Skip to content

Refactor: Consolidate Inspect/Outline analysis into the shared Visitor - #137

Closed
predictiple wants to merge 2 commits into
Velocidex:masterfrom
predictiple:inspect-consolidation
Closed

Refactor: Consolidate Inspect/Outline analysis into the shared Visitor#137
predictiple wants to merge 2 commits into
Velocidex:masterfrom
predictiple:inspect-consolidation

Conversation

@predictiple

Copy link
Copy Markdown
Contributor

Fold the duplicated AST descent logic from inspect.go and outline.go into the existing Visitor so the grammar is traversed by a single mechanism.

The Visitor now supports two additional format options:

  • AnalysisOnly: bypasses the copy/merge bookkeeping used by the formatter path so analysis state is collected exactly once on the original node graph.
  • CollectOutline: enables outline construction via an explicit stack that builds the Let/Query/Column/Function hierarchy. Function nodes are only emitted under column or expression contexts, so FROM, WHERE and GROUP BY clauses do not pollute the outline.

Source positions are recorded on CallSite (including per-argument positions) and DefinitionSite. The existing string-based Args field is retained unchanged, preserving backwards compatibility for consumers such as the launcher verifier.

Inspect() and Outline() are now thin wrappers that configure a Visitor, run a single traversal, and translate the collected state into their existing exported types; no caller-facing API changes. This removes roughly 410 lines of duplicated traversal code while keeping the full test suite (including the Velociraptor LSP integration tests) green.

Fold the duplicated AST descent logic from inspect.go and outline.go
into the existing Visitor so the grammar is traversed by a single
mechanism.

The Visitor now supports two additional format options:

- AnalysisOnly: bypasses the copy/merge bookkeeping used by the
  formatter path so analysis state is collected exactly once on the
  original node graph.
- CollectOutline: enables outline construction via an explicit stack
  that builds the Let/Query/Column/Function hierarchy. Function nodes
  are only emitted under column or expression contexts, so FROM, WHERE
  and GROUP BY clauses do not pollute the outline.

Source positions are recorded on CallSite (including per-argument
positions) and DefinitionSite. The existing string-based Args field is
retained unchanged, preserving backwards compatibility for consumers
such as the launcher verifier.

Inspect() and Outline() are now thin wrappers that configure a Visitor,
run a single traversal, and translate the collected state into their
existing exported types; no caller-facing API changes. This removes
roughly 410 lines of duplicated traversal code while keeping the full
test suite (including the Velociraptor LSP integration tests) green.
Reword comments flagged by the Vale spelling dictionaries: drop
possessive forms that the dictionaries do not cover, wrap the
`isExpression` identifier in backticks so it is treated as code, and
use the American spelling "behavior" in vfilter.go.

No functional changes.
@scudette scudette closed this Aug 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants