codeanalyzer-python 1.1.0__tar.gz → 1.2.0__tar.gz

codeanalyzer_python-1.1.0/README.md → codeanalyzer_python-1.2.0/PKG-INFO

@@ -1,3 +1,35 @@
+Metadata-Version: 2.5
+Name: codeanalyzer-python
+Version: 1.2.0
+Summary: Static analysis for Python — canonical schema v2 (symbol table, call graph, and native CFG/PDG/SDG dataflow) as analysis.json or a Neo4j property graph.
+Author-email: Rahul Krishna <i.m.ralk@gmail.com>
+License-File: LICENSE
+License-File: NOTICE
+Requires-Python: >=3.9
+Requires-Dist: astor<0.9.0,>=0.8.1
+Requires-Dist: jedi<0.20.0,>=0.18.0; python_version < '3.11'
+Requires-Dist: jedi<=0.19.2; python_version >= '3.11'
+Requires-Dist: networkx<3.2.0,>=2.6.0; python_version < '3.11'
+Requires-Dist: networkx<4.0.0,>=3.0.0; python_version >= '3.11'
+Requires-Dist: packaging>=25.0
+Requires-Dist: parso>=0.8.5
+Requires-Dist: pydantic<2.0.0,>=1.8.0; python_version < '3.11'
+Requires-Dist: pydantic<3.0.0,>=2.0.0; python_version >= '3.11'
+Requires-Dist: pyyaml<7.0,>=6.0
+Requires-Dist: ray<3.0.0,>=2.10.0; python_version >= '3.11'
+Requires-Dist: ray==2.0.0; python_version < '3.11'
+Requires-Dist: requests<3.0.0,>=2.20.0; python_version >= '3.11'
+Requires-Dist: rich<14.0.0,>=12.6.0; python_version < '3.11'
+Requires-Dist: rich<15.0.0,>=14.0.0; python_version >= '3.11'
+Requires-Dist: typer<1.0.0,>=0.9.0; python_version < '3.11'
+Requires-Dist: typer<2.0.0,>=0.9.0; python_version >= '3.11'
+Requires-Dist: typing-extensions<5.0.0,>=4.0.0; python_version < '3.11'
+Requires-Dist: typing-extensions<6.0.0,>=4.5.0; python_version >= '3.11'
+Requires-Dist: uv>=0.5.0
+Provides-Extra: neo4j
+Requires-Dist: neo4j<6.0.0,>=5.0.0; extra == 'neo4j'
+Description-Content-Type: text/markdown
+
 <div align="center">
 
 <img src="https://github.com/codellm-devkit/codeanalyzer-python/blob/main/docs/assets/logo.png?raw=true" alt="CodeLLM-DevKit" />
@@ -16,7 +48,7 @@
 ---
 
 `canpy` is a static analyzer for Python built on [Jedi](https://jedi.readthedocs.io/),
-[PyCG](https://github.com/vitsalis/PyCG), and [Tree-sitter](https://tree-sitter.github.io/). It
+and [Tree-sitter](https://tree-sitter.github.io/). It
 emits the **canonical CodeLLM-DevKit (CLDK) schema v2** — a single, additive Code Property Graph
 tree — either as `analysis.json` or projected into a **Neo4j property graph**. It is the Python
 backend behind [CLDK](https://github.com/codellm-devkit/python-sdk), mirroring its
@@ -58,8 +90,9 @@ needs.
   at a single `application` node with durable `can://` ids on every callable and above.
 - **Symbol table** — modules, classes, functions, methods, variables, decorators, imports, and
   docstrings, with precise byte-offset source spans; each module carries its `source` once.
-- **Call graph** — Jedi's lexical resolver at level 1, enriched with **PyCG**-resolved edges at
-  level 2 (provenance-tagged, coupling-aware sharding for large apps).
+- **Call graph** — Jedi's lexical resolver at level 1, enriched at level 2 by a per-callable
+  **defuse linker** that resolves call sites through local def-use chains and module-scope
+  bindings (provenance-tagged, deterministic, no global fixpoint).
 - **Dataflow graphs** — native, per-callable exceptional **CFG** plus **control-** and
   **data-dependence** edges (`cfg`/`cdg`/`ddg`) at level 3, stitched into a whole-program
   **interprocedural SDG** (synthetic parameter vertices, `param_in`/`param_out`/`summary`,
@@ -70,7 +103,7 @@ needs.
   checked in as `schema.neo4j.json` (`2.0.0`) and shipped with every release.
 - **Incremental cache** — per-file results are cached under `.codeanalyzer`; `--lazy` (default)
   reuses them, `--eager` forces a clean rebuild. `--ray` distributes the work across cores.
-- **Compact output** — canonical `analysis.json`, or binary `analysis.msgpack` for smaller artifacts.
+- **Compact output** — one canonical `analysis.json` per run.
 
 ## Installation
 
@@ -143,8 +176,7 @@ canpy --input /path/to/python/project
 ```
 
 With no `--output`, the analysis is printed to stdout as compact JSON; with `--output <dir>` it is
-written to `analysis.json` (or `graph.cypher` for `--emit neo4j`, or `analysis.msgpack` with
-`--format msgpack`) in that directory.
+written to `analysis.json` (or `graph.cypher` for `--emit neo4j`) in that directory.
 
 ### Options
 
@@ -155,7 +187,7 @@ $ canpy --help
 
  Usage: canpy [OPTIONS] COMMAND [ARGS]...
 
- Static Analysis on Python source code using Jedi, PyCG and Tree sitter.
+ Static Analysis on Python source code using Jedi and Tree sitter.
 
 ╭─ Options ────────────────────────────────────────────────────────────────────╮
 │ --version                                                   Show the canpy   │
@@ -168,10 +200,6 @@ $ canpy --help
 │                                                             --emit schema).  │
 │ --output           -o                     <path>            Output directory │
 │                                                             for artifacts.   │
-│ --format           -f                     <json|msgpack>    Output format    │
-│                                                             for --emit json: │
-│                                                             json or msgpack. │
-│                                                             [default: json]  │
 │ --emit                                    <json|neo4j|sche  Output target:   │
 │                                           ma>               json             │
 │                                                             (analysis.json,  │
@@ -219,7 +247,8 @@ $ canpy --help
 │ --analysis-level   -a                     <int range>       Analysis depth:  │
 │                                           [1<=x<=4]         1=symbol         │
 │                                                             table+Jedi call  │
-│                                                             graph, 2=+PyCG   │
+│                                                             graph,           │
+│                                                             2=+defuse-linker │
 │                                                             call graph,      │
 │                                                             3=+native        │
 │                                                             intraprocedural  │
@@ -231,7 +260,7 @@ $ canpy --help
 │                                                             edges,           │
 │                                                             alias-aware      │
 │                                                             DDG).            │
-│                                                             [default: 1]     │
+│                                                             [default: (1)]   │
 │ --graphs                                  <str>             Level 3+ only:   │
 │                                                             comma-separated  │
 │                                                             program-graph    │
@@ -243,8 +272,12 @@ $ canpy --help
 │                                                             PDG's data edges │
 │                                                             only; `sdg`      │
 │                                                             requires -a 4.   │
+│                                                             Incompatible     │
+│                                                             with --emit      │
+│                                                             neo4j (always    │
+│                                                             full-depth).     │
 │                                                             [default:        │
-│                                                             cfg,dfg,pdg]     │
+│                                                             (cfg,dfg,pdg)]   │
 │ --graph-field-de…                         <int range>       Level 3 only:    │
 │                                           [x>=1]            k-limit on       │
 │                                                             access-path      │
@@ -305,134 +338,14 @@ $ canpy --help
 │                                                             verbosity: -v,   │
 │                                                             -vv, -vvv        │
 │                                                             [default: 0]     │
-│ --pycg-shard           --no-pycg-shard                      Shard PyCG       │
-│                                                             call-graph       │
-│                                                             analysis by      │
-│                                                             Python package   │
-│                                                             (level 2 only).  │
-│                                                             When the project │
-│                                                             exceeds the      │
-│                                                             500-file         │
-│                                                             ceiling, PyCG is │
-│                                                             run              │
-│                                                             independently    │
-│                                                             per top-level    │
-│                                                             package with     │
-│                                                             cross-package    │
-│                                                             imports treated  │
-│                                                             as ghost nodes.  │
-│                                                             Without this     │
-│                                                             flag, projects   │
-│                                                             over the ceiling │
-│                                                             fall back to     │
-│                                                             Jedi-only edges. │
-│                                                             [default:        │
-│                                                             no-pycg-shard]   │
-│ --pycg-shard-cei…                         <int range>       Maximum files    │
-│                                           [x>=1]            per shard when   │
-│                                                             --pycg-shard is  │
-│                                                             active (default  │
-│                                                             100). Shards     │
-│                                                             exceeding this   │
-│                                                             limit are        │
-│                                                             skipped; their   │
-│                                                             call edges are   │
-│                                                             omitted from the │
-│                                                             call graph (Jedi │
-│                                                             edges for those  │
-│                                                             packages are     │
-│                                                             still included). │
-│                                                             Lower values are │
-│                                                             safer for        │
-│                                                             packages with    │
-│                                                             deep class       │
-│                                                             hierarchies or   │
-│                                                             heavy import     │
-│                                                             graphs.          │
-│                                                             [default: 100]   │
-│ --pycg-shard-tim…                         <int range>       Per-shard        │
-│                                           [x>=0]            wall-clock       │
-│                                                             timeout in       │
-│                                                             seconds when     │
-│                                                             --pycg-shard is  │
-│                                                             active (default  │
-│                                                             120). A shard    │
-│                                                             that exceeds     │
-│                                                             this limit is    │
-│                                                             skipped          │
-│                                                             gracefully.      │
-│                                                             PyCG's fixpoint  │
-│                                                             is bimodal: it   │
-│                                                             either converges │
-│                                                             quickly or       │
-│                                                             diverges         │
-│                                                             indefinitely, so │
-│                                                             the timeout acts │
-│                                                             as a final       │
-│                                                             safety net after │
-│                                                             the file-count   │
-│                                                             ceiling. Set to  │
-│                                                             0 to disable.    │
-│                                                             POSIX only       │
-│                                                             (macOS / Linux); │
-│                                                             ignored on       │
-│                                                             Windows.         │
-│                                                             [default: 120]   │
-│ --pycg-shard-str…                         <jedi|package>    How --pycg-shard │
-│                                                             groups files     │
-│                                                             (level 2 only).  │
-│                                                             'jedi' (default) │
-│                                                             partitions the   │
-│                                                             Jedi             │
-│                                                             module-dependen… │
-│                                                             graph (SCC +     │
-│                                                             Louvain) so      │
-│                                                             tightly-coupled  │
-│                                                             modules          │
-│                                                             co-compute and   │
-│                                                             few call edges   │
-│                                                             are severed      │
-│                                                             between shards;  │
-│                                                             import cycles    │
-│                                                             are never split. │
-│                                                             'package' uses   │
-│                                                             the legacy       │
-│                                                             one-shard-per-p… │
-│                                                             grouping.        │
-│                                                             [default: jedi]  │
-│ --pycg-max-iter                           <int range>       Cap on PyCG's    │
-│                                           [x>=-1]           fixpoint passes  │
-│                                                             per              │
-│                                                             shard/project    │
-│                                                             (level 2;        │
-│                                                             default 50).     │
-│                                                             PyCG iterates    │
-│                                                             until its        │
-│                                                             points-to state  │
-│                                                             stops changing,  │
-│                                                             but its          │
-│                                                             access-path      │
-│                                                             domain has no    │
-│                                                             convergence      │
-│                                                             bound, so heavy  │
-│                                                             metaclass/mixin  │
-│                                                             code (e.g. an    │
-│                                                             ORM) can loop    │
-│                                                             with each pass   │
-│                                                             costing seconds. │
-│                                                             The cap returns  │
-│                                                             a                │
-│                                                             sound-but-incom… │
-│                                                             call graph       │
-│                                                             instead of       │
-│                                                             looping until    │
-│                                                             the timeout      │
-│                                                             kills it. Set to │
-│                                                             -1 for PyCG's    │
-│                                                             unbounded        │
-│                                                             run-to-converge… │
-│                                                             behaviour.       │
-│                                                             [default: 50]    │
+│ --entrypoint-rul…                         <path>            Extra entrypoint │
+│                                                             rules file       │
+│                                                             (YAML).          │
+│                                                             Repeatable;      │
+│                                                             merges with the  │
+│                                                             shipped rules. A │
+│                                                             malformed file   │
+│                                                             is an error.     │
 │ --help                                                      Show this        │
 │                                                             message and      │
 │                                                             exit.            │
@@ -454,13 +367,14 @@ $ canpy --help
    canpy --input ./my-python-project --output ./out --format msgpack   # → ./out/analysis.msgpack
    ```
 
-3. **Enrich the call graph with PyCG (level 2):**
+3. **Enrich the call graph with the defuse linker (level 2):**
    ```sh
    canpy --input ./my-python-project -a 2
    ```
-   Level 1 edges come from Jedi's lexical resolution. `-a 2` runs **PyCG** and merges its
-   flow-sensitive edges in (RPC / third-party / dynamically-dispatched targets), backfilling
-   callees Jedi could not resolve. Every edge is provenance-tagged (e.g. `jedi`, `pycg`).
