Code Analysis Language Capabilities

Code Analysis language capabilities

Snapshot: 7 November 2026. In Labs, validated in Draft, and unsupported are distinct states. A Draft result is not approval, merge, release or installation.

Shared Labs: bf0a29e7664f52973d06a8e6a608df2db1ecbd39. Current investigation candidate: Draft #1252, 93378351dc97768fd7e0882a50f32ecc7a34e2a6. It retains #1250, the original A1/A2 contributor commits and previous language contributions. The collaboration overview records original contributors and separately owned work. Those PRs remain unchanged.

Language / capability	In Labs	Validated in Draft	Unsupported / remaining boundary
JavaScript / TypeScript source dependencies, definitions and complexity	Yes, source analysis; one language adapter per run	Runtime/package-condition corrections, lexical direct-call navigation and paired investigation in #1235/#1244/#1252 ancestry	Dynamic/member dispatch, macro-like/generated/runtime identity and complete impact are not established by lexical facts. See call evidence and combined evidence.
Python source dependencies and function analysis	Yes	Conservative call evidence and paired definitions; #1252 additionally validates unique preceding function-local from-imports	Decorated/duplicate/reexported targets, closure/global/conditional bindings, member/dynamic calls retain unknowns. Fixed Click/Jinja versions, commands, source/ZIP comparison.
Java dependencies and method/constructor analysis	Yes, original Java adapter by CheeseMiao0520	Unicode/type namespaces, conservative explicit static calls and paired definitions	Overload applicability/compiler attribution, inheritance, virtual/interface dispatch, generated sources and runtime loading remain outside the bounded resolver. Java fixed-source evidence.
Go normal CLI, packages/functions, direct source calls and changed-definition callers	No	Draft #1256: root module, build/test scope, exact declaration ranges, ordinary/alias/same-package direct functions and paired known callers; source/ZIP verified. Fixed cases and limits.	External types/full compilation, methods/interfaces/function variables, struct/field definitions, workspaces/replace/vendor/nested modules/cgo/generated build output and complete impact remain unsupported.
Rust normal CLI, modules/crates, direct calls and changed-definition callers	No	No implementation validation yet. #1255 freezes the baseline only	--language rust returns extract/adapter-unknown, exit 2 on all four frozen project/version runs. Cargo workspace, features/cfg, macro/trait and source/ZIP acceptance remain pending.

Go and Rust source-first investigation

Fixed manifest and source excerpts · Baseline commands, outputs and exits · Scope and acceptance queue.

Answers froze at 580b50393 before the eight unchanged CLI runs at b37f67c49. Each source file is hashed. These are selected source cases, not whole-project accuracy or a blind evaluation.

Language	Fixed real projects	First developer question	Remaining unknown
Go	Cobra 41fd44e1df83ad6acd8e14b304d5f2a2ae1d62f5 → e392f3204db0445f1f4ad47448b04d8c8ad04c2a; Chi 67be7d9cafdaeb4e04e887ff78d09e030ee43b00 → 71307f9b7e4e9527638bc951c42b782cd1560331	In Cobra, follow doc_test.ExampleGenMan → doc.GenMan → fillHeader across the real upstream DisableAutoGenTag change. Chi reserves ordinary root-package calls and presenter import aliases.	Interface calls such as io.Writer.Write and next.ServeHTTP must not pick arbitrary implementations. Build tags, platform, nested modules, test/external-test packages and ignored examples need explicit coverage.
Rust	regex f871a8eb1d725a8aaa56e2ceea57c24fce74b5fd → 9870c06e6c772daaad7ab612faab29130753e41c; serde_json d2fce19685bf0e3d493a9d785665137654c79e6d → 4d4f53c3b7de3259b6a8a15ef4d5f4edb47af32f	In regex, follow lib.rs → unicode::is_word_character across its implementation change; then test the workspace regex → regex-syntax call and function-local use ... as write in regex-automata. serde_json reserves the changed algorithm::fast_path via a wildcard import.	The older regex layout lacks the newer root wrapper/alias cases; these are head-only checks. float_roundtrip gates serde_json's lexical module. Trait dispatch, macros, feature/cfg alternatives and build output require separate evidence.

Chi and serde_json were partly source-inspected to establish answers. Their reserved questions are held out from initial implementation tuning, with this exposure disclosed. Go 1.27.2 and rustc/cargo 1.89.0 are present locally; rust-analyzer is not installed in the selected official toolchain. No extra toolchain was installed for this baseline.

Reproduce the current unsupported baseline with node archify/bin/archify.mjs code-analysis check <fixed-checkout> --language go --fail-on never --json --out <output>, substituting rust for Rust. Expect exit 2, not a successful empty analysis. Development proceeds Go first, then Rust, with wrong targets prioritized before deterministic coverage expansion.

Local baseline CLI evidence is recorded above. Implementation tests, full source/ZIP acceptance and new head CI remain pending; #1252's remote run is failed overall despite several passing checks. No PR was approved or merged, and no release/live installation occurred.

Baseline package follow-up: at #1255 head b7338e0b1, all eight extracted-ZIP invocations reproduce the same JSON diagnostics and exit 2 as source. The manifest was regenerated byte-identically. This is verified rejection parity; Go/Rust implementation acceptance remains pending. Existing parser dependencies were installed only in the isolated extracted package; no new toolchain or live installation. New head CI is tracked separately on the Draft.

Go follow-up: Draft validation and source-oracle correction. The initial Chi presenter alias expectation was inconsistent with its nested module declaration and is retained as an explicit oracle correction. A valid real grpc alias is separately supplemental. Baseline #1255 rejection results remain historical; they do not describe #1256. Rust implementation remains pending.