v2.0.0-rc.2

[github-actions[bot]]

cldk 2.0.0-rc.2

The first real release candidate of the v2 line, cut from release/2.0: the Python facade rebuilt as a static-analysis front end that agents and humans query the same way — address by name, enumerate a slice, walk one callable's graphs, take slices and follow flows — on codeanalyzer-python 1.4.1. Breaking; it supersedes 2.0.0-rc.1, which was cut from a branch that never merged.

⚠️ Breaking changes — read these first (#319, #321, #327)

• A Neo4j graph must be emitted by codeanalyzer-python ≥ 1.4.0. An older graph is refused at attach with GraphSchemaMismatch naming what was found and the floor; it used to answer every query with zero rows, silently. Migration: re-ingest with codeanalyzer-python>=1.4.0 --emit neo4j — there is no in-place upgrade.
• PyCallableOverview.path is repo-relative (value change, same type). It was the absolute path on whichever machine ran the analysis, which no other host could join. Migration: re-read stored values; they now equal PyModule keys.
• LocateResult.node_id is the analyzer's own body-node id (value change, same type). The old composed form named nothing in the graph. Migration: treat it as opaque — pass it to get_source() or describe(), never parse it.
• Fifteen PythonAnalysis accessors that only ever raised NotImplementedError are removed. No caller could depend on their behaviour, only on the name existing. CLDK.java() and CLDK.typescript() keep their working namesakes.
• C analysis is removed (CLDK.c(), cldk.analysis.c, cldk.models.c) with the clang, libclang and tree-sitter-c dependencies. It emitted none of the code-property graph the 2.0 surface is built on.

🎯 A query surface you can address by name (#321)

• resolve_callable(...) / resolve_value(...) / locate(path, line) — dotted-suffix matching, deterministic. An ambiguous name raises AmbiguousName listing candidates; nothing is auto-picked and there is no fuzzy matching anywhere, including error paths. No can:// URI appears in any signature.
• get_symbol_table(paths=…) / get_classes(module=…) / get_call_graph(roots=…, depth=…) — enumerate a slice of the application rather than all of it. A selector that resolves to nothing raises SelectorNotInGraph naming what missed, instead of an empty that reads like a fact.
• get_cfg / get_cdg / get_ddg — one callable's graphs, paginated, in a canonical order identical on both backends. One Odoo callable holds 1.39M data-dependence edges, which is why they paginate.
• slice_backward / slice_forward / backward_cone / reaches / callers_of / callees_of / paths_between / call_paths_between / flows_to_call / flows_to_argument, with describe() to hydrate source in one round trip. Every hop carries the edge and provenance that justified it. Slices default to a finite depth because a value's backward slice is either a handful of nodes or a fifth of the program; predicates and paths are unbounded, because a bounded boolean is a wrong answer rather than a small one.
• One completeness protocol — every bounded result carries complete, serialises, iterates its items, and is falsy when empty. A truncated answer always says so.

⚡ Fast enough to use (#321)

get_symbol_table() on a 970k-node graph went from 73,669 round trips and 382s to 12 round trips and about 10s; locate for 40 positions runs in about 50ms on either graph generation.

🔧 Fixed along the way (#320, #324, #328, #329)

analysis_level= now actually reaches the analyzer — the local backend had always run at level 1. Neo4j statements no longer leak across applications sharing a database, and call-graph walks no longer route through an external ghost node. The release workflow's test gate is live again, having silently passed on red since v1.5.0.

Known limitation: reaches, backward_cone and get_call_graph(roots=) need Neo4j server 5.9+ (quantified path patterns). Every other accessor runs on any 5.x, and the check is per accessor, so an older server keeps serving the rest.

Upgrade

pip install --pre -U "cldk==2.0.0rc2"
pip install --pre -U "cldk[neo4j]==2.0.0rc2"   # read-only Neo4j backend

Links: GitHub release · CHANGELOG · Agent API reference · Epic