codeanalyzer-python 0.2.0__py3-none-any.whl → 0.3.0__py3-none-any.whl

codeanalyzer/neo4j/rows.py

@@ -83,7 +83,11 @@ class RowBuilder:
         self._nodes: Dict[str, NodeRow] = {}  # key: f"{labels[0]} {value}"
         self._edges: List[EdgeRow] = []
         self._deferred: List[EdgeRow] = []  # edges gated against node existence at finish()
-        self._keys: set = set()  # every node value seen, for resolved-gating
+        # (merge_label, value) of every node seen, for resolved-gating. Keyed by
+        # label too so a :PyPackage name can't shadow a :PySymbol signature (and
+        # vice versa) — otherwise a call to an imported module name like ``os``
+        # resolves to a :PySymbol node that was never created and the edge is lost.
+        self._keys: set = set()
 
     def node(self, labels: List[str], key_prop: str, value: str, props: Props) -> NodeRef:
         """Upsert a node. Re-seeing the same ``(labels[0], value)`` merges props
@@ -98,7 +102,7 @@ class RowBuilder:
                     existing.labels.append(label)
         else:
             self._nodes[node_id] = NodeRow(list(labels), key_prop, value, dict(props))
-        self._keys.add(value)
+        self._keys.add((labels[0], value))
         return NodeRef(labels[0], key_prop, value)
 
     def edge(self, type_: str, from_ref: NodeRef, to_ref: NodeRef, props: Optional[Props] = None) -> None:
@@ -121,12 +125,13 @@ class RowBuilder:
             )
         )
 
-    def has_key(self, value: str) -> bool:
-        return value in self._keys
+    def has_key(self, label: str, value: str) -> bool:
+        """Whether a node with this ``(merge_label, value)`` identity was emitted."""
+        return (label, value) in self._keys
 
     def finish(self) -> GraphRows:
         for e in self._deferred:
-            if e.to_ref.value in self._keys:
+            if (e.to_ref.label, e.to_ref.value) in self._keys:
                 self._edges.append(e)
         nodes = sorted(self._nodes.values(), key=lambda n: f"{n.labels[0]} {n.value}")
         edges = sorted(self._edges, key=lambda e: f"{e.type} {e.from_ref.value} {e.to_ref.value}")

codeanalyzer/options/__init__.py

@@ -1,3 +1,3 @@
-from .options import AnalysisOptions, EmitTarget, OutputFormat
+from .options import AnalysisOptions, EmitTarget, OutputFormat, ShardStrategy
 
-__all__ = ["AnalysisOptions", "EmitTarget", "OutputFormat"]
+__all__ = ["AnalysisOptions", "EmitTarget", "OutputFormat", "ShardStrategy"]

codeanalyzer/options/options.py

@@ -23,6 +23,20 @@ class EmitTarget(str, Enum):
     SCHEMA = "schema"
 
 
+class ShardStrategy(str, Enum):
+    """How ``--pycg-shard`` groups files into shards (level 2 only).
+
+    - ``jedi``    : partition the Jedi module-dependency graph (strongly-
+                    connected-component condensation + Louvain) so tightly-
+                    coupled modules co-compute and few call edges are severed
+                    between shards. Import cycles are never split.
+    - ``package`` : legacy one-shard-per-package-directory grouping.
+    """
+
+    JEDI = "jedi"
+    PACKAGE = "package"
+
+
 @dataclass
 class AnalysisOptions:
     input: Path
@@ -34,11 +48,17 @@ class AnalysisOptions:
     neo4j_user: str = "neo4j"
     neo4j_password: str = "neo4j"
     neo4j_database: Optional[str] = None
-    using_codeql: bool = False
+    analysis_level: int = 1
     using_ray: bool = False
     rebuild_analysis: bool = False
     skip_tests: bool = True
+    no_venv: bool = False
     file_name: Optional[Path] = None
     cache_dir: Optional[Path] = None
     clear_cache: bool = False
     verbosity: int = 0
+    pycg_shard: bool = False
+    pycg_shard_ceiling: int = 100
+    pycg_shard_timeout: int = 120
+    pycg_shard_strategy: ShardStrategy = ShardStrategy.JEDI
+    pycg_max_iter: int = 50

codeanalyzer/schema/__init__.py

@@ -8,6 +8,7 @@ from .py_schema import (
     PyClass,
     PyClassAttribute,
     PyComment,
+    PyExternalSymbol,
     PyImport,
     PyModule,
     PyVariableDeclaration,
@@ -15,6 +16,7 @@ from .py_schema import (
 
