feat(ssa): enhance SSA value finding and context variable detection

Improvements to SSA infrastructure for future pattern integration:

1. findSSAValue now handles multiple expression types:
   - FuncLit: finds MakeClosure instructions
   - Ident: traces variable declarations to find assigned values
   - CallExpr: finds SSA Call instructions
   - SelectorExpr: finds FieldAddr/Field instructions
   - IndexExpr: finds IndexAddr/Index/Lookup instructions

2. GetContextVars now includes FreeVars:
   - Captures context variables from enclosing scopes
   - Essential for nested closure analysis

3. findEnclosingFunc uses syntax range:
   - Uses full AST syntax range for position checking
   - Handles cases where GoStmt position precedes FuncLit position

Note: These improvements prepare the infrastructure for future migration
to SSA-based patterns. Current analyzer still uses AST-based checkers.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: mpyw

internal/patterns/pattern.go

@@ -25,33 +25,170 @@ func (c *CheckContext) Report(pos token.Pos, msg string) {
 }
 
 // findSSAValue finds the SSA value corresponding to an AST expression.
+// Handles: FuncLit, Ident, CallExpr, SelectorExpr, IndexExpr
 func (c *CheckContext) findSSAValue(fn *ssa.Function, expr ast.Expr) ssa.Value {
 	if fn == nil || fn.Blocks == nil {
 		return nil
 	}
 
-	pos := expr.Pos()
+	switch e := expr.(type) {
+	case *ast.FuncLit:
+		return c.findFuncLitValue(fn, e)
+	case *ast.Ident:
+		return c.findIdentValue(fn, e)
+	case *ast.CallExpr:
+		return c.findCallValue(fn, e)
+	case *ast.SelectorExpr:
+		return c.findSelectorValue(fn, e)
+	case *ast.IndexExpr:
+		return c.findIndexValue(fn, e)
+	default:
+		return c.findValueByPos(fn, expr.Pos())
+	}
+}
 
-	// Search through all instructions in the function
+// findFuncLitValue finds the MakeClosure instruction for a function literal.
+func (c *CheckContext) findFuncLitValue(fn *ssa.Function, lit *ast.FuncLit) ssa.Value {
+	pos := lit.Pos()
 	for _, block := range fn.Blocks {
 		for _, instr := range block.Instrs {
-			// Check if this instruction's position matches
-			if instr.Pos() == pos {
-				if val, ok := instr.(ssa.Value); ok {
-					return val
+			if mc, ok := instr.(*ssa.MakeClosure); ok {
+				if mc.Pos() == pos {
+					return mc
 				}
 			}
+		}
+	}
+	return nil
+}
+
+// findIdentValue finds the SSA value for an identifier (variable reference).
+// For `g.Go(fn)` where `fn := func() {}`, finds the MakeClosure assigned to fn.
+func (c *CheckContext) findIdentValue(fn *ssa.Function, ident *ast.Ident) ssa.Value {
+	obj := c.Pass.TypesInfo.ObjectOf(ident)
+	if obj == nil {
+		return nil
+	}
+
+	v, ok := obj.(*types.Var)
+	if !ok {
+		return nil
+	}
+
+	// Search for the value assigned to this variable
+	// In SSA, we look for instructions that define a value at the variable's declaration position
+	declPos := v.Pos()
 
-			// For MakeClosure, check the Fn position
+	for _, block := range fn.Blocks {
+		for _, instr := range block.Instrs {
+			// Check MakeClosure at declaration position
 			if mc, ok := instr.(*ssa.MakeClosure); ok {
-				if mc.Pos() == pos {
+				if mc.Pos() == declPos {
 					return mc
 				}
 			}
+			// Check Call result at declaration position
+			if call, ok := instr.(*ssa.Call); ok {
+				if call.Pos() == declPos {
+					return call
+				}
+			}
+			// Check any value-producing instruction at declaration position
+			if val, ok := instr.(ssa.Value); ok {
+				if instr.Pos() == declPos {
+					return val
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+// findCallValue finds the SSA Call instruction for a call expression.
+func (c *CheckContext) findCallValue(fn *ssa.Function, call *ast.CallExpr) ssa.Value {
+	pos := call.Pos()
+	// Try Fun position for method calls
+	funPos := call.Fun.Pos()
+
+	for _, block := range fn.Blocks {
+		for _, instr := range block.Instrs {
+			if ssaCall, ok := instr.(*ssa.Call); ok {
+				if ssaCall.Pos() == pos || ssaCall.Pos() == funPos {
+					return ssaCall
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// findSelectorValue finds the SSA value for a selector expression (field access).
+func (c *CheckContext) findSelectorValue(fn *ssa.Function, sel *ast.SelectorExpr) ssa.Value {
+	pos := sel.Pos()
+	selPos := sel.Sel.Pos()
+
+	for _, block := range fn.Blocks {
+		for _, instr := range block.Instrs {
+			// Check FieldAddr
+			if fa, ok := instr.(*ssa.FieldAddr); ok {
+				if fa.Pos() == pos || fa.Pos() == selPos {
+					return fa
+				}
+			}
+			// Check Field (for value types)
+			if f, ok := instr.(*ssa.Field); ok {
+				if f.Pos() == pos || f.Pos() == selPos {
+					return f
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// findIndexValue finds the SSA value for an index expression.
+func (c *CheckContext) findIndexValue(fn *ssa.Function, idx *ast.IndexExpr) ssa.Value {
+	pos := idx.Pos()
+
+	for _, block := range fn.Blocks {
+		for _, instr := range block.Instrs {
+			// Check IndexAddr
+			if ia, ok := instr.(*ssa.IndexAddr); ok {
+				if ia.Pos() == pos {
+					return ia
+				}
+			}
+			// Check Index (for value types)
+			if i, ok := instr.(*ssa.Index); ok {
+				if i.Pos() == pos {
+					return i
+				}
+			}
+			// Check Lookup (for maps)
+			if l, ok := instr.(*ssa.Lookup); ok {
+				if l.Pos() == pos {
+					return l
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// findValueByPos finds any SSA value at the given position (fallback).
+func (c *CheckContext) findValueByPos(fn *ssa.Function, pos token.Pos) ssa.Value {
+	for _, block := range fn.Blocks {
+		for _, instr := range block.Instrs {
+			if instr.Pos() == pos {
+				if val, ok := instr.(ssa.Value); ok {
+					return val
+				}
+			}
 		}
 	}
 
-	// Also check parameters and free variables
+	// Check parameters
 	for _, param := range fn.Params {
 		if param.Pos() == pos {
 			return param

internal/ssa/builder.go

@@ -60,7 +60,14 @@ func (p *Program) EnclosingFunc(pos ast.Node) *ssa.Function {
 func (p *Program) findEnclosingFunc(fn *ssa.Function, pos ast.Node) *ssa.Function {
 	// Check anonymous functions defined within this function
 	for _, anon := range fn.AnonFuncs {
-		if anon.Pos() <= pos.Pos() && pos.End() <= anon.Syntax().End() {
+		syntax := anon.Syntax()
+		if syntax == nil {
+			continue
+		}
+		// Use the syntax's full range, not just anon.Pos()
+		// anon.Pos() is the position of 'func' keyword, but for GoStmt
+		// the position is the 'go' keyword which comes before 'func'
+		if syntax.Pos() <= pos.Pos() && pos.End() <= syntax.End() {
 			// Recursively check nested functions
 			return p.findEnclosingFunc(anon, pos)
 		}

internal/ssa/tracer.go

@@ -307,13 +307,15 @@ func isContextType(t types.Type) bool {
 	return obj.Pkg() != nil && obj.Pkg().Path() == "context" && obj.Name() == "Context"
 }
 
-// GetContextVars returns all context.Context variables from function parameters.
+// GetContextVars returns all context.Context variables available in a function.
+// This includes both parameters and captured variables (FreeVars) from enclosing scopes.
 func GetContextVars(fn *ssa.Function) []*types.Var {
 	var ctxVars []*types.Var
 	if fn == nil {
 		return ctxVars
 	}
 
+	// Check parameters
 	sig := fn.Signature
 	params := sig.Params()
 	for i := 0; i < params.Len(); i++ {
@@ -323,5 +325,19 @@ func GetContextVars(fn *ssa.Function) []*types.Var {
 		}
 	}
 
+	// Check captured variables (FreeVars) from enclosing scopes
+	for _, fv := range fn.FreeVars {
+		if isContextType(fv.Type()) {
+			// FreeVar doesn't have an underlying types.Var directly accessible,
+			// but we can create a synthetic Var for matching purposes.
+			// The package is derived from the parent function.
+			var pkg *types.Package
+			if fn.Pkg != nil {
+				pkg = fn.Pkg.Pkg
+			}
+			ctxVars = append(ctxVars, types.NewVar(fv.Pos(), pkg, fv.Name(), fv.Type()))
+		}
+	}
+
 	return ctxVars
 }