richlander/dotnet-inspect/correctness

dotnet-inspect: Investigate .NET Exceptions, Unsafe Code, and Resource Ownership

Use this skill to judge whether code is sound and safe to call: what it can throw, how it handles errors, and where it steps outside safe, managed execution. This is single-version analysis; for how these signals change between versions, use the compatibility skill.

dnx dotnet-inspect -y -- <command>

What can it throw? (exception surface)

There is no dedicated "Exceptions" section; exception behavior comes from method-body analysis. Exception Regions shows the exact catch/filter/finally layout; graph fields and hidden facts summarize behavior:

dnx dotnet-inspect -y -- member Type Method:1 -S "Exception Regions"
dnx dotnet-inspect -y -- member Type Method:1 -S "Call Graph" --fields "Throws,ThrowSites,ExceptionTypes,ConstructedExceptions,Catch,Finally"
dnx dotnet-inspect -y -- member Type Method:1 -S "Call Graph" --fields "Throws,Catch,Finally"
dnx dotnet-inspect -y -- member Type Method:1 -S Facts --tsv

Throws/ThrowSites count throw sites; ExceptionTypes/ConstructedExceptions name the exception types; Catch/Finally show handling. Exception Regions retains IL ranges and caught types. -S Facts (member, single method) lists the hidden facts in the body and supports --tsv.

Is it memory-safe? (unsafe operations)

dnx dotnet-inspect -y -- member Type Method:1 --library MyLib.dll -S "Unsafe Operations,IL"

-S "Unsafe Operations" shows the unsafe operations in a single method body, with IL evidence. For the library-wide safety surface (unsafe members, P/Invoke methods) and provenance/supply-chain signals, see the signals skill.

For one crash or profiler coordinate, use library coordinate 0x06000001+0x5 --library Foo.dll for the default source-location, member, instruction, exception, callsite, and return-address context. Safety evidence is opt-in: library coordinate 0x06000001+0x5 --library Foo.dll -S "Context: Safety".

To confirm whether one definite unsafe operation appeared at an adjacent version boundary, first correlate caller-selected package cells:

dnx dotnet-inspect -y -- diff --history --package MyLib@1.0.0..2.0.0 \
  -t MyType -m Method \
  --finding analysis.unsafety --at first --at last

Repeat --at for sparse probes or use --at all for an explicitly bounded dense traversal. A gap-spanning Added row locates a candidate boundary; it does not claim the exact introduction version. Confirm the adjacent pair:

dnx dotnet-inspect -y -- diff --package MyLib@1.4.0..1.5.0 \
  -t MyType -m Method \
  --finding analysis.unsafety

PairFinding.Added is the introduction proof. Present and Removed distinguish persistence from disappearance; the command compares only the two supplied endpoints.

Review unsafe code and ownership against .NET guidance

Use the .NET unsafe-code best-practices guide as the policy owner. Its source document currently organizes the review into 26 numbered topics.

dotnet-inspect supplies compiled evidence, not a monolithic compliance verdict. Acquire reusable JSONL row sets, use the agent and jq to slice and join them for each question, then drill only consequential Members. The same rows can answer other safety questions without adding a new aggregate command.

Acquire focused evidence

Start with library MyLib.dll -S "Unsafe Members" --jsonl; request P/Invoke Methods, Custom Attributes, References, or Signals only as the question requires. Keep row families, exit status, stderr and completion separate: empty output can be a failed inspection rather than checked absence. Use -D for section fields, -Q for supported filters and explain "<question>" for unfamiliar evidence. Follow the returned resource and CLI binding rather than guessing deeper query rules.

Library Custom Attributes covers a filtered set of assembly- and module-level attributes. It does not discover attributes on Types, fields, or methods, and does not establish SkipLocalsInit coverage. Preserve that scope: use exact-subject attributes only after another row or source evidence selects the Type or Member, and report whole-library attribute discovery as unverified.

Ownership and unsafe code overlap. A pooled buffer can have no pointer opcode yet still fail through use-after-return, missing cleanup, or ownership transfer. Use library MyLib.dll -S "Resource Triage" --jsonl beside unsafe evidence.

Resource Triage currently has no positive completion receipt and can emit rows while some resource roots remain incomplete. Always describe its ownership coverage as unverified; preserve any more specific diagnostic and never turn zero rows into "no ownership issue."

Select and drill one candidate

Slice machine rows locally with jq where no product predicate is available. Retain Member, IL, token, Candidate, Finding and boundary coordinates; keep unsafe, ownership and interop evidence distinct. Display-label equality does not establish identity. Resolve an exact Type and Member selector before drilling, and preserve the slice or join used to derive a candidate.

Drill one candidate

Use separate machine outputs for focused evidence and retain IL for review:

dnx dotnet-inspect -y -- member MyType Method:1 --library MyLib.dll \
  -S "Unsafe Operations" --jsonl
dnx dotnet-inspect -y -- member MyType Method:1 --library MyLib.dll \
  -S "Exception Regions" --jsonl
dnx dotnet-inspect -y -- member MyType Method:1 --library MyLib.dll -S IL

Load skill decompiler only when reconstructed C# helps explain the IL. Use source evidence when the question depends on lexical scope, an authored guard, compiler warnings, or repository test practice.

Route the 26 guidance questions

The routes below name the smallest useful evidence composition. They do not claim that matching evidence proves a violation or that checked-empty rows prove safety.

Report the review

For each applicable question, report:

1. the guidance topic and exact inspected subject;
2. owner-issued rows and exact coordinates;
3. the jq slice or join that produced the bounded candidate set;
4. the agent's labeled interpretation;
5. completion or unverified boundaries; and
6. the next focused probe when evidence cannot decide the question.

Do not report all 26 topics as clean because no matching row appeared. Omit topics that are genuinely inapplicable, and distinguish them from applicable questions whose evidence is unavailable or incomplete.