feat(ssa): add SSA-based deriver detection with IIFE/defer distinction

This commit adds SSA-based deriver function detection that:
- Traverses into immediately-invoked function expressions (IIFE)
- Distinguishes between regular calls and defer statements
- Reports a special error message when deriver is only in defer

Key changes:
- Add CheckDeriverCalls to SSA tracer with DeriverResult struct
- Update GoStmtPattern interface to return GoStmtResult with DeferOnly flag
- Add DeferMessage method for defer-specific error messages
- Former PARTIAL test cases now pass as GOOD (SSA detects IIFE correctly)

Behavioral changes:
- Deriver calls in IIFE are now correctly detected
- Deriver calls only in defer will report: "goroutine calls X in defer,
  but it should be called at goroutine start"

TODO: Add test case for defer-only scenario

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: mpyw

internal/checker/checker.go

@@ -106,8 +106,20 @@ func (c *Checker) checkGoStmt(cctx *patterns.CheckContext, stmt *ast.GoStmt, sco
 			continue
 		}
 
-		if !pattern.CheckGoStmt(cctx, stmt) {
-			msg := pattern.Message(scope.ctxName())
+		result := pattern.CheckGoStmt(cctx, stmt)
+		if result.OK {
+			continue
+		}
+
+		var msg string
+		if result.DeferOnly {
+			// Deriver found but only in defer - use special message
+			msg = pattern.DeferMessage(scope.ctxName())
+		} else {
+			msg = pattern.Message(scope.ctxName())
+		}
+
+		if msg != "" {
 			cctx.Pass.Reportf(stmt.Pos(), "%s", msg)
 		}
 	}

internal/patterns/gostmt.go

@@ -7,17 +7,29 @@ import (
 	"github.com/mpyw/goroutinectx/internal/directives/deriver"
 )
 
+// GoStmtResult represents the result of a go statement pattern check.
+type GoStmtResult struct {
+	// OK indicates the pattern is satisfied (no error).
+	OK bool
+	// DeferOnly indicates the deriver was found but only in defer statements.
+	// This is only relevant for deriver patterns.
+	DeferOnly bool
+}
+
 // GoStmtPattern defines the interface for go statement patterns.
 type GoStmtPattern interface {
 	// Name returns a human-readable name for the pattern.
 	Name() string
 
 	// CheckGoStmt checks if the pattern is satisfied for the given go statement.
-	// Returns true if the pattern is satisfied (no error).
-	CheckGoStmt(cctx *CheckContext, stmt *ast.GoStmt) bool
+	CheckGoStmt(cctx *CheckContext, stmt *ast.GoStmt) GoStmtResult
 
 	// Message returns the diagnostic message when the pattern is violated.
 	Message(ctxName string) string
+
+	// DeferMessage returns the diagnostic message when deriver is only in defer.
+	// Returns empty string if not applicable.
+	DeferMessage(ctxName string) string
 }
 
 // GoStmtCapturesCtx checks that a go statement's closure captures the outer context.
@@ -27,19 +39,19 @@ func (*GoStmtCapturesCtx) Name() string {
 	return "GoStmtCapturesCtx"
 }
 
-func (*GoStmtCapturesCtx) CheckGoStmt(cctx *CheckContext, stmt *ast.GoStmt) bool {
+func (*GoStmtCapturesCtx) CheckGoStmt(cctx *CheckContext, stmt *ast.GoStmt) GoStmtResult {
 	// If no context names in scope (from AST), nothing to check
 	if len(cctx.CtxNames) == 0 {
-		return true
+		return GoStmtResult{OK: true}
 	}
 
 	// Try SSA-based check first (more accurate, includes nested closures)
 	if result, ok := checkGoStmtFromSSA(cctx, stmt); ok {
-		return result
+		return GoStmtResult{OK: result}
 	}
 
 	// Fall back to AST-based check when SSA fails
-	return checkGoStmtFromAST(cctx, stmt)
+	return GoStmtResult{OK: checkGoStmtFromAST(cctx, stmt)}
 }
 
