synapse-callgraph

Overview ¶

Command synapse-callgraph builds a general first-party call graph from Go source (via go/ssa) and emits it as the taintcallgraph wire JSON on stdout. It isolates the heavy go/ssa analysis (golang.org/x/tools) into a standalone, sandboxable binary so the api server never imports x/tools and the UNTRUSTED target is compiled ONLY inside the sandbox the taintcallgraph adapter runs this binary under. Composition root only – the analysis lives in internal/infrastructure/tools/ssacallgraph.