Fix loose sibling module import resolution

[hopstreax]

Summary

Fixes #3430.

Plain Python imports such as import greeter followed by greeter.greet() were silently losing their calls edges when the importing file lived below the scan root in a directory without __init__.py.

The import edge targeted the bare module ID (greeter) while the extracted file node used the scan-root-relative ID (scripts_greeter). Because the package import repointing pass intentionally skips non-package directories, the member-call resolver could not match the imported module.

What changed

• Added a directory-local _repoint_python_sibling_imports() pass.
• Resolves unambiguous sibling .py/.pyi modules within the importing file's directory.
• Restricts candidates to files in the extracted corpus.
• Preserves package isolation and avoids global basename aliasing.
• Preserves local_alias for aliased imports such as import greeter as g.
• Runs the sibling repoint before Python member-call resolution.

Tests

Added regression coverage for:

• Loose sibling import module + module.func() resolution.
• Scan-root parity.
• Same-named modules in separate loose directories.
• Package/PEP 328 isolation.
• Cross-directory leakage prevention.
• Aliased sibling imports.

Verified with:

• pytest tests/test_loose_sibling_import_resolution.py
• pytest tests/test_src_layout_import_resolution.py tests/test_python_import_resolution.py
• pytest tests/test_language_resolvers.py -k "python"

All tests pass.

[graphify-labs]

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Formal verification. No changes could be formally verified in this run.

---

Graphify review — findings

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 1859 functions depend on the 255 functions this change touches.

Health — this change adds coupling hotspots:

• new: extract() — 566 callers, 44 callees
• new: _rebuild_code() — 115 callers, 51 callees
• new: extract_js() — 85 callers, 4 callees
• new: extract_xaml() — 19 callers, 17 callees
• new: dispatch_command() — 2 callers, 124 callees
• new: _get_extractor() — 26 callers, 6 callees
• new: run_pipeline() — 8 callers, 13 callees
• new: collect_files() — 17 callers, 6 callees
• …and 29 more — each is listed as a finding

Verification — 1859 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 1694 function(s) in the blast radius were not formally verified this run

Test selection

Test selection

103 of 260 test file(s) selected (40%) via static blast radius.

• tests/test_astro_extraction.py — impact
• tests/test_astro_import_ids.py — impact
• tests/test_build.py — impact
• tests/test_builtin_global_type_refs.py — impact
• tests/test_case_sensitive_resolution.py — impact
• tests/test_cjs_module_extension.py — impact
• tests/test_cpp_nested_and_cli.py — impact
• tests/test_cpp_objc_cross_file_calls.py — impact
• tests/test_cross_extension_reexport_self_cycle.py — impact
• tests/test_cross_language_call_resolution.py — impact
• tests/test_cross_repo_member_calls.py — impact
• tests/test_csharp_call_site_generic_args.py — impact
• tests/test_csharp_enum_members.py — impact
• tests/test_csharp_field_generic_args.py — impact
• tests/test_csharp_interface_dispatch.py — impact
• tests/test_csharp_member_calls.py — impact
• tests/test_csharp_member_nodes.py — impact
• tests/test_csharp_object_creation.py — impact
• tests/test_csharp_partial_classes.py — impact
• tests/test_csharp_type_resolution.py — impact
• tests/test_definition_file_portability.py — impact
• tests/test_detect.py — impact
• tests/test_dotnet.py — impact
• tests/test_duplicate_annotation_edges.py — impact
• tests/test_extract.py — impact
• tests/test_extract_cache_location.py — impact
• tests/test_file_label_disambiguation.py — impact
• tests/test_file_node_id_spec.py — impact
• tests/test_forwarding_review_findings.py — impact
• tests/test_go_builtin_call_targets.py — impact
• tests/test_go_qualified_resolution.py — impact
• tests/test_import_extension_resolution.py — impact
• tests/test_import_self_loops.py — impact
• tests/test_imported_export_forwarding.py — impact
• tests/test_incremental.py — impact
• tests/test_indirect_call_arrow_single_param_shadow.py — impact
• tests/test_indirect_call_catch_binding_shadow.py — impact
• tests/test_indirect_call_external_import_shadow.py — impact
• tests/test_indirect_call_for_of_binding_shadow.py — impact
• tests/test_indirect_call_function_expression_shadow.py — impact
• tests/test_indirect_call_nested_closure_shadow.py — impact
• tests/test_indirect_dispatch.py — impact
• tests/test_indirect_dispatch_assign_return.py — impact
• tests/test_indirect_dispatch_getattr.py — impact
• tests/test_inferred_confidence_rubric.py — impact
• tests/test_inherited_field_receivers.py — impact
• tests/test_java_member_calls.py — impact
• tests/test_java_type_resolution.py — impact
• tests/test_js_callback_calls.py — impact
• tests/test_js_dynamic_import_affected.py — impact
• … and 53 more

Selection is safe under the controlled-regression assumption; always-run tests + a periodic full run are the backstops. Advisory — it never changes the check verdict.

Formal verification

Could not verify: Could not verify extract.

The verifier did not have enough to check extract, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: parameter `cache_root` is annotated `Path | None` — outside the synthesizable primitive/collection set

· 1 grounded finding(s) anchored inline below; 36 more finding(s) on lines outside this diff (see the check run).

[graphify-labs]

⚠️ Health regression — _repoint_python_sibling_imports()

high coupling complexity (Ca·Ce = 12).

Grounded coupling-delta finding (deterministic), not an LLM guess.