/ase-code-analyze

name: ase-code-analyze
argument-hint: "[--help|-h] [--performance|-p] [--security|-s] [--severity|-S=(AUTO|LOW|MEDIUM|HIGH)] [--prefix|-P=<prefix>] [--staged] [--unstaged] [<source-reference>]"
description: >
    Analyze the source code for problems in either the logic and
    semantics and its related control flow, performance and efficiency,
    or security.
user-invocable: true
disable-model-invocation: false
effort: high
allowed-tools:
    - "Agent"
    - "Glob"
    - "Bash(git rev-parse *)"
    - "Bash(git -C *)"

@${CLAUDE_SKILL_DIR}/../../meta/ase-control.md @${CLAUDE_SKILL_DIR}/../../meta/ase-skill.md @${CLAUDE_SKILL_DIR}/../../meta/ase-getopt.md

<purpose name="ase-code-analyze"> Analyze Source Code </purpose>

<expand name="getopt" arg1="ase-code-analyze" arg2="--performance|-p --security|-s --severity|-S=(AUTO|LOW|MEDIUM|HIGH) --prefix|-P= --staged --unstaged"> $ARGUMENTS </expand>

<objective> *Analyze* the source code of <getopt-arguments/>, and its directly related source code, for problems - read-only, *without* applying any changes. The *analysis lens* depends on the selected options: problems in its *logic* and *semantics* and its related *control flow*, or problems in *performance* and *efficiency*, or problems in *security*. </objective>

<flow>

1. <step id="STEP 1: Sanity Check Usage">

<if condition="<getopt-option-performance/> is equal `true` and <getopt-option-security/> is equal `true`">

Only output the following <template/> and then *STOP* the entire flow (do not perform any further steps):

<template> ⧉ **ASE**: ✪ skill: **ase-code-analyze**, ▶ ERROR: options `--performance` and `--security` are mutually exclusive </template>

</if>

</step>

2. <step id="STEP 2: Investigate Code Base">

<if condition="<ase-project-boxing/> is equal `black` and <getopt-option-severity/> is equal `AUTO`">

The project source artifacts are classified as a *black box*, so the user does *not* want them inspected or their problems surfaced (an *explicitly* given severity floor lifts this skip). *Skip* the entire investigation and analysis: do *not* invoke any `Bash`, `Glob`, or `Agent` tool and do *not* read any source, only output the following <template/> and then *SKIP* the remaining step STEP 3:

<template> <ase-tpl-bullet-normal/> **CODE ANALYSIS**: *suppressed* (`project.boxing` is `black`) </template>

</if>

First, use the following <template/> to give a hint on this step:

<template> <ase-tpl-bullet-secondary/> **ANALYSIS INVESTIGATION** </template>

Dispatch the investigation to *sub-agents* via the `Agent` tool so that *no* investigation details leak into the user-visible transcript. The sub-agents perform the silent reading and checking; only their final structured return values are consumed here.

For this, first determine the *analysis lens* <lens/>: set <lens>performance</lens> if <getopt-option-performance/> is equal `true`, set <lens>security</lens> if <getopt-option-security/> is equal `true`, and set <lens>logic</lens> otherwise.

<if condition="<getopt-option-staged/> is equal `true` or <getopt-option-unstaged/> is equal `true`">

Then *silently* restrict the analysis to the *changed* files of the Git working copy. Set <changes>staged and unstaged</changes> if both <getopt-option-staged/> and <getopt-option-unstaged/> are equal `true`, set <changes>staged</changes> if only <getopt-option-staged/> is equal `true`, and set <changes>unstaged</changes> otherwise. Determine the *repository root* by running the command `git rev-parse --show-toplevel` (taken exactly as given) and capturing its output into <repo-root/>. Then determine the changed files by running the corresponding commands (taken exactly as given), each listing one path relative to <repo-root/> per line, and collect all listed paths, dropping duplicates:

<if condition="<getopt-option-staged/> is equal `true`"> `git -C "<repo-root/>" -c core.quotepath=off diff --cached --name-only --diff-filter=d` </if>

<if condition="<getopt-option-unstaged/> is equal `true`"> `git -C "<repo-root/>" -c core.quotepath=off diff --name-only --diff-filter=d`

`git -C "<repo-root/>" -c core.quotepath=off ls-files --others --exclude-standard` </if>

*Skip* every listed path below the `.ase/` directory (it carries *ASE*'s own state) and every path which is not a source code file (e.g. a binary file), and prefix every remaining path with `<repo-root/>/`. If `<getopt-arguments/>` is not empty, keep only those files which lie within the source code referenced by it, expanding any directory or wildcard references with the `Glob` tool. Set <sources/> to the resulting list of individual source code files, preserving order.

If <sources/> is empty, only output the following <template/> and then *SKIP* the rest of this STEP 2 and the remaining step STEP 3:

<template> <ase-tpl-bullet-normal/> **CODE ANALYSIS**: *no <changes/> source files to analyze* </template>

</if> <else>

Then *silently* resolve `<getopt-arguments/>` to the list <sources/> of individual source code files, expanding any directory or wildcard references with the `Glob` tool.

If <sources/> is empty (no *source-reference* given or none of it resolvable), only output the following <template/> and then *STOP* the entire flow (do not perform any further steps):

<template> ⧉ **ASE**: ✪ skill: **ase-code-analyze**, ▶ ERROR: no source files to analyze -- give a *source-reference* or use `--staged`/`--unstaged` </template>

</else>

Then partition <sources/>, preserving order, into at most *eight* batches of roughly equal size (a single file yields a single batch), and invoke the following tool once per batch, emitting *all*