- codedebrief-0.11.0/tests/test_ir_foundation.py +223 -0
- codedebrief-0.11.0/tests/test_is_test_classification.py +99 -0
- codedebrief-0.11.0/tests/test_java.py +153 -0
- codedebrief-0.11.0/tests/test_javascript.py +66 -0
- codedebrief-0.11.0/tests/test_markdown_render.py +115 -0
- codedebrief-0.11.0/tests/test_match_dispatch.py +90 -0
- codedebrief-0.11.0/tests/test_mcp.py +795 -0
- codedebrief-0.11.0/tests/test_packaging.py +19 -0
- codedebrief-0.11.0/tests/test_project.py +62 -0
- codedebrief-0.11.0/tests/test_python_analyzer.py +402 -0
- codedebrief-0.11.0/tests/test_quality.py +136 -0
- codedebrief-0.11.0/tests/test_query.py +84 -0
- codedebrief-0.11.0/tests/test_query_consumption.py +14 -0
- codedebrief-0.11.0/tests/test_query_ranking.py +430 -0
- codedebrief-0.11.0/tests/test_registry.py +398 -0
- codedebrief-0.11.0/tests/test_render_html.py +421 -0
- codedebrief-0.11.0/tests/test_render_payload.py +344 -0
- codedebrief-0.11.0/tests/test_robustness.py +219 -0
- codedebrief-0.11.0/tests/test_ruby.py +62 -0
- codedebrief-0.11.0/tests/test_scopes.py +66 -0
- codedebrief-0.11.0/tests/test_self_exclude.py +62 -0
- codedebrief-0.11.0/tests/test_semantic_precision.py +69 -0
- codedebrief-0.11.0/tests/test_snapshots.py +103 -0
- codedebrief-0.11.0/tests/test_typescript_analyzer.py +211 -0
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
# OS/editor noise
|
|
2
|
+
.DS_Store
|
|
3
|
+
Thumbs.db
|
|
4
|
+
.idea/
|
|
5
|
+
.vscode/
|
|
6
|
+
|
|
7
|
+
# Secrets and local environment files
|
|
8
|
+
.env
|
|
9
|
+
.env.*
|
|
10
|
+
!.env.example
|
|
11
|
+
.envrc
|
|
12
|
+
.env.codedebrief
|
|
13
|
+
|
|
14
|
+
# Python environments, caches, and build output
|
|
15
|
+
.venv/
|
|
16
|
+
venv/
|
|
17
|
+
env/
|
|
18
|
+
ENV/
|
|
19
|
+
__pycache__/
|
|
20
|
+
*.py[cod]
|
|
21
|
+
*$py.class
|
|
22
|
+
.pytest_cache/
|
|
23
|
+
.mypy_cache/
|
|
24
|
+
.ruff_cache/
|
|
25
|
+
.tox/
|
|
26
|
+
.nox/
|
|
27
|
+
.hypothesis/
|
|
28
|
+
.pyre/
|
|
29
|
+
.pytype/
|
|
30
|
+
.coverage
|
|
31
|
+
.coverage.*
|
|
32
|
+
htmlcov/
|
|
33
|
+
dist/
|
|
34
|
+
build/
|
|
35
|
+
*.egg-info/
|
|
36
|
+
pip-wheel-metadata/
|
|
37
|
+
|
|
38
|
+
# Node/frontend dependencies and build output
|
|
39
|
+
node_modules/
|
|
40
|
+
.next/
|
|
41
|
+
.nuxt/
|
|
42
|
+
.svelte-kit/
|
|
43
|
+
.vite/
|
|
44
|
+
.turbo/
|
|
45
|
+
coverage/
|
|
46
|
+
npm-debug.log*
|
|
47
|
+
yarn-debug.log*
|
|
48
|
+
yarn-error.log*
|
|
49
|
+
pnpm-debug.log*
|
|
50
|
+
|
|
51
|
+
# Logs
|
|
52
|
+
*.log
|
|
53
|
+
|
|
54
|
+
# Local agent/client configuration
|
|
55
|
+
.claude/
|
|
56
|
+
.codex/
|
|
57
|
+
.agents/skills/
|
|
58
|
+
.gemini/settings.json
|
|
59
|
+
.gemini/skills/
|
|
60
|
+
.mcp.json
|
|
61
|
+
.cursor/mcp.json
|
|
62
|
+
|
|
63
|
+
# Local analysis state and generated browser view
|
|
64
|
+
.codedebrief/
|
|
65
|
+
.logicchart/
|
|
66
|
+
**/codedebrief-out/codedebrief.html
|
|
67
|
+
**/codedebrief-out/*/
|
|
68
|
+
**/logicchart-out/
|
|
69
|
+
**/logic-flow.html
|
|
70
|
+
|
|
71
|
+
# Local examples and real-world fixtures
|
|
72
|
+
examples/
|
|
73
|
+
|
|
74
|
+
# Private local real-world fixture. Keep it available for local smoke tests, but
|
|
75
|
+
# never publish its source, generated artifacts, caches, or nested repository data.
|
|
76
|
+
examples/Certifexp/
|
|
@@ -0,0 +1,299 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
All notable changes to CodeDebrief will be documented in this file.