 __all__ = [
     "PyApplication",
+    "PyExternalSymbol",
     "PyImport",
     "PyComment",
     "PyModule",

codeanalyzer/schema/py_schema.py

@@ -355,7 +355,18 @@ class PyCallEdge(BaseModel):
     target: str  # callee's PyCallable.signature
     type: Literal["CALL_DEP"] = "CALL_DEP"
     weight: int = 1
-    provenance: List[Literal["jedi", "codeql", "joern"]] = []
+    provenance: List[Literal["jedi", "pycg", "joern"]] = []
+
+
+@builder
+@msgpk
+class PyExternalSymbol(BaseModel):
+    """A call-graph target outside the analyzed project -- an imported library or
+    builtin member. Mirrors codeanalyzer-typescript's ``TSExternalSymbol`` and is
+    keyed in ``PyApplication.external_symbols`` by its call-graph signature."""
+
+    name: str  # the member/short name, e.g. "get" for "requests.get"
+    module: Optional[str] = None  # best-effort owning module, e.g. "requests"
 
 
 @builder
@@ -365,3 +376,7 @@ class PyApplication(BaseModel):
 
     symbol_table: Dict[str, PyModule]
     call_graph: List[PyCallEdge] = []
+    # Call-graph endpoints not declared in the symbol table (imported library /
+    # builtin members), keyed by signature. Populated by the analyzer so every
+    # backend (JSON and Neo4j) shares one authoritative external-symbol set.
+    external_symbols: Dict[str, PyExternalSymbol] = {}

codeanalyzer/semantic_analysis/call_graph.py

@@ -173,7 +173,7 @@ def jedi_call_graph_edges(
 
     Edges are coalesced on ``(source, target)``: ``weight`` is the count of
     matching sites. Provenance is always ``["jedi"]``; combine with
-    CodeQL-derived edges via ``merge_edges``.
+    PyCG-derived edges via ``merge_edges``.
     """
     counts: Counter = Counter()
     for caller in iter_callables_in_symbol_table(symbol_table):
@@ -191,7 +191,7 @@ def jedi_call_graph_edges(
 def resolve_unresolved_constructors(symbol_table: Dict[str, PyModule]) -> int:
     """Fill in ``PyCallsite.callee_signature`` for unresolved constructor sites.
 
-    When both Jedi and CodeQL fail to resolve a constructor call (commonly
+    When Jedi fails to resolve a constructor call (commonly
     for classes nested inside functions or methods, where static-analysis
     points-to is weakest), Jedi still flags the site as
     ``is_constructor_call=True`` with ``method_name`` set to the class's
@@ -246,12 +246,33 @@ def resolve_unresolved_constructors(symbol_table: Dict[str, PyModule]) -> int:
     return resolved
 
 
+def filter_external_edges(
+    edges: List[PyCallEdge],
+    symbol_table: Dict[str, PyModule],
+) -> List[PyCallEdge]:
+    """Remove edges where both source and target are outside the app namespace.
+
+    Edges where an app callable calls a library function (or vice-versa) are
+    retained; only lib→lib edges are dropped.  The app symbol set is built by
+    walking every callable in the symbol table recursively (including nested
+    functions and closures via ``inner_callables``) plus every class, so
+    PyCG-discovered closure nodes are correctly recognised as app symbols.
+    """
+    app_symbols: set = {c.signature for c in iter_callables_in_symbol_table(symbol_table)}
+    app_symbols.update(cls.signature for cls in iter_classes_in_symbol_table(symbol_table))
+
+    return [
+        e for e in edges
+        if e.source in app_symbols or e.target in app_symbols
+    ]
+
+
 def merge_edges(*edge_lists: list) -> list:
     """Merge multiple ``List[PyCallEdge]`` into one.
 
     Edges with the same ``(source, target)`` are coalesced: weights sum,
     provenance is the sorted union. Useful for combining edges produced
-    by different backends (e.g. Jedi + CodeQL).
+    by different backends (e.g. Jedi + PyCG).
     """
     by_key: Dict[Tuple[str, str], PyCallEdge] = {}
     for edges in edge_lists:

codeanalyzer/semantic_analysis/pycg/__init__.py

@@ -0,0 +1,20 @@
+################################################################################
+# Copyright IBM Corporation 2025
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+from codeanalyzer.semantic_analysis.pycg.pycg_analysis import PyCG
+from codeanalyzer.semantic_analysis.pycg.pycg_exceptions import PyCGExceptions
+
+__all__ = ["PyCG", "PyCGExceptions"]