bcquality/custom/knowledge/architecture/curabis-app-sources-must-be-checked-first.md

bc-version	domain	keywords	technologies	countries	application-area
all	architecture	dependency source reference-repos clone github curabis closed-source test symbol black-box	al	w1	all

Description

CURABIS develops and maintains several AL apps that are consumed as dependencies across many customer projects (Danelec, Jernpladsen, Wareco, KLB, etc.). When a customer project imports one of these apps, it typically arrives as a compiled .app symbol package in .alpackages/ — not as source code.

This makes the app look like a closed external dependency. It is not.

Before treating any CURABIS-owned dependency app as a black box, the agent must check whether its source is available on GitHub and read it directly. Reverse-engineering compiled symbol packages (SymbolReference.json, .app manifest inspection) is always an inferior substitute for reading the actual production source, and produces lower-confidence tests and code reviews.

How to actually get the source (2026-07-30 — was previously the underspecified add_repo <repo>, which is not a real tool in most Claude Code sessions):

• Claude Code CLI (this is the common case): maintain a persistent, periodically-refreshed clone at ~/.claude/reference-repos/<org>/<repo>/ — same pattern as BCQuality's own channel clone. Before reading, check if it exists:
  • Missing: git clone --depth 1 <url> "$env:USERPROFILE\.claude\reference-repos\<org>\<repo>" (shallow — you need current source, not history)
  • Exists: git -C "$env:USERPROFILE\.claude\reference-repos\<org>\<repo>" pull --depth 1 (refresh before trusting it — a stale clone from a prior session is a silent source of wrong answers)
  • Then Read/Grep/Glob it like any other local path.
• Claude Code on web (claude.ai/code): use the session's repo picker / "add repository" action instead, if the UI offers one — there is no shell to clone into in that environment.

Verify which of these your actual session supports before assuming either works — do not silently fall back to symbol inspection if neither succeeds; flag the limitation explicitly instead (see "When cloning fails" below).

Known CURABIS app repos

App name	GitHub repo	Notes
Contract Management 365 app	https://github.com/Curabis/ContractMgmt365app.git	Main contract engine; depended on by most CURABIS customer projects
Project Management 365 app	https://github.com/Curabis/ProjectMgmt365app.git
Cross Channel Management 365 app	https://github.com/Curabis/WebStore.git
Summatim	https://github.com/MichaelDieringer/-summatim.git	Currently restricted — only mid has access; the clone will fail for other team members

Expand this table when new CURABIS apps are created. If an app is not listed here, ask mid whether source is available before reverting to symbol inspection.

Microsoft BCApps

Microsoft's own standard objects (Base Application, System Application, test framework libraries: Library-Sales, Library-ERM, Library-Purchase, etc.) are available at:

• https://github.com/microsoft/BCApps

Clone it to ~/.claude/reference-repos/microsoft/BCApps/ (see the mechanism above) when you need to understand internals of Microsoft standard codeunits (e.g. Sales-Post, Gen. Jnl.-Post Line, Copy Document Mgt.) that are referenced by event subscribers but whose source is not visible in the current project. It is a large public monorepo — a shallow clone is still the right call, and worth refreshing rather than re-cloning once it exists.

Anti Pattern

// WRONG: reverse-engineering the compiled symbol package instead of reading source
// Agent parses SymbolReference.json from .alpackages/*.app to learn
// Contract Management table fields and public procedure signatures.
// Result: incomplete picture, missed validation logic, excluded feature from tests.

Best Practice

// CORRECT: clone the source repo and read it directly
git clone --depth 1 https://github.com/Curabis/ContractMgmt365app.git `
  "$env:USERPROFILE\.claude\reference-repos\Curabis\ContractMgmt365app"

// Then read the actual table definitions, codeunits, and any Test Library
// codeunits that may already exist in the repo's own test app.

// If no Test Library exists in the dependency's test app:
// build GIVEN helpers in the consuming project's own Test Library codeunit
// based on the REAL table field definitions and trigger logic you can now read.

When to apply this rule

Apply at the start of any task involving:

• Writing tests for production code that uses event subscribers on CURABIS-owned codeunits or tables
• Calling public procedures from a CURABIS-owned app's codeunits
• Building GIVEN helpers for a CURABIS-owned app's tables
• Code-reviewing changes to codeunits that extend CURABIS-owned apps

When cloning fails

If the clone fails due to access restrictions (see table above) or your session has no shell to clone into, flag the limitation explicitly rather than silently falling back to symbol inspection.