feat(salesforce): read metadata XML, not just Apex - #3117
Graphify — worth a look
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 4 advisory finding(s) below merit a look before merge.
Details
Graphify reviewed this change.
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 4 advisory finding(s) below merit a look before merge.
Graphify review — findings
Adds a Salesforce *-meta.xml extractor and wires it into detection, dispatch, and file collection. classify_file and _get_extractor now route these files by filename (via is_salesforce_meta_xml_path) rather than extension, deliberately leaving plain .xml unclaimed so pom.xml/web.xml don't get swept in; collect_files shares a _claimed helper across both walks so the symlink-following path no longer misses them. The extractor derives what a file declares from its filename and emits leaf-element references as sourceless placeholders for corpus-level rewiring, skips .cls/.trigger/.js sidecars another extractor owns, caps input at 2 MB, and refuses DOCTYPE/ENTITY or NUL-containing (UTF-16/32) files to avoid entity-expansion attacks.
Worth a look
- Reference stub id uses _make_id(part) but component nodes use _make_id(stem, name), so references never rewire to definitions —
graphify/extractors/salesforce_meta_xml.py:210· Escalate · high- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
- _is_api_name rejects all-uppercase identifiers, dropping valid Apex/object references —
graphify/extractors/salesforce_meta_xml.py· Escalate · medium · 2 independent checks- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
- owner stub id _make_id(owner) does not match owner object's own component id _make_id(stem, name) —
graphify/extractors/salesforce_meta_xml.py:190· Escalate · medium- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
- Layout fullName references with spaces or hyphens are skipped —
graphify/extractors/salesforce_meta_xml.py:198· Escalate · medium- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 2223 functions depend on the 385 functions this change touches.
Health — this change adds coupling hotspots:
- new:
extract()— 500 callers, 42 callees - new:
_rebuild_code()— 98 callers, 50 callees - new:
detect()— 108 callers, 15 callees - new:
save_manifest()— 40 callers, 11 callees - new:
extract_files_direct()— 17 callers, 20 callees - new:
extract_xaml()— 19 callers, 17 callees - new:
extract_corpus_parallel()— 26 callers, 11 callees - new:
extract_js()— 83 callers, 3 callees - …and 41 more — each is listed as a finding
Verification — 2223 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 1996 function(s) in the blast radius were not formally verified this run