che-xray

Run the che-xray scan once per project. It detects language, frontend/backend frameworks, database drivers, auth providers, testing frameworks, and CI/CD from package manifests, config files, and a graphify knowledge graph, then writes a 12-section project_profile.md.

The scan classifies structure by looking for marker files: pnpm-workspace.yaml for pnpm workspaces, nx.json for Nx, turbo.json for Turborepo, and a workspaces field in package.json for npm workspaces. It also counts apps and shared packages.

Run it exactly once per project, the first time Che touches the repository, or again when architecture changes significantly such as a monolith-to-monorepo migration. It is idempotent and merges new findings without overwriting manually edited sections.

Yes. If graphify is unavailable (GRAPHIFY_OK=0), the scan falls back to a lightweight heuristic pass using glob and grep over file extensions, package manifests, CI configs, and migration folders to infer the stack and structure.

It flags god packages with excessive file counts, suspicious circular imports, raw SQL outside migration folders, projects with zero unit test files, hardcoded secrets, and hardcoded environment URLs, each with one line of evidence.

Results are written outside the worktree into the global project registry (Level 1.5): project_profile.md, an auto-filled architecture.md, and an appended audit line in registry.jsonl, so all worktrees and sessions share the same profile.