rex(#5): Fix JDepend to use source-based analysis when no compiled classes

Session 93: When no compiled .class files are found, JDepend now falls back
to source-based analysis from architecture-runner.ts instead of returning
empty results.

Changes:
- Modified runJDepend() in java-tool-orchestrator.ts
- Uses javaArchitectureRunner.runSourceBasedAnalysis() as fallback
- Converts architecture issues to RawIssue format
- Detects: circular-dependency, god-package, high-efferent-coupling

Tested on spring-petclinic (no compiled classes):
- Found 4 high-efferent-coupling issues from source analysis

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: alpsla

packages/agents/src/two-branch/tools/java/java-tool-orchestrator.ts

@@ -793,15 +793,33 @@ export class JavaToolOrchestrator extends BaseToolOrchestrator {
       const classesDir = await this.findJavaClassesDir(repoPath);
 
       if (!classesDir) {
-        logger.warn('⚠️ No compiled Java classes found. JDepend requires compiled .class files.');
-        logger.warn('   Run: mvn compile (Maven) or gradle build (Gradle) first.');
+        logger.info('🔄 No compiled Java classes found. Falling back to source-based analysis...');
+
+        // Session 93 Fix: Use source-based analysis from architecture-runner when no compiled classes
+        const { javaArchitectureRunner } = await import('./architecture-runner');
+        const sourceAnalysisIssues = await javaArchitectureRunner.runSourceBasedAnalysis(repoPath);
+
+        // Convert architecture issues to RawIssue format
+        const issues: RawIssue[] = sourceAnalysisIssues.map(issue => ({
+          tool: 'jdepend',
+          file: issue.file || issue.packageName || '',
+          line: issue.line || 0,
+          column: 0,
+          severity: issue.severity,
+          message: issue.message,
+          rule: issue.rule,
+          category: 'architecture'
+        }));
+
+        logger.info(`✅ Source-based analysis found ${issues.length} architecture issues`);
+
         return {
           tool: 'jdepend',
           success: true,
           duration: Date.now() - startTime,
-          issues: [],
-          rawOutput: 'No compiled classes found. JDepend requires compiled .class files.',
-          metadata: this.calculateMetadata([])
+          issues,
+          rawOutput: `Source-based analysis (no compiled classes): Found ${issues.length} issues`,
+          metadata: this.calculateMetadata(issues)
         };
       }
 

packages/agents/tests/integration/test-outputs/attachments/group-java-lang-security-audit-active-debug-code-printstacktrace-active-debug-code-printstacktrace-medium-semgrep-fix.json

@@ -4,26 +4,30 @@
   "rule": "java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace",
   "tool": "semgrep",
   "severity": "medium",
-  "description": "Remove or conditionally disable debug print statements in production builds. Use a proper logging framework with appropriate log levels and ensure debug-level logging is disabled in production environments. Consider using build profiles or environment variables to control debug output.",
+  "description": "Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information.",
   "fix_pattern": {
     "type": "template",
+    "fixTier": 2,
+    "fixerTool": "ai",
+    "fixerCommand": "ai",
+    "confidence": 85,
     "example": {
       "before": "",
-      "after": "public class MavenWrapperDownloader {\n    // ... other code\n    public static void main(String[] args) {\n        // Remove or comment out debug logging\n        // System.out.println(\"Downloading from: \" + MAVEN_WRAPPER_URL);\n        // ... rest of the method\n    }\n}"
+      "after": "@GwtIncompatible // java.io.PrintWriter, java.io.StringWriter\n  public static String getStackTraceAsString(Throwable throwable) {\n    StringWriter stringWriter = new StringWriter();\n    PrintWriter printWriter = new PrintWriter(stringWriter);\n    throwable.printStackTrace(printWriter);\n    printWriter.close();\n    return stringWriter.toString();\n  }"
     },
-    "instructions": "Remove or conditionally disable debug print statements in production builds. Use a proper logging framework with appropriate log levels and ensure debug-level logging is disabled in production environments. Consider using build profiles or environment variables to control debug output."
+    "instructions": "Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information."
   },
   "locations": [
     {
-      "file": ".mvn/wrapper/MavenWrapperDownloader.java",
-      "line": 92,
-      "snippet": "    89 |             System.exit(0);\n    90 |         } catch (Throwable e) {\n    91 |             System.out.println(\"- Error downloading\");\n>   92 |             e.printStackTrace();\n    93 |             System.exit(1);\n    94 |         }\n    95 |     }",
-      "category": "NEW"
+      "file": "amazon-s3-quickstart/src/main/java/org/acme/s3/S3AsyncClientResource.java",
+      "line": 56,
+      "snippet": "    53 |                 })\n    54 |                 .onItem().ignore().andSwitchTo(Uni.createFrom().item(Response.created(null).build()))\n    55 |                 .onFailure().recoverWithItem(th -> {\n>   56 |                     th.printStackTrace();\n    57 |                     return Response.serverError().build();\n    58 |                 });\n    59 |     }",
+      "category": "EXISTING_REST"
     }
   ],
   "metadata": {
     "total_occurrences": 1,
-    "confidence": "low",
+    "confidence": "medium",
     "safe_auto_apply": false,
     "estimated_time_seconds": 1
   }

packages/agents/tests/integration/test-outputs/attachments/group-java-spring-security-audit-spring-actuator-fully-enabled-spring-actuator-fully-enabled-high-semgrep-fix.json

@@ -4,26 +4,30 @@
   "rule": "java.spring.security.audit.spring-actuator-fully-enabled.spring-actuator-fully-enabled",
   "tool": "semgrep",
   "severity": "high",
-  "description": "1. Disable unnecessary actuator endpoints using management.endpoints.web.exposure.exclude=env,logfile,heapdump\n2. Enable Spring Security with proper authentication for actuator endpoints\n3. Configure actuator security via spring.security.user.name and spring.security.user.password properties\n4. Restrict actuator access to specific IP ranges or internal networks only",
+  "description": "Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk.",
   "fix_pattern": {
     "type": "template",
+    "fixTier": 2,
+    "fixerTool": "ai",
+    "fixerCommand": "ai",
+    "confidence": 85,
     "example": {
       "before": "",
-      "after": "# Before (vulnerable)\n# spring.boot.admin.client.enabled=true\n\n# After (secure)\nmanagement.endpoints.web.exposure.exclude=env,logfile,heapdump\nmanagement.endpoints.web.exposure.include=health,info\nspring.security.user.name=admin\nspring.security.user.password=securePassword123"
+      "after": "management.endpoints.web.exposure.include=health,info"
     },
-    "instructions": "1. Disable unnecessary actuator endpoints using management.endpoints.web.exposure.exclude=env,logfile,heapdump\n2. Enable Spring Security with proper authentication for actuator endpoints\n3. Configure actuator security via spring.security.user.name and spring.security.user.password properties\n4. Restrict actuator access to specific IP ranges or internal networks only"
+    "instructions": "Spring Boot Actuator is fully enabled. This exposes sensitive endpoints such as /actuator/env, /actuator/logfile, /actuator/heapdump and others. Unless you have Spring Security enabled or another means to protect these endpoints, this functionality is available without authentication, causing a significant security risk."
   },
   "locations": [
     {
       "file": "src/main/resources/application.properties",
-      "line": 17,
-      "snippet": "    14 | spring.messages.basename=messages/messages\n    15 | \n    16 | # Actuator\n>   17 | management.endpoints.web.exposure.include=*\n    18 | \n    19 | # Logging\n    20 | logging.level.org.springframework=INFO",
+      "line": 18,
+      "snippet": "    15 | spring.messages.basename=messages/messages\n    16 | \n    17 | # Actuator\n>   18 | management.endpoints.web.exposure.include=*\n    19 | \n    20 | # Logging\n    21 | logging.level.org.springframework=INFO",
       "category": "EXISTING_REST"
     }
   ],
   "metadata": {
     "total_occurrences": 1,
-    "confidence": "low",
+    "confidence": "medium",
     "safe_auto_apply": false,
     "estimated_time_seconds": 1
   }