codeanalyzer-python 1.5.1__py3-none-any.whl → 1.5.3__py3-none-any.whl

codeanalyzer/__main__.py

@@ -39,7 +39,7 @@ def _pin_hash_seed() -> None:
 from codeanalyzer.core import Codeanalyzer
 from codeanalyzer.utils import _set_log_level, logger
 from codeanalyzer.schema import model_dump, model_dump_json, strip_internal_only
-from codeanalyzer.options import AnalysisOptions, EmitTarget
+from codeanalyzer.options import ANALYSIS_JSON, AnalysisOptions, EmitTarget
 
 
 def _version_callback(value: bool) -> None:
@@ -402,7 +402,7 @@ def main(
 
 def _write_output(artifacts, output_dir: Path):
     """Write analysis.json (the single wire format since #118)."""
-    output_file = output_dir / "analysis.json"
+    output_file = output_dir / ANALYSIS_JSON
     # Use Pydantic's model_dump_json() for compact output
     # Strip internal-only fields here rather than with a field-level Pydantic
     # `exclude`: the analysis cache shares the serializer and must keep them.

codeanalyzer/artifacts/discovery.py

@@ -3,10 +3,11 @@ from __future__ import annotations
 import fnmatch
 import hashlib
 from pathlib import Path
-from typing import Dict, List, Tuple
+from typing import Dict, Iterable, List, Tuple
 
 from codeanalyzer.schema.ids import artifact_id
 from codeanalyzer.schema.py_schema import PyArtifact
+from codeanalyzer.utils import logger
 
 # (glob pattern against the repo-relative POSIX path, format, roles).
 # First match wins; patterns are checked in order.
@@ -67,6 +68,43 @@ _IGNORED_DIRS = {
 }
 
 
+def _resolve_exclusions(project_dir: Path, exclude_paths: Iterable[Path]) -> List[Path]:
+    """Resolve the paths a run writes to, dropping any that would take the whole
+    project with them (#207).
+
+    A *directory* exclusion at or above the project root would empty the
+    inventory, which is worse than the bug it guards against, so it is refused.
+    That case is still covered, because the caller also passes the individual
+    output *files* -- excluding ``<project>/analysis.json`` costs one file
+    instead of the entire tree.
+    """
+    root = project_dir.resolve()
+    kept = []
+    for given in exclude_paths:
+        resolved = given.resolve()
+        if root.is_relative_to(resolved):
+            logger.warning(
+                f"Not excluding {resolved} from artifact discovery: it holds the "
+                f"project itself. Only this run's own output files under it are "
+                f"skipped; anything else written there is ingested as an artifact."
+            )
+            continue
+        kept.append(resolved)
+    return kept
+
+
+def _is_excluded(path: Path, excluded: List[Path]) -> bool:
+    """True when ``path`` is, or sits inside, one of ``excluded`` (a file entry
+    matches only itself). Checked on the path as walked *and* on its resolved
+    form, so an output directory reached through a symlink is caught from either
+    side."""
+    if not excluded:
+        return False
+    if any(path.is_relative_to(directory) for directory in excluded):
+        return True
+    return any(path.resolve().is_relative_to(directory) for directory in excluded)
+
+
 def _classify(rel_posix: str) -> Tuple[str, List[str]] | None:
     name = rel_posix.rsplit("/", 1)[-1]
     for pattern, fmt, roles in RULES:
@@ -81,6 +119,7 @@ def discover_artifacts(
     app_name: str,
     *,
     capture_text: bool = True,
+    exclude_paths: Iterable[Path] = (),
 ) -> Dict[str, PyArtifact]:
     """Walk the project and return every file as an artifact, sorted by path.
 
@@ -93,15 +132,28 @@ def discover_artifacts(
     deliberate exception -- it IS rule-matched (a dependency-manifest), so it
     is captured like any other manifest despite the `.py` suffix.
 
+    ``exclude_paths`` names what this run writes -- the ``--output`` and cache
+    directories, and the output files inside them (#207). Without them a run
+    whose output lands inside the project ingests the previous run's whole
+    ``analysis.json``, and each run embeds the one before it until the process is
+    killed decoding its own output. Matching is on resolved paths, so a
+    relative, `..`-laden or symlinked target excludes the same tree, and a target
+    outside the project excludes nothing. A directory that holds the project
+    itself is refused (it would empty the inventory); the file entries still
+    cover that case.
+
     ``source`` is the WHOLE file or nothing -- never a prefix (#172). A
     decodable file is captured in full; ``capture_text=False`` empties
     ``source`` everywhere (inventory otherwise identical), and an undecodable
     file gets ``""`` as ``binary``. ``sha256``/``size_bytes`` always reflect
     the full file regardless."""
     out: Dict[str, PyArtifact] = {}
+    excluded = _resolve_exclusions(project_dir, exclude_paths)
     for path in sorted(project_dir.rglob("*")):
         if not path.is_file():
             continue
+        if _is_excluded(path, excluded):
+            continue
         rel = path.relative_to(project_dir)
         if any(part in _IGNORED_DIRS for part in rel.parts):
             continue

codeanalyzer/core.py

@@ -35,7 +35,7 @@ from codeanalyzer.syntactic_analysis.exceptions import SymbolTableBuilderRayErro
 from codeanalyzer.syntactic_analysis.import_resolver import resolve_imports
 from codeanalyzer.syntactic_analysis.symbol_table_builder import SymbolTableBuilder
 from codeanalyzer.utils import ProgressBar
-from codeanalyzer.options import AnalysisOptions
+from codeanalyzer.options import ANALYSIS_JSON, GRAPH_CYPHER, AnalysisOptions, EmitTarget
 from codeanalyzer.provenance import analyzer_info, repository_info
 
 def _artifact_full_text(project_dir: Path, path: str, art) -> str:
@@ -572,6 +572,24 @@ class Codeanalyzer:
                 )
         return externals
 
+    def _own_output_paths(self) -> List[Path]:
+        """Where this run writes: the output and cache directories, plus the
+        output files themselves (#207).
+
+        Artifact discovery skips these, so a run whose ``-o``/``-c`` lands inside
+        ``-i`` does not ingest its own previous output (each run embedding the
+        last until the process is killed decoding it). The file entries carry the
+        degenerate case where the output directory *is* the project root, which
+        cannot be skipped wholesale without emptying the inventory.
+        """
+        paths: List[Path] = [self.cache_dir]
+        if self.options.output is not None:
+            paths += [self.options.output, self.options.output / ANALYSIS_JSON]
+        if self.options.emit is EmitTarget.NEO4J:
+            # No -o means the cypher snapshot lands in the working directory.
+            paths.append((self.options.output or Path.cwd()) / GRAPH_CYPHER)
+        return paths
+
     def analyze(self) -> Analysis:
         """Analyze the project and return the v2 ``Analysis`` envelope.
 
@@ -673,6 +691,7 @@ class Codeanalyzer:
         app.artifacts = discover_artifacts(
             self.project_dir, app_name,
             capture_text=self.options.artifact_text,
+            exclude_paths=self._own_output_paths(),
         )
         app.dependencies, app.unresolved_imports = build_dependency_view(
             app.artifacts,

codeanalyzer/dataflow/builder.py

@@ -35,6 +35,7 @@ the result degrades gracefully instead of crashing (contract rule).
 from __future__ import annotations
 
 import ast
+from collections import defaultdict
 from pathlib import Path
 from typing import Callable, Dict, List, Optional, Set, Tuple
 
@@ -43,7 +44,7 @@ from codeanalyzer.dataflow.alias import TypeBasedAliasOracle
 from codeanalyzer.dataflow.pdg import build_pdg
 from codeanalyzer.dataflow.sdg import ProgramGraphsIR, assemble_sdg
 from codeanalyzer.dataflow.summaries import CallSite, FunctionInfo, compute_summaries
-from codeanalyzer.schema.ids import stamp_body_ids
+from codeanalyzer.schema.ids import call_body_keys, stamp_body_ids
 from codeanalyzer.schema.py_schema import PyApplication, PyCallable, PyClass, PyModule
 from codeanalyzer.utils import logger
 
@@ -291,6 +292,11 @@ def emit_l3_body(
                     continue
                 pycallable.body[local] = BodyNode(kind=node.kind, span=span)
 
+            keys_at: Dict[str, List[str]] = defaultdict(list)
+            for key, n in pycallable.body.items():
+                if n.kind == "call":
+                    keys_at[key.split("/", 1)[0]].append(key)
+
             # #115: anchor nested call vertices to their statement. A bare-call
             # statement shares its key with its CFG node (handled above); a call
             # nested inside a larger statement (`y = f(x)`) has its own key and
@@ -301,12 +307,16 @@ def emit_l3_body(
                     continue
                 stmt_local = im.local(node.id)
                 for call in _calls_in(node.ast_node):
-                    call_key = f"{call.lineno}:{call.col_offset}"
-                    child = pycallable.body.get(call_key)
-                    if child is None or call_key == stmt_local:
-                        continue
-                    if child.kind == "call":
-                        child.parent = stmt_local
+                    # Every call node at this position, not just one: nested calls
+                    # that share a start column are keyed `line:col`, `line:col/2`,
+                    # ... and each of them needs the anchor (#215).
+                    base = f"{call.lineno}:{call.col_offset}"
+                    for call_key in keys_at.get(base, ()):
+                        child = pycallable.body.get(call_key)
+                        if child is None or call_key == stmt_local:
+                            continue
+                        if child.kind == "call":
+                            child.parent = stmt_local
 
             if want_cfg:
                 pycallable.cfg = [
@@ -378,7 +388,7 @@ def build_program_graphs(
                 calls_by_pos.setdefault(pos, (node.id, call))
                 calls_by_line.setdefault(call.lineno, (node.id, call))
 
-        for site in pycallable.call_sites or []:
+        for site_key, site in call_body_keys(pycallable.call_sites):
             # Prefer the callsite's body-backfilled callee over Jedi's own
             # callee_signature side channel: under cross-test parso/Jedi cache
             # pressure that inference can silently degrade (full-suite-only
@@ -388,7 +398,7 @@ def build_program_graphs(
             # Only a resolved INTERNAL target counts (id_to_sig misses on an
             # external/unresolved callee); falls through to callee_signature
             # exactly as before whenever the body doesn't have an answer.
-            body_node = pycallable.body.get(f"{site.start_line}:{site.start_column}")
+            body_node = pycallable.body.get(site_key)
             target = (id_to_sig.get(body_node.callee) if body_node else None) or site.callee_signature
             if not target:
                 continue

codeanalyzer/neo4j/emit.py

@@ -31,7 +31,7 @@ from codeanalyzer.neo4j.bolt import BoltConfig, bolt_writer
 from codeanalyzer.neo4j.schema import build_schema_document
 from codeanalyzer.neo4j.cypher import render_cypher
 from codeanalyzer.neo4j.project import project
-from codeanalyzer.options import AnalysisOptions
+from codeanalyzer.options import GRAPH_CYPHER, AnalysisOptions
 from codeanalyzer.schema import Analysis
 from codeanalyzer.schema.assign_ids import assign_ids
 from codeanalyzer.utils import logger
@@ -75,6 +75,6 @@ def emit_neo4j(analysis: Analysis, options: AnalysisOptions) -> None:
 
     out_dir = options.output if options.output is not None else Path.cwd()
     out_dir.mkdir(parents=True, exist_ok=True)
-    target = out_dir / "graph.cypher"
+    target = out_dir / GRAPH_CYPHER
     target.write_text(render_cypher(rows, app_name))
     logger.info(f"Neo4j graph written to {target}")

codeanalyzer/neo4j/project.py

@@ -49,8 +49,10 @@ from codeanalyzer.schema import (
     PyVariableDeclaration,
 )
 from codeanalyzer.schema import model_dump
-from codeanalyzer.schema.ids import application_id, external_id, global_ordinal, purl_pypi
-from codeanalyzer.schema.py_schema import PyDecorator
+from codeanalyzer.schema.ids import (
+    application_id, call_body_keys, external_id, global_ordinal, purl_pypi,
+)
+from codeanalyzer.schema.py_schema import PyDecorator, byte_offsets
 
 
 def project(app: PyApplication, app_name: str, sig_to_id: dict,
@@ -182,6 +184,17 @@ def _project_program_graphs(
             if not c.id:
                 continue  # unstamped callable — assign_ids must run first
             owner = _sym(c.id)  # the :PyCallable node, keyed by its can:// id
+            # ``callee_signature`` lives on ``PyCallable.call_sites``, not on the body
+            # node, so the graph joins the two on the call site's BODY KEY (#203,
+            # #215) -- re-derived from the same sequence L1 keyed ``body`` with, so
+            # two calls that start at one position keep their own signatures.
+            # ``argument_types`` is deliberately not joined: it is the legacy field #86
+            # split into ``PyCallArgument``, already carried as ``arguments_json``.
+            sig_by_key = {
+                key: cs.callee_signature
+                for key, cs in call_body_keys(c.call_sites)
+                if cs.callee_signature
+            }
             for local_key, node in (c.body or {}).items():
                 span = node.span
                 # L4 param vertices carry the variable they model (``of``) and
@@ -194,8 +207,8 @@ def _project_program_graphs(
                     prune(
                         {
                             "kind": node.kind,
-                            "start_line": span.start[0] if span else None,
-                            "end_line": span.end[0] if span else None,
+                            **_span_props(span),
+                            "callee_signature": sig_by_key.get(local_key),
                             "var": node.of,
                             "call_node": node.parent,
                             # Call-site detail (#120). The JSON emits one node per
@@ -346,8 +359,7 @@ def _project_artifacts(b: RowBuilder, app: PyApplication, app_name: str, app_ref
                         "namespace": ck.namespace,
                         "value": ck.value,
                         "references": list(ck.references or []),
-                        "start_line": ck.span.start[0] if ck.span else None,
-                        "end_line": ck.span.end[0] if ck.span else None,
+                        **_span_props(ck.span),
                     }
                 ),
             )
@@ -569,7 +581,7 @@ def _project_module_body(
         _project_class(b, file_key, mod_ref, "PY_DECLARES", cl, externals, sig_to_id,
                        mod.source, base_ref)
     for v in mod.variables or []:
-        _project_variable(b, file_key, mod_ref, v)
+        _project_variable(b, file_key, mod_ref, v, mod.source or "")
     _project_imports(b, mod_ref, mod, module_id_by_key)
 
 
@@ -597,9 +609,15 @@ def _project_imports(b: RowBuilder, mod_ref: NodeRef, mod: PyModule,
             continue
         key = im.resolved_module or im.module
         a = agg.setdefault(
-            key, {"spellings": set(), "names": set(), "aliases": set(), "resolved": im.resolved_module}
+            key,
+            {"spellings": set(), "names": set(), "aliases": set(), "positions": {},
+             "resolved": im.resolved_module},
         )
         a["spellings"].add(im.module)
+        # Keyed by spelling, never by index: ``spellings`` is emitted sorted, so a
+        # parallel position array has already lost its alignment (#203).
+        a["positions"][im.module] = [im.start_line, im.start_column,
+                                     im.end_line, im.end_column]
         if im.name:
             a["names"].add(im.name)
         if im.alias:
@@ -623,6 +641,7 @@ def _project_imports(b: RowBuilder, mod_ref: NodeRef, mod: PyModule,
                     "spellings": sorted(a["spellings"]),
                     "imported_names": sorted(a["names"]) or None,
                     "aliases": sorted(a["aliases"]) or None,
+                    "positions_json": json.dumps(a["positions"], sort_keys=True),
                 }
             ),
         )
@@ -675,7 +694,7 @@ def _project_callable(
         _project_decorator(b, ref, d)
 
     for v in c.local_variables or []:
-        _project_variable(b, file_key, ref, v)
+        _project_variable(b, file_key, ref, v, source)
     for ic in (c.callables or {}).values():
         _project_callable(b, file_key, ref, "PY_DECLARES", ic, externals, sig_to_id,
                           source, base_ref)
@@ -700,12 +719,14 @@ def _project_variable(
     file_key: str,
     owner: NodeRef,
     v: PyVariableDeclaration,
+    source: str,
 ) -> None:
     # ``<owner can:// id>/<name>@<line>`` (#173) — the owner is the module or the
     # callable, so a module-level variable sits under ``<module-id>/`` like every
     # other declaration and the module's prefix purge reaches it.
     var_id = f"{owner.value}/{v.name}@{v.start_line}"
-    ref = b.node(["PyVariable"], "id", var_id, _variable_props(v, var_id, file_key))
+    ref = b.node(["PyVariable"], "id", var_id,
+                 _variable_props(v, var_id, file_key, source))
     b.edge("PY_DECLARES_VAR", owner, ref)
 
 
@@ -737,6 +758,7 @@ def _project_decorator(b: RowBuilder, on: NodeRef, decorator: PyDecorator) -> No
             "keyword_arguments_json": json.dumps(
                 dict(decorator.keyword_arguments or {}), sort_keys=True
             ),
+            **_span_props(decorator.span),
         },
     )
 
@@ -752,6 +774,9 @@ def _module_props(mod: PyModule, file_key: str) -> Props:
             "id": mod.id,
             "file_key": file_key,
             "module_name": mod.module_name,
+            # Always present, never pruned: "" for an empty file, so a consumer can
+            # never confuse "not carried" with "empty" (#202).
+            "source": mod.source or "",
             "content_hash": mod.content_hash,
             "last_modified": mod.last_modified,
             "file_size": mod.file_size,
@@ -760,6 +785,36 @@ def _module_props(mod: PyModule, file_key: str) -> Props:
     )
 
 
+def _span_props(span) -> Props:
+    """The six flattened span properties from a v2 ``Span`` (#202). Lines and columns
+    come straight off the model; ``bytes`` is already utf-8 and is what makes the span
+    sliceable out of ``:PyModule.source``."""
+    if span is None:
+        return {}
+    return {
+        "start_line": span.start[0], "start_column": span.start[1],
+        "end_line": span.end[0], "end_column": span.end[1],
+        "start_byte": span.bytes[0], "end_byte": span.bytes[1],
+    }
+
+
+def _flat_span_props(source: str, start_line: int, start_column: int,
+                     end_line: int, end_column: int) -> Props:
+    """The same six for a model carrying flat ast positions and no ``Span``
+    (:PyAttribute, :PyVariable). The byte pair is computed here rather than left
+    absent, so ``_SPAN`` means one thing on every label that spreads it (#202)."""
+    if start_line < 0 or end_line < 0 or not source:
+        return {}
+    start_column = max(start_column, 0)
+    end_column = max(end_column, 0)
+    lo, hi = byte_offsets(source, start_line, start_column, end_line, end_column)
+    return {
+        "start_line": start_line, "start_column": start_column,
+        "end_line": end_line, "end_column": end_column,
+        "start_byte": lo, "end_byte": hi,
+    }
+
+
 def _span_code(source: str, span) -> str | None:
     """A declaration's text: the owning module's ``source`` sliced by the node's
     utf-8 byte span. Schema v2 stores source once per module, so the graph's
@@ -781,8 +836,8 @@ def _class_props(cl: PyClass, file_key: str, source: str) -> Props:
             "base_classes": list(cl.base_classes or []),
             "decorators": [d.qualified_name or d.name for d in (cl.decorators or [])],
             "docstring": _docstring_of(cl.comments),
-            "start_line": cl.start_line,
-            "end_line": cl.end_line,
+            **(_span_props(cl.span) or {"start_line": cl.start_line,
+                                        "end_line": cl.end_line}),
             "_module": file_key,
             "is_entrypoint": bool(cl.entrypoints),
             "entrypoint_frameworks": sorted({e.framework for e in (cl.entrypoints or [])}),
@@ -801,8 +856,8 @@ def _callable_props(c: PyCallable, file_key: str, source: str) -> Props:
             "cyclomatic_complexity": c.cyclomatic_complexity,
             "code": _span_code(source, c.span),
             "code_start_line": c.code_start_line,
-            "start_line": c.start_line,
-            "end_line": c.end_line,
+            **(_span_props(c.span) or {"start_line": c.start_line,
+                                       "end_line": c.end_line}),
             "docstring": _docstring_of(c.comments),
             "decorators": [d.qualified_name or d.name for d in (c.decorators or [])],
             "modifiers": list(c.modifiers or []),
@@ -823,6 +878,8 @@ def _attribute_props(a: PyClassAttribute, attr_id: str, file_key: str) -> Props:
             "type": a.type,
             "initializer": a.initializer,
             "docstring": _docstring_of(a.comments),
+            # Line-only: PyClassAttribute has no columns, so there is nothing to
+            # derive bytes from. See the note on :PyAttribute in schema.py.
             "start_line": a.start_line,
             "end_line": a.end_line,
             "_module": file_key,
@@ -830,16 +887,21 @@ def _attribute_props(a: PyClassAttribute, attr_id: str, file_key: str) -> Props:
     )
 
 
-def _variable_props(v: PyVariableDeclaration, var_id: str, file_key: str) -> Props:
+def _variable_props(v: PyVariableDeclaration, var_id: str, file_key: str,
+                    source: str) -> Props:
     return prune(
         {
             "id": var_id,
             "name": v.name,
             "type": v.type,
             "initializer": v.initializer,
+            # ``value`` is Optional[Any] and a Neo4j property is a scalar or an array
+            # of scalars, so a dict/list value needs a serialization rather than a raw
+            # put -- always encoded, one shape for every value (#203).
+            "value_json": _stringify_if(v.value) if v.value is not None else None,
             "scope": v.scope,
-            "start_line": v.start_line,
-            "end_line": v.end_line,
+            **_flat_span_props(source, v.start_line, v.start_column,
+                              v.end_line, v.end_column),
             "_module": file_key,
         }
     )

codeanalyzer/neo4j/schema.py

@@ -28,6 +28,13 @@ SCHEMA_VERSION is the contract version: bump MAJOR on a breaking change (renamed
 relationship or key), MINOR on an additive change (new label/rel/property). It is stamped onto
 the :PyApplication node of every emitted graph so any consumer can detect a producer/consumer
 mismatch at runtime.
+
+**The additive-MINOR rule is suspended for the 2.0.0 line.** Per the 2026-09-07 ruling (all three
+analyzers), payload ``schema_version`` and this version both hold at ``2.0.0`` until the 2.0.0 line
+leaves release-candidate, so the additive properties of #202/#203 ship without a bump and are
+detectable only by presence. Consumers gate on the **analyzer version** instead -- the python-sdk
+Neo4j backends carry an analyzer floor and refuse anything below it at attach. The rule above
+resumes at the coordinated re-baseline.
 """
 
 from __future__ import annotations
@@ -61,7 +68,18 @@ class RelType:
 # anchor for the prefix-scoped destructive statements (see ``rows.CAN_NODE``).
 MARKER_LABELS: List[str] = ["PyCanNode"]
 
-_SPAN = {"start_line": "integer", "end_line": "integer"}
+# The flattened span. ``start_column``/``end_column``/``start_byte``/``end_byte``
+# are adopted **verbatim** from codeanalyzer-java#255, which coined them: a term
+# coined twice is permanently wrong under the cross-language parity clause. The
+# byte pair makes every span sliceable out of :PyModule.source -- for the labels
+# whose JSON model carries flat ast positions and no ``Span`` (:PyAttribute,
+# :PyVariable) the projector computes it, so this dict means one thing on every
+# label that spreads it (#202).
+_SPAN = {
+    "start_line": "integer", "end_line": "integer",
+    "start_column": "integer", "end_column": "integer",
+    "start_byte": "integer", "end_byte": "integer",
+}
 
 
 NODE_LABELS: List[NodeLabel] = [
@@ -90,6 +108,10 @@ NODE_LABELS: List[NodeLabel] = [
             "id": "string",
             "file_key": "string",
             "module_name": "string",
+            # The primary text: schema v2 stores source once per module and every
+            # narrower node's text is a byte slice of it. Always present -- an empty
+            # file yields "", so "not carried" is never confusable with "empty" (#202).
+            "source": "string",
             "content_hash": "string",
             "last_modified": "float",
             "file_size": "integer",
@@ -158,7 +180,13 @@ NODE_LABELS: List[NodeLabel] = [
             "type": "string",
             "initializer": "string",
             "docstring": "string",
-            **_SPAN,
+            # The one _SPAN exception: ``PyClassAttribute`` carries start/end LINE only
+            # -- no columns, hence no derivable byte offsets. Emitting a fabricated
+            # column 0 would make the span unsliceable while claiming otherwise, so the
+            # line pair is declared honestly instead. Filed for the JSON model to gain
+            # columns; until then this label is line-granular (#203).
+            "start_line": "integer",
+            "end_line": "integer",
         },
     ),
     NodeLabel(
@@ -170,6 +198,11 @@ NODE_LABELS: List[NodeLabel] = [
             "name": "string",
             "type": "string",
             "initializer": "string",
+            # ``PyVariableDeclaration.value`` -- the literal-evaluated result, always
+            # JSON-encoded because it is ``Optional[Any]`` and a Neo4j property is a
+            # scalar or an array of scalars (the ``arguments_json`` precedent, #203).
+            # ``initializer`` stays the raw source text.
+            "value_json": "string",
             "scope": "string",
             **_SPAN,
         },
@@ -197,6 +230,12 @@ NODE_LABELS: List[NodeLabel] = [
             "return_type": "string",
             "is_constructor_call": "boolean",
             "arguments_json": "string",
+            # What distinguishes overload targets at a resolved call site. Joined
+            # from ``PyCallable.call_sites`` at projection time, since ``BodyNode``
+            # does not carry it in JSON (#203). ``argument_types`` is deliberately
+            # NOT here: it is the legacy field #86 split into ``PyCallArgument``,
+            # already carried as ``arguments_json``.
+            "callee_signature": "string",
             **_SPAN,
         },
     ),
@@ -247,16 +286,26 @@ REL_TYPES: List[RelType] = [
         "PY_IMPORTS",
         ["PyModule"],
         ["PyModule", "PyPackage"],
-        {"spellings": "string[]", "imported_names": "string[]", "aliases": "string[]"},
+        # ``positions_json`` keys on the spelling, not on an index: this edge
+        # pre-aggregates per (module, target) and emits ``spellings`` sorted, so
+        # parallel position arrays have already lost their alignment (#203).
+        {"spellings": "string[]", "imported_names": "string[]", "aliases": "string[]",
+         "positions_json": "string"},
     ),
     RelType(
         "PY_DECORATED_BY",
         ["PyCallable", "PyClass"],
         ["PyDecorator"],
+        # The span rides here, not on :PyDecorator: that node is merged on the
+        # resolved ``qualified_name`` and carries no ``_module``, so it is never
+        # pruned and any per-application fact on it would accumulate across every
+        # project in the database -- the same reason ``expression`` and the
+        # arguments already ride the relationship (#203).
         {
             "expression": "string",
             "positional_arguments": "string[]",
             "keyword_arguments_json": "string",
+            **_SPAN,
         },
     ),
     # Level-3 CPG overlay (-a 3 only): the cross-language dataflow vocabulary,

codeanalyzer/options/__init__.py

@@ -1,3 +1,3 @@
-from .options import AnalysisOptions, EmitTarget
+from .options import ANALYSIS_JSON, GRAPH_CYPHER, AnalysisOptions, EmitTarget
 
-__all__ = ["AnalysisOptions", "EmitTarget"]
+__all__ = ["AnalysisOptions", "EmitTarget", "ANALYSIS_JSON", "GRAPH_CYPHER"]

codeanalyzer/options/options.py

@@ -4,6 +4,13 @@ from typing import Optional, Tuple
 from enum import Enum
 
 
+# The files a run writes into its output directory. Named once so artifact
+# discovery can recognize -- and skip -- the run's own output when it lands
+# inside the analyzed project (#207).
+ANALYSIS_JSON = "analysis.json"
+GRAPH_CYPHER = "graph.cypher"
+
+
 class EmitTarget(str, Enum):
     """Output target selected by ``--emit``.
 

codeanalyzer/schema/ids.py

@@ -10,7 +10,7 @@ and artifacts alike — which is what the prefix-scoped destructive statements
 an application named ``python`` mints ``can://python/python/...``, so a test
 for ``can://python/`` no longer means "a python id"; test the scheme instead."""
 from __future__ import annotations
-from typing import List, Optional
+from typing import Iterable, Iterator, List, Optional, Tuple
 
 SCHEME = "can://"
 
@@ -52,6 +52,42 @@ def external_id(app_id: str, module: Optional[str], name: str) -> str:
     return f"{base}/{module}/{name}" if module else f"{base}/{name}"
 
 
+def call_body_keys(sites: Iterable) -> Iterator[Tuple[str, object]]:
+    """The body key of each call site, in recording order: ``line:col``,
+    disambiguated ``/2``, ``/3``, ... when nested calls share a start position
+    (#215).
+
+    `getattr(o, n)(x)` begins the outer application and the inner `getattr` at the
+    same column, so a bare ``line:col`` key keeps one of the two and the dynamic
+    invocation is lost. Call sites are recorded pre-order, so the bare key goes to
+    the OUTERMOST call and the nested ones take the suffixes. The spelling is
+    codeanalyzer-typescript's (``callBodyKeys``, ``src/schema/l1Body.ts``), adopted
+    verbatim; the ``/`` never collides with a param-vertex segment, which always
+    begins ``actual_``.
+
+    The SINGLE definition of the sequence -- L1 builds ``body`` with it, and L2, the
+    dataflow builder, the defuse linker and the Neo4j projection re-derive the same
+    pairing from it rather than re-deriving a key from a position.
+    """
+    used = set()
+    for cs in sites or []:
+        base = f"{cs.start_line}:{cs.start_column}"
+        key = base
+        k = 2
+        while key in used:
+            key = f"{base}/{k}"
+            k += 1
+        used.add(key)
+        yield key, cs
+
+def call_body_key(callable_, site) -> Optional[str]:
+    """``site``'s body key within ``callable_`` — the pairing of
+    :func:`call_body_keys`, for a caller that holds one site rather than the list."""
+    for key, cs in call_body_keys(callable_.call_sites):
+        if cs is site:
+            return key
+    return None
+
 def global_ordinal(callable_id: str, local_key: str) -> str:
     """The GLOBAL ordinal id of a body node from its LOCAL key: synthetic keys
     (`@entry`, `@formal_in:0`) already carry the `@`; positional keys (`15:2`,

codeanalyzer/schema/l1_body.py

@@ -1,12 +1,11 @@
 """L1 body population: materialize `call` nodes from existing call sites.
 `callee` is left None here — the sanctioned null→id refinement happens at L2."""
 from __future__ import annotations
-from codeanalyzer.schema.ids import stamp_body_ids
+from codeanalyzer.schema.ids import call_body_keys, stamp_body_ids
 from codeanalyzer.schema.py_schema import PyApplication, PyClass, PyCallable, BodyNode, Span, byte_offsets
 
 def _do_callable(source: str, c: PyCallable) -> None:
-    for cs in c.call_sites or []:
-        key = f"{cs.start_line}:{cs.start_column}"
+    for key, cs in call_body_keys(c.call_sites):
         span = Span(start=(cs.start_line, cs.start_column),
                     end=(cs.end_line, cs.end_column),
                     bytes=byte_offsets(source, cs.start_line, cs.start_column, cs.end_line, cs.end_column)) if source else None

codeanalyzer/schema/l2_callees.py

@@ -5,17 +5,18 @@ signature; an unresolved call site leaves `callee` absent.
 
 Two resolution sources feed the backfill: Jedi's `callee_signature` on the
 call site itself, and the defuse linker's returned map (keyed by caller
-signature + "line:col"). The linker's resolutions are deliberately NOT written
+signature + the call site's body key, which carries a `/N` disambiguator when
+nested calls share a start position -- #215). The linker's resolutions are deliberately NOT written
 into `callee_signature` — the symbol table round-trips through the analysis
 cache, and a persisted resolution would resurface on a warm run as a Jedi
 edge, silently changing provenance."""
 from __future__ import annotations
+from codeanalyzer.schema.ids import call_body_keys
 from codeanalyzer.schema.py_schema import PyApplication, PyClass, PyCallable
 
 
 def _do_callable(c: PyCallable, sig_to_id: dict, resolutions: dict) -> None:
-    for cs in c.call_sites or []:
-        key = f"{cs.start_line}:{cs.start_column}"
+    for key, cs in call_body_keys(c.call_sites):
         jedi_sig = cs.callee_signature
         if jedi_sig and jedi_sig.startswith("typing."):
             # A decorator-typed callable resolved to its annotation, not a

codeanalyzer/semantic_analysis/defuse_linker.py

@@ -40,11 +40,14 @@ import ast
 import builtins as _py_builtins
 from typing import Dict, List, Optional, Tuple
 
+from codeanalyzer.schema.ids import call_body_key
 from codeanalyzer.schema.py_schema import PyCallable, PyCallEdge, PyClass, PyModule
 
 __all__ = ["defuse_linker_edges"]
 
-# (caller signature, "line:col" of the call site) -> resolved callee signature
+# (caller signature, the call site's body key) -> resolved callee signature.
+# The key is `call_body_key`, not a bare "line:col": two nested calls can start
+# at one position and only one of them is the resolution being recorded (#215).
 Resolutions = Dict[Tuple[str, str], str]
 
 _MAX_CHAIN = 16  # assignment-chain hops before giving up (cycle safety net)
@@ -1095,7 +1098,7 @@ def defuse_linker_edges(
                 oracle.vote(sig, site)
                 bump(caller.signature, sig)
                 resolutions[
-                    (caller.signature, f"{site.start_line}:{site.start_column}")
+                    (caller.signature, call_body_key(caller, site))
                 ] = sig
 
             # Calls Jedi's extractor never recorded as sites at all (with-
@@ -1398,7 +1401,7 @@ def defuse_linker_edges(
                     oracle.vote(sig, site)
                     bump(caller.signature, sig)
                     resolutions[
-                        (caller.signature, f"{site.start_line}:{site.start_column}")
+                        (caller.signature, call_body_key(caller, site))
                     ] = sig
                     made_progress = True
                 else:
@@ -1452,7 +1455,7 @@ def defuse_linker_edges(
             oracle.vote(sig, site)
             bump(caller.signature, sig)
             resolutions[
-                (caller.signature, f"{site.start_line}:{site.start_column}")
+                (caller.signature, call_body_key(caller, site))
             ] = sig
             made_progress = True
         remaining = still

codeanalyzer/syntactic_analysis/symbol_table_builder.py

@@ -130,8 +130,9 @@ class SymbolTableBuilder:
             return None, False
 
     @staticmethod
-    def _callee_anchor(node: ast.Call) -> Tuple[int, int]:
-        """Position of the callee *name* for Jedi inference.
+    def _callee_anchor(node: ast.Call) -> Optional[Tuple[int, int]]:
+        """Position of the callee *name* for Jedi inference, or ``None`` when the
+        callee is not a name at all.
 
         An ``ast.Call``'s own ``lineno``/``col_offset`` is the first
         character of the whole call expression — for an attribute call
@@ -139,11 +140,17 @@ class SymbolTableBuilder:
         would infer the receiver's type instead of the invoked method
         (issue #80). Anchor attribute calls inside the attribute name —
         its last character, so one-character names stay in range; other
-        callee shapes keep the call-expression start.
+        callee shapes keep the call-expression start. A callee that is itself a
+        call has no name to anchor on, so it yields ``None`` (#215).
         """
         func_expr = node.func
         if isinstance(func_expr, ast.Attribute):
             return func_expr.end_lineno, func_expr.end_col_offset - 1
+        if isinstance(func_expr, ast.Call):
+            # `getattr(o, n)(x)`: the callee IS a call, so the expression start is
+            # the INNER call's name and inferring there labels this site a call to
+            # `getattr` -- the thing that produced the callee, not the callee (#215).
+            return None
         return node.lineno, node.col_offset
 