|
|
4
|
+
|
|
5
|
+
The project follows Semantic Versioning.
|
|
6
|
+
|
|
7
|
+
## Unreleased
|
|
8
|
+
|
|
9
|
+
## 0.11.0 - 2026-06-21
|
|
10
|
+
|
|
11
|
+
### Added
|
|
12
|
+
|
|
13
|
+
- Added a README preview image that shows the kind of source-backed visual workflow a
|
|
14
|
+
coding agent can present from CodeDebrief artifacts.
|
|
15
|
+
|
|
16
|
+
### Changed
|
|
17
|
+
|
|
18
|
+
- Renamed the project, Python package, CLI, MCP server, generated artifacts, viewer runtime,
|
|
19
|
+
and documentation surface to CodeDebrief.
|
|
20
|
+
- Made `examples/` local-only and ignored; the committed dogfood artifact now maps
|
|
21
|
+
`src/codedebrief` instead of relying on tracked demo/shop fixtures.
|
|
22
|
+
|
|
23
|
+
## 0.10.0 - 2026-06-21
|
|
24
|
+
|
|
25
|
+
### Changed
|
|
26
|
+
|
|
27
|
+
- Reoriented CodeDebrief around code-logic comprehension instead of review findings:
|
|
28
|
+
MCP workflow slices, agent instructions, Markdown artifacts, and the generated viewer
|
|
29
|
+
now emphasize deterministic flows, decisions, calls, source anchors, visual snapshots,
|
|
30
|
+
and manual exploration through `codedebrief view`.
|
|
31
|
+
- Moved MCP into the default runtime install so release and source-checkout installs include
|
|
32
|
+
the primary agent surface without requiring an optional extra.
|
|
33
|
+
- Updated `codedebrief setup-agent codex|claude|gemini|cursor` so setup writes only the
|
|
34
|
+
requested target's instruction, skill, and MCP files.
|
|
35
|
+
- Added Gemini CLI / Antigravity parity for `setup-agent gemini`: it now writes the
|
|
36
|
+
provider-native CodeDebrief skill and project-scoped `.gemini/settings.json` MCP config,
|
|
37
|
+
including the same Mermaid artifact guidance used by Claude when inline rendering is not
|
|
38
|
+
available.
|
|
39
|
+
- Updated agent guidance so visual workflow answers use the deterministic
|
|
40
|
+
`workflow_slice.presentation.canonical_visual.diagram` first, persist Mermaid `.mmd` /
|
|
41
|
+
Markdown artifacts for clients without inline Mermaid rendering, avoid long raw Mermaid
|
|
42
|
+
code blocks as the primary visual, and reserve SVG snapshots for explicit SVG or
|
|
43
|
+
local-inspection requests.
|
|
44
|
+
- Replaced standalone LLM/viewer docs with the README, generated agent instructions, and
|
|
45
|
+
`CONTRIBUTING.md` as the maintained public guidance surfaces.
|
|
46
|
+
|
|
47
|
+
### Added
|
|
48
|
+
|
|
49
|
+
- Added `workflow_slice` to MCP `agent_context`, with stable slice handles, ordered
|
|
50
|
+
workflow steps, primary/supporting flows, decisions, calls, domain logic, source ranges,
|
|
51
|
+
visual handles, omissions, guardrails, and next-tool hints.
|
|
52
|
+
- Added MCP `expand_slice`, `workflow_path`, `snapshot_slice`, `explain_flow`,
|
|
53
|
+
`explain_node`, and `explain_edge` for progressive workflow-slice navigation and focused
|
|
54
|
+
source-grounded inspection.
|
|
55
|
+
- Added deterministic visual presentation metadata for workflow slices, including stable
|
|
56
|
+
top-to-bottom Mermaid output, `diagram_hash`, viewer targets, local `.mmd` / Markdown
|
|
57
|
+
snapshot artifacts, and legacy SVG/HTML artifacts for local inspection.
|
|
58
|
+
- Added analyzer quality, skipped-file, language-capability, and parse-warning metadata for
|
|
59
|
+
comprehension-oriented validation and viewer summaries.
|
|
60
|
+
|
|
61
|
+
### Removed
|
|
62
|
+
|
|
63
|
+
- Removed the public CLI surface for `query`, `impact`, `explain`, `navigate`, and
|
|
64
|
+
`snapshot`; those deterministic capabilities remain internal/MCP-only.
|
|
65
|
+
- Removed `analyze`, `init`, `install`, `llm`, and `enrich` from the public CLI surface;
|
|
66
|
+
`update` owns refresh/full analysis and `setup-agent` owns initialization and agent
|
|
67
|
+
setup.
|
|
68
|
+
- Removed dead internal finding detector modules, diagnostic helpers, gated detector
|
|
69
|
+
configuration, detector-only tests, and obsolete example expected-finding docs.
|
|
70
|
+
- Removed dead provider-managed LLM enrichment code and provider/model configuration.
|
|
71
|
+
- Removed `docs/llm.md`, `docs/viewer.md`, and the obsolete viewer screenshot asset now
|
|
72
|
+
covered by the README and generated agent/setup guidance.
|
|
73
|
+
- Removed findings/review queues from the generated viewer and public MCP workflow path.
