fix: positional path arg for quality/hotspots, deduplicate hotspots, suppress sarif import noise

[nandanadileep]

Fixes #12 and #13.

Changes

codexa quality . / codexa hotspots . now work (fixes #13)

Both commands previously defined --path as the only way to set the project root. Passing a bare path like . caused Click to reject it with Got unexpected extra argument (.).

Each command now accepts an optional positional DIRECTORY argument. Both of these are equivalent:

codexa quality .
codexa quality --path .

Duplicate hotspot entries de-duplicated (fixes #13)

analyze_hotspots was scoring every Symbol object from get_all_symbols() independently. If the same function was parsed or indexed more than once, it appeared multiple times in the output with identical scores (e.g. test_to_dict repeated in tests/test_phase20.py).

Symbols are now deduplicated by (file_path, name) before scoring, so each unique symbol appears exactly once.

Spurious SARIF error suppressed (fixes #12)

Bandit eagerly loads all its formatters at import time, including a SARIF formatter that requires the optional sarif_om package. When sarif_om is absent, bandit emits:

ERROR    Could not load 'sarif': No module named 'sarif_om'

This appeared on every codexa quality / codexa hotspots run regardless of whether SARIF output was requested.

The fix adds a temporary logging.Filter to the bandit logger around the import, removing it immediately after. Genuine bandit errors are still surfaced; only this specific optional-dependency message is suppressed.

Test plan

• codexa quality . runs without "Got unexpected extra argument" error
• codexa hotspots . runs without "Got unexpected extra argument" error
• codexa quality --path . still works (backward compatible)
• codexa hotspots output shows each symbol at most once
• No ERROR Could not load 'sarif' message on codexa quality without sarif_om installed
• codexa quality --sarif (if/when added) still shows a clear hint when sarif_om is missing

[Copilot]

Pull request overview

This PR fixes codexa quality / codexa hotspots CLI ergonomics and reduces noisy output by accepting a positional directory argument, deduplicating hotspot symbol entries, and suppressing an optional Bandit SARIF import log.

Changes:

• Add optional positional DIRECTORY argument to codexa quality and codexa hotspots (while keeping --path).
• Deduplicate hotspot scoring inputs to avoid repeated entries for the same symbol.
• Suppress Bandit’s “Could not load 'sarif'” log during import when sarif_om is not installed.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
semantic_code_intelligence/cli/commands/quality_cmd.py	Adds optional positional directory arg and uses it to select the analysis root.
semantic_code_intelligence/cli/commands/hotspots_cmd.py	Adds optional positional directory arg and uses it to select the analysis root.
semantic_code_intelligence/ci/quality.py	Adds a temporary logging filter around Bandit import to suppress SARIF optional-dependency noise.
semantic_code_intelligence/ci/hotspots.py	Deduplicates callable symbols before scoring to prevent repeated hotspot entries.

[M9nx]

Hi @nandanadileep , Appreciate the fix and improvements here. Changes look solid and tested — proceeding to close this PR. Thanks!