code-mapper-skill

The mapper combines:

• Grimp: module imports, transitive blast radius, and cycles.
• Jedi: references for a requested function or class.
• AST scanner: files, tables, models, configuration, HTTP, events, processes, and CodeQL trigger evidence.
• Contract parsers: OpenAPI/Swagger, AsyncAPI, GraphQL, Protobuf, JSON Schema, Avro, Pact, and Backstage.
• OpenLineage-compatible output: static input/output datasets.
• CodeQL: targeted local value flow and local taint flow when policy selects it.

Analyze the target repository statically. Do not import or execute target modules. Never install dependencies, clone or refresh repositories, download CodeQL packs, or select a persistent cache location automatically.

Require an explicit work root. Use the active session's .codex-bootstrap\code-mapper for Codex or .claude-bootstrap\code-mapper for Claude Code. Keep every report, parser cache, and optional CodeQL artifact below that root. Use a local target path from the harness-approved Git workflow; refuse Git URLs.

Command

python scripts/blast_radius.py <local-target> <file.py> --work-root <session-bootstrap> \
  [--function NAME] [--package NAME] [--subdir DIR] \
  [--codeql off|existing|auto|build] \
  [--codeql-intent mapping|value-flow|security|deep] \
  [--codeql-max-build-seconds N] \
  [--codeql-max-db-mb N] \
  [--codeql-max-query-seconds N] \
  [--allow-codeql-write]

Use this as the only mapper entrypoint. It emits one UTF-8 JSON graph to stdout and writes the same graph to code-map.json below the explicit work root. OpenLineage events and internal caches are written there too.

Run python scripts/bootstrap_env.py as a read-only preflight. Provision the exact pins in scripts/requirements.txt through an explicitly approved C:\Tools\code-mapper runtime or session-local virtual environment. The preflight never runs pip.

CodeQL modes

Repository size alone never triggers a build. Query value and database-build value are scored separately. Semantic triggers include unresolved or transformed sink arguments, parameters reaching sinks, ambiguous file modes, dynamic SQL, unresolved configuration, complex sink functions, high-value unresolved sinks, and explicit semantic intent.

Obtain explicit user authorization before adding --allow-codeql-write. Database creation requires CodeQL 2.16.4 or newer and uses --build-mode=none. Default budgets are 60 seconds for database creation, 1 GB for database size, and 5 seconds for a query. Missing CodeQL, absent setup, unsupported versions, failures, and timeouts preserve the Grimp/Jedi/AST/contract map.

Outputs

The graph includes:

• structural import dependencies and cycles;
• symbol references for --function;
• artifact, API, event, model, process, and contract edges;
• contract and Backstage records;
• OpenLineage event count;
• CodeQL decision, build/query diagnostics, and semantic edges;
• source fingerprints, cache statistics, and scanner errors.

Testing

python -m unittest -v smoke_test test_safety test_codeql_policy test_codeql_runtime test_codeql_cli
python scripts/benchmark_codeql_overhead.py --runs 15
python -m unittest -v test_codeql_live

The live test skips when CodeQL is absent. CI installs the official CLI and performs database creation, query compilation/execution, BQRS decoding, and semantic-edge assertions.

See references/codeql-adversarial-review.md, references/codeql-verification.md, and references/codeql-benchmark-results.md.