[tt-a1i]

Summary

 code-analysis check --json
+  ruleCounts: 445 complexity · 2 internal-leak · 1 cycle
+  investigation.leads:
+    1. COMP-2a6dc21b585e  archify/renderers/dataflow/dataflow-compiler.mjs:63
+       task: node … code-analysis task <out> --finding COMP-2a6dc21b585e --root <repo> --format json
+    2. COMP-a130c939bd0a  archify/modules/code-analysis/extract/shared/semantics.mjs:5
+    3. COMP-b7239cec9f19  archify/renderers/workflow/workflow-compiler.mjs:236
   priorities: [COMP-…, COMP-…, COMP-…]

Two changes:

• check now emits a self-contained investigation entry. Its leads repeat the ranked priorities with the message, path:line, symbol, impact, and a runnable task command. ruleCounts shows the open finding distribution, and the text output prints the same leads under Start here.
• vendor/, vendored/, third_party/ and third-party/ folders default to the generated role. Bundled third-party code no longer produces first-party complexity findings. Users can override roles.generated to analyze those folders. On Archify itself this removes 56 complexity findings in 12 third-party bundle files from the first-party count (504 → 448 findings). The measurements are real; the defect was counting them as first-party.

Base

This Draft is stacked on #1301's review head (codex/code-analysis-labs-review-candidate, commit 2877c157), because the Code Analysis module does not exist on main. The diff is the two commits on top of that revision. It does not retarget #1301, change its review site, or merge anything into Labs.

Reproduce

From the repository root:

node archify/bin/archify.mjs code-analysis check . --language ts --out /tmp/archify-self --json
node archify/bin/archify.mjs code-analysis task /tmp/archify-self --finding COMP-2a6dc21b585e --root . --format json

Evidence

• Before: 504 findings, 234 warnings; 56 complexity findings in 12 third-party bundle files under vendor paths; priorities were bare ids.
  After: 448 findings, 210 warnings; 0 vendor findings; each lead carries a source location and a task command.
• Clean session: old entry 58 tool uses / 2.34 M tokens; new entry 49 / 2.20 M. On a nine-finding repository the two requests sessions both found the same first lead and the new entry did not reduce cost. The measurable gains are the 56 third-party bundle findings removed from the first-party count and the self-contained first lead, not a large context reduction.
• External, requests v2.32.3: both entries independently found the empty-string cookie bug in RequestsCookieJar._find_no_duplicates. The regression test fails on the original and passes on the one-line is not None fix.
• External, clap ec93e71: deleting one unused import removes the two-file import cycle. cargo check -p clap_builder and 83 library tests pass; re-analysis drops 28 → 27 findings and 4 → 3 cycles.
• External, httpx 0.27.0: a repo-only session and a scan-assisted session received the same one-sentence request. The scan took 5.0 s and produced 8 findings; its top lead was a complexity metric. The scan-assisted session waived that metric, found an IPv6 netloc round-trip bug in the same file, and produced a patch with a regression test. The repo-only session reported an environment decision and withdrew its only code-bug candidate. No speed or token benefit appeared in this pair; the benefit was orientation. The scan did not surface the bug.
• Tests: 475/475 code-analysis tests, 19/19 root core tests.
• CI: all required checks pass on c3f16f5d6 (both full-regression shards, Windows portability on Node 22/24, package smoke on three platforms, website, and ZIP freshness).
• ZIP: f7b697c157cf4e310efb16f6a66ab8e9e723f91124e7acd5f3702ca207cf5d58. The unpacked CLI reproduced the requests findings and task evidence, reported 0 vendor findings, and emitted the new entry.

Evidence and reproduction commands: baseline, candidate comparison, external cases, validation.

Unfamiliar-repository session: repo vs repo + scan

encode/httpx at 326b9431 (0.27.0), two isolated copies, the same agent configuration and 12-minute cap, both receiving only “帮我看看这个项目”.

	Repository only	Repository + scan
First decision-bearing evidence	environment: the prepared venv cannot run the suite (≈23 s)	IPv6 netloc defect (≈69 s)
Code defect a maintainer can act on	none; its only code hypothesis was withdrawn	IPv6 netloc, patch and regression test
Tool uses / tokens / time	38 / 1.51 M / 122.7 s	32 / 1.34 M / 135.3 s
Scan cost	—	5.0 s plus artifact reads

The scan's top lead was urlparse complexity 39. The scan-assisted session recomputed and waived the metric, then found the netloc bug while reading that function. The scan did not surface the bug, and this pair shows no speed or token benefit; the benefit was orientation. URL(netloc=b"[::1]:8080") fails at 0.27.0 and on current 0.28.1; the fix is a bracket-aware split with 1 failed before and 87 passed after.

Full record: experiment, session A, session B, verification, patch.

Merge Danger

Door: two-way. The vendor default is one config override away. Existing baselines and comparisons see a config-digest change, so their vendor findings should be reviewed and the baseline updated rather than treated as fixed.

Blast Radius: analysis output and default finding counts. priorities keeps its shape, so existing consumers still work; new consumers can use investigation.leads. Repositories with vendored folders will report fewer findings after this change.

No maintainer adoption is claimed. No pull request was opened against the requests or clap sample repositories. Draft only; do not merge.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn