v2.0.0-rc.8

[github-actions[bot]]

cldk v2.0.0-rc.8

A small release with one user-visible fix: locate on a Python decorator line now answers with the decorated callable instead of module_scope. It also takes up codeanalyzer-python 1.5.3.

pip install -U --pre "cldk==2.0.0rc8"
pip install -U --pre "cldk[neo4j]==2.0.0rc8"     # with the read-only Neo4j backend
pip install -U --pre "cldk[java]==2.0.0rc8"      # with the Java analyzer

No breaking changes. The Python graph floor stays at codeanalyzer-python 1.5.0; nothing that attached to rc.7 is refused by rc.8.

locate places a decorator line on the callable it decorates (#408)

PyCallable.start_line is the def line, because codeanalyzer-python takes it from ast.FunctionDef.lineno, and Python's AST puts decorators above that line. So a scanner alert on @http.route('/crm/notes/...', auth='user') sat inside no callable span, and locate reported it as module scope. It is not; it is the routed method's.

Both backends now read where the decorator is applied. The local backend reads PyCallable.decorators[].span. The Neo4j backend reads PY_DECORATED_BY.start_line, which codeanalyzer-python 1.5.2 emits. Every line from the first decorator through the callable's last line resolves to that callable, including a line between two decorators, and diagnostics is empty for it.

Three things stay as they were, each pinned by a test:

• A blank line with no decorator over it is still module_scope. This is not a nearest-callable fallback.
• A class decorator is still module_scope. A result with type set and callable unset would be a new shape, and that decision is not made here.
• A graph emitted by codeanalyzer-python 1.5.1 or earlier, or an analysis from one, records no decorator span. It answers exactly as before and raises nothing.

A decorator on a nested function resolves to the nested function, because ranking is unchanged: the def-based width, and the nested span is narrower.

Measured on odoo-slim-19 re-emitted by codeanalyzer-python 1.5.3, 40 positions (20 decorator lines, 20 body lines), median of 5, same graph both ways: 71.0 ms placing 20 of 40 before, 70.2 ms placing 40 of 40 after. The query still seeks the pysymbol_id index.

Analyzer pin: codeanalyzer-python 1.5.3 (#410)

Two analyzer fixes. Neither moves the schema; schema_version and the graph SCHEMA_VERSION both stay 2.0.0.

• The analyzer no longer ingests its own output (codeanalyzer-python#207). An output or cache directory inside the analyzed project made run N inventory run N-1's analysis.json and embed it whole. This SDK's default cache_dir is <project>/.codeanalyzer, inside the project, so every local run was exposed.
• One body node per call site when two calls share a start position (codeanalyzer-python#215). In getattr(o, n)(x) the outer call and the inner getattr start at the same column, and the position-keyed body kept only the inner one. Keys now carry a /2, /3 disambiguator, outermost first. A key that used to collide now names the outer call, and a call whose callee is itself a call carries callee_signature: null with method_name: "<unknown>". The SDK's key parser already handled the suffix.

Links

• Release: https://github.com/codellm-devkit/python-sdk/releases/tag/v2.0.0-rc.8
• Changelog: https://github.com/codellm-devkit/python-sdk/blob/release/2.0/CHANGELOG.md