Skip to main content

6. Dependency Intelligence

Batho's dependency subsystem resolves and indexes third-party and standard-library dependencies across 40+ languages. It populates the scope manager with resolved symbols, enabling cross-file reference resolution and external symbol entity creation. As of v1.4.0, stdlib symbol tables cover 27 languages and live introspection supports five package ecosystems (Python, npm, Cargo, Go modules, and Maven).

6.1 Indexing Pipeline​

The dependency indexer orchestrates a five-stage pipeline that transforms raw manifest files into a fully populated scope manager:

Figure 29: Dependency Indexing Pipeline — Five-stage flow from manifest discovery through scope manager population.

Pipeline Statistics​

Pipeline statistics track metrics throughout the process:

MetricDescription
manifests_foundNumber of manifest files detected
deps_declaredTotal dependencies parsed from manifests
deps_cachedDependencies resolved from cache (no introspection needed)
deps_introspectedDependencies resolved via live introspection
symbols_indexedTotal symbols added to ScopeManager
stdlib_modules_indexedStandard library modules indexed
duration_msTotal pipeline execution time
errorsNon-fatal errors encountered

6.2 Manifest Parser​

The manifest parser detects and parses dependency manifest files across seven package ecosystems:

EcosystemManifest FilesPackage Manager
Pythonrequirements*.txt, pyproject.toml, Pipfilepip, poetry, setuptools
JavaScript/TypeScriptpackage.jsonnpm, yarn, pnpm
RustCargo.tomlcargo
Gogo.modgo modules
Java (JVM)build.gradle, pom.xmlgradle, maven

DependencySpec​

Each parsed dependency is returned as a structured specification:

FieldTypeExample
namestr"requests", "express", "tokio"
version_specstr">=2.28.0", "^1.2.3", "*"
managerPackageManagerPIP, NPM, CARGO, GO, GRADLE, MAVEN
languagestr"python", "javascript", "rust", "go", "java"
source_filestrRelative path to the manifest file

The parser uses pre-compiled regex patterns for each manifest format, ensuring high throughput on large monorepos with many manifest files.


6.3 Standard Library Symbol Tables​

Batho ships with curated, static symbol tables for standard libraries that ship with each language runtime. These are bundled directly with Batho and require no network access. As of v1.4.0, stdlib tables cover 27 languages.

LanguageModules CoveredExample Symbols
Pythonjson, os, os.path, pathlib, re, datetime, sys, typing, collections, math, time, threading, subprocess, loggingdumps, Path, compile, Thread
JavaScriptfs, path, http, https, crypto, stream, events, os, util, processreadFile, join, createServer
TypeScriptfs, path, http, crypto, stream, eventsreadFile, join, createServer
Gofmt, strings, io, net/http, encoding/json, os, timePrintln, Reader, HandleFunc
Ruststd::collections, std::io, std::fs, std::pathHashMap, Read, PathBuf
Cstdio, stdlib, string, math, timeprintf, malloc, strcpy
C++std::vector, std::string, std::map, std::iostream, std::algorithmvector, string, sort
Javajava.util, java.io, java.netList, InputStream, Socket
RubyEnumerable, File, Dir, JSON, Net::HTTPeach, open, parse
C#System, System.IO, System.Collections, System.NetConsole, File, List
PHPstdClass, array, string, json, curljson_encode, curl_init
Kotlinkotlin.collections, kotlin.io, kotlin.textlistOf, println, split
SwiftFoundation, Swift, Dispatch, CombineURL, Data, Task
Scalascala.collection, scala.io, scala.utilList, Map, Try
Dartdart:core, dart:io, dart:convert, dart:asyncList, File, jsonDecode
HaskellPrelude, Data.List, Data.Map, System.IOmap, filter, foldr
Luatable, string, math, io, osinsert, format, open
Rbase, stats, utils, graphicsc, mean, plot
Perlstrict, warnings, File::Spec, JSONbless, catfile
JuliaBase, Stdlib, LinearAlgebra, Datespush!, length, Date
Zigstd, std.mem, std.io, std.fsalloc, print, open
Bashbuiltin, test, read, echoecho, read, test
Objective-CFoundation, UIKit, CoreFoundationNSObject, NSString
Erlangerlang, lists, io, oslength, foreach, format
OCamlStdlib, List, Map, Stringmap, fold, length
HackHH\\Lib\\C, HH\\Lib\\Str, HH\\Lib\\Vecmap, filter, length
Verilog$display, $finish, $monitordisplay, finish

Languages with lighter stdlib coverage (e.g. Bash, Verilog) register their built-in functions and pragmas so that imports are tracked even when full module hierarchies are not applicable.


The popular packages database is a bundled catalog covering the top third-party packages across five ecosystems. It uses set-based lookup for O(1) performance and caches package name sets in memory.

  • Singleton pattern: Avoids reloading the catalog across multiple indexer invocations.
  • Configurable path: Can be overridden via the BATHO_POPULAR_PACKAGES_PATH environment variable.
  • Default location: Bundled with Batho's built-in data files.

When a declared dependency is found in the popular packages database, its symbols are loaded from the curated set without requiring live introspection, significantly reducing indexing time for common packages.


6.5 Third-Party Introspector​

The third-party introspector performs live introspection of installed third-party packages across five package ecosystems. It is subprocess-isolated to maintain Batho's zero-code-execution guarantee on untrusted code — the introspected packages are the developer's own installed dependencies, not the analyzed source code.

Supported Ecosystems​

EcosystemIntrospectorSourceMethod
Pythonintrospect_pythonActive virtual environmentdir() + inspect in subprocess
npmintrospect_npmnode_modules/ directoryParse package.json exports + require() probe
Cargointrospect_crateCargo registry cache (~/.cargo/registry/)Parse crate metadata and public API
Gointrospect_go_moduleGo module cache (~/go/pkg/mod/)Parse exported declarations from module source
Mavenintrospect_jarMaven local repo (~/.m2/repository/)Parse JAR class entries via jar/unzip listing

Python Introspection Modes​

ModeBehaviorUse Case
shallowLists public symbols via dir() + inspectFast indexing, default mode
deepRecursively inspects classes and module hierarchyComprehensive symbol extraction

Safety guarantees:

  • Runs in a subprocess with a timeout (default: 5 seconds).
  • Uses a pre-compiled script template injected with the package name.
  • Extracts only public symbols (filters _-prefixed names).
  • All package/module/crate names are validated with _is_safe_dependency_name before any filesystem path is constructed, preventing traversal attacks outside the package cache.
  • Reports failures as non-fatal errors; unresolved packages are tagged as unresolved: in the graph.

6.6 Resolution Cache​

The resolution cache provides a flat-file msgpack cache for indexed dependency symbols, avoiding redundant introspection on subsequent builds.

PropertyValue
KeySHA-256 hash of (package_name, version, manager)
Formatmsgpack flat-file under .batho/cache/dep/
Indexdep_manifests.idx — manifest-level metadata index
Thread safetyRLock for concurrent access
TTL90 days (configurable)

The cache is checked before live introspection. On cache hit, symbols are loaded directly from the msgpack file, reducing indexing time by 80–95% for repositories with stable dependencies.