|
|
74
|
+
- Removed the legacy `findings` artifact field and moved the canonical model schema to
|
|
75
|
+
`2.0`.
|
|
76
|
+
|
|
77
|
+
### Fixed
|
|
78
|
+
|
|
79
|
+
- Fixed visual workflow guidance so repeated chat requests prefer vertical/top-to-bottom
|
|
80
|
+
deterministic visuals and offer language-friendly or expanded follow-ups without
|
|
81
|
+
changing graph facts.
|
|
82
|
+
- Fixed stale docs and examples that still described CodeDebrief as a review-signal or
|
|
83
|
+
detector product.
|
|
84
|
+
|
|
85
|
+
## 0.8.0 - 2026-06-17
|
|
86
|
+
|
|
87
|
+
### Added
|
|
88
|
+
|
|
89
|
+
- Added dedicated viewer documentation covering the progressive flowchart product shape,
|
|
90
|
+
the static and React runtime split, layout invariants, and browser verification loop.
|
|
91
|
+
- Added React-viewer viewport panning with reset coverage in the frontend test suite.
|
|
92
|
+
|
|
93
|
+
### Changed
|
|
94
|
+
|
|
95
|
+
- Clarified README and contributor instructions for the framework-backed viewer runtime,
|
|
96
|
+
generated runtime bundle, cache-busted browser checks, and viewer-specific gates.
|
|
97
|
+
|
|
98
|
+
### Fixed
|
|
99
|
+
|
|
100
|
+
- Fixed the React viewer so clicking empty canvas space clears selected connections, and
|
|
101
|
+
dimmed scope-entry links now fade consistently with dimmed canvas nodes.
|
|
102
|
+
|
|
103
|
+
## 0.7.0 - 2026-06-16
|
|
104
|
+
|
|
105
|
+
### Added
|
|
106
|
+
|
|
107
|
+
- Added PNG and JPG export buttons for the currently visible flowchart canvas.
|
|
108
|
+
- Added session-local drag positioning for scope, flow, and inline decision blocks, with
|
|
109
|
+
reset restoring the automatic progressive layout.
|
|
110
|
+
|
|
111
|
+
### Changed
|
|
112
|
+
|
|
113
|
+
- Reworked the viewer canvas toward a single progressive flowchart: scopes expand into
|
|
114
|
+
entrypoint/call rows, selected decision charts unfold in that same route, and selected
|
|
115
|
+
links highlight their source and target while unrelated blocks dim.
|
|
116
|
+
- Unified scope nodes with the rest of the canvas block styling so top-level areas do not
|
|
117
|
+
read as a separate visual component family.
|
|
118
|
+
|
|
119
|
+
## 0.6.2 - 2026-06-16
|
|
120
|
+
|
|
121
|
+
### Changed
|
|
122
|
+
|
|
123
|
+
- Updated the HTML viewer so expanding a scope keeps the whole codebase map visible while
|
|
124
|
+
drawing the active scope's files and flows in place.
|
|
125
|
+
- Added folder/file path focus in the viewer (`#path=...`) so clicking a tree folder
|
|
126
|
+
highlights the matching canvas area without losing global context.
|
|
127
|
+
|
|
128
|
+
## 0.6.1 - 2026-06-16
|
|
129
|
+
|
|
130
|
+
### Fixed
|
|
131
|
+
|
|
132
|
+
- Fixed Markdown report rendering for enum-backed finding kinds so reports show public
|
|
133
|
+
values such as `missing_branch` instead of Python enum names.
|
|
134
|
+
|
|
135
|
+
## 0.6.0 - 2026-06-16
|
|
136
|
+
|
|
137
|
+
### Added
|
|
138
|
+
|
|
139
|
+
- Added C++ control-flow support for `.cc`, `.cpp`, `.cxx`, `.hh`, `.hpp`, `.hxx`, `.ipp`,
|
|
140
|
+
and `.tpp` files.
|
|
141
|
+
|
|
142
|
+
### Changed
|
|
143
|
+
|
|
144
|
+
- Improved large-codebase defaults by excluding more common dependency caches, build output,
|
|
145
|
+
and generated-code patterns during discovery.
|
|
146
|
+
- Refined the HTML viewer for broad codebase study with scope/file finding density, a
|
|
147
|
+
responsive details-panel toggle, and an empty state for tree search/filter misses.
|
|
148
|
+
- Restructured the README around project purpose, quick start, scale behavior, viewer usage,
|
|
149
|
+
and supported languages.
|
|
150
|
+
|
|
151
|
+
## 0.5.0 - 2026-06-16
|
|
152
|
+
|
|
153
|
+
### Added
|
|
154
|
+
|
|
155
|
+
- Added `codedebrief doctor` to check the active installation, parser grammar imports, and
|
|
156
|
+
repair command for stale editable installs.
|
|
157
|
+
|
|
158
|
+
### Fixed
|
|
159
|
+
|
|
160
|
+
- Fixed analysis robustness when a lazy language grammar is missing from the active Python
|
|
161
|
+
environment: affected files are now reported as skipped instead of aborting the whole run.
|
|
162
|
+
- Fixed `codedebrief --version` so it follows installed package metadata instead of a stale
|
|
163
|
+
duplicated constant.
