Conversation
Documents what every module under je_editor/ does, the layering and dependency direction, the startup flow, the runtime singletons, the threading model and the settings layout, so the structure can be checked without reading all 170 modules.
…o stay current Merges the two overlapping security sections, folds the long rule lists into single lines and drops the restated explanations, keeping every substantive rule and its analyser code. Adds a mandatory rule that architecture_explore.md is updated in the same commit as any structural change.
Adds a feature tour carried by eighteen captures of the application itself: a real run with its output, ruff diagnostics, a failing pytest with its traceback, the git client showing a diff, the terminal and the embedded browser. Also corrects the run-configuration plugin example, which passed keyword arguments and a 'command'/'suffix' pair that register_plugin_run_config has never accepted; it takes one dict keyed by suffixes, compiler and args.
langchain 1.2.15 carries CVE-2026-55443 (path traversal and sandbox escape in the file-search middleware and loaders), but nothing in the project ever imported it: the AI widget uses langchain_core.prompts and langchain_openai only, and langchain_openai depends on langchain-core rather than langchain. Removing it takes the vulnerable code out of the install altogether instead of shipping a newer copy of something unused, and avoids pulling in langgraph, which langchain 1.3.9 now requires. langchain_core is now declared directly, since it is imported directly; its version stays governed by the pinned langchain_openai.
Rewrites all 44 remaining Union[A, B] annotations as A | B, the form the rest of the codebase already uses, and drops the now-unused typing.Union imports. None is placed last so the hints read as X | None throughout. Requires Python 3.10, which the project already does.
Three patterns could degrade to quadratic time on a long line. The result pattern had two \S+ parts backtracking against each other, so the ':: is in the node id' check moves into code; the failure location now searches for its ':line: ' separator and slices around it instead of driving a lazy .+? from the front; and the summary line is recognised by stripping its '=' fence and looking for a keyword rather than by a pattern with two lazy quantifiers around an alternation. Matching behaviour is unchanged.
Collapses chained startswith calls into tuple arguments, builds the constant line-status maps with dict.fromkeys, drops exception classes already covered by a base class in the same except clause (IndentationError under SyntaxError, UnicodeDecodeError under ValueError), admits that read_file_with_encoding can return None, narrows the definition-location result with a statement-level isinstance check, removes two list() copies that guarded iterations which cannot mutate, and lifts the three Japanese labels used three times each into module constants, matching what english.py already does.
keyPressEvent dispatched through ten guard clauses in one body; the chain now lives in _handled_by_editing_keys and _handled_by_popup_or_newline, with the completion restart in _maybe_start_completion, and the order the keys are tried in is unchanged. _flatten_symbols hands one symbol's conversion to _symbol_entry and keeps only the walk itself.
Four tests built an argument inside the block, so a failure there would have been read as the call under test raising. The value is now prepared first, leaving one call that can throw.
The light styles left Python source nearly unreadable: keywords were a pale yellow and builtins a pure cyan, both tuned for a dark background. Those colours were fixed QColor values in syntax_setting.py, so PythonHighlighter never consulted the palette that every other language already used. The built-in rules now name a theme colour key, which PythonHighlighter resolves through actually_color_dict; a plugin passing a QColor still works. Two keys the palette was missing, syntax_builtin_color and syntax_self_color, are added to both sets. Two related defects came out with it. update_actually_color_dict listed its keys and defaults by hand, so a colour added to the palette resolved to nothing and was painted in the default text colour; it now derives both from DARK_COLORS. And switching styles only repainted, leaving every highlighter on the previous theme's colours, so _repaint_editors rebuilds them. The dark current line was near-white at [148, 148, 184], which buried the text sitting on it once keywords were no longer bright yellow; it now lifts slightly from the background instead.
PROGRESS.md is cleared whenever its items are done, so the environment notes, verification loop, Qt testing pitfalls, CI matrix and analyser-token endpoints kept there were one tidy-up away from being lost. They now live here, alongside a note that the progress file holds outstanding work and nothing else. Also records what this round of static-analysis work established: union type expressions over typing.Union, no exception already covered by a sibling in the same clause, no super-linearly backtracking regular expressions, deriving key tables rather than restating them, staging deliberately rather than with git add -u, and treating an analyser finding as a claim to verify. The machine-specific venv paths are generalised to 'the project venv' rather than published in a tracked file.
The interpreter paths differ per machine and do not belong in a tracked file, so the rule names the environment variables that carry them instead.
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 8 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thirteen commits that split into six pieces of work.
Security
langchain1.2.15 carries CVE-2026-55443 (path traversal and sandbox escape in the file-searchmiddleware and loaders). Nothing in the project ever imported it — the AI widget uses
langchain_core.promptsandlangchain_openaionly, andlangchain_openaidepends onlangchain-corerather thanlangchain. Removing it takes the vulnerable code out of the installinstead of shipping a newer copy of something unused, and avoids pulling in
langgraph, whichlangchain 1.3.9 now requires.
langchain_coreis declared directly, since it is imported directly.This changes what
pip install je_editorpulls in. It also makes #243 (bump langchain to1.3.11) unnecessary.
Documentation
architecture_explore.mdis new: what every module underje_editor/does, the layering anddependency direction, the startup flow, the runtime singletons, the threading model and the
settings layout.
CLAUDE.mdis condensed — the two overlapping security sections are merged and the rule listsfolded into single lines, keeping every substantive rule — and now requires the architecture
record to be updated in the same commit as any structural change. The standing environment,
verification, Qt-testing and CI notes move here from the untracked progress file, which is
cleared whenever its items are done.
application: a real run with its output, ruff diagnostics, a failing pytest with its traceback,
the git client showing a diff, the terminal and the embedded browser. It also corrects the
run-configuration plugin example, which passed keyword arguments and a
command/suffixpairthat
register_plugin_run_confighas never accepted.Theme colours
Light styles left Python source nearly unreadable: keywords were a pale yellow and builtins a pure
cyan, both tuned for a dark background. Those were fixed
QColorvalues insyntax_setting.py, soPythonHighlighternever consulted the palette every other language already used. The built-inrules now name a theme colour key; a plugin passing a
QColorstill works.Two related defects surfaced with it:
update_actually_color_dictlisted its keys and defaults byhand, so a colour added to the palette resolved to nothing and was painted in the default text
colour; and switching styles only repainted, leaving every highlighter on the previous theme's
colours.
The dark theme's Python colours change as a result — keywords go from yellow to the palette's
blue, matching every other language. The dark current line, previously near-white, now lifts only
slightly from the background so text on it stays readable.
Static analysis
68 of the 69 open SonarCloud findings are cleared: 44
Union[A, B]annotations rewritten asA | B, three patterns that could degrade to quadratic time on a long line, chainedstartswithcalls collapsed into tuple arguments, exception classes already covered by a sibling in the same
clause, two functions over the cognitive-complexity limit split, duplicated Japanese labels lifted
into constants, and four tests that built an argument inside their
pytest.raisesblock.The remaining finding is a false positive: S125 reads the bilingual comment at
extend_system_tray.py:27as commented-out code. The comment is correct and stays; it needsmarking as a false positive in SonarCloud.
Verification
ruff checkclean, 1859 tests passing, and both Qt smoke tests exiting 0 on every commit. CI greenon 3.10, 3.11 and 3.12 for each of the eleven pushes.