// Use when you need to understand the Pyre or Pysa codebase architecture, find where specific functionality is implemented, or navigate the source directory structure. Use when working on OCaml code, debugging type checking or taint analysis issues, or exploring the codebase.
Use when creating commits or diffs to apply the correct title prefix, reviewer, and test plan based on the area of the codebase being changed.
Use when debugging a Pysa false negative (missing taint issue), comparing two Pysa output directories, or finding where taint flow is lost.
Use when running, debugging, updating, or creating Pysa end-to-end integration tests. Use when taint analysis tests fail, when expected output files need updating, or when working with .models, .cg, .hofcg, .overrides files under `source/interprocedural_analyses/taint/test/integration`.
Use when reading, writing, or debugging Pysa JSON model output (.models files). Use when working with taint models that describe sources, sinks, TITO, sanitizers, or issues in JSON format.
| name | architecture |
| description | Use when you need to understand the Pyre or Pysa codebase architecture, find where specific functionality is implemented, or navigate the source directory structure. Use when working on OCaml code, debugging type checking or taint analysis issues, or exploring the codebase. |
| oncalls | ["pysa"] |
client/): Reads .pyre_configuration, determines flags, shells out to pyre.binsource/main.ml): Routes to Check, Analyze (Pysa), Infer, Server, CodeNavigation, or NoDaemonQuerysource/menhir_parser/, source/cpython_parser/): Python source -> AST (source/ast/)source/analysis/): Populates global type environment in parallel. All sources added at once (not recursively following imports). Builds a layered environment chain: UnannotatedGlobalEnvironment -> ClassHierarchyEnvironment -> TypeAliasEnvironment -> AnnotatedGlobalEnvironment -> FunctionDefinitionEnvironment -> ErrorsEnvironment -> TypeEnvironmentsource/analysis/typeCheck.ml): Each function checked in parallel via control flow graph. Propagates parameter types through function body, checks compatibility at each operation. Never goes beyond function call boundaries.source/interprocedural_analyses/taint/taintAnalysis.ml): Main entrypoint of the analysis, runs the different analysis stepssource/interprocedural/pyrePysaApi.ml): Provides an API to query a type checker (pyre or pyrefly)source/interprocedural/classHierarchyGraph.ml): Builds a class hierarchy graphsource/interprocedural/callablesSharedMemory.ml): Builds a mapping from callables (functions and methods) to their AST and signaturesource/interprocedural/callGraph.ml): Defines call graph data structuressource/interprocedural/callGraphBuilder.ml): Builds call graphs for all callablessource/interprocedural_analyses/taint/modelParser.ml): Parses .pysa model filessource/interprocedural_analyses/taint/forwardAnalysis.ml): Tracks taint from sourcessource/interprocedural_analyses/taint/backwardAnalysis.ml): Tracks taint to sinkssource/interprocedural_analyses/taint/taintConfiguration.ml): Defines rules connecting sources to sinkssource/interprocedural/fixpointAnalysis.ml): Implements a global fixpoint over callablessource/interprocedural_analyses/taint/model.ml): Defines a summary of the taint behavior of a function, inferred during analysissource/ast/: Python AST representation (Expression, Statement, Source, Location, Reference)source/analysis/: Core type checker: type representation (type.ml), CFG, fixpoint, preprocessing, environments, type order, class hierarchysource/interprocedural/: Interprocedural framework: call graph, dependency graph, override graph, fixpointsource/interprocedural_analyses/taint/: Pysa taint analysis: sources, sinks, domains, models, rules, reportingsource/interprocedural_analyses/type_inference/: Interprocedural type inferencesource/server/: Pyre daemon for incremental analysissource/code_navigation_server/: IDE code navigation serversource/command/: OCaml CLI command implementationssource/buck_command/: Buck-specific commandssource/buck_integration/: Buck build system integrationsource/service/: Shared memory management, schedulingsource/domains/: Abstract domain library (lattices for interprocedural analyses)source/hack_parallel/: Shared memory and multi-worker infrastructure (forked from Hack)source/saved_state/: Serialization for incremental analysisclient/: Python CLI (pyre command)client/commands/: All user-facing commands (check, analyze, start, stop, infer, query, etc.)client/configuration/: .pyre_configuration file parsingclient/language_server/: LSP protocol implementationapi/: Programmatic Python API for Pyre serverpyre_extensions/: Runtime Python helpers (none_throws, safe_cast, etc.)tools/generate_taint_models/: Auto-generation of Pysa taint modelstools/typeshed_patcher/: Applies patches to bundled typeshed stubsstubs/: Bundled typeshed with patching mechanismfacebook/: Meta-internal code (not open-sourced)show, eq, compare, to_yojson via PPX derivers. For a type Module.t, Module.show gives a debug string.Log.dump "format %s" value and run with pyre --noninteractive checkpyre_dump(), pyre_dump_cfg(), pyre_dump_locations(), and reveal_type(x) to inspect Pyre's state