/code-assessment

name: code-assessment
description: |
  Detect, review, and fix code-quality and correctness issues in an AEM as a Cloud Service
  project — locally, with no external services or network calls. Use whenever a user wants to
  check, review, assess, audit, scan, modernize, upgrade, or fix AEM Java, Sling Models, OSGi,
  or Maven code — for example: "check my Sling Models are implemented correctly", "review my
  @Inject usage", "are my Maven dependencies up to date", "scan this AEM project for issues",
  "modernize my Sling Models", or "fix code-quality problems". Name the files to assess, or ask
  it to scan the repo; it detects issues, plans, and — only when you ask — applies surgical
  edits on a branch or in place, then verifies with mvn compile. It recognises the intent and
  handles each issue type itself, reporting anything it cannot yet fix.
license: Apache-2.0

AEM as a Cloud Service — Code Assessment

Single skill for detecting and fixing AEM CS code-quality issues, **entirely against the local workspace** — no external services or network calls. Findings reach the runbook from one of two sources; everything downstream is identical.

Findings sources

| Source | When | Target versions (deps) | |---|---|---| | **User-named** | the user names files or coordinates | user-supplied | | **Discover** | the user asks to scan, or names no files | user-supplied (per the pattern's resolution contract) |

Discovery runs through the deterministic **analyzer** ([`scripts/analyze.sh`](scripts/README.md)): it parses the workspace once and runs the enabled detectors, emitting the shared findings shape. Every `ready` pattern has an analyzer detector. One detector — `remove-deprecated-api` — loads its rules dynamically from a preflight-produced cache ([`remove-deprecated-api/scripts/detect.sh`](remove-deprecated-api/scripts/detect.sh) runs the AEM Analyser Maven Plugin and writes the cache TSV before the analyzer is invoked); the detector's shape and integration are otherwise identical. Patterns without a detector are `planned` only — not yet detectable and not yet built; there is **no LLM-scan fallback** in this version (see Scope & limitations) — the `scan` value on `planned` rows in [`references/patterns.md`](references/patterns.md) marks the intended future detection method, not an active code path.

Routing

1. **User named files / coordinates** → run the runbook in `with_findings` mode against those paths. 2. **"Scan my repo" / no files named** → run the runbook in `discover` mode (per-pattern Discovery, workspace roots only).

Then follow the runbook: [`references/runbook.md`](references/runbook.md).

Manual Pattern Hints (classification → expert skill)

Route the request to one expert skill. Two pattern families share this skill:

**Mechanical fixes** (analyzer-driven detection, deterministic edits — follow the runbook flow):

| User said / saw | Expert skill | |---|---| | "update aem sdk", "upgrade mockito", stale `<version>` or `${property}` in pom | [`outdated-dependencies/`](outdated-dependencies/SKILL.md) | | "fix @Inject", "modernize Sling Models", `javax.inject.Inject` on `@Model` fields | [`inject-in-sling-model/`](inject-in-sling-model/SKILL.md) | | "add HTTP timeouts", "outbound/external call has no timeout", `HttpClient` / `HttpClients` / `OkHttpClient` built without a timeout | [`outbound-call-timeouts/`](outbound-call-timeouts/SKILL.md) | | "bound my query", "unbounded query", "query causing OOM", `p.limit=-1`, `setLimit(-1)` | [`unbounded-query/`](unbounded-query/SKILL.md) | | "remove deprecated API", "fix deprecated imports", "Cloud Manager deprecated API failure", `region-deprecated-api` / `api-regions-check` / `Import-Package not satisfied` pipeline failures, log4j migration, commons-lang/collections upgrades, deprecated Maven deps, unmodifiable OSGi configs | [`remove-deprecated-api/`](remove-deprecated-api/SKILL.md) _(analyzer detector with dynamic rules — preflight runs `aemanalyser-maven-plugin`; hint-driven fixes; see recipe.md)_ |

**Architectural migration patterns** (guided remediation — full before/after, troubleshooting, modern alternatives; invoked directly or via `migration` for BPA/CAM-driven discovery):

| User said / saw | Expert skill | BPA pattern ID | |---|---|---| | `org.apache.sling.commons.scheduler.Scheduler` or `scheduler.schedule(` with `Runnable` | [`scheduler/`](scheduler/SKILL.md) | `scheduler` | | `implements ResourceChangeListener`, lightweight listener + JobConsumer | [`resource-change-listener/`](resource-change-listener/SKILL.md) | `resourceChangeListener` | | `com.day.cq.replication.Replicator`, `org.apache.sling.replication.*`, "publish/preview activation" | [`replication/`](replication/SKILL.md) | `replication` | | `javax.jcr.observation.EventListener`, `org.osgi.service.event.EventHandler` on non-resource topics (replication, workflow, custom) | [`event-migration/`](event-migration/SKILL.md) | `eventListener` / `eventHandler` | | `com.day.cq.dam.api.AssetManager` create/upload/delete APIs, `createAssetForBinary`, `removeAssetForBinary` | [`asset-manager/`](asset-manager/SKILL.md) | `assetApi` | | HTL build warning `data-sly-test: redundant constant value comparison` | [`references/data-sly-test-redundant-constant.md`](references/data-sly-test-redundant-constant.md) | `htlLint` (reference, no expert skill subdirectory) |

**Broad / correctness-review asks** ("check my Sling Models are implemented correctly", "review my code", "is my AEM project healthy", "assess this project") are not a single pattern: run the runbook in `discover` mode with intent `report` — the analyzer runs every detector and the report covers all built patterns, explicitly noting aspects not yet supported. Only narrow to one pattern when the user targets a specific fix.

If nothing matches, say the issue is not yet supported and offer to file a request for a new expert skill.

**Full catalog** (built + `planned` patterns, with severity / detection / fi