Skip to content

Conversation

@SimplyLiz
Copy link
Owner

Summary

  • Function-level complexity in auditRiskauditRisk now returns per-function functionComplexity[] with cyclomatic+cognitive scores via tree-sitter, sorted by complexity (top 10 per file). Falls back to string-counting heuristic without CGO.
  • Graceful degradation messaging — All compound tools (explore, understand, prepareChange) and auditRisk/findDeadCode now emit DegradationWarning in the envelope when SCIP is missing (~40% capability), stale (~60%), or git is unavailable (~20%), with actionable fix commands.
  • Test gap analysis — New analyzeTestGaps tool identifies untested functions sorted by complexity. Uses SCIP references when available, falls back to heuristic test file name matching. Added to refactor preset.
  • Richer prepareChange for rename/extractprepareChange now returns renameDetail (classified call sites, type refs, imports with context snippets) for rename operations, and extractDetail (boundary analysis) for extract operations, via parallel goroutines.
  • Unified planRefactor compound tool — New planRefactor tool aggregates prepareChange + auditRisk + analyzeTestGaps in parallel, returning combined risk assessment, impact analysis, test strategy, coupling analysis, and ordered refactoring steps by change type. Added to core and refactor presets.

Test plan

  • go build ./cmd/ckb compiles clean
  • go test ./internal/... — all 52 packages pass
  • go install ./cmd/ckb installs updated binary
  • Manual: auditRisk response includes functionComplexity[] with sorted functions
  • Manual: explore with stale index → response warnings[] includes capability message
  • Manual: analyzeTestGaps on a file → returns untested functions sorted by complexity
  • Manual: prepareChange with changeType: "rename" → response includes renameDetail
  • Manual: planRefactor on a file → returns combined risk + impact + tests + steps

🤖 Generated with Claude Code

Five features based on Cursor agent feedback from live refactoring trial:

1. Function-level complexity in auditRisk — wire tree-sitter complexity
   analyzer into audit, returning per-function cyclomatic+cognitive scores
   sorted by complexity (top 10 per file). Falls back to heuristic.

2. Graceful degradation messaging — new DegradationWarning type with
   capability percentages and fix commands. Wired into explore, understand,
   prepareChange, auditRisk, and findDeadCode MCP handlers.

3. Test gap analysis — new testgap package + analyzeTestGaps MCP tool.
   Cross-references complexity analysis with SCIP references or heuristic
   name matching to identify untested functions, sorted by risk.

4. Richer prepareChange for rename/extract — RenameDetail (call sites,
   type refs, imports with context snippets) and ExtractDetail (boundary
   analysis) added as parallel goroutines in PrepareChange.

5. Unified planRefactor compound tool — aggregates prepareChange + auditRisk
   + analyzeTestGaps in parallel, generates ordered refactoring steps by
   change type (rename/extract/delete/modify).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@github-actions
Copy link

🟡 Change Impact Analysis

Metric Value
Risk Level MEDIUM 🟡
Files Changed 17
Symbols Changed 410
Directly Affected 1
Transitively Affected 146

Blast Radius: 0 modules, 1 files, 147 unique callers

📝 Changed Symbols (410)
Symbol File Type Confidence
AnalyzeOptions internal/query/testgap.go added 100%
AnalyzeOptions#Limit internal/query/testgap.go added 100%
AnalyzeOptions#MinLines internal/query/testgap.go added 100%
AnalyzeOptions#Target internal/query/testgap.go added 100%
AnalyzeTestGapsOptions internal/mcp/tool_impls_testgap.go added 100%
AnalyzeTestGapsOptions#Limit internal/mcp/tool_impls_testgap.go added 100%
AnalyzeTestGapsOptions#MinLines internal/mcp/tool_impls_testgap.go added 100%
AnalyzeTestGapsOptions#Target internal/mcp/tool_impls_testgap.go added 100%
Analyzer internal/testgap/analyzer.go added 100%
Analyzer#Analyze internal/query/testgap.go added 100%
Analyzer#checkTestedViaHeuristic internal/testgap/analyzer.go added 100%
Analyzer#checkTestedViaSCIP internal/testgap/analyzer.go added 100%
Analyzer#collectFiles internal/testgap/analyzer.go added 100%
Analyzer#complexityAnalyzer internal/testgap/analyzer.go added 100%
Analyzer#complexityAnalyzer internal/audit/analyzer.go modified 100%
+395 more
🎯 Affected Downstream (20)
Symbol Module Distance Kind
unknown `` 1 type-dependency
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/cmd/ckb/runAudit(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/api/Server#handleAudit(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/Analyzer#analyzeFile(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/TestComputeSummary(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/TestDetectSecurityKeywords(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/TestDetectSecurityKeywordsNonexistent(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/TestFindQuickWins(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/TestFindSourceFiles(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/TestGenerateRecommendation(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/TestGetComplexity(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/TestGetComplexityNonexistent(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/TestHasTestFile(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/TestNewAnalyzer(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/mcp/MCPServer#RegisterTools(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/mcp/MCPServer#toolAnalyzeTestGaps(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/mcp/MCPServer#toolPlanRefactor(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/query/Engine#AnalyzeTestGaps(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/query/Engine#PlanRefactor(). `` 2 transitive-caller
scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/testgap/Analyzer#Analyze(). `` 2 transitive-caller

Recommendations

  • ⚠️ test: Significant transitive impact (146 symbols). Run comprehensive test suite.
    • Action: Run full test suite before merging

⚠️ Index is 0 commit(s) behind HEAD. Results may be incomplete.


Generated by CKB

@github-actions
Copy link

🔐 Security Audit Results

⚠️ Security gate passed with warnings - 7 issue(s) found (review recommended)

Category Findings
🔑 Secrets ✅ 0
🛡️ SAST ✅ 0
📦 Dependencies ⚠️ 7
📜 Licenses ⚠️ 144 non-permissive

📦 Dependency Vulnerabilities

Found 7 vulnerability(ies) across 2 scanner(s)

Details

Trivy (4 findings)

  • CVE-2026-22036 (MEDIUM): undici - undici: Undici: Denial of Service via excessive de...
  • CVE-2025-54410 (LOW): github.com/docker/docker - github.com/moby/moby: Moby's Firewalld reload remo...
  • GHSA-vrw8-fxc6-2r93 (MEDIUM): github.com/go-chi/chi/v5 - chi Allows Host Header Injection which Leads to Op...
  • CVE-2025-47908 (MEDIUM): github.com/rs/cors - github.com/rs/cors: Denial of service via maliciou...

OSV-Scanner (3 findings)

  • github.com/docker/docker: 2 vulnerabilities
  • github.com/go-chi/chi/v5: 1 vulnerabilities
  • github.com/rs/cors: 2 vulnerabilities

📜 License Issues

Found 144 non-permissive license(s)

Details
  • github.com/BurntSushi/toml: MIT (notice)
  • github.com/google/uuid: BSD-3-Clause (notice)
  • github.com/klauspost/compress: Apache-2.0 (notice)
  • github.com/klauspost/compress: BSD-3-Clause (notice)
  • github.com/klauspost/compress: MIT (notice)
  • github.com/pelletier/go-toml/v2: MIT (notice)
  • github.com/smacker/go-tree-sitter: MIT (notice)
  • github.com/sourcegraph/go-diff: MIT (notice)
  • github.com/sourcegraph/scip: Apache-2.0 (notice)
  • github.com/spf13/cobra: Apache-2.0 (notice)
  • ... and 134 more

Generated by CKB Security Audit | View Details | Security Tab

@codecov
Copy link

codecov bot commented Jan 31, 2026

Codecov Report

❌ Patch coverage is 11.70520% with 611 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
internal/query/compound_refactor.go 0.0% 183 Missing ⚠️
internal/testgap/analyzer.go 0.0% 162 Missing ⚠️
internal/query/prepare_rename.go 0.0% 70 Missing ⚠️
internal/mcp/tool_impls_compound.go 0.0% 41 Missing ⚠️
internal/query/prepare_extract.go 0.0% 41 Missing ⚠️
internal/audit/analyzer.go 21.0% 30 Missing ⚠️
internal/mcp/tool_impls_testgap.go 0.0% 25 Missing ⚠️
internal/query/compound.go 28.0% 16 Missing and 2 partials ⚠️
internal/mcp/tool_impls_v65.go 0.0% 14 Missing ⚠️
internal/query/degradation.go 64.7% 10 Missing and 2 partials ⚠️
... and 2 more

