Skip to content

analysis-limitations.md

Latest commit

 

History

History
54 lines (43 loc) · 3.38 KB

analysis-limitations.md

File metadata and controls

54 lines (43 loc) · 3.38 KB
Raw

Static Analysis Limitations & Boundaries

RepoDNA performs purely static syntax and structural analysis without executing repository code. This design prioritizes speed and security, but entails honest boundaries regarding dynamic runtime features.

Known Boundaries

1. Dynamic Imports & Reflection

  • What is detected: Static import statements (import foo from 'bar', from app.services import UserService, require('./routes')).
  • Limitation: Imports constructed dynamically at runtime (e.g. import(dynamicModulePath) or __import__(var_name)) cannot be statically resolved to a deterministic target file.
  • Diagnostic: Reported under diagnostics as UNRESOLVED_DYNAMIC_IMPORT.

2. Runtime Dependency Injection & Metaprogramming

  • What is detected: Explicit decorator injection (@router.get('/'), Depends(get_db)), class constructors, and standard module exports.
  • Limitation: Dynamic container bindings (e.g. runtime IoC factories that dynamically bind interface symbols based on environment variables) are grouped with lower heuristic confidence.

3. Dynamic Route Generation

  • What is detected: Declarative route definitions (FastAPI @router.get, Express router.post, Flask @app.route, Next.js App/Pages Router file paths).
  • Limitation: Routes generated through programmatic runtime loops (e.g. for route in database_routes: app.add_url_rule(route)) are not statically enumerated.

4. Heuristic Call Graph Edges

  • Confidence Model:
    • 1.00: Same file / same class exact resolution.
    • 0.95: Direct named import resolution (import { UserService } from './user').
    • 0.80: Repository-unique symbol resolution.
    • 0.55: Heuristic name matching across modules.

5. Large repositories and bounded graph rendering

  • What is detected: Public durable analyses inventory the repository first and use Git tree acquisition when GitHub's repository-size hint reaches the large- repository threshold. The resulting artifact retains inventory counts, skipped-path reasons, coverage, and graph-compaction diagnostics.
  • Limitation: The v2 artifact and interactive canvas use explicit node/edge budgets so a dense repository does not freeze the browser. Compaction keeps high-signal structural entities and balanced relationship families, but the rendered graph is not a complete list of every source-level entity.
  • How to interpret it: Treat coverage, completeness, security.truncated, inventory.skippedByReason, and unresolved relationships as part of the result. RepoDNA reports omitted or uncertain material instead of drawing a complete- looking graph.

Why Pure Static Analysis?

Running untrusted repository code inside dynamic runtimes poses severe security and denial-of-service risks. By relying exclusively on deterministic static analysis, RepoDNA ensures:

  1. Safety: Zero risk of executing malicious payload scripts or crypto miners.
  2. Predictable work: Analysis is bounded by explicit file, byte, syntax-tree, and graph budgets. Small repositories often finish quickly; large or dense repositories can take longer and may produce a clearly marked partial graph.
  3. Portability: Local folders, ZIP files, and fallback analysis can run entirely in a standard browser. Public deep scans can also use the durable server workflow for larger repositories and cached, commit-addressed results.