     @staticmethod
@@ -766,11 +773,18 @@ class SymbolTableBuilder:
             func_expr = node.func
 
             method_name = "<unknown>"
-            anchor_line, anchor_col = self._callee_anchor(node)
-            callee_signature, is_constructor = self._infer_callee(
-                script, anchor_line, anchor_col
-            )
-            return_type = self._infer_call_return_type(script, anchor_line, anchor_col)
+            anchor = self._callee_anchor(node)
+            if anchor is None:
+                # A dynamic invocation: the site is recorded, and it resolves to
+                # nothing. Guessing a target here is what produced a graph full of
+                # calls to `builtins.getattr` (#215).
+                callee_signature, is_constructor, return_type = None, False, None
+            else:
+                anchor_line, anchor_col = anchor
+                callee_signature, is_constructor = self._infer_callee(
+                    script, anchor_line, anchor_col
+                )
+                return_type = self._infer_call_return_type(script, anchor_line, anchor_col)
 
             receiver_expr = None
             receiver_type = None

{codeanalyzer_python-1.5.1.dist-info → codeanalyzer_python-1.5.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codeanalyzer-python
-Version: 1.5.1
+Version: 1.5.3
 Summary: Static analysis for Python — canonical schema v2 (symbol table, call graph, and native CFG/PDG/SDG dataflow) as analysis.json or a Neo4j property graph.
 Author-email: Rahul Krishna <i.m.ralk@gmail.com>
 License-File: LICENSE

{codeanalyzer_python-1.5.1.dist-info → codeanalyzer_python-1.5.3.dist-info}/RECORD

@@ -1,6 +1,6 @@
 codeanalyzer/__init__.py,sha256=BZ3Kuwl-F_F-8H8cepLnVJ4Ku4NNUjjqg0Y6ujPQSsI,108
-codeanalyzer/__main__.py,sha256=o5_9ct61l3T7ryIsag8bz304NabVV-el_ooGD8tnbhA,15968
-codeanalyzer/core.py,sha256=JfSsQEacBiVn38tQP34QWdJqQx7ecE70EXI8obISZN4,46598
+codeanalyzer/__main__.py,sha256=noiZpfaiyFlnmdzHoWOAImXpxDkiQzTxSO4gmyZVyGI,15981
+codeanalyzer/core.py,sha256=UoK-7xgzJx-f3A_fmmeEZkBshiOWNDwc_RJTPhCTU0Y,47655
 codeanalyzer/provenance.py,sha256=DT-DqwdVwO7g-GyK3sC0_4vDNCUjZYEY1fyYCt-7VRM,2306
 codeanalyzer/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codeanalyzer/artifacts/__init__.py,sha256=317sEeZLS1AYsfYDYIk7tLR3AdDFwWw_cmkeZDabkJo,906
@@ -8,12 +8,12 @@ codeanalyzer/artifacts/config_keys.py,sha256=ovwptAErLYutlCzUwvyim2kH6-6vUKxuRcB
 codeanalyzer/artifacts/config_use.py,sha256=1-jGacW249dwF7b6DOrTFuJ7sA5Ho9khgrgZqND0nro,27173
 codeanalyzer/artifacts/config_use_rules.yml,sha256=fNgI6IceOsj78LYmgoDH-vQ4-Mfb2ZFGKIQhLuoL4ik,1483
 codeanalyzer/artifacts/dependencies.py,sha256=h_-XV5KhrT-1Ytguw0c4fyI9zSFzn9Aj7kR66omvL3M,10853
-codeanalyzer/artifacts/discovery.py,sha256=cUVRSdV82G2hVGhkRGV7u24-tEAxUBmH9nkTg24ur0Y,5968
+codeanalyzer/artifacts/discovery.py,sha256=urN4ZvtnXs0w9Kv2-yeOQza1TV1mjLL007zHfbdjNSg,8416
 codeanalyzer/artifacts/parsers.py,sha256=xOjC53tT0Mv0k7ONGwzl5XUvpBLnZlEcGmyrX5DS45k,9035
 codeanalyzer/dataflow/__init__.py,sha256=HCNOH24rAGLUMG94N9aC-2SsAWSntk3uys7e39ipU5o,1725
 codeanalyzer/dataflow/access_paths.py,sha256=wC8Q9qD-RZzkoFWMVvu_6uNNmYP8z48OGp9h9v3F1d4,23623
 codeanalyzer/dataflow/alias.py,sha256=ZYKY0DiR3GHv6YJr7C001Lode9rZsk6-gxdomUyIvwg,3928
-codeanalyzer/dataflow/builder.py,sha256=grzgpl82KzNiwlgdTx60INMxkTZvddT3JzgaBRO4xh4,32839
+codeanalyzer/dataflow/builder.py,sha256=Ku16XuEJj46lnfuigMMyR6yheRW52f5U-ih9msxqSyo,33402
 codeanalyzer/dataflow/cfg.py,sha256=u5YXJjAaDshdgv-9kWWITbBJFP-MwXKq6hbNh0fhDm8,25307
 codeanalyzer/dataflow/defuse.py,sha256=LrX1ToOZzR79NlAGg5T647UAFkpiEqEnT7t0K5RXOiI,4377
 codeanalyzer/dataflow/dominance.py,sha256=X7Ki1QRdVqaseYsJtiUL7m9MbcC2WHEv9b8bczSLFUA,5086
@@ -47,32 +47,32 @@ codeanalyzer/jedi/jedi.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codeanalyzer/neo4j/__init__.py,sha256=8Ei6uThTOqmul6GhnKoGOjLXJZbyDwF5Jo-8I8NxnAk,1574
 codeanalyzer/neo4j/bolt.py,sha256=8l70iGDjY3Kdm-W1sb3b3O1uqLjDrVPYTpXhnkXdZOY,13694
 codeanalyzer/neo4j/cypher.py,sha256=-wledvXVrcLJRtSC5MCn1N3tqgC06rNfPBn0w6POqHo,6239
-codeanalyzer/neo4j/emit.py,sha256=OBCO77TDTaNpqk9Di3JIQzBouLpHPdgoXuPSs44iJuU,3587
-codeanalyzer/neo4j/project.py,sha256=wKvX7C1vamGswzoBRX09BZ1hOm1NJWoSdtQ7UNt2qTE,39102
+codeanalyzer/neo4j/emit.py,sha256=7QYosqiadH2GIsjaUSmSlJ5g8yLjAAcMplsmFaJLnC4,3599
+codeanalyzer/neo4j/project.py,sha256=o6jdjwvHRxpNPNn-DXpOzebFq-fXgxoXTrKZ4_2ZVbQ,42383
 codeanalyzer/neo4j/rows.py,sha256=n_J3NVIusLPsHMjPCWaYvlL5sFm6V-kl_Z6B_BTH8Fk,10140
-codeanalyzer/neo4j/schema.py,sha256=ZRjBxpagBsQrPbD5BbeAZlj3ilTeYe4AsquztRDaH4M,14735
-codeanalyzer/options/__init__.py,sha256=6NewN0a-1HAEgKcxQjYyVn2WEDLrhax8h3WLgZddeqI,94
-codeanalyzer/options/options.py,sha256=2jDCcs74iSEOhz90LoRGts6PC8yV9IDPVxnLPNmonOA,1609
+codeanalyzer/neo4j/schema.py,sha256=0qZ1qJgmutlMHyIjdfD5N9QtA-gwl8Qcgh4NGguQEMs,18089
+codeanalyzer/options/__init__.py,sha256=HvKzVXBI91lBM941JSFN7npG4S2fHlVEKo9VC2lRso8,156
+codeanalyzer/options/options.py,sha256=DAo1i08D0K16jCivTrdOcBgKRPO50SngFZTPAL_kpmY,1862
 codeanalyzer/schema/__init__.py,sha256=hIyz02abUJNPW8yUgguaeKflZjTmOZWbDiKICNBD7yk,4141
 codeanalyzer/schema/assign_ids.py,sha256=pQHluLaO5a6hFREp3vjVRsUeAfTYSJ95RXS9TZvnoys,1590
 codeanalyzer/schema/call_graph_ids.py,sha256=mWAhJDBsW8i-siJiINOHCXEm4qM6F_5se9-HuHWIFqU,568
-codeanalyzer/schema/ids.py,sha256=YuioNK3Y-M2NcCBiGH4AB4rDezlqu6ycNO0R3O-Jxho,4388
-codeanalyzer/schema/l1_body.py,sha256=_sca0mTkMRb-5lasep87faGjDxZJd9jGB0hmBx3uCgk,1757
-codeanalyzer/schema/l2_callees.py,sha256=CTcBeGoO04DstDC6h-1sHMbbIrHDEOMxP01U9VLBcfc,2327
+codeanalyzer/schema/ids.py,sha256=eShvV3R6oQt1lCQ2DFAhWekSWom63wQJDfeWXJ7KovQ,5986
+codeanalyzer/schema/l1_body.py,sha256=-rBXZH1nhaCyQ2DVN-iIswuuSQ7Jsa8voSAaljv_c80,1737
+codeanalyzer/schema/l2_callees.py,sha256=UGubBSLA_-GCK9Kak2rqkmoFlGifiImVnPDrypjHfrA,2441
 codeanalyzer/schema/py_schema.py,sha256=4xJto32nWqHx0dkge4qHsV2JZSjbyv4ojnqpyBm78sQ,24588
 codeanalyzer/semantic_analysis/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codeanalyzer/semantic_analysis/call_graph.py,sha256=6YEB_wTn5-oQYLrbIhJYE0BsHl4fpWPoy5Hwd9mTnGc,11918
-codeanalyzer/semantic_analysis/defuse_linker.py,sha256=bSn1rCun28OQqSd2NOc9aVBSm47Gt9Iul4r_gwfqO1w,64930
+codeanalyzer/semantic_analysis/defuse_linker.py,sha256=3n1ew94eyBsSI98cFqP0uMHFUv7ob7QR9DL2hTKMHsQ,65099
 codeanalyzer/syntactic_analysis/__init__.py,sha256=EUQkJEh6wHjWx2qTTKbTbUgwSbfKeNieKHNy7RknVXA,476
 codeanalyzer/syntactic_analysis/exceptions.py,sha256=whs_n0vIu655Jkk1a7iOoXY6iIca4pZqJnU40V9Ejaw,537
 codeanalyzer/syntactic_analysis/import_resolver.py,sha256=Q8noZwSdDNt4P4NMqDTB9FaS-M0_d4ASK9GnJop9MDI,2751
-codeanalyzer/syntactic_analysis/symbol_table_builder.py,sha256=eTknBDlUuuQd3JEwbRtJt5pGVU89kOnzfmT4D5J_GKQ,47917
+codeanalyzer/syntactic_analysis/symbol_table_builder.py,sha256=tKed-VCSd_albMeZfUuPRCcKz_WEBic38DU21gM8o7g,48797
 codeanalyzer/utils/__init__.py,sha256=hC6VWdR5rerSqBxzu9KQHTASWqwrrYJv-CMDwrTlzkc,137
 codeanalyzer/utils/logging.py,sha256=Fw0tattPAOMs3o0JMjjXhRVLIF64f-SCcygUXF9jqeg,904
 codeanalyzer/utils/progress_bar.py,sha256=C9JtzVdd10lIxTv-KA6PebqjKWueC_vMGwVzAtHuHIw,2818
-codeanalyzer_python-1.5.1.dist-info/METADATA,sha256=Ujo3QIsG8aBykzxm3Mjw_OLCD3b8oaiIrLP1wTvOVD8,44845
-codeanalyzer_python-1.5.1.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-codeanalyzer_python-1.5.1.dist-info/entry_points.txt,sha256=v4Vux0Nnx7sOntVk_CH7W9RX6SkIkvR1FQYq73oVlCQ,105
-codeanalyzer_python-1.5.1.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-codeanalyzer_python-1.5.1.dist-info/licenses/NOTICE,sha256=MdVkNYqHJ20on2FmWvgD4WpMsX5mir33xdyPvTXd0A0,1223
-codeanalyzer_python-1.5.1.dist-info/RECORD,,
+codeanalyzer_python-1.5.3.dist-info/METADATA,sha256=mYN0yUedKfOOzWquD1DxyaoE3c9yUpK9Prs9AXqj6d0,44845
+codeanalyzer_python-1.5.3.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+codeanalyzer_python-1.5.3.dist-info/entry_points.txt,sha256=v4Vux0Nnx7sOntVk_CH7W9RX6SkIkvR1FQYq73oVlCQ,105
+codeanalyzer_python-1.5.3.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+codeanalyzer_python-1.5.3.dist-info/licenses/NOTICE,sha256=MdVkNYqHJ20on2FmWvgD4WpMsX5mir33xdyPvTXd0A0,1223
+codeanalyzer_python-1.5.3.dist-info/RECORD,,