Code analysis

bee code analyze checks source without MongoDB or bee init. Select a compiler engine for C#, TypeScript, Vue, Dart, Swift/iOS or Kotlin/Android, using the supported context described below. The default engine keeps the six C# naming and maintainability rules. Compiler tools and dependencies must already be installed; analysis does not download them.

C# compiler diagnostics

From the repository directory:

bee code analyze --engine roslyn --json

Install the .NET SDK and the reference packs required by the project’s target framework first. Bee does not download them; unavailable references are reported as incomplete analysis.

This engine reports real C# compiler diagnostics, such as CS0029 when a string is assigned to an integer. Findings retain the compiler’s rule identity and source location. The version 2 report also identifies the engine, analysis profile, source snapshot and completion state. Analysis coverage and test coverage are separate; this command does not run tests or measure test coverage.

Bee reads project inputs and performs the analysis in process. It does not run MSBuild targets, restore packages, execute generators or load the repository’s analyzer plugins. Missing dependencies and project features that cannot be faithfully reconstructed produce an incomplete result. A clean result applies to the reported scope; it is not proof that every target framework builds.

This first slice supports the default Debug context. Explicit DefineConstants, DisableImplicitConfigurationDefines or DisableImplicitFrameworkDefines settings produce incomplete analysis.

The snapshot is tied to source content, not just a branch name or a file’s modification time. Git information, when available, is provenance; uncommitted source changes are part of the content identity. Runs with the same effective inputs, engine and profile have the same normalized analysis identity. snapshot.dirty stays null (unknown); compare source inputs using the content identity.

The default command and bee lint --native keep their version 1 report and existing exit codes. Explicit compiler engines use version 2. Test-coverage import, duplication and new-code gates remain future work.

TypeScript, Vue and Dart

Select an engine and supply an existing toolchain explicitly. Bee does not install tools, restore packages or execute project scripts during analysis. Run these commands from the project directory; replace the absolute tool paths.

bee code analyze --engine typescript --project tsconfig.json --runtime /tools/node --toolchain /tools/node_modules --json
bee code analyze --engine vue --project tsconfig.json --runtime /tools/node --toolchain /tools/node_modules --json
bee code analyze --engine dart --project pubspec.yaml --toolchain /tools/dart-sdk --json

Engine	Context and output
typescript	TypeScript Compiler API with the selected tsconfig, sources and captured declarations; original TSxxxx diagnostics
vue	Vue language tools for script and template checking; findings map to the original .vue source
dart	Dart SDK analyzer, declared package configuration and supported analysis options; original analyzer rule codes

The Node toolchain directory contains TypeScript and, for Vue, vue-tsc with its dependencies. Use a trusted installed toolchain. Required project dependencies must already exist. Dart package imports use an existing .dart_tool/package_config.json; supported options can include captured relative files or package:lints rules. This Dart engine does not support Flutter projects.

Each engine analyzes captured source and dependency inputs in a private temporary directory. Its report records actual compiler/SDK identity, source locations, fingerprints and completion status. Selecting source paths narrows findings, while the required compilation context remains available. Non-.NET engines report analyzed contexts; compiled-projects is not applicable.

Unsupported config plugins, executable hooks, missing dependencies and unmappable diagnostics produce an incomplete report. Vue preprocessors, external SFC scripts and custom blocks are outside this slice. The external engines currently emit version 2 JSON or text; SARIF and native rulesets are not supported for them. Use --timeout-seconds to allow more time for larger toolchain snapshots. After a timeout or cancellation, each engine has a separate cleanup window: 500 ms by default, or 3 seconds for adapters that own external compiler processes. If cleanup does not finish in that window, the incomplete report includes cleanup-timeout.

Tool versions

This release accepts TypeScript 6.0.3, Vue language-core 3.3.6 with Volar TypeScript 2.4.28 (provided by the tested vue-tsc 3.3.6 installation), and Dart SDK 3.11.4. Other compiler versions produce incomplete analysis. Node 26.4.0 is used by the package verification suite. Keep the analysis toolchain in a separate directory if your application’s dependency versions differ.