|
|
164
|
+
|
|
165
|
+
## 0.4.1 - 2026-06-16
|
|
166
|
+
|
|
167
|
+
### Fixed
|
|
168
|
+
|
|
169
|
+
- Fixed packaged `codedebrief validate` so installed wheels include and load the bundled JSON
|
|
170
|
+
Schema outside the source checkout.
|
|
171
|
+
|
|
172
|
+
## 0.4.0 - 2026-06-16
|
|
173
|
+
|
|
174
|
+
### Added
|
|
175
|
+
|
|
176
|
+
- Added built-in analysis profiles for the public demo artifact, CodeDebrief self-analysis,
|
|
177
|
+
and a whole-checkout project map without overwriting each other.
|
|
178
|
+
- Added `codedebrief validate`, artifact/schema registry validation, and optional full
|
|
179
|
+
source sync checks for local CI and agent workflows.
|
|
180
|
+
- Added richer query filters and ranking signals (`--language`, `--finding-kind`, scope,
|
|
181
|
+
language, path, decision metadata, and finding text).
|
|
182
|
+
- Added MCP agent tools for prioritized review queues, compact context packs, and artifact
|
|
183
|
+
validation.
|
|
184
|
+
- Added optional `codedebrief install --mcp-config ...` project MCP config generation and
|
|
185
|
+
server instructions for agent workflow guidance.
|
|
186
|
+
- Added viewer flow search and a prioritized review queue in the review-signals panel.
|
|
187
|
+
- Clarified the earlier CLI/MCP agent workflow in the README.
|
|
188
|
+
|
|
189
|
+
### Changed
|
|
190
|
+
|
|
191
|
+
- Simplified the README Quick Start to the two commands needed for first success:
|
|
192
|
+
`codedebrief analyze --full` and `codedebrief view`.
|
|
193
|
+
- Updated public/package positioning around local-first decision flowcharts for humans and
|
|
194
|
+
coding agents.
|
|
195
|
+
- Removed internal planning/design documents from `docs/`, keeping the public repository
|
|
196
|
+
focused on end-user documentation and README assets.
|
|
197
|
+
|
|
198
|
+
### Removed
|
|
199
|
+
|
|
200
|
+
- Removed Terraform/HCL support.
|
|
201
|
+
- Removed the `diff` (CI gate) and `hook` (git auto-sync) commands; both are tracked as planned future evolutions.
|
|
202
|
+
|
|
203
|
+
## 0.3.0
|
|
204
|
+
|
|
205
|
+
Major capability expansion: from a Python/TypeScript analyzer to a polyglot,
|
|
206
|
+
whole-codebase one - 10 control-flow languages plus Terraform, organized by macro-part.
|
|
207
|
+
|
|
208
|
+
### Languages
|
|
209
|
+
|
|
210
|
+
- Profile-driven tree-sitter engine: a new control-flow language is a `LanguageProfile`
|
|
211
|
+
(grammar vocabulary + a few extractors), not a bespoke analyzer.
|
|
212
|
+
- Added Go, Java, C#, PHP, C, Rust, and Ruby alongside the existing Python and
|
|
213
|
+
TypeScript/JavaScript analyzers - 10 control-flow languages in all.
|
|
214
|
+
- Terraform/HCL support: each `resource` / `module` / `data` / `variable` / `output` block
|
|
215
|
+
becomes a flow and each reference (`aws_vpc.main.id`, `depends_on`) becomes a dependency
|
|
216
|
+
edge, so the IR carries a resource dependency graph.
|
|
217
|
+
- Pluggable language registry keyed by file suffix, with lazy grammar loading.
|
|
218
|
+
- Rust `match` is treated as compiler-exhaustive: a missing `_` arm is no longer flagged as
|
|
219
|
+
a missing fallback.
|
|
220
|
+
|
|
221
|
+
### Whole codebase and scopes
|
|
222
|
+
|
|
223
|
+
- Macro-part scopes: declare `[codedebrief.scopes]` (or fall back to the inferred top-level
|
|
224
|
+
directory) so one model can be viewed whole or restricted to backend/frontend/infra.
|
|
225
|
+
- `--scope` on `query` and `impact`; scope and language filters in the viewer.
|
|
226
|
+
- Every flow records the scope(s) it belongs to; the Markdown header summarizes the
|
|
227
|
+
per-scope breakdown.
|
|
228
|
+
|
|
229
|
+
### Viewer
|
|
230
|
+
|
|
231
|
+
- UI refresh: a new logo - a blue entry-node circle, a violet connector, and an amber
|
|
232
|
+
decision diamond in three solid colors with clear spacing (and a matching favicon); a
|
|
233
|
+
light/dark theme toggle (remembered across sessions); refined palette; node hover and
|
|
234
|
+
shadow states; selecting a block now highlights it and its connected edges while dimming
|
|
235
|
+
the rest; and the legend now includes the cyan "outcome" (terminal) node color it was
|
|
236
|
+
missing.
|
|
237
|
+
|
|
238
|
+
### Examples & fixes
|
|
239
|
+
|
|
240
|
+
- `examples/demo` is now a polyglot "users & orders" platform spanning all 10
|
|
241
|
+
control-flow languages plus Terraform/HCL across backend/frontend/edge/infra scopes.
|
|
242
|
+
- `analyze` summary wording: "{n} finding(s)" instead of the earlier hybrid review
|
|
243
|
+
wording.
|
|
244
|
+
|
|
245
|
+
## 0.2.1
|
|
246
|
+
|
|
247
|
+
- Interactive viewer: drag any block to rearrange the flowchart by hand; connected edges
|
|
248
|
+
re-route live, hand-placed positions persist per flow, and reset restores the auto layout.
|
|
249
|
+
- README rewritten for clarity: sharper scope, a runnable 30-second example, an outcome-
|
|
250
|
+
focused "Why", a per-command reference with real output, explicit limitations, and the
|
|
251
|
+
agent/MCP integrations moved to an "Advanced" section.
|
|
252
|
+
|
|
253
|
+
## 0.2.0
|
|
254
|
+
|
|
255
|
+
First tagged release. A deterministic, local, no-API-key static analyzer that turns
|
|
256
|
+
Python and TypeScript source into a versioned logical model plus reviewable
|
|
257
|
+
flowcharts, with evidence-tiered findings (`VERIFIED` / `INFERRED` / `POTENTIAL_GAP`).
|
|
258
|
+
|
|
259
|
+
### Analysis & IR
|
|
260
|
+
|
|
261
|
+
- Deterministic Python (AST) and TypeScript/TSX (tree-sitter) analyzers producing one
|
|
262
|
+
canonical `codedebrief.json` model (schema 1.1).
|
|
263
|
+
- Framework adapters: FastAPI routes; Next.js route handlers, middleware, server
|
|
264
|
+
actions, pages, and layouts; shallow React components, hooks, and event handlers;
|
|
265
|
+
public/exported functions, CLI commands, and tests.
|
|
266
|
+
- IR enrichment: per-branch outcomes, decision identity (subject/operator/negation/
|
|
267
|
+
value namespace), reachability, side-effect tags, declared enum/union value tables,
|
|
268
|
+
module-level constants, and stable structural finding ids.
|
|
269
|
+
- Import-aware call resolver with `module:symbol` boundary preservation, longest-prefix
|
|
270
|
+
module resolution, submodule-import binding, and per-call link confidence.
|
|
271
|
+
|
|
272
|
+
### Detectors (11, evidence-tiered)
|
|
273
|
+
|
|
274
|
+
- Single-flow: `missing_branch`, `dead_code`, `broad_except_swallow` (empty **or**
|
|
275
|
+
log-only handlers), `no_op_branch`, `asymmetric_return`, `dead_guard`.
|
|
276
|
+
- Cross-flow: `inconsistent_case_handling` (quorum-aware), `enum_exhaustiveness`,
|
|
277
|
+
`outcome_inconsistency` (HTTP status-aware), `logging_asymmetry`.
|
|
278
|
+
- Gated (opt-in via `gated_detectors`): `auth_divergence`.
|
|
279
|
+
|
|
280
|
+
### Surfaces
|
|
281
|
+
|
|
282
|
+
- CLI: `init`, `analyze` (`--full`, `--include-gaps`), `update`, `impact`, `query`,
|
|
283
|
+
`view`, `install`, `hook` (install/uninstall/status), `mcp`, and `diff`.
|
|
284
|
+
- CI diff gate: `diff` compares two models by stable finding id and emits a GitHub
|
|
285
|
+
Markdown summary and SARIF (stable `partialFingerprints`), with `--fail-on-introduced`.
|
|
286
|
+
- Markdown report with a signal/noise split - `VERIFIED`/`INFERRED` in the main
|
|
287
|
+
section, `POTENTIAL_GAP` folded under a collapsible review-only block (`--include-gaps`
|
|
288
|
+
to expand) - plus injection-safe escaping of source-derived finding text.
|
|
289
|
+
- Interactive local HTML viewer.
|
|
290
|
+
- MCP server with 11 tools and a `token_budget` cap on every query/list tool.
|
|
291
|
+
- Agent instruction installer (`AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, Cursor rules) and
|
|
292
|
+
managed git auto-sync hooks with a `merge=union` driver for `codedebrief.json`.
|
|
293
|
+
|
|
294
|
+
### Robustness
|
|
295
|
+
|
|
296
|
+
- Incremental content-hash cache with per-file analysis.
|
|
297
|
+
- Per-file parse isolation: an un-parseable or non-UTF-8 file is skipped and reported
|
|
298
|
+
in `skipped_files` rather than aborting the whole run.
|
|
299
|
+
- Malformed `codedebrief.json` is rejected with a clean error instead of a raw traceback.