 // checkGoStmtFromSSA uses SSA analysis to check if a goroutine captures context.
@@ -74,6 +86,10 @@ func (*GoStmtCapturesCtx) Message(ctxName string) string {
 	return "goroutine does not propagate context \"" + ctxName + "\""
 }
 
+func (*GoStmtCapturesCtx) DeferMessage(_ string) string {
+	return "" // Not applicable for context capture pattern
+}
+
 // checkGoStmtFromAST falls back to AST-based analysis for go statements.
 func checkGoStmtFromAST(cctx *CheckContext, stmt *ast.GoStmt) bool {
 	call := stmt.Call
@@ -263,9 +279,9 @@ func (*GoStmtCallsDeriver) Name() string {
 	return "GoStmtCallsDeriver"
 }
 
-func (p *GoStmtCallsDeriver) CheckGoStmt(cctx *CheckContext, stmt *ast.GoStmt) bool {
+func (p *GoStmtCallsDeriver) CheckGoStmt(cctx *CheckContext, stmt *ast.GoStmt) GoStmtResult {
 	if p.Matcher == nil || p.Matcher.IsEmpty() {
-		return true // No deriver configured
+		return GoStmtResult{OK: true} // No deriver configured
 	}
 
 	call := stmt.Call
@@ -274,22 +290,54 @@ func (p *GoStmtCallsDeriver) CheckGoStmt(cctx *CheckContext, stmt *ast.GoStmt) b
 	if lit, ok := call.Fun.(*ast.FuncLit); ok {
 		// Skip if closure has its own context parameter
 		if funcLitHasContextParam(cctx, lit) {
-			return true
+			return GoStmtResult{OK: true}
 		}
-		return p.Matcher.SatisfiesAnyGroup(cctx.Pass, lit.Body)
+
+		// Try SSA-based check first (detects IIFE, distinguishes defer)
+		if result, ok := p.checkDeriverFromSSA(cctx, lit); ok {
+			return result
+		}
+
+		// Fall back to AST-based check
+		return GoStmtResult{OK: p.Matcher.SatisfiesAnyGroup(cctx.Pass, lit.Body)}
 	}
 
 	// For go fn()() (higher-order), check the factory function
 	if innerCall, ok := call.Fun.(*ast.CallExpr); ok {
-		return p.checkHigherOrderDeriver(cctx, innerCall)
+		return GoStmtResult{OK: p.checkHigherOrderDeriver(cctx, innerCall)}
 	}
 
 	// For go fn() where fn is an identifier, trace the variable
 	if ident, ok := call.Fun.(*ast.Ident); ok {
-		return p.checkIdentDeriver(cctx, ident)
+		return GoStmtResult{OK: p.checkIdentDeriver(cctx, ident)}
 	}
 
-	return true // Can't analyze, assume OK
+	return GoStmtResult{OK: true} // Can't analyze, assume OK
+}
+
+// checkDeriverFromSSA uses SSA analysis to check deriver calls.
+// Returns (result, true) if SSA analysis succeeded, or (GoStmtResult{}, false) if it failed.
+func (p *GoStmtCallsDeriver) checkDeriverFromSSA(cctx *CheckContext, lit *ast.FuncLit) (GoStmtResult, bool) {
+	if cctx.SSAProg == nil || cctx.Tracer == nil {
+		return GoStmtResult{}, false
+	}
+
+	ssaFn := cctx.SSAProg.FindFuncLit(lit)
+	if ssaFn == nil {
+		return GoStmtResult{}, false
+	}
+
+	result := cctx.Tracer.CheckDeriverCalls(ssaFn, p.Matcher)
+
+	if result.FoundAtStart {
+		return GoStmtResult{OK: true}, true
+	}
+
+	if result.FoundOnlyInDefer {
+		return GoStmtResult{OK: false, DeferOnly: true}, true
+	}
+
+	return GoStmtResult{OK: false}, true
 }
 
 // checkIdentDeriver checks go fn() patterns where fn is a variable.
@@ -425,3 +473,7 @@ func (p *GoStmtCallsDeriver) returnedValueCallsDeriver(cctx *CheckContext, resul
 func (p *GoStmtCallsDeriver) Message(_ string) string {
 	return "goroutine should call " + p.Matcher.Original + " to derive context"
 }
+
+func (p *GoStmtCallsDeriver) DeferMessage(_ string) string {
+	return "goroutine calls " + p.Matcher.Original + " in defer, but it should be called at goroutine start"
+}

internal/ssa/tracer.go

@@ -8,6 +8,7 @@ import (
 	"golang.org/x/tools/go/ssa"
 
 	"github.com/mpyw/goroutinectx/internal/directives/carrier"
+	"github.com/mpyw/goroutinectx/internal/directives/deriver"
 	"github.com/mpyw/goroutinectx/internal/typeutil"
 )
 
@@ -369,3 +370,211 @@ func GetContextVars(fn *ssa.Function) []*types.Var {
 
 	return ctxVars
 }
+
+// =============================================================================
+// Deriver Function Detection
+// =============================================================================
+
+// DeriverResult represents the result of deriver function detection.
+type DeriverResult struct {
+	// FoundAtStart indicates the deriver is called at goroutine start (not in defer)
+	FoundAtStart bool
+	// FoundOnlyInDefer indicates the deriver is called, but only in defer statements
+	FoundOnlyInDefer bool
+}
+
+// CheckDeriverCalls checks if a closure calls any of the required deriver functions.
+// It traverses into immediately-invoked function expressions (IIFE) but tracks
+// whether calls are made in defer statements.
+func (t *Tracer) CheckDeriverCalls(closure *ssa.Function, matcher *deriver.Matcher) DeriverResult {
+	if closure == nil || matcher == nil || matcher.IsEmpty() {
+		return DeriverResult{FoundAtStart: true} // No check needed
+	}
+
+	// Collect all function calls with their defer status
+	calls := t.collectDeriverCalls(closure, false, make(map[*ssa.Function]bool))
+
+	// Check if any OR group is satisfied
+	for _, andGroup := range matcher.OrGroups {
+		startResult := t.checkAndGroup(calls, andGroup, false)
+		if startResult {
+			return DeriverResult{FoundAtStart: true}
+		}
+	}
+
+	// Check if deriver is only in defer
+	for _, andGroup := range matcher.OrGroups {
+		deferResult := t.checkAndGroup(calls, andGroup, true)
+		if deferResult {
+			return DeriverResult{FoundOnlyInDefer: true}
+		}
+	}
+
+	return DeriverResult{}
+}
+
+// deriverCall represents a function call with its context (defer or not).
+type deriverCall struct {
+	fn      *types.Func
+	inDefer bool
+}
+
+// collectDeriverCalls collects all function calls in a closure, including IIFE.
+func (t *Tracer) collectDeriverCalls(fn *ssa.Function, inDefer bool, visited map[*ssa.Function]bool) []deriverCall {
+	if fn == nil || visited[fn] {
+		return nil
+	}
+	visited[fn] = true
+
+	var calls []deriverCall
+
+	for _, block := range fn.Blocks {
+		for _, instr := range block.Instrs {
+			switch v := instr.(type) {
+			case *ssa.Call:
+				// Regular function call
+				if calledFn := t.extractCalledFunc(v); calledFn != nil {
+					calls = append(calls, deriverCall{fn: calledFn, inDefer: inDefer})
+				}
+				// Check for IIFE: call where the callee is a MakeClosure
+				if iifeFn := t.extractIIFE(v); iifeFn != nil {
+					// Traverse into the IIFE with the same defer status
+					calls = append(calls, t.collectDeriverCalls(iifeFn, inDefer, visited)...)
+				}
+
+			case *ssa.Defer:
+				// Deferred function call - mark as inDefer
+				if calledFn := t.extractCalledFuncFromCallCommon(&v.Call); calledFn != nil {
+					calls = append(calls, deriverCall{fn: calledFn, inDefer: true})
+				}
+				// Check for deferred IIFE
+				if iifeFn := t.extractIIFEFromCallCommon(&v.Call); iifeFn != nil {
+					// Traverse into the deferred IIFE with inDefer=true
+					calls = append(calls, t.collectDeriverCalls(iifeFn, true, visited)...)
+				}
+			}
+		}
+	}
+
+	return calls
+}
+
+// extractCalledFunc extracts the types.Func from a Call instruction.
+func (t *Tracer) extractCalledFunc(call *ssa.Call) *types.Func {
+	return t.extractCalledFuncFromCallCommon(&call.Call)
+}
+
+// extractCalledFuncFromCallCommon extracts the types.Func from a CallCommon.
+func (t *Tracer) extractCalledFuncFromCallCommon(call *ssa.CallCommon) *types.Func {
+	if call.IsInvoke() {
+		// Interface method call
+		return call.Method
+	}
+
+	// Static call
+	if fn := call.StaticCallee(); fn != nil {
+		if obj, ok := fn.Object().(*types.Func); ok {
+			return obj
+		}
+	}
+
+	return nil
+}
+
+// extractIIFE checks if a Call instruction is an IIFE (immediately invoked function expression).
+// Returns the called function if it's an IIFE, nil otherwise.
+func (t *Tracer) extractIIFE(call *ssa.Call) *ssa.Function {
+	return t.extractIIFEFromCallCommon(&call.Call)
+}
+
+// extractIIFEFromCallCommon checks if a CallCommon is an IIFE.
+func (t *Tracer) extractIIFEFromCallCommon(call *ssa.CallCommon) *ssa.Function {
+	if call.IsInvoke() {
+		return nil
+	}
+
+	// Check if the callee is a MakeClosure
+	if mc, ok := call.Value.(*ssa.MakeClosure); ok {
+		if fn, ok := mc.Fn.(*ssa.Function); ok {
+			return fn
+		}
+	}
+
+	// Check if the callee is a direct function reference
+	if fn, ok := call.Value.(*ssa.Function); ok {
+		// Only count as IIFE if it's an anonymous function (has no name in package scope)
+		if fn.Parent() != nil {
+			return fn
+		}
+	}
+
+	return nil
+}
+
+// checkAndGroup checks if all specs in an AND group are satisfied.
+// If includeDefer is false, only non-defer calls are considered.
+// If includeDefer is true, all calls (including defer) are considered.
+func (t *Tracer) checkAndGroup(calls []deriverCall, andGroup []deriver.FuncSpec, includeDefer bool) bool {
+	for _, spec := range andGroup {
+		found := false
+		for _, call := range calls {
+			if !includeDefer && call.inDefer {
+				continue
+			}
+			if t.matchesSpec(call.fn, spec) {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+	return true
+}
+
+// matchesSpec checks if a types.Func matches the given deriver function spec.
+func (t *Tracer) matchesSpec(fn *types.Func, spec deriver.FuncSpec) bool {
+	if fn == nil {
+		return false
+	}
+
+	if fn.Name() != spec.FuncName {
+		return false
+	}
+
+	if fn.Pkg() == nil || fn.Pkg().Path() != spec.PkgPath {
+		return false
+	}
+
+	if spec.TypeName != "" {
+		return t.matchesMethod(fn, spec.TypeName)
+	}
+
+	return true
+}
+
+// matchesMethod checks if a types.Func is a method on the expected type.
+func (t *Tracer) matchesMethod(fn *types.Func, typeName string) bool {
+	sig, ok := fn.Type().(*types.Signature)
+	if !ok {
+		return false
+	}
+
+	recv := sig.Recv()
+	if recv == nil {
+		return false
+	}
+
+	recvType := recv.Type()
+	if ptr, ok := recvType.(*types.Pointer); ok {
+		recvType = ptr.Elem()
+	}
+
+	named, ok := recvType.(*types.Named)
+	if !ok {
+		return false
+	}
+
+	return named.Obj().Name() == typeName
+}