+   Level 1 edges come from Jedi's lexical resolution. `-a 2` runs the **defuse linker** —
+   per-callable resolution over lexical scopes, import bindings, class hierarchies, and a
+   bounded type-propagation round — and merges its edges with Jedi's, backfilling the
+   callees Jedi could not resolve. Every edge is provenance-tagged (`jedi`, `defuse`).
 
 4. **Emit a Neo4j snapshot, or push to a live database:**
    ```sh
@@ -489,7 +403,7 @@ $ canpy --help
    canpy --input ./my-python-project -a 3 --graph-field-depth 2   # tighter access-path k-limit
    ```
    Levels 3 and 4 also enrich the Neo4j projection (`--emit neo4j`) with the CPG overlay
-   (`:PyCFGNode` nodes wired by `PY_CFG_NEXT`/`PY_CDG`/`PY_DDG`, plus the level-4
+   (`:PyBodyNode` nodes wired by `PY_CFG_NEXT`/`PY_CDG`/`PY_DDG`, plus the level-4
    `PY_PARAM_IN`/`PY_PARAM_OUT`/`PY_SUMMARY` edges — the cross-language dataflow vocabulary,
    PY_-namespaced like every other row family so multi-language databases never mingle
    analyzers' edges).
@@ -502,7 +416,7 @@ levels are cumulative and additive — `analysis.json(-a 1) ⊆ … ⊆ analysis
 | Level | Flag | What it adds | Where it lands |
 | --- | --- | --- | --- |
 | **1** | `-a 1` (default) | Symbol table, Jedi call graph, and `call` nodes in each callable's `body` | `body` calls (`callee: null`) |
-| **2** | `-a 2` | PyCG call-graph enrichment; each call's `callee` backfilled to a `can://` id | `call_graph`, `body` callees |
+| **2** | `-a 2` | Defuse-linker call-graph enrichment; each call's `callee` backfilled to a `can://` id | `call_graph`, `body` callees |
 | **3** | `-a 3` | Native **intraprocedural** CFG/CDG/DDG (syntactic, name-equality, `prov: ["ssa"]`) | `cfg`, `cdg`, `ddg`, `@entry`/`@exit` on each callable |
 | **4** | `-a 4` | **Interprocedural** SDG: synthetic param vertices, alias-aware DDG (`prov: ["points-to"]`) | `param_in`, `param_out`, `summary`, semantic `ddg` |
 
@@ -531,7 +445,7 @@ symbol-table signature by construction
   external dependency to install; the analyzer falls back to the built-in `TypeBasedAliasOracle`
   (Jedi-inferred types; unknown types conservatively alias) only when Scalpel can't resolve a
   construct or a per-callable build fails, keeping the `may_alias` interface total. Call dispatch
-  comes from the merged Jedi(+PyCG) call graph, treated as a frozen oracle.
+  comes from the merged Jedi + defuse-linker call graph, treated as a frozen oracle.
 - **Summaries:** relational formal-in → formal-out flows composed bottom-up over the Tarjan SCC
   condensation of the call graph, a monotone fixpoint within SCCs; globals ride as extra formals,
   closure captures bind at definition sites.
@@ -570,7 +484,7 @@ just populate more of the same tree:
       }
     },
     "call_graph": [ { "src": "can://…/main(a)", "dst": "can://…/helper(x)",
-                      "weight": 1, "prov": ["jedi", "pycg"] } ],
+                      "weight": 1, "prov": ["defuse", "jedi"] } ],
     "external_symbols": {         // imported/builtin call targets, keyed by id
       "can://python/<app>/@external/os/getcwd":
         { "id": "can://python/<app>/@external/os/getcwd", "kind": "external",
@@ -636,7 +550,7 @@ label is `Py`-prefixed and every relationship type is `PY_`-prefixed (e.g. `:PyC
 so multiple language analyzers can share one database without label or relationship-type collisions.
 Declarations are keyed by their **`can://` id** under a shared `:PySymbol` label; calls, imports,
 inheritance, decorators, and call sites are relationships. At `-a 3`/`-a 4` the projection gains the
-**CPG overlay** — `:PyCFGNode` nodes (statements, and at level 4 the parameter vertices) wired by
+**CPG overlay** — `:PyBodyNode` nodes (statements, and at level 4 the parameter vertices) wired by
 `PY_CFG_NEXT`/`PY_CDG`/`PY_DDG`, plus the level-4 `PY_PARAM_IN`/`PY_PARAM_OUT`/`PY_SUMMARY` edges:
 
 - **Without `--neo4j-uri`** — writes a self-contained `graph.cypher` (constraints + indexes, a scoped