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
# Code of Conduct
|
|
2
|
+
|
|
3
|
+
CodeDebrief contributors are expected to communicate respectfully, focus criticism on the
|
|
4
|
+
work, and make participation safe for people of different backgrounds and experience levels.
|
|
5
|
+
|
|
6
|
+
Harassment, personal attacks, discriminatory language, and deliberate disruption are not
|
|
7
|
+
acceptable. Maintainers may edit or remove contributions and restrict participation when
|
|
8
|
+
needed to protect the community.
|
|
9
|
+
|
|
10
|
+
Report conduct concerns privately to the project maintainers.
|
|
@@ -0,0 +1,77 @@
|
|
|
1
|
+
# Contributing to CodeDebrief
|
|
2
|
+
|
|
3
|
+
CodeDebrief welcomes bug reports, language fixtures, framework adapters, documentation, and
|
|
4
|
+
code contributions.
|
|
5
|
+
|
|
6
|
+
## Development Setup
|
|
7
|
+
|
|
8
|
+
```bash
|
|
9
|
+
uv sync --extra dev
|
|
10
|
+
uv run pytest
|
|
11
|
+
```
|
|
12
|
+
|
|
13
|
+
Viewer UI/layout work also uses the frontend workspace:
|
|
14
|
+
|
|
15
|
+
```bash
|
|
16
|
+
npm install
|
|
17
|
+
npm run viewer:typecheck
|
|
18
|
+
npm run viewer:test
|
|
19
|
+
npm run viewer:build
|
|
20
|
+
```
|
|
21
|
+
|
|
22
|
+
`npm run viewer:build` writes the offline React runtime to
|
|
23
|
+
`src/codedebrief/render/assets/generated/codedebrief-viewer-runtime.iife.js`; regenerate the
|
|
24
|
+
local HTML before browser checks and open it with `?runtime=react` when testing the typed
|
|
25
|
+
canvas path.
|
|
26
|
+
|
|
27
|
+
Viewer changes should preserve the manual exploration invariants: scope nodes use the same
|
|
28
|
+
node styling family as other blocks, each scope connects to all visible entrypoints,
|
|
29
|
+
expanded details reserve layout space before rendering, selected links dim unrelated
|
|
30
|
+
blocks, and invisible hit paths never become visible bounding boxes.
|
|
31
|
+
|
|
32
|
+
The recommended viewer loop is:
|
|
33
|
+
|
|
34
|
+
```bash
|
|
35
|
+
npm run viewer:typecheck
|
|
36
|
+
npm run viewer:test
|
|
37
|
+
npm run viewer:build
|
|
38
|
+
UV_CACHE_DIR=/tmp/codedebrief-uv-cache uv run codedebrief update
|
|
39
|
+
UV_CACHE_DIR=/tmp/codedebrief-uv-cache uv run codedebrief view --render-only --no-open
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
Use a cache-buster when reloading the generated viewer in a browser:
|
|
43
|
+
|
|
44
|
+
```text
|
|
45
|
+
codedebrief.html?runtime=react&v=<stamp>
|
|
46
|
+
```
|
|
47
|
+
|
|
48
|
+
Before submitting a pull request:
|
|
49
|
+
|
|
50
|
+
```bash
|
|
51
|
+
uv run ruff check .
|
|
52
|
+
uv run ruff format --check .
|
|
53
|
+
uv run mypy
|
|
54
|
+
uv run pytest --cov
|
|
55
|
+
npm run viewer:typecheck
|
|
56
|
+
npm run viewer:test
|
|
57
|
+
npm run viewer:build
|
|
58
|
+
npm audit --audit-level=high
|
|
59
|
+
```
|
|
60
|
+
|
|
61
|
+
## Analyzer Changes
|
|
62
|
+
|
|
63
|
+
Every analyzer change should include a minimal source fixture and assertions for:
|
|
64
|
+
|
|
65
|
+
- detected entry points;
|
|
66
|
+
- decision nodes and branch labels;
|
|
67
|
+
- source locations;
|
|
68
|
+
- evidence level;
|
|
69
|
+
- call metadata and domain metadata when the fixture exercises them.
|
|
70
|
+
|
|
71
|
+
Keep language-specific extraction separate from the shared logical IR. Framework knowledge
|
|
72
|
+
belongs in a focused adapter or classifier, not in the renderer.
|
|
73
|
+
|
|
74
|
+
## Compatibility
|
|
75
|
+
|
|
76
|
+
CodeDebrief supports Python 3.10 and later. Avoid changing the canonical JSON schema without
|
|
77
|
+
updating `schema_version`, migration notes, and serialization tests.
|
|
@@ -0,0 +1,176 @@
|
|
|
1
|
+
Apache License
|
|
2
|
+
Version 2.0, January 2004
|
|
3
|
+
http://www.apache.org/licenses/
|
|
4
|
+
|
|
5
|
+
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
|
6
|
+
|
|
7
|
+
1. Definitions.
|
|
8
|
+
|
|
9
|
+
"License" shall mean the terms and conditions for use, reproduction,
|
|
10
|
+
and distribution as defined by Sections 1 through 9 of this document.
|
|
11
|
+
|
|
12
|
+
"Licensor" shall mean the copyright owner or entity authorized by
|
|
13
|
+
the copyright owner that is granting the License.
|
|
14
|
+
|
|
15
|
+
"Legal Entity" shall mean the union of the acting entity and all
|
|
16
|
+
other entities that control, are controlled by, or are under common
|
|
17
|
+
control with that entity. For the purposes of this definition,
|
|
18
|
+
"control" means (i) the power, direct or indirect, to cause the
|
|
19
|
+
direction or management of such entity, whether by contract or
|
|
20
|
+
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
|
21
|
+
outstanding shares, or (iii) beneficial ownership of such entity.
|
|
22
|
+
|
|
23
|
+
"You" (or "Your") shall mean an individual or Legal Entity
|
|
24
|
+
exercising permissions granted by this License.
|
|
25
|
+
|
|
26
|
+
"Source" form shall mean the preferred form for making modifications,
|
|
27
|
+
including but not limited to software source code, documentation
|
|
28
|
+
source, and configuration files.
|
|
29
|
+
|
|
30
|
+
"Object" form shall mean any form resulting from mechanical
|
|
31
|
+
transformation or translation of a Source form, including but
|
|
32
|
+
not limited to compiled object code, generated documentation,
|
|
33
|
+
and conversions to other media types.
|
|
34
|
+
|
|
35
|
+
"Work" shall mean the work of authorship, whether in Source or
|
|
36
|
+
Object form, made available under the License, as indicated by a
|
|
37
|
+
copyright notice that is included in or attached to the work
|
|
38
|
+
(an example is provided in the Appendix below).
|
|
39
|
+
|
|
40
|
+
"Derivative Works" shall mean any work, whether in Source or Object
|
|
41
|
+
form, that is based on (or derived from) the Work and for which the
|
|
42
|
+
editorial revisions, annotations, elaborations, or other modifications
|
|
43
|
+
represent, as a whole, an original work of authorship. For the purposes
|
|
44
|
+
of this License, Derivative Works shall not include works that remain
|
|
45
|
+
separable from, or merely link (or bind by name) to the interfaces of,
|
|
46
|
+
the Work and Derivative Works thereof.
|
|
47
|
+
|
|
48
|
+
"Contribution" shall mean any work of authorship, including
|
|
49
|
+
the original version of the Work and any modifications or additions
|
|
50
|
+
to that Work or Derivative Works thereof, that is intentionally
|
|
51
|
+
submitted to Licensor for inclusion in the Work by the copyright owner
|
|
52
|
+
or by an individual or Legal Entity authorized to submit on behalf of
|
|
53
|
+
the copyright owner. For the purposes of this definition, "submitted"
|
|
54
|
+
means any form of electronic, verbal, or written communication sent
|
|
55
|
+
to the Licensor or its representatives, including but not limited to
|
|
56
|
+
communication on electronic mailing lists, source code control systems,
|
|
57
|
+
and issue tracking systems that are managed by, or on behalf of, the
|
|
58
|
+
Licensor for the purpose of discussing and improving the Work, but
|
|
59
|
+
excluding communication that is conspicuously marked or otherwise
|
|
60
|
+
designated in writing by the copyright owner as "Not a Contribution."
|
|
61
|
+
|
|
62
|
+
"Contributor" shall mean Licensor and any individual or Legal Entity
|
|
63
|
+
on behalf of whom a Contribution has been received by Licensor and
|
|
64
|
+
subsequently incorporated within the Work.
|
|
65
|
+
|
|
66
|
+
2. Grant of Copyright License. Subject to the terms and conditions of
|
|
67
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
68
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
69
|
+
copyright license to reproduce, prepare Derivative Works of,
|
|
70
|
+
publicly display, publicly perform, sublicense, and distribute the
|
|
71
|
+
Work and such Derivative Works in Source or Object form.
|
|
72
|
+
|
|
73
|
+
3. Grant of Patent License. Subject to the terms and conditions of
|
|
74
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
75
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
76
|
+
(except as stated in this section) patent license to make, have made,
|
|
77
|
+
use, offer to sell, sell, import, and otherwise transfer the Work,
|
|
78
|
+
where such license applies only to those patent claims licensable
|
|
79
|
+
by such Contributor that are necessarily infringed by their
|
|
80
|
+
Contribution(s) alone or by combination of their Contribution(s)
|
|
81
|
+
with the Work to which such Contribution(s) was submitted. If You
|
|
82
|
+
institute patent litigation against any entity (including a
|
|
83
|
+
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
|
84
|
+
or a Contribution incorporated within the Work constitutes direct
|
|
85
|
+
or contributory patent infringement, then any patent licenses
|
|
86
|
+
granted to You under this License for that Work shall terminate
|
|
87
|
+
as of the date such litigation is filed.
|
|
88
|
+
|
|
89
|
+
4. Redistribution. You may reproduce and distribute copies of the
|
|
90
|
+
Work or Derivative Works thereof in any medium, with or without
|
|
91
|
+
modifications, and in Source or Object form, provided that You
|
|
92
|
+
meet the following conditions:
|
|
93
|
+
|
|
94
|
+
(a) You must give any other recipients of the Work or
|
|
95
|
+
Derivative Works a copy of this License; and
|
|
96
|
+
|
|
97
|
+
(b) You must cause any modified files to carry prominent notices
|
|
98
|
+
stating that You changed the files; and
|
|
99
|
+
|
|
100
|
+
(c) You must retain, in the Source form of any Derivative Works
|
|
101
|
+
that You distribute, all copyright, patent, trademark, and
|
|
102
|
+
attribution notices from the Source form of the Work,
|
|
103
|
+
excluding those notices that do not pertain to any part of
|
|
104
|
+
the Derivative Works; and
|
|
105
|
+
|
|
106
|
+
(d) If the Work includes a "NOTICE" text file as part of its
|
|
107
|
+
distribution, then any Derivative Works that You distribute must
|
|
108
|
+
include a readable copy of the attribution notices contained
|
|
109
|
+
within such NOTICE file, excluding those notices that do not
|
|
110
|
+
pertain to any part of the Derivative Works, in at least one
|
|
111
|
+
of the following places: within a NOTICE text file distributed
|
|
112
|
+
as part of the Derivative Works; within the Source form or
|
|
113
|
+
documentation, if provided along with the Derivative Works; or,
|
|
114
|
+
within a display generated by the Derivative Works, if and
|
|
115
|
+
wherever such third-party notices normally appear. The contents
|
|
116
|
+
of the NOTICE file are for informational purposes only and
|
|
117
|
+
do not modify the License. You may add Your own attribution
|
|
118
|
+
notices within Derivative Works that You distribute, alongside
|
|
119
|
+
or as an addendum to the NOTICE text from the Work, provided
|
|
120
|
+
that such additional attribution notices cannot be construed
|
|
121
|
+
as modifying the License.
|
|
122
|
+
|
|
123
|
+
You may add Your own copyright statement to Your modifications and
|
|
124
|
+
may provide additional or different license terms and conditions
|
|
125
|
+
for use, reproduction, or distribution of Your modifications, or
|
|
126
|
+
for any such Derivative Works as a whole, provided Your use,
|
|
127
|
+
reproduction, and distribution of the Work otherwise complies with
|
|
128
|
+
the conditions stated in this License.
|
|
129
|
+
|
|
130
|
+
5. Submission of Contributions. Unless You explicitly state otherwise,
|
|
131
|
+
any Contribution intentionally submitted for inclusion in the Work
|
|
132
|
+
by You to the Licensor shall be under the terms and conditions of
|
|
133
|
+
this License, without any additional terms or conditions.
|
|
134
|
+
Notwithstanding the above, nothing herein shall supersede or modify
|
|
135
|
+
the terms of any separate license agreement you may have executed
|
|
136
|
+
with Licensor regarding such Contributions.
|
|
137
|
+
|
|
138
|
+
6. Trademarks. This License does not grant permission to use the trade
|
|
139
|
+
names, trademarks, service marks, or product names of the Licensor,
|
|
140
|
+
except as required for reasonable and customary use in describing the
|
|
141
|
+
origin of the Work and reproducing the content of the NOTICE file.
|
|
142
|
+
|
|
143
|
+
7. Disclaimer of Warranty. Unless required by applicable law or
|
|
144
|
+
agreed to in writing, Licensor provides the Work (and each
|
|
145
|
+
Contributor provides its Contributions) on an "AS IS" BASIS,
|
|
146
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
147
|
+
implied, including, without limitation, any warranties or conditions
|
|
148
|
+
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
|
149
|
+
PARTICULAR PURPOSE. You are solely responsible for determining the
|
|
150
|
+
appropriateness of using or redistributing the Work and assume any
|
|
151
|
+
risks associated with Your exercise of permissions under this License.
|
|
152
|
+
|
|
153
|
+
8. Limitation of Liability. In no event and under no legal theory,
|
|
154
|
+
whether in tort (including negligence), contract, or otherwise,
|
|
155
|
+
unless required by applicable law (such as deliberate and grossly
|
|
156
|
+
negligent acts) or agreed to in writing, shall any Contributor be
|
|
157
|
+
liable to You for damages, including any direct, indirect, special,
|
|
158
|
+
incidental, or consequential damages of any character arising as a
|
|
159
|
+
result of this License or out of the use or inability to use the
|
|
160
|
+
Work (including but not limited to damages for loss of goodwill,
|
|
161
|
+
work stoppage, computer failure or malfunction, or any and all
|
|
162
|
+
other commercial damages or losses), even if such Contributor
|
|
163
|
+
has been advised of the possibility of such damages.
|
|
164
|
+
|
|
165
|
+
9. Accepting Warranty or Additional Liability. While redistributing
|
|
166
|
+
the Work or Derivative Works thereof, You may choose to offer,
|
|
167
|
+
and charge a fee for, acceptance of support, warranty, indemnity,
|
|
168
|
+
or other liability obligations and/or rights consistent with this
|
|
169
|
+
License. However, in accepting such obligations, You may act only
|
|
170
|
+
on Your own behalf and on Your sole responsibility, not on behalf
|
|
171
|
+
of any other Contributor, and only if You agree to indemnify,
|
|
172
|
+
defend, and hold each Contributor harmless for any liability
|
|
173
|
+
incurred by, or claims asserted against, such Contributor by reason
|
|
174
|
+
of your accepting any such warranty or additional liability.
|
|
175
|
+
|
|
176
|
+
END OF TERMS AND CONDITIONS
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
CodeDebrief
|
|
2
|
+
Copyright 2026 Ferdinando Bonsegna
|
|
3
|
+
|
|
4
|
+
Created and maintained by Ferdinando Bonsegna.
|
|
5
|
+
https://github.com/ferdinandobons/CodeDebrief
|
|
6
|
+
|
|
7
|
+
Licensed under the Apache License, Version 2.0 (see the LICENSE file). If you
|
|
8
|
+
redistribute CodeDebrief or a work derived from it, you must retain this NOTICE
|
|
9
|
+
file and the attribution above, per Section 4(d) of the License.
|