Swift for iOS and Kotlin for Android

Native mobile analysis uses an explicit JSON compilation context. Declare all source files and SDK dependencies needed for the selected module. Source paths are relative to the invocation directory; tool and SDK paths are absolute. Unknown fields and unsupported settings are rejected. Bee does not evaluate an Xcode project, Swift package manifest or Gradle build.

For Swift, save this context as bee-ios.json, replace the SDK path and select a target supported by that SDK. This engine requires a macOS host with Xcode.

{
  "schemaVersion": 1,
  "language": "swift",
  "platform": "ios",
  "moduleName": "MobileApp",
  "sources": ["Types.swift", "Main.swift"],
  "sdkRoot": "/absolute/iPhoneOS.sdk",
  "targetTriple": "arm64-apple-ios18.0",
  "defines": ["DEBUG"],
  "dependencies": []
}

bee code analyze --engine swift --project bee-ios.json --toolchain /absolute/XcodeDefault.xctoolchain --timeout-seconds 600 --json

Capturing a large iOS SDK and type-checking sources that use UIKit can take several minutes, especially on Intel Macs. This example allows ten minutes; the default timeout remains 60 seconds.

Swift dependencies contains additional ordinary .swift source files in the same module. It does not accept prebuilt custom modules or package manifests. The engine captures the selected iOS SDK and required compiler resources, then type-checks the declared sources. Findings use swift.compiler with the actual compiler version and physical source positions. Simulator and macOS application contexts are outside this iOS slice. Custom macros, unsupported attributes, #sourceLocation, mixed Objective-C and bridging headers are unsupported.

For Kotlin, save this context as bee-android.json and set the actual Android SDK jar and installed compiler/Java paths:

{
  "schemaVersion": 1,
  "language": "kotlin",
  "platform": "android",
  "moduleName": "MobileApp",
  "sources": ["Types.kt", "Main.kt"],
  "androidJar": "/absolute/android-sdk/platforms/android-36/android.jar",
  "classpath": [],
  "jvmTarget": "17"
}

bee code analyze --engine kotlin --project bee-android.json --toolchain /absolute/kotlinc --runtime /absolute/jdk/bin/java --timeout-seconds 180 --json

classpath contains existing project JARs, read as compilation metadata. The Java runtime runs the trusted Kotlin compiler; Android API types come from android.jar. Desktop JDK classes do not become Android APIs. Diagnostics use kotlin.compiler and the compiler’s structured locations. Kotlin scripting, KAPT/KSP, Compose/compiler plugins, mixed Java and Kotlin Multiplatform are not supported. Required generated types must already be present as explicitly declared, supported sources or dependency metadata.

Both contexts describe the exact scope you provide. A complete analysis does not validate application packaging, signing, resources, minSdk/desugaring, emulators, devices or runtime behavior. Missing SDKs/dependencies and unsupported contexts exit 5. Swift iOS on Linux or Windows also exits 5. Large SDK snapshots can take longer than ordinary source checks.

Swift requires a 6.x compiler with its matching diagnostic library; the local reference check used Swift 6.4. Raw strings and raw regex literals are currently unsupported, along with attributes and directives outside the tested allowlist. Kotlin requires 2.1.21 and a Java 17 JDK; jvmTarget is 17. Android API 36 is used by the verification suite. Select the SDK for your declared context.

Native quality rules

bee code analyze src --scope source --json
bee code analyze --format sarif
bee lint src --native --scope source --json

bee lint --native selects four naming rules. bee code analyze also checks method length and complexity. The existing project-linter mode remains available.

Rule	Check
BEE1001	Private fields use _camelCase
BEE1002	Private constants use PascalCase
BEE1003	Async methods end in Async, with override/interface exclusions
BEE1004	Ordinary top-level public class name matches its file
BEE2001	Method body spans at most 200 physical lines by default
BEE2002	Cyclomatic-style complexity is at most 10 by default

BEE1004 excludes nested, partial and file-local classes, generated implicit Program, and grouped record/interface/enum declarations. Method length includes nested source within the body span. Complexity measures block-bodied local functions separately. Expression-bodied methods/local functions and lambda/anonymous bodies are not separately measured in this version; the report marks that metric coverage incomplete. Comments and strings are not executable branches.

