limitations.md

Current Limitations

Version 0.x is deliberately narrow:

• Node.js 20 or later;
• strongest static source analysis for TypeScript and JavaScript; TypeScript/JavaScript parser diagnostics fail closed instead of becoming a green check; Python support covers .py source ownership, AST-based import extraction, public symbols, public-surface hashes, selected Django/FastAPI/SQLAlchemy/Celery resource patterns, and common pyproject.toml, setup.cfg, and static setup.py package roots;
• one public entry per cell;
• repository-local cells only;
• file-path artifact lanes only;
• selected static resource access and imported runtime evidence only; dynamic dataflow, arbitrary runtime broker behavior, and live database schema drift are not inferred, but recognized dynamic HTTP URLs and known SQL receivers with non-static query arguments fail closed as unresolved resources;
• resource adapters are deliberately scoped: v0.x detects selected file, HTTP, queue, SQL, Prisma, TypeORM, Drizzle, BullMQ, KafkaJS, NestJS, Fastify, Django, FastAPI, SQLAlchemy, and Celery patterns, while unsupported libraries require a dedicated adapter or runtime evidence;
• external dependency policy covers npm package roots and Python import roots observed by the resolver; it is not a package-manager lockfile auditor;
• ownership overlap detection uses the same directory expansion for bare owned paths as source ownership and solves the supported glob dialect; unsupported glob syntax remains literal and suspicious multi-star segments are reported as manifest warnings;
• public symbol analysis supports common TypeScript forms, exported namespaces, and Python AST top-level declarations / literal __all__, not every possible dynamic export pattern. In Python, module-level imports are public attributes unless hidden by underscore aliases or constrained by __all__;
• TypeScript/JavaScript public surface hashes use isolated normalized declaration output when available and remain contract fingerprints, not full API-compatibility proofs; imported implementation details can still collapse to broad declaration types without a separate typecheck;
• computed dynamic imports and computed CommonJS require() calls cannot be resolved statically;
• createRequire preserves statically known filename and file-URL origins; unknown origins, assigned loader aliases, and loaders passed to unknown functions are reported as unresolved. HTTP URL constructors resolve both input and base, and string alternatives exceeding the 16-value analysis limit are unresolved rather than partially accepted;
• Python standard-library classification uses the inspector interpreter's sys.stdlib_module_names on Python 3.10 or later. Older interpreters without that metadata recognize builtin modules only; other imports remain subject to dependency policy;
• check --changed performs full head analysis, then compares stable finding fingerprints to report only newly introduced findings. Only clean base results without findings are cacheable; the key binds the base commit, engine and schema implementation, Node/TypeScript/Python runtime, policy inputs, and severity configuration. Absolute or repository-escaping policy paths and plugins without an explicit pluginCacheKey remain uncached;
• Markdown and SARIF output are report formats over the same deterministic findings, not separate analyzers;
• cellfence coverage reports unresolved analysis observations; it is not a proof that unsupported code paths are safe;
• the reusable GitHub Action is pre-release and invokes the published CLI through a version input; the checked-in default is the current exact package version, and required checks should keep it pinned to an exact published version;
• CellFence does not identify which particular agent wrote a changed file;
• CellFence does not prevent an agent from editing a path at runtime.

To enforce per-agent write permissions, combine CellFence with worktree isolation, filesystem or sandbox permissions, path-scoped task policy, and protected-branch CI.