Skip to content

fix(python): args regex only balanced one level of nested parens - #1547

Merged
squid-protocol merged 3 commits into
mainfrom
fix/python-1527-nested-paren-depth
Aug 14, 2026
Merged

fix(python): args regex only balanced one level of nested parens#1547
squid-protocol merged 3 commits into
mainfrom
fix/python-1527-nested-paren-depth

Conversation

@squid-protocol

Copy link
Copy Markdown
Owner

Fixes #1527.

Summary

Python's args rule's parameter-list capture group \((?:[^()]|\([^()]*\))*\) balances exactly one level of nested parens (outer paren + one inner non-nested group). A default value with two levels of nested calls -- FastAPI's dependency-injection idiom Depends(partial(callable_gen_dependency, "x")) -- doesn't match at all, so the whole def statement is skipped by the args regex and args_count silently defaults to 0.

Fix extends the existing bounded-recursion idiom by one more level (still no unbounded backtracking -- same ReDoS-safety tradeoff already established for this rule, just one level deeper). Confirmed 12 occurrences of this exact shape in language-crucible/data/python/fastapi/tests/test_dependency_partial.py.

Numbers

args_exact_match: 3588 -> 3601 (python corpus). No other metric changed -- purely additive fix.

Test plan

  • pytest tests/extraction/languages/test_python.py tests/extraction/languages/test_python_strict.py -- 153 passed
  • Pathological-input timing probes (unbalanced/deeply-nested parens up to depth 160, 40k-char unbalanced string) -- all sub-3ms, no ReDoS regression
  • tree_sitter_accuracy_audit.py --all --ci -- clean across all 31 languages
  • crucible_check.py --mode both -- PASS/PASS
  • audit_check.py --ci -- all clear

🤖 Generated with Claude Code

squid-protocol and others added 3 commits August 13, 2026 22:58
#1527: python's args rule's parameter-list capture group
\((?:[^()]|\([^()]*\))*\) balances exactly one level of nested parens (outer
paren + one inner non-nested group). A default value with two levels of
nested calls -- FastAPI's dependency-injection idiom
Depends(partial(callable_gen_dependency, "x")) -- doesn't match at all, so
the whole def statement is skipped and args silently defaults to 0.

Extends the existing bounded-recursion idiom by one more level (still no
unbounded backtracking -- same ReDoS-safety tradeoff already established for
this rule, just deeper). Confirmed 12 occurrences of this exact shape in
language-crucible/data/python/fastapi/tests/test_dependency_partial.py.

args_exact_match: 3588 -> 3601 (python corpus), no other metric changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Rebased this branch onto the current main (after #1538/#1539/#1545 merged)
and regenerated the target's own tree-sitter baseline, both golden masters,
and the ruff line-shift baseline against the combined state. No additional
code change beyond the previous commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@squid-protocol
squid-protocol merged commit 9c37a6f into main Aug 14, 2026
27 checks passed
@squid-protocol
squid-protocol deleted the fix/python-1527-nested-paren-depth branch August 14, 2026 03:04
@github-actions

Copy link
Copy Markdown
Contributor

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

python's args regex only balances one level of nested parens, silently zeroing args for deeply-nested default values

1 participant