Scope and reports

compiled is the default: Bee reconstructs the project’s selected C# inputs and preprocessor symbols without executing MSBuild, build targets or generators. It uses the existing graph loader, a chosen target framework and Roslyn Preview; unevaluated context and other limits are visible in the report. This is not a claim that every target framework was built. --scope source explicitly scans raw C# files instead. Neither mode executes repository code.

Native JSON and SARIF 2.1.0 reports include rule identities, locations, fingerprints, coverage and reasons for incomplete work. Line insertions above an unchanged symbol preserve its fingerprint. A changed symbol identity can change it. Unsupported languages, missing inputs and failed reads/parses do not produce a clean result. Built-in BEE rules cover C#. Use the explicit language engines above for compiler diagnostics.

Exit	Meaning
0	Clean, with executed rules and inspected source
1	Findings
4	Invalid command or ruleset
5	Could not run, or incomplete analysis

An incomplete run with findings still exits 5. CI should inspect the report and distinguish failure to analyze from a clean analysis.

Rulesets

bee lint --catalog --json
bee lint --validate-ruleset ruleset.json --json
bee lint --self-test --ruleset ruleset.json --json
bee code analyze --ruleset ruleset.json --format sarif

{
  "version": 1,
  "rules": [
    { "id": "BEE1001", "severity": "error" },
    { "id": "BEE2001", "options": { "max-lines": 120 } }
  ],
  "scope": "source"
}

The validator rejects unknown rules, duplicate fields, misspelled options, unsupported versions and empty rule selections. Self-test executes positive and negative fixtures through the actual selected rules. Natural-language guidance from bee hook rule is still guidance; it is not automatically converted into an executable analyzer. See bee lint.

Save and revisit an analysis

Save a compiler analysis explicitly, then read a small result summary without running the compiler again:

bee code analyze --engine roslyn --save-run --json
bee code runs list --json --limit 10 --budget 4096
bee code runs show <run-id> --json --limit 20 --budget 8192

--save-run supports the compiler engines roslyn, typescript, vue, dart, swift and kotlin. It does not support native/schema-1 or SARIF output. Without this flag, existing analysis output and storage behavior stay unchanged.

With --save-run --json, one analysis-save envelope contains the analysis and a storage receipt. Saving preserves the analysis exit code: 0 for clean, 1 for findings and 5 for incomplete. An existing run ID returns 8 without overwriting the artifact. Other storage failures return 5 and keep the analysis outcome separate. Invalid requests are not saved. An oversized report produces an explicit omitted-report summary rather than a successful save.

Each run has its own immutable local artifact. list checks metadata and reports integrity: report-not-checked; show also verifies report bytes, hashes and matching identity fields before reporting integrity: verified. Reading an intact incomplete or findings report exits 0; its analysisStatus and analysisExitCode still describe the original analysis. Missing runs exit 3, invalid arguments 4, and unreadable or corrupt artifacts 5.

Both read commands default to 20 results and a 16,000-character budget. --limit accepts 0–200; --budget accepts 2,048–65,536 UTF-16 characters, including the final newline. Whole entries are omitted to fit, with explicit counts. Partial scans are marked incomplete instead of claiming a complete newest-results list.

History belongs to the analysis working directory. Use --root DIR to read another directory’s namespace; separate checkouts do not automatically share history. Files live under Bee’s local analysis/runs/v1 directory. Saving is opt-in and does not automatically prune older artifacts; per-report limits are not a total disk quota.

Stored reports preserve available source and tool identities. Early failures may have no captured source or profile hash; an analysis key alone does not prove identical source inputs. This history does not establish settings compatibility, a baseline comparison, test coverage or a quality-gate result. Reusing an existing report avoids another analysis run, but does not show whether the current source has changed.