❌ Your patch status has failed because the patch coverage (11.7%) is below the target coverage (30.0%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files
@@            Coverage Diff            @@
##           develop    #126     +/-   ##
=========================================
- Coverage     44.9%   44.6%   -0.4%     
=========================================
  Files          350     357      +7     
  Lines        60028   60690    +662     
=========================================
+ Hits         27004   27081     +77     
- Misses       31188   31769    +581     
- Partials      1836    1840      +4     
Flag Coverage Δ
unit 44.6% <11.7%> (-0.4%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link

CKB Analysis

Risk Files +1342 -63 Modules

🎯 410 changed → 146 affected · 🔥 5 hotspots · 📊 7 complex · 💣 2 blast · 📚 143 stale

Risk factors: Medium-sized PR with 17 files • High churn: 1405 lines changed • Touches 5 hotspot(s)

Metric Value
Impact Analysis 410 symbols → 146 affected 🟡
Doc Coverage 9.090909090909092% ⚠️
Complexity 7 violations ⚠️
Coupling 0 gaps
Blast Radius 0 modules, 1 files
Index indexed (6s) 🆕
🎯 Change Impact Analysis · 🟡 MEDIUM · 410 changed → 20 affected
Metric Value
Symbols Changed 410
Directly Affected 1
Transitively Affected 146
Modules in Blast Radius 0
Files in Blast Radius 1

Symbols changed in this PR:

Downstream symbols affected:
Direct callers (1):

  • unknown
    Transitive callers (19):
  • scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/cmd/ckb/runAudit(). (depth 2)
  • scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/api/Server#handleAudit(). (depth 2)
  • scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/Analyzer#analyzeFile(). (depth 2)
  • scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/TestComputeSummary(). (depth 2)
  • scip-go gomod github.com/SimplyLiz/CodeMCP 1f12d5f15067 github.com/SimplyLiz/CodeMCP/internal/audit/TestDetectSecurityKeywords(). (depth 2)
  • … and 14 more transitive callers

Recommendations:

  • ⚠️ Significant transitive impact (146 symbols). Run comprehensive test suite.
    • Action: Run full test suite before merging

⚠️ Index is undefined commit(s) behind HEAD. Results may be incomplete. Run ckb index to refresh.

💣 Blast radius · 0 symbols · 2 tests · 0 consumers

Tests that may break:

  • internal/audit/audit_test.go
  • internal/mcp/presets_test.go
🔥 Hotspots · 5 volatile files
File Churn Score
internal/mcp/presets.go 8.58
internal/mcp/tool_impls_compound.go 9.32
internal/mcp/tool_impls_deadcode.go 7.76
internal/mcp/tools.go 12.03
internal/query/compound.go 11.65
📦 Modules · 2 at risk
Module Files
🟡 internal/mcp 7
🟡 internal/query 6
📊 Complexity · 7 violations
File Cyclomatic Cognitive
internal/audit/analyzer.go ⚠️ 19 ⚠️ 49
internal/mcp/presets_test.go ⚠️ 21 ⚠️ 35
internal/mcp/tool_impls_compound.go 15 ⚠️ 28
internal/mcp/tool_impls_deadcode.go ⚠️ 19 ⚠️ 32
internal/query/compound.go ⚠️ 31 ⚠️ 52
internal/query/compound_refactor.go ⚠️ 29 ⚠️ 62
internal/testgap/analyzer.go ⚠️ 16 ⚠️ 27
💡 Quick wins · 10 suggestions
📚 Stale docs · 143 broken references

Generated by CKB · Run details

@SimplyLiz SimplyLiz closed this Jan 31, 2026
@SimplyLiz SimplyLiz deleted the feature/v8.2-refactoring-tools branch January 31, 2026 11:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants