Understand home-assistant/core's source layout and find a starting point for your task using the saved repository evidence.
Detailed import-graph metrics were not captured for this report.
Files at fc43ebe75757 · descriptions are AI-written.
The descriptions and the file list come from different revisions. Check responsibilities against source.
Suggested by the saved analysis. Verify the proposed change against these source files.
Suggested by the saved analysis. Verify the proposed change against these source files.
Suggested by the saved analysis. Verify the proposed change against these source files.
Start with possible export surfaces, then check their consumers and tests. These suggestions use file names, not verified execution paths.
Start with possible startup or request handlers, then follow the calls for your scenario. These suggestions use file names, not verified execution paths.
Use a nearby test as a pattern. Read the root manifest or contribution guide for the correct test command. These suggestions use file names, not verified execution paths.
Inspect the relevant configuration and the commands it runs before changing the workflow. These suggestions use file names, not verified execution paths.
File paths come from a snapshot of up to 500 captured paths; an omitted file may still exist.
Core Home Assistant initialization and main API surface; entry point for understanding the framework's structure.
Application entrypoint that bootstraps the Home Assistant runtime and event loop.
Startup orchestration for loading components, integrations, and configuration; critical for understanding initialization order.
Authentication framework providing user, permission, and credential management across the system.
Permission model and access control layer that gates entity, event, and system-level operations.
Backup and restoration pipeline; critical for data persistence and recovery workflows.
Async/sync boundary enforcement preventing blocking calls in async contexts; enforces architectural compliance.
Async/await (Python asyncio)
Enables non-blocking I/O for handling multiple device connections and automations concurrently without thread overhead.
Modular component system
Allows independent development and distribution of integrations for different device brands and services without monolithic core changes.
JWT-based authentication
Provides stateless token-based authentication suitable for distributed home automation deployments and API-first architecture.
Permission-based access control (PBAC)
Enables fine-grained authorization for entity and event access, supporting multi-user household scenarios with restricted access levels.
Build-time
Runtime
Single-threaded async architecture with blocking I/O guard
Simplifies state consistency and scheduling; prevents race conditions on shared state.
Blocking operations must be deferred to thread pools; CPU-intensive integrations risk event loop starvation.
Local-first with optional cloud connectivity
Prioritizes privacy and local control for core operations.
Remote access and cloud features require additional setup; not all integrations work offline.
Pluggable provider system for authentication and MFA
Allows operators to choose their credential source (local, LDAP, OAuth, etc.).
Adds complexity to auth layer; operators responsible for secure provider implementation.
This repo is in good health with CI, tests, and active maintenance.
How maintainable the code looks — from complexity, code issues, test presence, file size, and hotspot load. It grades the shape of the code, not defect risk, and doesn't replace review.
Provider: GitHub Actions
13,772 test files detected
Stack: Pytest
Where: pylint/plugins/pylint_home_assistant/checkers/tests · tests/auth/mfa_modules · tests/auth/permissions
13,772 test files / 10,693 source files. This is a file-count ratio, not real line coverage — set up Codecov for authoritative numbers.
CodeQL
Files edited often AND hard to reason about. Churn = recent commit frequency, Complexity = branches and nesting, Risk = both combined. These are the highest-leverage targets for refactoring or testing.
Files that change often and are complex tend to accumulate more bugs
Pattern-matches from the file structure and dependencies — useful as hypotheses, but not grounded in actual source. For real findings see Code Scanning above.
Auth providers and permission checkers may accidentally call blocking operations; block_async_io guard attempts detection but relies on runtime behavior rather than static typing.
homeassistant/block_async_io.py and auth subsystem
Adding new auth providers requires modifying core auth module rather than using plugin/entry point system; scales poorly.
homeassistant/auth/providers/__init__.py
All default policies centralized in single file; makes it difficult for integrations to define custom permission types without core changes.
homeassistant/auth/permissions/system_policies.py
Permission merging logic may produce unexpected results when multiple policies conflict; no clear precedence rules.
homeassistant/auth/permissions/merge.py
Speculation from file structure, not profiling data. Validate against real metrics before acting on these.
Sequential credential lookups and JSON deserialization on every login; no caching or indexing of user credentials.
homeassistant/auth/auth_store.py
Permission resolution traverses full permission tree for every entity/event access check; no caching of computed permissions per user.
homeassistant/auth/permissions/__init__.py
Sequential component and integration loading during startup; no parallel initialization of independent components.
homeassistant/bootstrap.py
Full state serialization and disk write on every backup; no incremental or differential backup support.
homeassistant/backup_restore.py
Static analysis on sampled source files (up to 15 files).