Skip to content

Load-path overlays, merge gate, and faster indexing - #21

Merged
cursor[bot] merged 5 commits into
mainfrom
cursor/loadpath-full-fledged-review-89eb
Aug 15, 2026
Merged

cursor[bot] merged 5 commits into
mainfrom
cursor/loadpath-full-fledged-review-89eb

Conversation

@Modsofthenation

@Modsofthenation Modsofthenation commented Aug 15, 2026 •

Copy link
Copy Markdown
Owner

Walks the rest of a Django + React (and FastAPI) monorepo as load-path inspection — not hunk comments.

Merged with main (PR #20: app namespacing, FilterSet, nested regex routes, workspace-switch loading). Adversarial review findings on this branch are addressed in the merge.

Review surface

  • GitHub Action merge gate (fail-on: never / blocker / low / medium) plus --github-output
  • --dirty working-tree review
  • Fetch a GitHub / GitLab / Bitbucket PR into a detached worktree at the PR head (review_pull_request, Review this PR) so index reads the PR tree, not the local checkout
  • GitLab nested groups, GitHub Enterprise, and self-hosted GitLab OAuth hosts
  • Suggested tests from untested seams
  • What-if from one indexed node (CLI whatif, inspector, MCP what_if)
  • Guided read-order tour (prev/next highlights the graph)
  • Auth as a first-class load path
  • Contract-break labels: additive / breaking / drift (only added required=True is breaking)
  • Confidence trend on the same PR/range

Overlays on the same graph

  • GraphQL (Strawberry + Graphene) stitched like OpenAPI, including client gql documents
  • Django Channels consumers and websocket routes as sinks
  • Django templates + HTMX ({% url %}, include/extends, hx-*)
  • Cache keys, feature flags, and transaction.on_commit as sinks
  • FastAPI next to Django in the same repo (Ninja routes are not also extracted as FastAPI)

Indexing progress and speed

  • Live phase/file progress (scan → extract N/M → boot → stitch → done) so a long index is distinguishable from a hang
  • CLI progress bar (loadpath index -j N); LOADPATH_INDEX_JOBS also works
  • GET /api/index/progress?repo_path= polled by the UI (current file/phase in the rail; determinate bar when totals are known)
  • Hash each source file once (no double-hash on drift)
  • Parallel AST extract via ProcessPoolExecutor (spawn); SQLite upserts stay on one thread
  • Default stays sequential below 80 files (spawn overhead); --jobs / LOADPATH_INDEX_JOBS force a pool
  • WAL + batched commits; frozen Electron sidecars stay at 1 worker; spawn failure falls back to sequential
  • INDEX_REVISION bumped so overlay identity is not skipped on incremental index

Safety

  • Clone failures redact tokens from git stderr before they reach the UI
  • Repo slugs reject . / .. path segments while still allowing GitLab group/subgroup/project

Demo fixture, unit, and e2e coverage added for the new extractors, stitch, gate, GitLab, dirty review, what-if, progress events, parallel vs sequential graph identity, UI progress polling, PR worktree checkout, and Ninja-vs-FastAPI extract.

Open in Web Open in Cursor 

Summary by CodeRabbit

  • New Features
    • Added GitLab, GitHub Enterprise, and self-hosted GitLab support, including OAuth and merge-request reviews.
    • Added GitHub Action support for automated reviews, merge gates, outputs, and optional pull-request comments.
    • Added dirty-worktree reviews, pull-request fetching, What-If impact analysis, and review progress tracking.
    • Expanded reviews with contract-break detection, authorization findings, suggested tests, and confidence trends.
    • Added broader analysis for GraphQL, FastAPI, WebSockets, templates, HTMX, caching, feature flags, and transaction side effects.
  • Bug Fixes
    • Improved external repository URL validation, including GitLab and hosted GitHub URLs.
  • Documentation
    • Expanded setup and usage guidance for supported providers, reviews, integrations, and analysis features.

Walk GraphQL, Channels, Django templates/HTMX, cache/flags/on_commit, and
in-repo FastAPI as sinks on the same architecture graph. Classify contract
breaks, surface auth, suggest tests, what-if a node, and trend confidence.
Review dirty trees, fetch GitHub/GitLab/Bitbucket PRs into a local clone,
and fail CI via a composite Action plus --fail-on.

Co-authored-by: zord.lack.net <zord.lack.net@gmail.com>
@coderabbitai

coderabbitai Bot commented Aug 15, 2026 •

Copy link
Copy Markdown

Review Change Stack

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: aaf529f8-1cf1-466a-9922-868304e64c0d

📥 Commits

Reviewing files that changed from the base of the PR and between d4d1a32 and 4f2eaf8.

📒 Files selected for processing (65)
  • README.md
  • action.yml
  • desktop/urls.mjs
  • desktop/urls.test.mjs
  • fixtures/demo_monorepo/backend/billing/consumers.py
  • fixtures/demo_monorepo/backend/billing/gateway.py
  • fixtures/demo_monorepo/backend/billing/routing.py
  • fixtures/demo_monorepo/backend/billing/schema.py
  • fixtures/demo_monorepo/backend/billing/templates/billing/base.html
  • fixtures/demo_monorepo/backend/billing/templates/billing/invoice_board.html
  • fixtures/demo_monorepo/backend/billing/urls.py
  • fixtures/demo_monorepo/backend/billing/views.py
  • fixtures/demo_monorepo/frontend/src/features/billing/InvoicePage.tsx
  • fixtures/demo_monorepo/loadpath.yml
  • fixtures/demo_monorepo/openapi.yaml
  • src/loadpath/architecture/snapshot.py
  • src/loadpath/cli.py
  • src/loadpath/extractors/__init__.py
  • src/loadpath/extractors/django.py
  • src/loadpath/extractors/react.py
  • src/loadpath/extractors/templates.py
  • src/loadpath/graph/store.py
  • src/loadpath/index.py
  • src/loadpath/mcp/compact.py
  • src/loadpath/mcp/server.py
  • src/loadpath/mcp/tools.py
  • src/loadpath/progress.py
  • src/loadpath/providers/oauth.py
  • src/loadpath/providers/pr_fetch.py
  • src/loadpath/providers/scm.py
  • src/loadpath/review/auth.py
  • src/loadpath/review/cluster.py
  • src/loadpath/review/contract.py
  • src/loadpath/review/diff.py
  • src/loadpath/review/engine.py
  • src/loadpath/review/gate.py
  • src/loadpath/review/render.py
  • src/loadpath/review/suggested_tests.py
  • src/loadpath/review/trend.py
  • src/loadpath/review/whatif.py
  • src/loadpath/server/app.py
  • src/loadpath/settings.py
  • src/loadpath/static/assets/LayeredGraph3D-DLi5mNhS.js
  • src/loadpath/static/assets/index-CE5vlBBA.js
  • src/loadpath/static/assets/index-CJdGI30d.css
  • src/loadpath/static/assets/index-DPfPes3Y.js
  • src/loadpath/static/index.html
  • src/loadpath/stitch/openapi.py
  • src/loadpath/types.py
  • tests/e2e/test_api_flow.py
  • tests/e2e/test_cli_review.py
  • tests/e2e/test_ui_flows.py
  • tests/unit/test_index_progress.py
  • tests/unit/test_overlays.py
  • tests/unit/test_providers_and_api.py
  • tests/unit/test_review_features.py
  • ui/src/App.tsx
  • ui/src/ImpactGraph.tsx
  • ui/src/api.ts
  • ui/src/graphView.test.ts
  • ui/src/graphView.ts
  • ui/src/nodeInspector.test.ts
  • ui/src/nodeInspector.ts
  • ui/src/styles.css
  • ui/src/types.ts

📝 Walkthrough

Walkthrough

This change adds GitLab and enterprise SCM support, pull-request fetching, dirty reviews, indexing progress, expanded architecture extraction, contract and authorization analysis, what-if reviews, CI gating, MCP tools, frontend workflows, and expanded fixture and test coverage.

Changes

Architecture extraction and indexing

Layer / File(s) Summary
Architecture graph expansion
src/loadpath/types.py, src/loadpath/extractors/*, src/loadpath/stitch/openapi.py, src/loadpath/architecture/snapshot.py
The graph now represents GraphQL, FastAPI, WebSockets, templates, HTMX, cache keys, feature flags, side effects, and Pydantic models. Extraction and stitching create relationships between client and server entities.
Parallel indexing and progress
src/loadpath/index.py, src/loadpath/progress.py, src/loadpath/graph/store.py, src/loadpath/cli.py
Indexing supports worker selection, parallel hashing and extraction, progress callbacks, batched commits, elapsed-time metadata, and residual extraction errors.
Fixture and overlay validation
fixtures/demo_monorepo/*, tests/unit/test_overlays.py, tests/unit/test_index_progress.py
The billing fixture includes FastAPI, GraphQL, Channels, templates, HTMX, cache, flags, and commit hooks. Tests validate extraction, stitching, progress, parallel consistency, and failure residuals.

SCM and review workflows

Layer / File(s) Summary
Provider and OAuth support
src/loadpath/providers/scm.py, src/loadpath/providers/oauth.py, src/loadpath/settings.py
GitLab providers, nested repository paths, self-hosted hosts, GitHub Enterprise API bases, GitLab OAuth, host persistence, and masked settings are added.
Pull-request preparation
src/loadpath/providers/pr_fetch.py, src/loadpath/mcp/tools.py, src/loadpath/server/app.py
The system can clone or reuse repositories, fetch pull-request refs, create detached worktrees, redact credentials, and run reviews against prepared pull-request trees.
Review analysis and gating
src/loadpath/review/*, src/loadpath/cli.py, src/loadpath/mcp/*
Reviews include dirty worktree changes, contract classifications, authentication findings, suggested tests, confidence trends, what-if simulations, gate results, GitHub output, and expanded Markdown or compact payloads.
Validation coverage
tests/unit/test_providers_and_api.py, tests/unit/test_review_features.py, tests/e2e/test_api_flow.py, tests/e2e/test_cli_review.py
Tests cover provider parsing, GitLab APIs, clone and worktree behavior, dirty diffs, contract and authorization findings, what-if traversal, trends, gating, and end-to-end API and CLI flows.

Application and frontend integration

Layer / File(s) Summary
Server and API contracts
src/loadpath/server/app.py, ui/src/api.ts, ui/src/types.ts
The server and client expose indexing progress, GitLab OAuth, what-if analysis, remote pull-request review, dirty-review options, expanded review metadata, and provider settings.
Frontend review workflows
ui/src/App.tsx, ui/src/ImpactGraph.tsx
The UI polls indexing progress, supports GitLab configuration and pull-request review, includes uncommitted changes, opens what-if analysis from graph nodes, tracks read order, and renders contract, authorization, test, and trend sections.
Graph presentation and assets
ui/src/graphView.ts, ui/src/nodeInspector.ts, ui/src/styles.css, src/loadpath/static/*
Graph families, node colors, sink and contract classifications, type descriptions, determinate progress styling, tour styling, and generated asset references are updated.

Action and documentation

Layer / File(s) Summary
GitHub Action
action.yml
The composite action installs Loadpath, indexes the repository, reviews the base branch, supports gating and comments, and exposes review metadata outputs.
External URL handling
desktop/urls.mjs, desktop/urls.test.mjs
The desktop allowlist accepts GitHub and GitLab merge-request and repository hosts while retaining existing provider cases.
Documentation
README.md
The README documents SCM configuration, dirty reviews, pull-request fetching, what-if analysis, merge gates, MCP tools, expanded extraction, confidence data, and fixture coverage.

Estimated code review effort: 5 (Critical) | ~120 minutes

Merge Risk: ⚪ Minimal · up to 4f2ea

No actionable merge-blocking risk remains; the PR is merge-ready after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant Developer
  participant UI
  participant API
  participant Indexer
  participant GraphStore
  participant ReviewEngine
  Developer->>UI: start indexing or review
  UI->>API: submit repository and review options
  API->>Indexer: index with workers and progress callback
  Indexer->>GraphStore: store extracted and stitched graph
  API-->>UI: return progress and review data
  UI->>ReviewEngine: request what-if or review workflow
  ReviewEngine->>GraphStore: load graph and review history
  ReviewEngine-->>UI: return findings, contract status, auth data, and suggested tests
Loading

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

Comment @coderabbitai help to get the list of available commands.

cursoragent and others added 2 commits August 15, 2026 13:24
parse_remote_url treated '.git' as part of the slug because the host regex
allows dots. Gate checks for a breaking contract before medium confidence
so --fail-on medium fails on a public-contract break.

Co-authored-by: zord.lack.net <zord.lack.net@gmail.com>
Indexing now reports scan/extract/boot/stitch phases with per-file counts, hashes each source once, extracts CPU-bound ASTs in a process pool, and keeps SQLite upserts on one thread with WAL and batched commits. The CLI shows a live bar, the API exposes GET /api/index/progress, and the UI polls that endpoint so a long index is distinguishable from a hang.

Co-authored-by: zord.lack.net <zord.lack.net@gmail.com>
@cursor cursor Bot changed the title Load-path overlays, merge gate, and PR fetch Load-path overlays, merge gate, and faster indexing Aug 15, 2026
cursoragent and others added 2 commits August 15, 2026 14:28
Spawn overhead dominates tiny trees, so default extract workers stay at 1 below 80 files (--jobs / LOADPATH_INDEX_JOBS still force a pool). Worker spawn failures fall back to sequential extract instead of writing an empty graph. The UI ignores idle progress polls so the rail shows the current phase, not "No index in progress".

Co-authored-by: zord.lack.net <zord.lack.net@gmail.com>
Keep PR #20 app namespacing, FilterSet, nested regex routes, and
workspace-switch loading while landing overlays, parallel index, and
the merge gate.

Also address merge-blocking review findings: index a detached worktree
at the fetched PR ref, redact clone tokens, skip FastAPI when Ninja
matched, classify only added required=True, bump INDEX_REVISION, keep
GitLab nested group slugs without path traversal, and allow self-hosted
GitHub/GitLab OAuth hosts.

Co-authored-by: zord.lack.net <zord.lack.net@gmail.com>
@Modsofthenation
Modsofthenation marked this pull request as ready for review August 15, 2026 14:53
@cursor
cursor Bot merged commit cddcf14 into main Aug 15, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants